SqlCertForge.Audit

2.0.0

SqlCertForge.Audit.psd1

                                # =============================================================================

# Script  : SqlCertForge.Audit.psd1

# Author  : Keith Ramsey

# Created : 2026-06-30

# =============================================================================

# Change Log

# -----------------------------------------------------------------------------

# 2026-06-30  cross-suite meta Claude  Read-only (audit) edition of SqlCertForge.

#                            Exports ONLY the 4 read-only verification/inventory

#                            functions -- no state-changing cmdlets. This is the

#                            free "Community / audit" tier and the surface the

#                            MVP PowerShell MCP exposes. State-changing tools live

#                            in the full SqlCertForge module (paid tier).

#                            Derived from SqlCertForge; regenerate from source.

# 2026-09-12  Claude Opus 4.8  v2.0.0: expand the read-only surface from 4 to 12

#                            functions so the free edition matches the v2.0.0 C#

#                            MCP and the main module. Adds the estate-wide cert

#                            inventory and the TDE / backup-encryption / endpoint /

#                            Always Encrypted CMK / cell-key / PolyBase / client-

#                            trust read-only checks (each never-throw, SqlCert.Result

#                            / SqlCert.Inventory). Still no state-changing cmdlets.

#                            Copied from SqlCertForge; regenerate from source.

# =============================================================================

@{

    RootModule           = 'SqlCertForge.Audit.psm1'

    ModuleVersion        = '2.0.0'

    GUID                 = 'efc8d2d0-9420-41d4-950c-9fd4b13a0425'

    Author               = 'Keith Ramsey'

    Description          = 'SqlCertForge (audit edition) -- READ-ONLY inventory and verification of SQL Server and Reporting Services (SSRS/PBIRS) certificate configuration: TLS bindings and HTTPS endpoints, estate-wide certificate inventory, TDE, backup encryption, mirroring/AG/Service Broker endpoint authentication, Always Encrypted column master keys, cell-level key hierarchies, PolyBase, and client trust. Reports what is configured; makes NO changes. The free/community surface; state-changing provisioning lives in the full SqlCertForge module.'

    PowerShellVersion    = '5.1'

    CompatiblePSEditions = @('Desktop', 'Core')

    # Exactly the twelve READ-ONLY functions -- no wildcard.

    FunctionsToExport    = @(

        'Get-RsHttpConfig'

        'Test-RsHttpsEndpoint'

        'Test-SqlCertBinding'

        'Test-RsCertBinding'

        'Get-SqlCertInventory'

        'Test-SqlTdeConfiguration'

        'Test-SqlBackupEncryptionReadiness'

        'Test-SqlEndpointCertAuth'

        'Test-SqlColumnMasterKey'

        'Test-SqlCellKeyHierarchy'

        'Test-SqlPolyBaseCertificate'

        'Test-SqlCertClientTrust'

    )

    CmdletsToExport      = @()

    VariablesToExport    = @()

    AliasesToExport      = @()

    PrivateData = @{

        PSData = @{

            Tags         = @('SQL', 'TLS', 'Certificate', 'ReportingServices', 'PBIRS', 'SSRS', 'Audit', 'ReadOnly', 'MCP', 'TDE', 'AlwaysEncrypted', 'Endpoint', 'BackupEncryption', 'PolyBase', 'Inventory')

            ProjectUri   = 'https://detentpoint.com/sqlcertforge/'

            # Canonical MPL-2.0 text rather than a Detent Point URL. A LicenseUri on a

            # published Gallery version can never be corrected -- the version cannot be

            # edited or re-uploaded -- so it points somewhere that will outlive any site

            # restructure. The licence itself ships in the package as LICENSE.

            LicenseUri   = 'https://mozilla.org/MPL/2.0/'

            ReleaseNotes = 'v2.0.0: the read-only audit edition grows from four commands to twelve, matching the read-only surface of the full SqlCertForge module and the v2.0.0 C# MCP. Every command is read-only and never throws -- a read error is reported as a Failed result, not an exception. New in v2.0.0: Get-SqlCertInventory (estate-wide certificate inventory across engine, Reporting Services, TDE, backup, endpoint and cell surfaces, with expiry), Test-SqlTdeConfiguration, Test-SqlBackupEncryptionReadiness, Test-SqlEndpointCertAuth, Test-SqlColumnMasterKey, Test-SqlCellKeyHierarchy, Test-SqlPolyBaseCertificate and Test-SqlCertClientTrust. The original four (Get-RsHttpConfig, Test-RsHttpsEndpoint, Test-SqlCertBinding, Test-RsCertBinding) are unchanged. The DMV-backed checks read through the dbatools or SqlServer module when present and report a Failed result naming the missing provider when neither is; the registry, WMI and store checks have no such dependency. Safe against production. Runs on Windows PowerShell 5.1 and PowerShell 7. The bundled zero-dependency stdio MCP server exposes all twelve commands as read-only tools. State-changing provisioning remains in the full SqlCertForge module.'

        }

    }

}