taurusdb-core 0.4.0 → 0.5.0-rc.10

package/dist/safety/confirmation-store.js

@@ -1,11 +1,14 @@
-import { randomBytes } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
 import { normalizeSql, sqlHash } from "../utils/hash.js";
 const DEFAULT_TTL_SECONDS = 300;
 const DEFAULT_CLEANUP_INTERVAL_MS = 60_000;
+const DEFAULT_MAX_ENTRIES = 1_000;
+const REQUEST_PREFIX = "creq_";
 const TOKEN_PREFIX = "ctok_";
-function allowResult() {
+function allowResult(actor) {
     return {
         valid: true,
+        actor,
         action: "allow",
         riskLevel: "low",
         reasonCodes: [],
@@ -36,16 +39,90 @@ function parseTtlSeconds(ttlSeconds, fallback) {
     }
     return resolved;
 }
+function parseMaxEntries(value) {
+    const resolved = value ?? DEFAULT_MAX_ENTRIES;
+    if (!Number.isInteger(resolved) || resolved <= 0) {
+        throw new Error("maxEntries must be a positive integer.");
+    }
+    return resolved;
+}
+function encodePayload(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function decodeJson(encoded) {
+    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+}
+function normalizeSecret(secret) {
+    if (secret === undefined) {
+        return undefined;
+    }
+    const normalized = Buffer.isBuffer(secret) ? Buffer.from(secret) : Buffer.from(secret, "utf8");
+    if (normalized.length < 32) {
+        throw new Error("Mutation approval secret must contain at least 32 bytes.");
+    }
+    return normalized;
+}
+function signEncodedPayload(encodedPayload, secret) {
+    return createHmac("sha256", secret).update(encodedPayload, "utf8").digest();
+}
+export function parseApprovalRequest(request) {
+    if (!request.startsWith(REQUEST_PREFIX)) {
+        throw new Error("Invalid approval request prefix.");
+    }
+    const payload = decodeJson(request.slice(REQUEST_PREFIX.length));
+    if (payload.version !== 1 ||
+        typeof payload.requestId !== "string" ||
+        typeof payload.sqlHash !== "string" ||
+        typeof payload.datasource !== "string" ||
+        typeof payload.issuedAt !== "number" ||
+        typeof payload.expiresAt !== "number") {
+        throw new Error("Invalid approval request payload.");
+    }
+    return payload;
+}
+export function signApprovalRequest(request, actor, secret) {
+    const normalizedActor = actor.trim();
+    if (!normalizedActor) {
+        throw new Error("Approval actor is required.");
+    }
+    const requestPayload = parseApprovalRequest(request);
+    const payload = {
+        ...requestPayload,
+        actor: normalizedActor,
+    };
+    const encodedPayload = encodePayload(payload);
+    const signature = signEncodedPayload(encodedPayload, normalizeSecret(secret));
+    return `${TOKEN_PREFIX}${encodedPayload}.${signature.toString("base64url")}`;
+}
+function equalRequestPayload(pending, signed) {
+    return (pending.version === signed.version &&
+        pending.requestId === signed.requestId &&
+        pending.sqlHash === signed.sqlHash &&
+        pending.datasource === signed.datasource &&
+        pending.database === signed.database &&
+        pending.host === signed.host &&
+        pending.port === signed.port &&
+        pending.projectId === signed.projectId &&
+        pending.instanceId === signed.instanceId &&
+        pending.nodeId === signed.nodeId &&
+        pending.riskLevel === signed.riskLevel &&
+        pending.issuedAt === signed.issuedAt &&
+        pending.expiresAt === signed.expiresAt);
+}
 export class InMemoryConfirmationStore {
     entries = new Map();
     now;
     ttlSeconds;
+    maxEntries;
     randomBytesFn;
+    approvalSecret;
     cleanupTimer;
     constructor(options = {}) {
         this.now = options.now ?? Date.now;
         this.ttlSeconds = parseTtlSeconds(options.ttlSeconds, DEFAULT_TTL_SECONDS);
+        this.maxEntries = parseMaxEntries(options.maxEntries);
         this.randomBytesFn = options.randomBytesFn ?? randomBytes;
+        this.approvalSecret = normalizeSecret(options.approvalSecret);
         const cleanupIntervalMs = options.cleanupIntervalMs ?? DEFAULT_CLEANUP_INTERVAL_MS;
         if (cleanupIntervalMs > 0) {
             this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
@@ -54,53 +131,100 @@ export class InMemoryConfirmationStore {
     }
     async issue(input) {
         this.cleanupExpired();
+        if (this.entries.size >= this.maxEntries) {
+            throw new Error("Too many pending mutation approval requests.");
+        }
         const ttlSeconds = parseTtlSeconds(input.ttlSeconds, this.ttlSeconds);
         const issuedAt = this.now();
         const expiresAt = issuedAt + ttlSeconds * 1000;
-        const token = this.generateUniqueToken();
-        this.entries.set(token, {
-            token,
+        const requestId = this.generateUniqueRequestId();
+        const payload = {
+            version: 1,
+            requestId,
             sqlHash: input.sqlHash,
-            normalizedSql: input.normalizedSql,
             datasource: input.context.datasource,
             database: normalizeDatabase(input.context.database),
+            host: input.context.host,
+            port: input.context.port,
+            projectId: input.context.projectId,
+            instanceId: input.context.instanceId,
+            nodeId: input.context.nodeId,
             riskLevel: input.riskLevel,
             issuedAt,
             expiresAt,
-        });
+        };
+        this.entries.set(requestId, { payload });
         return {
-            token,
+            request: `${REQUEST_PREFIX}${encodePayload(payload)}`,
+            requestId,
             issuedAt,
             expiresAt,
         };
     }
     async validate(token, currentSql, ctx) {
-        const entry = this.entries.get(token);
+        if (!this.approvalSecret) {
+            return blockResult("CF006", "External mutation approval is not configured.");
+        }
+        if (!token.startsWith(TOKEN_PREFIX)) {
+            return blockResult("CF001", "Invalid approval token prefix.");
+        }
+        const [encodedPayload, encodedSignature, ...extra] = token
+            .slice(TOKEN_PREFIX.length)
+            .split(".");
+        if (!encodedPayload || !encodedSignature || extra.length > 0) {
+            return blockResult("CF001", "Invalid approval token format.");
+        }
+        let payload;
+        let signature;
+        try {
+            payload = decodeJson(encodedPayload);
+            signature = Buffer.from(encodedSignature, "base64url");
+        }
+        catch {
+            return blockResult("CF001", "Invalid approval token encoding.");
+        }
+        const expectedSignature = signEncodedPayload(encodedPayload, this.approvalSecret);
+        if (signature.length !== expectedSignature.length ||
+            !timingSafeEqual(signature, expectedSignature)) {
+            return blockResult("CF007", "Approval token signature is invalid.");
+        }
+        if (typeof payload.actor !== "string" || !payload.actor.trim()) {
+            return blockResult("CF008", "Approval token does not identify an actor.");
+        }
+        const entry = this.entries.get(payload.requestId);
         if (!entry) {
-            return blockResult("CF001", "Confirmation token not found.");
+            return blockResult("CF001", "Approval request not found.");
         }
         const now = this.now();
-        if (entry.expiresAt <= now) {
-            this.entries.delete(token);
-            return blockResult("CF002", "Confirmation token has expired.");
+        if (entry.payload.expiresAt <= now || payload.expiresAt <= now) {
+            this.entries.delete(payload.requestId);
+            return blockResult("CF002", "Approval request has expired.");
         }
         if (entry.usedAt !== undefined) {
-            return blockResult("CF005", "Confirmation token has already been used.");
+            return blockResult("CF005", "Approval token has already been used.");
+        }
+        if (!equalRequestPayload(entry.payload, payload)) {
+            return blockResult("CF009", "Approval token payload does not match the pending request.");
         }
         const normalizedCurrentSql = normalizeSql(currentSql);
-        const currentSqlHash = sqlHash(normalizedCurrentSql);
-        if (currentSqlHash !== entry.sqlHash) {
-            return blockResult("CF003", "SQL hash mismatch for confirmation token.");
+        if (sqlHash(normalizedCurrentSql) !== payload.sqlHash) {
+            return blockResult("CF003", "SQL hash mismatch for approval token.");
         }
         const currentDatabase = normalizeDatabase(ctx.database);
-        if (ctx.datasource !== entry.datasource || currentDatabase !== entry.database) {
-            return blockResult("CF004", "Datasource or database mismatch for confirmation token.");
+        if (ctx.datasource !== payload.datasource ||
+            currentDatabase !== payload.database ||
+            ctx.host !== payload.host ||
+            ctx.port !== payload.port ||
+            ctx.projectId !== payload.projectId ||
+            ctx.instanceId !== payload.instanceId ||
+            ctx.nodeId !== payload.nodeId) {
+            return blockResult("CF004", "Datasource, database, or target mismatch for approval token.");
         }
         entry.usedAt = now;
-        return allowResult();
+        return allowResult(payload.actor.trim());
     }
-    async revoke(token) {
-        this.entries.delete(token);
+    async revoke(requestId) {
+        this.entries.delete(requestId);
     }
     stop() {
         if (this.cleanupTimer) {
@@ -109,20 +233,20 @@ export class InMemoryConfirmationStore {
         }
     }
     cleanupExpired(now = this.now()) {
-        for (const [token, entry] of this.entries.entries()) {
-            if (entry.expiresAt <= now) {
-                this.entries.delete(token);
+        for (const [requestId, entry] of this.entries.entries()) {
+            if (entry.payload.expiresAt <= now) {
+                this.entries.delete(requestId);
             }
         }
     }
-    generateUniqueToken() {
+    generateUniqueRequestId() {
         for (let i = 0; i < 5; i += 1) {
-            const token = `${TOKEN_PREFIX}${this.randomBytesFn(32).toString("base64url")}`;
-            if (!this.entries.has(token)) {
-                return token;
+            const requestId = this.randomBytesFn(24).toString("base64url");
+            if (!this.entries.has(requestId)) {
+                return requestId;
             }
         }
-        throw new Error("Unable to generate unique confirmation token.");
+        throw new Error("Unable to generate unique approval request id.");
     }
 }
 export function createConfirmationStore(options = {}) {

package/dist/safety/guardrail.d.ts

@@ -8,6 +8,9 @@ export interface GuardrailRuntimeLimits {
     maxRows: number;
     maxColumns: number;
     maxFieldChars: number;
+    maxResultBytes: number;
+    maxBlobBytes: number;
+    maskAllColumns: boolean;
 }
 export interface GuardrailDecision {
     action: "allow" | "confirm" | "block";

package/dist/safety/guardrail.js

@@ -1,6 +1,7 @@
 import { createSqlParser } from "./parser/index.js";
 import { classifySql } from "./sql-classifier.js";
-import { validateStaticRules, validateToolScope, } from "./sql-validator.js";
+import { hasSensitiveColumnReference } from "./redaction.js";
+import { validateStaticRules, validateDatabaseScope, validateToolScope, } from "./sql-validator.js";
 function dedupeCaseInsensitive(values) {
     const output = [];
     const seen = new Set();
@@ -54,10 +55,13 @@ function buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, rea
             maxRows: input.context.limits.maxRows,
             maxColumns: input.context.limits.maxColumns,
             maxFieldChars: input.context.limits.maxFieldChars ?? 2048,
+            maxResultBytes: input.context.limits.maxResultBytes ?? 1048576,
+            maxBlobBytes: input.context.limits.maxBlobBytes ?? 65536,
+            maskAllColumns: false,
         },
     };
 }
-function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExplain) {
+function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExplain, maskAllColumns = false) {
     let action = "allow";
     let riskLevel = "low";
     const reasonCodes = [];
@@ -68,7 +72,9 @@ function mergeDecision(input, normalizedSql, sqlHash, validations, requiresExpla
         reasonCodes.push(...validation.reasonCodes);
         riskHints.push(...validation.riskHints);
     }
-    return buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, reasonCodes, riskHints, requiresExplain);
+    const decision = buildBaseDecision(input, normalizedSql, sqlHash, action, riskLevel, reasonCodes, riskHints, requiresExplain);
+    decision.runtimeLimits.maskAllColumns = maskAllColumns;
+    return decision;
 }
 export class GuardrailImpl {
     parserFactory;
@@ -85,13 +91,17 @@ export class GuardrailImpl {
         const cls = classifySql(parseResult.ast, normalized, input.context.engine);
         const d1 = validateToolScope(input.toolName, cls);
         if (d1.action === "block") {
-            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1], false);
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1], false, hasSensitiveColumnReference(cls.referencedColumns));
+        }
+        const databaseScope = validateDatabaseScope(cls, input.context.database);
+        if (databaseScope.action === "block") {
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope], false, hasSensitiveColumnReference(cls.referencedColumns));
         }
         const d2 = validateStaticRules(cls);
         if (d2.action === "block") {
-            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, d2], false);
+            return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope, d2], false, hasSensitiveColumnReference(cls.referencedColumns));
         }
-        return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, d2], false);
+        return mergeDecision(input, normalized.normalizedSql, normalized.sqlHash, [d1, databaseScope, d2], false, hasSensitiveColumnReference(cls.referencedColumns));
     }
 }
 export function createGuardrail(options = {}) {

package/dist/safety/redaction.d.ts

@@ -12,6 +12,9 @@ export interface RedactionPolicy {
     maxRows: number;
     maxColumns: number;
     maxFieldChars: number;
+    maxResultBytes?: number;
+    maxBlobBytes?: number;
+    maskAllColumns?: boolean;
     sensitiveColumns?: Iterable<string>;
     sensitiveStrategy?: SensitiveStrategy;
 }
@@ -24,6 +27,8 @@ export interface RedactedQueryResult {
     rowTruncated: boolean;
     columnTruncated: boolean;
     fieldTruncated: boolean;
+    byteTruncated: boolean;
+    returnedBytes: number;
     redactedColumns: string[];
     droppedColumns: string[];
     truncatedColumns: string[];
@@ -31,4 +36,5 @@ export interface RedactedQueryResult {
 export interface ResultRedactor {
     redact(raw: RawQueryResult, policy: RedactionPolicy): RedactedQueryResult;
 }
+export declare function hasSensitiveColumnReference(columns: Iterable<string>): boolean;
 export declare function createResultRedactor(): ResultRedactor;

package/dist/safety/redaction.js

@@ -2,6 +2,8 @@ import { createHash } from "node:crypto";
 const DEFAULT_MAX_ROWS = 200;
 const DEFAULT_MAX_COLUMNS = 50;
 const DEFAULT_MAX_FIELD_CHARS = 2048;
+const DEFAULT_MAX_RESULT_BYTES = 1048576;
+const DEFAULT_MAX_BLOB_BYTES = 65536;
 const DEFAULT_SENSITIVE_STRATEGY = "mask";
 const SENSITIVE_COLUMN_PATTERNS = [
     /password|passwd|secret/i,
@@ -58,6 +60,14 @@ function isSensitiveColumn(name, explicitSensitive) {
     const base = candidates[candidates.length - 1];
     return SENSITIVE_COLUMN_PATTERNS.some((pattern) => pattern.test(base));
 }
+export function hasSensitiveColumnReference(columns) {
+    for (const column of columns) {
+        if (isSensitiveColumn(column, new Set())) {
+            return true;
+        }
+    }
+    return false;
+}
 function maskValue(columnName, value) {
     if (value === null || value === undefined) {
         return value;
@@ -87,7 +97,19 @@ function hashValue(value) {
     const digest = createHash("sha256").update(plain).digest("hex").slice(0, 12);
     return `[HASH:${digest}]`;
 }
-function truncateFieldValue(value, maxFieldChars) {
+function truncateFieldValue(value, maxFieldChars, maxBlobBytes) {
+    if (Buffer.isBuffer(value)) {
+        if (value.byteLength > maxBlobBytes) {
+            return {
+                value: `[BINARY:${value.byteLength} bytes; omitted by max_blob_bytes]`,
+                truncated: true,
+            };
+        }
+        return {
+            value: `[BINARY:${value.byteLength} bytes;base64:${value.toString("base64")}]`,
+            truncated: false,
+        };
+    }
     if (typeof value !== "string") {
         return { value, truncated: false };
     }
@@ -104,12 +126,14 @@ class DefaultResultRedactor {
         const maxRows = asPositiveInt(policy.maxRows, DEFAULT_MAX_ROWS);
         const maxColumns = asPositiveInt(policy.maxColumns, DEFAULT_MAX_COLUMNS);
         const maxFieldChars = asPositiveInt(policy.maxFieldChars, DEFAULT_MAX_FIELD_CHARS);
+        const maxResultBytes = asPositiveInt(policy.maxResultBytes, DEFAULT_MAX_RESULT_BYTES);
+        const maxBlobBytes = asPositiveInt(policy.maxBlobBytes, DEFAULT_MAX_BLOB_BYTES);
         const sensitiveStrategy = policy.sensitiveStrategy ?? DEFAULT_SENSITIVE_STRATEGY;
         const explicitSensitive = buildSensitiveSet(policy.sensitiveColumns);
         const sourceColumns = Array.isArray(raw.columns) ? raw.columns : [];
         const sourceRows = Array.isArray(raw.rows) ? raw.rows : [];
         const originalRowCount = asNonNegativeInt(raw.rowCount, sourceRows.length);
-        const rowTruncated = sourceRows.length > maxRows || originalRowCount > maxRows;
+        let rowTruncated = sourceRows.length > maxRows || originalRowCount > maxRows;
         const columnTruncated = sourceColumns.length > maxColumns;
         const rowLimited = sourceRows.slice(0, maxRows);
         const columnLimited = sourceColumns.slice(0, maxColumns);
@@ -120,7 +144,8 @@ class DefaultResultRedactor {
         const droppedColumns = [];
         for (let index = 0; index < columnLimited.length; index += 1) {
             const column = columnLimited[index];
-            const sensitive = isSensitiveColumn(column.name, explicitSensitive);
+            const sensitive = policy.maskAllColumns === true ||
+                isSensitiveColumn(column.name, explicitSensitive);
             if (sensitive && sensitiveStrategy === "drop") {
                 droppedColumns.push(column.name);
                 continue;
@@ -151,7 +176,7 @@ class DefaultResultRedactor {
                     }
                 }
                 else {
-                    const truncated = truncateFieldValue(rawValue, maxFieldChars);
+                    const truncated = truncateFieldValue(rawValue, maxFieldChars, maxBlobBytes);
                     value = truncated.value;
                     if (truncated.truncated) {
                         truncatedColumns.add(column.name);
@@ -162,15 +187,31 @@ class DefaultResultRedactor {
             return outputRow;
         });
         const fieldTruncated = truncatedColumns.size > 0;
+        let returnedBytes = Buffer.byteLength(JSON.stringify({ columns: keepColumns, rows: [] }), "utf8");
+        let byteTruncated = false;
+        const byteLimitedRows = [];
+        for (const row of outputRows) {
+            const rowBytes = Buffer.byteLength(JSON.stringify(row), "utf8");
+            const delimiterBytes = byteLimitedRows.length > 0 ? 1 : 0;
+            if (returnedBytes + delimiterBytes + rowBytes > maxResultBytes) {
+                byteTruncated = true;
+                rowTruncated = true;
+                break;
+            }
+            byteLimitedRows.push(row);
+            returnedBytes += delimiterBytes + rowBytes;
+        }
         return {
             columns: keepColumns,
-            rows: outputRows,
+            rows: byteLimitedRows,
             rowCount: originalRowCount,
             originalRowCount,
-            truncated: rowTruncated || columnTruncated || fieldTruncated,
+            truncated: rowTruncated || columnTruncated || fieldTruncated || byteTruncated,
             rowTruncated,
             columnTruncated,
             fieldTruncated,
+            byteTruncated,
+            returnedBytes,
             redactedColumns: keepColumns
                 .map((column) => column.name)
                 .filter((name) => redactedColumns.has(name)),

package/dist/safety/sql-classifier.d.ts

@@ -8,6 +8,7 @@ export interface SqlClassification {
     sqlHash: string;
     isMultiStatement: boolean;
     referencedTables: string[];
+    referencedSchemas: string[];
     referencedColumns: string[];
     hasWhere: boolean;
     hasLimit: boolean;

package/dist/safety/sql-classifier.js

@@ -32,6 +32,7 @@ export function classifySql(ast, normalized, engine) {
         sqlHash: normalized.sqlHash,
         isMultiStatement: ast.isMultiStatement,
         referencedTables: extractTables(ast),
+        referencedSchemas: dedupeCaseInsensitive(ast.tables.flatMap((table) => (table.schema ? [table.schema] : []))),
         referencedColumns: extractColumns(ast),
         hasWhere: ast.where !== undefined,
         hasLimit: ast.limit !== undefined,

package/dist/safety/sql-validator.d.ts

@@ -16,4 +16,5 @@ export interface ExplainRiskSummary {
     riskHints: string[];
 }
 export declare function validateToolScope(toolName: string, cls: SqlClassification): ValidationResult;
+export declare function validateDatabaseScope(cls: SqlClassification, database: string | undefined): ValidationResult;
 export declare function validateStaticRules(cls: SqlClassification): ValidationResult;

package/dist/safety/sql-validator.js

@@ -1,6 +1,7 @@
 const READONLY_STATEMENTS = new Set(["select", "show", "explain", "describe"]);
 const MUTATION_STATEMENTS = new Set(["insert", "update", "delete"]);
 const STAR_COLUMN_PATTERN = /(^|\.)(\*|\(\.\*\))$/;
+const READONLY_SIDE_EFFECT_PATTERN = /\b(?:INTO\s+(?:OUTFILE|DUMPFILE)|FOR\s+UPDATE|LOCK\s+IN\s+SHARE\s+MODE|GET_LOCK\s*\(|RELEASE_LOCK\s*\(|SLEEP\s*\(|BENCHMARK\s*\(|LOAD_FILE\s*\()/i;
 function allow(riskLevel = "low") {
     return {
         action: "allow",
@@ -53,7 +54,7 @@ export function validateToolScope(toolName, cls) {
         if (!READONLY_STATEMENTS.has(cls.statementType)) {
             return block(["T001"], [
                 `Tool execute_readonly_sql only allows SELECT/SHOW/EXPLAIN/DESCRIBE, got ${cls.statementType}.`,
-                "Use execute_sql for controlled mutations.",
+                "Use analyze_mutation_sql to generate non-executing SQL Advice.",
             ]);
         }
         return allow("low");
@@ -75,6 +76,23 @@ export function validateToolScope(toolName, cls) {
     }
     return allow("low");
 }
+export function validateDatabaseScope(cls, database) {
+    const schemas = cls.referencedSchemas ?? [];
+    if (schemas.length === 0) {
+        return allow("low");
+    }
+    if (!database) {
+        return block(["D001"], ["SQL uses an explicit database but the session has no bound database."]);
+    }
+    const expected = database.toLowerCase();
+    const outOfScope = schemas.filter((schema) => schema.toLowerCase() !== expected);
+    if (outOfScope.length > 0) {
+        return block(["D002"], [
+            `SQL references database(s) outside the bound database "${database}": ${outOfScope.join(", ")}.`,
+        ]);
+    }
+    return allow("low");
+}
 export function validateStaticRules(cls) {
     const reasonCodes = [];
     const riskHints = [];
@@ -117,7 +135,13 @@ export function validateStaticRules(cls) {
             escalateToConfirm("R006", "Mutation SQL with WHERE requires confirmation.");
         }
     }
+    if (cls.statementType === "insert") {
+        escalateToConfirm("R006", "INSERT, REPLACE, and UPSERT statements require confirmation.");
+    }
     if (cls.statementType === "select") {
+        if (READONLY_SIDE_EFFECT_PATTERN.test(cls.normalizedSql)) {
+            escalateToBlock("R009", "SELECT statements with side effects or blocking functions are blocked.");
+        }
         if (!cls.hasLimit && !cls.hasAggregate) {
             escalateToMediumAllow("R007", "Detail SELECT without LIMIT has medium risk.");
         }

package/dist/schema/adapters/mysql.js

@@ -272,7 +272,9 @@ export class MySqlSchemaAdapter {
         }));
     }
     async queryObjects(ctx, sql) {
-        const session = await this.connectionPool.acquire(ctx.datasource, "ro");
+        const session = await this.connectionPool.acquire(ctx.datasource, "ro", {
+            database: ctx.database,
+        });
         try {
             const result = await session.execute(sql, { timeoutMs: ctx.limits.timeoutMs });
             return rowsToObjects(result);

package/dist/taurus/flashback.js

@@ -1,6 +1,6 @@
 import { createSqlParser } from "../safety/parser/index.js";
 import { normalizeSql } from "../utils/hash.js";
-const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+import { quoteMysqlIdentifier } from "../utils/mysql-identifier.js";
 const SQL_TIMESTAMP_PATTERN = /^(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2})(?:\.\d{1,6})?$/;
 const RELATIVE_DURATION_PATTERN = /(\d+)\s*(ms|milliseconds?|s|sec|secs|seconds?|m|min|mins|minutes?|h|hr|hrs|hours?|d|days?)/gi;
 const UNIT_TO_MS = {
@@ -26,12 +26,6 @@ function normalizeDurationUnit(unit) {
     }
     return "d";
 }
-function quoteIdentifier(identifier, fieldName) {
-    if (!IDENTIFIER_PATTERN.test(identifier)) {
-        throw new Error(`Invalid ${fieldName}: "${identifier}".`);
-    }
-    return `\`${identifier}\``;
-}
 export function normalizeFlashbackWhereClause(where) {
     const parser = createSqlParser("mysql");
     const candidate = parser.normalize(`SELECT 1 FROM placeholder WHERE (${where})`);
@@ -128,10 +122,10 @@ export function resolveFlashbackTimestamp(asOf, now = Date.now) {
     throw new Error("Flashback query requires either as_of.timestamp or as_of.relative.");
 }
 export function buildFlashbackSql(input, defaultDatabase, now = Date.now) {
-    const database = quoteIdentifier(input.database ?? defaultDatabase, "database");
-    const table = quoteIdentifier(input.table, "table");
+    const database = quoteMysqlIdentifier(input.database ?? defaultDatabase, "database");
+    const table = quoteMysqlIdentifier(input.table, "table");
     const columns = input.columns && input.columns.length > 0
-        ? input.columns.map((column) => quoteIdentifier(column, "column")).join(", ")
+        ? input.columns.map((column) => quoteMysqlIdentifier(column, "column")).join(", ")
         : "*";
     const timestamp = resolveFlashbackTimestamp(input.asOf, now);
     const clauses = [

package/dist/taurus/recycle-bin.js

@@ -1,12 +1,6 @@
+import { quoteMysqlIdentifier } from "../utils/mysql-identifier.js";
 export const RECYCLE_BIN_DATABASE = "__recyclebin__";
-const SIMPLE_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_$]*$/;
 const RECYCLE_TABLE_PATTERN = /^[A-Za-z0-9_$@.-]+$/;
-function quoteIdentifier(identifier, fieldName) {
-    if (!SIMPLE_IDENTIFIER_PATTERN.test(identifier)) {
-        throw new Error(`Invalid ${fieldName}: "${identifier}".`);
-    }
-    return `\`${identifier}\``;
-}
 function quoteRecycleTableName(table) {
     if (!RECYCLE_TABLE_PATTERN.test(table)) {
         throw new Error(`Invalid recycle_table: "${table}".`);
@@ -45,7 +39,7 @@ export function buildRestoreRecycleBinTableSql(input) {
         if (!input.destinationDatabase || !input.destinationTable) {
             throw new Error("insert_select restore requires destination_database and destination_table. Create the destination table with a compatible structure before calling this tool.");
         }
-        return `INSERT INTO ${quoteIdentifier(input.destinationDatabase, "destination_database")}.${quoteIdentifier(input.destinationTable, "destination_table")} SELECT * FROM \`${RECYCLE_BIN_DATABASE}\`.${quoteRecycleTableName(input.recycleTable)}`;
+        return `INSERT INTO ${quoteMysqlIdentifier(input.destinationDatabase, "destination_database")}.${quoteMysqlIdentifier(input.destinationTable, "destination_table")} SELECT * FROM \`${RECYCLE_BIN_DATABASE}\`.${quoteRecycleTableName(input.recycleTable)}`;
     }
     throw new Error(`Unsupported restore method: ${method}.`);
 }

package/dist/utils/formatter.d.ts

@@ -10,7 +10,14 @@ export declare const ErrorCode: {
     readonly QUERY_TIMEOUT: "QUERY_TIMEOUT";
     readonly QUERY_CANCELLED: "QUERY_CANCELLED";
     readonly CONNECTION_FAILED: "CONNECTION_FAILED";
+    readonly DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE";
+    readonly DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED";
+    readonly DB_TLS_FAILED: "DB_TLS_FAILED";
+    readonly DB_AUTH_FAILED: "DB_AUTH_FAILED";
+    readonly DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT";
     readonly RESULT_TOO_LARGE: "RESULT_TOO_LARGE";
+    readonly AUDIT_FAILED: "AUDIT_FAILED";
+    readonly SERVER_BUSY: "SERVER_BUSY";
     readonly UNSUPPORTED_FEATURE: "UNSUPPORTED_FEATURE";
 };
 export type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
@@ -53,7 +60,8 @@ export type FormatBlockedOptions = {
     details?: Record<string, unknown>;
 };
 export type FormatConfirmationRequiredOptions = {
-    confirmationToken: string;
+    approvalRequest: string;
+    requestId: string;
     metadata: ResponseMetadata;
     summary?: string;
     message?: string;
@@ -64,7 +72,8 @@ export declare function formatSuccess<T>(data: T, options: FormatSuccessOptions)
 export declare function formatError<T = unknown>(options: FormatErrorOptions<T>): ToolResponse<T>;
 export declare function formatBlocked(options: FormatBlockedOptions): ToolResponse;
 export declare function formatConfirmationRequired(options: FormatConfirmationRequiredOptions): ToolResponse<{
-    confirmation_token: string;
+    approval_request: string;
+    request_id: string;
     risk_level?: string;
     sql_hash?: string;
 }>;