TugQL is DataTug's query language for sources, joins, filters, and columns. It is not a SQL dialect. datatug query run is the command that reads rows. A whole collection uses --from. A TugQL document uses -f or --file. Raw SQL text in that file fails with invalid TugQL. A saved library query uses --project and --query instead of --db.
This recorded command reads every row and field of Shippers from a local SQLite file and prints JSON. --no-policies runs without a DataTug access policy:
datatug query run --db "sqlite://$PWD/northwind.sqlite" --from Shippers --no-policies --format json
--db takes sqlite://, ingitdb://, http://, or https://, or env:NAME when that name holds a PostgreSQL, MySQL, Oracle, or SQL Server address in an environment variable. An HTTP (Hypertext Transfer Protocol) or HTTPS (HTTP Secure) address points at a local project directory of saved HTTP queries, not at an arbitrary remote URL (uniform resource locator). One --db address is one source. It does not join PostgreSQL and MySQL by itself.
A saved query can be SQL, TugQL, or HTTP, according to the query file. The CLI reference runs one like this:
datatug query run --project demo-project-1 --query customers/customer-invoices \
--env local --as boss --role admin --var CustomerId=5
A saved query whose type is SQL is opaque text. It needs its own opaqueQuery: true grant. The reference names customers/customer-purchases-by-genre as a verified SQL-type run of that kind. Row filters and column allow-lists are not applied to native SQL. See Native SQL access policies.
The supported databases catalogue lists SQLite, PostgreSQL, MySQL, Oracle, and SQL Server as command-line sources for read-only SQL and TugQL, with schema scan implemented. A server read on PostgreSQL, MySQL, Oracle, and SQL Server requires unrestricted access, which the CLI calls --no-policies. Do not assume row or column policy enforcement on those engines. --no-policies skips DataTug's access policy. It does not take write permission away from the database login. Use a login that can only read. The catalogue's browser and hosted column says "Not verified by this catalogue" on each row.
Not every catalogue row accepts SQL text. Query Firestore with SQL is a CLI path that rejects SQL. The catalogue is the operation-by-operation list, including sources whose query path is TugQL only.