taurusdb-core 0.3.0 → 0.4.0

package/dist/auth/sql-profile-loader/parsing.js

@@ -1,4 +1,4 @@
-const CREDENTIAL_URI_PREFIXES = ["aws-sm:", "hw-kms:", "uri:"];
+const CREDENTIAL_URI_PREFIXES = ["aws-sm:", "hw-csms:", "hw-kms:", "hw-kms-file:", "uri:"];
 const SENSITIVE_KEY_PATTERN = /(password|secret|token|credential|apikey|api_key)/i;
 export function isObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);

package/dist/auth/sql-profile-loader/runtime-override.d.ts

@@ -5,7 +5,6 @@ export declare class RuntimeOverrideProfileLoader implements RuntimeTargetProfil
     private readonly runtimeTargets;
     constructor(base: ProfileLoader);
     setRuntimeTarget(name: string, target: RuntimeDataSourceTarget): void;
-    clearRuntimeUser(name: string): void;
     clearRuntimeTarget(name: string): void;
     clearAllRuntimeTargets(): void;
     getRuntimeTarget(name: string): RuntimeDataSourceTarget | undefined;

package/dist/auth/sql-profile-loader/runtime-override.js

@@ -8,7 +8,6 @@ export function applyRuntimeTarget(profile, target) {
         host: target.host ?? profile.host,
         port: target.port ?? profile.port,
         database: target.database ?? profile.database,
-        user: target.user ?? profile.user,
     });
 }
 export class RuntimeOverrideProfileLoader {
@@ -23,20 +22,11 @@ export class RuntimeOverrideProfileLoader {
             host: target.host ?? current?.host,
             port: target.port ?? current?.port,
             database: target.database ?? current?.database,
-            user: target.user ?? current?.user,
             instanceId: target.instanceId ?? current?.instanceId,
             nodeId: target.nodeId ?? current?.nodeId,
         };
         this.runtimeTargets.set(name, next);
     }
-    clearRuntimeUser(name) {
-        const current = this.runtimeTargets.get(name);
-        if (!current) {
-            return;
-        }
-        const { user: _user, ...next } = current;
-        this.runtimeTargets.set(name, next);
-    }
     clearRuntimeTarget(name) {
         this.runtimeTargets.delete(name);
     }

package/dist/auth/sql-profile-loader/types.d.ts

@@ -45,13 +45,11 @@ export interface RuntimeDataSourceTarget {
     host?: string;
     port?: number;
     database?: string;
-    user?: UserCredential;
     instanceId?: string;
     nodeId?: string;
 }
 export interface RuntimeTargetProfileLoader extends ProfileLoader {
     setRuntimeTarget(name: string, target: RuntimeDataSourceTarget): void;
-    clearRuntimeUser(name: string): void;
     clearRuntimeTarget(name: string): void;
     clearAllRuntimeTargets(): void;
     getRuntimeTarget(name: string): RuntimeDataSourceTarget | undefined;

package/dist/cloud/auth.d.ts

@@ -9,7 +9,14 @@ export interface HuaweiCloudAuthOptions {
     domainSuffix?: string;
     iamEndpoint?: string;
     language?: "en-us" | "zh-cn";
+    credentialProvider?: HuaweiCloudCredentialProvider;
 }
+export interface HuaweiCloudCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    securityToken?: string;
+}
+export type HuaweiCloudCredentialProvider = () => Promise<HuaweiCloudCredentials>;
 export interface FetchHuaweiCloudOptions {
     url: string;
     method?: string;

package/dist/cloud/auth.js

@@ -1,4 +1,5 @@
 import { createHash, createHmac } from "node:crypto";
+import { createSystemCredentialProvider } from "./keychain.js";
 function readString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
@@ -98,9 +99,21 @@ export async function fetchHuaweiCloud(options) {
             body: options.body,
         });
     }
-    const { accessKeyId, secretAccessKey } = requireAksk(options.auth);
+    const providerCredentials = (!readString(options.auth.accessKeyId) ||
+        !readString(options.auth.secretAccessKey)) &&
+        options.auth.credentialProvider
+        ? await options.auth.credentialProvider()
+        : undefined;
+    const resolvedAuth = {
+        ...options.auth,
+        accessKeyId: readString(options.auth.accessKeyId) ?? providerCredentials?.accessKeyId,
+        secretAccessKey: readString(options.auth.secretAccessKey) ??
+            providerCredentials?.secretAccessKey,
+        securityToken: readString(options.auth.securityToken) ?? providerCredentials?.securityToken,
+    };
+    const { accessKeyId, secretAccessKey } = requireAksk(resolvedAuth);
     const sdkDate = formatSdkDate(new Date());
-    const headerMap = buildHeaderMap(headers, url, sdkDate, readString(options.auth.securityToken));
+    const headerMap = buildHeaderMap(headers, url, sdkDate, readString(resolvedAuth.securityToken));
     headerMap.set("authorization", buildAuthorization(method, url, headerMap, body, accessKeyId, secretAccessKey));
     return fetchImpl(url, {
         method,
@@ -169,6 +182,12 @@ export async function resolveHuaweiCloudProjectId(auth, fetchImpl) {
     throw new Error(`Unable to resolve project id for region ${region}. Set TAURUSDB_CLOUD_PROJECT_ID explicitly or restrict the account to a single visible project in that region.`);
 }
 export function getHuaweiCloudAuthFromConfig(config) {
+    const credentialProvider = config.cloud?.keychainService
+        ? createSystemCredentialProvider({
+            service: config.cloud.keychainService,
+            account: config.cloud.keychainAccount,
+        })
+        : undefined;
     return {
         region: config.cloud?.region,
         projectId: config.cloud?.projectId,
@@ -179,10 +198,12 @@ export function getHuaweiCloudAuthFromConfig(config) {
         domainSuffix: config.cloud?.domainSuffix,
         iamEndpoint: config.cloud?.iamEndpoint,
         language: config.cloud?.language,
+        credentialProvider,
     };
 }
 export function hasHuaweiCloudCredentialAuth(config) {
-    return canAuthenticateHuaweiCloudRequests(getHuaweiCloudAuthFromConfig(config));
+    return Boolean(config.cloud?.keychainService ||
+        canAuthenticateHuaweiCloudRequests(getHuaweiCloudAuthFromConfig(config)));
 }
 export function inferHuaweiCloudRegionFromEndpoint(endpoint) {
     const normalized = readString(endpoint);

package/dist/cloud/csms.d.ts

@@ -0,0 +1,7 @@
+import type { UriSecretResolver } from "../auth/secret-resolver.js";
+import type { Config } from "../config/index.js";
+export type HuaweiCsmsSecretResolverOptions = {
+    config: Config;
+    fetchImpl?: typeof fetch;
+};
+export declare function createHuaweiCsmsSecretResolver(options: HuaweiCsmsSecretResolverOptions): UriSecretResolver;

package/dist/cloud/csms.js

@@ -0,0 +1,60 @@
+import { fetchHuaweiCloud, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "./auth.js";
+function readString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function readSecretName(uri) {
+    if (!uri.startsWith("hw-csms:")) {
+        throw new Error(`Unsupported Huawei CSMS credential reference: ${uri}`);
+    }
+    const secretName = decodeURIComponent(uri.slice("hw-csms:".length).trim());
+    if (!secretName) {
+        throw new Error("Huawei CSMS credential reference is missing a secret name.");
+    }
+    return secretName;
+}
+function parseSecretString(payload) {
+    const record = payload && typeof payload === "object" && !Array.isArray(payload)
+        ? payload
+        : {};
+    const version = record.version && typeof record.version === "object" && !Array.isArray(record.version)
+        ? record.version
+        : {};
+    const secretString = readString(version.secret_string);
+    if (!secretString) {
+        throw new Error("Huawei CSMS response did not include version.secret_string.");
+    }
+    return secretString;
+}
+export function createHuaweiCsmsSecretResolver(options) {
+    const auth = getHuaweiCloudAuthFromConfig(options.config);
+    const endpoint = options.config.cloud.csmsEndpoint?.replace(/\/+$/g, "");
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (uri) => {
+        if (!endpoint) {
+            throw new Error("Huawei CSMS endpoint is not configured. Set TAURUSDB_CLOUD_REGION or TAURUSDB_CLOUD_CSMS_ENDPOINT.");
+        }
+        const [secretName, projectId] = await Promise.all([
+            Promise.resolve(readSecretName(uri)),
+            resolveHuaweiCloudProjectId(auth, fetchImpl),
+        ]);
+        if (!projectId) {
+            throw new Error("Huawei CSMS request could not resolve a project id. Set TAURUSDB_CLOUD_PROJECT_ID or configure region plus Huawei Cloud credentials.");
+        }
+        const response = await fetchHuaweiCloud({
+            url: `${endpoint}/v1/${encodeURIComponent(projectId)}/secrets/${encodeURIComponent(secretName)}/versions/latest`,
+            headers: { "content-type": "application/json" },
+            auth,
+            fetchImpl,
+        });
+        const payload = (await response.json().catch(() => ({})));
+        if (!response.ok) {
+            const record = payload && typeof payload === "object" && !Array.isArray(payload)
+                ? payload
+                : {};
+            const code = readString(record.error_code) ?? readString(record.code);
+            const message = readString(record.error_msg) ?? readString(record.message);
+            throw new Error(`Huawei CSMS request failed with status ${response.status}${code ? ` (${code})` : ""}${message ? `: ${message}` : ""}.`);
+        }
+        return parseSecretString(payload);
+    };
+}

package/dist/cloud/keychain.d.ts

@@ -0,0 +1,28 @@
+import type { HuaweiCloudCredentialProvider } from "./auth.js";
+export type MacOsKeychainCredentialProviderOptions = {
+    service: string;
+    account?: string;
+    platform?: NodeJS.Platform;
+    readPassword?: (service: string, account: string) => Promise<string | undefined>;
+};
+export type LinuxSecretServiceCredentialProviderOptions = {
+    service: string;
+    account?: string;
+    platform?: NodeJS.Platform;
+    readPassword?: (service: string, account: string, key: string) => Promise<string | undefined>;
+};
+export type WindowsCredentialManagerProviderOptions = {
+    service: string;
+    account?: string;
+    platform?: NodeJS.Platform;
+    readPassword?: (service: string, account: string, key: string) => Promise<string | undefined>;
+};
+export type SystemCredentialProviderOptions = {
+    service: string;
+    account?: string;
+    platform?: NodeJS.Platform;
+};
+export declare function createMacOsKeychainCredentialProvider(options: MacOsKeychainCredentialProviderOptions): HuaweiCloudCredentialProvider;
+export declare function createLinuxSecretServiceCredentialProvider(options: LinuxSecretServiceCredentialProviderOptions): HuaweiCloudCredentialProvider;
+export declare function createWindowsCredentialManagerProvider(options: WindowsCredentialManagerProviderOptions): HuaweiCloudCredentialProvider;
+export declare function createSystemCredentialProvider(options: SystemCredentialProviderOptions): HuaweiCloudCredentialProvider;

package/dist/cloud/keychain.js

@@ -0,0 +1,200 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+async function readMacOsKeychainPassword(service, account) {
+    try {
+        const { stdout } = await execFileAsync("security", [
+            "find-generic-password",
+            "-s",
+            service,
+            "-a",
+            account,
+            "-w",
+        ]);
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "44") {
+            return undefined;
+        }
+        throw new Error(`Failed to read macOS Keychain item "${service}".`, {
+            cause: error,
+        });
+    }
+}
+async function readLinuxSecretServicePassword(service, account, key) {
+    try {
+        const { stdout } = await execFileAsync("secret-tool", [
+            "lookup",
+            "service",
+            service,
+            "account",
+            account,
+            "key",
+            key,
+        ]);
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "1") {
+            return undefined;
+        }
+        if (code === "ENOENT") {
+            throw new Error("Linux Secret Service requires the secret-tool command. Install libsecret-tools or the equivalent package.", { cause: error });
+        }
+        throw new Error(`Failed to read Linux Secret Service item "${service}".`, {
+            cause: error,
+        });
+    }
+}
+const WINDOWS_CREDENTIAL_READ_SCRIPT = `
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class TaurusCredentialManager {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Credential {
+    public UInt32 Flags;
+    public UInt32 Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public UInt32 Persist;
+    public UInt32 AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredRead(string target, UInt32 type, UInt32 flags, out IntPtr credential);
+  [DllImport("advapi32.dll", SetLastError = true)]
+  public static extern void CredFree(IntPtr buffer);
+}
+'@
+$pointer = [IntPtr]::Zero
+if (-not [TaurusCredentialManager]::CredRead($env:TAURUSDB_CREDENTIAL_TARGET, 1, 0, [ref]$pointer)) {
+  if ([Runtime.InteropServices.Marshal]::GetLastWin32Error() -eq 1168) { exit 0 }
+  throw "CredReadW failed."
+}
+try {
+  $credential = [Runtime.InteropServices.Marshal]::PtrToStructure($pointer, [type][TaurusCredentialManager+Credential])
+  if ($credential.CredentialBlobSize -gt 0) {
+    [Runtime.InteropServices.Marshal]::PtrToStringUni($credential.CredentialBlob, [int]($credential.CredentialBlobSize / 2))
+  }
+} finally {
+  [TaurusCredentialManager]::CredFree($pointer)
+}
+`;
+async function readWindowsCredentialManagerPassword(service, account, key) {
+    const target = `${service}/${account}/${key}`;
+    const encodedScript = Buffer.from(WINDOWS_CREDENTIAL_READ_SCRIPT, "utf16le").toString("base64");
+    try {
+        const { stdout } = await execFileAsync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encodedScript], {
+            env: { ...process.env, TAURUSDB_CREDENTIAL_TARGET: target },
+        });
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "ENOENT") {
+            throw new Error("Windows Credential Manager requires Windows PowerShell.", {
+                cause: error,
+            });
+        }
+        throw new Error(`Failed to read Windows Credential Manager item "${target}".`, {
+            cause: error,
+        });
+    }
+}
+function createCachedCredentialProvider(readValues) {
+    let cached;
+    return async () => {
+        cached ??= readValues();
+        return cached;
+    };
+}
+export function createMacOsKeychainCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readMacOsKeychainPassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "darwin") {
+            throw new Error("Huawei Cloud system Keychain credentials currently require macOS.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(`${options.service}/access-key-id`, account),
+            readPassword(`${options.service}/secret-access-key`, account),
+            readPassword(`${options.service}/security-token`, account),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in macOS Keychain service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createLinuxSecretServiceCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readLinuxSecretServicePassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "linux") {
+            throw new Error("Huawei Cloud Linux Secret Service credentials require Linux.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(options.service, account, "access-key-id"),
+            readPassword(options.service, account, "secret-access-key"),
+            readPassword(options.service, account, "security-token"),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in Linux Secret Service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createWindowsCredentialManagerProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readWindowsCredentialManagerPassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "win32") {
+            throw new Error("Huawei Cloud Windows Credential Manager credentials require Windows.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(options.service, account, "access-key-id"),
+            readPassword(options.service, account, "secret-access-key"),
+            readPassword(options.service, account, "security-token"),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in Windows Credential Manager service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createSystemCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "darwin") {
+        return createMacOsKeychainCredentialProvider({ ...options, platform });
+    }
+    if (platform === "linux") {
+        return createLinuxSecretServiceCredentialProvider({ ...options, platform });
+    }
+    if (platform === "win32") {
+        return createWindowsCredentialManagerProvider({ ...options, platform });
+    }
+    return async () => {
+        throw new Error(`Huawei Cloud system credential storage is not supported on platform "${platform}".`);
+    };
+}

package/dist/cloud/kms.d.ts

@@ -0,0 +1,7 @@
+import type { UriSecretResolver } from "../auth/secret-resolver.js";
+import type { Config } from "../config/index.js";
+export type HuaweiKmsSecretResolverOptions = {
+    config: Config;
+    fetchImpl?: typeof fetch;
+};
+export declare function createHuaweiKmsSecretResolver(options: HuaweiKmsSecretResolverOptions): UriSecretResolver;

package/dist/cloud/kms.js

@@ -0,0 +1,86 @@
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fetchHuaweiCloud, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "./auth.js";
+function readString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function resolveFilePath(rawPath) {
+    const decoded = decodeURIComponent(rawPath);
+    if (decoded === "~") {
+        return os.homedir();
+    }
+    if (decoded.startsWith("~/")) {
+        return path.join(os.homedir(), decoded.slice(2));
+    }
+    return path.isAbsolute(decoded) ? decoded : path.resolve(process.cwd(), decoded);
+}
+function requireValue(value, context) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error(`${context} must not be empty.`);
+    }
+    return normalized;
+}
+async function readCipherText(uri) {
+    if (uri.startsWith("hw-kms-file:")) {
+        const rawPath = uri.slice("hw-kms-file:".length).trim();
+        if (!rawPath) {
+            throw new Error("Huawei KMS file credential reference is missing a path.");
+        }
+        return requireValue(await readFile(resolveFilePath(rawPath), "utf8"), "Huawei KMS ciphertext");
+    }
+    if (uri.startsWith("hw-kms:")) {
+        return requireValue(uri.slice("hw-kms:".length), "Huawei KMS ciphertext");
+    }
+    throw new Error(`Unsupported Huawei KMS credential reference: ${uri}`);
+}
+function parsePlainText(payload) {
+    const record = payload && typeof payload === "object" && !Array.isArray(payload)
+        ? payload
+        : {};
+    const plainTextBase64 = typeof record.plain_text_base64 === "string" ? record.plain_text_base64 : undefined;
+    if (plainTextBase64 !== undefined && plainTextBase64.length > 0) {
+        return Buffer.from(plainTextBase64, "base64").toString("utf8");
+    }
+    const plainText = typeof record.plain_text === "string" ? record.plain_text : undefined;
+    if (plainText !== undefined && plainText.length > 0) {
+        return plainText;
+    }
+    throw new Error("Huawei KMS decrypt response did not include plain_text or plain_text_base64.");
+}
+export function createHuaweiKmsSecretResolver(options) {
+    const auth = getHuaweiCloudAuthFromConfig(options.config);
+    const endpoint = options.config.cloud.kmsEndpoint?.replace(/\/+$/g, "");
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (uri) => {
+        if (!endpoint) {
+            throw new Error("Huawei KMS endpoint is not configured. Set TAURUSDB_CLOUD_REGION or TAURUSDB_CLOUD_KMS_ENDPOINT.");
+        }
+        const [cipherText, projectId] = await Promise.all([
+            readCipherText(uri),
+            resolveHuaweiCloudProjectId(auth, fetchImpl),
+        ]);
+        if (!projectId) {
+            throw new Error("Huawei KMS decrypt could not resolve a project id. Set TAURUSDB_CLOUD_PROJECT_ID or configure region plus Huawei Cloud credentials.");
+        }
+        const response = await fetchHuaweiCloud({
+            url: `${endpoint}/v1.0/${projectId}/kms/decrypt-data`,
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ cipher_text: cipherText }),
+            auth,
+            fetchImpl,
+        });
+        const payload = (await response.json().catch(() => ({})));
+        if (!response.ok) {
+            const record = payload && typeof payload === "object" && !Array.isArray(payload)
+                ? payload
+                : {};
+            const code = readString(record.error_code) ?? readString(record.code);
+            const message = readString(record.error_msg) ?? readString(record.message);
+            throw new Error(`Huawei KMS decrypt failed with status ${response.status}${code ? ` (${code})` : ""}${message ? `: ${message}` : ""}.`);
+        }
+        return parsePlainText(payload);
+    };
+}

package/dist/config/env.js

@@ -130,8 +130,14 @@ export function buildRawConfigFromEnv(env) {
             accessKeyId: cloudAccessKeyId,
             secretAccessKey: cloudSecretAccessKey,
             securityToken: cloudSecurityToken,
+            keychainService: readString(env.TAURUSDB_CLOUD_KEYCHAIN_SERVICE),
+            keychainAccount: readString(env.TAURUSDB_CLOUD_KEYCHAIN_ACCOUNT),
             apiEndpoint: buildHuaweiCloudEndpoint("gaussdb", cloudRegion, cloudDomainSuffix),
             iamEndpoint: buildHuaweiCloudEndpoint("iam", cloudRegion, cloudDomainSuffix),
+            kmsEndpoint: readString(env.TAURUSDB_CLOUD_KMS_ENDPOINT) ??
+                buildHuaweiCloudEndpoint("kms", cloudRegion, cloudDomainSuffix),
+            csmsEndpoint: readString(env.TAURUSDB_CLOUD_CSMS_ENDPOINT) ??
+                buildHuaweiCloudEndpoint("csms", cloudRegion, cloudDomainSuffix),
             domainSuffix: cloudDomainSuffix,
             language: readString(env.TAURUSDB_CLOUD_LANGUAGE) ??
                 readString(env.TAURUSDB_SLOW_SQL_SOURCE_TAURUS_API_LANGUAGE),

package/dist/config/schema.d.ts

@@ -12,12 +12,17 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId: z.ZodOptional<z.ZodString>;
         secretAccessKey: z.ZodOptional<z.ZodString>;
         securityToken: z.ZodOptional<z.ZodString>;
+        keychainService: z.ZodOptional<z.ZodString>;
+        keychainAccount: z.ZodDefault<z.ZodString>;
         apiEndpoint: z.ZodOptional<z.ZodString>;
         iamEndpoint: z.ZodOptional<z.ZodString>;
+        kmsEndpoint: z.ZodOptional<z.ZodString>;
+        csmsEndpoint: z.ZodOptional<z.ZodString>;
         domainSuffix: z.ZodDefault<z.ZodString>;
         language: z.ZodDefault<z.ZodEnum<["en-us", "zh-cn"]>>;
     }, "strip", z.ZodTypeAny, {
         provider: "huaweicloud";
+        keychainAccount: string;
         domainSuffix: string;
         language: "en-us" | "zh-cn";
         region?: string | undefined;
@@ -28,8 +33,11 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
     }, {
         provider?: "huaweicloud" | undefined;
         region?: string | undefined;
@@ -40,8 +48,12 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
+        keychainAccount?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
         domainSuffix?: string | undefined;
         language?: "en-us" | "zh-cn" | undefined;
     }>>;
@@ -271,6 +283,7 @@ export declare const ConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     cloud: {
         provider: "huaweicloud";
+        keychainAccount: string;
         domainSuffix: string;
         language: "en-us" | "zh-cn";
         region?: string | undefined;
@@ -281,8 +294,11 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
     };
     limits: {
         maxRows: number;
@@ -352,8 +368,12 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
+        keychainAccount?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
         domainSuffix?: string | undefined;
         language?: "en-us" | "zh-cn" | undefined;
     } | undefined;

package/dist/config/schema.js

@@ -24,8 +24,12 @@ const CloudSchema = z
     accessKeyId: z.string().min(1).optional(),
     secretAccessKey: z.string().min(1).optional(),
     securityToken: z.string().min(1).optional(),
+    keychainService: z.string().min(1).optional(),
+    keychainAccount: z.string().min(1).default("default"),
     apiEndpoint: z.string().min(1).optional(),
     iamEndpoint: z.string().min(1).optional(),
+    kmsEndpoint: z.string().min(1).optional(),
+    csmsEndpoint: z.string().min(1).optional(),
     domainSuffix: z.string().min(1).default("myhuaweicloud.com"),
     language: z.enum(["en-us", "zh-cn"]).default("zh-cn"),
 })

package/dist/diagnostics/metrics-source.d.ts

@@ -1,5 +1,6 @@
 import type { Config } from "../config/index.js";
 import type { SessionContext } from "../context/session-context.js";
+import { type HuaweiCloudCredentialProvider } from "../cloud/auth.js";
 import type { DiagnosisWindow } from "./types.js";
 export type MetricAlias = "cpu_util" | "mem_util" | "connection_count" | "active_connection_count" | "connection_usage" | "qps" | "tps" | "slow_queries" | "storage_used_size" | "storage_write_delay" | "storage_read_delay" | "row_lock_time" | "row_lock_waits" | "long_trx_count" | "write_iops" | "read_iops" | "write_throughput" | "read_throughput" | "temp_tables_per_min";
 export interface MetricPoint {
@@ -31,6 +32,7 @@ type CesMetricsSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     namespace: string;
     instanceDimension: string;
     nodeDimension: string;
@@ -49,6 +51,7 @@ export declare class CesMetricsSource implements MetricsSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly namespace;
     private readonly instanceDimension;
     private readonly nodeDimension;

package/dist/diagnostics/metrics-source.js

@@ -1,4 +1,4 @@
-import { fetchHuaweiCloud } from "../cloud/auth.js";
+import { fetchHuaweiCloud, getHuaweiCloudAuthFromConfig } from "../cloud/auth.js";
 const TAURUS_CES_METRICS = {
     cpu_util: "gaussdb_mysql001_cpu_util",
     mem_util: "gaussdb_mysql002_mem_util",
@@ -132,6 +132,7 @@ export class CesMetricsSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     namespace;
     instanceDimension;
     nodeDimension;
@@ -149,6 +150,7 @@ export class CesMetricsSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.namespace = options.namespace;
         this.instanceDimension = options.instanceDimension;
         this.nodeDimension = options.nodeDimension;
@@ -228,6 +230,7 @@ export class CesMetricsSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,
@@ -257,7 +260,8 @@ export function createMetricsSource(config) {
         !ces.projectId ||
         !ces.instanceId ||
         (!ces.authToken &&
-            !(config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+            !(config.cloud?.accessKeyId && config.cloud?.secretAccessKey) &&
+            !config.cloud?.keychainService)) {
         return undefined;
     }
     return new CesMetricsSource({
@@ -269,6 +273,7 @@ export function createMetricsSource(config) {
         accessKeyId: config.cloud?.accessKeyId,
         secretAccessKey: config.cloud?.secretAccessKey,
         securityToken: config.cloud?.securityToken,
+        credentialProvider: getHuaweiCloudAuthFromConfig(config).credentialProvider,
         namespace: ces.namespace,
         instanceDimension: ces.instanceDimension,
         nodeDimension: ces.nodeDimension,

package/dist/diagnostics/slow-sql-source/das-source.d.ts

@@ -1,3 +1,4 @@
+import { type HuaweiCloudCredentialProvider } from "../../cloud/auth.js";
 import type { SessionContext } from "../../context/session-context.js";
 import type { FindTopSlowSqlInput } from "../types.js";
 import type { ExternalSlowSqlSample, ResolveSlowSqlInput, SlowSqlSource } from "./types.js";
@@ -9,6 +10,7 @@ type DasSlowSqlSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     datastoreType: "MySQL" | "TaurusDB";
     requestTimeoutMs: number;
     defaultLookbackMinutes: number;
@@ -24,6 +26,7 @@ export declare class DasSlowSqlSource implements SlowSqlSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly datastoreType;
     private readonly requestTimeoutMs;
     private readonly defaultLookbackMinutes;

package/dist/diagnostics/slow-sql-source/das-source.js

@@ -9,6 +9,7 @@ export class DasSlowSqlSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     datastoreType;
     requestTimeoutMs;
     defaultLookbackMinutes;
@@ -23,6 +24,7 @@ export class DasSlowSqlSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.datastoreType = options.datastoreType;
         this.requestTimeoutMs = options.requestTimeoutMs;
         this.defaultLookbackMinutes = options.defaultLookbackMinutes;
@@ -149,6 +151,7 @@ export class DasSlowSqlSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,

package/dist/diagnostics/slow-sql-source/factory.js

@@ -1,3 +1,4 @@
+import { getHuaweiCloudAuthFromConfig } from "../../cloud/auth.js";
 import { DasSlowSqlSource } from "./das-source.js";
 import { TaurusApiSlowSqlSource } from "./taurus-api-source.js";
 import { sortExternalSamples } from "./utils.js";
@@ -28,6 +29,7 @@ class CompositeSlowSqlSource {
     }
 }
 export function createSlowSqlSource(config) {
+    const credentialProvider = getHuaweiCloudAuthFromConfig(config).credentialProvider;
     const sources = [];
     const taurusApi = config.slowSqlSource?.taurusApi;
     if (taurusApi?.enabled &&
@@ -36,7 +38,8 @@ export function createSlowSqlSource(config) {
         taurusApi.instanceId &&
         taurusApi.nodeId &&
         (taurusApi.authToken ||
-            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey) ||
+            config.cloud?.keychainService)) {
         sources.push(new TaurusApiSlowSqlSource({
             endpoint: taurusApi.endpoint,
             projectId: taurusApi.projectId,
@@ -46,6 +49,7 @@ export function createSlowSqlSource(config) {
             accessKeyId: config.cloud?.accessKeyId,
             secretAccessKey: config.cloud?.secretAccessKey,
             securityToken: config.cloud?.securityToken,
+            credentialProvider,
             language: taurusApi.language,
             requestTimeoutMs: taurusApi.requestTimeoutMs,
             defaultLookbackMinutes: taurusApi.defaultLookbackMinutes,
@@ -57,7 +61,9 @@ export function createSlowSqlSource(config) {
         das.endpoint &&
         das.projectId &&
         das.instanceId &&
-        (das.authToken || (config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+        (das.authToken ||
+            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey) ||
+            config.cloud?.keychainService)) {
         sources.push(new DasSlowSqlSource({
             endpoint: das.endpoint,
             projectId: das.projectId,
@@ -66,6 +72,7 @@ export function createSlowSqlSource(config) {
             accessKeyId: config.cloud?.accessKeyId,
             secretAccessKey: config.cloud?.secretAccessKey,
             securityToken: config.cloud?.securityToken,
+            credentialProvider,
             datastoreType: das.datastoreType,
             requestTimeoutMs: das.requestTimeoutMs,
             defaultLookbackMinutes: das.defaultLookbackMinutes,

package/dist/diagnostics/slow-sql-source/taurus-api-source.d.ts

@@ -1,3 +1,4 @@
+import { type HuaweiCloudCredentialProvider } from "../../cloud/auth.js";
 import type { SessionContext } from "../../context/session-context.js";
 import type { FindTopSlowSqlInput } from "../types.js";
 import type { ExternalSlowSqlSample, ResolveSlowSqlInput, SlowSqlSource } from "./types.js";
@@ -10,6 +11,7 @@ type TaurusApiSlowSqlSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     language: "en-us" | "zh-cn";
     requestTimeoutMs: number;
     defaultLookbackMinutes: number;
@@ -25,6 +27,7 @@ export declare class TaurusApiSlowSqlSource implements SlowSqlSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly language;
     private readonly requestTimeoutMs;
     private readonly defaultLookbackMinutes;

package/dist/diagnostics/slow-sql-source/taurus-api-source.js

@@ -10,6 +10,7 @@ export class TaurusApiSlowSqlSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     language;
     requestTimeoutMs;
     defaultLookbackMinutes;
@@ -24,6 +25,7 @@ export class TaurusApiSlowSqlSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.language = options.language;
         this.requestTimeoutMs = options.requestTimeoutMs;
         this.defaultLookbackMinutes = options.defaultLookbackMinutes;
@@ -128,6 +130,7 @@ export class TaurusApiSlowSqlSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,

package/dist/engine.js

@@ -1,5 +1,7 @@
 import { createSqlProfileLoader, } from "./auth/sql-profile-loader.js";
 import { createSecretResolver, } from "./auth/secret-resolver.js";
+import { createHuaweiKmsSecretResolver } from "./cloud/kms.js";
+import { createHuaweiCsmsSecretResolver } from "./cloud/csms.js";
 import { createCapabilityProbe, } from "./capability/probe.js";
 import { getConfig } from "./config/index.js";
 import { createDatasourceResolver } from "./context/datasource-resolver.js";
@@ -56,7 +58,14 @@ export class TaurusDBEngine {
     static async create(options = {}) {
         const config = options.config ?? getConfig();
         const profileLoader = options.profileLoader ?? createSqlProfileLoader({ config });
-        const secretResolver = options.secretResolver ?? createSecretResolver();
+        const secretResolver = options.secretResolver ??
+            createSecretResolver({
+                uriResolvers: {
+                    "hw-csms": createHuaweiCsmsSecretResolver({ config }),
+                    "hw-kms": createHuaweiKmsSecretResolver({ config }),
+                    "hw-kms-file": createHuaweiKmsSecretResolver({ config }),
+                },
+            });
         const datasourceResolver = options.datasourceResolver ??
             createDatasourceResolver({
                 config,

package/dist/executor/connection-pool.js

@@ -35,7 +35,7 @@ async function resolveTls(tls, secretResolver) {
 function selectCredential(profile, mode, _opts = {}) {
     void mode;
     if (!profile.user) {
-        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define SQL credentials. Call begin_sql_login and complete the secure local login form before executing SQL.`);
+        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define SQL credentials. Configure a database username and password reference before executing SQL.`);
     }
     return profile.user;
 }

package/dist/index.d.ts

@@ -27,7 +27,13 @@ export { logger, withTaskContext } from "./utils/logger.js";
 export { CloudTaurusInstanceClient, createCloudTaurusInstanceClient, } from "./cloud/instances.js";
 export type { CloudTaurusInstanceSummary, ListCloudTaurusInstancesInput, } from "./cloud/instances.js";
 export { canAuthenticateHuaweiCloudRequests, fetchHuaweiCloud, getHuaweiCloudAuthFromConfig, hasHuaweiCloudCredentialAuth, inferHuaweiCloudRegionFromEndpoint, resolveHuaweiCloudProjectId, } from "./cloud/auth.js";
-export type { HuaweiCloudAuthOptions } from "./cloud/auth.js";
+export type { HuaweiCloudAuthOptions, HuaweiCloudCredentialProvider, HuaweiCloudCredentials, } from "./cloud/auth.js";
+export { createLinuxSecretServiceCredentialProvider, createMacOsKeychainCredentialProvider, createSystemCredentialProvider, createWindowsCredentialManagerProvider, } from "./cloud/keychain.js";
+export type { LinuxSecretServiceCredentialProviderOptions, MacOsKeychainCredentialProviderOptions, SystemCredentialProviderOptions, WindowsCredentialManagerProviderOptions, } from "./cloud/keychain.js";
+export { createHuaweiKmsSecretResolver } from "./cloud/kms.js";
+export type { HuaweiKmsSecretResolverOptions } from "./cloud/kms.js";
+export { createHuaweiCsmsSecretResolver } from "./cloud/csms.js";
+export type { HuaweiCsmsSecretResolverOptions } from "./cloud/csms.js";
 export { FlashbackNoViewError, formatTimestamp as formatFlashbackTimestamp, } from "./taurus/flashback.js";
 export type { FlashbackInput, FlashbackNoViewDetails, } from "./taurus/flashback.js";
 export { buildListRecycleBinSql, buildRestoreRecycleBinTableSql, RECYCLE_BIN_DATABASE, } from "./taurus/recycle-bin.js";

package/dist/index.js

@@ -14,6 +14,9 @@ export { generateQueryId, generateTaskId } from "./utils/id.js";
 export { logger, withTaskContext } from "./utils/logger.js";
 export { CloudTaurusInstanceClient, createCloudTaurusInstanceClient, } from "./cloud/instances.js";
 export { canAuthenticateHuaweiCloudRequests, fetchHuaweiCloud, getHuaweiCloudAuthFromConfig, hasHuaweiCloudCredentialAuth, inferHuaweiCloudRegionFromEndpoint, resolveHuaweiCloudProjectId, } from "./cloud/auth.js";
+export { createLinuxSecretServiceCredentialProvider, createMacOsKeychainCredentialProvider, createSystemCredentialProvider, createWindowsCredentialManagerProvider, } from "./cloud/keychain.js";
+export { createHuaweiKmsSecretResolver } from "./cloud/kms.js";
+export { createHuaweiCsmsSecretResolver } from "./cloud/csms.js";
 export { FlashbackNoViewError, formatTimestamp as formatFlashbackTimestamp, } from "./taurus/flashback.js";
 export { buildListRecycleBinSql, buildRestoreRecycleBinTableSql, RECYCLE_BIN_DATABASE, } from "./taurus/recycle-bin.js";
 export { createPlaceholderDiagnosticResult } from "./diagnostics/types.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "type": "module",
   "main": "dist/index.js",
@@ -32,7 +32,7 @@
     }
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "test": "node --test tests/*.test.mjs"
   },