@mcpolyglot/connector-sql 0.2.0 → 0.3.1

package/dist/policy.js

@@ -0,0 +1,343 @@
+import sqlParser from 'node-sql-parser';
+import { z } from 'zod';
+const { Parser } = sqlParser;
+const parser = new Parser();
+export const AccessSchema = z.enum(['read', 'write', 'none']);
+export const PolicySchema = z
+    .object({
+    /** Per-table access. Keys are `table` or `schema.table`, case-insensitive. */
+    tables: z.record(z.string(), AccessSchema).default({}),
+    /** Access for tables not listed in `tables`. Never `write`: writes are opt-in per table. */
+    defaultAccess: z.enum(['read', 'none']).default('read'),
+    /** Columns no query may reference, as `table.column` (`*.column` matches any table). */
+    denyColumns: z.array(z.string()).default([]),
+    maxRows: z.number().int().positive().optional(),
+    maxWritesPerCall: z.number().int().positive().default(1),
+    statementTimeoutMs: z.number().int().positive().optional(),
+    /** How long an `execute` idempotencyKey is remembered. */
+    idempotencyWindowMinutes: z.number().positive().default(10),
+})
+    .strict();
+const DB_FOR = {
+    postgres: 'postgresql',
+    mysql: 'mysql',
+    mariadb: 'mariadb',
+    sqlite: 'sqlite',
+};
+const WRITE_STATEMENTS = new Set(['insert', 'update', 'delete', 'replace']);
+/**
+ * Functions no policy may call. They read or write the server's filesystem, reach other
+ * hosts, or stall the connection, and a read-only transaction does not stop any of them.
+ * This list is defense-in-depth: the database role's privileges are the real control.
+ */
+export const DENIED_FUNCTIONS = new Set([
+    // Postgres: server filesystem
+    'pg_read_file',
+    'pg_read_binary_file',
+    'pg_ls_dir',
+    'pg_ls_logdir',
+    'pg_ls_waldir',
+    'pg_ls_tmpdir',
+    'pg_ls_archive_statusdir',
+    'pg_stat_file',
+    'lo_import',
+    'lo_export',
+    'lo_get',
+    'lo_put',
+    'lo_from_bytea',
+    // Postgres: network / other sessions / server state
+    'dblink',
+    'dblink_connect',
+    'dblink_connect_u',
+    'dblink_exec',
+    'dblink_open',
+    'dblink_fetch',
+    'dblink_send_query',
+    'pg_terminate_backend',
+    'pg_cancel_backend',
+    'pg_reload_conf',
+    'pg_rotate_logfile',
+    'set_config',
+    'pg_advisory_lock',
+    'pg_advisory_xact_lock',
+    'pg_sleep',
+    'pg_sleep_for',
+    'pg_sleep_until',
+    // MySQL / MariaDB
+    'load_file',
+    'sleep',
+    'benchmark',
+    'sys_exec',
+    'sys_eval',
+    'sys_get',
+    'sys_set',
+    // SQLite
+    'load_extension',
+    'readfile',
+    'writefile',
+    'edit',
+    'fsdir',
+]);
+/** Schemas hidden from every policy unless a `tables` key names one of their tables. */
+const SYSTEM_SCHEMAS = new Set([
+    'information_schema',
+    'pg_catalog',
+    'mysql',
+    'performance_schema',
+    'sys',
+]);
+const SYSTEM_TABLE_PREFIXES = ['pg_', 'sqlite_'];
+/** Classify one SQL string against a policy. Pure: never touches the database. */
+export function classify(sql, policy, dialect) {
+    const opt = { database: DB_FOR[dialect] };
+    const deny = (reason, extra = {}) => ({
+        allow: false,
+        reason,
+        tables: [],
+        ...extra,
+    });
+    let ast;
+    let tableRefs;
+    let columnRefs;
+    try {
+        ast = parser.astify(sql, opt);
+        tableRefs = parser.tableList(sql, opt);
+        columnRefs = parser.columnList(sql, opt);
+    }
+    catch (err) {
+        // Unparseable SQL is denied: anything the classifier can't see, it can't vouch for.
+        return deny(`Could not parse SQL as ${dialect}: ${err.message.slice(0, 200)}`);
+    }
+    const stmts = (Array.isArray(ast) ? ast : [ast]);
+    if (stmts.length !== 1)
+        return deny(`Exactly one statement per call; got ${stmts.length}.`);
+    const stmt = stmts[0];
+    const type = String(stmt.type ?? 'unknown').toLowerCase();
+    if (type !== 'select' && !WRITE_STATEMENTS.has(type)) {
+        return deny(`"${type.toUpperCase()}" statements are always blocked (DDL/admin).`, {
+            statement: type,
+        });
+    }
+    if ((type === 'update' || type === 'delete') && !stmt.where) {
+        return deny(`${type.toUpperCase()} without a WHERE clause is blocked.`, { statement: type });
+    }
+    if ((type === 'update' || type === 'delete') && !referencesColumn(stmt.where)) {
+        return deny(`${type.toUpperCase()} with a WHERE clause that names no column (e.g. WHERE 1=1) is blocked.`, { statement: type });
+    }
+    // `SELECT ... INTO OUTFILE/DUMPFILE` (MySQL) and `SELECT ... INTO newtable` (Postgres) write
+    // to the server even inside a read-only transaction.
+    if (stmt.into && (stmt.into.keyword || stmt.into.expr || stmt.into.type)) {
+        return deny(`SELECT ... INTO is blocked; it writes to the server.`, { statement: type });
+    }
+    const fn = findDeniedFunction(ast);
+    if (fn) {
+        return deny(`Function "${fn}" is always blocked (file, network, or server access).`, {
+            statement: type,
+        });
+    }
+    const tables = [];
+    for (const ref of tableRefs) {
+        const [rawOp, schema, name] = ref.split('::');
+        const op = WRITE_STATEMENTS.has(rawOp.toLowerCase()) ? 'write' : 'read';
+        const qualified = schema && schema !== 'null' ? `${schema}.${name}` : name;
+        tables.push({ name: qualified, op });
+        if (isSystemTable(schema, name) && !explicitlyListed(policy, schema, name)) {
+            return deny(`System table "${qualified}" is hidden; list it in policy.tables to expose it.`, {
+                statement: type,
+                tables,
+            });
+        }
+        const access = tableAccess(policy, schema, name);
+        if (access === 'none') {
+            return deny(`Table "${qualified}" is not accessible under this policy.`, {
+                statement: type,
+                tables,
+            });
+        }
+        if (op === 'write' && access !== 'write') {
+            return deny(`Table "${qualified}" is read-only under this policy; ${type} denied.`, {
+                statement: type,
+                tables,
+            });
+        }
+    }
+    const denied = policy.denyColumns.map((c) => {
+        const i = c.lastIndexOf('.');
+        return { table: c.slice(0, i).toLowerCase(), column: c.slice(i + 1).toLowerCase() };
+    });
+    if (denied.length > 0) {
+        const referenced = tables.map((t) => t.name.split('.').pop().toLowerCase());
+        // A column with no table qualifier could come from any referenced table, so it's
+        // checked against all of them.
+        const deniedFor = (table) => denied.filter((d) => d.table === '*' ||
+            (table === null ? referenced.includes(bareName(d.table)) : bareName(d.table) === table));
+        // A bare identifier that names a table or alias in FROM is a whole-row reference
+        // (`SELECT u FROM users u`, `to_jsonb(u)`, `u::text`): every column, including denied
+        // ones, comes back inside one value. Treat it like `SELECT *` on that table.
+        const rowRefs = tableNamesAndAliases(ast, referenced);
+        for (const ref of columnRefs) {
+            const [refOp, rawTable, rawCol] = ref.split('::');
+            // DELETE reports `table.(.*)` but returns no columns; its WHERE refs are still checked.
+            if (refOp === 'delete' && rawCol === '(.*)')
+                continue;
+            let table = rawTable === 'null' ? null : bareName(rawTable.toLowerCase());
+            let col = rawCol.toLowerCase();
+            let wholeRow = col === '(.*)';
+            if (table === null && !wholeRow && rowRefs.has(col)) {
+                table = rowRefs.get(col);
+                col = '(.*)';
+                wholeRow = true;
+            }
+            const hits = deniedFor(table);
+            const hit = wholeRow ? hits[0] : hits.find((d) => d.column === col);
+            if (hit) {
+                const what = rawCol === '(.*)'
+                    ? `SELECT * would expose`
+                    : wholeRow
+                        ? `Whole-row reference "${rawCol}" would expose`
+                        : `Query references`;
+                return deny(`${what} denied column "${hit.table}.${hit.column}". List allowed columns explicitly.`, { statement: type, tables });
+            }
+        }
+    }
+    return { allow: true, reason: 'Allowed by policy.', statement: type, tables };
+}
+const RANK = { none: 0, read: 1, write: 2 };
+function isSystemTable(schema, name) {
+    const s = schema && schema !== 'null' ? schema.toLowerCase() : null;
+    if (s)
+        return SYSTEM_SCHEMAS.has(s);
+    const n = name.toLowerCase();
+    return SYSTEM_TABLE_PREFIXES.some((p) => n.startsWith(p));
+}
+function explicitlyListed(policy, schema, name) {
+    const bare = name.toLowerCase();
+    const qualified = schema && schema !== 'null' ? `${schema}.${name}`.toLowerCase() : undefined;
+    return Object.keys(policy.tables).some((k) => {
+        const key = k.toLowerCase();
+        return key === bare || key === qualified;
+    });
+}
+/** Depth-first walk over every object/array in the AST. */
+function* walk(node, seen = new Set()) {
+    if (node === null || typeof node !== 'object' || seen.has(node))
+        return;
+    seen.add(node);
+    if (Array.isArray(node)) {
+        for (const child of node)
+            yield* walk(child, seen);
+        return;
+    }
+    const obj = node;
+    yield obj;
+    for (const v of Object.values(obj))
+        yield* walk(v, seen);
+}
+/** Function name from the several shapes node-sql-parser uses. */
+function functionName(node) {
+    const n = node.name;
+    if (typeof n === 'string')
+        return n.toLowerCase();
+    if (n && typeof n === 'object') {
+        const parts = n.name;
+        if (Array.isArray(parts)) {
+            const last = parts[parts.length - 1];
+            if (last && typeof last.value === 'string')
+                return last.value.toLowerCase();
+        }
+    }
+    return null;
+}
+function findDeniedFunction(ast) {
+    for (const node of walk(ast)) {
+        if (node.type !== 'function' && node.type !== 'aggr_func')
+            continue;
+        const name = functionName(node);
+        if (name && DENIED_FUNCTIONS.has(name))
+            return name;
+    }
+    return null;
+}
+function referencesColumn(where) {
+    for (const node of walk(where))
+        if (node.type === 'column_ref')
+            return true;
+    return false;
+}
+/**
+ * Map of every bare name the query can use as a whole-row reference (table names and
+ * FROM aliases, lowercased) to the underlying table's bare name.
+ */
+function tableNamesAndAliases(ast, referenced) {
+    const out = new Map();
+    for (const t of referenced)
+        out.set(t, t);
+    for (const node of walk(ast)) {
+        if (typeof node.table !== 'string')
+            continue;
+        const table = bareName(node.table.toLowerCase());
+        if (typeof node.as === 'string')
+            out.set(node.as.toLowerCase(), table);
+    }
+    return out;
+}
+/**
+ * Every policy key that could name this table matches; the most restrictive wins. An
+ * unqualified `users` therefore can't dodge a `public.users: none` rule.
+ */
+export function tableAccess(policy, schema, name) {
+    const bare = name.toLowerCase();
+    const qualified = schema && schema !== 'null' ? `${schema}.${name}`.toLowerCase() : undefined;
+    const matches = Object.entries(policy.tables)
+        .filter(([k]) => {
+        const key = k.toLowerCase();
+        return key === bare || key === qualified || (!qualified && bareName(key) === bare);
+    })
+        .map(([, v]) => v);
+    if (matches.length === 0)
+        return policy.defaultAccess;
+    return matches.reduce((a, b) => (RANK[a] <= RANK[b] ? a : b));
+}
+function bareName(t) {
+    return t.split('.').pop();
+}
+export function isColumnDenied(policy, table, column) {
+    const t = bareName(table.toLowerCase());
+    const c = column.toLowerCase();
+    return policy.denyColumns.some((d) => {
+        const i = d.lastIndexOf('.');
+        const dt = d.slice(0, i).toLowerCase();
+        return d.slice(i + 1).toLowerCase() === c && (dt === '*' || bareName(dt) === t);
+    });
+}
+/**
+ * Combine a source policy with a per-agent override so the result is never more
+ * permissive than either: per table the most restrictive access wins, deny lists are
+ * unioned, and every cap takes the smaller value.
+ */
+export function narrowPolicy(base, override) {
+    const lookup = (p, key) => {
+        const i = key.lastIndexOf('.');
+        return i < 0 ? tableAccess(p, 'null', key) : tableAccess(p, key.slice(0, i), key.slice(i + 1));
+    };
+    const stricter = (a, b) => (RANK[a] <= RANK[b] ? a : b);
+    const min = (a, b) => a === undefined ? b : b === undefined ? a : Math.min(a, b);
+    const tables = {};
+    for (const key of new Set([...Object.keys(base.tables), ...Object.keys(override.tables)])) {
+        tables[key] = stricter(lookup(base, key), lookup(override, key));
+    }
+    const maxRows = min(base.maxRows, override.maxRows);
+    const statementTimeoutMs = min(base.statementTimeoutMs, override.statementTimeoutMs);
+    return {
+        tables,
+        defaultAccess: RANK[base.defaultAccess] <= RANK[override.defaultAccess]
+            ? base.defaultAccess
+            : override.defaultAccess,
+        denyColumns: [...new Set([...base.denyColumns, ...override.denyColumns])],
+        maxWritesPerCall: Math.min(base.maxWritesPerCall, override.maxWritesPerCall),
+        idempotencyWindowMinutes: Math.min(base.idempotencyWindowMinutes, override.idempotencyWindowMinutes),
+        ...(maxRows !== undefined && { maxRows }),
+        ...(statementTimeoutMs !== undefined && { statementTimeoutMs }),
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;AAC7B,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,8EAA8E;IAC9E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,4FAA4F;IAC5F,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvD,wFAAwF;IACxF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,0DAA0D;IAC1D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAWZ,MAAM,MAAM,GAAuC;IACjD,QAAQ,EAAE,YAAY;IACtB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAC;AACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,8BAA8B;IAC9B,cAAc;IACd,qBAAqB;IACrB,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,yBAAyB;IACzB,cAAc;IACd,WAAW;IACX,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,oDAAoD;IACpD,QAAQ;IACR,gBAAgB;IAChB,kBAAkB;IAClB,aAAa;IACb,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,kBAAkB;IAClB,uBAAuB;IACvB,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,oBAAoB;IACpB,YAAY;IACZ,OAAO;IACP,oBAAoB;IACpB,KAAK;CACN,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAEjD,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,OAA2B;IAC/E,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAkB,EAAE,CAAC,CAAC;QACrF,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,MAAM,EAAE,EAAE;QACV,GAAG,KAAK;KACT,CAAC,CAAC;IAEH,IAAI,GAAY,CAAC;IACjB,IAAI,SAAmB,CAAC;IACxB,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oFAAoF;QACpF,OAAO,IAAI,CAAC,0BAA0B,OAAO,KAAM,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAI7C,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,uCAAuC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAE1D,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,8CAA8C,EAAE;YAChF,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,qCAAqC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CACT,GAAG,IAAI,CAAC,WAAW,EAAE,wEAAwE,EAC7F,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;IACJ,CAAC;IACD,6FAA6F;IAC7F,qDAAqD;IACrD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,sDAAsD,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,EAAE,wDAAwD,EAAE;YACnF,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;QAC1E,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAErC,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,iBAAiB,SAAS,qDAAqD,EAAE;gBAC3F,SAAS,EAAE,IAAI;gBACf,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,UAAU,SAAS,wCAAwC,EAAE;gBACvE,SAAS,EAAE,IAAI;gBACf,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,UAAU,SAAS,qCAAqC,IAAI,UAAU,EAAE;gBAClF,SAAS,EAAE,IAAI;gBACf,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,iFAAiF;QACjF,+BAA+B;QAC/B,MAAM,SAAS,GAAG,CAAC,KAAoB,EAAE,EAAE,CACzC,MAAM,CAAC,MAAM,CACX,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,KAAK,GAAG;YACf,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAC1F,CAAC;QAEJ,iFAAiF;QACjF,sFAAsF;QACtF,6EAA6E;QAC7E,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;YAC9E,wFAAwF;YACxF,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAS;YACtD,IAAI,KAAK,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,QAAQ,GAAG,GAAG,KAAK,MAAM,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;gBAC1B,GAAG,GAAG,MAAM,CAAC;gBACb,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;YACpE,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GACR,MAAM,KAAK,MAAM;oBACf,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,wBAAwB,MAAM,gBAAgB;wBAChD,CAAC,CAAC,kBAAkB,CAAC;gBAC3B,OAAO,IAAI,CACT,GAAG,IAAI,mBAAmB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,qCAAqC,EACtF,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAC5B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEpE,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,MAAM,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAa,EAAE,OAAO,IAAI,GAAG,EAAU;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACxE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,GAAG,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,IAA6B;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAI,CAAwB,CAAC,IAAI,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAoC,CAAC;YACxE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,UAAoB;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;QACd,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;IAC1E,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CACrC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrF,OAAO;QACL,MAAM;QACN,aAAa,EACX,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,QAAQ,CAAC,aAAa;QAC5B,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAC5E,wBAAwB,EAAE,IAAI,CAAC,GAAG,CAChC,IAAI,CAAC,wBAAwB,EAC7B,QAAQ,CAAC,wBAAwB,CAClC;QACD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,kBAAkB,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpolyglot/connector-sql",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Shared SQL connector for mcpolyglot with Postgres, MySQL/MariaDB, and SQLite dialects. Read-only-by-default with per-dialect enforcement.",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,7 @@
   "dependencies": {
     "node-sql-parser": "^5.3.4",
     "zod": "^4.4.3",
-    "@mcpolyglot/core": "^0.2.0"
+    "@mcpolyglot/core": "^0.4.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.4.1",