db-mcp 3.0.2 → 4.0.0

package/dist/{chunk-L552U3QS.js → chunk-Y57WFKAP.js}

@@ -71,7 +71,7 @@ var TOOL_GROUPS = {
     "json_diff"
   ],
   text: [
-    // Text Tools (14 WASM)
+    // Text Tools (15 WASM)
     "regex_extract",
     "regex_match",
     "text_split",
@@ -85,6 +85,7 @@ var TOOL_GROUPS = {
     "text_normalize",
     "text_validate",
     "advanced_search",
+    "hybrid_search",
     "text_sentiment",
     // FTS5 Tools (5 Native-only)
     "fts_create",
@@ -94,7 +95,7 @@ var TOOL_GROUPS = {
     "fts_headline"
   ],
   stats: [
-    // Stats Tools (16 WASM)
+    // Stats Tools (13 WASM)
     "stats_basic",
     "stats_count",
     "stats_group_by",
@@ -136,7 +137,7 @@ var TOOL_GROUPS = {
     "vector_distance"
   ],
   admin: [
-    // Admin Tools (15: backup.ts, verify.ts, pragma.ts, reindex.ts, wal.ts)
+    // Admin Tools (12: backup.ts, verify.ts, pragma.ts)
     "backup",
     "analyze",
     "integrity_check",
@@ -149,7 +150,6 @@ var TOOL_GROUPS = {
     "pragma_optimize",
     "pragma_settings",
     "pragma_table_info",
-    "append_insight",
     // Virtual Table Tools (13: views.ts, vtable.ts, extensions.ts, analysis.ts)
     "generate_series",
     "create_view",
@@ -164,7 +164,7 @@ var TOOL_GROUPS = {
     "analyze_csv_schema",
     "create_rtree_table",
     "create_series_table",
-    // Database management (5: pragma.ts, backup/create.ts, reindex.ts, wal.ts)
+    // Database management (6: pragma.ts, backup/create.ts, dump.ts, reindex.ts, wal.ts)
     "attach_database",
     "detach_database",
     "vacuum_into",
@@ -223,11 +223,11 @@ var TOOL_GROUPS = {
   codemode: ["execute_code"]
 };
 var META_GROUPS = {
-  // General development - Core + JSON + Text (60 WASM / 65 Native)
+  // General development - Core + JSON + Text (61 WASM / 66 Native)
   starter: ["core", "json", "text", "codemode"],
   // Data analysis - Core + JSON + Stats (63 WASM / 69 Native)
   analytics: ["core", "json", "stats", "codemode"],
-  // Search workloads - Core + Text + Vector (46 WASM / 51 Native)
+  // Search workloads - Core + Text + Vector (47 WASM / 52 Native)
   search: ["core", "text", "vector", "codemode"],
   // Geospatial workloads - Core + Geo + Vector (36 WASM / 43 Native)
   spatial: ["core", "geo", "vector", "codemode"],
@@ -235,7 +235,7 @@ var META_GROUPS = {
   "dev-schema": ["core", "introspection", "migration", "codemode"],
   // Bare minimum - Core (21 tools)
   minimal: ["core", "codemode"],
-  // All group tools enabled (166 Native / 139 WASM — see TOOL COUNT TAXONOMY above)
+  // All group tools enabled (167 Native / 140 WASM — see TOOL COUNT TAXONOMY above)
   full: [
     "core",
     "json",
@@ -1174,6 +1174,224 @@ function formatHandlerError(error, _context) {
     details: void 0
   };
 }
+
+// src/observability/metrics.ts
+var MAX_SAMPLES = 1e3;
+var ToolMetric = class {
+  calls = 0;
+  errors = 0;
+  tokens = 0;
+  // Circular buffer for latency samples
+  samples = new Array(MAX_SAMPLES).fill(0);
+  sampleIndex = 0;
+  sampleCount = 0;
+  record(durationMs, success, tokens = 0) {
+    this.calls++;
+    if (!success) this.errors++;
+    this.tokens += tokens;
+    this.samples[this.sampleIndex] = durationMs;
+    this.sampleIndex = (this.sampleIndex + 1) % MAX_SAMPLES;
+    if (this.sampleCount < MAX_SAMPLES) {
+      this.sampleCount++;
+    }
+  }
+  getSummary() {
+    if (this.sampleCount === 0) {
+      return {
+        calls: this.calls,
+        errors: this.errors,
+        tokens: this.tokens,
+        p50: 0,
+        p95: 0,
+        p99: 0
+      };
+    }
+    const activeSamples = this.samples.slice(0, this.sampleCount).sort((a, b) => a - b);
+    return {
+      calls: this.calls,
+      errors: this.errors,
+      tokens: this.tokens,
+      p50: this.getPercentile(activeSamples, 0.5),
+      p95: this.getPercentile(activeSamples, 0.95),
+      p99: this.getPercentile(activeSamples, 0.99)
+    };
+  }
+  getPercentile(sorted, p) {
+    if (sorted.length === 0) return 0;
+    const idx = (sorted.length - 1) * p;
+    const base = Math.floor(idx);
+    const rest = idx - base;
+    const v0 = sorted[base] ?? 0;
+    const v1 = sorted[base + 1];
+    if (v1 !== void 0) {
+      return Math.round(v0 + rest * (v1 - v0));
+    } else {
+      return v0;
+    }
+  }
+};
+var ResourceMetric = class {
+  reads = 0;
+  record() {
+    this.reads++;
+  }
+  getSummary() {
+    return { reads: this.reads };
+  }
+};
+var MetricsRegistry = class {
+  tools = /* @__PURE__ */ new Map();
+  resources = /* @__PURE__ */ new Map();
+  systemDb = null;
+  flushTimer = null;
+  setSystemDb(systemDb) {
+    this.systemDb = systemDb;
+    this.loadHistorical();
+    this.startFlushTimer();
+  }
+  loadHistorical() {
+    if (!this.systemDb) return;
+    try {
+      const db = this.systemDb.getDb();
+      const rows = db.prepare(
+        `
+        SELECT tool, MAX(calls) as max_calls, MAX(errors) as max_errors, MAX(tokens) as max_tokens
+        FROM metrics_snapshots
+        GROUP BY tool
+      `
+      ).all();
+      for (const row of rows) {
+        const metric = new ToolMetric();
+        metric.calls = row.max_calls;
+        metric.errors = row.max_errors;
+        metric.tokens = row.max_tokens;
+        this.tools.set(row.tool, metric);
+      }
+      logger.info(`Loaded historical metrics for ${rows.length} tools`, {
+        module: "METRICS"
+      });
+    } catch (err) {
+      logger.warning("Failed to load historical metrics", {
+        module: "METRICS",
+        error: err instanceof Error ? err : new Error(String(err))
+      });
+    }
+  }
+  startFlushTimer() {
+    if (this.flushTimer) clearInterval(this.flushTimer);
+    this.flushTimer = setInterval(
+      () => {
+        this.flushToDb();
+      },
+      5 * 60 * 1e3
+    );
+    this.flushTimer.unref();
+  }
+  flushToDb() {
+    if (!this.systemDb) return;
+    try {
+      const db = this.systemDb.getDb();
+      const stmt = db.prepare(`
+        INSERT INTO metrics_snapshots (timestamp, tool, calls, errors, p50, p95, p99, tokens)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `);
+      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      const transaction = db.transaction(() => {
+        for (const [name, metric] of this.tools.entries()) {
+          const summary = metric.getSummary();
+          stmt.run(
+            timestamp,
+            name,
+            summary.calls,
+            summary.errors,
+            summary.p50,
+            summary.p95,
+            summary.p99,
+            summary.tokens
+          );
+        }
+      });
+      transaction();
+    } catch (err) {
+      logger.warning("Failed to flush metrics to db", {
+        module: "METRICS",
+        error: err instanceof Error ? err : new Error(String(err))
+      });
+    }
+  }
+  close() {
+    if (this.flushTimer) {
+      clearInterval(this.flushTimer);
+      this.flushTimer = null;
+    }
+    this.flushToDb();
+  }
+  recordToolCall(toolName, durationMs, success, tokens = 0) {
+    let metric = this.tools.get(toolName);
+    if (!metric) {
+      metric = new ToolMetric();
+      this.tools.set(toolName, metric);
+    }
+    metric.record(durationMs, success, tokens);
+  }
+  recordResourceRead(uri) {
+    let metric = this.resources.get(uri);
+    if (!metric) {
+      metric = new ResourceMetric();
+      this.resources.set(uri, metric);
+    }
+    metric.record();
+  }
+  getSummary() {
+    const toolsSummary = {};
+    for (const [name, metric] of this.tools.entries()) {
+      toolsSummary[name] = metric.getSummary();
+    }
+    const resourcesSummary = {};
+    for (const [uri, metric] of this.resources.entries()) {
+      resourcesSummary[uri] = metric.getSummary();
+    }
+    return {
+      tools: toolsSummary,
+      resources: resourcesSummary,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  toPrometheus() {
+    const lines = [];
+    lines.push("# HELP db_mcp_tool_calls_total Total tool calls");
+    lines.push("# TYPE db_mcp_tool_calls_total counter");
+    lines.push("# HELP db_mcp_tool_errors_total Total tool errors");
+    lines.push("# TYPE db_mcp_tool_errors_total counter");
+    lines.push("# HELP db_mcp_tool_tokens_total Total tokens estimated");
+    lines.push("# TYPE db_mcp_tool_tokens_total counter");
+    lines.push("# HELP db_mcp_tool_latency_ms_p50 P50 Latency (ms)");
+    lines.push("# TYPE db_mcp_tool_latency_ms_p50 gauge");
+    lines.push("# HELP db_mcp_tool_latency_ms_p95 P95 Latency (ms)");
+    lines.push("# TYPE db_mcp_tool_latency_ms_p95 gauge");
+    lines.push("# HELP db_mcp_tool_latency_ms_p99 P99 Latency (ms)");
+    lines.push("# TYPE db_mcp_tool_latency_ms_p99 gauge");
+    for (const [name, metric] of this.tools.entries()) {
+      const summary = metric.getSummary();
+      const labels = `{tool="${name}"}`;
+      lines.push(`db_mcp_tool_calls_total${labels} ${summary.calls}`);
+      lines.push(`db_mcp_tool_errors_total${labels} ${summary.errors}`);
+      lines.push(`db_mcp_tool_tokens_total${labels} ${summary.tokens}`);
+      lines.push(`db_mcp_tool_latency_ms_p50${labels} ${summary.p50}`);
+      lines.push(`db_mcp_tool_latency_ms_p95${labels} ${summary.p95}`);
+      lines.push(`db_mcp_tool_latency_ms_p99${labels} ${summary.p99}`);
+    }
+    lines.push("# HELP db_mcp_resource_reads_total Total resource reads");
+    lines.push("# TYPE db_mcp_resource_reads_total counter");
+    for (const [uri, metric] of this.resources.entries()) {
+      const summary = metric.getSummary();
+      const labels = `{resource="${uri}"}`;
+      lines.push(`db_mcp_resource_reads_total${labels} ${summary.reads}`);
+    }
+    return lines.join("\n") + "\n";
+  }
+};
+var metrics = new MetricsRegistry();
 var authContextStorage = new AsyncLocalStorage();
 function runWithAuthContext(context, fn) {
   return authContextStorage.run(context, fn);
@@ -1555,4 +1773,4 @@ function isOAuthError(error) {
   return error instanceof OAuthError;
 }
 
-export { ALL_TOOL_GROUPS, AuthServerDiscoveryError, AuthenticationError, AuthorizationError, BASE_SCOPES, ConfigurationError, ConnectionError, DbMcpError, ERROR_CODES, ExtensionNotAvailableError, InsufficientScopeError, InvalidSignatureError, InvalidTokenError, JwksFetchError, META_GROUPS, QueryError, ResourceNotFoundError, SCOPES, SUPPORTED_SCOPES, TOOL_GROUPS, TokenExpiredError, TokenMissingError, ValidationError, createModuleLogger, filterTools, findSuggestion, formatHandlerError, getAuthContext, getFilterSummary, getToolFilterFromEnv, hasAdminScope, hasReadScope, isOAuthError, isToolEnabled, logger, parseScopes, parseToolFilter, registerToolScopes, runWithAuthContext, sanitizeErrorMessage, scopesGrantToolAccess };
+export { ALL_TOOL_GROUPS, AuthServerDiscoveryError, AuthenticationError, AuthorizationError, BASE_SCOPES, ConfigurationError, ConnectionError, DbMcpError, ERROR_CODES, ExtensionNotAvailableError, InsufficientScopeError, InvalidSignatureError, InvalidTokenError, JwksFetchError, META_GROUPS, QueryError, ResourceNotFoundError, SCOPES, SUPPORTED_SCOPES, TOOL_GROUPS, TokenExpiredError, TokenMissingError, ValidationError, createModuleLogger, filterTools, findSuggestion, formatHandlerError, getAuthContext, getFilterSummary, getToolFilterFromEnv, hasAdminScope, hasReadScope, isOAuthError, isToolEnabled, logger, metrics, parseScopes, parseToolFilter, registerToolScopes, runWithAuthContext, sanitizeErrorMessage, scopesGrantToolAccess };

package/dist/cli.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG, createServer } from './chunk-37G4DLL6.js';
-import { VERSION } from './chunk-E5IESRTK.js';
-import { logger } from './chunk-L552U3QS.js';
+import { DEFAULT_CONFIG, createServer } from './chunk-NIC5Z2CA.js';
+import { VERSION } from './chunk-R5M4WKDM.js';
+import { logger } from './chunk-Y57WFKAP.js';
+import fs from 'fs';
+import yaml from 'yaml';
 
 // src/audit/types.ts
 var DEFAULT_AUDIT_LOG_MAX_SIZE_BYTES = 10 * 1024 * 1024;
@@ -21,6 +23,9 @@ function parseArgs() {
   let auditReads = false;
   let auditBackup = false;
   let auditBackupData = false;
+  let metricsExport;
+  let dumpConfig = false;
+  let configPath;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "--transport" || arg === "-t") {
@@ -123,6 +128,19 @@ function parseArgs() {
       if (lastDb?.options && "backend" in lastDb.options) {
         lastDb.options["spatialite"] = true;
       }
+    } else if (arg === "--encryption-key") {
+      const keyValue = args[++i];
+      if (keyValue) {
+        const lastDb = databases[databases.length - 1];
+        if (lastDb?.options && "backend" in lastDb.options) {
+          lastDb.options["encryptionKey"] = keyValue;
+        } else {
+          console.error(
+            "Error: --encryption-key must be specified after --sqlite-native"
+          );
+          process.exit(1);
+        }
+      }
     } else if (arg === "--audit-log") {
       const logPath = args[++i];
       if (logPath) {
@@ -136,6 +154,18 @@ function parseArgs() {
       auditBackup = true;
     } else if (arg === "--audit-backup-data") {
       auditBackupData = true;
+    } else if (arg === "--metrics-export") {
+      const metricsValue = args[++i];
+      if (metricsValue === "prometheus") {
+        metricsExport = "prometheus";
+      }
+    } else if (arg === "--config" || arg === "-c") {
+      const pathValue = args[++i];
+      if (pathValue) {
+        configPath = pathValue;
+      }
+    } else if (arg === "--dump-config") {
+      dumpConfig = true;
     } else if (arg === "--help" || arg === "-h") {
       printHelp();
       process.exit(0);
@@ -144,6 +174,9 @@ function parseArgs() {
   if (databases.length > 0) {
     config.databases = databases;
   }
+  if (metricsExport) {
+    config.metricsExport = metricsExport;
+  }
   if (auditLogPath) {
     config.audit = {
       enabled: true,
@@ -162,7 +195,11 @@ function parseArgs() {
       }
     };
   }
-  return config;
+  return {
+    cliConfig: config,
+    dumpConfig,
+    ...configPath !== void 0 ? { configPath } : {}
+  };
 }
 function printHelp() {
   console.error(`
@@ -194,6 +231,7 @@ Database Options:
 Extension Options (Native only):
   --csv                     Load CSV extension for CSV virtual tables
   --spatialite              Load SpatiaLite extension for GIS capabilities
+  --encryption-key <key>    Set SQLCipher encryption key for the database
 
 Audit Options:
   --audit-log <path>        Enable audit logging (JSONL file path, or "stderr")
@@ -203,8 +241,11 @@ Audit Options:
   --audit-backup-data       Include sample data rows in snapshots
 
 Server Options:
+  --config, -c <path>       Load configuration from YAML/JSON file
+  --dump-config             Print the resolved configuration and exit
   --name <name>             Server name (default: db-mcp)
   --version <version>       Server version (default: ${VERSION})
+  --metrics-export <type>   Export metrics at HTTP /metrics (e.g., prometheus)
   --tool-filter <filter>    Tool filter string. Supports:
                               Shortcuts: starter, analytics, search, spatial, minimal, full
                               Groups: core, json, text, fts5, stats, vector, geo, ...
@@ -222,8 +263,10 @@ Environment Variables:
   MCP_ENABLE_HSTS            Enable HSTS header (same as --enable-hsts)
   DB_MCP_TOOL_FILTER        Tool filter string
   SQLITE_DATABASE           SQLite database path
+  DB_ENCRYPTION_KEY         SQLCipher encryption key (Native only)
   CSV_EXTENSION_PATH        Custom path to CSV extension binary
   SPATIALITE_PATH           Custom path to SpatiaLite extension binary
+  METRICS_EXPORT            Export metrics (e.g., prometheus)
   AUDIT_LOG                 Audit log file path (or "stderr")
   AUDIT_REDACT              Redact arguments (default: true, set false to include args)
   AUDIT_READS               Log reads (true/false)
@@ -233,7 +276,7 @@ Environment Variables:
 Examples:
   db-mcp --sqlite-native ./data.db
   db-mcp --sqlite-native ./data.db --tool-filter "starter"
-  db-mcp --transport http --port 3000 --auth-token my-secret --sqlite ./data.db
+  MCP_AUTH_TOKEN=my-secret db-mcp --transport http --port 3000 --sqlite ./data.db
   db-mcp --transport http --oauth-enabled --oauth-issuer http://keycloak:8080/realms/mcp --oauth-audience db-mcp --sqlite ./data.db
 
 For more information, visit: https://github.com/neverinfamous/db-mcp
@@ -304,24 +347,60 @@ function loadEnvConfig() {
   if (sqliteUri) {
     databases.push({ type: "sqlite", connectionString: sqliteUri });
   }
+  if (process.env["METRICS_EXPORT"] === "prometheus") {
+    config.metricsExport = "prometheus";
+  }
   if (databases.length > 0) {
     config.databases = databases;
   }
   return config;
 }
+function loadConfigFile(configPath) {
+  try {
+    const fileContent = fs.readFileSync(configPath, "utf-8");
+    if (configPath.endsWith(".yaml") || configPath.endsWith(".yml")) {
+      return yaml.parse(fileContent);
+    } else {
+      return JSON.parse(fileContent);
+    }
+  } catch (error) {
+    logger.error(`Failed to load config file: ${configPath}`, {
+      error: error instanceof Error ? error : new Error(String(error)),
+      module: "CLI"
+    });
+    process.exit(1);
+  }
+}
 async function main() {
   try {
+    const { cliConfig, dumpConfig, configPath } = parseArgs();
+    const fileConfig = configPath ? loadConfigFile(configPath) : {};
     const envConfig = loadEnvConfig();
-    const cliConfig = parseArgs();
     const config = {
       ...DEFAULT_CONFIG,
+      ...fileConfig,
       ...envConfig,
       ...cliConfig,
       databases: [
+        ...fileConfig.databases ?? [],
         ...envConfig.databases ?? [],
         ...cliConfig.databases ?? []
       ]
     };
+    if (dumpConfig) {
+      const safeConfig = JSON.parse(JSON.stringify(config));
+      if (typeof safeConfig["authToken"] === "string") {
+        safeConfig["authToken"] = "***REDACTED***";
+      }
+      if (typeof safeConfig["oauth"] === "object" && safeConfig["oauth"] !== null) {
+        const oauth = safeConfig["oauth"];
+        if (typeof oauth["jwksUri"] === "string") {
+          oauth["jwksUri"] = "***REDACTED***";
+        }
+      }
+      process.stdout.write(JSON.stringify(safeConfig, null, 2) + "\n");
+      process.exit(0);
+    }
     if (process.env["NODE_ENV"] === "production" && config.transport === "http" && !config.oauth?.enabled && !config.authToken && !config.noAuthEnforcement) {
       logger.error(
         "FATAL SECURITY ERROR: HTTP transport in production requires authentication (--oauth-enabled or --auth-token). If you intend to run without authentication, you must explicitly pass --no-auth-enforcement.",
@@ -340,15 +419,29 @@ async function main() {
         process.exit(0);
       });
     });
+    const globalEncryptionKey = process.env["DB_ENCRYPTION_KEY"];
     for (const dbConfig of config.databases) {
       if (dbConfig.type === "sqlite") {
-        const options = dbConfig.options;
-        if (options?.backend === "better-sqlite3") {
-          const { NativeSqliteAdapter } = await import('./sqlite-native-IF75BB3O.js');
+        const options = dbConfig.options ?? {};
+        if (globalEncryptionKey && !options.encryptionKey) {
+          if (options.backend === "better-sqlite3") {
+            options.encryptionKey = globalEncryptionKey;
+          }
+        }
+        dbConfig.options = options;
+        if (options.encryptionKey && options.backend !== "better-sqlite3") {
+          logger.error(
+            "FATAL: SQLCipher encryption is only supported with the native better-sqlite3 backend. Use --sqlite-native or specify backend: 'better-sqlite3' in config.",
+            { module: "CLI" }
+          );
+          process.exit(1);
+        }
+        if (options.backend === "better-sqlite3") {
+          const { NativeSqliteAdapter } = await import('./sqlite-native-DLVS2T52.js');
           const adapter = new NativeSqliteAdapter();
           await server.registerAdapter(adapter, dbConfig);
         } else {
-          const { SqliteAdapter } = await import('./sqlite-TB56Z7G3.js');
+          const { SqliteAdapter } = await import('./sqlite-D4WCNPU4.js');
           const adapter = new SqliteAdapter();
           await server.registerAdapter(adapter, dbConfig);
         }

package/dist/codemode/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAGpB;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAgB;IAEvC,OAAO;IAIP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe;IAQxD;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAwSzB,gBAAgB,IAAI,MAAM,EAAE;IAI5B,kBAAkB,IAAI,IAAI;IAI1B,SAAS,IAAI,OAAO;IAIpB,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAoC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,CAA2B;gBAE1C,WAAW,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,cAAc;IAKtE,MAAM,CAAC,SAAS,IAAI,OAAO,GAAG;WAOjB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAgCzB,OAAO,IAAI,IAAI;IAOf,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAS3E,OAAO,IAAI,IAAI;CAGhB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/codemode/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAGpB;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAgB;IAEvC,OAAO;IAIP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,eAAe;IAQxD;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAkUzB,gBAAgB,IAAI,MAAM,EAAE;IAI5B,kBAAkB,IAAI,IAAI;IAI1B,SAAS,IAAI,OAAO;IAIpB,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAoC;IAC7D,OAAO,CAAC,MAAM,CAAC,YAAY,CAA2B;gBAE1C,WAAW,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,cAAc;IAKtE,MAAM,CAAC,SAAS,IAAI,OAAO,GAAG;WAOjB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAUlC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAgCzB,OAAO,IAAI,IAAI;IAOf,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAS3E,OAAO,IAAI,IAAI;CAGhB"}

package/dist/constants/server-instructions.d.ts

@@ -12,7 +12,7 @@
  * Slim instructions for the MCP instructions field (~600 chars).
  * Points agents to sqlite://help resources for detailed reference.
  */
-export declare const INSTRUCTIONS = "# db-mcp (SQLite MCP Server)\n\n## Quick Access\n\n| Purpose         | Action                     |\n| --------------- | -------------------------- |\n| Health check    | `server_health` tool       |\n| Server info     | `server_info` tool         |\n| Database schema | `sqlite://schema` resource |\n| Tool help       | `sqlite://help` resource   |\n\n## Built-in Tools\n\n`server_info`, `server_health`, `list_adapters`, `sqlite_execute_code` \u2014 injected into all configurations.\n\n## Help Resources\n\nRead `sqlite://help` for gotchas and critical usage patterns.\nRead `sqlite://help/{group}` for group-specific tool reference (core, json, text, stats, vector, geo, admin, transactions, introspection, migration).\nOnly help resources for your enabled tool groups are registered.";
+export declare const INSTRUCTIONS = "# db-mcp (SQLite MCP Server)\n\n## Quick Access\n\n| Purpose            | Action                     |\n| ------------------ | -------------------------- |\n| Health check       | `server_health` tool       |\n| Live server health | `sqlite://health` resource |\n| Server info        | `server_info` tool         |\n| Database schema    | `sqlite://schema` resource |\n| Tool help          | `sqlite://help` resource   |\n\n## Built-in Tools\n\n`server_info`, `server_health`, `list_adapters`, `sqlite_execute_code` \u2014 injected into all configurations.\n\n## Help Resources\n\nRead `sqlite://help` for gotchas and critical usage patterns.\nRead `sqlite://help/{group}` for group-specific tool reference (core, json, text, stats, vector, geo, admin, transactions, introspection, migration).\nOnly help resources for your enabled tool groups are registered.";
 /**
  * Help content keyed by group name.
  * 'gotchas' is the always-available help (sqlite://help).

package/dist/constants/server-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/constants/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,yxBAmBwC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAo2BnD,CAAC"}
+{"version":3,"file":"server-instructions.d.ts","sourceRoot":"","sources":["../../src/constants/server-instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,g2BAoBwC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAs3BnD,CAAC"}

package/dist/filtering/tool-constants.d.ts

@@ -6,10 +6,10 @@
  * GROUP TOOLS (adapter-registered, accessible via Code Mode sqlite.help()):
  *   core: 21 tools (core/queries.ts, core/tables.ts, core/indexes.ts, core/convenience.ts, core/triggers.ts, core/constraints.ts, core/datetime.ts, core/alter-table.ts)
  *   json: 25 tools (json-operations/crud+query+transform+security+diff.ts, json-helpers/read+write.ts)
- *   text: 14 WASM / 19 Native (text/regex+formatting+search+validate+sentiment.ts, fts.ts)
+ *   text: 15 WASM / 20 Native (text/regex+formatting+search+validate+sentiment.ts, fts.ts)
  *   stats: 17 WASM / 23 Native (stats/basic+advanced.ts, inference/, anomaly-detection.ts, schema-risks.ts, native: window.ts)
  *   vector: 11 tools (vector/storage+search+metadata.ts)
- *   admin: 31 WASM / 32 Native (admin/backup+verify+pragma+reindex+wal.ts, virtual/views+vtable+extensions+analysis.ts; dump.ts is NATIVE ONLY)
+ *   admin: 30 WASM / 31 Native (admin/backup+verify+pragma+reindex+wal.ts, virtual/views+vtable+extensions+analysis.ts; dump.ts is NATIVE ONLY)
  *   transactions: 8 Native (native: transactions.ts)
  *   geo: 4 WASM / 11 Native (geo.ts, native: spatialite/tools+analysis.ts)
  *   introspection: 10 tools (introspection/graph/tools.ts, analysis/constraints+risks+snapshot+diff.ts, diagnostics/storage+indexes+query-plan.ts)
@@ -17,15 +17,15 @@
  *   codemode: 1 tool (codemode.ts)
  *   Subtotal: 139 WASM / 166 Native (excluding Code Mode)
  *
- * AUDIT TOOLS (server-level, MCP-only — NOT exposed in Code Mode):
- *   5 tools (server/registration/audit-tools.ts)
+ * AUDIT & ADMIN TOOLS (server-level, MCP-only — NOT exposed in Code Mode):
+ *   7 tools (server/registration/audit-tools.ts, admin-tools.ts)
  *
  * TOOL COUNT TAXONOMY:
- *   Group tools:  166 Native / 139 WASM  (Code Mode sqlite.help() base total)
- *   Audit tools:    5 Native /   5 WASM  (MCP-only)
- *   Inventory:    171 Native / 144 WASM  (Group + Audit)
- *   Built-in:       4 /   4              (server_info, health, adapters, + Code Mode injected)
- *   MCP total:    175 Native / 148 WASM  (tools/list response)
+ *   Group tools:  166 Native / 139 WASM  (10 groups excluding Code Mode)
+ *   Audit tools:    7 Native /   7 WASM  (MCP-only)
+ *   Inventory:    173 Native / 146 WASM  (Group + Audit)
+ *   Built-in:       4 /   4              (server_info, health, adapters, execute_code)
+ *   MCP total:    177 Native / 150 WASM  (tools/list response)
  */
 import type { ToolGroup, MetaGroup } from "../types/index.js";
 /**

package/dist/{http-HWTUVFIA.js → http-2WGR3E5K.js}

@@ -1,4 +1,4 @@
-import { createModuleLogger, DbMcpError, runWithAuthContext, ERROR_CODES, logger, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-L552U3QS.js';
+import { createModuleLogger, DbMcpError, metrics, runWithAuthContext, ERROR_CODES, logger, SUPPORTED_SCOPES, scopesGrantToolAccess, InsufficientScopeError, hasAdminScope, hasReadScope, isOAuthError, BASE_SCOPES, AuthServerDiscoveryError, JwksFetchError, parseScopes, TokenExpiredError, InvalidSignatureError, InvalidTokenError, TokenMissingError } from './chunk-Y57WFKAP.js';
 import express from 'express';
 import { localhostHostValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
 import cors from 'cors';
@@ -446,6 +446,9 @@ function setupStatefulEndpoints(state) {
               });
               state.transports.delete(sid);
               state.sessionOwners.delete(sid);
+              if ("subscriptionManager" in server) {
+                server.subscriptionManager.unsubscribeSession(sid);
+              }
             }
           };
           await connectionMutex.acquire().then(async (release) => {
@@ -606,6 +609,9 @@ function setupLegacySSEEndpoints(state) {
           });
           state.sseTransports.delete(sseTransport.sessionId);
           state.sessionOwners.delete(sseTransport.sessionId);
+          if ("subscriptionManager" in server) {
+            server.subscriptionManager.unsubscribeSession(sseTransport.sessionId);
+          }
         };
         const origSend = sseTransport.send.bind(sseTransport);
         sseTransport.send = async (message) => {
@@ -1590,6 +1596,12 @@ var HttpTransport = class {
     });
     applyAuthMiddleware(this.state);
     applyScopeEnforcementMiddleware(this.state);
+    if (this.state.config.metricsExport === "prometheus") {
+      this.state.app.get("/metrics", (_req, res) => {
+        res.set("Content-Type", "text/plain");
+        res.send(metrics.toPrometheus());
+      });
+    }
     const oauthEnabled = this.state.config.oauth?.enabled ?? false;
     let lastNoAuthWarning = 0;
     this.state.app.use((req, _res, next) => {

package/dist/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-37G4DLL6.js';
-export { DatabaseAdapter } from './chunk-W5WQVNVX.js';
-export { NAME, VERSION } from './chunk-E5IESRTK.js';
-export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-L552U3QS.js';
+export { DEFAULT_CONFIG, DbMcpServer, createServer } from './chunk-NIC5Z2CA.js';
+export { DatabaseAdapter } from './chunk-EQF3WZHX.js';
+export { NAME, VERSION } from './chunk-R5M4WKDM.js';
+export { ALL_TOOL_GROUPS, AuthenticationError, AuthorizationError, ConnectionError, DbMcpError, META_GROUPS, QueryError, TOOL_GROUPS, ValidationError, filterTools, getFilterSummary, getToolFilterFromEnv, isToolEnabled, parseToolFilter } from './chunk-Y57WFKAP.js';

package/dist/observability/metrics.d.ts

@@ -0,0 +1,36 @@
+/**
+ * db-mcp — Observability Metrics
+ *
+ * In-memory streaming metrics aggregator for tools and resources.
+ * Uses a zero-dependency circular buffer to estimate latency percentiles
+ * (p50, p95, p99) without memory bloat.
+ */
+import type { SystemDb } from "./system-db.js";
+export interface MetricSummary {
+    calls: number;
+    errors: number;
+    tokens: number;
+    p50: number;
+    p95: number;
+    p99: number;
+}
+export interface ResourceMetricSummary {
+    reads: number;
+}
+export declare class MetricsRegistry {
+    private tools;
+    private resources;
+    private systemDb;
+    private flushTimer;
+    setSystemDb(systemDb: SystemDb): void;
+    private loadHistorical;
+    private startFlushTimer;
+    private flushToDb;
+    close(): void;
+    recordToolCall(toolName: string, durationMs: number, success: boolean, tokens?: number): void;
+    recordResourceRead(uri: string): void;
+    getSummary(): Record<string, unknown>;
+    toPrometheus(): string;
+}
+export declare const metrics: MetricsRegistry;
+//# sourceMappingURL=metrics.d.ts.map