taurusdb-core 0.4.0 → 0.5.0-rc.1

package/dist/executor/sql-executor.d.ts

@@ -11,6 +11,9 @@ export type SqlExecutorOptions = {
     historyLimit?: number;
     queryTracker?: QueryTracker;
     resultRedactor?: ResultRedactor;
+    maxConcurrentQueries?: number;
+    maxQueuedQueries?: number;
+    queueTimeoutMs?: number;
 };
 export declare class SqlExecutorImpl implements SqlExecutor {
     private readonly connectionPool;

package/dist/executor/sql-executor.js

@@ -3,6 +3,22 @@ import { buildExplainRecommendations, normalizeExplainRows, summarizeExplainRows
 import { createQueryTracker, } from "./query-tracker.js";
 import { createResultRedactor, } from "../safety/redaction.js";
 import { asFiniteNumber, inferColumns, normalizeRows } from "./result-normalizer.js";
+import { QueryConcurrencyLimiter } from "./concurrency-limiter.js";
+import { buildServerBoundedReadonlySql } from "./bounded-sql.js";
+function isTimeoutError(error) {
+    return /timeout|timed out/i.test(error instanceof Error ? error.message : String(error));
+}
+async function cancelTimedOutSession(session, error) {
+    if (!isTimeoutError(error)) {
+        return;
+    }
+    try {
+        await session.cancel();
+    }
+    catch {
+        // Keep the original timeout error.
+    }
+}
 export class SqlExecutorImpl {
     connectionPool;
     now;
@@ -25,7 +41,9 @@ export class SqlExecutorImpl {
     async explain(sql, ctx) {
         const queryId = this.queryIdGenerator();
         const startedAt = this.now();
-        const session = await this.connectionPool.acquire(ctx.datasource, "ro");
+        const session = await this.connectionPool.acquire(ctx.datasource, "ro", {
+            database: ctx.database,
+        });
         const active = this.beginQuery(queryId, session, ctx, "ro", startedAt);
         try {
             const result = await session.execute(`EXPLAIN ${sql}`, {
@@ -45,6 +63,7 @@ export class SqlExecutorImpl {
             };
         }
         catch (error) {
+            await cancelTimedOutSession(session, error);
             const durationMs = this.now() - startedAt;
             this.completeQuery(active.queryId, active.cancelRequested ? "cancelled" : "failed", durationMs, error);
             throw error;
@@ -59,11 +78,16 @@ export class SqlExecutorImpl {
         const maxRows = opts.maxRows ?? ctx.limits.maxRows;
         const maxColumns = opts.maxColumns ?? ctx.limits.maxColumns;
         const maxFieldChars = opts.maxFieldChars ?? ctx.limits.maxFieldChars ?? 2048;
+        const maxResultBytes = opts.maxResultBytes ?? ctx.limits.maxResultBytes ?? 1048576;
+        const maxBlobBytes = opts.maxBlobBytes ?? ctx.limits.maxBlobBytes ?? 65536;
         const timeoutMs = opts.timeoutMs ?? ctx.limits.timeoutMs;
-        const session = await this.connectionPool.acquire(ctx.datasource, "ro");
+        const session = await this.connectionPool.acquire(ctx.datasource, "ro", {
+            database: ctx.database,
+        });
         const active = this.beginQuery(queryId, session, ctx, "ro", startedAt);
         try {
-            const result = await session.execute(sql, { timeoutMs });
+            const executionSql = buildServerBoundedReadonlySql(sql, maxRows);
+            const result = await session.execute(executionSql, { timeoutMs });
             const sourceRows = Array.isArray(result.rows) ? result.rows : [];
             const columns = inferColumns(result, sourceRows);
             const normalizedRows = normalizeRows(sourceRows, columns);
@@ -76,6 +100,9 @@ export class SqlExecutorImpl {
                 maxRows,
                 maxColumns,
                 maxFieldChars,
+                maxResultBytes,
+                maxBlobBytes,
+                maskAllColumns: opts.maskAllColumns,
                 sensitiveColumns: opts.sensitiveColumns,
                 sensitiveStrategy: opts.sensitiveStrategy,
             });
@@ -91,6 +118,8 @@ export class SqlExecutorImpl {
                 rowTruncated: redacted.rowTruncated,
                 columnTruncated: redacted.columnTruncated,
                 fieldTruncated: redacted.fieldTruncated,
+                byteTruncated: redacted.byteTruncated,
+                returnedBytes: redacted.returnedBytes,
                 redactedColumns: redacted.redactedColumns,
                 droppedColumns: redacted.droppedColumns,
                 truncatedColumns: redacted.truncatedColumns,
@@ -98,6 +127,7 @@ export class SqlExecutorImpl {
             };
         }
         catch (error) {
+            await cancelTimedOutSession(session, error);
             const durationMs = this.now() - startedAt;
             this.completeQuery(active.queryId, active.cancelRequested ? "cancelled" : "failed", durationMs, error);
             throw error;
@@ -114,7 +144,7 @@ export class SqlExecutorImpl {
         const startedAt = this.now();
         const timeoutMs = opts.timeoutMs ?? ctx.limits.timeoutMs;
         const session = await this.connectionPool.acquire(ctx.datasource, "rw", {
-            allowReadonlyFallbackForMutations: opts.allowReadonlyFallbackForMutations,
+            database: ctx.database,
         });
         const active = this.beginQuery(queryId, session, ctx, "rw", startedAt);
         try {
@@ -133,11 +163,16 @@ export class SqlExecutorImpl {
             };
         }
         catch (error) {
-            try {
-                await session.execute("ROLLBACK", { timeoutMs });
+            if (isTimeoutError(error)) {
+                await cancelTimedOutSession(session, error);
             }
-            catch {
-                // Ignore rollback failure and keep original error.
+            else {
+                try {
+                    await session.execute("ROLLBACK", { timeoutMs });
+                }
+                catch {
+                    // Ignore rollback failure and keep original error.
+                }
             }
             const durationMs = this.now() - startedAt;
             this.completeQuery(active.queryId, active.cancelRequested ? "cancelled" : "failed", durationMs, error);
@@ -245,5 +280,13 @@ export class SqlExecutorImpl {
     }
 }
 export function createSqlExecutor(options) {
-    return new SqlExecutorImpl(options);
+    const executor = new SqlExecutorImpl(options);
+    const limiter = new QueryConcurrencyLimiter(options.maxConcurrentQueries ?? 8, options.maxQueuedQueries ?? 32, options.queueTimeoutMs ?? 5000);
+    return {
+        explain: (sql, ctx) => limiter.run(() => executor.explain(sql, ctx)),
+        executeReadonly: (sql, ctx, opts) => limiter.run(() => executor.executeReadonly(sql, ctx, opts)),
+        executeMutation: (sql, ctx, opts) => limiter.run(() => executor.executeMutation(sql, ctx, opts)),
+        getQueryStatus: (queryId) => executor.getQueryStatus(queryId),
+        cancelQuery: (queryId) => executor.cancelQuery(queryId),
+    };
 }

package/dist/executor/types.d.ts

@@ -9,13 +9,15 @@ export interface ReadonlyOptions {
     maxRows?: number;
     maxColumns?: number;
     maxFieldChars?: number;
+    maxResultBytes?: number;
+    maxBlobBytes?: number;
+    maskAllColumns?: boolean;
     timeoutMs?: number;
     sensitiveColumns?: Iterable<string>;
     sensitiveStrategy?: SensitiveStrategy;
 }
 export interface MutationOptions {
     timeoutMs?: number;
-    allowReadonlyFallbackForMutations?: boolean;
 }
 export interface QueryResult {
     queryId: string;
@@ -27,6 +29,8 @@ export interface QueryResult {
     rowTruncated: boolean;
     columnTruncated: boolean;
     fieldTruncated: boolean;
+    byteTruncated: boolean;
+    returnedBytes: number;
     redactedColumns: string[];
     droppedColumns: string[];
     truncatedColumns: string[];

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { TaurusDBEngine } from "./engine.js";
 export type { EnhancedExplainResult, ConfirmationOutcome, DataSourceInfo, IssueConfirmationInput, TaurusDBEngineCreateOptions, TaurusDBEngineDeps, } from "./engine.js";
+export { createJsonlAuditWriter, JsonlAuditWriter, type AuditDecision, type AuditEvent, type AuditWriter, type JsonlAuditWriterOptions, } from "./audit/jsonl-writer.js";
 export { createConfigFromEnv, getConfig, redactConfigForLog, resetConfigForTests, } from "./config/index.js";
 export type { Config } from "./config/index.js";
 export { createSqlProfileLoader, RuntimeOverrideProfileLoader, } from "./auth/sql-profile-loader.js";
@@ -7,13 +8,15 @@ export type { DataSourceProfile, DatabaseEngine, ProfileLoader, RuntimeDataSourc
 export { DatasourceResolutionError } from "./context/datasource-resolver.js";
 export type { DatasourceResolveInput, DatasourceResolver, RuntimeLimits, SessionContext, } from "./context/session-context.js";
 export { ConnectionPoolError } from "./executor/connection-pool.js";
+export { QueryConcurrencyError } from "./executor/concurrency-limiter.js";
+export { buildServerBoundedReadonlySql } from "./executor/bounded-sql.js";
 export type { CancelResult, ExplainResult, MutationOptions, MutationResult, QueryResult, QueryStatus, ReadonlyOptions, SqlExecutor, } from "./executor/sql-executor.js";
 export { createCapabilityProbe } from "./capability/probe.js";
 export type { CapabilityProbe } from "./capability/probe.js";
 export { UnsupportedFeatureError } from "./capability/types.js";
 export type { CapabilitySnapshot, FeatureMatrix, FeatureStatus, KernelInfo, TaurusFeatureName, } from "./capability/types.js";
-export { createConfirmationStore, InMemoryConfirmationStore, } from "./safety/confirmation-store.js";
-export type { ConfirmationStore, ConfirmationToken, ConfirmationValidationResult, IssueInput, } from "./safety/confirmation-store.js";
+export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
+export type { ConfirmationStore, ConfirmationRequest, ConfirmationValidationResult, IssueInput, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
 export type { Guardrail, GuardrailDecision, GuardrailRuntimeLimits, InspectInput, } from "./safety/guardrail.js";
 export type { ExplainRiskSummary, RiskLevel, ValidationResult } from "./safety/sql-validator.js";
@@ -41,6 +44,6 @@ export type { RecycleBinListResult, RecycleBinRestoreResult, RestoreRecycleBinTa
 export { createPlaceholderDiagnosticResult } from "./diagnostics/types.js";
 export { buildResolveSlowSqlInput, createSlowSqlSource, TaurusApiSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 export { CesMetricsSource, createMetricsSource, } from "./diagnostics/metrics-source.js";
-export type { DbHotspotItem, DbHotspotResult, DiagnosticBaseInput, DiagnosticConfidence, DiagnosticEvidenceItem, DiagnosticEvidenceLevel, DiagnosticNextToolInput, DiagnoseDbHotspotInput, DiagnoseServiceLatencyInput, FindTopSlowSqlInput, FindTopSlowSqlResult, DiagnosticResult, DiagnosticRootCauseCandidate, DiagnosticSeverity, DiagnosticStatus, ServiceLatencyCandidate, ServiceLatencyResult, ServiceLatencySuspectedCategory, DiagnosticSuspiciousEntities, DiagnosticToolName, DiagnosisWindow, DiagnoseConnectionSpikeInput, DiagnoseLockContentionInput, DiagnoseSlowQueryInput, DiagnoseStoragePressureInput, PlaceholderDiagnosticOptions, TopSlowSqlItem, } from "./diagnostics/types.js";
+export type { DbHotspotItem, DbHotspotResult, DiagnosticBaseInput, DiagnosticConfidence, DiagnosticEvidenceItem, DiagnosticEvidenceLevel, DiagnosticNextToolInput, DiagnoseDbHotspotInput, DiagnoseServiceLatencyInput, FindTopSlowSqlInput, FindTopSlowSqlResult, DiagnosticResult, DiagnosticRootCauseCandidate, DiagnosticSeverity, DiagnosticStatus, ServiceLatencyCandidate, ServiceLatencyResult, ServiceLatencySuspectedCategory, DiagnosticSuspiciousEntities, DiagnosticToolName, DiagnosisWindow, DiagnoseConnectionSpikeInput, DiagnoseLockContentionInput, DiagnoseReplicationLagInput, DiagnoseSlowQueryInput, DiagnoseStoragePressureInput, PlaceholderDiagnosticOptions, TopSlowSqlItem, } from "./diagnostics/types.js";
 export type { ExternalSlowSqlSample, ResolveSlowSqlInput, SlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 export type { MetricAlias, MetricPoint, MetricSummary, MetricsSource, QueryMetricsInput, } from "./diagnostics/metrics-source.js";

package/dist/index.js

@@ -1,11 +1,14 @@
 export { TaurusDBEngine } from "./engine.js";
+export { createJsonlAuditWriter, JsonlAuditWriter, } from "./audit/jsonl-writer.js";
 export { createConfigFromEnv, getConfig, redactConfigForLog, resetConfigForTests, } from "./config/index.js";
 export { createSqlProfileLoader, RuntimeOverrideProfileLoader, } from "./auth/sql-profile-loader.js";
 export { DatasourceResolutionError } from "./context/datasource-resolver.js";
 export { ConnectionPoolError } from "./executor/connection-pool.js";
+export { QueryConcurrencyError } from "./executor/concurrency-limiter.js";
+export { buildServerBoundedReadonlySql } from "./executor/bounded-sql.js";
 export { createCapabilityProbe } from "./capability/probe.js";
 export { UnsupportedFeatureError } from "./capability/types.js";
-export { createConfirmationStore, InMemoryConfirmationStore, } from "./safety/confirmation-store.js";
+export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";
 export { ErrorCode, formatBlocked, formatConfirmationRequired, formatError, formatSuccess, } from "./utils/formatter.js";

package/dist/safety/confirmation-store.d.ts

@@ -1,5 +1,20 @@
 import type { SessionContext } from "../context/session-context.js";
 import type { RiskLevel, ValidationResult } from "./sql-validator.js";
+export type ApprovalRequestPayload = {
+    version: 1;
+    requestId: string;
+    sqlHash: string;
+    datasource: string;
+    database?: string;
+    host?: string;
+    port?: number;
+    projectId?: string;
+    instanceId?: string;
+    nodeId?: string;
+    riskLevel: RiskLevel;
+    issuedAt: number;
+    expiresAt: number;
+};
 export type IssueInput = {
     sqlHash: string;
     normalizedSql: string;
@@ -7,38 +22,46 @@ export type IssueInput = {
     riskLevel: RiskLevel;
     ttlSeconds?: number;
 };
-export type ConfirmationToken = {
-    token: string;
+export type ConfirmationRequest = {
+    request: string;
+    requestId: string;
     issuedAt: number;
     expiresAt: number;
 };
 export type ConfirmationValidationResult = ValidationResult & {
     valid: boolean;
+    actor?: string;
     reason?: string;
 };
 export interface ConfirmationStore {
-    issue(input: IssueInput): Promise<ConfirmationToken>;
+    issue(input: IssueInput): Promise<ConfirmationRequest>;
     validate(token: string, currentSql: string, ctx: SessionContext): Promise<ConfirmationValidationResult>;
-    revoke(token: string): Promise<void>;
+    revoke(requestId: string): Promise<void>;
 }
 export type ConfirmationStoreOptions = {
+    approvalSecret?: string | Buffer;
     ttlSeconds?: number;
     cleanupIntervalMs?: number;
+    maxEntries?: number;
     now?: () => number;
     randomBytesFn?: (size: number) => Buffer;
 };
+export declare function parseApprovalRequest(request: string): ApprovalRequestPayload;
+export declare function signApprovalRequest(request: string, actor: string, secret: string | Buffer): string;
 export declare class InMemoryConfirmationStore implements ConfirmationStore {
     private readonly entries;
     private readonly now;
     private readonly ttlSeconds;
+    private readonly maxEntries;
     private readonly randomBytesFn;
+    private readonly approvalSecret?;
     private cleanupTimer?;
     constructor(options?: ConfirmationStoreOptions);
-    issue(input: IssueInput): Promise<ConfirmationToken>;
+    issue(input: IssueInput): Promise<ConfirmationRequest>;
     validate(token: string, currentSql: string, ctx: SessionContext): Promise<ConfirmationValidationResult>;
-    revoke(token: string): Promise<void>;
+    revoke(requestId: string): Promise<void>;
     stop(): void;
     cleanupExpired(now?: number): void;
-    private generateUniqueToken;
+    private generateUniqueRequestId;
 }
 export declare function createConfirmationStore(options?: ConfirmationStoreOptions): ConfirmationStore;

package/dist/safety/confirmation-store.js

@@ -1,11 +1,14 @@
-import { randomBytes } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
 import { normalizeSql, sqlHash } from "../utils/hash.js";
 const DEFAULT_TTL_SECONDS = 300;
 const DEFAULT_CLEANUP_INTERVAL_MS = 60_000;
+const DEFAULT_MAX_ENTRIES = 1_000;
+const REQUEST_PREFIX = "creq_";
 const TOKEN_PREFIX = "ctok_";
-function allowResult() {
+function allowResult(actor) {
     return {
         valid: true,
+        actor,
         action: "allow",
         riskLevel: "low",
         reasonCodes: [],
@@ -36,16 +39,90 @@ function parseTtlSeconds(ttlSeconds, fallback) {
     }
     return resolved;
 }
+function parseMaxEntries(value) {
+    const resolved = value ?? DEFAULT_MAX_ENTRIES;
+    if (!Number.isInteger(resolved) || resolved <= 0) {
+        throw new Error("maxEntries must be a positive integer.");
+    }
+    return resolved;
+}
+function encodePayload(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function decodeJson(encoded) {
+    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+}
+function normalizeSecret(secret) {
+    if (secret === undefined) {
+        return undefined;
+    }
+    const normalized = Buffer.isBuffer(secret) ? Buffer.from(secret) : Buffer.from(secret, "utf8");
+    if (normalized.length < 32) {
+        throw new Error("Mutation approval secret must contain at least 32 bytes.");
+    }
+    return normalized;
+}
+function signEncodedPayload(encodedPayload, secret) {
+    return createHmac("sha256", secret).update(encodedPayload, "utf8").digest();
+}
+export function parseApprovalRequest(request) {
+    if (!request.startsWith(REQUEST_PREFIX)) {
+        throw new Error("Invalid approval request prefix.");
+    }
+    const payload = decodeJson(request.slice(REQUEST_PREFIX.length));
+    if (payload.version !== 1 ||
+        typeof payload.requestId !== "string" ||
+        typeof payload.sqlHash !== "string" ||
+        typeof payload.datasource !== "string" ||
+        typeof payload.issuedAt !== "number" ||
+        typeof payload.expiresAt !== "number") {
+        throw new Error("Invalid approval request payload.");
+    }
+    return payload;
+}
+export function signApprovalRequest(request, actor, secret) {
+    const normalizedActor = actor.trim();
+    if (!normalizedActor) {
+        throw new Error("Approval actor is required.");
+    }
+    const requestPayload = parseApprovalRequest(request);
+    const payload = {
+        ...requestPayload,
+        actor: normalizedActor,
+    };
+    const encodedPayload = encodePayload(payload);
+    const signature = signEncodedPayload(encodedPayload, normalizeSecret(secret));
+    return `${TOKEN_PREFIX}${encodedPayload}.${signature.toString("base64url")}`;
+}
+function equalRequestPayload(pending, signed) {
+    return (pending.version === signed.version &&
+        pending.requestId === signed.requestId &&
+        pending.sqlHash === signed.sqlHash &&
+        pending.datasource === signed.datasource &&
+        pending.database === signed.database &&
+        pending.host === signed.host &&
+        pending.port === signed.port &&
+        pending.projectId === signed.projectId &&
+        pending.instanceId === signed.instanceId &&
+        pending.nodeId === signed.nodeId &&
+        pending.riskLevel === signed.riskLevel &&
+        pending.issuedAt === signed.issuedAt &&
+        pending.expiresAt === signed.expiresAt);
+}
 export class InMemoryConfirmationStore {
     entries = new Map();
     now;
     ttlSeconds;
+    maxEntries;
     randomBytesFn;
+    approvalSecret;
     cleanupTimer;
     constructor(options = {}) {
         this.now = options.now ?? Date.now;
         this.ttlSeconds = parseTtlSeconds(options.ttlSeconds, DEFAULT_TTL_SECONDS);
+        this.maxEntries = parseMaxEntries(options.maxEntries);
         this.randomBytesFn = options.randomBytesFn ?? randomBytes;
+        this.approvalSecret = normalizeSecret(options.approvalSecret);
         const cleanupIntervalMs = options.cleanupIntervalMs ?? DEFAULT_CLEANUP_INTERVAL_MS;
         if (cleanupIntervalMs > 0) {
             this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
@@ -54,53 +131,100 @@ export class InMemoryConfirmationStore {
     }
     async issue(input) {
         this.cleanupExpired();
+        if (this.entries.size >= this.maxEntries) {
+            throw new Error("Too many pending mutation approval requests.");
+        }
         const ttlSeconds = parseTtlSeconds(input.ttlSeconds, this.ttlSeconds);
         const issuedAt = this.now();
         const expiresAt = issuedAt + ttlSeconds * 1000;
-        const token = this.generateUniqueToken();
-        this.entries.set(token, {
-            token,
+        const requestId = this.generateUniqueRequestId();
+        const payload = {
+            version: 1,
+            requestId,
             sqlHash: input.sqlHash,
-            normalizedSql: input.normalizedSql,
             datasource: input.context.datasource,
             database: normalizeDatabase(input.context.database),
+            host: input.context.host,
+            port: input.context.port,
+            projectId: input.context.projectId,
+            instanceId: input.context.instanceId,
+            nodeId: input.context.nodeId,
             riskLevel: input.riskLevel,
             issuedAt,
             expiresAt,
-        });
+        };
+        this.entries.set(requestId, { payload });
         return {
-            token,
+            request: `${REQUEST_PREFIX}${encodePayload(payload)}`,
+            requestId,
             issuedAt,
             expiresAt,
         };
     }
     async validate(token, currentSql, ctx) {
-        const entry = this.entries.get(token);
+        if (!this.approvalSecret) {
+            return blockResult("CF006", "External mutation approval is not configured.");
+        }
+        if (!token.startsWith(TOKEN_PREFIX)) {
+            return blockResult("CF001", "Invalid approval token prefix.");
+        }
+        const [encodedPayload, encodedSignature, ...extra] = token
+            .slice(TOKEN_PREFIX.length)
+            .split(".");
+        if (!encodedPayload || !encodedSignature || extra.length > 0) {
+            return blockResult("CF001", "Invalid approval token format.");
+        }
+        let payload;
+        let signature;
+        try {
+            payload = decodeJson(encodedPayload);
+            signature = Buffer.from(encodedSignature, "base64url");
+        }
+        catch {
+            return blockResult("CF001", "Invalid approval token encoding.");
+        }
+        const expectedSignature = signEncodedPayload(encodedPayload, this.approvalSecret);
+        if (signature.length !== expectedSignature.length ||
+            !timingSafeEqual(signature, expectedSignature)) {
+            return blockResult("CF007", "Approval token signature is invalid.");
+        }
+        if (typeof payload.actor !== "string" || !payload.actor.trim()) {
+            return blockResult("CF008", "Approval token does not identify an actor.");
+        }
+        const entry = this.entries.get(payload.requestId);
         if (!entry) {
-            return blockResult("CF001", "Confirmation token not found.");
+            return blockResult("CF001", "Approval request not found.");
         }
         const now = this.now();
-        if (entry.expiresAt <= now) {
-            this.entries.delete(token);
-            return blockResult("CF002", "Confirmation token has expired.");
+        if (entry.payload.expiresAt <= now || payload.expiresAt <= now) {
+            this.entries.delete(payload.requestId);
+            return blockResult("CF002", "Approval request has expired.");
         }
         if (entry.usedAt !== undefined) {
-            return blockResult("CF005", "Confirmation token has already been used.");
+            return blockResult("CF005", "Approval token has already been used.");
+        }
+        if (!equalRequestPayload(entry.payload, payload)) {
+            return blockResult("CF009", "Approval token payload does not match the pending request.");
         }
         const normalizedCurrentSql = normalizeSql(currentSql);
-        const currentSqlHash = sqlHash(normalizedCurrentSql);
-        if (currentSqlHash !== entry.sqlHash) {
-            return blockResult("CF003", "SQL hash mismatch for confirmation token.");
+        if (sqlHash(normalizedCurrentSql) !== payload.sqlHash) {
+            return blockResult("CF003", "SQL hash mismatch for approval token.");
         }
         const currentDatabase = normalizeDatabase(ctx.database);
-        if (ctx.datasource !== entry.datasource || currentDatabase !== entry.database) {
-            return blockResult("CF004", "Datasource or database mismatch for confirmation token.");
+        if (ctx.datasource !== payload.datasource ||
+            currentDatabase !== payload.database ||
+            ctx.host !== payload.host ||
+            ctx.port !== payload.port ||
+            ctx.projectId !== payload.projectId ||
+            ctx.instanceId !== payload.instanceId ||
+            ctx.nodeId !== payload.nodeId) {
+            return blockResult("CF004", "Datasource, database, or target mismatch for approval token.");
         }
         entry.usedAt = now;
-        return allowResult();
+        return allowResult(payload.actor.trim());
     }
-    async revoke(token) {
-        this.entries.delete(token);
+    async revoke(requestId) {
+        this.entries.delete(requestId);
     }
     stop() {
         if (this.cleanupTimer) {
@@ -109,20 +233,20 @@ export class InMemoryConfirmationStore {
         }
     }
     cleanupExpired(now = this.now()) {
-        for (const [token, entry] of this.entries.entries()) {
-            if (entry.expiresAt <= now) {
-                this.entries.delete(token);
+        for (const [requestId, entry] of this.entries.entries()) {
+            if (entry.payload.expiresAt <= now) {
+                this.entries.delete(requestId);
             }
         }
     }
-    generateUniqueToken() {
+    generateUniqueRequestId() {
         for (let i = 0; i < 5; i += 1) {
-            const token = `${TOKEN_PREFIX}${this.randomBytesFn(32).toString("base64url")}`;
-            if (!this.entries.has(token)) {
-                return token;
+            const requestId = this.randomBytesFn(24).toString("base64url");
+            if (!this.entries.has(requestId)) {
+                return requestId;
             }
         }
-        throw new Error("Unable to generate unique confirmation token.");
+        throw new Error("Unable to generate unique approval request id.");
     }
 }
 export function createConfirmationStore(options = {}) {

package/dist/safety/guardrail.d.ts

@@ -8,6 +8,9 @@ export interface GuardrailRuntimeLimits {
     maxRows: number;
     maxColumns: number;
     maxFieldChars: number;
+    maxResultBytes: number;
+    maxBlobBytes: number;
+    maskAllColumns: boolean;
 }
 export interface GuardrailDecision {
     action: "allow" | "confirm" | "block";

package/dist/safety/guardrail.js

@@ -1,6 +1,7 @@
 import { createSqlParser } from "./parser/index.js";
 import { classifySql } from "./sql-classifier.js";
-import { validateStaticRules, validateToolScope, } from "./sql-validator.js";
+import { hasSensitiveColumnReference } from "./redaction.js";
+import { validateStaticRules, validateDatabaseScope, validateToolScope, } from "./sql-validator.js";
 function dedupeCaseInsensitive(values) {
     const output = [];
     const seen = new Set();
@@ -54,10 +55,13 @@ function buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, rea
             maxRows: input.context.limits.maxRows,
             maxColumns: input.context.limits.maxColumns,
             maxFieldChars: input.context.limits.maxFieldChars ?? 2048,
+            maxResultBytes: input.context.limits.maxResultBytes ?? 1048576,
+            maxBlobBytes: input.context.limits.maxBlobBytes ?? 65536,
+            maskAllColumns: false,
         },
     };
 }
-function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExplain) {
+function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExplain, maskAllColumns = false) {
     let action = "allow";
     let riskLevel = "low";
     const reasonCodes = [];
@@ -68,7 +72,9 @@ function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExpla
         reasonCodes.push(...validation.reasonCodes);
         riskHints.push(...validation.riskHints);
     }
-    return buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, reasonCodes, riskHints, requiresExplain);
+    const decision = buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, reasonCodes, riskHints, requiresExplain);
+    decision.runtimeLimits.maskAllColumns = maskAllColumns;
+    return decision;
 }
 export class GuardrailImpl {
     parserFactory;
@@ -85,13 +91,17 @@ export class GuardrailImpl {
         const cls = classifySql(parseResult.ast, normalized, input.context.engine);
         const d1 = validateToolScope(input.toolName, cls);
         if (d1.action === "block") {
-            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1], false);
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1], false, hasSensitiveColumnReference(cls.referencedColumns));
+        }
+        const databaseScope = validateDatabaseScope(cls, input.context.database);
+        if (databaseScope.action === "block") {
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope], false, hasSensitiveColumnReference(cls.referencedColumns));
         }
         const d2 = validateStaticRules(cls);
         if (d2.action === "block") {
-            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, d2], false);
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope, d2], false, hasSensitiveColumnReference(cls.referencedColumns));
         }
-        return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, d2], false);
+        return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope, d2], false, hasSensitiveColumnReference(cls.referencedColumns));
     }
 }
 export function createGuardrail(options = {}) {

package/dist/safety/redaction.d.ts

@@ -12,6 +12,9 @@ export interface RedactionPolicy {
     maxRows: number;
     maxColumns: number;
     maxFieldChars: number;
+    maxResultBytes?: number;
+    maxBlobBytes?: number;
+    maskAllColumns?: boolean;
     sensitiveColumns?: Iterable<string>;
     sensitiveStrategy?: SensitiveStrategy;
 }
@@ -24,6 +27,8 @@ export interface RedactedQueryResult {
     rowTruncated: boolean;
     columnTruncated: boolean;
     fieldTruncated: boolean;
+    byteTruncated: boolean;
+    returnedBytes: number;
     redactedColumns: string[];
     droppedColumns: string[];
     truncatedColumns: string[];
@@ -31,4 +36,5 @@ export interface RedactedQueryResult {
 export interface ResultRedactor {
     redact(raw: RawQueryResult, policy: RedactionPolicy): RedactedQueryResult;
 }
+export declare function hasSensitiveColumnReference(columns: Iterable<string>): boolean;
 export declare function createResultRedactor(): ResultRedactor;