taurusdb-core 0.3.0 → 0.5.0-rc.1

package/dist/cloud/keychain.js

@@ -0,0 +1,200 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+async function readMacOsKeychainPassword(service, account) {
+    try {
+        const { stdout } = await execFileAsync("security", [
+            "find-generic-password",
+            "-s",
+            service,
+            "-a",
+            account,
+            "-w",
+        ]);
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "44") {
+            return undefined;
+        }
+        throw new Error(`Failed to read macOS Keychain item "${service}".`, {
+            cause: error,
+        });
+    }
+}
+async function readLinuxSecretServicePassword(service, account, key) {
+    try {
+        const { stdout } = await execFileAsync("secret-tool", [
+            "lookup",
+            "service",
+            service,
+            "account",
+            account,
+            "key",
+            key,
+        ]);
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "1") {
+            return undefined;
+        }
+        if (code === "ENOENT") {
+            throw new Error("Linux Secret Service requires the secret-tool command. Install libsecret-tools or the equivalent package.", { cause: error });
+        }
+        throw new Error(`Failed to read Linux Secret Service item "${service}".`, {
+            cause: error,
+        });
+    }
+}
+const WINDOWS_CREDENTIAL_READ_SCRIPT = `
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class TaurusCredentialManager {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Credential {
+    public UInt32 Flags;
+    public UInt32 Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public UInt32 Persist;
+    public UInt32 AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredRead(string target, UInt32 type, UInt32 flags, out IntPtr credential);
+  [DllImport("advapi32.dll", SetLastError = true)]
+  public static extern void CredFree(IntPtr buffer);
+}
+'@
+$pointer = [IntPtr]::Zero
+if (-not [TaurusCredentialManager]::CredRead($env:TAURUSDB_CREDENTIAL_TARGET, 1, 0, [ref]$pointer)) {
+  if ([Runtime.InteropServices.Marshal]::GetLastWin32Error() -eq 1168) { exit 0 }
+  throw "CredReadW failed."
+}
+try {
+  $credential = [Runtime.InteropServices.Marshal]::PtrToStructure($pointer, [type][TaurusCredentialManager+Credential])
+  if ($credential.CredentialBlobSize -gt 0) {
+    [Runtime.InteropServices.Marshal]::PtrToStringUni($credential.CredentialBlob, [int]($credential.CredentialBlobSize / 2))
+  }
+} finally {
+  [TaurusCredentialManager]::CredFree($pointer)
+}
+`;
+async function readWindowsCredentialManagerPassword(service, account, key) {
+    const target = `${service}/${account}/${key}`;
+    const encodedScript = Buffer.from(WINDOWS_CREDENTIAL_READ_SCRIPT, "utf16le").toString("base64");
+    try {
+        const { stdout } = await execFileAsync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encodedScript], {
+            env: { ...process.env, TAURUSDB_CREDENTIAL_TARGET: target },
+        });
+        const value = stdout.replace(/\r?\n$/, "");
+        return value.length > 0 ? value : undefined;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : undefined;
+        if (code === "ENOENT") {
+            throw new Error("Windows Credential Manager requires Windows PowerShell.", {
+                cause: error,
+            });
+        }
+        throw new Error(`Failed to read Windows Credential Manager item "${target}".`, {
+            cause: error,
+        });
+    }
+}
+function createCachedCredentialProvider(readValues) {
+    let cached;
+    return async () => {
+        cached ??= readValues();
+        return cached;
+    };
+}
+export function createMacOsKeychainCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readMacOsKeychainPassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "darwin") {
+            throw new Error("Huawei Cloud system Keychain credentials currently require macOS.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(`${options.service}/access-key-id`, account),
+            readPassword(`${options.service}/secret-access-key`, account),
+            readPassword(`${options.service}/security-token`, account),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in macOS Keychain service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createLinuxSecretServiceCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readLinuxSecretServicePassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "linux") {
+            throw new Error("Huawei Cloud Linux Secret Service credentials require Linux.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(options.service, account, "access-key-id"),
+            readPassword(options.service, account, "secret-access-key"),
+            readPassword(options.service, account, "security-token"),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in Linux Secret Service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createWindowsCredentialManagerProvider(options) {
+    const platform = options.platform ?? process.platform;
+    const account = options.account ?? "default";
+    const readPassword = options.readPassword ?? readWindowsCredentialManagerPassword;
+    return createCachedCredentialProvider(async () => {
+        if (platform !== "win32") {
+            throw new Error("Huawei Cloud Windows Credential Manager credentials require Windows.");
+        }
+        const [accessKeyId, secretAccessKey, securityToken] = await Promise.all([
+            readPassword(options.service, account, "access-key-id"),
+            readPassword(options.service, account, "secret-access-key"),
+            readPassword(options.service, account, "security-token"),
+        ]);
+        if (!accessKeyId || !secretAccessKey) {
+            throw new Error(`Huawei Cloud credentials were not found in Windows Credential Manager service "${options.service}" for account "${account}".`);
+        }
+        return { accessKeyId, secretAccessKey, securityToken };
+    });
+}
+export function createSystemCredentialProvider(options) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "darwin") {
+        return createMacOsKeychainCredentialProvider({ ...options, platform });
+    }
+    if (platform === "linux") {
+        return createLinuxSecretServiceCredentialProvider({ ...options, platform });
+    }
+    if (platform === "win32") {
+        return createWindowsCredentialManagerProvider({ ...options, platform });
+    }
+    return async () => {
+        throw new Error(`Huawei Cloud system credential storage is not supported on platform "${platform}".`);
+    };
+}

package/dist/cloud/kms.d.ts

@@ -0,0 +1,7 @@
+import type { UriSecretResolver } from "../auth/secret-resolver.js";
+import type { Config } from "../config/index.js";
+export type HuaweiKmsSecretResolverOptions = {
+    config: Config;
+    fetchImpl?: typeof fetch;
+};
+export declare function createHuaweiKmsSecretResolver(options: HuaweiKmsSecretResolverOptions): UriSecretResolver;

package/dist/cloud/kms.js

@@ -0,0 +1,86 @@
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fetchHuaweiCloud, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "./auth.js";
+function readString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function resolveFilePath(rawPath) {
+    const decoded = decodeURIComponent(rawPath);
+    if (decoded === "~") {
+        return os.homedir();
+    }
+    if (decoded.startsWith("~/")) {
+        return path.join(os.homedir(), decoded.slice(2));
+    }
+    return path.isAbsolute(decoded) ? decoded : path.resolve(process.cwd(), decoded);
+}
+function requireValue(value, context) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error(`${context} must not be empty.`);
+    }
+    return normalized;
+}
+async function readCipherText(uri) {
+    if (uri.startsWith("hw-kms-file:")) {
+        const rawPath = uri.slice("hw-kms-file:".length).trim();
+        if (!rawPath) {
+            throw new Error("Huawei KMS file credential reference is missing a path.");
+        }
+        return requireValue(await readFile(resolveFilePath(rawPath), "utf8"), "Huawei KMS ciphertext");
+    }
+    if (uri.startsWith("hw-kms:")) {
+        return requireValue(uri.slice("hw-kms:".length), "Huawei KMS ciphertext");
+    }
+    throw new Error(`Unsupported Huawei KMS credential reference: ${uri}`);
+}
+function parsePlainText(payload) {
+    const record = payload && typeof payload === "object" && !Array.isArray(payload)
+        ? payload
+        : {};
+    const plainTextBase64 = typeof record.plain_text_base64 === "string" ? record.plain_text_base64 : undefined;
+    if (plainTextBase64 !== undefined && plainTextBase64.length > 0) {
+        return Buffer.from(plainTextBase64, "base64").toString("utf8");
+    }
+    const plainText = typeof record.plain_text === "string" ? record.plain_text : undefined;
+    if (plainText !== undefined && plainText.length > 0) {
+        return plainText;
+    }
+    throw new Error("Huawei KMS decrypt response did not include plain_text or plain_text_base64.");
+}
+export function createHuaweiKmsSecretResolver(options) {
+    const auth = getHuaweiCloudAuthFromConfig(options.config);
+    const endpoint = options.config.cloud.kmsEndpoint?.replace(/\/+$/g, "");
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (uri) => {
+        if (!endpoint) {
+            throw new Error("Huawei KMS endpoint is not configured. Set TAURUSDB_CLOUD_REGION or TAURUSDB_CLOUD_KMS_ENDPOINT.");
+        }
+        const [cipherText, projectId] = await Promise.all([
+            readCipherText(uri),
+            resolveHuaweiCloudProjectId(auth, fetchImpl),
+        ]);
+        if (!projectId) {
+            throw new Error("Huawei KMS decrypt could not resolve a project id. Set TAURUSDB_CLOUD_PROJECT_ID or configure region plus Huawei Cloud credentials.");
+        }
+        const response = await fetchHuaweiCloud({
+            url: `${endpoint}/v1.0/${projectId}/kms/decrypt-data`,
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ cipher_text: cipherText }),
+            auth,
+            fetchImpl,
+        });
+        const payload = (await response.json().catch(() => ({})));
+        if (!response.ok) {
+            const record = payload && typeof payload === "object" && !Array.isArray(payload)
+                ? payload
+                : {};
+            const code = readString(record.error_code) ?? readString(record.code);
+            const message = readString(record.error_msg) ?? readString(record.message);
+            throw new Error(`Huawei KMS decrypt failed with status ${response.status}${code ? ` (${code})` : ""}${message ? `: ${message}` : ""}.`);
+        }
+        return parsePlainText(payload);
+    };
+}

package/dist/config/env.js

@@ -130,8 +130,14 @@ export function buildRawConfigFromEnv(env) {
             accessKeyId: cloudAccessKeyId,
             secretAccessKey: cloudSecretAccessKey,
             securityToken: cloudSecurityToken,
+            keychainService: readString(env.TAURUSDB_CLOUD_KEYCHAIN_SERVICE),
+            keychainAccount: readString(env.TAURUSDB_CLOUD_KEYCHAIN_ACCOUNT),
             apiEndpoint: buildHuaweiCloudEndpoint("gaussdb", cloudRegion, cloudDomainSuffix),
             iamEndpoint: buildHuaweiCloudEndpoint("iam", cloudRegion, cloudDomainSuffix),
+            kmsEndpoint: readString(env.TAURUSDB_CLOUD_KMS_ENDPOINT) ??
+                buildHuaweiCloudEndpoint("kms", cloudRegion, cloudDomainSuffix),
+            csmsEndpoint: readString(env.TAURUSDB_CLOUD_CSMS_ENDPOINT) ??
+                buildHuaweiCloudEndpoint("csms", cloudRegion, cloudDomainSuffix),
             domainSuffix: cloudDomainSuffix,
             language: readString(env.TAURUSDB_CLOUD_LANGUAGE) ??
                 readString(env.TAURUSDB_SLOW_SQL_SOURCE_TAURUS_API_LANGUAGE),
@@ -141,10 +147,24 @@ export function buildRawConfigFromEnv(env) {
             maxColumns: parseInteger(env.TAURUSDB_MCP_MAX_COLUMNS, "TAURUSDB_MCP_MAX_COLUMNS"),
             maxStatementMs: parseInteger(env.TAURUSDB_MCP_MAX_STATEMENT_MS, "TAURUSDB_MCP_MAX_STATEMENT_MS"),
             maxFieldChars: parseInteger(env.TAURUSDB_MCP_MAX_FIELD_CHARS, "TAURUSDB_MCP_MAX_FIELD_CHARS"),
+            maxResultBytes: parseInteger(env.TAURUSDB_MCP_MAX_RESULT_BYTES, "TAURUSDB_MCP_MAX_RESULT_BYTES"),
+            maxBlobBytes: parseInteger(env.TAURUSDB_MCP_MAX_BLOB_BYTES, "TAURUSDB_MCP_MAX_BLOB_BYTES"),
+            maxConcurrentQueries: parseInteger(env.TAURUSDB_MCP_MAX_CONCURRENT_QUERIES, "TAURUSDB_MCP_MAX_CONCURRENT_QUERIES"),
+            maxQueuedQueries: parseInteger(env.TAURUSDB_MCP_MAX_QUEUED_QUERIES, "TAURUSDB_MCP_MAX_QUEUED_QUERIES"),
+            queueTimeoutMs: parseInteger(env.TAURUSDB_MCP_QUEUE_TIMEOUT_MS, "TAURUSDB_MCP_QUEUE_TIMEOUT_MS"),
         },
         audit: {
             logPath: expandTildePath(readString(env.TAURUSDB_MCP_AUDIT_LOG_PATH)),
             includeRawSql: parseBoolean(env.TAURUSDB_MCP_AUDIT_INCLUDE_RAW_SQL, "TAURUSDB_MCP_AUDIT_INCLUDE_RAW_SQL"),
+            maxBytes: parseInteger(env.TAURUSDB_MCP_AUDIT_MAX_BYTES, "TAURUSDB_MCP_AUDIT_MAX_BYTES"),
+            maxFiles: parseInteger(env.TAURUSDB_MCP_AUDIT_MAX_FILES, "TAURUSDB_MCP_AUDIT_MAX_FILES"),
+        },
+        security: {
+            mutationsEnabled: parseBoolean(env.TAURUSDB_ENABLE_MUTATIONS, "TAURUSDB_ENABLE_MUTATIONS"),
+            dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
+            requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
+            approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
+            approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),
         },
         slowSqlSource: {
             taurusApi: {

package/dist/config/schema.d.ts

@@ -12,12 +12,17 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId: z.ZodOptional<z.ZodString>;
         secretAccessKey: z.ZodOptional<z.ZodString>;
         securityToken: z.ZodOptional<z.ZodString>;
+        keychainService: z.ZodOptional<z.ZodString>;
+        keychainAccount: z.ZodDefault<z.ZodString>;
         apiEndpoint: z.ZodOptional<z.ZodString>;
         iamEndpoint: z.ZodOptional<z.ZodString>;
+        kmsEndpoint: z.ZodOptional<z.ZodString>;
+        csmsEndpoint: z.ZodOptional<z.ZodString>;
         domainSuffix: z.ZodDefault<z.ZodString>;
         language: z.ZodDefault<z.ZodEnum<["en-us", "zh-cn"]>>;
     }, "strip", z.ZodTypeAny, {
         provider: "huaweicloud";
+        keychainAccount: string;
         domainSuffix: string;
         language: "en-us" | "zh-cn";
         region?: string | undefined;
@@ -28,8 +33,11 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
     }, {
         provider?: "huaweicloud" | undefined;
         region?: string | undefined;
@@ -40,8 +48,12 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
+        keychainAccount?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
         domainSuffix?: string | undefined;
         language?: "en-us" | "zh-cn" | undefined;
     }>>;
@@ -50,26 +62,66 @@ export declare const ConfigSchema: z.ZodObject<{
         maxColumns: z.ZodDefault<z.ZodNumber>;
         maxStatementMs: z.ZodDefault<z.ZodNumber>;
         maxFieldChars: z.ZodDefault<z.ZodNumber>;
+        maxResultBytes: z.ZodDefault<z.ZodNumber>;
+        maxBlobBytes: z.ZodDefault<z.ZodNumber>;
+        maxConcurrentQueries: z.ZodDefault<z.ZodNumber>;
+        maxQueuedQueries: z.ZodDefault<z.ZodNumber>;
+        queueTimeoutMs: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         maxRows: number;
         maxColumns: number;
         maxStatementMs: number;
         maxFieldChars: number;
+        maxResultBytes: number;
+        maxBlobBytes: number;
+        maxConcurrentQueries: number;
+        maxQueuedQueries: number;
+        queueTimeoutMs: number;
     }, {
         maxRows?: number | undefined;
         maxColumns?: number | undefined;
         maxStatementMs?: number | undefined;
         maxFieldChars?: number | undefined;
+        maxResultBytes?: number | undefined;
+        maxBlobBytes?: number | undefined;
+        maxConcurrentQueries?: number | undefined;
+        maxQueuedQueries?: number | undefined;
+        queueTimeoutMs?: number | undefined;
     }>>;
     audit: z.ZodDefault<z.ZodObject<{
         logPath: z.ZodDefault<z.ZodString>;
         includeRawSql: z.ZodDefault<z.ZodBoolean>;
+        maxBytes: z.ZodDefault<z.ZodNumber>;
+        maxFiles: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         logPath: string;
         includeRawSql: boolean;
+        maxBytes: number;
+        maxFiles: number;
     }, {
         logPath?: string | undefined;
         includeRawSql?: boolean | undefined;
+        maxBytes?: number | undefined;
+        maxFiles?: number | undefined;
+    }>>;
+    security: z.ZodDefault<z.ZodObject<{
+        mutationsEnabled: z.ZodDefault<z.ZodBoolean>;
+        dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
+        requireTls: z.ZodDefault<z.ZodBoolean>;
+        approvalSecretPath: z.ZodOptional<z.ZodString>;
+        approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        mutationsEnabled: boolean;
+        dynamicTargetsEnabled: boolean;
+        requireTls: boolean;
+        approvalTtlSeconds: number;
+        approvalSecretPath?: string | undefined;
+    }, {
+        mutationsEnabled?: boolean | undefined;
+        dynamicTargetsEnabled?: boolean | undefined;
+        requireTls?: boolean | undefined;
+        approvalSecretPath?: string | undefined;
+        approvalTtlSeconds?: number | undefined;
     }>>;
     slowSqlSource: z.ZodDefault<z.ZodObject<{
         taurusApi: z.ZodDefault<z.ZodObject<{
@@ -271,6 +323,7 @@ export declare const ConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     cloud: {
         provider: "huaweicloud";
+        keychainAccount: string;
         domainSuffix: string;
         language: "en-us" | "zh-cn";
         region?: string | undefined;
@@ -281,18 +334,35 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
     };
     limits: {
         maxRows: number;
         maxColumns: number;
         maxStatementMs: number;
         maxFieldChars: number;
+        maxResultBytes: number;
+        maxBlobBytes: number;
+        maxConcurrentQueries: number;
+        maxQueuedQueries: number;
+        queueTimeoutMs: number;
     };
     audit: {
         logPath: string;
         includeRawSql: boolean;
+        maxBytes: number;
+        maxFiles: number;
+    };
+    security: {
+        mutationsEnabled: boolean;
+        dynamicTargetsEnabled: boolean;
+        requireTls: boolean;
+        approvalTtlSeconds: number;
+        approvalSecretPath?: string | undefined;
     };
     slowSqlSource: {
         taurusApi: {
@@ -352,8 +422,12 @@ export declare const ConfigSchema: z.ZodObject<{
         accessKeyId?: string | undefined;
         secretAccessKey?: string | undefined;
         securityToken?: string | undefined;
+        keychainService?: string | undefined;
+        keychainAccount?: string | undefined;
         apiEndpoint?: string | undefined;
         iamEndpoint?: string | undefined;
+        kmsEndpoint?: string | undefined;
+        csmsEndpoint?: string | undefined;
         domainSuffix?: string | undefined;
         language?: "en-us" | "zh-cn" | undefined;
     } | undefined;
@@ -362,10 +436,24 @@ export declare const ConfigSchema: z.ZodObject<{
         maxColumns?: number | undefined;
         maxStatementMs?: number | undefined;
         maxFieldChars?: number | undefined;
+        maxResultBytes?: number | undefined;
+        maxBlobBytes?: number | undefined;
+        maxConcurrentQueries?: number | undefined;
+        maxQueuedQueries?: number | undefined;
+        queueTimeoutMs?: number | undefined;
     } | undefined;
     audit?: {
         logPath?: string | undefined;
         includeRawSql?: boolean | undefined;
+        maxBytes?: number | undefined;
+        maxFiles?: number | undefined;
+    } | undefined;
+    security?: {
+        mutationsEnabled?: boolean | undefined;
+        dynamicTargetsEnabled?: boolean | undefined;
+        requireTls?: boolean | undefined;
+        approvalSecretPath?: string | undefined;
+        approvalTtlSeconds?: number | undefined;
     } | undefined;
     slowSqlSource?: {
         taurusApi?: {

package/dist/config/schema.js

@@ -5,12 +5,28 @@ const LimitsSchema = z
     maxColumns: z.number().int().positive().default(50),
     maxStatementMs: z.number().int().positive().default(15000),
     maxFieldChars: z.number().int().positive().default(2048),
+    maxResultBytes: z.number().int().positive().default(1048576),
+    maxBlobBytes: z.number().int().positive().default(65536),
+    maxConcurrentQueries: z.number().int().positive().default(8),
+    maxQueuedQueries: z.number().int().nonnegative().default(32),
+    queueTimeoutMs: z.number().int().positive().default(5000),
 })
     .default({});
 const AuditSchema = z
     .object({
     logPath: z.string().min(1).default("~/.taurusdb-mcp/audit.jsonl"),
     includeRawSql: z.boolean().default(false),
+    maxBytes: z.number().int().positive().default(104857600),
+    maxFiles: z.number().int().positive().max(100).default(10),
+})
+    .default({});
+const SecuritySchema = z
+    .object({
+    mutationsEnabled: z.boolean().default(false),
+    dynamicTargetsEnabled: z.boolean().default(false),
+    requireTls: z.boolean().default(true),
+    approvalSecretPath: z.string().min(1).optional(),
+    approvalTtlSeconds: z.number().int().positive().max(3600).default(300),
 })
     .default({});
 const CloudSchema = z
@@ -24,8 +40,12 @@ const CloudSchema = z
     accessKeyId: z.string().min(1).optional(),
     secretAccessKey: z.string().min(1).optional(),
     securityToken: z.string().min(1).optional(),
+    keychainService: z.string().min(1).optional(),
+    keychainAccount: z.string().min(1).default("default"),
     apiEndpoint: z.string().min(1).optional(),
     iamEndpoint: z.string().min(1).optional(),
+    kmsEndpoint: z.string().min(1).optional(),
+    csmsEndpoint: z.string().min(1).optional(),
     domainSuffix: z.string().min(1).default("myhuaweicloud.com"),
     language: z.enum(["en-us", "zh-cn"]).default("zh-cn"),
 })
@@ -85,6 +105,7 @@ export const ConfigSchema = z.object({
     cloud: CloudSchema,
     limits: LimitsSchema,
     audit: AuditSchema,
+    security: SecuritySchema,
     slowSqlSource: z
         .object({
         taurusApi: TaurusApiSlowSqlSourceSchema,

package/dist/context/datasource-resolver.js

@@ -41,12 +41,19 @@ export class DefaultDatasourceResolver {
             engine: profile.engine,
             database: normalizeString(input.database) ?? profile.database,
             schema: normalizeString(input.schema),
+            host: profile.host,
+            port: profile.port,
+            projectId: this.config.cloud.projectId,
+            instanceId: profile.instanceId ?? this.config.cloud.instanceId,
+            nodeId: profile.nodeId ?? this.config.cloud.nodeId,
             limits: {
                 readonly: input.readonly ?? true,
                 timeoutMs: resolveTimeoutMs(input.timeout_ms, this.config.limits.maxStatementMs),
                 maxRows: this.config.limits.maxRows,
                 maxColumns: this.config.limits.maxColumns,
                 maxFieldChars: this.config.limits.maxFieldChars,
+                maxResultBytes: this.config.limits.maxResultBytes,
+                maxBlobBytes: this.config.limits.maxBlobBytes,
             },
         };
     }

package/dist/context/session-context.d.ts

@@ -5,6 +5,8 @@ export interface RuntimeLimits {
     maxRows: number;
     maxColumns: number;
     maxFieldChars: number;
+    maxResultBytes?: number;
+    maxBlobBytes?: number;
 }
 export interface SessionContext {
     task_id: string;
@@ -12,6 +14,11 @@ export interface SessionContext {
     engine: DatabaseEngine;
     database?: string;
     schema?: string;
+    host?: string;
+    port?: number;
+    projectId?: string;
+    instanceId?: string;
+    nodeId?: string;
     limits: RuntimeLimits;
 }
 export interface DatasourceResolveInput {

package/dist/diagnostics/metrics-source.d.ts

@@ -1,5 +1,6 @@
 import type { Config } from "../config/index.js";
 import type { SessionContext } from "../context/session-context.js";
+import { type HuaweiCloudCredentialProvider } from "../cloud/auth.js";
 import type { DiagnosisWindow } from "./types.js";
 export type MetricAlias = "cpu_util" | "mem_util" | "connection_count" | "active_connection_count" | "connection_usage" | "qps" | "tps" | "slow_queries" | "storage_used_size" | "storage_write_delay" | "storage_read_delay" | "row_lock_time" | "row_lock_waits" | "long_trx_count" | "write_iops" | "read_iops" | "write_throughput" | "read_throughput" | "temp_tables_per_min";
 export interface MetricPoint {
@@ -31,6 +32,7 @@ type CesMetricsSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     namespace: string;
     instanceDimension: string;
     nodeDimension: string;
@@ -49,6 +51,7 @@ export declare class CesMetricsSource implements MetricsSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly namespace;
     private readonly instanceDimension;
     private readonly nodeDimension;