@bytebase/dbhub 1.3.1 → 1.5.0

package/dist/{sqlserver-AJUK6L55.js → sqlserver-25MAE77Q.js}

@@ -8,13 +8,13 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-YIGJHEU6.js";
+} from "./chunk-X5OCFRNL.js";
 import {
   sqlServerDynamicSqlKeywords,
   sqlServerDynamicSqlPattern,
   sqlServerPassThroughKeywords,
   sqlServerPassThroughPattern
-} from "./chunk-ABTVMHD6.js";
+} from "./chunk-55X2VY5D.js";
 import {
   ConnectorRegistry,
   LEADING_SQL_NOISE,
@@ -25,7 +25,234 @@ import {
 } from "./chunk-IXC4NQGC.js";
 
 // src/connectors/sqlserver/index.ts
+import sql3 from "mssql";
+
+// src/connectors/sqlserver/request-helpers.ts
 import sql from "mssql";
+function bindParameters(request, parameters) {
+  if (!parameters || parameters.length === 0) {
+    return;
+  }
+  parameters.forEach((param, index) => {
+    const paramName = `p${index + 1}`;
+    if (typeof param === "string") {
+      request.input(paramName, sql.VarChar, param);
+    } else if (typeof param === "number") {
+      if (Number.isInteger(param)) {
+        request.input(paramName, sql.Int, param);
+      } else {
+        request.input(paramName, sql.Float, param);
+      }
+    } else if (typeof param === "boolean") {
+      request.input(paramName, sql.Bit, param);
+    } else if (param === null || param === void 0) {
+      request.input(paramName, sql.VarChar, param);
+    } else if (Array.isArray(param)) {
+      request.input(paramName, sql.VarChar, JSON.stringify(param));
+    } else {
+      request.input(paramName, sql.VarChar, JSON.stringify(param));
+    }
+  });
+}
+function assertNoReadOnlyEscapes(sqlText, { transactionControl = false } = {}) {
+  const cleaned = stripCommentsAndStrings(sqlText, "sqlserver").toLowerCase();
+  if (transactionControl && /\b(?:commit|rollback)\b/.test(cleaned)) {
+    throw new Error(
+      "Read-only mode: transaction control statements (COMMIT, ROLLBACK) are not allowed"
+    );
+  }
+  if (sqlServerDynamicSqlPattern.test(cleaned)) {
+    throw new Error(
+      `Read-only mode: dynamic SQL execution (${sqlServerDynamicSqlKeywords.map((k) => k.toUpperCase()).join(", ")}) is not allowed`
+    );
+  }
+  if (sqlServerPassThroughPattern.test(cleaned)) {
+    throw new Error(
+      `Read-only mode: pass-through data sources (${sqlServerPassThroughKeywords.map((k) => k.toUpperCase()).join(", ")}) are not allowed`
+    );
+  }
+}
+
+// src/connectors/sqlserver/explain.ts
+import sql2 from "mssql";
+var EXPLAIN_ON = /^(?:true|on|1)$/i;
+var EXPLAIN_OFF = /^(?:false|off|0)$/i;
+var EXPLAIN_OPTION = /^([A-Za-z_]+)(?:(?:\s*=\s*|\s+)(\S+))?$/;
+var EXPLAIN_BARE_DISABLED = /^(?:=\s*)?(?:false|off|0)\b/i;
+async function explainQuery(config, innerQuery, readonly, parameters) {
+  const cleaned = stripCommentsAndStrings(innerQuery, "sqlserver").trim();
+  if (!cleaned) {
+    throw new Error("EXPLAIN requires a statement to analyze");
+  }
+  if (readonly) {
+    assertNoReadOnlyEscapes(innerQuery);
+  }
+  if (/\bset\s+showplan/i.test(cleaned)) {
+    throw new Error("EXPLAIN does not support SET SHOWPLAN statements");
+  }
+  const explainPool = new sql2.ConnectionPool({
+    ...config,
+    pool: { ...config.pool, max: 1, min: 1 }
+  });
+  try {
+    await explainPool.connect();
+    await explainPool.request().batch("SET SHOWPLAN_XML ON");
+    const planRequest = explainPool.request();
+    bindParameters(planRequest, parameters);
+    const planResult = await planRequest.batch(innerQuery);
+    const planRow = planResult.recordset?.[0];
+    const planXml = planRow ? Object.values(planRow)[0] : null;
+    return {
+      resultSets: [
+        {
+          rows: planXml != null ? [{ plan: planXml }] : [],
+          rowCount: planXml != null ? 1 : 0
+        }
+      ]
+    };
+  } catch (error) {
+    throw new Error(`Failed to explain query: ${error.message}`);
+  } finally {
+    await explainPool.close();
+  }
+}
+function parseExplainPrefix(afterExplain) {
+  if (afterExplain.startsWith("(")) {
+    const close = afterExplain.indexOf(")");
+    if (close < 0) {
+      throw new Error("EXPLAIN option list is missing its closing ')'");
+    }
+    let analyze = false;
+    for (const part of afterExplain.slice(1, close).split(",")) {
+      const token = part.trim();
+      if (!token) continue;
+      const parsed = EXPLAIN_OPTION.exec(token);
+      if (!parsed) {
+        throw new Error(
+          `EXPLAIN option '${token}' is not supported on SQL Server \u2014 only ANALYZE is.`
+        );
+      }
+      const name = parsed[1];
+      if (!/^analyze$/i.test(name)) {
+        throw new Error(
+          `EXPLAIN option '${name}' is not supported on SQL Server \u2014 only ANALYZE is.`
+        );
+      }
+      const value = parsed[2];
+      if (value === void 0 || EXPLAIN_ON.test(value)) {
+        analyze = true;
+      } else if (EXPLAIN_OFF.test(value)) {
+        analyze = false;
+      } else {
+        throw new Error(`EXPLAIN option 'ANALYZE' expects a boolean, got '${value}'.`);
+      }
+    }
+    return { analyze, query: afterExplain.slice(close + 1).trim() };
+  }
+  const analyzeKeyword = /^analyze\b/i.exec(afterExplain);
+  if (!analyzeKeyword) {
+    return { analyze: false, query: afterExplain };
+  }
+  const rest = afterExplain.slice(analyzeKeyword[0].length).trim();
+  const disabled = EXPLAIN_BARE_DISABLED.exec(rest);
+  if (disabled) {
+    return { analyze: false, query: rest.slice(disabled[0].length).trim() };
+  }
+  const trailing = /^([A-Za-z_]+)\b/.exec(rest);
+  if (trailing && /^verbose$/i.test(trailing[1])) {
+    throw new Error(
+      "EXPLAIN option 'VERBOSE' is not supported on SQL Server \u2014 only ANALYZE is."
+    );
+  }
+  return { analyze: true, query: rest };
+}
+async function explainAnalyzeQuery(config, innerQuery, options, parameters) {
+  const cleaned = stripCommentsAndStrings(innerQuery, "sqlserver").trim();
+  if (!cleaned) {
+    throw new Error("EXPLAIN ANALYZE requires a statement to analyze");
+  }
+  if (/\bset\s+statistics\b/i.test(cleaned)) {
+    throw new Error("EXPLAIN ANALYZE does not support SET STATISTICS statements");
+  }
+  if (/\bset\s+showplan\b/i.test(cleaned)) {
+    throw new Error("EXPLAIN ANALYZE does not support SET SHOWPLAN statements");
+  }
+  if (options.readonly) {
+    assertNoReadOnlyEscapes(innerQuery, { transactionControl: true });
+  }
+  const explainPool = new sql2.ConnectionPool({
+    ...config,
+    pool: { ...config.pool, max: 1, min: 1 }
+  });
+  try {
+    await explainPool.connect();
+    await explainPool.request().batch("SET STATISTICS XML ON");
+    let planResult;
+    if (options.readonly) {
+      planResult = await batchRolledBack(
+        explainPool,
+        innerQuery,
+        parameters
+      );
+    } else {
+      const planRequest = explainPool.request();
+      bindParameters(planRequest, parameters);
+      planResult = await planRequest.batch(innerQuery);
+    }
+    const planXml = extractPlanXml(planResult);
+    return {
+      resultSets: [
+        {
+          rows: planXml != null ? [{ plan: planXml }] : [],
+          rowCount: planXml != null ? 1 : 0
+        }
+      ]
+    };
+  } catch (error) {
+    throw new Error(`Failed to explain analyze query: ${error.message}`);
+  } finally {
+    await explainPool.close();
+  }
+}
+async function batchRolledBack(pool, innerQuery, parameters) {
+  const transaction = new sql2.Transaction(pool);
+  await transaction.begin();
+  let queryFailed = false;
+  try {
+    const request = new sql2.Request(transaction);
+    bindParameters(request, parameters);
+    return await request.batch(innerQuery);
+  } catch (error) {
+    queryFailed = true;
+    throw error;
+  } finally {
+    try {
+      await transaction.rollback();
+    } catch (rollbackError) {
+      if (!queryFailed) {
+        throw new Error(
+          `Read-only rollback failed \u2014 data may have been modified: ${rollbackError.message}`
+        );
+      }
+    }
+  }
+}
+function extractPlanXml(result) {
+  const recordsets = result.recordsets ?? [];
+  for (let i = recordsets.length - 1; i >= 0; i--) {
+    const firstRow = recordsets[i]?.[0];
+    if (!firstRow) continue;
+    const values = Object.values(firstRow);
+    if (values.length !== 1) continue;
+    const value = values[0];
+    if (typeof value === "string" && value.includes("<ShowPlanXML")) {
+      return value;
+    }
+  }
+  return null;
+}
+
+// src/connectors/sqlserver/index.ts
 var SQLServerDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
@@ -40,13 +267,16 @@ Expected: ${expectedFormat}`
       );
     }
     try {
+      const queryStart = dsn.indexOf("?");
+      const sslmodes = new URLSearchParams(queryStart === -1 ? "" : dsn.substring(queryStart + 1)).getAll("sslmode");
+      if (sslmodes.length > 1 || sslmodes.length === 1 && !["disable", "require", "verify-full"].includes(sslmodes[0])) {
+        throw new Error("Invalid sslmode. Specify exactly one value: disable, require, verify-full");
+      }
       const url = new SafeURL(dsn);
-      const options = {};
+      const options = { sslmode: sslmodes[0] };
       url.forEachSearchParam((value, key) => {
         if (key === "authentication") {
           options.authentication = value;
-        } else if (key === "sslmode") {
-          options.sslmode = value;
         } else if (key === "instanceName") {
           options.instanceName = value;
         } else if (key === "domain") {
@@ -66,6 +296,9 @@ Expected: ${expectedFormat}`
         } else if (options.sslmode === "require") {
           options.encrypt = true;
           options.trustServerCertificate = true;
+        } else if (options.sslmode === "verify-full") {
+          options.encrypt = true;
+          options.trustServerCertificate = false;
         }
       }
       const config2 = {
@@ -169,7 +402,7 @@ var _SQLServerConnector = class _SQLServerConnector {
       if (!this.config.options) {
         this.config.options = {};
       }
-      this.connection = new sql.ConnectionPool(this.config);
+      this.connection = new sql3.ConnectionPool(this.config);
       await this.connection.connect();
     } catch (error) {
       if (this.connection) {
@@ -207,7 +440,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT TABLE_NAME
           FROM INFORMATION_SCHEMA.TABLES
@@ -227,7 +460,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT TABLE_NAME
           FROM INFORMATION_SCHEMA.TABLES
@@ -247,7 +480,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("tableName", sql.VarChar, tableName).input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("tableName", sql3.VarChar, tableName).input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT COUNT(*) as count
           FROM INFORMATION_SCHEMA.TABLES
@@ -266,7 +499,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("tableName", sql.VarChar, tableName).input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("tableName", sql3.VarChar, tableName).input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT i.name AS index_name,
                  i.is_unique,
@@ -324,7 +557,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("tableName", sql.VarChar, tableName).input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("tableName", sql3.VarChar, tableName).input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT c.COLUMN_NAME as    column_name,
                  c.DATA_TYPE as      data_type,
@@ -358,7 +591,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("tableName", sql.VarChar, tableName).input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("tableName", sql3.VarChar, tableName).input("schema", sql3.VarChar, schemaToUse);
       const query = `
           SELECT ep.value as table_comment
           FROM sys.extended_properties ep
@@ -459,7 +692,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("schema", sql3.VarChar, schemaToUse);
       let typeFilter;
       if (routineType === "function") {
         typeFilter = "AND ROUTINE_TYPE = 'FUNCTION'";
@@ -487,7 +720,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     try {
       const schemaToUse = schema || "dbo";
-      const request = this.connection.request().input("procedureName", sql.VarChar, procedureName).input("schema", sql.VarChar, schemaToUse);
+      const request = this.connection.request().input("procedureName", sql3.VarChar, procedureName).input("schema", sql3.VarChar, schemaToUse);
       const routineQuery = `
           SELECT ROUTINE_NAME as procedure_name,
                  ROUTINE_TYPE,
@@ -549,35 +782,41 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
   }
   async executeSQL(sqlQuery, options, parameters) {
-    if (!this.connection) {
+    if (!this.connection || !this.config) {
       throw new Error("Not connected to SQL Server database");
     }
     const afterNoise = sqlQuery.replace(LEADING_SQL_NOISE, "");
     if (/^explain\b/i.test(afterNoise)) {
-      const { analyze, query } = _SQLServerConnector.parseExplainPrefix(
+      const { analyze, query } = parseExplainPrefix(
         afterNoise.slice("explain".length).trim()
       );
-      return analyze ? this.explainAnalyzeQuery(query, options, parameters) : this.explainQuery(query, options.readonly, parameters);
+      return analyze ? explainAnalyzeQuery(this.config, query, options, parameters) : explainQuery(this.config, query, options.readonly, parameters);
     }
     try {
+      const statements = splitSQLStatements(sqlQuery, "sqlserver");
+      const isSingleStatement = statements.length === 1;
       let processedSQL = sqlQuery;
-      let probeApplied = false;
       if (options.maxRows) {
-        const rewrite = SQLRowLimiter.applyMaxRowsForSQLServerWithTruncationProbe(
-          sqlQuery,
-          options.maxRows
-        );
-        processedSQL = rewrite.sql;
-        probeApplied = rewrite.probeApplied;
+        const maxRows = options.maxRows;
+        if (isSingleStatement) {
+          processedSQL = SQLRowLimiter.applyMaxRowsForSQLServerWithTruncationProbe(sqlQuery, maxRows).sql;
+        } else {
+          const terminator = sqlQuery.trimEnd().endsWith(";") ? "\n;" : "";
+          const moduleStart = statements.findIndex(
+            (statement) => _SQLServerConnector.MODULE_DEFINITION.test(stripCommentsAndStrings(statement, "sqlserver"))
+          );
+          const rewritable = moduleStart === -1 ? statements.length : moduleStart;
+          processedSQL = statements.map(
+            (statement, i) => i < rewritable ? SQLRowLimiter.applyMaxRowsForSQLServerWithTruncationProbe(statement, maxRows).sql : statement
+          ).join("\n;\n") + terminator;
+        }
       }
-      const isSingleStatement = splitSQLStatements(processedSQL, "sqlserver").length === 1;
       if (options.readonly) {
         return await this.executeReadOnly(
           processedSQL,
           parameters,
           isSingleStatement ? sqlQuery : void 0,
-          options.maxRows,
-          probeApplied
+          options.maxRows
         );
       }
       const request = this.connection.request();
@@ -594,16 +833,14 @@ var _SQLServerConnector = class _SQLServerConnector {
           });
         }
       );
-      _SQLServerConnector.bindParameters(request, parameters);
+      bindParameters(request, parameters);
       const result = await request.query(processedSQL);
       const resultSets = _SQLServerConnector.buildResultSets(
         result.recordsets,
         result.rowsAffected,
-        isSingleStatement ? sqlQuery : void 0
+        isSingleStatement ? sqlQuery : void 0,
+        options.maxRows
       );
-      if (resultSets.length > 0) {
-        SQLRowLimiter.flagTruncation(resultSets[0], options.maxRows, probeApplied);
-      }
       return {
         resultSets,
         ...messages.length > 0 ? { messages } : {}
@@ -613,28 +850,18 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
   }
   /**
-   * Builds one result set per SELECT-producing statement in the batch, plus
-   * (if any) a trailing result set summarizing the write-only statements.
-   *
-   * node-mssql only pushes a `recordsets` entry for statements that produce
-   * columns (SELECT); INSERT/UPDATE/DELETE statements in the same batch
-   * contribute to `rowsAffected` only, with no way to recover which
-   * `rowsAffected` entry belongs to which statement from the driver's final
-   * arrays (`recordsets`/`rowsAffected` aren't index-aligned - see the
-   * tedious `doneHandler`, which always pushes to `rowsAffected` but only
-   * conditionally to `recordsets`). So a batch of pure writes collapses to a
-   * single summed result set, and a batch mixing writes with selects gets
-   * one result set per select plus one trailing "writes" set for the rest -
-   * not a truly per-statement breakdown, but no read statement's rows are
-   * ever merged with another's, which is what mattered for #380.
-   *
-   * `sourceSql`, when given, is attributed to the single resulting set - it
-   * must be omitted (pass `undefined`) unless the caller has already
-   * confirmed the batch is unambiguously one statement, since for a genuine
-   * multi-statement batch there's no reliable way to say which source
-   * statement a given recordset (or the trailing writes set) came from.
+   * Builds one result set per recordset. With `maxRows`, every set is capped:
+   * a statement the TOP/FETCH probe rewrite reached returns at most
+   * maxRows + 1 rows, and more than maxRows rows means the cap fired, so the
+   * probe row is dropped and the set flagged truncated. The same check also
+   * bounds result sets the rewrite could not reach (a stored procedure's
+   * output, say): those are trimmed to maxRows and flagged the same way. A
+   * statement whose own TOP/FETCH is within the cap never exceeds maxRows
+   * rows, so it is never flagged. Recordsets do not map 1:1 onto statements
+   * (a SELECT ... INTO returns none, an EXEC may return several), which is
+   * why the check is per result set rather than per rewritten statement.
    */
-  static buildResultSets(recordsets, rowsAffected, sourceSql) {
+  static buildResultSets(recordsets, rowsAffected, sourceSql, maxRows) {
     const sets = (recordsets ?? []).map((recordset) => {
       const rows = recordset ?? [];
       return { rows, rowCount: rows.length };
@@ -642,6 +869,9 @@ var _SQLServerConnector = class _SQLServerConnector {
     const totalAffected = (rowsAffected ?? []).reduce((total, count) => total + (count ?? 0), 0);
     const accountedFor = sets.reduce((total, set) => total + set.rowCount, 0);
     const writesOnly = totalAffected - accountedFor;
+    for (const set of sets) {
+      SQLRowLimiter.flagTruncation(set, maxRows, true);
+    }
     if (sets.length === 0) {
       sets.push({ rows: [], rowCount: totalAffected });
     } else if (writesOnly > 0) {
@@ -652,78 +882,6 @@ var _SQLServerConnector = class _SQLServerConnector {
     }
     return sets;
   }
-  /**
-   * Bind positional parameters as @p1, @p2, ... inferring the SQL Server type
-   * from each JavaScript value. Shared by every execution path so they cannot
-   * drift in how a given value is typed.
-   *
-   * Works for `batch` as well as `query`: node-mssql prepends the matching
-   * DECLARE/SET statements when the request is a batch.
-   */
-  static bindParameters(request, parameters) {
-    if (!parameters || parameters.length === 0) {
-      return;
-    }
-    parameters.forEach((param, index) => {
-      const paramName = `p${index + 1}`;
-      if (typeof param === "string") {
-        request.input(paramName, sql.VarChar, param);
-      } else if (typeof param === "number") {
-        if (Number.isInteger(param)) {
-          request.input(paramName, sql.Int, param);
-        } else {
-          request.input(paramName, sql.Float, param);
-        }
-      } else if (typeof param === "boolean") {
-        request.input(paramName, sql.Bit, param);
-      } else if (param === null || param === void 0) {
-        request.input(paramName, sql.VarChar, param);
-      } else if (Array.isArray(param)) {
-        request.input(paramName, sql.VarChar, JSON.stringify(param));
-      } else {
-        request.input(paramName, sql.VarChar, JSON.stringify(param));
-      }
-    });
-  }
-  /**
-   * Reject the constructs that escape SQL Server's read-only guards, for use by
-   * both read-only execution paths.
-   *
-   * - Dynamic SQL (sqlServerDynamicSqlKeywords): can carry hidden COMMIT/ROLLBACK
-   *   inside string literals that stripCommentsAndStrings removes
-   * - Pass-through data sources (sqlServerPassThroughKeywords): execute on a
-   *   remote or ad-hoc source, so a local rollback never reaches them
-   * - COMMIT/ROLLBACK, when `transactionControl` is set: would end the wrapping
-   *   transaction, letting writes persist. Only meaningful for the transaction
-   *   path; the EXPLAIN path opens no transaction of its own.
-   *
-   * Both keyword lists are imported from the read-only classifier rather than
-   * redeclared, so the classifier and these backstops cannot drift apart.
-   *
-   * Note the COMMIT/ROLLBACK check is SQL Server-only by design. MySQL/MariaDB
-   * wrap batches in a transaction too, but there `commit`, `prepare` and
-   * `execute` are absent from their allow-lists in allowedKeywords, and
-   * execute-sql.ts requires every split statement to pass the classifier — so a
-   * transaction-control statement can never reach their backstop.
-   */
-  assertNoReadOnlyEscapes(sqlText, { transactionControl = false } = {}) {
-    const cleaned = stripCommentsAndStrings(sqlText, "sqlserver").toLowerCase();
-    if (transactionControl && /\b(?:commit|rollback)\b/.test(cleaned)) {
-      throw new Error(
-        "Read-only mode: transaction control statements (COMMIT, ROLLBACK) are not allowed"
-      );
-    }
-    if (sqlServerDynamicSqlPattern.test(cleaned)) {
-      throw new Error(
-        `Read-only mode: dynamic SQL execution (${sqlServerDynamicSqlKeywords.map((k) => k.toUpperCase()).join(", ")}) is not allowed`
-      );
-    }
-    if (sqlServerPassThroughPattern.test(cleaned)) {
-      throw new Error(
-        `Read-only mode: pass-through data sources (${sqlServerPassThroughKeywords.map((k) => k.toUpperCase()).join(", ")}) are not allowed`
-      );
-    }
-  }
   /**
    * Execute a query inside a transaction that always rolls back, preventing
    * any modifications from persisting. SQL Server has no native READ ONLY
@@ -733,11 +891,11 @@ var _SQLServerConnector = class _SQLServerConnector {
    * Dangerous constructs are rejected before the transaction opens; see
    * assertNoReadOnlyEscapes.
    */
-  async executeReadOnly(processedSQL, parameters, sourceSql, maxRows, probeApplied) {
-    this.assertNoReadOnlyEscapes(processedSQL, { transactionControl: true });
-    const transaction = new sql.Transaction(this.connection);
+  async executeReadOnly(processedSQL, parameters, sourceSql, maxRows) {
+    assertNoReadOnlyEscapes(processedSQL, { transactionControl: true });
+    const transaction = new sql3.Transaction(this.connection);
     await transaction.begin();
-    const request = new sql.Request(transaction);
+    const request = new sql3.Request(transaction);
     const messages = [];
     request.on(
       "info",
@@ -750,7 +908,7 @@ var _SQLServerConnector = class _SQLServerConnector {
         });
       }
     );
-    _SQLServerConnector.bindParameters(request, parameters);
+    bindParameters(request, parameters);
     let result;
     let queryFailed = false;
     try {
@@ -772,257 +930,39 @@ var _SQLServerConnector = class _SQLServerConnector {
     const resultSets = _SQLServerConnector.buildResultSets(
       result.recordsets,
       result.rowsAffected,
-      sourceSql
+      sourceSql,
+      maxRows
     );
-    if (resultSets.length > 0) {
-      SQLRowLimiter.flagTruncation(resultSets[0], maxRows, probeApplied);
-    }
     return {
       resultSets,
       ...messages.length > 0 ? { messages } : {}
     };
   }
-  /**
-   * Return the estimated execution plan for a query using SHOWPLAN_XML.
-   *
-   * SHOWPLAN_XML compiles the statement and returns its plan without executing
-   * it, but it has two constraints: `SET SHOWPLAN_XML ON` must be the only
-   * statement in its batch, and the setting is session scoped. The shared pool
-   * hands out a fresh connection per request() and an open transaction
-   * suppresses SHOWPLAN, so neither can carry the setting to a follow-up query.
-   *
-   * We therefore run the SET / query pair on a short-lived, single-connection
-   * pool built from the same config. The dedicated session keeps SHOWPLAN state
-   * off the shared pool, so a concurrent query can never land on a connection
-   * with SHOWPLAN enabled (which would return a plan instead of its results).
-   */
-  async explainQuery(innerQuery, readonly, parameters) {
-    const cleaned = stripCommentsAndStrings(innerQuery, "sqlserver").trim();
-    if (!cleaned) {
-      throw new Error("EXPLAIN requires a statement to analyze");
-    }
-    if (readonly) {
-      this.assertNoReadOnlyEscapes(innerQuery);
-    }
-    if (/\bset\s+showplan/i.test(cleaned)) {
-      throw new Error("EXPLAIN does not support SET SHOWPLAN statements");
-    }
-    if (!this.config) {
-      throw new Error("Not connected to SQL Server database");
-    }
-    const explainPool = new sql.ConnectionPool({
-      ...this.config,
-      pool: { ...this.config.pool, max: 1, min: 1 }
-    });
-    try {
-      await explainPool.connect();
-      await explainPool.request().batch("SET SHOWPLAN_XML ON");
-      const planRequest = explainPool.request();
-      _SQLServerConnector.bindParameters(planRequest, parameters);
-      const planResult = await planRequest.batch(innerQuery);
-      const planRow = planResult.recordset?.[0];
-      const planXml = planRow ? Object.values(planRow)[0] : null;
-      return {
-        resultSets: [
-          {
-            rows: planXml != null ? [{ plan: planXml }] : [],
-            rowCount: planXml != null ? 1 : 0
-          }
-        ]
-      };
-    } catch (error) {
-      throw new Error(`Failed to explain query: ${error.message}`);
-    } finally {
-      await explainPool.close();
-    }
-  }
-  /**
-   * Splits the modifiers between EXPLAIN and its statement, covering the same
-   * forms the read-only classifier recognises (see utils/allowed-keywords.ts):
-   * `ANALYZE`, `ANALYZE VERBOSE`, `(ANALYZE)`, `(ANALYZE, BUFFERS)`,
-   * `(ANALYZE false)`.
-   *
-   * Only ANALYZE carries a meaning here — it selects STATISTICS XML over
-   * SHOWPLAN_XML. The rest are PostgreSQL planner knobs with no SQL Server
-   * counterpart, so they are refused by name: silently dropping an option would
-   * quietly hand back something other than what was asked for.
-   */
-  static parseExplainPrefix(afterExplain) {
-    if (afterExplain.startsWith("(")) {
-      const close = afterExplain.indexOf(")");
-      if (close < 0) {
-        throw new Error("EXPLAIN option list is missing its closing ')'");
-      }
-      let analyze = false;
-      for (const part of afterExplain.slice(1, close).split(",")) {
-        const token = part.trim();
-        if (!token) continue;
-        const parsed = _SQLServerConnector.EXPLAIN_OPTION.exec(token);
-        if (!parsed) {
-          throw new Error(
-            `EXPLAIN option '${token}' is not supported on SQL Server \u2014 only ANALYZE is.`
-          );
-        }
-        const name = parsed[1];
-        if (!/^analyze$/i.test(name)) {
-          throw new Error(
-            `EXPLAIN option '${name}' is not supported on SQL Server \u2014 only ANALYZE is.`
-          );
-        }
-        const value = parsed[2];
-        if (value === void 0 || _SQLServerConnector.EXPLAIN_ON.test(value)) {
-          analyze = true;
-        } else if (_SQLServerConnector.EXPLAIN_OFF.test(value)) {
-          analyze = false;
-        } else {
-          throw new Error(`EXPLAIN option 'ANALYZE' expects a boolean, got '${value}'.`);
-        }
-      }
-      return { analyze, query: afterExplain.slice(close + 1).trim() };
-    }
-    const analyzeKeyword = /^analyze\b/i.exec(afterExplain);
-    if (!analyzeKeyword) {
-      return { analyze: false, query: afterExplain };
-    }
-    const rest = afterExplain.slice(analyzeKeyword[0].length).trim();
-    const disabled = _SQLServerConnector.EXPLAIN_BARE_DISABLED.exec(rest);
-    if (disabled) {
-      return { analyze: false, query: rest.slice(disabled[0].length).trim() };
-    }
-    const trailing = /^([A-Za-z_]+)\b/.exec(rest);
-    if (trailing && /^verbose$/i.test(trailing[1])) {
-      throw new Error(
-        "EXPLAIN option 'VERBOSE' is not supported on SQL Server \u2014 only ANALYZE is."
-      );
-    }
-    return { analyze: true, query: rest };
-  }
-  /**
-   * Run a statement under SET STATISTICS XML and return its *actual* execution
-   * plan — the Postgres `EXPLAIN ANALYZE` contract.
-   *
-   * SHOWPLAN_XML (plain EXPLAIN) compiles without executing, so its plan carries
-   * only estimates. STATISTICS XML runs the statement, so the plan reports real
-   * row counts and execution counts. The flip side is that this path is *not*
-   * inherently read-only the way explainQuery is, so under `options.readonly` the
-   * statement runs inside a transaction that always rolls back.
-   *
-   * The dedicated single-connection pool serves the same purpose as in
-   * explainQuery: the STATISTICS XML session toggle must never leak onto a
-   * shared pool connection, where a concurrent query would inherit it.
-   */
-  async explainAnalyzeQuery(innerQuery, options, parameters) {
-    const cleaned = stripCommentsAndStrings(innerQuery, "sqlserver").trim();
-    if (!cleaned) {
-      throw new Error("EXPLAIN ANALYZE requires a statement to analyze");
-    }
-    if (/\bset\s+statistics\b/i.test(cleaned)) {
-      throw new Error("EXPLAIN ANALYZE does not support SET STATISTICS statements");
-    }
-    if (/\bset\s+showplan\b/i.test(cleaned)) {
-      throw new Error("EXPLAIN ANALYZE does not support SET SHOWPLAN statements");
-    }
-    if (options.readonly) {
-      this.assertNoReadOnlyEscapes(innerQuery, { transactionControl: true });
-    }
-    if (!this.config) {
-      throw new Error("Not connected to SQL Server database");
-    }
-    const explainPool = new sql.ConnectionPool({
-      ...this.config,
-      pool: { ...this.config.pool, max: 1, min: 1 }
-    });
-    try {
-      await explainPool.connect();
-      await explainPool.request().batch("SET STATISTICS XML ON");
-      let planResult;
-      if (options.readonly) {
-        planResult = await _SQLServerConnector.batchRolledBack(
-          explainPool,
-          innerQuery,
-          parameters
-        );
-      } else {
-        const planRequest = explainPool.request();
-        _SQLServerConnector.bindParameters(planRequest, parameters);
-        planResult = await planRequest.batch(innerQuery);
-      }
-      const planXml = _SQLServerConnector.extractPlanXml(planResult);
-      return {
-        resultSets: [
-          {
-            rows: planXml != null ? [{ plan: planXml }] : [],
-            rowCount: planXml != null ? 1 : 0
-          }
-        ]
-      };
-    } catch (error) {
-      throw new Error(`Failed to explain analyze query: ${error.message}`);
-    } finally {
-      await explainPool.close();
-    }
-  }
-  /**
-   * Run a batch inside a transaction that is always rolled back, so EXPLAIN
-   * ANALYZE can report a real plan without letting the statement's writes stick.
-   */
-  static async batchRolledBack(pool, innerQuery, parameters) {
-    const transaction = new sql.Transaction(pool);
-    await transaction.begin();
-    let queryFailed = false;
-    try {
-      const request = new sql.Request(transaction);
-      _SQLServerConnector.bindParameters(request, parameters);
-      return await request.batch(innerQuery);
-    } catch (error) {
-      queryFailed = true;
-      throw error;
-    } finally {
-      try {
-        await transaction.rollback();
-      } catch (rollbackError) {
-        if (!queryFailed) {
-          throw new Error(
-            `Read-only rollback failed \u2014 data may have been modified: ${rollbackError.message}`
-          );
-        }
-      }
-    }
-  }
-  /**
-   * Pull the ShowPlanXML document out of a STATISTICS XML result.
-   *
-   * STATISTICS XML interleaves each statement's plan with that statement's own
-   * result sets, so the plan sits at no fixed index — and `recordset` (singular)
-   * would hand back the statement's data instead. Scan from the end for the
-   * first single-column row holding a plan document.
-   */
-  static extractPlanXml(result) {
-    const recordsets = result.recordsets ?? [];
-    for (let i = recordsets.length - 1; i >= 0; i--) {
-      const firstRow = recordsets[i]?.[0];
-      if (!firstRow) continue;
-      const values = Object.values(firstRow);
-      if (values.length !== 1) continue;
-      const value = values[0];
-      if (typeof value === "string" && value.includes("<ShowPlanXML")) {
-        return value;
-      }
-    }
-    return null;
-  }
 };
-/** Boolean spellings PostgreSQL accepts for an EXPLAIN option. */
-_SQLServerConnector.EXPLAIN_ON = /^(?:true|on|1)$/i;
-_SQLServerConnector.EXPLAIN_OFF = /^(?:false|off|0)$/i;
 /**
- * One option inside `EXPLAIN (...)`: a name, then optionally a value written
- * either space-separated as PostgreSQL spells it (`ANALYZE false`) or with an
- * equals sign, which the read-only classifier also accepts (`ANALYZE = 0`).
+ * Builds one result set per SELECT-producing statement in the batch, plus
+ * (if any) a trailing result set summarizing the write-only statements.
+ *
+ * node-mssql only pushes a `recordsets` entry for statements that produce
+ * columns (SELECT); INSERT/UPDATE/DELETE statements in the same batch
+ * contribute to `rowsAffected` only, with no way to recover which
+ * `rowsAffected` entry belongs to which statement from the driver's final
+ * arrays (`recordsets`/`rowsAffected` aren't index-aligned - see the
+ * tedious `doneHandler`, which always pushes to `rowsAffected` but only
+ * conditionally to `recordsets`). So a batch of pure writes collapses to a
+ * single summed result set, and a batch mixing writes with selects gets
+ * one result set per select plus one trailing "writes" set for the rest -
+ * not a truly per-statement breakdown, but no read statement's rows are
+ * ever merged with another's, which is what mattered for #380.
+ *
+ * `sourceSql`, when given, is attributed to the single resulting set - it
+ * must be omitted (pass `undefined`) unless the caller has already
+ * confirmed the batch is unambiguously one statement, since for a genuine
+ * multi-statement batch there's no reliable way to say which source
+ * statement a given recordset (or the trailing writes set) came from.
  */
-_SQLServerConnector.EXPLAIN_OPTION = /^([A-Za-z_]+)(?:(?:\s*=\s*|\s+)(\S+))?$/;
-/** A disabling boolean directly after a bare `EXPLAIN ANALYZE`. */
-_SQLServerConnector.EXPLAIN_BARE_DISABLED = /^(?:=\s*)?(?:false|off|0)\b/i;
+/** A segment that opens a module whose body extends to the end of the batch. */
+_SQLServerConnector.MODULE_DEFINITION = /^\s*(?:create|alter)\s+(?:or\s+alter\s+)?(?:proc|procedure|function|trigger)\b/i;
 var SQLServerConnector = _SQLServerConnector;
 var sqlServerConnector = new SQLServerConnector();
 ConnectorRegistry.register(sqlServerConnector);