@pilat/mcp-datalink 1.1.0 → 1.2.0

package/dist/utils/formatter.js

@@ -2,9 +2,22 @@
  * Formatting utilities for query results
  */
 /**
- * Format a single value for display
- * Handles null, dates, objects, and primitive values
+ * JSON replacer function that handles BigInt values by converting them to strings.
+ * This prevents "TypeError: Do not know how to serialize a BigInt" when using JSON.stringify.
  */
+export function bigIntReplacer(_key, value) {
+    if (typeof value === 'bigint') {
+        return value.toString();
+    }
+    return value;
+}
+/**
+ * Safely stringify a value to JSON, handling BigInt values.
+ */
+export function safeJsonStringify(value) {
+    return JSON.stringify(value, bigIntReplacer);
+}
+/** Format a value for display (handles null, dates, objects, primitives) */
 export function formatValue(value) {
     if (value === null || value === undefined) {
         return 'NULL';
@@ -19,19 +32,16 @@ export function formatValue(value) {
         return value.toISOString();
     }
     if (typeof value === 'object') {
-        return JSON.stringify(value);
+        return safeJsonStringify(value);
     }
     return String(value);
 }
-/**
- * Escape pipe characters in cell content for Markdown tables
- */
 function escapeForMarkdown(value) {
-    return value.replace(/\|/g, '\\|');
+    return value
+        .replace(/\|/g, '\\|')
+        .replace(/\r\n|\r|\n/g, ' ')
+        .replace(/`/g, '\\`');
 }
-/**
- * Format query results as a Markdown table
- */
 export function formatAsMarkdownTable(columns, rows) {
     if (columns.length === 0) {
         return '';

package/dist/utils/formatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/utils/formatter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,IAAyB;IAEzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,aAAa;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAElD,gBAAgB;IAChB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAErD,YAAY;IACZ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/utils/formatter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,IAAyB;IAEzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,aAAa;IACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAElD,gBAAgB;IAChB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAErD,YAAY;IACZ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5C,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/utils/sql-parser.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Unified SQL Parser Utility
+ *
+ * Provides SQL parsing and validation for PostgreSQL, MySQL, and SQLite
+ * using node-sql-parser library.
+ */
+import type { QueryType } from '../types.js';
+/**
+ * Supported SQL dialects
+ */
+export type SqlDialect = 'PostgreSQL' | 'MySQL' | 'SQLite';
+/**
+ * Inject a LIMIT clause into a SELECT query if it doesn't have one
+ *
+ * @param sql - SQL query
+ * @param limit - Maximum number of rows
+ * @param dialect - SQL dialect
+ * @returns SQL with LIMIT clause
+ */
+export declare function injectLimit(sql: string, limit: number, dialect: SqlDialect): string;
+/**
+ * Result of parsing a SQL query
+ */
+export interface ParseResult {
+    type: QueryType;
+    hasLimit: boolean;
+    isDangerous: boolean;
+    dangerousReason?: string;
+    sql: string;
+}
+/**
+ * Parse and validate a SQL query
+ *
+ * @param sql - SQL query to parse
+ * @param dialect - SQL dialect
+ * @returns Parsed query information
+ * @throws DbMcpError if query is invalid or contains multiple statements
+ */
+export declare function parseQuery(sql: string, dialect: SqlDialect): ParseResult;
+/**
+ * Validate that a parsed SQL query is appropriate for a specific tool
+ *
+ * This function contains the shared validation logic used by all database adapters.
+ * Adapters may perform additional adapter-specific checks before calling this.
+ *
+ * @param parsed - Parsed query result from parseQuery
+ * @param tool - Tool being used ('query' for SELECT, 'execute' for INSERT/UPDATE/DELETE)
+ * @throws DbMcpError if the query is not appropriate for the specified tool
+ */
+export declare function validateQueryForTool(parsed: ParseResult, tool: 'query' | 'execute'): void;
+//# sourceMappingURL=sql-parser.d.ts.map

package/dist/utils/sql-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-parser.d.ts","sourceRoot":"","sources":["../../src/utils/sql-parser.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;AA6J3D;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAyCnF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb;AA6CD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,WAAW,CAwExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,OAAO,GAAG,SAAS,GACxB,IAAI,CA6CN"}

package/dist/utils/sql-parser.js

@@ -0,0 +1,310 @@
+/**
+ * Unified SQL Parser Utility
+ *
+ * Provides SQL parsing and validation for PostgreSQL, MySQL, and SQLite
+ * using node-sql-parser library.
+ */
+import { Parser } from 'node-sql-parser';
+import { DbMcpError, ErrorCode } from './errors.js';
+/**
+ * Prefixes that indicate dangerous SQL operations
+ */
+const DANGEROUS_PREFIXES = [
+    'drop',
+    'truncate',
+    'alter',
+    'create',
+    'grant',
+    'revoke',
+    'rename',
+];
+/**
+ * SQLite-specific dangerous operations
+ */
+const SQLITE_DANGEROUS_OPERATIONS = [
+    'attach',
+    'detach',
+    'vacuum',
+    'reindex',
+];
+/**
+ * SQLite-specific operations that node-sql-parser cannot parse.
+ * These need to be detected before parsing to throw QUERY_BLOCKED instead of INVALID_SQL.
+ * Note: ATTACH is parseable by node-sql-parser, so it's excluded from this list.
+ */
+const SQLITE_UNPARSEABLE_OPERATIONS = [
+    'detach',
+    'vacuum',
+    'reindex',
+];
+/**
+ * Check if SQL starts with a SQLite-specific dangerous operation
+ * that node-sql-parser cannot parse
+ *
+ * @param sql - SQL query to check
+ * @returns Object with isDangerous flag and optional reason
+ */
+function checkSqliteUnparseableDangerousPrefix(sql) {
+    const normalized = sql.trim().toLowerCase();
+    for (const op of SQLITE_UNPARSEABLE_OPERATIONS) {
+        if (normalized.startsWith(op)) {
+            return {
+                isDangerous: true,
+                reason: `${op.toUpperCase()} statements are not allowed`,
+            };
+        }
+    }
+    return { isDangerous: false };
+}
+/**
+ * Create a parser instance for the specified dialect
+ */
+function createParser() {
+    return new Parser();
+}
+/**
+ * Parse SQL and return AST
+ *
+ * @param sql - SQL query to parse
+ * @param dialect - SQL dialect (PostgreSQL, MySQL, SQLite)
+ * @returns Parsed AST
+ * @throws DbMcpError if parsing fails or SQL contains dangerous operations
+ */
+function parseSQL(sql, dialect) {
+    // For SQLite, check for dangerous unparseable operations before parsing
+    // since node-sql-parser may not recognize these statements
+    if (dialect === 'SQLite') {
+        const { isDangerous, reason } = checkSqliteUnparseableDangerousPrefix(sql);
+        if (isDangerous) {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, reason ?? 'Statement is not allowed', { sql });
+        }
+    }
+    const parser = createParser();
+    try {
+        return parser.astify(sql, { database: dialect });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown parse error';
+        throw new DbMcpError(ErrorCode.INVALID_SQL, 'Failed to parse SQL: ' + message, { sql });
+    }
+}
+/**
+ * Convert AST back to SQL string
+ *
+ * @param ast - AST to convert
+ * @param dialect - SQL dialect
+ * @returns SQL string
+ */
+function astToSQL(ast, dialect) {
+    const parser = createParser();
+    return parser.sqlify(ast, { database: dialect });
+}
+/**
+ * Check if a SQL statement type is dangerous
+ *
+ * @param stmtType - Statement type from AST
+ * @param dialect - SQL dialect
+ * @returns Object with isDangerous flag and optional reason
+ */
+function checkDangerousType(stmtType, dialect) {
+    const normalizedType = stmtType.toLowerCase();
+    // Check common dangerous prefixes
+    for (const prefix of DANGEROUS_PREFIXES) {
+        if (normalizedType === prefix || normalizedType.startsWith(prefix)) {
+            return {
+                isDangerous: true,
+                reason: `${prefix.toUpperCase()} statements are not allowed`,
+            };
+        }
+    }
+    // Check SQLite-specific dangerous operations
+    if (dialect === 'SQLite') {
+        for (const op of SQLITE_DANGEROUS_OPERATIONS) {
+            if (normalizedType === op || normalizedType.startsWith(op)) {
+                return {
+                    isDangerous: true,
+                    reason: `${op.toUpperCase()} statements are not allowed`,
+                };
+            }
+        }
+    }
+    return { isDangerous: false };
+}
+/**
+ * Regular expression to check for LIMIT clause in SQL
+ * Matches LIMIT followed by a number, handling whitespace
+ */
+const LIMIT_PATTERN = /\bLIMIT\s+\d+/i;
+/**
+ * Inject a LIMIT clause into a SELECT query if it doesn't have one
+ *
+ * @param sql - SQL query
+ * @param limit - Maximum number of rows
+ * @param dialect - SQL dialect
+ * @returns SQL with LIMIT clause
+ */
+export function injectLimit(sql, limit, dialect) {
+    const ast = parseSQL(sql, dialect);
+    const statements = Array.isArray(ast) ? ast : [ast];
+    if (statements.length !== 1) {
+        return sql;
+    }
+    const stmt = statements[0];
+    if (stmt.type !== 'select') {
+        return sql;
+    }
+    const selectStmt = stmt;
+    // Check if already has limit (value array must have entries)
+    if (selectStmt.limit && Array.isArray(selectStmt.limit.value) && selectStmt.limit.value.length > 0) {
+        return sql;
+    }
+    // Add limit clause
+    selectStmt.limit = {
+        seperator: '',
+        value: [{ type: 'number', value: limit }],
+    };
+    const result = astToSQL(stmt, dialect);
+    // Verify that LIMIT was actually added to the result
+    if (!LIMIT_PATTERN.test(result)) {
+        // LIMIT injection failed - fall back to original SQL
+        // This is a safety measure in case astToSQL doesn't properly serialize the limit
+        console.warn(`[mcp-datalink] LIMIT injection verification failed: astToSQL did not produce LIMIT clause. ` +
+            `Returning original SQL. Dialect: ${dialect}`);
+        return sql;
+    }
+    return result;
+}
+/**
+ * Allowed query types for the execute tool
+ */
+const EXECUTE_ALLOWED_TYPES = ['insert', 'update', 'delete'];
+/**
+ * Data-modifying statement types that should not be in CTEs for query tool
+ */
+const DATA_MODIFYING_TYPES = ['insert', 'update', 'delete'];
+/**
+ * Check if a CTE contains data-modifying statements
+ *
+ * PostgreSQL supports data-modifying CTEs like:
+ *   WITH inserted AS (INSERT ... RETURNING *) SELECT * FROM inserted
+ *
+ * These modify data even though the outer query is a SELECT.
+ *
+ * @param ast - Parsed AST
+ * @returns Object with hasDataModifyingCTE flag and optional reason
+ */
+function checkDataModifyingCTE(ast) {
+    const withClause = ast.with;
+    if (!Array.isArray(withClause)) {
+        return { hasDataModifyingCTE: false };
+    }
+    for (const cte of withClause) {
+        const stmtType = cte.stmt?.type?.toLowerCase();
+        if (stmtType && DATA_MODIFYING_TYPES.includes(stmtType)) {
+            return {
+                hasDataModifyingCTE: true,
+                reason: `CTE contains data-modifying ${stmtType.toUpperCase()} statement`,
+            };
+        }
+    }
+    return { hasDataModifyingCTE: false };
+}
+/**
+ * Parse and validate a SQL query
+ *
+ * @param sql - SQL query to parse
+ * @param dialect - SQL dialect
+ * @returns Parsed query information
+ * @throws DbMcpError if query is invalid or contains multiple statements
+ */
+export function parseQuery(sql, dialect) {
+    const ast = parseSQL(sql, dialect);
+    const statements = Array.isArray(ast) ? ast : [ast];
+    // Filter out null/undefined entries
+    const validStatements = statements.filter((s) => s !== null && s !== undefined);
+    if (validStatements.length === 0) {
+        throw new DbMcpError(ErrorCode.INVALID_SQL, 'No valid SQL statement found', { sql });
+    }
+    if (validStatements.length > 1) {
+        throw new DbMcpError(ErrorCode.MULTI_STATEMENT, 'Multiple SQL statements are not allowed. Please provide a single statement.', { sql, statementCount: validStatements.length });
+    }
+    const stmt = validStatements[0];
+    const stmtType = (stmt.type ?? '').toLowerCase();
+    // Determine query type
+    let queryType;
+    switch (stmtType) {
+        case 'select':
+            queryType = 'select';
+            break;
+        case 'insert':
+            queryType = 'insert';
+            break;
+        case 'update':
+            queryType = 'update';
+            break;
+        case 'delete':
+            queryType = 'delete';
+            break;
+        default:
+            queryType = 'other';
+    }
+    // Check for dangerous operations
+    let { isDangerous, reason } = checkDangerousType(stmtType, dialect);
+    // Check for data-modifying CTEs (e.g. WITH x AS (INSERT ...) SELECT ...)
+    if (!isDangerous) {
+        const cteCheck = checkDataModifyingCTE(stmt);
+        if (cteCheck.hasDataModifyingCTE) {
+            isDangerous = true;
+            reason = cteCheck.reason;
+        }
+    }
+    // Check for LIMIT clause
+    let hasLimit = false;
+    if (queryType === 'select') {
+        const selectStmt = stmt;
+        // node-sql-parser returns limit: { value: [] } even when no LIMIT is present
+        hasLimit = !!(selectStmt.limit && Array.isArray(selectStmt.limit.value) && selectStmt.limit.value.length > 0);
+    }
+    return {
+        type: queryType,
+        hasLimit,
+        isDangerous,
+        dangerousReason: reason,
+        sql,
+    };
+}
+/**
+ * Validate that a parsed SQL query is appropriate for a specific tool
+ *
+ * This function contains the shared validation logic used by all database adapters.
+ * Adapters may perform additional adapter-specific checks before calling this.
+ *
+ * @param parsed - Parsed query result from parseQuery
+ * @param tool - Tool being used ('query' for SELECT, 'execute' for INSERT/UPDATE/DELETE)
+ * @throws DbMcpError if the query is not appropriate for the specified tool
+ */
+export function validateQueryForTool(parsed, tool) {
+    if (tool === 'query') {
+        if (parsed.type !== 'select') {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, 'The query tool only accepts SELECT statements. Use the execute tool for ' +
+                parsed.type.toUpperCase() +
+                ' statements.', { sql: parsed.sql, queryType: parsed.type, tool });
+        }
+        // Block data-modifying CTEs in query tool
+        if (parsed.isDangerous) {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, parsed.dangerousReason ?? 'This operation is not allowed', { sql: parsed.sql, queryType: parsed.type, tool });
+        }
+    }
+    else if (tool === 'execute') {
+        if (parsed.type === 'select') {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, 'The execute tool does not accept SELECT statements. Use the query tool instead.', { sql: parsed.sql, queryType: parsed.type, tool });
+        }
+        if (parsed.isDangerous) {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, parsed.dangerousReason ?? 'This operation is not allowed', { sql: parsed.sql, queryType: parsed.type, tool });
+        }
+        if (!EXECUTE_ALLOWED_TYPES.includes(parsed.type)) {
+            throw new DbMcpError(ErrorCode.QUERY_BLOCKED, 'The execute tool only accepts INSERT, UPDATE, or DELETE statements.', { sql: parsed.sql, queryType: parsed.type, tool });
+        }
+    }
+}
+//# sourceMappingURL=sql-parser.js.map

package/dist/utils/sql-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-parser.js","sourceRoot":"","sources":["../../src/utils/sql-parser.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAO,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOpD;;GAEG;AACH,MAAM,kBAAkB,GAA0B;IAChD,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF;;GAEG;AACH,MAAM,2BAA2B,GAA0B;IACzD,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;CACV,CAAC;AAEF;;;;GAIG;AACH,MAAM,6BAA6B,GAA0B;IAC3D,QAAQ;IACR,QAAQ;IACR,SAAS;CACV,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,qCAAqC,CAAC,GAAW;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,KAAK,MAAM,EAAE,IAAI,6BAA6B,EAAE,CAAC;QAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,6BAA6B;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,YAAY;IACnB,OAAO,IAAI,MAAM,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAmB;IAChD,wEAAwE;IACxE,2DAA2D;IAC3D,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,qCAAqC,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,MAAM,IAAI,0BAA0B,EACpC,EAAE,GAAG,EAAE,CACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAC/E,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,WAAW,EACrB,uBAAuB,GAAG,OAAO,EACjC,EAAE,GAAG,EAAE,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAmB;IACrD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,OAAmB;IAEnB,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE9C,kCAAkC;IAClC,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,6BAA6B;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,2BAA2B,EAAE,CAAC;YAC7C,IAAI,cAAc,KAAK,EAAE,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACL,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,6BAA6B;iBACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,OAAmB;IACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,IAA+F,CAAC;IAEnH,6DAA6D;IAC7D,IAAI,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mBAAmB;IACnB,UAAU,CAAC,KAAK,GAAG;QACjB,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEvC,qDAAqD;IACrD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,qDAAqD;QACrD,iFAAiF;QACjF,OAAO,CAAC,IAAI,CACV,6FAA6F;YAC7F,oCAAoC,OAAO,EAAE,CAC9C,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;GAEG;AACH,MAAM,qBAAqB,GAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,oBAAoB,GAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,GAAQ;IAER,MAAM,UAAU,GAAI,GAA4D,CAAC,IAAI,CAAC;IAEtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,mBAAmB,EAAE,IAAI;gBACzB,MAAM,EAAE,+BAA+B,QAAQ,CAAC,WAAW,EAAE,YAAY;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAmB;IACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAEhF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,WAAW,EACrB,8BAA8B,EAC9B,EAAE,GAAG,EAAE,CACR,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,eAAe,EACzB,6EAA6E,EAC7E,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,CAAC,MAAM,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,uBAAuB;IACvB,IAAI,SAAoB,CAAC;IACzB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM;QACR;YACE,SAAS,GAAG,OAAO,CAAC;IACxB,CAAC;IAED,iCAAiC;IACjC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpE,yEAAyE;IACzE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAsD,CAAC;QAC1E,6EAA6E;QAC7E,QAAQ,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,WAAW;QACX,eAAe,EAAE,MAAM;QACvB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,IAAyB;IAEzB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,0EAA0E;gBACxE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE;gBACzB,cAAc,EAChB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,eAAe,IAAI,+BAA+B,EACzD,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,iFAAiF,EACjF,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,eAAe,IAAI,+BAA+B,EACzD,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,UAAU,CAClB,SAAS,CAAC,aAAa,EACvB,qEAAqE,EACrE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/utils/truncate.d.ts

@@ -8,30 +8,21 @@ export interface TruncationInfo {
     returned?: number;
     hint?: string;
 }
-/**
- * Truncate array of rows to maxRows limit
- */
 export declare function truncateRows(rows: unknown[][], maxRows: number, totalAvailable?: number): {
     rows: unknown[][];
     info: TruncationInfo;
 };
-/**
- * Truncate individual cell value to maxLength
- */
 export declare function truncateCell(value: unknown, maxLength: number): {
     value: string;
     truncated: boolean;
     originalLength?: number;
 };
-/**
- * Truncate columns array to maxColumns limit
- */
 export declare function truncateColumns(columns: string[], maxColumns: number): {
     columns: string[];
     truncated: boolean;
 };
-/**
- * Check if total response size exceeds maxSize
- */
-export declare function checkTotalSize(data: string, maxSize: number): TruncationInfo;
+export declare function checkTotalSize(data: string, maxSize: number): {
+    data: string;
+    info: TruncationInfo;
+};
 //# sourceMappingURL=truncate.d.ts.map

package/dist/utils/truncate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"truncate.d.ts","sourceRoot":"","sources":["../../src/utils/truncate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,CAAC;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EAAE,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB;IAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAoB7C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BhE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAY3C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,cAAc,CAYhB"}
+{"version":3,"file":"truncate.d.ts","sourceRoot":"","sources":["../../src/utils/truncate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,CAAC;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EAAE,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB;IAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAoB7C;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CA4ChE;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAY3C;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAmCxC"}

package/dist/utils/truncate.js

@@ -1,9 +1,7 @@
 /**
  * Truncation utilities for limiting MCP response sizes
  */
-/**
- * Truncate array of rows to maxRows limit
- */
+import { safeJsonStringify } from './formatter.js';
 export function truncateRows(rows, maxRows, totalAvailable) {
     const available = totalAvailable ?? rows.length;
     if (rows.length <= maxRows) {
@@ -23,9 +21,6 @@ export function truncateRows(rows, maxRows, totalAvailable) {
         },
     };
 }
-/**
- * Truncate individual cell value to maxLength
- */
 export function truncateCell(value, maxLength) {
     // Convert value to string
     let stringValue;
@@ -42,7 +37,7 @@ export function truncateCell(value, maxLength) {
         stringValue = value.toISOString();
     }
     else if (typeof value === 'object') {
-        stringValue = JSON.stringify(value);
+        stringValue = safeJsonStringify(value);
     }
     else {
         stringValue = String(value);
@@ -53,15 +48,23 @@ export function truncateCell(value, maxLength) {
             truncated: false,
         };
     }
+    // Account for ellipsis length (3 chars) when truncating
+    const ellipsis = '...';
+    // Edge case: if maxLength is too small for ellipsis, just truncate without it
+    if (maxLength < ellipsis.length) {
+        return {
+            value: stringValue.slice(0, maxLength),
+            truncated: true,
+            originalLength: stringValue.length,
+        };
+    }
+    const truncateAt = maxLength - ellipsis.length;
     return {
-        value: stringValue.slice(0, maxLength) + '...',
+        value: stringValue.slice(0, truncateAt) + ellipsis,
         truncated: true,
         originalLength: stringValue.length,
     };
 }
-/**
- * Truncate columns array to maxColumns limit
- */
 export function truncateColumns(columns, maxColumns) {
     if (columns.length <= maxColumns) {
         return {
@@ -74,18 +77,35 @@ export function truncateColumns(columns, maxColumns) {
         truncated: true,
     };
 }
-/**
- * Check if total response size exceeds maxSize
- */
 export function checkTotalSize(data, maxSize) {
     const byteLength = Buffer.byteLength(data, 'utf8');
     if (byteLength <= maxSize) {
-        return { truncated: false };
+        return { data, info: { truncated: false } };
     }
+    // Truncate to fit within maxSize bytes
+    // We need to be careful with multi-byte UTF-8 characters
+    // Binary search for the right character position
+    let low = 0;
+    let high = data.length;
+    while (low < high) {
+        const mid = Math.floor((low + high + 1) / 2);
+        const slice = data.slice(0, mid);
+        const sliceBytes = Buffer.byteLength(slice, 'utf8');
+        if (sliceBytes <= maxSize) {
+            low = mid;
+        }
+        else {
+            high = mid - 1;
+        }
+    }
+    const truncatedData = data.slice(0, low);
     return {
-        truncated: true,
-        truncationReason: 'maxTotalSize',
-        hint: 'Use LIMIT/OFFSET or WHERE clause to paginate',
+        data: truncatedData,
+        info: {
+            truncated: true,
+            truncationReason: 'maxTotalSize',
+            hint: 'Use LIMIT/OFFSET or WHERE clause to paginate',
+        },
     };
 }
 //# sourceMappingURL=truncate.js.map

package/dist/utils/truncate.js.map

@@ -1 +1 @@
-{"version":3,"file":"truncate.js","sourceRoot":"","sources":["../../src/utils/truncate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAiB,EACjB,OAAe,EACf,cAAuB;IAEvB,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;IAEhD,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,SAAS;YAC3B,cAAc,EAAE,SAAS;YACzB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8CAA8C;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,SAAiB;IAEjB,0BAA0B;IAC1B,IAAI,WAAmB,CAAC;IAExB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACnE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACjC,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK;QAC9C,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,WAAW,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAiB,EACjB,UAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,OAAO;YACP,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QACrC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,cAAc;QAChC,IAAI,EAAE,8CAA8C;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"truncate.js","sourceRoot":"","sources":["../../src/utils/truncate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAUnD,MAAM,UAAU,YAAY,CAC1B,IAAiB,EACjB,OAAe,EACf,cAAuB;IAEvB,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;IAEhD,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,SAAS;YAC3B,cAAc,EAAE,SAAS;YACzB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8CAA8C;SACrD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,SAAiB;IAEjB,0BAA0B;IAC1B,IAAI,WAAmB,CAAC;IAExB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACnE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACjC,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC;IAEvB,8EAA8E;IAC9E,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YACtC,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,WAAW,CAAC,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/C,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,QAAQ;QAClD,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,WAAW,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAiB,EACjB,UAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,OAAO;YACP,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QACrC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAe;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,uCAAuC;IACvC,yDAAyD;IACzD,iDAAiD;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IAEvB,OAAO,GAAG,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,GAAG,GAAG,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEzC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,cAAc;YAChC,IAAI,EAAE,8CAA8C;SACrD;KACF,CAAC;AACJ,CAAC"}

package/dist/utils/validation.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Validation utilities for database operations
+ */
+import type { Config, DatabaseConfig } from '../types.js';
+/**
+ * Get a validated database configuration, throwing if not found
+ *
+ * @param database - The database name to look up
+ * @param config - The application configuration
+ * @returns The database configuration
+ * @throws DbMcpError with DATABASE_NOT_FOUND if database not configured
+ */
+export declare function getValidatedDatabase(database: string, config: Config): DatabaseConfig;
+/**
+ * Count placeholder parameters in SQL query
+ *
+ * Counts PostgreSQL-style placeholders ($1, $2, etc.) in SQL.
+ * Ignores placeholders inside string literals (single or double quoted).
+ *
+ * Note: LLM always uses $N style placeholders. For MySQL/SQLite,
+ * adapters convert $N to ? via convertPlaceholders() after validation.
+ *
+ * @param sql - SQL query to analyze
+ * @returns Number of unique placeholders found
+ */
+export declare function countPlaceholders(sql: string): number;
+/**
+ * Validate that the number of parameters matches the placeholder count in SQL
+ *
+ * @param sql - SQL query with $1, $2, etc. placeholders
+ * @param params - Array of parameter values
+ * @throws DbMcpError with INVALID_SQL if counts don't match
+ */
+export declare function validateParamCount(sql: string, params: unknown[]): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/utils/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/utils/validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI1D;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAUrF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8CrD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAWvE"}