taurusdb-core 0.3.0 → 0.5.0-rc.1

package/dist/diagnostics/metrics-source.js

@@ -1,4 +1,4 @@
-import { fetchHuaweiCloud } from "../cloud/auth.js";
+import { fetchHuaweiCloud, getHuaweiCloudAuthFromConfig } from "../cloud/auth.js";
 const TAURUS_CES_METRICS = {
     cpu_util: "gaussdb_mysql001_cpu_util",
     mem_util: "gaussdb_mysql002_mem_util",
@@ -132,6 +132,7 @@ export class CesMetricsSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     namespace;
     instanceDimension;
     nodeDimension;
@@ -149,6 +150,7 @@ export class CesMetricsSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.namespace = options.namespace;
         this.instanceDimension = options.instanceDimension;
         this.nodeDimension = options.nodeDimension;
@@ -228,6 +230,7 @@ export class CesMetricsSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,
@@ -257,7 +260,8 @@ export function createMetricsSource(config) {
         !ces.projectId ||
         !ces.instanceId ||
         (!ces.authToken &&
-            !(config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+            !(config.cloud?.accessKeyId && config.cloud?.secretAccessKey) &&
+            !config.cloud?.keychainService)) {
         return undefined;
     }
     return new CesMetricsSource({
@@ -269,6 +273,7 @@ export function createMetricsSource(config) {
         accessKeyId: config.cloud?.accessKeyId,
         secretAccessKey: config.cloud?.secretAccessKey,
         securityToken: config.cloud?.securityToken,
+        credentialProvider: getHuaweiCloudAuthFromConfig(config).credentialProvider,
         namespace: ces.namespace,
         instanceDimension: ces.instanceDimension,
         nodeDimension: ces.nodeDimension,

package/dist/diagnostics/replication-lag.d.ts

@@ -0,0 +1,4 @@
+import type { SessionContext } from "../context/session-context.js";
+import type { SqlExecutor } from "../executor/sql-executor.js";
+import type { DiagnoseReplicationLagInput, DiagnosticResult } from "./types.js";
+export declare function diagnoseReplicationLag(executor: SqlExecutor, input: DiagnoseReplicationLagInput, ctx: SessionContext): Promise<DiagnosticResult>;

package/dist/diagnostics/replication-lag.js

@@ -0,0 +1,138 @@
+function rowsAsObjects(result) {
+    return result.rows.map((row) => Object.fromEntries(result.columns.map((column, index) => [column.name, row[index]])));
+}
+function text(row, ...names) {
+    for (const name of names) {
+        const value = row[name];
+        if (value !== undefined && value !== null && String(value).trim()) {
+            return String(value).trim();
+        }
+    }
+    return undefined;
+}
+function number(row, ...names) {
+    const value = text(row, ...names);
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+async function readReplicationStatus(executor, ctx) {
+    try {
+        return rowsAsObjects(await executor.executeReadonly("SHOW REPLICA STATUS", ctx, {
+            maxRows: 20,
+            maxColumns: 80,
+            maxFieldChars: 512,
+            maxResultBytes: 262144,
+        }));
+    }
+    catch {
+        return rowsAsObjects(await executor.executeReadonly("SHOW SLAVE STATUS", ctx, {
+            maxRows: 20,
+            maxColumns: 80,
+            maxFieldChars: 512,
+            maxResultBytes: 262144,
+        }));
+    }
+}
+export async function diagnoseReplicationLag(executor, input, ctx) {
+    let rows;
+    try {
+        rows = await readReplicationStatus(executor, ctx);
+    }
+    catch {
+        rows = [];
+    }
+    const filtered = rows.filter((row) => {
+        const channel = text(row, "Channel_Name");
+        const replicaId = text(row, "Server_Id", "Source_Server_Id", "Master_Server_Id");
+        return ((!input.channel || channel === input.channel) &&
+            (!input.replicaId || replicaId === input.replicaId));
+    });
+    const window = {
+        from: input.timeRange?.from,
+        to: input.timeRange?.to,
+        relative: input.timeRange?.relative,
+    };
+    if (filtered.length === 0) {
+        return {
+            tool: "diagnose_replication_lag",
+            status: "not_applicable",
+            severity: "info",
+            summary: "No replication channel was visible on the selected database endpoint.",
+            diagnosisWindow: window,
+            rootCauseCandidates: [],
+            keyFindings: [
+                "SHOW REPLICA STATUS and SHOW SLAVE STATUS returned no matching channel.",
+            ],
+            evidence: [],
+            recommendedActions: [
+                "Confirm that the selected endpoint is a read replica and that the read-only SQL user can inspect replication status.",
+            ],
+            limitations: [
+                "A primary or standalone endpoint legitimately has no replica status.",
+                "Cloud time-series replication metrics are not included in this data-plane-only result.",
+            ],
+        };
+    }
+    const findings = filtered.map((row) => {
+        const lag = number(row, "Seconds_Behind_Source", "Seconds_Behind_Master");
+        const io = text(row, "Replica_IO_Running", "Slave_IO_Running") ?? "unknown";
+        const sql = text(row, "Replica_SQL_Running", "Slave_SQL_Running") ?? "unknown";
+        const channel = text(row, "Channel_Name") ?? "default";
+        return { lag, io, sql, channel };
+    });
+    const maxLag = Math.max(...findings.map((item) => item.lag ?? 0));
+    const stopped = findings.some((item) => item.io.toLowerCase() === "no" || item.sql.toLowerCase() === "no");
+    const severity = stopped || maxLag >= 300 ? "high" : maxLag >= 30 ? "warning" : "info";
+    const status = stopped || maxLag >= 30 ? "inconclusive" : "ok";
+    return {
+        tool: "diagnose_replication_lag",
+        status,
+        severity,
+        summary: stopped
+            ? "At least one replication worker is not running."
+            : `Observed maximum replication delay of ${maxLag} seconds.`,
+        diagnosisWindow: window,
+        rootCauseCandidates: [
+            ...(stopped
+                ? [{
+                        code: "replication_worker_stopped",
+                        title: "Replication worker stopped",
+                        confidence: "high",
+                        rationale: "Replica IO or SQL worker reports No.",
+                    }]
+                : []),
+            ...(maxLag >= 30
+                ? [{
+                        code: "replication_delay",
+                        title: "Replica apply delay",
+                        confidence: "high",
+                        rationale: `Seconds behind source reached ${maxLag}.`,
+                    }]
+                : []),
+        ],
+        keyFindings: findings.map((item) => `Channel ${item.channel}: lag=${item.lag ?? "unknown"}s, io=${item.io}, sql=${item.sql}.`),
+        evidence: [{
+                source: "replication_status",
+                title: "Current replication status",
+                summary: `Collected ${findings.length} matching replication channel(s).`,
+            }],
+        recommendedActions: stopped
+            ? [
+                "Inspect Last_IO_Error and Last_SQL_Error directly with a privileged DBA account.",
+                "Do not skip replication errors until the failed event and data consistency impact are understood.",
+            ]
+            : maxLag >= 30
+                ? [
+                    "Check long transactions, write bursts, DDL, and replica resource saturation.",
+                    "Compare lag over time in Cloud Eye before changing replica topology.",
+                ]
+                : ["Continue monitoring the replication delay trend."],
+        limitations: [
+            "This result is a point-in-time data-plane snapshot.",
+            "Error text and relay-log SQL are intentionally not returned to the MCP client.",
+        ],
+    };
+}

package/dist/diagnostics/slow-sql-source/das-source.d.ts

@@ -1,3 +1,4 @@
+import { type HuaweiCloudCredentialProvider } from "../../cloud/auth.js";
 import type { SessionContext } from "../../context/session-context.js";
 import type { FindTopSlowSqlInput } from "../types.js";
 import type { ExternalSlowSqlSample, ResolveSlowSqlInput, SlowSqlSource } from "./types.js";
@@ -9,6 +10,7 @@ type DasSlowSqlSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     datastoreType: "MySQL" | "TaurusDB";
     requestTimeoutMs: number;
     defaultLookbackMinutes: number;
@@ -24,6 +26,7 @@ export declare class DasSlowSqlSource implements SlowSqlSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly datastoreType;
     private readonly requestTimeoutMs;
     private readonly defaultLookbackMinutes;

package/dist/diagnostics/slow-sql-source/das-source.js

@@ -9,6 +9,7 @@ export class DasSlowSqlSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     datastoreType;
     requestTimeoutMs;
     defaultLookbackMinutes;
@@ -23,6 +24,7 @@ export class DasSlowSqlSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.datastoreType = options.datastoreType;
         this.requestTimeoutMs = options.requestTimeoutMs;
         this.defaultLookbackMinutes = options.defaultLookbackMinutes;
@@ -149,6 +151,7 @@ export class DasSlowSqlSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,

package/dist/diagnostics/slow-sql-source/factory.js

@@ -1,3 +1,4 @@
+import { getHuaweiCloudAuthFromConfig } from "../../cloud/auth.js";
 import { DasSlowSqlSource } from "./das-source.js";
 import { TaurusApiSlowSqlSource } from "./taurus-api-source.js";
 import { sortExternalSamples } from "./utils.js";
@@ -28,6 +29,7 @@ class CompositeSlowSqlSource {
     }
 }
 export function createSlowSqlSource(config) {
+    const credentialProvider = getHuaweiCloudAuthFromConfig(config).credentialProvider;
     const sources = [];
     const taurusApi = config.slowSqlSource?.taurusApi;
     if (taurusApi?.enabled &&
@@ -36,7 +38,8 @@ export function createSlowSqlSource(config) {
         taurusApi.instanceId &&
         taurusApi.nodeId &&
         (taurusApi.authToken ||
-            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey) ||
+            config.cloud?.keychainService)) {
         sources.push(new TaurusApiSlowSqlSource({
             endpoint: taurusApi.endpoint,
             projectId: taurusApi.projectId,
@@ -46,6 +49,7 @@ export function createSlowSqlSource(config) {
             accessKeyId: config.cloud?.accessKeyId,
             secretAccessKey: config.cloud?.secretAccessKey,
             securityToken: config.cloud?.securityToken,
+            credentialProvider,
             language: taurusApi.language,
             requestTimeoutMs: taurusApi.requestTimeoutMs,
             defaultLookbackMinutes: taurusApi.defaultLookbackMinutes,
@@ -57,7 +61,9 @@ export function createSlowSqlSource(config) {
         das.endpoint &&
         das.projectId &&
         das.instanceId &&
-        (das.authToken || (config.cloud?.accessKeyId && config.cloud?.secretAccessKey))) {
+        (das.authToken ||
+            (config.cloud?.accessKeyId && config.cloud?.secretAccessKey) ||
+            config.cloud?.keychainService)) {
         sources.push(new DasSlowSqlSource({
             endpoint: das.endpoint,
             projectId: das.projectId,
@@ -66,6 +72,7 @@ export function createSlowSqlSource(config) {
             accessKeyId: config.cloud?.accessKeyId,
             secretAccessKey: config.cloud?.secretAccessKey,
             securityToken: config.cloud?.securityToken,
+            credentialProvider,
             datastoreType: das.datastoreType,
             requestTimeoutMs: das.requestTimeoutMs,
             defaultLookbackMinutes: das.defaultLookbackMinutes,

package/dist/diagnostics/slow-sql-source/taurus-api-source.d.ts

@@ -1,3 +1,4 @@
+import { type HuaweiCloudCredentialProvider } from "../../cloud/auth.js";
 import type { SessionContext } from "../../context/session-context.js";
 import type { FindTopSlowSqlInput } from "../types.js";
 import type { ExternalSlowSqlSample, ResolveSlowSqlInput, SlowSqlSource } from "./types.js";
@@ -10,6 +11,7 @@ type TaurusApiSlowSqlSourceOptions = {
     accessKeyId?: string;
     secretAccessKey?: string;
     securityToken?: string;
+    credentialProvider?: HuaweiCloudCredentialProvider;
     language: "en-us" | "zh-cn";
     requestTimeoutMs: number;
     defaultLookbackMinutes: number;
@@ -25,6 +27,7 @@ export declare class TaurusApiSlowSqlSource implements SlowSqlSource {
     private readonly accessKeyId?;
     private readonly secretAccessKey?;
     private readonly securityToken?;
+    private readonly credentialProvider?;
     private readonly language;
     private readonly requestTimeoutMs;
     private readonly defaultLookbackMinutes;

package/dist/diagnostics/slow-sql-source/taurus-api-source.js

@@ -10,6 +10,7 @@ export class TaurusApiSlowSqlSource {
     accessKeyId;
     secretAccessKey;
     securityToken;
+    credentialProvider;
     language;
     requestTimeoutMs;
     defaultLookbackMinutes;
@@ -24,6 +25,7 @@ export class TaurusApiSlowSqlSource {
         this.accessKeyId = options.accessKeyId;
         this.secretAccessKey = options.secretAccessKey;
         this.securityToken = options.securityToken;
+        this.credentialProvider = options.credentialProvider;
         this.language = options.language;
         this.requestTimeoutMs = options.requestTimeoutMs;
         this.defaultLookbackMinutes = options.defaultLookbackMinutes;
@@ -128,6 +130,7 @@ export class TaurusApiSlowSqlSource {
                     accessKeyId: this.accessKeyId,
                     secretAccessKey: this.secretAccessKey,
                     securityToken: this.securityToken,
+                    credentialProvider: this.credentialProvider,
                 },
                 fetchImpl: (input, init) => this.fetchImpl(input, {
                     ...init,

package/dist/diagnostics/types.d.ts

@@ -1,4 +1,4 @@
-export type DiagnosticToolName = "diagnose_service_latency" | "diagnose_db_hotspot" | "find_top_slow_sql" | "diagnose_slow_query" | "diagnose_connection_spike" | "diagnose_lock_contention" | "diagnose_storage_pressure";
+export type DiagnosticToolName = "diagnose_service_latency" | "diagnose_db_hotspot" | "find_top_slow_sql" | "diagnose_slow_query" | "diagnose_connection_spike" | "diagnose_lock_contention" | "diagnose_replication_lag" | "diagnose_storage_pressure";
 export type DiagnosticStatus = "ok" | "inconclusive" | "not_applicable";
 export type DiagnosticSeverity = "info" | "warning" | "high" | "critical";
 export type DiagnosticEvidenceLevel = "basic" | "standard" | "full";
@@ -46,6 +46,10 @@ export interface DiagnoseStoragePressureInput extends DiagnosticBaseInput {
     scope?: "instance" | "database" | "table";
     table?: string;
 }
+export interface DiagnoseReplicationLagInput extends DiagnosticBaseInput {
+    replicaId?: string;
+    channel?: string;
+}
 export interface DiagnosticRootCauseCandidate {
     code: string;
     title: string;

package/dist/diagnostics/types.js

@@ -11,29 +11,29 @@ export function createPlaceholderDiagnosticResult(tool, input, options) {
         },
         rootCauseCandidates: [
             {
-                code: `${tool}_pending`,
+                code: `${tool}_insufficient_evidence`,
                 title: options.candidateTitle,
                 confidence: "low",
                 rationale: options.candidateRationale,
             },
         ],
         keyFindings: options.keyFindings ?? [
-            "The diagnostic contract is available, but evidence collectors have not been wired yet.",
-            "No live control-plane or data-plane evidence was collected in this run.",
+            "No conclusive live control-plane or data-plane evidence matched this diagnosis.",
+            "The result is intentionally inconclusive rather than inferring a root cause without evidence.",
         ],
         suspiciousEntities: options.suspiciousEntities,
         evidence: options.evidence ?? [
             {
-                source: "diagnostics_scaffold",
-                title: "Diagnostic scaffold active",
-                summary: "Typed inputs, outputs, and engine entrypoints are in place, but collectors and analyzers are pending.",
+                source: "diagnostic_limitations",
+                title: "No conclusive evidence",
+                summary: "The configured collectors returned no evidence sufficient for a root-cause conclusion.",
             },
         ],
         recommendedActions: options.recommendedActions ?? [
             "Implement the required collectors before relying on this tool for production diagnosis.",
         ],
         limitations: options.limitations ?? [
-            "This diagnostic currently returns a scaffolded result instead of live evidence-backed analysis.",
+            "The configured datasource, permissions, time window, or cloud metric sources did not provide sufficient evidence.",
         ],
     };
 }

package/dist/engine/runtime.d.ts

@@ -1,6 +1,6 @@
 import type { SessionContext } from "../context/session-context.js";
 import type { CancelResult, ExplainResult, MutationOptions, MutationResult, QueryResult, QueryStatus, ReadonlyOptions } from "../executor/sql-executor.js";
-import type { ConfirmationToken, ConfirmationValidationResult } from "../safety/confirmation-store.js";
+import type { ConfirmationRequest, ConfirmationValidationResult } from "../safety/confirmation-store.js";
 import type { GuardrailDecision } from "../safety/guardrail.js";
 import { type FlashbackInput } from "../taurus/flashback.js";
 import { type RestoreRecycleBinTableInput } from "../taurus/recycle-bin.js";
@@ -14,7 +14,7 @@ export declare function listRecycleBin(engine: TaurusDBEngine, ctx: SessionConte
 export declare function restoreRecycleBinTable(engine: TaurusDBEngine, input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
 export declare function getQueryStatus(engine: TaurusDBEngine, queryId: string): Promise<QueryStatus>;
 export declare function cancelQuery(engine: TaurusDBEngine, queryId: string): Promise<CancelResult>;
-export declare function issueConfirmation(engine: TaurusDBEngine, input: IssueConfirmationInput): Promise<ConfirmationToken>;
+export declare function issueConfirmation(engine: TaurusDBEngine, input: IssueConfirmationInput): Promise<ConfirmationRequest>;
 export declare function validateConfirmation(engine: TaurusDBEngine, token: string, sql: string, ctx: SessionContext): Promise<ConfirmationValidationResult>;
 export declare function handleConfirmation(engine: TaurusDBEngine, decision: GuardrailDecision, ctx: SessionContext): Promise<ConfirmationOutcome>;
 export declare function close(engine: TaurusDBEngine): Promise<void>;

package/dist/engine/runtime.js

@@ -3,6 +3,7 @@ import { InMemoryConfirmationStore } from "../safety/confirmation-store.js";
 import { buildFlashbackSql, FlashbackNoViewError, flashbackReadonlyOptions, formatTimestamp, normalizeFlashbackWhereClause, resolveRelativeTimestampFromBase, resolveFlashbackTimestamp, } from "../taurus/flashback.js";
 import { buildListRecycleBinSql, buildRestoreRecycleBinTableSql, recycleBinMutationOptions, recycleBinReadonlyOptions } from "../taurus/recycle-bin.js";
 import { normalizeSql, sqlHash } from "../utils/hash.js";
+import { quoteMysqlIdentifier } from "../utils/mysql-identifier.js";
 function resolveConfirmationSql(input) {
     const normalized = input.normalizedSql ?? (input.sql ? normalizeSql(input.sql) : undefined);
     const hash = input.sqlHash ?? (normalized ? sqlHash(normalized) : undefined);
@@ -26,13 +27,6 @@ function hasSqlPattern(sql, pattern) {
     return pattern.test(sql);
 }
 const NO_FLASHBACK_VIEW_PATTERN = /No view available for provided TIMESTAMP/i;
-const SIMPLE_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-function quoteIdentifier(identifier) {
-    if (!SIMPLE_IDENTIFIER_PATTERN.test(identifier)) {
-        throw new Error(`Invalid identifier: "${identifier}".`);
-    }
-    return `\`${identifier}\``;
-}
 function firstRowAsObject(result) {
     if (result.rows.length === 0) {
         return undefined;
@@ -91,7 +85,7 @@ async function buildFlashbackNoViewError(engine, ctx, input, database, requested
     if (input.where?.trim()) {
         try {
             const where = normalizeFlashbackWhereClause(input.where);
-            const updatedAtResult = await engine.executor.executeReadonly(`SELECT ${quoteIdentifier("updated_at")} FROM ${quoteIdentifier(database)}.${quoteIdentifier(input.table)} WHERE (${where}) LIMIT 1`, ctx, { maxRows: 1, maxColumns: 1, maxFieldChars: 128 });
+            const updatedAtResult = await engine.executor.executeReadonly(`SELECT ${quoteMysqlIdentifier("updated_at")} FROM ${quoteMysqlIdentifier(database, "database")}.${quoteMysqlIdentifier(input.table, "table")} WHERE (${where}) LIMIT 1`, ctx, { maxRows: 1, maxColumns: 1, maxFieldChars: 128 });
             const updatedAtRow = firstRowAsObject(updatedAtResult);
             if (typeof updatedAtRow?.updated_at === "string") {
                 details.current_row_updated_at = updatedAtRow.updated_at;
@@ -341,7 +335,6 @@ export async function restoreRecycleBinTable(engine, input, ctx, opts) {
     }
     return engine.executor.executeMutation(buildRestoreRecycleBinTableSql(input), ctx, {
         ...recycleBinMutationOptions(opts),
-        allowReadonlyFallbackForMutations: true,
     });
 }
 export async function getQueryStatus(engine, queryId) {
@@ -367,17 +360,18 @@ export async function handleConfirmation(engine, decision, ctx) {
     if (!decision.requiresConfirmation) {
         return { status: "confirmed" };
     }
-    const token = await engine.confirmationStore.issue({
+    const approval = await engine.confirmationStore.issue({
         sqlHash: decision.sqlHash,
         normalizedSql: decision.normalizedSql,
         context: ctx,
         riskLevel: decision.riskLevel,
     });
     return {
-        status: "token_issued",
-        token: token.token,
-        issuedAt: token.issuedAt,
-        expiresAt: token.expiresAt,
+        status: "approval_required",
+        request: approval.request,
+        requestId: approval.requestId,
+        issuedAt: approval.issuedAt,
+        expiresAt: approval.expiresAt,
     };
 }
 export async function close(engine) {

package/dist/engine/types.d.ts

@@ -31,8 +31,9 @@ export type IssueConfirmationInput = {
 export type ConfirmationOutcome = {
     status: "confirmed";
 } | {
-    status: "token_issued";
-    token: string;
+    status: "approval_required";
+    request: string;
+    requestId: string;
     issuedAt: number;
     expiresAt: number;
 };

package/dist/engine.d.ts

@@ -6,12 +6,12 @@ import { type Config } from "./config/index.js";
 import type { DatasourceResolveInput, DatasourceResolver, SessionContext } from "./context/session-context.js";
 import { type ConnectionPool } from "./executor/connection-pool.js";
 import { type CancelResult, type ExplainResult, type MutationOptions, type MutationResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
-import { type ConfirmationStore, type ConfirmationToken, type ConfirmationValidationResult } from "./safety/confirmation-store.js";
+import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationValidationResult } from "./safety/confirmation-store.js";
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
 import { type RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
-import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
+import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
 import type { ConfirmationOutcome, DataSourceInfo, EnhancedExplainResult, IssueConfirmationInput, ShowLockWaitsInput, ShowProcesslistInput, TaurusDBEngineCreateOptions, TaurusDBEngineDeps } from "./engine/types.js";
@@ -44,6 +44,7 @@ export declare class TaurusDBEngine {
     listFeatures(ctx: SessionContext): Promise<FeatureMatrix>;
     showProcesslist(input: ShowProcesslistInput, ctx: SessionContext): Promise<QueryResult>;
     showLockWaits(input: ShowLockWaitsInput, ctx: SessionContext): Promise<QueryResult>;
+    diagnoseReplicationLag(input: DiagnoseReplicationLagInput, ctx: SessionContext): Promise<DiagnosticResult>;
     findMetadataLockWaits(input: DiagnoseLockContentionInput, ctx: SessionContext): Promise<MetadataLockRow[]>;
     findLatestDeadlock(ctx: SessionContext): Promise<DeadlockSummary | undefined>;
     findStatementDigestSample(digestText: string, ctx: SessionContext): Promise<StatementDigestRow | undefined>;
@@ -70,7 +71,7 @@ export declare class TaurusDBEngine {
     restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     getQueryStatus(queryId: string): Promise<QueryStatus>;
     cancelQuery(queryId: string): Promise<CancelResult>;
-    issueConfirmation(input: IssueConfirmationInput): Promise<ConfirmationToken>;
+    issueConfirmation(input: IssueConfirmationInput): Promise<ConfirmationRequest>;
     validateConfirmation(token: string, sql: string, ctx: SessionContext): Promise<ConfirmationValidationResult>;
     handleConfirmation(decision: GuardrailDecision, ctx: SessionContext): Promise<ConfirmationOutcome>;
     close(): Promise<void>;

package/dist/engine.js

@@ -1,5 +1,8 @@
+import { lstat, readFile } from "node:fs/promises";
 import { createSqlProfileLoader, } from "./auth/sql-profile-loader.js";
 import { createSecretResolver, } from "./auth/secret-resolver.js";
+import { createHuaweiKmsSecretResolver } from "./cloud/kms.js";
+import { createHuaweiCsmsSecretResolver } from "./cloud/csms.js";
 import { createCapabilityProbe, } from "./capability/probe.js";
 import { getConfig } from "./config/index.js";
 import { createDatasourceResolver } from "./context/datasource-resolver.js";
@@ -10,11 +13,26 @@ import { createConfirmationStore, } from "./safety/confirmation-store.js";
 import { createGuardrail, } from "./safety/guardrail.js";
 import { createSchemaIntrospector, } from "./schema/introspector.js";
 import { createMySqlSchemaAdapter } from "./schema/adapters/mysql.js";
+import { diagnoseReplicationLag } from "./diagnostics/replication-lag.js";
 import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
 import { cancelQuery, close, executeMutation, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
+async function readMutationApprovalSecret(filePath) {
+    const info = await lstat(filePath);
+    if (!info.isFile() || info.isSymbolicLink()) {
+        throw new Error("Mutation approval secret must be a regular, non-symlink file.");
+    }
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0) {
+        throw new Error("Mutation approval secret file must not be accessible by group or other users.");
+    }
+    const secret = (await readFile(filePath, "utf8")).trim();
+    if (Buffer.byteLength(secret, "utf8") < 32) {
+        throw new Error("Mutation approval secret must contain at least 32 bytes.");
+    }
+    return secret;
+}
 function toDataSourceInfo(profile, defaultDatasource) {
     return {
         name: profile.name,
@@ -56,7 +74,14 @@ export class TaurusDBEngine {
     static async create(options = {}) {
         const config = options.config ?? getConfig();
         const profileLoader = options.profileLoader ?? createSqlProfileLoader({ config });
-        const secretResolver = options.secretResolver ?? createSecretResolver();
+        const secretResolver = options.secretResolver ??
+            createSecretResolver({
+                uriResolvers: {
+                    "hw-csms": createHuaweiCsmsSecretResolver({ config }),
+                    "hw-kms": createHuaweiKmsSecretResolver({ config }),
+                    "hw-kms-file": createHuaweiKmsSecretResolver({ config }),
+                },
+            });
         const datasourceResolver = options.datasourceResolver ??
             createDatasourceResolver({
                 config,
@@ -80,9 +105,23 @@ export class TaurusDBEngine {
         const executor = options.executor ??
             createSqlExecutor({
                 connectionPool,
+                maxConcurrentQueries: config.limits.maxConcurrentQueries,
+                maxQueuedQueries: config.limits.maxQueuedQueries,
+                queueTimeoutMs: config.limits.queueTimeoutMs,
             });
         const guardrail = options.guardrail ?? createGuardrail();
-        const confirmationStore = options.confirmationStore ?? createConfirmationStore();
+        let approvalSecret;
+        if (config.security.approvalSecretPath) {
+            approvalSecret = await readMutationApprovalSecret(config.security.approvalSecretPath);
+        }
+        if (config.security.mutationsEnabled && !approvalSecret && !options.confirmationStore) {
+            throw new Error("Mutations require TAURUSDB_MUTATION_APPROVAL_SECRET_FILE with at least 32 bytes.");
+        }
+        const confirmationStore = options.confirmationStore ??
+            createConfirmationStore({
+                approvalSecret,
+                ttlSeconds: config.security.approvalTtlSeconds,
+            });
         const capabilityProbe = options.capabilityProbe ??
             createCapabilityProbe({
                 connectionPool,
@@ -146,6 +185,9 @@ export class TaurusDBEngine {
     async showLockWaits(input, ctx) {
         return showLockWaits(this, input, ctx);
     }
+    async diagnoseReplicationLag(input, ctx) {
+        return diagnoseReplicationLag(this.executor, input, ctx);
+    }
     async findMetadataLockWaits(input, ctx) {
         return findMetadataLockWaits(this, input, ctx);
     }

package/dist/executor/bounded-sql.d.ts

@@ -0,0 +1 @@
+export declare function buildServerBoundedReadonlySql(sql: string, maxRows: number): string;

package/dist/executor/bounded-sql.js

@@ -0,0 +1,10 @@
+export function buildServerBoundedReadonlySql(sql, maxRows) {
+    const normalized = sql.trim().replace(/;\s*$/, "");
+    if (!/^(?:select|with)\b/i.test(normalized)) {
+        return normalized;
+    }
+    if (!Number.isInteger(maxRows) || maxRows <= 0) {
+        throw new Error("maxRows must be a positive integer.");
+    }
+    return `SELECT * FROM (${normalized}) AS __taurus_mcp_bounded LIMIT ${maxRows + 1}`;
+}

package/dist/executor/concurrency-limiter.d.ts

@@ -0,0 +1,15 @@
+export declare class QueryConcurrencyError extends Error {
+    readonly code = "SERVER_BUSY";
+    constructor(message: string);
+}
+export declare class QueryConcurrencyLimiter {
+    private readonly maxConcurrent;
+    private readonly maxQueued;
+    private readonly queueTimeoutMs;
+    private active;
+    private readonly queue;
+    constructor(maxConcurrent: number, maxQueued: number, queueTimeoutMs: number);
+    run<T>(operation: () => Promise<T>): Promise<T>;
+    private acquire;
+    private releaseFactory;
+}