db-mcp 1.1.1 → 3.0.0

package/dist/utils/validate-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-path.d.ts","sourceRoot":"","sources":["../../src/utils/validate-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,oBAAoB,CAqGtB"}

package/dist/utils/where-clause.d.ts

@@ -0,0 +1,42 @@
+/**
+ * db-mcp - WHERE Clause Validation
+ *
+ * Validates WHERE clause parameters to prevent SQL injection.
+ * Uses a blocklist approach to reject dangerous patterns while
+ * allowing legitimate complex conditions.
+ *
+ * Applies Unicode NFC normalization and full-width character
+ * mapping before pattern matching to prevent homoglyph-based
+ * blocklist bypasses (CWE-20).
+ *
+ * Adapted from postgres-mcp reference implementation for SQLite.
+ */
+/**
+ * Error thrown when an unsafe WHERE clause is detected
+ */
+export declare class UnsafeWhereClauseError extends Error {
+    constructor(reason: string);
+}
+/**
+ * Normalize a WHERE clause string for pattern matching.
+ *
+ * Applies two transformations:
+ * 1. Unicode NFC normalization — collapses composed characters
+ * 2. Full-width Latin → ASCII mapping — converts U+FF01..FF5E to U+0021..007E
+ *
+ * The original input is NOT modified; this returns a copy for blocklist matching.
+ * This prevents attackers from using visually-similar Unicode characters
+ * (e.g., "ＵＮＩＯＮ ＳＥＬＥＣＴ") to bypass ASCII-only regex patterns.
+ */
+export declare function normalizeForPatternMatching(input: string): string;
+export declare function sanitizeWhereClause(where: string): string;
+export interface WhereCondition {
+    column: string;
+    operator: string;
+    value?: unknown;
+}
+export declare function buildWhereClause(conditions?: WhereCondition[], whereClause?: string): {
+    sql: string;
+    params: unknown[];
+};
+//# sourceMappingURL=where-clause.d.ts.map

package/dist/utils/where-clause.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"where-clause.d.ts","sourceRoot":"","sources":["../../src/utils/where-clause.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,MAAM,EAAE,MAAM;CAI3B;AA8MD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA8BjE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BzD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,gBAAgB,CAC9B,UAAU,CAAC,EAAE,cAAc,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAmDpC"}

package/dist/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Version Constants
+ *
+ * Single source of truth — reads from package.json at runtime.
+ */
+/** Server version from package.json */
+export declare const VERSION: string;
+/** Package name from package.json */
+export declare const NAME: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,uCAAuC;AACvC,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC;AAE3C,qCAAqC;AACrC,eAAO,MAAM,IAAI,EAAE,MAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "db-mcp",
-  "version": "1.1.1",
+  "version": "3.0.0",
   "description": "SQLite MCP server with OAuth 2.1 authentication, HTTP/SSE transport, and smart tool filtering",
   "mcpName": "io.github.neverinfamous/db-mcp",
   "type": "module",
@@ -9,8 +9,15 @@
   "bin": {
     "db-mcp": "./dist/cli.js"
   },
+  "files": [
+    "dist"
+  ],
   "scripts": {
-    "build": "tsup",
+    "install": "echo \"Skipping automatic native build to preserve optional dependencies\"",
+    "build": "npm run build:native && npm run build:js && npm run build:types",
+    "build:native": "node-gyp rebuild",
+    "build:js": "tsup",
+    "build:types": "tsc --project tsconfig.build.json --emitDeclarationOnly",
     "dev": "tsx watch src/index.ts",
     "start": "node dist/index.js",
     "start:stdio": "node dist/cli.js --transport=stdio",
@@ -22,8 +29,8 @@
     "check": "npm run lint && npm run typecheck",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "test:e2e": "playwright test",
+    "test:coverage": "vitest run --coverage && tsx scripts/update-badges.ts",
+    "test:e2e": "playwright test && tsx scripts/update-badges.ts",
     "bench": "vitest bench --run",
     "bench:verbose": "vitest bench --run --reporter=verbose",
     "clean": "rimraf dist",
@@ -53,12 +60,18 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "cors": "^2.8.5",
-    "express": "^5.2.1",
-    "jose": "^6.2.1",
-    "sql.js": "^1.14.1",
-    "zod": "^3.25.0 || ^4.0.0"
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "cors": "2.8.6",
+    "express": "5.2.1",
+    "express-rate-limit": "8.5.2",
+    "isolated-vm": "6.1.2",
+    "jose": "6.2.3",
+    "rate-limit-redis": "^5.0.0",
+    "redis": "^6.0.0",
+    "sql.js": "1.14.1",
+    "sqlite-parser": "^1.0.1",
+    "zod": "^4.4.3",
+    "zod-to-json-schema": "3.25.2"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -71,23 +84,23 @@
     "@vitest/coverage-v8": "^4.0.18",
     "eslint": "^10.0.2",
     "globals": "^17.4.0",
+    "node-addon-api": "^8.8.0",
     "rimraf": "^6.1.3",
     "tsup": "^8.5.1",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.57.1",
+    "tsx": "^4.22.1",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.60.0",
     "vitest": "^4.0.17"
   },
-  "peerDependencies": {
-    "zod": "^3.25.0 || ^4.0.0"
-  },
   "optionalDependencies": {
-    "better-sqlite3": "^12.8.0"
+    "better-sqlite3": "^12.10.0"
   },
+  "//overrides": "Transitive CVE patches. Review quarterly or when dockerfile-patch-drift.yml flags staleness.",
   "overrides": {
-    "diff": "8.0.3",
+    "diff": "9.0.0",
     "@isaacs/brace-expansion": "5.0.1",
-    "tar": "7.5.11",
-    "minimatch": "10.2.4"
+    "tar": "7.5.15",
+    "minimatch": "10.2.5",
+    "brace-expansion": "5.0.6"
   }
 }

package/.gitattributes

@@ -1,2 +0,0 @@
-# Normalize line endings to LF on all platforms
-* text=auto eol=lf

package/dist/chunk-4IA3DB5C.js

@@ -1,135 +0,0 @@
-import { DbMcpError, findSuggestion } from './chunk-AOUL5SHS.js';
-
-// src/utils/errors/classes.ts
-var ValidationError = class extends DbMcpError {
-  constructor(message, code = "VALIDATION_ERROR", options) {
-    super(message, code, "validation" /* VALIDATION */, {
-      ...options,
-      recoverable: false
-    });
-  }
-};
-var ConnectionError = class extends DbMcpError {
-  constructor(message, code = "CONNECTION_ERROR", options) {
-    super(message, code, "connection" /* CONNECTION */, {
-      ...options,
-      recoverable: true
-      // Connection errors are often transient
-    });
-  }
-};
-var QueryError = class extends DbMcpError {
-  constructor(message, code = "QUERY_ERROR", options) {
-    super(message, code, "query" /* QUERY */, {
-      ...options,
-      details: {
-        ...options?.details,
-        sql: options?.sql
-      },
-      recoverable: false
-    });
-  }
-};
-var ResourceNotFoundError = class extends DbMcpError {
-  constructor(message, code = "RESOURCE_NOT_FOUND", options) {
-    super(message, code, "resource" /* RESOURCE */, {
-      ...options,
-      details: {
-        ...options?.details,
-        resourceType: options?.resourceType,
-        resourceName: options?.resourceName
-      },
-      recoverable: false
-    });
-  }
-};
-var ConfigurationError = class extends DbMcpError {
-  constructor(message, code = "CONFIG_ERROR", options) {
-    super(message, code, "config" /* CONFIGURATION */, {
-      ...options,
-      recoverable: false
-    });
-  }
-};
-var AuthenticationError = class extends DbMcpError {
-  constructor(message, code = "AUTHENTICATION_ERROR", options) {
-    super(message, code, "authentication" /* AUTHENTICATION */, {
-      ...options,
-      recoverable: false
-    });
-  }
-};
-var AuthorizationError = class extends DbMcpError {
-  constructor(message, code = "AUTHORIZATION_ERROR", options) {
-    super(message, code, "authorization" /* AUTHORIZATION */, {
-      ...options,
-      recoverable: false
-    });
-  }
-};
-
-// src/utils/errors/format.ts
-var CATEGORY_DEFAULT_CODES = {
-  ["validation" /* VALIDATION */]: "VALIDATION_ERROR",
-  ["connection" /* CONNECTION */]: "CONNECTION_ERROR",
-  ["query" /* QUERY */]: "QUERY_ERROR",
-  ["permission" /* PERMISSION */]: "PERMISSION_ERROR",
-  ["config" /* CONFIGURATION */]: "CONFIG_ERROR",
-  ["resource" /* RESOURCE */]: "RESOURCE_ERROR",
-  ["authentication" /* AUTHENTICATION */]: "AUTHENTICATION_ERROR",
-  ["authorization" /* AUTHORIZATION */]: "AUTHORIZATION_ERROR",
-  ["internal" /* INTERNAL */]: "UNKNOWN_ERROR"
-};
-function formatZodError(error) {
-  if (!("issues" in error) || !Array.isArray(error["issues"])) {
-    return null;
-  }
-  const issues = error["issues"];
-  return issues.map((issue) => {
-    const pathStr = Array.isArray(issue.path) && issue.path.length > 0 ? `${issue.path.join(".")}: ` : "";
-    return `${pathStr}${issue.message ?? "Unknown validation error"}`;
-  }).join("; ");
-}
-function formatHandlerError(error, _context) {
-  if (error instanceof DbMcpError) {
-    return error.toResponse();
-  }
-  if (error instanceof Error) {
-    const zodMessage = formatZodError(error);
-    if (zodMessage !== null) {
-      return {
-        success: false,
-        error: zodMessage,
-        code: "VALIDATION_ERROR",
-        category: "validation" /* VALIDATION */,
-        suggestion: void 0,
-        recoverable: false,
-        details: void 0
-      };
-    }
-  }
-  if (error instanceof Error) {
-    const match = findSuggestion(error.message);
-    const category = match?.category ?? "internal" /* INTERNAL */;
-    return {
-      success: false,
-      error: error.message,
-      code: match?.code ?? CATEGORY_DEFAULT_CODES[category],
-      category,
-      suggestion: match?.suggestion,
-      recoverable: false,
-      details: void 0
-    };
-  }
-  return {
-    success: false,
-    error: String(error),
-    code: "UNKNOWN_ERROR",
-    category: "internal" /* INTERNAL */,
-    suggestion: void 0,
-    recoverable: false,
-    details: void 0
-  };
-}
-
-export { AuthenticationError, AuthorizationError, ConfigurationError, ConnectionError, QueryError, ResourceNotFoundError, ValidationError, formatHandlerError };

package/dist/chunk-FW7UCRLN.js

@@ -1,82 +0,0 @@
-import { createRequire } from 'module';
-
-// src/version.ts
-var _require = createRequire(import.meta.url);
-var pkg = _require("../package.json");
-var VERSION = pkg.version;
-var NAME = pkg.name;
-
-// src/utils/icons.ts
-var MDI_BASE = "https://cdn.jsdelivr.net/npm/@mdi/svg@7.4.47/svg";
-var SERVER_ICONS = [
-  {
-    src: `${MDI_BASE}/server.svg`,
-    mimeType: "image/svg+xml"
-  }
-];
-var TOOL_GROUP_ICONS = {
-  core: [{ src: `${MDI_BASE}/database.svg`, mimeType: "image/svg+xml" }],
-  json: [{ src: `${MDI_BASE}/code-json.svg`, mimeType: "image/svg+xml" }],
-  text: [{ src: `${MDI_BASE}/format-text.svg`, mimeType: "image/svg+xml" }],
-  stats: [{ src: `${MDI_BASE}/chart-bar.svg`, mimeType: "image/svg+xml" }],
-  vector: [
-    { src: `${MDI_BASE}/vector-polyline.svg`, mimeType: "image/svg+xml" }
-  ],
-  admin: [{ src: `${MDI_BASE}/cog.svg`, mimeType: "image/svg+xml" }],
-  geo: [{ src: `${MDI_BASE}/earth.svg`, mimeType: "image/svg+xml" }],
-  introspection: [
-    { src: `${MDI_BASE}/graph-outline.svg`, mimeType: "image/svg+xml" }
-  ],
-  migration: [
-    { src: `${MDI_BASE}/source-branch.svg`, mimeType: "image/svg+xml" }
-  ],
-  codemode: [{ src: `${MDI_BASE}/code-braces.svg`, mimeType: "image/svg+xml" }]
-};
-function getToolGroupIcon(group) {
-  return TOOL_GROUP_ICONS[group];
-}
-
-// src/utils/annotations.ts
-var READ_ONLY = {
-  readOnlyHint: true,
-  destructiveHint: false,
-  openWorldHint: false
-};
-var WRITE = {
-  readOnlyHint: false,
-  destructiveHint: false,
-  openWorldHint: false
-};
-var DESTRUCTIVE = {
-  readOnlyHint: false,
-  destructiveHint: true,
-  openWorldHint: false
-};
-var IDEMPOTENT = {
-  readOnlyHint: false,
-  destructiveHint: false,
-  idempotentHint: true,
-  openWorldHint: false
-};
-var ADMIN = {
-  readOnlyHint: false,
-  destructiveHint: false,
-  openWorldHint: false
-};
-function readOnly(title) {
-  return { title, ...READ_ONLY };
-}
-function write(title) {
-  return { title, ...WRITE };
-}
-function destructive(title) {
-  return { title, ...DESTRUCTIVE };
-}
-function idempotent(title) {
-  return { title, ...IDEMPOTENT };
-}
-function admin(title) {
-  return { title, ...ADMIN };
-}
-
-export { NAME, READ_ONLY, SERVER_ICONS, VERSION, admin, destructive, getToolGroupIcon, idempotent, readOnly, write };