@eamonboyle/mssql-mcp 1.0.0 → 1.2.0

package/README.md

@@ -1,10 +1,11 @@
 # MSSQL MCP Server
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![npm version](https://img.shields.io/npm/v/@eamonboyle/mssql-mcp.svg)](https://www.npmjs.com/package/@eamonboyle/mssql-mcp)
 [![Node.js 18+](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen)](https://nodejs.org/)
 
-[![Add to Cursor](https://img.shields.io/badge/Add_to-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](cursor://anysphere.cursor-deeplink/mcp/install?name=MSSQL&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBlYW1vbmJveWxlL21zc3FsLW1jcCJdLCJlbnYiOnsiU0VSVkVSX05BTUUiOiJsb2NhbGhvc3QiLCJEQVRBQkFTRV9OQU1FIjoiWW91ckRhdGFiYXNlIiwiREJfVVNFUiI6IiIsIkRCX1BBU1NXT1JEIjoiIiwiUkVBRE9OTFkiOiJmYWxzZSJ9fQ==)
-[![Install in VS Code](https://img.shields.io/badge/Install_in-VS_Code-007ACC?style=for-the-badge&logo=visualstudiocode&logoColor=white)](vscode://mcp/install?%7B%22name%22%3A%22mssql%22%2C%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40eamonboyle%2Fmssql-mcp%22%5D%2C%22env%22%3A%7B%22SERVER_NAME%22%3A%22localhost%22%2C%22DATABASE_NAME%22%3A%22YourDatabase%22%2C%22DB_USER%22%3A%22%22%2C%22DB_PASSWORD%22%3A%22%22%2C%22READONLY%22%3A%22false%22%7D%7D)
+[![Add to Cursor](https://img.shields.io/badge/Add_to-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](https://cursor.com/en/install-mcp?name=MSSQL&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBlYW1vbmJveWxlL21zc3FsLW1jcCJdLCJlbnYiOnsiU0VSVkVSX05BTUUiOiJsb2NhbGhvc3QiLCJEQVRBQkFTRV9OQU1FIjoiWW91ckRhdGFiYXNlIiwiREFUQUJBU0VTIjoiIiwiREJfVVNFUiI6IiIsIkRCX1BBU1NXT1JEIjoiIiwiUkVBRE9OTFkiOiJmYWxzZSIsIkNPTk5FQ1RJT05fVElNRU9VVCI6IjMwIiwiUVVFUllfVElNRU9VVF9NUyI6IjMwMDAwIiwiTUFYX1JPV1MiOiIxMDAwMCIsIlRSVVNUX1NFUlZFUl9DRVJUSUZJQ0FURSI6ImZhbHNlIn19)
+[![Install in VS Code](https://img.shields.io/badge/Install_in-VS_Code-007ACC?style=for-the-badge&logo=visualstudiocode&logoColor=white)](https://intradeus.github.io/http-protocol-redirector?r=vscode%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522mssql%2522%252C%2522command%2522%253A%2522npx%2522%252C%2522args%2522%253A%255B%2522-y%2522%252C%2522%2540eamonboyle%252Fmssql-mcp%2522%255D%252C%2522env%2522%253A%257B%2522SERVER_NAME%2522%253A%2522localhost%2522%252C%2522DATABASE_NAME%2522%253A%2522YourDatabase%2522%252C%2522DATABASES%2522%253A%2522%2522%252C%2522DB_USER%2522%253A%2522%2522%252C%2522DB_PASSWORD%2522%253A%2522%2522%252C%2522READONLY%2522%253A%2522false%2522%252C%2522CONNECTION_TIMEOUT%2522%253A%252230%2522%252C%2522QUERY_TIMEOUT_MS%2522%253A%252230000%2522%252C%2522MAX_ROWS%2522%253A%252210000%2522%252C%2522TRUST_SERVER_CERTIFICATE%2522%253A%2522false%2522%257D%257D)
 
 > ⚠️ **EXPERIMENTAL USE ONLY** — This MCP Server is provided for educational and experimental purposes. It is NOT intended for production use. Use appropriate security measures and test thoroughly before any deployment.
 
@@ -22,11 +23,13 @@ AI: *queries your MSSQL database and returns the results in plain English*
 ## Features 📊
 
 - **Natural language to SQL** — Ask questions in plain English
-- **CRUD operations** — Create, read, update, and delete data
-- **Schema management** — Create tables, indexes; describe and drop tables
+- **Row-level CRUD support** — Read, insert, update, and delete rows with dedicated tools
+- **Schema discovery** — Inspect tables, views, procedures, functions, and triggers
+- **Query analysis** — Generate estimated execution plans with `explain_query`
+- **MCP resources and prompts** — Expose schema snapshots and prompt templates to capable clients
 - **Multi-database support** — Connect to multiple databases on the same server
-- **Read-only mode** — Restrict to SELECT-only for safer environments
-- **Secure by default** — WHERE clauses required for reads/updates; SQL injection safeguards
+- **Read-only mode** — Restrict to inspection, search, read, and explain tools for safer environments
+- **Secure by default** — WHERE clauses required for updates/deletes; SQL injection safeguards for reads
 
 ## Supported AI Clients
 
@@ -39,7 +42,11 @@ AI: *queries your MSSQL database and returns the results in plain English*
 
 ### One-Click Install (Cursor / VS Code)
 
-Click **Add to Cursor** or **Install in VS Code** above to add the MCP server. Edit the config to add your database credentials (`DB_USER`, `DB_PASSWORD`, etc.). No cloning required—runs via `npx`.
+Click **Add to Cursor** or **Install in VS Code** above to add the MCP server—no cloning required; it runs via `npx`.
+
+**Cursor** opens a dedicated install page that lists env vars you can edit before saving (similar to a short form).
+
+**VS Code** only applies the JSON embedded in the `vscode:mcp/install` link: you get static placeholder values, not an interactive database wizard. To be prompted for host, database, and credentials when the server starts, add [`inputs`](https://code.visualstudio.com/docs/copilot/reference/mcp-configuration#_input-variables-for-sensitive-data) to `.vscode/mcp.json` as in the **Prompted inputs** example under **VS Code (`mcp.json`)** below.
 
 ### Prerequisites
 
@@ -70,22 +77,26 @@ npm run build
 
 ### Environment Variables
 
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `SERVER_NAME` | Yes | SQL Server host (e.g., `localhost`, `my-server.database.windows.net`) |
-| `DATABASE_NAME` | Yes | Default database name |
-| `DB_USER` | Yes* | SQL Server username (for SQL authentication) |
-| `DB_PASSWORD` | Yes* | SQL Server password (for SQL authentication) |
-| `READONLY` | No | `"true"` for read-only mode, `"false"` for full access (default: `"false"`) |
-| `DATABASES` | No | Comma-separated list for multi-database access (e.g., `ProdDB,StagingDB`) |
-| `CONNECTION_TIMEOUT` | No | Timeout in seconds (default: `30`) |
-| `TRUST_SERVER_CERTIFICATE` | No | `"true"` for self-signed certs (e.g., local dev) (default: `"false"`) |
+| Variable                   | Required | Description                                                                          |
+| -------------------------- | -------- | ------------------------------------------------------------------------------------ |
+| `SERVER_NAME`              | Yes      | SQL Server host (e.g., `localhost`, `my-server.database.windows.net`)                |
+| `DATABASE_NAME`            | Yes\*\*  | Default database name. Optional when `DATABASES` is set.                             |
+| `DB_USER`                  | Yes\*    | SQL Server username (for SQL authentication)                                         |
+| `DB_PASSWORD`              | Yes\*    | SQL Server password (for SQL authentication)                                         |
+| `READONLY`                 | No       | `"true"` for read-only mode, `"false"` for full access (default: `"false"`)          |
+| `DATABASES`                | No       | Comma-separated allowlist for multi-database access (e.g., `ProdDB,StagingDB`)       |
+| `CONNECTION_TIMEOUT`       | No       | Timeout in seconds (default: `30`)                                                   |
+| `QUERY_TIMEOUT_MS`         | No       | Query timeout in milliseconds (default: `30000`)                                     |
+| `MAX_ROWS`                 | No       | Maximum rows returned by read tools (default: `10000`)                               |
+| `TRUST_SERVER_CERTIFICATE` | No       | `"true"` for self-signed certs (e.g., local dev) (default: `"false"`)                |
 
 \* Required for SQL authentication. For Windows/Integrated authentication, consult the [mssql](https://www.npmjs.com/package/mssql) package documentation.
 
-### Option 1: Cursor / VS Code Setup
+\*\* Required for single-database setups. When `DATABASES` is provided, `DATABASE_NAME` becomes optional and is used as the default database if set.
+
+### Cursor (`mcp.json`)
 
-1. Create or edit `.vscode/mcp.json` in your workspace:
+Use [global or project MCP config](https://cursor.com/docs/context/mcp): e.g. `~/.cursor/mcp.json` or `.cursor/mcp.json` in your repo.
 
 ```json
 {
@@ -95,7 +106,8 @@ npm run build
       "args": ["-y", "@eamonboyle/mssql-mcp"],
       "env": {
         "SERVER_NAME": "localhost",
-        "DATABASE_NAME": "YourDatabase",
+        "DATABASE_NAME": "AppDB",
+        "DATABASES": "AppDB,ReportingDB",
         "DB_USER": "your_username",
         "DB_PASSWORD": "your_password",
         "READONLY": "false"
@@ -105,9 +117,93 @@ npm run build
 }
 ```
 
-2. Restart Cursor/VS Code.
+Restart Cursor after changes.
+
+### VS Code (`mcp.json`)
+
+VS Code uses `.vscode/mcp.json` (or **MCP: Open User Configuration**) with a top-level [`servers`](https://code.visualstudio.com/docs/copilot/reference/mcp-configuration) object—**not** `mcpServers`.
+
+**Static env** (same idea as the one-click link; edit values in the file):
+
+```json
+{
+  "servers": {
+    "mssql": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@eamonboyle/mssql-mcp"],
+      "env": {
+        "SERVER_NAME": "localhost",
+        "DATABASE_NAME": "AppDB",
+        "DATABASES": "AppDB,ReportingDB",
+        "DB_USER": "your_username",
+        "DB_PASSWORD": "your_password",
+        "READONLY": "false",
+        "CONNECTION_TIMEOUT": "30",
+        "QUERY_TIMEOUT_MS": "30000",
+        "MAX_ROWS": "10000",
+        "TRUST_SERVER_CERTIFICATE": "false"
+      }
+    }
+  }
+}
+```
+
+**Prompted inputs** (closest to Cursor’s hosted form: VS Code asks on first start, then stores values). Use `${input:…}` in `env` and define matching entries under `inputs`:
+
+```json
+{
+  "inputs": [
+    {
+      "type": "promptString",
+      "id": "mssql-server",
+      "description": "SQL Server host (e.g. localhost or my-server.database.windows.net)"
+    },
+    {
+      "type": "promptString",
+      "id": "mssql-database",
+      "description": "Default database name"
+    },
+    {
+      "type": "promptString",
+      "id": "mssql-databases",
+      "description": "Optional: comma-separated DB allowlist (e.g. AppDB,ReportingDB). Leave empty for a single database."
+    },
+    {
+      "type": "promptString",
+      "id": "mssql-user",
+      "description": "SQL Server login (SQL authentication)"
+    },
+    {
+      "type": "promptString",
+      "id": "mssql-password",
+      "description": "SQL Server password",
+      "password": true
+    }
+  ],
+  "servers": {
+    "mssql": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@eamonboyle/mssql-mcp"],
+      "env": {
+        "SERVER_NAME": "${input:mssql-server}",
+        "DATABASE_NAME": "${input:mssql-database}",
+        "DATABASES": "${input:mssql-databases}",
+        "DB_USER": "${input:mssql-user}",
+        "DB_PASSWORD": "${input:mssql-password}",
+        "READONLY": "false",
+        "CONNECTION_TIMEOUT": "30",
+        "QUERY_TIMEOUT_MS": "30000",
+        "MAX_ROWS": "10000",
+        "TRUST_SERVER_CERTIFICATE": "false"
+      }
+    }
+  }
+}
+```
 
-### Option 2: Claude Desktop Setup
+### Claude Desktop Setup
 
 1. Open **File → Settings → Developer → Edit Config**
 2. Add the MCP server configuration:
@@ -120,7 +216,8 @@ npm run build
       "args": ["-y", "@eamonboyle/mssql-mcp"],
       "env": {
         "SERVER_NAME": "localhost",
-        "DATABASE_NAME": "YourDatabase",
+        "DATABASE_NAME": "AppDB",
+        "DATABASES": "AppDB,ReportingDB",
         "DB_USER": "your_username",
         "DB_PASSWORD": "your_password",
         "READONLY": "false"
@@ -147,7 +244,7 @@ To allow queries across multiple databases:
 }
 ```
 
-All tools accept an optional `databaseName` parameter. When omitted, `DATABASE_NAME` is used.
+`DATABASES` defines which databases the MCP can access. All tools accept an optional `databaseName` parameter. When omitted, the server uses `DATABASE_NAME` if it is included in `DATABASES`; otherwise it falls back to the first entry in `DATABASES`.
 
 ## Sample Configurations
 
@@ -161,34 +258,54 @@ See `src/samples/` for example configs:
 Once configured, you can ask things like:
 
 - "Show me all users from New York"
+- "Search the customers table for email addresses containing acme.com"
 - "Create a new table called products with columns for id, name, and price"
 - "Update all pending orders to completed status"
+- "Delete inactive sessions older than 30 days"
 - "List all tables in the database"
 - "Describe the schema of the customers table"
+- "List all views and procedures in the reporting database"
+- "Explain why this SELECT query is slow"
 
 ## Available Tools
 
-| Tool | Read-only | Description |
-|------|-----------|-------------|
-| `read_data` | ✓ | Execute SELECT queries |
-| `list_table` | ✓ | List tables in a database |
-| `describe_table` | ✓ | Get table schema |
-| `insert_data` | | Insert rows |
-| `update_data` | | Update rows (requires WHERE) |
-| `create_table` | | Create tables |
-| `create_index` | | Create indexes |
-| `drop_table` | | Drop tables |
+| Tool              | Read-only | Description                                             |
+| ----------------- | --------- | ------------------------------------------------------- |
+| `read_data`       | ✓         | Execute validated SELECT queries                        |
+| `search_data`     | ✓         | Search one or more columns with parameterized `LIKE`    |
+| `explain_query`   | ✓         | Get an estimated execution plan for a SELECT query      |
+| `list_table`      | ✓         | List tables in a database                               |
+| `describe_table`  | ✓         | Get table schema (optional `schemaName`)                |
+| `list_objects`    | ✓         | List tables, views, procedures, functions, and triggers |
+| `describe_object` | ✓         | Describe an object definition and metadata              |
+| `insert_data`     |           | Insert rows                                             |
+| `update_data`     |           | Update rows (requires WHERE)                            |
+| `delete_data`     |           | Delete rows (requires WHERE)                            |
+| `create_table`    |           | Create tables                                           |
+| `create_index`    |           | Create indexes                                          |
+| `drop_table`      |           | Drop tables                                             |
+
+## Resources And Prompts
+
+Clients that support MCP resources and prompts can use additional discovery surfaces:
+
+- **Resources** — Server config, prompt catalog, per-database table lists, per-database object lists, and dynamic table/object resources
+- **Prompts** — `explore_schema`, `draft_safe_select`, and `review_write_operation`
+
+## Changelog
+
+Release notes: [CHANGELOG.md](https://github.com/eamonboyle/mssql-mcp/blob/main/CHANGELOG.md).
 
 ## Security Notes
 
 - **Credentials** — Never commit `DB_USER`/`DB_PASSWORD` or config files with secrets. Use environment variables or a secrets manager.
 - **Read-only mode** — Set `READONLY: "true"` when you only need queries.
-- **WHERE clauses** — Read and update operations require explicit WHERE clauses to reduce accidental full-table operations.
+- **WHERE clauses** — Update and delete operations require explicit WHERE clauses to reduce accidental full-table changes.
 - **SQL injection** — The server validates and restricts dangerous SQL patterns.
 
 ## Contributing
 
-Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. By participating, you agree to uphold our [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## License
 

package/dist/__tests__/ExplainQueryTool.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ExplainQueryTool.test.d.ts.map

package/dist/__tests__/ExplainQueryTool.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExplainQueryTool.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/ExplainQueryTool.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/ExplainQueryTool.test.js

@@ -0,0 +1,96 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+const explainMockState = vi.hoisted(() => ({
+    closeCalls: 0,
+    statements: [],
+    failOnQuery: false,
+}));
+const mockRequestModule = vi.hoisted(() => {
+    class MockRequest {
+        async query(statement) {
+            return this.run(statement);
+        }
+        async batch(statement) {
+            return this.run(statement);
+        }
+        async run(statement) {
+            explainMockState.statements.push(statement);
+            if (statement === "SET SHOWPLAN_XML ON") {
+                return { recordsets: [] };
+            }
+            if (statement === "SET SHOWPLAN_XML OFF") {
+                return { recordsets: [] };
+            }
+            if (explainMockState.failOnQuery) {
+                throw new Error("query failed");
+            }
+            return {
+                recordsets: [[{ planXml: "<ShowPlanXML />" }]],
+            };
+        }
+    }
+    function mockPool() {
+        return {
+            request() {
+                return new MockRequest();
+            },
+            async close() {
+                explainMockState.closeCalls += 1;
+            },
+        };
+    }
+    return { MockRequest, mockPool };
+});
+vi.mock("mssql", () => ({
+    default: {
+        Request: mockRequestModule.MockRequest,
+    },
+}));
+vi.mock("../db.js", () => ({
+    getDedicatedSqlPool: vi.fn(async () => ({
+        pool: mockRequestModule.mockPool(),
+    })),
+}));
+import { ExplainQueryTool } from "../tools/ExplainQueryTool.js";
+describe("ExplainQueryTool", () => {
+    beforeEach(() => {
+        vi.spyOn(console, "error").mockImplementation(() => { });
+        explainMockState.closeCalls = 0;
+        explainMockState.statements.length = 0;
+        explainMockState.failOnQuery = false;
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it("uses a dedicated pool and always disables SHOWPLAN_XML", async () => {
+        const tool = new ExplainQueryTool();
+        const result = await tool.run({
+            query: "SELECT * FROM movies",
+        });
+        expect(result).toMatchObject({
+            success: true,
+            planXml: "<ShowPlanXML />",
+            recordsets: undefined,
+        });
+        expect(explainMockState.statements).toEqual([
+            "SET SHOWPLAN_XML ON",
+            "SELECT * FROM movies",
+            "SET SHOWPLAN_XML OFF",
+        ]);
+        expect(explainMockState.closeCalls).toBe(1);
+    });
+    it("cleans up SHOWPLAN state after failures", async () => {
+        explainMockState.failOnQuery = true;
+        const tool = new ExplainQueryTool();
+        const result = await tool.run({
+            query: "SELECT * FROM movies",
+        });
+        expect(result).toMatchObject({ success: false });
+        expect(explainMockState.statements).toEqual([
+            "SET SHOWPLAN_XML ON",
+            "SELECT * FROM movies",
+            "SET SHOWPLAN_XML OFF",
+        ]);
+        expect(explainMockState.closeCalls).toBe(1);
+    });
+});
+//# sourceMappingURL=ExplainQueryTool.test.js.map

package/dist/__tests__/ExplainQueryTool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExplainQueryTool.test.js","sourceRoot":"","sources":["../../src/__tests__/ExplainQueryTool.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,MAAM,gBAAgB,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,EAAc;IAC1B,WAAW,EAAE,KAAK;CACnB,CAAC,CAAC,CAAC;AAEJ,MAAM,iBAAiB,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IACxC,MAAM,WAAW;QACf,KAAK,CAAC,KAAK,CAAC,SAAiB;YAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAiB;YAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAiB;YACzB,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;gBACxC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YAED,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;gBACzC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YAED,IAAI,gBAAgB,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;aAC/C,CAAC;QACJ,CAAC;KACF;IAED,SAAS,QAAQ;QACf,OAAO;YACL,OAAO;gBACL,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,KAAK;gBACT,gBAAgB,CAAC,UAAU,IAAI,CAAC,CAAC;YACnC,CAAC;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE;QACP,OAAO,EAAE,iBAAiB,CAAC,WAAW;KACvC;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,gBAAgB,CAAC,UAAU,GAAG,CAAC,CAAC;QAChC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,gBAAgB,CAAC,WAAW,GAAG,KAAK,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC5B,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YAC1C,qBAAqB;YACrB,sBAAsB;YACtB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,gBAAgB,CAAC,WAAW,GAAG,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC5B,KAAK,EAAE,sBAAsB;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;YAC1C,qBAAqB;YACrB,sBAAsB;YACtB,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/__tests__/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/config.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/config.test.js

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { clampRowLimit, getDefaultSearchLimit, getMaxRows, getQueryTimeoutMs, } from "../config.js";
+const originalEnv = process.env;
+afterEach(() => {
+    process.env = { ...originalEnv };
+});
+describe("config helpers", () => {
+    it("uses defaults when env vars are absent", () => {
+        delete process.env.MAX_ROWS;
+        delete process.env.QUERY_TIMEOUT_MS;
+        expect(getMaxRows()).toBe(10000);
+        expect(getQueryTimeoutMs()).toBe(30000);
+        expect(getDefaultSearchLimit()).toBe(100);
+    });
+    it("reads env-based limits", () => {
+        process.env.MAX_ROWS = "250";
+        process.env.QUERY_TIMEOUT_MS = "45000";
+        expect(getMaxRows()).toBe(250);
+        expect(getQueryTimeoutMs()).toBe(45000);
+        expect(getDefaultSearchLimit()).toBe(100);
+    });
+    it("clamps row limits to the configured maximum", () => {
+        process.env.MAX_ROWS = "50";
+        expect(clampRowLimit(200)).toBe(50);
+        expect(clampRowLimit("5")).toBe(5);
+        expect(clampRowLimit(undefined)).toBe(50);
+    });
+});
+//# sourceMappingURL=config.test.js.map

package/dist/__tests__/config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.js","sourceRoot":"","sources":["../../src/__tests__/config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;AAEhC,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAEpC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAEvC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QAE5B,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/db.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=db.test.d.ts.map

package/dist/__tests__/db.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/db.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/db.test.js

@@ -0,0 +1,204 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+const mssqlMockState = vi.hoisted(() => ({
+    poolConfigs: [],
+    requestObject: { kind: "mock-request" },
+    connectCalls: vi.fn(),
+    closeCalls: vi.fn(),
+    requestCalls: vi.fn(),
+}));
+// Mock mssql to avoid loading native deps and transitive issues in test env
+vi.mock("mssql", () => {
+    class MockConnectionPool {
+        constructor(config) {
+            this.config = config;
+            this.connected = false;
+            mssqlMockState.poolConfigs.push(config);
+        }
+        async connect() {
+            this.connected = true;
+            mssqlMockState.connectCalls(this.config);
+            return this;
+        }
+        async close() {
+            this.connected = false;
+            mssqlMockState.closeCalls(this.config);
+        }
+        request() {
+            mssqlMockState.requestCalls(this.config);
+            return mssqlMockState.requestObject;
+        }
+    }
+    return {
+        default: {
+            ConnectionPool: MockConnectionPool,
+        },
+    };
+});
+import { getAllowedDatabases, getSqlRequest, resolveDatabaseName } from "../db.js";
+describe("getAllowedDatabases", () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        mssqlMockState.poolConfigs.length = 0;
+        mssqlMockState.connectCalls.mockClear();
+        mssqlMockState.closeCalls.mockClear();
+        mssqlMockState.requestCalls.mockClear();
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    it("returns DATABASE_NAME when DATABASES is not set", () => {
+        delete process.env.DATABASES;
+        process.env.DATABASE_NAME = "MyDb";
+        expect(getAllowedDatabases()).toEqual(["MyDb"]);
+    });
+    it("returns empty array when neither DATABASES nor DATABASE_NAME is set", () => {
+        delete process.env.DATABASES;
+        delete process.env.DATABASE_NAME;
+        expect(getAllowedDatabases()).toEqual([]);
+    });
+    it("returns empty array when DATABASE_NAME is empty string", () => {
+        delete process.env.DATABASES;
+        process.env.DATABASE_NAME = "";
+        expect(getAllowedDatabases()).toEqual([]);
+    });
+    it("returns DATABASES split by comma when set", () => {
+        process.env.DATABASES = "ProdDB,StagingDB,AnalyticsDB";
+        expect(getAllowedDatabases()).toEqual([
+            "ProdDB",
+            "StagingDB",
+            "AnalyticsDB",
+        ]);
+    });
+    it("trims whitespace from DATABASES entries", () => {
+        process.env.DATABASES = "  ProdDB , StagingDB , AnalyticsDB  ";
+        expect(getAllowedDatabases()).toEqual([
+            "ProdDB",
+            "StagingDB",
+            "AnalyticsDB",
+        ]);
+    });
+    it("filters out empty entries from DATABASES", () => {
+        process.env.DATABASES = "ProdDB,,StagingDB,";
+        expect(getAllowedDatabases()).toEqual(["ProdDB", "StagingDB"]);
+    });
+    it("prefers DATABASES over DATABASE_NAME when both set", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        process.env.DATABASE_NAME = "OtherDb";
+        expect(getAllowedDatabases()).toEqual(["ProdDB", "StagingDB"]);
+    });
+});
+describe("resolveDatabaseName", () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        mssqlMockState.poolConfigs.length = 0;
+        mssqlMockState.connectCalls.mockClear();
+        mssqlMockState.closeCalls.mockClear();
+        mssqlMockState.requestCalls.mockClear();
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    it("returns param when valid and in allowed list", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        expect(resolveDatabaseName("ProdDB")).toBe("ProdDB");
+        expect(resolveDatabaseName("StagingDB")).toBe("StagingDB");
+    });
+    it("returns DATABASE_NAME when param omitted and DATABASES not set", () => {
+        process.env.DATABASE_NAME = "DefaultDb";
+        delete process.env.DATABASES;
+        expect(resolveDatabaseName()).toBe("DefaultDb");
+    });
+    it("returns DATABASE_NAME when it is in DATABASES", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        process.env.DATABASE_NAME = "StagingDB";
+        expect(resolveDatabaseName()).toBe("StagingDB");
+    });
+    it("returns the first DATABASES entry when DATABASE_NAME is omitted", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        delete process.env.DATABASE_NAME;
+        expect(resolveDatabaseName()).toBe("ProdDB");
+    });
+    it("returns param when param provided and in allowed list", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        process.env.DATABASE_NAME = "ProdDB";
+        expect(resolveDatabaseName("StagingDB")).toBe("StagingDB");
+    });
+    it("falls back to the first DATABASES entry when DATABASE_NAME is not included in DATABASES", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        process.env.DATABASE_NAME = "OtherDb";
+        expect(resolveDatabaseName()).toBe("ProdDB");
+    });
+    it("returns null when param not in allowed list", () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        expect(resolveDatabaseName("OtherDb")).toBeNull();
+    });
+    it("returns null when param is empty and DATABASE_NAME not set", () => {
+        delete process.env.DATABASE_NAME;
+        delete process.env.DATABASES;
+        expect(resolveDatabaseName()).toBeNull();
+        expect(resolveDatabaseName("")).toBeNull();
+    });
+    it("returns resolved name when no DATABASES set (only DATABASE_NAME allowed)", () => {
+        delete process.env.DATABASES;
+        process.env.DATABASE_NAME = "MyDb";
+        expect(resolveDatabaseName()).toBe("MyDb");
+        expect(resolveDatabaseName("MyDb")).toBe("MyDb");
+        expect(resolveDatabaseName("AnyDb")).toBeNull();
+    });
+    it("trims whitespace from param", () => {
+        process.env.DATABASES = "ProdDB";
+        expect(resolveDatabaseName("  ProdDB  ")).toBe("ProdDB");
+    });
+    it("returns null when neither DATABASE_NAME nor DATABASES is configured", () => {
+        delete process.env.DATABASE_NAME;
+        delete process.env.DATABASES;
+        expect(resolveDatabaseName()).toBeNull();
+    });
+});
+describe("getSqlRequest", () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+        mssqlMockState.poolConfigs.length = 0;
+        mssqlMockState.connectCalls.mockClear();
+        mssqlMockState.closeCalls.mockClear();
+        mssqlMockState.requestCalls.mockClear();
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    it("returns a helpful error when no database access is configured", async () => {
+        delete process.env.DATABASE_NAME;
+        delete process.env.DATABASES;
+        const result = await getSqlRequest();
+        expect(result.error).toBe("Invalid or disallowed database. Set DATABASE_NAME or DATABASES to configure database access. Use the databaseName parameter to target a specific configured database.");
+    });
+    it("returns allowed databases in the error when a disallowed database is requested", async () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        const result = await getSqlRequest("OtherDb");
+        expect(result.error).toBe("Invalid or disallowed database. Allowed: ProdDB, StagingDB. Use the databaseName parameter to target a specific configured database.");
+    });
+    it("returns a request using the resolved default database", async () => {
+        process.env.DATABASES = "ProdDBDefault,StagingDB";
+        delete process.env.DATABASE_NAME;
+        const result = await getSqlRequest();
+        expect(result.error).toBeUndefined();
+        expect(result.request).toBe(mssqlMockState.requestObject);
+        expect(mssqlMockState.poolConfigs).toContainEqual(expect.objectContaining({ database: "ProdDBDefault" }));
+        expect(mssqlMockState.connectCalls).toHaveBeenCalledWith(expect.objectContaining({ database: "ProdDBDefault" }));
+        expect(mssqlMockState.requestCalls).toHaveBeenCalledWith(expect.objectContaining({ database: "ProdDBDefault" }));
+    });
+    it("falls back to the first allowed database when DATABASE_NAME is disallowed", async () => {
+        process.env.DATABASES = "ProdDB,StagingDB";
+        process.env.DATABASE_NAME = "OtherDb";
+        const result = await getSqlRequest();
+        expect(result.error).toBeUndefined();
+        expect(result.request).toBe(mssqlMockState.requestObject);
+        expect(mssqlMockState.poolConfigs).toContainEqual(expect.objectContaining({ database: "ProdDB" }));
+        expect(mssqlMockState.connectCalls).toHaveBeenCalledWith(expect.objectContaining({ database: "ProdDB" }));
+        expect(mssqlMockState.requestCalls).toHaveBeenCalledWith(expect.objectContaining({ database: "ProdDB" }));
+    });
+});
+//# sourceMappingURL=db.test.js.map