@eamonboyle/mssql-mcp 1.1.0 → 1.3.0

package/dist/tools/UpdateDataTool.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateDataTool.js","sourceRoot":"","sources":["../../src/tools/UpdateDataTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,cAAc;IAA3B;QAEE,SAAI,GAAG,aAAa,CAAC;QACrB,gBAAW,GACT,+GAA+G,CAAC;QAClH,gBAAW,GAAG;YACZ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,qGAAqG;iBACxG;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,kHAAkH;iBACrH;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,sFAAsF;iBACzF;aACF;YACD,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;SAC3C,CAAC;IA0CX,CAAC;IAxCC,KAAK,CAAC,GAAG,CAAC,MAAW;QACnB,IAAI,KAAyB,CAAC;QAC9B,IAAI;YACF,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;YAEjE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI,KAAK,EAAE;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aAC3C;YAED,oDAAoD;YACpD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;aAClE;YAED,2DAA2D;YAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;iBACnC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,MAAM,SAAS,GAAG,UAAU,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvC,OAAO,IAAI,GAAG,QAAQ,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,KAAK,GAAG,UAAU,SAAS,QAAQ,SAAS,UAAU,WAAW,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE1C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,kCAAkC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB;gBACnF,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;aACrC,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,yBAAyB,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE;aAC9E,CAAC;SACH;IACH,CAAC;CACF"}
+{"version":3,"file":"UpdateDataTool.js","sourceRoot":"","sources":["../../src/tools/UpdateDataTool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAkB,MAAM,mBAAmB,CAAC;AAUlF,MAAM,OAAO,cAAc;IAA3B;QACE,SAAI,GAAG,aAAa,CAAC;QACrB,gBAAW,GACT,4EAA4E,CAAC;IAmDjF,CAAC;IAjDC,KAAK,CAAC,GAAG,CAAC,MAAwB;QAChC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;YAEzE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5C,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,SAAS,GAAG,aAAa;iBAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAClB,MAAM,SAAS,GAAG,UAAU,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvC,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,SAAS,EAAE,CAAC;YACnD,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,MAAM,WAAW,GAAG,6BAA6B,CAC/C,OAAO,EACP,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAC3C,eAAe,CAChB,CAAC;YAEF,KAAK,GAAG,UAAU,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,SAAS,UAAU,WAAW,EAAE,CAAC;YACpG,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAChC,8BAA8B,KAAK,mBAAmB,CACvD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,kCAAkC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB;gBACnF,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,yBAAyB,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/validation.d.ts

@@ -1,14 +1,14 @@
-/**
- * SQL query validation for read-only operations.
- * Extracted for testability and reuse.
- */
-export interface ValidationResult {
-    isValid: boolean;
-    error?: string;
-}
-/**
- * Validates a SQL query for read-only (SELECT) operations.
- * Rejects dangerous keywords, injection patterns, and multi-statement queries.
- */
-export declare function validateReadQuery(query: string): ValidationResult;
+/**
+ * SQL query validation for read-only operations.
+ * Extracted for testability and reuse.
+ */
+export interface ValidationResult {
+    isValid: boolean;
+    error?: string;
+}
+/**
+ * Validates a SQL query for read-only (SELECT) operations.
+ * Rejects dangerous keywords, injection patterns, and multi-statement queries.
+ */
+export declare function validateReadQuery(query: string): ValidationResult;
 //# sourceMappingURL=validation.d.ts.map

package/dist/validation.js

@@ -1,134 +1,134 @@
-/**
- * SQL query validation for read-only operations.
- * Extracted for testability and reuse.
- */
-const DANGEROUS_KEYWORDS = [
-    "DELETE",
-    "DROP",
-    "UPDATE",
-    "INSERT",
-    "ALTER",
-    "CREATE",
-    "TRUNCATE",
-    "EXEC",
-    "EXECUTE",
-    "MERGE",
-    "REPLACE",
-    "GRANT",
-    "REVOKE",
-    "COMMIT",
-    "ROLLBACK",
-    "TRANSACTION",
-    "BEGIN",
-    "DECLARE",
-    "SET",
-    "USE",
-    "BACKUP",
-    "RESTORE",
-    "KILL",
-    "SHUTDOWN",
-    "WAITFOR",
-    "OPENROWSET",
-    "OPENDATASOURCE",
-    "OPENQUERY",
-    "OPENXML",
-    "BULK",
-    "INTO",
-];
-const DANGEROUS_PATTERNS = [
-    /SELECT\s+.*?\s+INTO\s+/i,
-    /;\s*(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE|MERGE|REPLACE|GRANT|REVOKE)/i,
-    /UNION\s+(?:ALL\s+)?SELECT.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
-    /--.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
-    /\/\*.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE).*?\*\//i,
-    /EXEC\s*\(/i,
-    /EXECUTE\s*\(/i,
-    /sp_/i,
-    /xp_/i,
-    /BULK\s+INSERT/i,
-    /OPENROWSET/i,
-    /OPENDATASOURCE/i,
-    /@@/,
-    /SYSTEM_USER/i,
-    /USER_NAME/i,
-    /DB_NAME/i,
-    /HOST_NAME/i,
-    /WAITFOR\s+DELAY/i,
-    /WAITFOR\s+TIME/i,
-    /;\s*\w/,
-    /\+\s*CHAR\s*\(/i,
-    /\+\s*NCHAR\s*\(/i,
-    /\+\s*ASCII\s*\(/i,
-];
-/**
- * Validates a SQL query for read-only (SELECT) operations.
- * Rejects dangerous keywords, injection patterns, and multi-statement queries.
- */
-export function validateReadQuery(query) {
-    if (!query || typeof query !== "string") {
-        return {
-            isValid: false,
-            error: "Query must be a non-empty string",
-        };
-    }
-    const cleanQuery = query
-        .replace(/--.*$/gm, "")
-        .replace(/\/\*[\s\S]*?\*\//g, "")
-        .replace(/\s+/g, " ")
-        .trim();
-    if (!cleanQuery) {
-        return {
-            isValid: false,
-            error: "Query cannot be empty after removing comments",
-        };
-    }
-    const upperQuery = cleanQuery.toUpperCase();
-    if (!upperQuery.startsWith("SELECT")) {
-        return {
-            isValid: false,
-            error: "Query must start with SELECT for security reasons",
-        };
-    }
-    for (const keyword of DANGEROUS_KEYWORDS) {
-        const keywordRegex = new RegExp(`(^|\\s|[^A-Za-z0-9_])${keyword}($|\\s|[^A-Za-z0-9_])`, "i");
-        if (keywordRegex.test(upperQuery)) {
-            return {
-                isValid: false,
-                error: `Dangerous keyword '${keyword}' detected in query. Only SELECT operations are allowed.`,
-            };
-        }
-    }
-    for (const pattern of DANGEROUS_PATTERNS) {
-        if (pattern.test(query)) {
-            return {
-                isValid: false,
-                error: "Potentially malicious SQL pattern detected. Only simple SELECT queries are allowed.",
-            };
-        }
-    }
-    const statements = cleanQuery
-        .split(";")
-        .filter((stmt) => stmt.trim().length > 0);
-    if (statements.length > 1) {
-        return {
-            isValid: false,
-            error: "Multiple SQL statements are not allowed. Use only a single SELECT statement.",
-        };
-    }
-    if (query.includes("CHAR(") ||
-        query.includes("NCHAR(") ||
-        query.includes("ASCII(")) {
-        return {
-            isValid: false,
-            error: "Character conversion functions are not allowed as they may be used for obfuscation.",
-        };
-    }
-    if (query.length > 10000) {
-        return {
-            isValid: false,
-            error: "Query is too long. Maximum allowed length is 10,000 characters.",
-        };
-    }
-    return { isValid: true };
-}
+/**
+ * SQL query validation for read-only operations.
+ * Extracted for testability and reuse.
+ */
+const DANGEROUS_KEYWORDS = [
+    "DELETE",
+    "DROP",
+    "UPDATE",
+    "INSERT",
+    "ALTER",
+    "CREATE",
+    "TRUNCATE",
+    "EXEC",
+    "EXECUTE",
+    "MERGE",
+    "REPLACE",
+    "GRANT",
+    "REVOKE",
+    "COMMIT",
+    "ROLLBACK",
+    "TRANSACTION",
+    "BEGIN",
+    "DECLARE",
+    "SET",
+    "USE",
+    "BACKUP",
+    "RESTORE",
+    "KILL",
+    "SHUTDOWN",
+    "WAITFOR",
+    "OPENROWSET",
+    "OPENDATASOURCE",
+    "OPENQUERY",
+    "OPENXML",
+    "BULK",
+    "INTO",
+];
+const DANGEROUS_PATTERNS = [
+    /SELECT\s+.*?\s+INTO\s+/i,
+    /;\s*(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE|MERGE|REPLACE|GRANT|REVOKE)/i,
+    /UNION\s+(?:ALL\s+)?SELECT.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
+    /--.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
+    /\/\*.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE).*?\*\//i,
+    /EXEC\s*\(/i,
+    /EXECUTE\s*\(/i,
+    /sp_/i,
+    /xp_/i,
+    /BULK\s+INSERT/i,
+    /OPENROWSET/i,
+    /OPENDATASOURCE/i,
+    /@@/,
+    /SYSTEM_USER/i,
+    /USER_NAME/i,
+    /DB_NAME/i,
+    /HOST_NAME/i,
+    /WAITFOR\s+DELAY/i,
+    /WAITFOR\s+TIME/i,
+    /;\s*\w/,
+    /\+\s*CHAR\s*\(/i,
+    /\+\s*NCHAR\s*\(/i,
+    /\+\s*ASCII\s*\(/i,
+];
+/**
+ * Validates a SQL query for read-only (SELECT) operations.
+ * Rejects dangerous keywords, injection patterns, and multi-statement queries.
+ */
+export function validateReadQuery(query) {
+    if (!query || typeof query !== "string") {
+        return {
+            isValid: false,
+            error: "Query must be a non-empty string",
+        };
+    }
+    const cleanQuery = query
+        .replace(/--.*$/gm, "")
+        .replace(/\/\*[\s\S]*?\*\//g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!cleanQuery) {
+        return {
+            isValid: false,
+            error: "Query cannot be empty after removing comments",
+        };
+    }
+    const upperQuery = cleanQuery.toUpperCase();
+    if (!upperQuery.startsWith("SELECT")) {
+        return {
+            isValid: false,
+            error: "Query must start with SELECT for security reasons",
+        };
+    }
+    for (const keyword of DANGEROUS_KEYWORDS) {
+        const keywordRegex = new RegExp(`(^|\\s|[^A-Za-z0-9_])${keyword}($|\\s|[^A-Za-z0-9_])`, "i");
+        if (keywordRegex.test(upperQuery)) {
+            return {
+                isValid: false,
+                error: `Dangerous keyword '${keyword}' detected in query. Only SELECT operations are allowed.`,
+            };
+        }
+    }
+    for (const pattern of DANGEROUS_PATTERNS) {
+        if (pattern.test(query)) {
+            return {
+                isValid: false,
+                error: "Potentially malicious SQL pattern detected. Only simple SELECT queries are allowed.",
+            };
+        }
+    }
+    const statements = cleanQuery
+        .split(";")
+        .filter((stmt) => stmt.trim().length > 0);
+    if (statements.length > 1) {
+        return {
+            isValid: false,
+            error: "Multiple SQL statements are not allowed. Use only a single SELECT statement.",
+        };
+    }
+    if (query.includes("CHAR(") ||
+        query.includes("NCHAR(") ||
+        query.includes("ASCII(")) {
+        return {
+            isValid: false,
+            error: "Character conversion functions are not allowed as they may be used for obfuscation.",
+        };
+    }
+    if (query.length > 10000) {
+        return {
+            isValid: false,
+            error: "Query is too long. Maximum allowed length is 10,000 characters.",
+        };
+    }
+    return { isValid: true };
+}
 //# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,yBAAyB;IACzB,gGAAgG;IAChG,6FAA6F;IAC7F,sEAAsE;IACtE,+EAA+E;IAC/E,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,IAAI;IACJ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAOF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QACvC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;SAC1C,CAAC;KACH;IAED,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,IAAI,CAAC,UAAU,EAAE;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+CAA+C;SACvD,CAAC;KACH;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACpC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC3D,CAAC;KACH;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE;QACxC,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,wBAAwB,OAAO,uBAAuB,EACtD,GAAG,CACJ,CAAC;QACF,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB,OAAO,0DAA0D;aAC/F,CAAC;SACH;KACF;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACvB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,qFAAqF;aACxF,CAAC;SACH;KACF;IAED,MAAM,UAAU,GAAG,UAAU;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,8EAA8E;SACjF,CAAC;KACH;IAED,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxB;QACA,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,qFAAqF;SACxF,CAAC;KACH;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,iEAAiE;SACzE,CAAC;KACH;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,yBAAyB;IACzB,gGAAgG;IAChG,6FAA6F;IAC7F,sEAAsE;IACtE,+EAA+E;IAC/E,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,IAAI;IACJ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAOF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+CAA+C;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC3D,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,wBAAwB,OAAO,uBAAuB,EACtD,GAAG,CACJ,CAAC;QACF,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB,OAAO,0DAA0D;aAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,qFAAqF;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,8EAA8E;SACjF,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxB,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,qFAAqF;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,iEAAiE;SACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/writePreview.d.ts

@@ -0,0 +1,20 @@
+import { type SqlFilter } from "./writeSafety.js";
+export interface WritePreviewResult {
+    query: string;
+    countQuery: string;
+    rows: unknown[];
+    affectedRowCount: number;
+}
+export declare function previewFilteredRows(params: {
+    tableName: string;
+    schemaName?: string;
+    filters: SqlFilter[];
+    databaseName?: string;
+    limit: number;
+}): Promise<{
+    query: string;
+    countQuery: string;
+    rows: import("mssql").IRecordSet<any>;
+    affectedRowCount: any;
+}>;
+//# sourceMappingURL=writePreview.d.ts.map

package/dist/writePreview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreview.d.ts","sourceRoot":"","sources":["../src/writePreview.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;;;;;GA6BA"}

package/dist/writePreview.js

@@ -0,0 +1,27 @@
+import { getSqlRequest } from "./db.js";
+import { buildQualifiedName } from "./sql.js";
+import { buildParameterizedWhereClause } from "./writeSafety.js";
+export async function previewFilteredRows(params) {
+    const { tableName, schemaName, filters, databaseName, limit } = params;
+    const { request, error } = await getSqlRequest(databaseName);
+    if (error) {
+        throw new Error(error);
+    }
+    request.input("previewLimit", limit);
+    const whereClause = buildParameterizedWhereClause(filters, (name, value) => request.input(name, value), "preview_filter");
+    const tableRef = buildQualifiedName(tableName, schemaName);
+    const query = `SELECT TOP (@previewLimit) * FROM ${tableRef} WHERE ${whereClause}`;
+    const countQuery = `SELECT COUNT(*) AS affectedRowCount FROM ${tableRef} WHERE ${whereClause}`;
+    const result = await request.query(`
+    ${query};
+    ${countQuery};
+  `);
+    const recordsets = Array.isArray(result.recordsets) ? result.recordsets : [];
+    return {
+        query,
+        countQuery,
+        rows: recordsets[0] ?? [],
+        affectedRowCount: recordsets[1]?.[0]?.affectedRowCount ?? 0,
+    };
+}
+//# sourceMappingURL=writePreview.js.map

package/dist/writePreview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreview.js","sourceRoot":"","sources":["../src/writePreview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAkB,MAAM,kBAAkB,CAAC;AASjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAMzC;IACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,6BAA6B,CAC/C,OAAO,EACP,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAC3C,gBAAgB,CACjB,CAAC;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,qCAAqC,QAAQ,UAAU,WAAW,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,4CAA4C,QAAQ,UAAU,WAAW,EAAE,CAAC;IAE/F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;MAC/B,KAAK;MACL,UAAU;GACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,OAAO;QACL,KAAK;QACL,UAAU;QACV,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE;QACzB,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,CAAC;KAC/B,CAAC;AACjC,CAAC"}

package/dist/writePreviewGrant.d.ts

@@ -0,0 +1,18 @@
+import type { SqlFilter } from "./writeSafety.js";
+export type WriteDataToolName = "update_data" | "delete_data";
+export declare function fingerprintForUpdateOp(params: {
+    databaseName?: string;
+    schemaName?: string;
+    tableName: string;
+    filters: SqlFilter[];
+    updates: Record<string, unknown>;
+}): string;
+export declare function fingerprintForDeleteOp(params: {
+    databaseName?: string;
+    schemaName?: string;
+    tableName: string;
+    filters: SqlFilter[];
+}): string;
+export type PreviewOrWriteName = "preview_update" | "preview_delete" | "update_data" | "delete_data";
+export declare function fingerprintForWriteTool(toolName: PreviewOrWriteName, requestArgs: Record<string, unknown>): string;
+//# sourceMappingURL=writePreviewGrant.d.ts.map

package/dist/writePreviewGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreviewGrant.d.ts","sourceRoot":"","sources":["../src/writePreviewGrant.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,aAAa,CAAC;AAqC9D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,GAAG,MAAM,CAUT;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB,GAAG,MAAM,CAST;AAED,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,aAAa,CAAC;AAElB,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,CAiBR"}

package/dist/writePreviewGrant.js

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+function stableStringify(value) {
+    return JSON.stringify(value, (_key, v) => {
+        if (v instanceof Date) {
+            return v.toISOString();
+        }
+        return v;
+    });
+}
+function normalizeFilters(filters) {
+    return [...filters]
+        .map((f) => ({
+        column: f.column,
+        operator: f.operator,
+        value: f.value,
+        values: f.values ? [...f.values] : undefined,
+    }))
+        .sort((a, b) => {
+        const byCol = a.column.localeCompare(b.column);
+        if (byCol !== 0) {
+            return byCol;
+        }
+        return a.operator.localeCompare(b.operator);
+    });
+}
+function normalizeUpdates(updates) {
+    const keys = Object.keys(updates).sort((a, b) => a.localeCompare(b));
+    const out = {};
+    for (const key of keys) {
+        out[key] = updates[key];
+    }
+    return out;
+}
+export function fingerprintForUpdateOp(params) {
+    const payload = {
+        kind: "update",
+        database: params.databaseName ?? "",
+        schema: params.schemaName ?? "",
+        table: params.tableName,
+        filters: normalizeFilters(params.filters),
+        updates: normalizeUpdates(params.updates),
+    };
+    return createHash("sha256").update(stableStringify(payload)).digest("hex");
+}
+export function fingerprintForDeleteOp(params) {
+    const payload = {
+        kind: "delete",
+        database: params.databaseName ?? "",
+        schema: params.schemaName ?? "",
+        table: params.tableName,
+        filters: normalizeFilters(params.filters),
+    };
+    return createHash("sha256").update(stableStringify(payload)).digest("hex");
+}
+export function fingerprintForWriteTool(toolName, requestArgs) {
+    const filters = requestArgs.filters ?? [];
+    const databaseName = typeof requestArgs.databaseName === "string" ? requestArgs.databaseName : undefined;
+    const schemaName = typeof requestArgs.schemaName === "string" ? requestArgs.schemaName : undefined;
+    const tableName = String(requestArgs.tableName ?? "");
+    if (toolName === "preview_delete" || toolName === "delete_data") {
+        return fingerprintForDeleteOp({ databaseName, schemaName, tableName, filters });
+    }
+    return fingerprintForUpdateOp({
+        databaseName,
+        schemaName,
+        tableName,
+        filters,
+        updates: requestArgs.updates ?? {},
+    });
+}
+//# sourceMappingURL=writePreviewGrant.js.map

package/dist/writePreviewGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreviewGrant.js","sourceRoot":"","sources":["../src/writePreviewGrant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7C,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAMtC;IACC,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,QAAiB;QACvB,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACnC,MAAM,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QAC/B,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;QACzC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;KAC1C,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAKtC;IACC,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,QAAiB;QACvB,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACnC,MAAM,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QAC/B,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC;KAC1C,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,QAA4B,EAC5B,WAAoC;IAEpC,MAAM,OAAO,GAAI,WAAW,CAAC,OAAuB,IAAI,EAAE,CAAC;IAC3D,MAAM,YAAY,GAChB,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,UAAU,GACd,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,OAAO,sBAAsB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,sBAAsB,CAAC;QAC5B,YAAY;QACZ,UAAU;QACV,SAAS;QACT,OAAO;QACP,OAAO,EAAG,WAAW,CAAC,OAAmC,IAAI,EAAE;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/writePreviewGrantStore.d.ts

@@ -0,0 +1,10 @@
+import type { WriteDataToolName } from "./writePreviewGrant.js";
+/**
+ * Process-global store so preview tokens remain valid across HTTP round-trips
+ * (each request uses a fresh ServerState for query plans / results).
+ */
+export declare const writePreviewGrantStore: {
+    issue(fingerprint: string, writeToolName: WriteDataToolName): string;
+    consume(token: string, fingerprint: string, writeToolName: WriteDataToolName): boolean;
+};
+//# sourceMappingURL=writePreviewGrantStore.d.ts.map

package/dist/writePreviewGrantStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreviewGrantStore.d.ts","sourceRoot":"","sources":["../src/writePreviewGrantStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAoBhE;;;GAGG;AACH,eAAO,MAAM,sBAAsB;uBACd,MAAM,iBAAiB,iBAAiB,GAAG,MAAM;mBAa3D,MAAM,eACA,MAAM,iBACJ,iBAAiB,GAC/B,OAAO;CAqBX,CAAC"}

package/dist/writePreviewGrantStore.js

@@ -0,0 +1,47 @@
+import { randomBytes } from "node:crypto";
+const WRITE_PREVIEW_GRANT_TTL_MS = 10 * 60 * 1000;
+const grants = new Map();
+function purgeExpiredGrants(now) {
+    for (const [token, grant] of grants) {
+        if (grant.expiresAt < now) {
+            grants.delete(token);
+        }
+    }
+}
+/**
+ * Process-global store so preview tokens remain valid across HTTP round-trips
+ * (each request uses a fresh ServerState for query plans / results).
+ */
+export const writePreviewGrantStore = {
+    issue(fingerprint, writeToolName) {
+        const now = Date.now();
+        purgeExpiredGrants(now);
+        const token = randomBytes(24).toString("base64url");
+        grants.set(token, {
+            fingerprint,
+            writeToolName,
+            expiresAt: now + WRITE_PREVIEW_GRANT_TTL_MS,
+        });
+        return token;
+    },
+    consume(token, fingerprint, writeToolName) {
+        const now = Date.now();
+        purgeExpiredGrants(now);
+        if (!token) {
+            return false;
+        }
+        const grant = grants.get(token);
+        if (!grant) {
+            return false;
+        }
+        if (grant.expiresAt < now ||
+            grant.fingerprint !== fingerprint ||
+            grant.writeToolName !== writeToolName) {
+            grants.delete(token);
+            return false;
+        }
+        grants.delete(token);
+        return true;
+    },
+};
+//# sourceMappingURL=writePreviewGrantStore.js.map

package/dist/writePreviewGrantStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePreviewGrantStore.js","sourceRoot":"","sources":["../src/writePreviewGrantStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEpD,SAAS,kBAAkB,CAAC,GAAW;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK,CAAC,WAAmB,EAAE,aAAgC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE;YAChB,WAAW;YACX,aAAa;YACb,SAAS,EAAE,GAAG,GAAG,0BAA0B;SAC5C,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,KAAa,EACb,WAAmB,EACnB,aAAgC;QAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,KAAK,CAAC,SAAS,GAAG,GAAG;YACrB,KAAK,CAAC,WAAW,KAAK,WAAW;YACjC,KAAK,CAAC,aAAa,KAAK,aAAa,EACrC,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC"}

package/dist/writeSafety.d.ts

@@ -0,0 +1,21 @@
+export declare const SQL_FILTER_OPERATORS: readonly ["=", "!=", ">", ">=", "<", "<=", "LIKE", "IN", "IS NULL", "IS NOT NULL"];
+export type SqlFilterOperator = (typeof SQL_FILTER_OPERATORS)[number];
+export interface SqlFilter {
+    column: string;
+    operator: SqlFilterOperator;
+    value?: unknown;
+    values?: unknown[];
+}
+export interface SqlTypeDeclaration {
+    type: string;
+    nullable?: boolean;
+    isPrimaryKey?: boolean;
+    isUnique?: boolean;
+    isIdentity?: boolean;
+    identitySeed?: number;
+    identityIncrement?: number;
+}
+export declare function normalizeSqlType(rawType: string): string;
+export declare function buildCreateColumnDefinition(columnName: string, declaration: SqlTypeDeclaration): string;
+export declare function buildParameterizedWhereClause(filters: SqlFilter[], input: (name: string, value: unknown) => unknown, parameterPrefix?: string): string;
+//# sourceMappingURL=writeSafety.d.ts.map

package/dist/writeSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeSafety.d.ts","sourceRoot":"","sources":["../src/writeSafety.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB,oFAWvB,CAAC;AAGX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAqFD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6BxD;AAED,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,kBAAkB,GAC9B,MAAM,CAwBR;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,EAAE,EACpB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,EAChD,eAAe,SAAW,GACzB,MAAM,CA0CR"}