@superglue/cli 1.1.13 → 1.1.14

package/dist/skills/superglue/SKILL.md

@@ -246,15 +246,15 @@ sg system call --url "sftp://<<my_sftp_host>>:22/data" \
   --body '{"operation":"list","path":"/"}'
 ```
 
-| Flag                | Description                                                            |
-| ------------------- | ---------------------------------------------------------------------- |
-| `--url <url>`       | Full URL with protocol (http/https/postgres/redis/rediss/sftp/ftp/smb) |
-| `--system-id <id>`  | System ID for credential injection                                     |
-| `--method <method>` | HTTP method (GET, POST, PUT, DELETE, PATCH)                            |
-| `--headers <json>`  | HTTP headers JSON with credential placeholders                         |
-| `--body <string>`   | Request body (JSON string)                                             |
-| `--env <env>`       | Environment: `dev` or `prod`                                           |
-| `--file <key=path>` | File references (repeatable)                                           |
+| Flag                | Description                                                                                       |
+| ------------------- | ------------------------------------------------------------------------------------------------- |
+| `--url <url>`       | Full URL with protocol (http/https/postgres/postgresql/mssql/sqlserver/redis/rediss/sftp/ftp/smb) |
+| `--system-id <id>`  | System ID for credential injection                                                                |
+| `--method <method>` | HTTP method (GET, POST, PUT, DELETE, PATCH)                                                       |
+| `--headers <json>`  | HTTP headers JSON with credential placeholders                                                    |
+| `--body <string>`   | Request body (JSON string)                                                                        |
+| `--env <env>`       | Environment: `dev` or `prod`                                                                      |
+| `--file <key=path>` | File references (repeatable)                                                                      |
 
 **`sg system search-docs`** — Search system documentation.
 
@@ -458,7 +458,7 @@ Empty arrays are valid — the step simply skips execution.
 
 ### Two Step Types
 
-**Request step** (HTTP, Postgres, Redis, FTP/SFTP/SMB) — makes an API call:
+**Request step** (HTTP, PostgreSQL, MSSQL, Redis, FTP/SFTP/SMB) — makes an API call:
 
 ```json
 {
@@ -645,7 +645,7 @@ For detailed documentation on specific topics, read these files in the `referenc
 | File                                  | When to read                                                                                     |
 | ------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | `references/integration.md`           | **READ THIS** when deploying tools to production - SDK usage, REST API, webhooks, error handling |
-| `references/databases.md`             | Building tools that query PostgreSQL/MySQL databases                                             |
+| `references/databases.md`             | Building tools that query PostgreSQL or Microsoft SQL Server (Azure SQL) databases               |
 | `references/redis.md`                 | Building tools that interact with Redis (commands, pipelines, data types)                        |
 | `references/file-servers.md`          | Building tools that interact with FTP/SFTP/SMB file servers                                      |
 | `references/transforms-and-output.md` | Complex data transformations, output shaping, JS sandbox constraints                             |

package/dist/skills/superglue/references/databases.md

@@ -1,6 +1,12 @@
-# Database Steps (PostgreSQL)
+# Database Steps
 
-## Step Configuration
+Superglue supports both PostgreSQL and Microsoft SQL Server (including Azure SQL).
+
+---
+
+## PostgreSQL
+
+### Step Configuration
 
 ```typescript
 {
@@ -78,7 +84,7 @@ Returns `result.rows` — array of row objects with column names as keys.
 - `INSERT/UPDATE/DELETE` with `RETURNING`: array of returned rows
 - Mutations without `RETURNING`: empty array
 
-## Batch Operations via Loop
+### Batch Operations via Loop
 
 Use a data selector returning an array to execute a query per item:
 
@@ -86,3 +92,158 @@ Use a data selector returning an array to execute a query per item:
 // dataSelector: (sourceData) => sourceData.newUsers
 // body: {"query": "INSERT INTO users (name) VALUES ($1)", "params": ["<<(sourceData) => sourceData.currentItem.name>>"]}
 ```
+
+---
+
+## Microsoft SQL Server / Azure SQL
+
+### Step Configuration
+
+```typescript
+{
+  type: "request",
+  systemId: "my_azure_sql",
+  url: "mssql://<<my_azure_sql_user>>:<<my_azure_sql_password>>@<<my_azure_sql_host>>:<<my_azure_sql_port>>/<<my_azure_sql_database>>",
+  method: "POST",            // ignored for MSSQL but required by schema
+  body: '{"query": "SELECT * FROM users WHERE id = @param1", "params": [<<userId>>]}'
+}
+```
+
+Configure the connection url depending on which credentials are saved in the stored db system - reference them accordingly.
+
+### URL Format
+
+```
+mssql://user:password@host:port/database
+sqlserver://user:password@host:port/database
+```
+
+Both `mssql://` and `sqlserver://` protocols are supported. All credential variables are resolved before connecting.
+
+#### Azure SQL Database Connection
+
+For Azure SQL Database, use the fully qualified server name:
+
+```
+mssql://myuser@myserver:mypassword@myserver.database.windows.net:1433/mydatabase
+```
+
+You can include connection parameters as query strings:
+
+```
+mssql://user:password@host:port/database?encrypt=true&trustServerCertificate=false
+```
+
+**Connection Parameters:**
+
+- `encrypt` (default: `true`) - Enable/disable encryption (required for Azure SQL)
+- `trustServerCertificate` (default: `false`) - Whether to trust the server certificate
+- `database` - Database name (can be in URL path or query parameter)
+
+### Body Format
+
+JSON string with `query` and optional `params` (or `values`):
+
+```json
+{
+  "query": "SELECT * FROM users WHERE age > @param1 AND status = @param2",
+  "params": [25, "active"]
+}
+```
+
+### Parameterized Queries
+
+**Always use parameterized queries** with `@param1`, `@param2`, etc. — prevents SQL injection.
+
+```json
+{ "query": "SELECT * FROM orders WHERE customer_id = @param1", "params": ["<<customerId>>"] }
+```
+
+With expressions:
+
+```json
+{
+  "query": "INSERT INTO logs (message, level) VALUES (@param1, @param2)",
+  "params": ["<<(sourceData) => sourceData.message>>", "error"]
+}
+```
+
+With OUTPUT (MSSQL equivalent of RETURNING):
+
+```json
+{
+  "query": "INSERT INTO users (name, email) OUTPUT INSERTED.* VALUES (@param1, @param2)",
+  "params": [
+    "<<(sourceData) => sourceData.currentItem.name>>",
+    "<<(sourceData) => sourceData.currentItem.email>>"
+  ]
+}
+```
+
+**Parameter Naming**: MSSQL uses named parameters with `@` prefix. The params array maps positionally: `params[0]` → `@param1`, `params[1]` → `@param2`, etc.
+
+### Connection Pooling
+
+- Pools cached by connection string, max 10 clients per pool
+- 5s connection timeout, configurable request timeout
+- Idle pools cleaned up automatically
+- SSL/TLS encryption enabled by default for Azure SQL
+
+### Retry Logic
+
+Default retries from server config. On final failure, error includes query text and params.
+
+### Return Value
+
+Returns the recordset — array of row objects with column names as keys.
+
+- `SELECT`: array of matching rows
+- `INSERT/UPDATE/DELETE` with `OUTPUT`: array of returned rows
+- Mutations without `OUTPUT`: empty array
+
+### Batch Operations via Loop
+
+Use a data selector returning an array to execute a query per item:
+
+```javascript
+// dataSelector: (sourceData) => sourceData.newUsers
+// body: {"query": "INSERT INTO users (name) VALUES (@param1)", "params": ["<<(sourceData) => sourceData.currentItem.name>>"]}
+```
+
+### Common Patterns
+
+**Simple SELECT:**
+
+```json
+{
+  "query": "SELECT id, name, email FROM users WHERE status = @param1",
+  "params": ["active"]
+}
+```
+
+**INSERT with OUTPUT:**
+
+```json
+{
+  "query": "INSERT INTO users (name, email, created_at) OUTPUT INSERTED.id, INSERTED.created_at VALUES (@param1, @param2, GETUTCDATE())",
+  "params": ["John Doe", "john@example.com"]
+}
+```
+
+**UPDATE with OUTPUT:**
+
+```json
+{
+  "query": "UPDATE users SET last_login = GETUTCDATE() OUTPUT INSERTED.id, INSERTED.last_login WHERE id = @param1",
+  "params": [123]
+}
+```
+
+**Stored Procedure Call:**
+
+```json
+{
+  "query": "EXEC dbo.GetUserById @param1",
+  "params": [123]
+}
+```

package/dist/skills/superglue/references/transforms-and-output.md

@@ -82,9 +82,9 @@ Payload fields are at root level — **NEVER** use `sourceData.payload.*`.
 
 ## JS Code Constraints (all transform points)
 
-Runs in `isolated-vm` sandbox:
+Runs in Deno subprocess sandbox:
 
-- 4096 MB memory limit, 10s timeout (transforms/selectors), 3s timeout (pagination stops)
+- 8192 MB memory limit, 10 minute timeout per transform
 - Synchronous only — no async/await, no Promises, no setTimeout
 - No side effects — no network, filesystem, or console access
 - No external dependencies — only standard JS built-ins (Array, Object, String, Math, Date, JSON, etc.)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.13",
+  "version": "1.1.14",
   "bin": {
     "sg": "./dist/cli.js"
   },
@@ -11,13 +11,13 @@
     "LICENSE"
   ],
   "dependencies": {
-    "commander": "^13.0.0",
-    "fast-json-patch": "^3.1.1"
+    "commander": "15.0.0-0",
+    "fast-json-patch": "3.1.1"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "tsup": "^8.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "25.5.0",
+    "tsup": "8.5.1",
+    "typescript": "5.8.3"
   },
   "scripts": {
     "build": "tsup && (cp -r skills dist/ 2>/dev/null || true)",

package/skills/superglue/SKILL.md

@@ -246,15 +246,15 @@ sg system call --url "sftp://<<my_sftp_host>>:22/data" \
   --body '{"operation":"list","path":"/"}'
 ```
 
-| Flag                | Description                                                            |
-| ------------------- | ---------------------------------------------------------------------- |
-| `--url <url>`       | Full URL with protocol (http/https/postgres/redis/rediss/sftp/ftp/smb) |
-| `--system-id <id>`  | System ID for credential injection                                     |
-| `--method <method>` | HTTP method (GET, POST, PUT, DELETE, PATCH)                            |
-| `--headers <json>`  | HTTP headers JSON with credential placeholders                         |
-| `--body <string>`   | Request body (JSON string)                                             |
-| `--env <env>`       | Environment: `dev` or `prod`                                           |
-| `--file <key=path>` | File references (repeatable)                                           |
+| Flag                | Description                                                                                       |
+| ------------------- | ------------------------------------------------------------------------------------------------- |
+| `--url <url>`       | Full URL with protocol (http/https/postgres/postgresql/mssql/sqlserver/redis/rediss/sftp/ftp/smb) |
+| `--system-id <id>`  | System ID for credential injection                                                                |
+| `--method <method>` | HTTP method (GET, POST, PUT, DELETE, PATCH)                                                       |
+| `--headers <json>`  | HTTP headers JSON with credential placeholders                                                    |
+| `--body <string>`   | Request body (JSON string)                                                                        |
+| `--env <env>`       | Environment: `dev` or `prod`                                                                      |
+| `--file <key=path>` | File references (repeatable)                                                                      |
 
 **`sg system search-docs`** — Search system documentation.
 
@@ -458,7 +458,7 @@ Empty arrays are valid — the step simply skips execution.
 
 ### Two Step Types
 
-**Request step** (HTTP, Postgres, Redis, FTP/SFTP/SMB) — makes an API call:
+**Request step** (HTTP, PostgreSQL, MSSQL, Redis, FTP/SFTP/SMB) — makes an API call:
 
 ```json
 {
@@ -645,7 +645,7 @@ For detailed documentation on specific topics, read these files in the `referenc
 | File                                  | When to read                                                                                     |
 | ------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | `references/integration.md`           | **READ THIS** when deploying tools to production - SDK usage, REST API, webhooks, error handling |
-| `references/databases.md`             | Building tools that query PostgreSQL/MySQL databases                                             |
+| `references/databases.md`             | Building tools that query PostgreSQL or Microsoft SQL Server (Azure SQL) databases               |
 | `references/redis.md`                 | Building tools that interact with Redis (commands, pipelines, data types)                        |
 | `references/file-servers.md`          | Building tools that interact with FTP/SFTP/SMB file servers                                      |
 | `references/transforms-and-output.md` | Complex data transformations, output shaping, JS sandbox constraints                             |

package/skills/superglue/references/databases.md

@@ -1,6 +1,12 @@
-# Database Steps (PostgreSQL)
+# Database Steps
 
-## Step Configuration
+Superglue supports both PostgreSQL and Microsoft SQL Server (including Azure SQL).
+
+---
+
+## PostgreSQL
+
+### Step Configuration
 
 ```typescript
 {
@@ -78,7 +84,7 @@ Returns `result.rows` — array of row objects with column names as keys.
 - `INSERT/UPDATE/DELETE` with `RETURNING`: array of returned rows
 - Mutations without `RETURNING`: empty array
 
-## Batch Operations via Loop
+### Batch Operations via Loop
 
 Use a data selector returning an array to execute a query per item:
 
@@ -86,3 +92,158 @@ Use a data selector returning an array to execute a query per item:
 // dataSelector: (sourceData) => sourceData.newUsers
 // body: {"query": "INSERT INTO users (name) VALUES ($1)", "params": ["<<(sourceData) => sourceData.currentItem.name>>"]}
 ```
+
+---
+
+## Microsoft SQL Server / Azure SQL
+
+### Step Configuration
+
+```typescript
+{
+  type: "request",
+  systemId: "my_azure_sql",
+  url: "mssql://<<my_azure_sql_user>>:<<my_azure_sql_password>>@<<my_azure_sql_host>>:<<my_azure_sql_port>>/<<my_azure_sql_database>>",
+  method: "POST",            // ignored for MSSQL but required by schema
+  body: '{"query": "SELECT * FROM users WHERE id = @param1", "params": [<<userId>>]}'
+}
+```
+
+Configure the connection url depending on which credentials are saved in the stored db system - reference them accordingly.
+
+### URL Format
+
+```
+mssql://user:password@host:port/database
+sqlserver://user:password@host:port/database
+```
+
+Both `mssql://` and `sqlserver://` protocols are supported. All credential variables are resolved before connecting.
+
+#### Azure SQL Database Connection
+
+For Azure SQL Database, use the fully qualified server name:
+
+```
+mssql://myuser@myserver:mypassword@myserver.database.windows.net:1433/mydatabase
+```
+
+You can include connection parameters as query strings:
+
+```
+mssql://user:password@host:port/database?encrypt=true&trustServerCertificate=false
+```
+
+**Connection Parameters:**
+
+- `encrypt` (default: `true`) - Enable/disable encryption (required for Azure SQL)
+- `trustServerCertificate` (default: `false`) - Whether to trust the server certificate
+- `database` - Database name (can be in URL path or query parameter)
+
+### Body Format
+
+JSON string with `query` and optional `params` (or `values`):
+
+```json
+{
+  "query": "SELECT * FROM users WHERE age > @param1 AND status = @param2",
+  "params": [25, "active"]
+}
+```
+
+### Parameterized Queries
+
+**Always use parameterized queries** with `@param1`, `@param2`, etc. — prevents SQL injection.
+
+```json
+{ "query": "SELECT * FROM orders WHERE customer_id = @param1", "params": ["<<customerId>>"] }
+```
+
+With expressions:
+
+```json
+{
+  "query": "INSERT INTO logs (message, level) VALUES (@param1, @param2)",
+  "params": ["<<(sourceData) => sourceData.message>>", "error"]
+}
+```
+
+With OUTPUT (MSSQL equivalent of RETURNING):
+
+```json
+{
+  "query": "INSERT INTO users (name, email) OUTPUT INSERTED.* VALUES (@param1, @param2)",
+  "params": [
+    "<<(sourceData) => sourceData.currentItem.name>>",
+    "<<(sourceData) => sourceData.currentItem.email>>"
+  ]
+}
+```
+
+**Parameter Naming**: MSSQL uses named parameters with `@` prefix. The params array maps positionally: `params[0]` → `@param1`, `params[1]` → `@param2`, etc.
+
+### Connection Pooling
+
+- Pools cached by connection string, max 10 clients per pool
+- 5s connection timeout, configurable request timeout
+- Idle pools cleaned up automatically
+- SSL/TLS encryption enabled by default for Azure SQL
+
+### Retry Logic
+
+Default retries from server config. On final failure, error includes query text and params.
+
+### Return Value
+
+Returns the recordset — array of row objects with column names as keys.
+
+- `SELECT`: array of matching rows
+- `INSERT/UPDATE/DELETE` with `OUTPUT`: array of returned rows
+- Mutations without `OUTPUT`: empty array
+
+### Batch Operations via Loop
+
+Use a data selector returning an array to execute a query per item:
+
+```javascript
+// dataSelector: (sourceData) => sourceData.newUsers
+// body: {"query": "INSERT INTO users (name) VALUES (@param1)", "params": ["<<(sourceData) => sourceData.currentItem.name>>"]}
+```
+
+### Common Patterns
+
+**Simple SELECT:**
+
+```json
+{
+  "query": "SELECT id, name, email FROM users WHERE status = @param1",
+  "params": ["active"]
+}
+```
+
+**INSERT with OUTPUT:**
+
+```json
+{
+  "query": "INSERT INTO users (name, email, created_at) OUTPUT INSERTED.id, INSERTED.created_at VALUES (@param1, @param2, GETUTCDATE())",
+  "params": ["John Doe", "john@example.com"]
+}
+```
+
+**UPDATE with OUTPUT:**
+
+```json
+{
+  "query": "UPDATE users SET last_login = GETUTCDATE() OUTPUT INSERTED.id, INSERTED.last_login WHERE id = @param1",
+  "params": [123]
+}
+```
+
+**Stored Procedure Call:**
+
+```json
+{
+  "query": "EXEC dbo.GetUserById @param1",
+  "params": [123]
+}
+```

package/skills/superglue/references/transforms-and-output.md

@@ -82,9 +82,9 @@ Payload fields are at root level — **NEVER** use `sourceData.payload.*`.
 
 ## JS Code Constraints (all transform points)
 
-Runs in `isolated-vm` sandbox:
+Runs in Deno subprocess sandbox:
 
-- 4096 MB memory limit, 10s timeout (transforms/selectors), 3s timeout (pagination stops)
+- 8192 MB memory limit, 10 minute timeout per transform
 - Synchronous only — no async/await, no Promises, no setTimeout
 - No side effects — no network, filesystem, or console access
 - No external dependencies — only standard JS built-ins (Array, Object, String, Math, Date, JSON, etc.)