taurusdb-core 0.5.0-rc.10 → 0.5.0-rc.2

package/dist/auth/sql-profile-loader/env-source.js

@@ -12,8 +12,7 @@ export function parseEngineFromDsnProtocol(protocol) {
 export function parseEnvProfile(env) {
     const dsn = asString(env.TAURUSDB_SQL_DSN);
     const explicitHost = asString(env.TAURUSDB_SQL_HOST);
-    const explicitProfileName = asString(env.TAURUSDB_SQL_DATASOURCE);
-    const profileName = explicitProfileName ?? "taurus_mcp";
+    const profileName = asString(env.TAURUSDB_SQL_DATASOURCE) ?? "taurus_mcp";
     let engine;
     let host;
     let port;
@@ -41,7 +40,6 @@ export function parseEnvProfile(env) {
     }
     if (!dsn &&
         !explicitHost &&
-        !explicitProfileName &&
         !asString(env.TAURUSDB_SQL_USER) &&
         !asString(env.TAURUSDB_SQL_PASSWORD) &&
         !database) {
@@ -51,13 +49,23 @@ export function parseEnvProfile(env) {
         throw new Error("Failed to resolve SQL port from environment.");
     }
     username = username ?? asString(env.TAURUSDB_SQL_USER);
+    if (!username) {
+        throw new Error("Missing SQL username in environment. Set TAURUSDB_SQL_USER or include it in DSN.");
+    }
     passwordRef =
         passwordRef ??
             (Object.hasOwn(env, "TAURUSDB_SQL_PASSWORD")
                 ? parseCredentialRef(env.TAURUSDB_SQL_PASSWORD, "TAURUSDB_SQL_PASSWORD")
                 : undefined);
-    if ((username && !passwordRef) || (!username && passwordRef)) {
-        throw new Error("SQL credentials require both username and password. Omit both to use the local database login page.");
+    if (!passwordRef) {
+        throw new Error("Missing SQL password in environment. Set TAURUSDB_SQL_PASSWORD or include it in DSN.");
+    }
+    const mutationUsername = asString(env.TAURUSDB_SQL_MUTATION_USER);
+    const mutationPasswordRef = Object.hasOwn(env, "TAURUSDB_SQL_MUTATION_PASSWORD")
+        ? parseCredentialRef(env.TAURUSDB_SQL_MUTATION_PASSWORD, "TAURUSDB_SQL_MUTATION_PASSWORD")
+        : undefined;
+    if ((mutationUsername && !mutationPasswordRef) || (!mutationUsername && mutationPasswordRef)) {
+        throw new Error("Mutation credentials require both TAURUSDB_SQL_MUTATION_USER and TAURUSDB_SQL_MUTATION_PASSWORD.");
     }
     const poolSize = asInteger(env.TAURUSDB_SQL_POOL_SIZE);
     if (poolSize !== undefined && poolSize <= 0) {
@@ -69,7 +77,13 @@ export function parseEnvProfile(env) {
         host,
         port,
         database,
-        user: username && passwordRef ? { username, password: passwordRef } : undefined,
+        user: {
+            username,
+            password: passwordRef,
+        },
+        mutationUser: mutationUsername && mutationPasswordRef
+            ? { username: mutationUsername, password: mutationPasswordRef }
+            : undefined,
         poolSize,
     });
 }

package/dist/auth/sql-profile-loader/parsing.js

@@ -196,14 +196,19 @@ export function parseProfileRecord(name, value, context) {
     if (poolSize !== undefined && poolSize <= 0) {
         throw new Error(`Invalid datasource profile ${name} in ${context}: poolSize must be positive.`);
     }
-    // `user` is the session credential. Keep older read-only aliases for compatibility.
+    // `user` is the read-only credential. Keep older read-only aliases for compatibility.
     const userRaw = value.user ??
         value.readonlyUser ??
         value.readonly ??
         value.readOnlyUser;
-    const user = userRaw === undefined
+    if (userRaw === undefined) {
+        throw new Error(`Invalid datasource profile ${name} in ${context}: missing user.`);
+    }
+    const user = parseUserCredential(userRaw, `${context}.${name}.user`);
+    const mutationUserRaw = value.mutationUser ?? value.writeUser ?? value.rwUser;
+    const mutationUser = mutationUserRaw === undefined
         ? undefined
-        : parseUserCredential(userRaw, `${context}.${name}.user`);
+        : parseUserCredential(mutationUserRaw, `${context}.${name}.mutationUser`);
     const tls = parseTlsOptions(value.tls, `${context}.${name}.tls`);
     return withRedactedToString({
         name,
@@ -214,6 +219,7 @@ export function parseProfileRecord(name, value, context) {
         instanceId,
         nodeId,
         user,
+        mutationUser,
         tls,
         poolSize,
     });

package/dist/auth/sql-profile-loader/types.d.ts

@@ -33,8 +33,10 @@ export interface DataSourceProfile {
     database?: string;
     instanceId?: string;
     nodeId?: string;
-    /** Session credential used by guarded query tools and the human-gated recovery path. */
+    /** Read-only credential used by discovery, diagnostics, and query tools. */
     user?: UserCredential;
+    /** Separate credential required for mutation tools. No fallback is allowed. */
+    mutationUser?: UserCredential;
     tls?: TlsOptions;
     poolSize?: number;
     toString(): string;

package/dist/config/env.js

@@ -160,13 +160,11 @@ export function buildRawConfigFromEnv(env) {
             maxFiles: parseInteger(env.TAURUSDB_MCP_AUDIT_MAX_FILES, "TAURUSDB_MCP_AUDIT_MAX_FILES"),
         },
         security: {
+            mutationsEnabled: parseBoolean(env.TAURUSDB_ENABLE_MUTATIONS, "TAURUSDB_ENABLE_MUTATIONS"),
             dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
-            recycleBinRestoreEnabled: parseBoolean(env.TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE, "TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE"),
             requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
             approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
             approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),
-            credentialIdleTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES"),
-            credentialMaxTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES"),
         },
         slowSqlSource: {
             taurusApi: {

package/dist/config/schema.d.ts

@@ -105,29 +105,23 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     }>>;
     security: z.ZodDefault<z.ZodObject<{
+        mutationsEnabled: z.ZodDefault<z.ZodBoolean>;
         dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
-        recycleBinRestoreEnabled: z.ZodDefault<z.ZodBoolean>;
         requireTls: z.ZodDefault<z.ZodBoolean>;
         approvalSecretPath: z.ZodOptional<z.ZodString>;
         approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
-        credentialIdleTtlMinutes: z.ZodDefault<z.ZodNumber>;
-        credentialMaxTtlMinutes: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
+        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
-        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
-        credentialIdleTtlMinutes: number;
-        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     }, {
+        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
-        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
-        credentialIdleTtlMinutes?: number | undefined;
-        credentialMaxTtlMinutes?: number | undefined;
     }>>;
     slowSqlSource: z.ZodDefault<z.ZodObject<{
         taurusApi: z.ZodDefault<z.ZodObject<{
@@ -364,12 +358,10 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles: number;
     };
     security: {
+        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
-        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
-        credentialIdleTtlMinutes: number;
-        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     };
     slowSqlSource: {
@@ -457,13 +449,11 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     } | undefined;
     security?: {
+        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
-        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
-        credentialIdleTtlMinutes?: number | undefined;
-        credentialMaxTtlMinutes?: number | undefined;
     } | undefined;
     slowSqlSource?: {
         taurusApi?: {

package/dist/config/schema.js

@@ -22,13 +22,11 @@ const AuditSchema = z
     .default({});
 const SecuritySchema = z
     .object({
-    dynamicTargetsEnabled: z.boolean().default(true),
-    recycleBinRestoreEnabled: z.boolean().default(true),
-    requireTls: z.boolean().default(false),
+    mutationsEnabled: z.boolean().default(false),
+    dynamicTargetsEnabled: z.boolean().default(false),
+    requireTls: z.boolean().default(true),
     approvalSecretPath: z.string().min(1).optional(),
     approvalTtlSeconds: z.number().int().positive().max(3600).default(300),
-    credentialIdleTtlMinutes: z.number().int().positive().max(30).default(30),
-    credentialMaxTtlMinutes: z.number().int().positive().max(480).default(480),
 })
     .default({});
 const CloudSchema = z

package/dist/engine.d.ts

@@ -10,7 +10,7 @@ import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationVali
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
-import type { RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
+import { type RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
 import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
@@ -65,6 +65,7 @@ export declare class TaurusDBEngine {
     explain(sql: string, ctx: SessionContext): Promise<ExplainResult>;
     explainEnhanced(sql: string, ctx: SessionContext): Promise<EnhancedExplainResult>;
     executeReadonly(sql: string, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
+    executeMutation(sql: string, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     flashbackQuery(input: FlashbackInput, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     listRecycleBin(ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;

package/dist/engine.js

@@ -18,7 +18,7 @@ import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
-import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
+import { cancelQuery, close, executeMutation, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
 async function readMutationApprovalSecret(filePath) {
     const info = await lstat(filePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -114,6 +114,9 @@ export class TaurusDBEngine {
         if (config.security.approvalSecretPath) {
             approvalSecret = await readMutationApprovalSecret(config.security.approvalSecretPath);
         }
+        if (config.security.mutationsEnabled && !approvalSecret && !options.confirmationStore) {
+            throw new Error("Mutations require TAURUSDB_MUTATION_APPROVAL_SECRET_FILE with at least 32 bytes.");
+        }
         const confirmationStore = options.confirmationStore ??
             createConfirmationStore({
                 approvalSecret,
@@ -245,6 +248,9 @@ export class TaurusDBEngine {
     async executeReadonly(sql, ctx, opts) {
         return executeReadonly(this, sql, ctx, opts);
     }
+    async executeMutation(sql, ctx, opts) {
+        return executeMutation(this, sql, ctx, opts);
+    }
     async flashbackQuery(input, ctx, opts) {
         return flashbackQuery(this, input, ctx, opts);
     }

package/dist/executor/connection-pool.js

@@ -20,12 +20,12 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     if (requireTls && tls?.enabled === false) {
         throw new ConnectionPoolError("TLS is required by server policy and cannot be disabled for this datasource.");
     }
+    if (requireTls && tls?.rejectUnauthorized === false) {
+        throw new ConnectionPoolError("TLS certificate verification is required by server policy.");
+    }
     const resolved = {
         enabled: tls?.enabled ?? true,
-        // Dynamic cloud targets are commonly bound by public IP while the server
-        // certificate is issued to a DNS name. When TLS is explicitly enabled,
-        // make CA/hostname verification a separate profile opt-in.
-        rejectUnauthorized: tls?.rejectUnauthorized ?? false,
+        rejectUnauthorized: tls?.rejectUnauthorized ?? true,
         servername: tls?.servername ?? (isIP(host) === 0 ? host : undefined),
     };
     if (tls?.ca) {
@@ -39,10 +39,11 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     }
     return resolved;
 }
-function selectCredential(profile, _mode) {
-    const credential = profile.user;
+function selectCredential(profile, mode) {
+    const credential = mode === "rw" ? profile.mutationUser : profile.user;
     if (!credential) {
-        throw new ConnectionPoolError(`Datasource "${profile.name}" has no active SQL credential session. Select a TaurusDB instance and open the returned local login URL, or call begin_sql_login.`);
+        const credentialKind = mode === "rw" ? "mutation" : "read-only";
+        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define ${credentialKind} SQL credentials. Configure a dedicated ${credentialKind} database username and password reference.`);
     }
     return credential;
 }

package/dist/index.d.ts

@@ -18,8 +18,6 @@ export type { CapabilitySnapshot, FeatureMatrix, FeatureStatus, KernelInfo, Taur
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export type { ConfirmationStore, ConfirmationRequest, ConfirmationValidationResult, IssueInput, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
-export { createSqlParser } from "./safety/parser/index.js";
-export type { SqlAst, StatementType as ParsedStatementType } from "./safety/parser/index.js";
 export type { Guardrail, GuardrailDecision, GuardrailRuntimeLimits, InspectInput, } from "./safety/guardrail.js";
 export type { ExplainRiskSummary, RiskLevel, ValidationResult } from "./safety/sql-validator.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";

package/dist/index.js

@@ -10,7 +10,6 @@ export { createCapabilityProbe } from "./capability/probe.js";
 export { UnsupportedFeatureError } from "./capability/types.js";
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
-export { createSqlParser } from "./safety/parser/index.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";
 export { ErrorCode, formatBlocked, formatConfirmationRequired, formatError, formatSuccess, } from "./utils/formatter.js";
 export { normalizeSql, sqlHash } from "./utils/hash.js";

package/dist/safety/sql-validator.js

@@ -54,7 +54,7 @@ export function validateToolScope(toolName, cls) {
         if (!READONLY_STATEMENTS.has(cls.statementType)) {
             return block(["T001"], [
                 `Tool execute_readonly_sql only allows SELECT/SHOW/EXPLAIN/DESCRIBE, got ${cls.statementType}.`,
-                "Use analyze_mutation_sql to generate non-executing SQL Advice.",
+                "Use execute_sql for controlled mutations.",
             ]);
         }
         return allow("low");

package/dist/utils/formatter.d.ts

@@ -10,11 +10,6 @@ export declare const ErrorCode: {
     readonly QUERY_TIMEOUT: "QUERY_TIMEOUT";
     readonly QUERY_CANCELLED: "QUERY_CANCELLED";
     readonly CONNECTION_FAILED: "CONNECTION_FAILED";
-    readonly DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE";
-    readonly DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED";
-    readonly DB_TLS_FAILED: "DB_TLS_FAILED";
-    readonly DB_AUTH_FAILED: "DB_AUTH_FAILED";
-    readonly DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT";
     readonly RESULT_TOO_LARGE: "RESULT_TOO_LARGE";
     readonly AUDIT_FAILED: "AUDIT_FAILED";
     readonly SERVER_BUSY: "SERVER_BUSY";

package/dist/utils/formatter.js

@@ -9,11 +9,6 @@ export const ErrorCode = {
     QUERY_TIMEOUT: "QUERY_TIMEOUT",
     QUERY_CANCELLED: "QUERY_CANCELLED",
     CONNECTION_FAILED: "CONNECTION_FAILED",
-    DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE",
-    DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED",
-    DB_TLS_FAILED: "DB_TLS_FAILED",
-    DB_AUTH_FAILED: "DB_AUTH_FAILED",
-    DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT",
     RESULT_TOO_LARGE: "RESULT_TOO_LARGE",
     AUDIT_FAILED: "AUDIT_FAILED",
     SERVER_BUSY: "SERVER_BUSY",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.5.0-rc.10",
+  "version": "0.5.0-rc.2",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "license": "MIT",
   "repository": {