taurusdb-core 0.5.0-rc.1 → 0.5.0-rc.11

package/dist/auth/sql-profile-loader/env-source.js

@@ -12,7 +12,8 @@ export function parseEngineFromDsnProtocol(protocol) {
 export function parseEnvProfile(env) {
     const dsn = asString(env.TAURUSDB_SQL_DSN);
     const explicitHost = asString(env.TAURUSDB_SQL_HOST);
-    const profileName = asString(env.TAURUSDB_SQL_DATASOURCE) ?? "taurus_mcp";
+    const explicitProfileName = asString(env.TAURUSDB_SQL_DATASOURCE);
+    const profileName = explicitProfileName ?? "taurus_mcp";
     let engine;
     let host;
     let port;
@@ -40,6 +41,7 @@ export function parseEnvProfile(env) {
     }
     if (!dsn &&
         !explicitHost &&
+        !explicitProfileName &&
         !asString(env.TAURUSDB_SQL_USER) &&
         !asString(env.TAURUSDB_SQL_PASSWORD) &&
         !database) {
@@ -49,23 +51,13 @@ export function parseEnvProfile(env) {
         throw new Error("Failed to resolve SQL port from environment.");
     }
     username = username ?? asString(env.TAURUSDB_SQL_USER);
-    if (!username) {
-        throw new Error("Missing SQL username in environment. Set TAURUSDB_SQL_USER or include it in DSN.");
-    }
     passwordRef =
         passwordRef ??
             (Object.hasOwn(env, "TAURUSDB_SQL_PASSWORD")
                 ? parseCredentialRef(env.TAURUSDB_SQL_PASSWORD, "TAURUSDB_SQL_PASSWORD")
                 : undefined);
-    if (!passwordRef) {
-        throw new Error("Missing SQL password in environment. Set TAURUSDB_SQL_PASSWORD or include it in DSN.");
-    }
-    const mutationUsername = asString(env.TAURUSDB_SQL_MUTATION_USER);
-    const mutationPasswordRef = Object.hasOwn(env, "TAURUSDB_SQL_MUTATION_PASSWORD")
-        ? parseCredentialRef(env.TAURUSDB_SQL_MUTATION_PASSWORD, "TAURUSDB_SQL_MUTATION_PASSWORD")
-        : undefined;
-    if ((mutationUsername && !mutationPasswordRef) || (!mutationUsername && mutationPasswordRef)) {
-        throw new Error("Mutation credentials require both TAURUSDB_SQL_MUTATION_USER and TAURUSDB_SQL_MUTATION_PASSWORD.");
+    if ((username && !passwordRef) || (!username && passwordRef)) {
+        throw new Error("SQL credentials require both username and password. Omit both to use the local database login page.");
     }
     const poolSize = asInteger(env.TAURUSDB_SQL_POOL_SIZE);
     if (poolSize !== undefined && poolSize <= 0) {
@@ -77,13 +69,7 @@ export function parseEnvProfile(env) {
         host,
         port,
         database,
-        user: {
-            username,
-            password: passwordRef,
-        },
-        mutationUser: mutationUsername && mutationPasswordRef
-            ? { username: mutationUsername, password: mutationPasswordRef }
-            : undefined,
+        user: username && passwordRef ? { username, password: passwordRef } : undefined,
         poolSize,
     });
 }

package/dist/auth/sql-profile-loader/parsing.js

@@ -196,19 +196,14 @@ export function parseProfileRecord(name, value, context) {
     if (poolSize !== undefined && poolSize <= 0) {
         throw new Error(`Invalid datasource profile ${name} in ${context}: poolSize must be positive.`);
     }
-    // `user` is the read-only credential. Keep older read-only aliases for compatibility.
+    // `user` is the session credential. Keep older read-only aliases for compatibility.
     const userRaw = value.user ??
         value.readonlyUser ??
         value.readonly ??
         value.readOnlyUser;
-    if (userRaw === undefined) {
-        throw new Error(`Invalid datasource profile ${name} in ${context}: missing user.`);
-    }
-    const user = parseUserCredential(userRaw, `${context}.${name}.user`);
-    const mutationUserRaw = value.mutationUser ?? value.writeUser ?? value.rwUser;
-    const mutationUser = mutationUserRaw === undefined
+    const user = userRaw === undefined
         ? undefined
-        : parseUserCredential(mutationUserRaw, `${context}.${name}.mutationUser`);
+        : parseUserCredential(userRaw, `${context}.${name}.user`);
     const tls = parseTlsOptions(value.tls, `${context}.${name}.tls`);
     return withRedactedToString({
         name,
@@ -219,7 +214,6 @@ export function parseProfileRecord(name, value, context) {
         instanceId,
         nodeId,
         user,
-        mutationUser,
         tls,
         poolSize,
     });

package/dist/auth/sql-profile-loader/types.d.ts

@@ -33,10 +33,8 @@ export interface DataSourceProfile {
     database?: string;
     instanceId?: string;
     nodeId?: string;
-    /** Read-only credential used by discovery, diagnostics, and query tools. */
+    /** Session credential used by guarded query tools and the human-gated recovery path. */
     user?: UserCredential;
-    /** Separate credential required for mutation tools. No fallback is allowed. */
-    mutationUser?: UserCredential;
     tls?: TlsOptions;
     poolSize?: number;
     toString(): string;

package/dist/capability/probe.js

@@ -88,11 +88,15 @@ function hasTaurusSpecificVariables(variables) {
     return TAURUS_VARIABLE_NAMES.some((name) => Object.prototype.hasOwnProperty.call(variables, name));
 }
 async function detectKernelInfo(session, variables) {
-    const rawVersion = (await executeSingleValueQuery(session, "SELECT VERSION() AS version")) ?? "unknown";
+    const [rawVersionValue, taurusVersion] = await Promise.all([
+        executeSingleValueQuery(session, "SELECT VERSION() AS version"),
+        executeSingleValueQuery(session, "SELECT taurus_version() AS version"),
+    ]);
+    const rawVersion = rawVersionValue ?? "unknown";
     const versionComment = variables.version_comment;
-    const combined = [rawVersion, versionComment].filter(Boolean).join(" ");
-    const kernelVersion = extractKernelVersion(combined);
-    const taurusSignals = [combined, variables.force_parallel_execute, variables.innodb_rds_backquery_enable]
+    const combined = [taurusVersion, rawVersion, versionComment].filter(Boolean).join(" ");
+    const kernelVersion = extractKernelVersion(taurusVersion) ?? extractKernelVersion(combined);
+    const taurusSignals = [taurusVersion, combined, variables.force_parallel_execute, variables.innodb_rds_backquery_enable]
         .filter((value) => typeof value === "string")
         .join(" ");
     const hasTaurusSignals = /taurus|huawei|gaussdb/i.test(taurusSignals) ||

package/dist/capability/version.js

@@ -38,10 +38,8 @@ export function extractKernelVersion(input) {
     if (!input) {
         return undefined;
     }
-    const exact = input.match(/\b\d+\.\d+\.\d+\.\d+\b/);
-    if (exact) {
-        return exact[0];
-    }
-    const fallback = input.match(/\b\d+\.\d+\.\d+\b/);
-    return fallback?.[0];
+    // TaurusDB kernel releases use a four-component 2.x.x.x version. Do not
+    // fall back to VERSION()'s MySQL compatibility value (for example 8.0.22),
+    // because feature gates are defined against the TaurusDB kernel version.
+    return input.match(/\b2\.\d+\.\d+\.\d+\b/)?.[0];
 }

package/dist/config/env.js

@@ -160,11 +160,13 @@ export function buildRawConfigFromEnv(env) {
             maxFiles: parseInteger(env.TAURUSDB_MCP_AUDIT_MAX_FILES, "TAURUSDB_MCP_AUDIT_MAX_FILES"),
         },
         security: {
-            mutationsEnabled: parseBoolean(env.TAURUSDB_ENABLE_MUTATIONS, "TAURUSDB_ENABLE_MUTATIONS"),
             dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
+            recycleBinRestoreEnabled: parseBoolean(env.TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE, "TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE"),
             requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
             approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
             approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),
+            credentialIdleTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES"),
+            credentialMaxTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES"),
         },
         slowSqlSource: {
             taurusApi: {

package/dist/config/schema.d.ts

@@ -105,23 +105,29 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     }>>;
     security: z.ZodDefault<z.ZodObject<{
-        mutationsEnabled: z.ZodDefault<z.ZodBoolean>;
         dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
+        recycleBinRestoreEnabled: z.ZodDefault<z.ZodBoolean>;
         requireTls: z.ZodDefault<z.ZodBoolean>;
         approvalSecretPath: z.ZodOptional<z.ZodString>;
         approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        credentialIdleTtlMinutes: z.ZodDefault<z.ZodNumber>;
+        credentialMaxTtlMinutes: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
+        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
+        credentialIdleTtlMinutes: number;
+        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     }, {
-        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
+        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
+        credentialIdleTtlMinutes?: number | undefined;
+        credentialMaxTtlMinutes?: number | undefined;
     }>>;
     slowSqlSource: z.ZodDefault<z.ZodObject<{
         taurusApi: z.ZodDefault<z.ZodObject<{
@@ -358,10 +364,12 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles: number;
     };
     security: {
-        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
+        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
+        credentialIdleTtlMinutes: number;
+        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     };
     slowSqlSource: {
@@ -449,11 +457,13 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     } | undefined;
     security?: {
-        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
+        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
+        credentialIdleTtlMinutes?: number | undefined;
+        credentialMaxTtlMinutes?: number | undefined;
     } | undefined;
     slowSqlSource?: {
         taurusApi?: {

package/dist/config/schema.js

@@ -22,11 +22,13 @@ const AuditSchema = z
     .default({});
 const SecuritySchema = z
     .object({
-    mutationsEnabled: z.boolean().default(false),
-    dynamicTargetsEnabled: z.boolean().default(false),
-    requireTls: z.boolean().default(true),
+    dynamicTargetsEnabled: z.boolean().default(true),
+    recycleBinRestoreEnabled: z.boolean().default(true),
+    requireTls: z.boolean().default(false),
     approvalSecretPath: z.string().min(1).optional(),
     approvalTtlSeconds: z.number().int().positive().max(3600).default(300),
+    credentialIdleTtlMinutes: z.number().int().positive().max(30).default(30),
+    credentialMaxTtlMinutes: z.number().int().positive().max(480).default(480),
 })
     .default({});
 const CloudSchema = z

package/dist/engine.d.ts

@@ -10,7 +10,7 @@ import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationVali
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
-import { type RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
+import type { RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
 import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
@@ -65,7 +65,6 @@ export declare class TaurusDBEngine {
     explain(sql: string, ctx: SessionContext): Promise<ExplainResult>;
     explainEnhanced(sql: string, ctx: SessionContext): Promise<EnhancedExplainResult>;
     executeReadonly(sql: string, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
-    executeMutation(sql: string, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     flashbackQuery(input: FlashbackInput, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     listRecycleBin(ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;

package/dist/engine.js

@@ -18,7 +18,7 @@ import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
-import { cancelQuery, close, executeMutation, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
+import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
 async function readMutationApprovalSecret(filePath) {
     const info = await lstat(filePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -114,9 +114,6 @@ export class TaurusDBEngine {
         if (config.security.approvalSecretPath) {
             approvalSecret = await readMutationApprovalSecret(config.security.approvalSecretPath);
         }
-        if (config.security.mutationsEnabled && !approvalSecret && !options.confirmationStore) {
-            throw new Error("Mutations require TAURUSDB_MUTATION_APPROVAL_SECRET_FILE with at least 32 bytes.");
-        }
         const confirmationStore = options.confirmationStore ??
             createConfirmationStore({
                 approvalSecret,
@@ -248,9 +245,6 @@ export class TaurusDBEngine {
     async executeReadonly(sql, ctx, opts) {
         return executeReadonly(this, sql, ctx, opts);
     }
-    async executeMutation(sql, ctx, opts) {
-        return executeMutation(this, sql, ctx, opts);
-    }
     async flashbackQuery(input, ctx, opts) {
         return flashbackQuery(this, input, ctx, opts);
     }

package/dist/executor/connection-pool.js

@@ -20,12 +20,12 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     if (requireTls && tls?.enabled === false) {
         throw new ConnectionPoolError("TLS is required by server policy and cannot be disabled for this datasource.");
     }
-    if (requireTls && tls?.rejectUnauthorized === false) {
-        throw new ConnectionPoolError("TLS certificate verification is required by server policy.");
-    }
     const resolved = {
         enabled: tls?.enabled ?? true,
-        rejectUnauthorized: tls?.rejectUnauthorized ?? true,
+        // Dynamic cloud targets are commonly bound by public IP while the server
+        // certificate is issued to a DNS name. When TLS is explicitly enabled,
+        // make CA/hostname verification a separate profile opt-in.
+        rejectUnauthorized: tls?.rejectUnauthorized ?? false,
         servername: tls?.servername ?? (isIP(host) === 0 ? host : undefined),
     };
     if (tls?.ca) {
@@ -39,11 +39,10 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     }
     return resolved;
 }
-function selectCredential(profile, mode) {
-    const credential = mode === "rw" ? profile.mutationUser : profile.user;
+function selectCredential(profile, _mode) {
+    const credential = profile.user;
     if (!credential) {
-        const credentialKind = mode === "rw" ? "mutation" : "read-only";
-        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define ${credentialKind} SQL credentials. Configure a dedicated ${credentialKind} database username and password reference.`);
+        throw new ConnectionPoolError(`Datasource "${profile.name}" has no active SQL credential session. Select a TaurusDB instance and open the returned local login URL, or call begin_sql_login.`);
     }
     return credential;
 }

package/dist/index.d.ts

@@ -18,6 +18,8 @@ export type { CapabilitySnapshot, FeatureMatrix, FeatureStatus, KernelInfo, Taur
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export type { ConfirmationStore, ConfirmationRequest, ConfirmationValidationResult, IssueInput, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
+export { createSqlParser } from "./safety/parser/index.js";
+export type { SqlAst, StatementType as ParsedStatementType } from "./safety/parser/index.js";
 export type { Guardrail, GuardrailDecision, GuardrailRuntimeLimits, InspectInput, } from "./safety/guardrail.js";
 export type { ExplainRiskSummary, RiskLevel, ValidationResult } from "./safety/sql-validator.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";

package/dist/index.js

@@ -10,6 +10,7 @@ export { createCapabilityProbe } from "./capability/probe.js";
 export { UnsupportedFeatureError } from "./capability/types.js";
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
+export { createSqlParser } from "./safety/parser/index.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";
 export { ErrorCode, formatBlocked, formatConfirmationRequired, formatError, formatSuccess, } from "./utils/formatter.js";
 export { normalizeSql, sqlHash } from "./utils/hash.js";

package/dist/safety/sql-validator.js

@@ -54,7 +54,7 @@ export function validateToolScope(toolName, cls) {
         if (!READONLY_STATEMENTS.has(cls.statementType)) {
             return block(["T001"], [
                 `Tool execute_readonly_sql only allows SELECT/SHOW/EXPLAIN/DESCRIBE, got ${cls.statementType}.`,
-                "Use execute_sql for controlled mutations.",
+                "Use analyze_mutation_sql to generate non-executing SQL Advice.",
             ]);
         }
         return allow("low");

package/dist/utils/formatter.d.ts

@@ -10,10 +10,16 @@ export declare const ErrorCode: {
     readonly QUERY_TIMEOUT: "QUERY_TIMEOUT";
     readonly QUERY_CANCELLED: "QUERY_CANCELLED";
     readonly CONNECTION_FAILED: "CONNECTION_FAILED";
+    readonly DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE";
+    readonly DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED";
+    readonly DB_TLS_FAILED: "DB_TLS_FAILED";
+    readonly DB_AUTH_FAILED: "DB_AUTH_FAILED";
+    readonly DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT";
     readonly RESULT_TOO_LARGE: "RESULT_TOO_LARGE";
     readonly AUDIT_FAILED: "AUDIT_FAILED";
     readonly SERVER_BUSY: "SERVER_BUSY";
     readonly UNSUPPORTED_FEATURE: "UNSUPPORTED_FEATURE";
+    readonly FLASHBACK_VIEW_UNAVAILABLE: "FLASHBACK_VIEW_UNAVAILABLE";
 };
 export type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
 export type ToolError = {

package/dist/utils/formatter.js

@@ -9,10 +9,16 @@ export const ErrorCode = {
     QUERY_TIMEOUT: "QUERY_TIMEOUT",
     QUERY_CANCELLED: "QUERY_CANCELLED",
     CONNECTION_FAILED: "CONNECTION_FAILED",
+    DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE",
+    DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED",
+    DB_TLS_FAILED: "DB_TLS_FAILED",
+    DB_AUTH_FAILED: "DB_AUTH_FAILED",
+    DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT",
     RESULT_TOO_LARGE: "RESULT_TOO_LARGE",
     AUDIT_FAILED: "AUDIT_FAILED",
     SERVER_BUSY: "SERVER_BUSY",
     UNSUPPORTED_FEATURE: "UNSUPPORTED_FEATURE",
+    FLASHBACK_VIEW_UNAVAILABLE: "FLASHBACK_VIEW_UNAVAILABLE",
 };
 export function formatSuccess(data, options) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.5.0-rc.1",
+  "version": "0.5.0-rc.11",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "license": "MIT",
   "repository": {