@hesed/mysql 0.6.0 → 0.6.2

package/README.md

@@ -26,7 +26,7 @@ $ npm install -g @hesed/mysql
 $ mq COMMAND
 running command...
 $ mq (--version)
-@hesed/mysql/0.6.0 linux-x64 node-v24.18.0
+@hesed/mysql/0.6.2 linux-x64 node-v24.20.0
 $ mq --help [COMMAND]
 USAGE
   $ mq COMMAND
@@ -82,7 +82,7 @@ EXAMPLES
   $ mq mysql auth add -p prod
 ```
 
-_See code: [src/commands/mysql/auth/add.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/add.ts)_
+_See code: [src/commands/mysql/auth/add.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/add.ts)_
 
 ## `mq mysql auth delete`
 
@@ -107,7 +107,7 @@ EXAMPLES
   $ mq mysql auth delete -p prod
 ```
 
-_See code: [src/commands/mysql/auth/delete.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/delete.ts)_
+_See code: [src/commands/mysql/auth/delete.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/delete.ts)_
 
 ## `mq mysql auth list`
 
@@ -127,7 +127,7 @@ EXAMPLES
   $ mq mysql auth list
 ```
 
-_See code: [src/commands/mysql/auth/list.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/list.ts)_
+_See code: [src/commands/mysql/auth/list.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/list.ts)_
 
 ## `mq mysql auth profile`
 
@@ -152,7 +152,7 @@ EXAMPLES
   $ mq mysql auth profile --default test
 ```
 
-_See code: [src/commands/mysql/auth/profile.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/profile.ts)_
+_See code: [src/commands/mysql/auth/profile.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/profile.ts)_
 
 ## `mq mysql auth test`
 
@@ -177,7 +177,7 @@ EXAMPLES
   $ mq mysql auth test -p prod
 ```
 
-_See code: [src/commands/mysql/auth/test.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/test.ts)_
+_See code: [src/commands/mysql/auth/test.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/test.ts)_
 
 ## `mq mysql auth update`
 
@@ -211,7 +211,7 @@ EXAMPLES
   $ mq mysql auth update -p test
 ```
 
-_See code: [src/commands/mysql/auth/update.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/auth/update.ts)_
+_See code: [src/commands/mysql/auth/update.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/update.ts)_
 
 ## `mq mysql databases`
 
@@ -236,7 +236,7 @@ EXAMPLES
   $ mq mysql databases -p staging
 ```
 
-_See code: [src/commands/mysql/databases.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/databases.ts)_
+_See code: [src/commands/mysql/databases.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/databases.ts)_
 
 ## `mq mysql describe-table TABLE`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ mq mysql describe-table orders --toon -p prod
 ```
 
-_See code: [src/commands/mysql/describe-table.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/describe-table.ts)_
+_See code: [src/commands/mysql/describe-table.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/describe-table.ts)_
 
 ## `mq mysql explain QUERY`
 
@@ -294,7 +294,7 @@ EXAMPLES
   $ mq mysql explain "SELECT * FROM orders JOIN users ON orders.user_id = users.id" --json
 ```
 
-_See code: [src/commands/mysql/explain.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/explain.ts)_
+_See code: [src/commands/mysql/explain.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/explain.ts)_
 
 ## `mq mysql indexes TABLE`
 
@@ -323,7 +323,7 @@ EXAMPLES
   $ mq mysql indexes orders --json -p prod
 ```
 
-_See code: [src/commands/mysql/indexes.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/indexes.ts)_
+_See code: [src/commands/mysql/indexes.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/indexes.ts)_
 
 ## `mq mysql query QUERY`
 
@@ -355,7 +355,7 @@ EXAMPLES
   $ mq mysql query "DELETE FROM sessions" -p prod --skip-confirmation
 ```
 
-_See code: [src/commands/mysql/query.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/query.ts)_
+_See code: [src/commands/mysql/query.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/query.ts)_
 
 ## `mq mysql tables`
 
@@ -380,5 +380,5 @@ EXAMPLES
   $ mq mysql tables -p local
 ```
 
-_See code: [src/commands/mysql/tables.ts](https://github.com/hesedcasa/mysql/blob/v0.6.0/src/commands/mysql/tables.ts)_
+_See code: [src/commands/mysql/tables.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/tables.ts)_
 <!-- commandsstop -->

package/dist/commands/mysql/describe-table.d.ts

@@ -1,4 +1,4 @@
-import { ApiResult } from '@hesed/plugin-lib';
+import { type ApiResult } from '@hesed/plugin-lib';
 import { BaseCommand } from '../../base-command.js';
 export default class MySQLDescribeTable extends BaseCommand {
     static args: {

package/dist/commands/mysql/explain.d.ts

@@ -1,4 +1,4 @@
-import { ApiResult } from '@hesed/plugin-lib';
+import { type ApiResult } from '@hesed/plugin-lib';
 import { BaseCommand } from '../../base-command.js';
 export default class MySQLExplain extends BaseCommand {
     static args: {

package/dist/commands/mysql/indexes.d.ts

@@ -1,4 +1,4 @@
-import { ApiResult } from '@hesed/plugin-lib';
+import { type ApiResult } from '@hesed/plugin-lib';
 import { BaseCommand } from '../../base-command.js';
 export default class MySQLIndexes extends BaseCommand {
     static args: {

package/dist/commands/mysql/query.d.ts

@@ -1,4 +1,4 @@
-import { ApiResult } from '@hesed/plugin-lib';
+import { type ApiResult } from '@hesed/plugin-lib';
 import { BaseCommand } from '../../base-command.js';
 export default class MySQLQuery extends BaseCommand {
     static args: {

package/dist/mysql/config-loader.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectionOptions as MySQL2ConnectionOptions } from 'mysql2/promise';
-export interface DatabaseProfile {
+export type DatabaseProfile = {
     database: string;
     host: string;
     maxConcurrentQueries?: number;
@@ -8,20 +8,20 @@ export interface DatabaseProfile {
     queryQueueTimeoutMs?: number;
     ssl?: boolean;
     user: string;
-}
-interface SafetyConfig {
+};
+type SafetyConfig = {
     blacklistedOperations: string[];
     defaultLimit: number;
     maxConcurrentQueries?: number;
     queryQueueTimeoutMs?: number;
     requireConfirmationFor: string[];
-}
-export interface MySQLConfig {
+};
+export type MySQLConfig = {
     defaultFormat: 'csv' | 'json' | 'table' | 'toon';
     defaultProfile: string;
     profiles: Record<string, DatabaseProfile>;
     safety: SafetyConfig;
-}
+};
 type MySQLConnectionOptions = Pick<MySQL2ConnectionOptions, 'connectTimeout' | 'database' | 'host' | 'multipleStatements' | 'password' | 'port' | 'ssl' | 'user'>;
 export declare function getMySQLConnectionOptions(config: MySQLConfig, profileName: string): MySQLConnectionOptions;
 export {};

package/dist/mysql/database.d.ts

@@ -1,36 +1,36 @@
 import type { ApiResult } from '@hesed/plugin-lib';
 export type OutputFormat = 'csv' | 'json' | 'table' | 'toon';
-export interface QueryData {
+export type QueryData = {
     message?: string;
     notices?: string;
     requiresConfirmation?: boolean;
     result?: unknown;
-}
-export interface DatabaseListData {
+};
+export type DatabaseListData = {
     databases: string[];
     result?: string;
-}
-export interface TableListData {
+};
+export type TableListData = {
     result?: string;
     tables: string[];
-}
-export interface TableStructureData {
+};
+export type TableStructureData = {
     result?: string;
-    structure: Record<string, unknown>[];
-}
-export interface IndexData {
-    indexes: Record<string, unknown>[];
+    structure: Array<Record<string, unknown>>;
+};
+export type IndexData = {
+    indexes: Array<Record<string, unknown>>;
     result?: string;
-}
-export interface ExplainData {
-    plan: Record<string, unknown>[];
+};
+export type ExplainData = {
+    plan: Array<Record<string, unknown>>;
     result?: string;
-}
-interface ConnectionTestData {
+};
+type ConnectionTestData = {
     database: string;
     result?: string;
     version: string;
-}
+};
 export type QueryResult = ApiResult & {
     data?: QueryData;
 };
@@ -52,7 +52,7 @@ export type ExplainResult = ApiResult & {
 export type ConnectionTestResult = ApiResult & {
     data?: ConnectionTestData;
 };
-export interface DatabaseUtil {
+export type DatabaseUtil = {
     closeAll(): Promise<void>;
     describeTable(profileName: string, table: string, format?: OutputFormat): Promise<TableStructureResult>;
     executeQuery(profileName: string, query: string, format?: OutputFormat, skipConfirmation?: boolean): Promise<QueryResult>;
@@ -60,5 +60,5 @@ export interface DatabaseUtil {
     listDatabases(profileName: string): Promise<DatabaseListResult>;
     listTables(profileName: string): Promise<TableListResult>;
     showIndexes(profileName: string, table: string, format?: OutputFormat): Promise<IndexResult>;
-}
+};
 export {};

package/dist/mysql/formatters.js

@@ -1,4 +1,5 @@
 import { encode } from '@toon-format/toon';
+import { Buffer } from 'node:buffer';
 function formatAsCsv(rows, fields) {
     if (!rows || rows.length === 0) {
         return '';

package/dist/mysql/mysql-client.js

@@ -68,9 +68,10 @@ export async function testDirectConnection(profile) {
     return result;
 }
 export async function closeConnections() {
-    if (mysqlUtil) {
-        await mysqlUtil.closeAll();
-        mysqlUtil = null;
-        cachedConfig = null;
+    if (!mysqlUtil) {
+        return;
     }
+    await mysqlUtil.closeAll();
+    mysqlUtil = null;
+    cachedConfig = null;
 }

package/dist/mysql/mysql-utils.d.ts

@@ -1,9 +1,9 @@
-import type { MySQLConfig } from './config-loader.js';
 import type { ConnectionTestResult, DatabaseListResult, DatabaseUtil, ExplainResult, IndexResult, OutputFormat, QueryResult, TableListResult, TableStructureResult } from './database.js';
+import { type MySQLConfig } from './config-loader.js';
 export declare class MySQLUtil implements DatabaseUtil {
-    private config;
-    private pools;
-    private querySlots;
+    private readonly config;
+    private readonly pools;
+    private readonly querySlots;
     constructor(config: MySQLConfig);
     closeAll(): Promise<void>;
     describeTable(profileName: string, table: string, format?: 'json' | 'table' | 'toon'): Promise<TableStructureResult>;

package/dist/mysql/mysql-utils.js

@@ -4,6 +4,10 @@ import { FORMATTERS } from './formatters.js';
 import { analyzeQuery, applyDefaultLimit, checkBlacklist, getQueryType, requiresConfirmation } from './query-validator.js';
 const DEFAULT_MAX_CONCURRENT_QUERIES = 5;
 const DEFAULT_QUEUE_TIMEOUT_MS = 60_000;
+// Formats that must emit only the data payload on stdout.
+const MACHINE_FORMATS = new Set(['csv', 'json', 'toon']);
+// Query types whose result set is rows rather than an OkPacket.
+const READ_QUERY_TYPES = new Set(['DESCRIBE', 'EXPLAIN', 'SELECT', 'SHOW']);
 export class MySQLUtil {
     config;
     pools;
@@ -16,14 +20,16 @@ export class MySQLUtil {
     async closeAll() {
         // Reject queued queries first so nothing waits forever on a closed util.
         for (const slot of this.querySlots.values()) {
-            for (const waiter of slot.waiting.splice(0)) {
+            const { waiting } = slot;
+            slot.waiting = [];
+            for (const waiter of waiting) {
                 waiter.reject(new Error('Connections were closed while the query was waiting for a free slot'));
             }
         }
         this.querySlots.clear();
         const pools = [...this.pools.values()];
         this.pools.clear();
-        await Promise.allSettled(pools.map((pool) => pool.end()));
+        await Promise.allSettled(pools.map(async (pool) => pool.end()));
     }
     async describeTable(profileName, table, format = 'table') {
         try {
@@ -39,7 +45,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -66,7 +72,7 @@ export class MySQLUtil {
         }
         // Machine-readable formats must emit only the data payload on stdout, so
         // analysis warnings and status lines are collected as notices instead.
-        const machineFormat = format === 'json' || format === 'csv' || format === 'toon';
+        const isMachineFormat = MACHINE_FORMATS.has(format);
         const notices = [];
         const warnings = analyzeQuery(query);
         if (warnings.length > 0) {
@@ -83,7 +89,7 @@ export class MySQLUtil {
         }
         try {
             const [rows, fields] = await this.runQuery(profileName, finalQuery);
-            const isRead = queryType === 'SELECT' || queryType === 'SHOW' || queryType === 'DESCRIBE' || queryType === 'EXPLAIN';
+            const isRead = READ_QUERY_TYPES.has(queryType);
             let data = isRead
                 ? this.formatReadResult(rows, fields, format, notices)
                 : this.formatWriteResult(rows, notices, format);
@@ -95,8 +101,8 @@ export class MySQLUtil {
             // For machine formats the data is returned alone and notices go to stderr.
             return {
                 data: {
-                    notices: machineFormat ? notice : undefined,
-                    result: machineFormat ? data : `${notice}\n\n${data}`,
+                    notices: isMachineFormat ? notice : undefined,
+                    result: isMachineFormat ? data : `${notice}\n\n${data}`,
                 },
                 success: true,
             };
@@ -104,7 +110,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -123,7 +129,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -143,7 +149,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -152,6 +158,14 @@ export class MySQLUtil {
         try {
             const [rows] = await this.runQuery(profileName, 'SHOW TABLES');
             const rowsArray = rows;
+            // SHOW TABLES names its one column after the database, so the key has to
+            // be read off a row — an empty schema has none.
+            if (rowsArray.length === 0) {
+                return {
+                    data: { result: 'No tables found in this database', tables: [] },
+                    success: true,
+                };
+            }
             const tableKey = Object.keys(rowsArray[0])[0];
             const tables = rowsArray.map((row) => row[tableKey]);
             return {
@@ -165,7 +179,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -184,7 +198,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -205,14 +219,14 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
     }
     // Grants a query slot for the profile, or waits until one frees up. The
     // returned release callback must be invoked exactly once per acquisition.
-    acquireQuerySlot(profileName) {
+    async acquireQuerySlot(profileName) {
         const limit = this.getQueryLimit(profileName);
         let slot = this.querySlots.get(profileName);
         if (!slot) {
@@ -231,7 +245,7 @@ export class MySQLUtil {
         };
         if (state.active < limit) {
             state.active += 1;
-            return Promise.resolve(release);
+            return release;
         }
         const timeoutMs = this.config.profiles[profileName]?.queryQueueTimeoutMs ??
             this.config.safety.queryQueueTimeoutMs ??
@@ -312,7 +326,7 @@ export class MySQLUtil {
     async runQuery(profileName, sql) {
         const release = await this.acquireQuerySlot(profileName);
         try {
-            return (await this.getPool(profileName).query(sql));
+            return await this.getPool(profileName).query(sql);
         }
         finally {
             release();

package/dist/mysql/query-validator.d.ts

@@ -1,16 +1,16 @@
-interface BlacklistCheckResult {
+type BlacklistCheckResult = {
     allowed: boolean;
     reason?: string;
-}
-interface ConfirmationCheckResult {
+};
+type ConfirmationCheckResult = {
     message?: string;
     required: boolean;
-}
-interface QueryWarning {
+};
+type QueryWarning = {
     level: 'info' | 'warning';
     message: string;
     suggestion: string;
-}
+};
 export declare function checkBlacklist(query: string, blacklistedOperations: string[]): BlacklistCheckResult;
 export declare function requiresConfirmation(query: string, confirmationOperations: string[]): ConfirmationCheckResult;
 export declare function getQueryType(query: string): string;

package/dist/mysql/query-validator.js

@@ -1,8 +1,149 @@
+// Escapes a config-supplied operation so it can be embedded in a pattern.
+function escapeForPattern(word) {
+    return word.replaceAll(/[$()*+.?[\\\]^{|}]/g, String.raw `\$&`);
+}
+// String literals ('...', "...") and quoted identifiers (`...`).
+const QUOTE_CHARS = new Set(['"', "'", '`']);
+// Returns the index just past the quoted run that starts at `start`, so the
+// caller can copy a string literal or quoted identifier through untouched. An
+// unterminated quote swallows the rest of the query, which keeps any keyword it
+// hides visible to the safety checks.
+function findQuoteEnd(query, start) {
+    const quote = query[start];
+    for (let index = start + 1; index < query.length; index += 1) {
+        // Backslash escapes apply inside string literals but not inside `identifiers`.
+        if (quote !== '`' && query[index] === '\\') {
+            index += 1;
+            continue;
+        }
+        if (query[index] === quote) {
+            // A doubled quote is an escaped quote, not the end of the run.
+            if (query[index + 1] === quote) {
+                index += 1;
+                continue;
+            }
+            return index + 1;
+        }
+    }
+    return query.length;
+}
+// Walks the query, yielding each stretch of it alongside the text MySQL would
+// actually execute there. Code and quoted runs come through untouched; an
+// ordinary comment collapses to a single space, so keyword matching sees
+// `DROP /* here */ DATABASE` for what MySQL sees: `DROP DATABASE`.
+//
+// The scan is quote aware — `--`, `#` and `/*` inside a string literal or a
+// quoted identifier are data, not the start of a comment.
+//
+// A `/*! ... */` version comment keeps its body, because MySQL executes it —
+// only the `/*!`, its leading version digits and the closing `*/` become
+// whitespace, so `DROP /*!40000 */ DATABASE` reads as `DROP DATABASE` here too.
+// MySQL 8.4 consumes a five- or six-digit version (`/*!080411 */` runs), and
+// any other digit run it executes as part of the body, where it can only turn
+// the statement into a syntax error — so every leading digit goes, whatever the
+// server's rule for them is.
+// A `/*+ ... */` hint comment goes entirely, like any other comment: its body
+// is hint syntax, never SQL MySQL would run.
+//
+// `quoted` marks a string literal or quoted identifier, so a caller that cares
+// about clause structure rather than raw text can blank it out.
+function* scanQuery(query) {
+    let index = 0;
+    while (index < query.length) {
+        const char = query[index];
+        if (QUOTE_CHARS.has(char)) {
+            const end = findQuoteEnd(query, index);
+            yield { executable: query.slice(index, end), quoted: true, start: index };
+            index = end;
+            continue;
+        }
+        if (char === '/' && query[index + 1] === '*') {
+            const close = query.indexOf('*/', index + 2);
+            const end = close === -1 ? query.length : close + 2;
+            const body = query.slice(index + 3, close === -1 ? query.length : close);
+            const versionComment = query[index + 2] === '!';
+            yield { executable: versionComment ? ` ${body.replace(/^\d+/u, ' ')} ` : ' ', quoted: false, start: index };
+            index = end;
+            continue;
+        }
+        // `--` only opens a comment when whitespace (or the end of the query)
+        // follows it; `a--b` is two minus signs.
+        const dashComment = char === '-' && query[index + 1] === '-' && /^\s*$/u.test(query[index + 2] ?? '');
+        if (char === '#' || dashComment) {
+            const newline = query.indexOf('\n', index);
+            yield { executable: ' ', quoted: false, start: index };
+            index = newline === -1 ? query.length : newline;
+            continue;
+        }
+        yield { executable: char, quoted: false, start: index };
+        index += 1;
+    }
+}
+// Replaces every non-executable MySQL comment with a single space, and every
+// string literal or quoted identifier too when `blankQuoted` is set.
+function stripComments(query, blankQuoted = false) {
+    let stripped = '';
+    for (const { executable, quoted } of scanQuery(query)) {
+        stripped += blankQuoted && quoted ? ' ' : executable;
+    }
+    return stripped;
+}
+// Index of the `;` that terminates the query's single statement — the last one
+// with nothing but whitespace and comments after it — or -1 when the query is
+// not terminated. A `;` inside a string literal or a comment is not a
+// terminator, because MySQL does not execute it as one.
+function findTrailingTerminator(query) {
+    let terminator = -1;
+    for (const { executable, start } of scanQuery(query)) {
+        if (executable === ';') {
+            terminator = start;
+        }
+        else if (/\S/u.test(executable)) {
+            // Executable text after a `;` means that `;` separated statements rather
+            // than ending the query.
+            terminator = -1;
+        }
+    }
+    return terminator;
+}
+// Strips comments, then trims and upper-cases what is left, giving the checks
+// below a single view of the SQL MySQL would actually execute. Quoted text
+// stays, so a keyword hidden in a string literal is still visible.
+function normalize(query) {
+    return stripComments(query).trim().toUpperCase();
+}
+// The same view with every string literal and quoted identifier blanked out.
+// Clause detection asks a structural question — does this statement have a
+// WHERE, does it have a LIMIT — and `SELECT 'LIMIT 5' FROM metrics` has neither,
+// so keeping the quoted text there would drop the row cap off a query that is
+// in fact unbounded. The blacklist and confirmation checks ask the opposite
+// question and keep quoted text on purpose.
+function normalizeClauses(query) {
+    return stripComments(query, true).trim().toUpperCase();
+}
+// Tests whether an operation appears in an already-normalized query as whole
+// words, allowing any run of whitespace between the words of a multi-word
+// operation ("DROP  DATABASE", "DROP\nDATABASE"). Comments are gone by this
+// point, so a comment between those words no longer hides the operation.
+//
+// The scan deliberately covers the whole query rather than just the leading
+// keyword: a destructive keyword is worth flagging wherever it appears. Word
+// boundaries stop the reverse mistake, where `nowhere_stats` reads as a WHERE
+// clause or `limit_reached` as a LIMIT. A keyword inside a string literal still
+// matches, which errs toward asking for confirmation rather than skipping it —
+// and keeps `PREPARE s FROM 'DROP DATABASE x'` in reach of the blacklist.
+function containsOperation(normalizedQuery, operation) {
+    const pattern = operation
+        .trim()
+        .split(/\s+/)
+        .map((word) => escapeForPattern(word))
+        .join(String.raw `\s+`);
+    return new RegExp(String.raw `\b${pattern}\b`, 'u').test(normalizedQuery);
+}
 export function checkBlacklist(query, blacklistedOperations) {
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalize(query);
     for (const operation of blacklistedOperations) {
-        const normalizedOp = operation.toUpperCase();
-        if (normalizedQuery.includes(normalizedOp)) {
+        if (containsOperation(normalizedQuery, operation.toUpperCase())) {
             return {
                 allowed: false,
                 reason: `Operation "${operation}" is blacklisted and not allowed`,
@@ -12,10 +153,9 @@ export function checkBlacklist(query, blacklistedOperations) {
     return { allowed: true };
 }
 export function requiresConfirmation(query, confirmationOperations) {
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalize(query);
     for (const operation of confirmationOperations) {
-        const normalizedOp = operation.toUpperCase();
-        if (normalizedQuery.startsWith(normalizedOp) || normalizedQuery.includes(` ${normalizedOp} `)) {
+        if (containsOperation(normalizedQuery, operation.toUpperCase())) {
             return {
                 message: `This query contains a destructive operation: ${operation}`,
                 required: true,
@@ -25,8 +165,8 @@ export function requiresConfirmation(query, confirmationOperations) {
     return { required: false };
 }
 export function getQueryType(query) {
-    const normalizedQuery = query.trim().toUpperCase();
-    const firstWord = normalizedQuery.split(/\s+/)[0];
+    const normalizedQuery = normalize(query);
+    const firstWord = normalizedQuery.split(/\s+/, 1)[0];
     const knownTypes = [
         'SELECT',
         'INSERT',
@@ -47,10 +187,10 @@ export function getQueryType(query) {
 }
 export function analyzeQuery(query) {
     const warnings = [];
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalizeClauses(query);
     // Check for missing WHERE clause in UPDATE/DELETE
     if ((normalizedQuery.startsWith('UPDATE') || normalizedQuery.startsWith('DELETE')) &&
-        !normalizedQuery.includes('WHERE')) {
+        !containsOperation(normalizedQuery, 'WHERE')) {
         warnings.push({
             level: 'warning',
             message: 'Missing WHERE clause in UPDATE/DELETE query',
@@ -66,7 +206,7 @@ export function analyzeQuery(query) {
         });
     }
     // Check for missing LIMIT in SELECT
-    if (normalizedQuery.startsWith('SELECT') && !normalizedQuery.includes('LIMIT')) {
+    if (normalizedQuery.startsWith('SELECT') && !containsOperation(normalizedQuery, 'LIMIT')) {
         warnings.push({
             level: 'info',
             message: 'SELECT query without LIMIT',
@@ -76,9 +216,17 @@ export function analyzeQuery(query) {
     return warnings;
 }
 export function applyDefaultLimit(query, defaultLimit) {
-    const normalizedQuery = query.trim().toUpperCase();
-    if (normalizedQuery.startsWith('SELECT') && !normalizedQuery.includes('LIMIT')) {
-        return `${query.trim()} LIMIT ${defaultLimit}`;
+    const normalizedQuery = normalizeClauses(query);
+    if (!normalizedQuery.startsWith('SELECT') || containsOperation(normalizedQuery, 'LIMIT')) {
+        return query;
+    }
+    const terminator = findTrailingTerminator(query);
+    // On its own line either way: a trailing `-- comment` would otherwise swallow
+    // the LIMIT.
+    if (terminator === -1) {
+        return `${query.trim()}\nLIMIT ${defaultLimit}`;
     }
-    return query;
+    // The LIMIT has to go in front of the terminator. After it, MySQL reads
+    // `LIMIT 100` as a second statement and rejects the whole query.
+    return `${query.slice(0, terminator).trim()}\nLIMIT ${defaultLimit}\n${query.slice(terminator).trim()}`;
 }

package/oclif.manifest.json

@@ -689,5 +689,5 @@
       ]
     }
   },
-  "version": "0.6.0"
+  "version": "0.6.2"
 }

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@hesed/mysql",
   "description": "CLI for MySQL database interaction",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "author": "Hesed",
   "bin": {
     "mq": "./bin/run.js"
   },
   "bugs": "https://github.com/hesedcasa/mysql/issues",
   "dependencies": {
-    "@hesed/plugin-lib": "^0.9.0",
+    "@hesed/plugin-lib": "^0.12.3",
     "@inquirer/prompts": "^8.3.0",
     "@oclif/core": "^4",
     "@toon-format/toon": "^2.1.0",
@@ -23,11 +23,11 @@
     "@types/fs-extra": "^11.0.4",
     "@types/mocha": "^10",
     "@types/node": "^26",
-    "@types/sinon": "^21.0.0",
-    "c8": "^11.0.0",
+    "@types/sinon": "^22.0.0",
+    "c8": "^12.0.0",
     "chai": "^6",
-    "eslint": "^9",
-    "eslint-config-oclif": "^6",
+    "eslint": "^10",
+    "eslint-config-oclif": "^7",
     "eslint-config-prettier": "^10",
     "esmock": "^2.7.3",
     "mocha": "^11",
@@ -37,10 +37,11 @@
     "sinon": "^22.0.0",
     "ts-node": "^10",
     "ts-prune": "^0.10.3",
-    "typescript": "^5"
+    "typescript": "^5",
+    "typescript-eslint": "^8.67.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.13.0"
   },
   "files": [
     "./bin",
@@ -68,13 +69,17 @@
     "postpack": "shx rm -f oclif.manifest.json",
     "posttest": "npm run lint",
     "prepack": "oclif manifest && oclif readme",
-    "test": "mocha --forbid-only \"test/**/*.test.ts\"",
+    "test": "mocha --forbid-only \"test/**/*.test.ts\" --ignore \"test/e2e/**\"",
     "test:coverage": "c8 npm test",
     "test:coverage:report": "c8 --reporter=html --reporter=text npm test",
     "version": "oclif readme && git add README.md",
     "find-deadcode": "ts-prune --ignore '(run|default)'",
     "format": "eslint --cache --fix --quiet . && prettier --write --cache .",
-    "pre-commit": "npm run format && npm run find-deadcode"
+    "pre-commit": "npm run format && npm run find-deadcode",
+    "test:e2e": "./scripts/e2e.sh",
+    "e2e:up": "docker compose -f docker/compose.yaml up -d --build --wait",
+    "e2e:down": "docker compose -f docker/compose.yaml down -v --remove-orphans",
+    "e2e:mocha": "mocha --forbid-only \"test/e2e/**/*.e2e.test.ts\""
   },
   "types": "dist/index.d.ts",
   "c8": {