taurusdb-core 0.5.0-rc.10 → 0.5.0-rc.3

package/dist/auth/sql-profile-loader/env-source.js

@@ -12,8 +12,7 @@ export function parseEngineFromDsnProtocol(protocol) {
 export function parseEnvProfile(env) {
     const dsn = asString(env.TAURUSDB_SQL_DSN);
     const explicitHost = asString(env.TAURUSDB_SQL_HOST);
-    const explicitProfileName = asString(env.TAURUSDB_SQL_DATASOURCE);
-    const profileName = explicitProfileName ?? "taurus_mcp";
+    const profileName = asString(env.TAURUSDB_SQL_DATASOURCE) ?? "taurus_mcp";
     let engine;
     let host;
     let port;
@@ -41,7 +40,6 @@ export function parseEnvProfile(env) {
     }
     if (!dsn &&
         !explicitHost &&
-        !explicitProfileName &&
         !asString(env.TAURUSDB_SQL_USER) &&
         !asString(env.TAURUSDB_SQL_PASSWORD) &&
         !database) {
@@ -51,13 +49,23 @@ export function parseEnvProfile(env) {
         throw new Error("Failed to resolve SQL port from environment.");
     }
     username = username ?? asString(env.TAURUSDB_SQL_USER);
+    if (!username) {
+        throw new Error("Missing SQL username in environment. Set TAURUSDB_SQL_USER or include it in DSN.");
+    }
     passwordRef =
         passwordRef ??
             (Object.hasOwn(env, "TAURUSDB_SQL_PASSWORD")
                 ? parseCredentialRef(env.TAURUSDB_SQL_PASSWORD, "TAURUSDB_SQL_PASSWORD")
                 : undefined);
-    if ((username && !passwordRef) || (!username && passwordRef)) {
-        throw new Error("SQL credentials require both username and password. Omit both to use the local database login page.");
+    if (!passwordRef) {
+        throw new Error("Missing SQL password in environment. Set TAURUSDB_SQL_PASSWORD or include it in DSN.");
+    }
+    const mutationUsername = asString(env.TAURUSDB_SQL_MUTATION_USER);
+    const mutationPasswordRef = Object.hasOwn(env, "TAURUSDB_SQL_MUTATION_PASSWORD")
+        ? parseCredentialRef(env.TAURUSDB_SQL_MUTATION_PASSWORD, "TAURUSDB_SQL_MUTATION_PASSWORD")
+        : undefined;
+    if ((mutationUsername && !mutationPasswordRef) || (!mutationUsername && mutationPasswordRef)) {
+        throw new Error("Mutation credentials require both TAURUSDB_SQL_MUTATION_USER and TAURUSDB_SQL_MUTATION_PASSWORD.");
     }
     const poolSize = asInteger(env.TAURUSDB_SQL_POOL_SIZE);
     if (poolSize !== undefined && poolSize <= 0) {
@@ -69,7 +77,13 @@ export function parseEnvProfile(env) {
         host,
         port,
         database,
-        user: username && passwordRef ? { username, password: passwordRef } : undefined,
+        user: {
+            username,
+            password: passwordRef,
+        },
+        mutationUser: mutationUsername && mutationPasswordRef
+            ? { username: mutationUsername, password: mutationPasswordRef }
+            : undefined,
         poolSize,
     });
 }

package/dist/auth/sql-profile-loader/parsing.js

@@ -196,14 +196,19 @@ export function parseProfileRecord(name, value, context) {
     if (poolSize !== undefined && poolSize <= 0) {
         throw new Error(`Invalid datasource profile ${name} in ${context}: poolSize must be positive.`);
     }
-    // `user` is the session credential. Keep older read-only aliases for compatibility.
+    // `user` is the read-only credential. Keep older read-only aliases for compatibility.
     const userRaw = value.user ??
         value.readonlyUser ??
         value.readonly ??
         value.readOnlyUser;
-    const user = userRaw === undefined
+    if (userRaw === undefined) {
+        throw new Error(`Invalid datasource profile ${name} in ${context}: missing user.`);
+    }
+    const user = parseUserCredential(userRaw, `${context}.${name}.user`);
+    const mutationUserRaw = value.mutationUser ?? value.writeUser ?? value.rwUser;
+    const mutationUser = mutationUserRaw === undefined
         ? undefined
-        : parseUserCredential(userRaw, `${context}.${name}.user`);
+        : parseUserCredential(mutationUserRaw, `${context}.${name}.mutationUser`);
     const tls = parseTlsOptions(value.tls, `${context}.${name}.tls`);
     return withRedactedToString({
         name,
@@ -214,6 +219,7 @@ export function parseProfileRecord(name, value, context) {
         instanceId,
         nodeId,
         user,
+        mutationUser,
         tls,
         poolSize,
     });

package/dist/auth/sql-profile-loader/types.d.ts

@@ -33,8 +33,10 @@ export interface DataSourceProfile {
     database?: string;
     instanceId?: string;
     nodeId?: string;
-    /** Session credential used by guarded query tools and the human-gated recovery path. */
+    /** Read-only credential used by discovery, diagnostics, and query tools. */
     user?: UserCredential;
+    /** Separate credential required for mutation tools. No fallback is allowed. */
+    mutationUser?: UserCredential;
     tls?: TlsOptions;
     poolSize?: number;
     toString(): string;

package/dist/config/env.js

@@ -161,7 +161,6 @@ export function buildRawConfigFromEnv(env) {
         },
         security: {
             dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
-            recycleBinRestoreEnabled: parseBoolean(env.TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE, "TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE"),
             requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
             approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
             approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),

package/dist/config/schema.d.ts

@@ -106,7 +106,6 @@ export declare const ConfigSchema: z.ZodObject<{
     }>>;
     security: z.ZodDefault<z.ZodObject<{
         dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
-        recycleBinRestoreEnabled: z.ZodDefault<z.ZodBoolean>;
         requireTls: z.ZodDefault<z.ZodBoolean>;
         approvalSecretPath: z.ZodOptional<z.ZodString>;
         approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
@@ -114,7 +113,6 @@ export declare const ConfigSchema: z.ZodObject<{
         credentialMaxTtlMinutes: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         dynamicTargetsEnabled: boolean;
-        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
         credentialIdleTtlMinutes: number;
@@ -122,7 +120,6 @@ export declare const ConfigSchema: z.ZodObject<{
         approvalSecretPath?: string | undefined;
     }, {
         dynamicTargetsEnabled?: boolean | undefined;
-        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
@@ -365,7 +362,6 @@ export declare const ConfigSchema: z.ZodObject<{
     };
     security: {
         dynamicTargetsEnabled: boolean;
-        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
         credentialIdleTtlMinutes: number;
@@ -458,7 +454,6 @@ export declare const ConfigSchema: z.ZodObject<{
     } | undefined;
     security?: {
         dynamicTargetsEnabled?: boolean | undefined;
-        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;

package/dist/config/schema.js

@@ -22,9 +22,8 @@ const AuditSchema = z
     .default({});
 const SecuritySchema = z
     .object({
-    dynamicTargetsEnabled: z.boolean().default(true),
-    recycleBinRestoreEnabled: z.boolean().default(true),
-    requireTls: z.boolean().default(false),
+    dynamicTargetsEnabled: z.boolean().default(false),
+    requireTls: z.boolean().default(true),
     approvalSecretPath: z.string().min(1).optional(),
     approvalTtlSeconds: z.number().int().positive().max(3600).default(300),
     credentialIdleTtlMinutes: z.number().int().positive().max(30).default(30),

package/dist/engine.d.ts

@@ -5,12 +5,11 @@ import type { CapabilitySnapshot, FeatureMatrix, KernelInfo } from "./capability
 import { type Config } from "./config/index.js";
 import type { DatasourceResolveInput, DatasourceResolver, SessionContext } from "./context/session-context.js";
 import { type ConnectionPool } from "./executor/connection-pool.js";
-import { type CancelResult, type ExplainResult, type MutationOptions, type MutationResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
+import { type CancelResult, type ExplainResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
 import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationValidationResult } from "./safety/confirmation-store.js";
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
-import type { RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
 import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
@@ -67,7 +66,6 @@ export declare class TaurusDBEngine {
     executeReadonly(sql: string, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     flashbackQuery(input: FlashbackInput, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     listRecycleBin(ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
-    restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     getQueryStatus(queryId: string): Promise<QueryStatus>;
     cancelQuery(queryId: string): Promise<CancelResult>;
     issueConfirmation(input: IssueConfirmationInput): Promise<ConfirmationRequest>;

package/dist/engine.js

@@ -18,7 +18,7 @@ import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
-import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
+import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, validateConfirmation, } from "./engine/runtime.js";
 async function readMutationApprovalSecret(filePath) {
     const info = await lstat(filePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -251,9 +251,6 @@ export class TaurusDBEngine {
     async listRecycleBin(ctx, opts) {
         return listRecycleBin(this, ctx, opts);
     }
-    async restoreRecycleBinTable(input, ctx, opts) {
-        return restoreRecycleBinTable(this, input, ctx, opts);
-    }
     async getQueryStatus(queryId) {
         return getQueryStatus(this, queryId);
     }

package/dist/executor/connection-pool.js

@@ -20,12 +20,12 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     if (requireTls && tls?.enabled === false) {
         throw new ConnectionPoolError("TLS is required by server policy and cannot be disabled for this datasource.");
     }
+    if (requireTls && tls?.rejectUnauthorized === false) {
+        throw new ConnectionPoolError("TLS certificate verification is required by server policy.");
+    }
     const resolved = {
         enabled: tls?.enabled ?? true,
-        // Dynamic cloud targets are commonly bound by public IP while the server
-        // certificate is issued to a DNS name. When TLS is explicitly enabled,
-        // make CA/hostname verification a separate profile opt-in.
-        rejectUnauthorized: tls?.rejectUnauthorized ?? false,
+        rejectUnauthorized: tls?.rejectUnauthorized ?? true,
         servername: tls?.servername ?? (isIP(host) === 0 ? host : undefined),
     };
     if (tls?.ca) {
@@ -39,10 +39,11 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     }
     return resolved;
 }
-function selectCredential(profile, _mode) {
-    const credential = profile.user;
+function selectCredential(profile, mode) {
+    const credential = mode === "rw" ? profile.mutationUser : profile.user;
     if (!credential) {
-        throw new ConnectionPoolError(`Datasource "${profile.name}" has no active SQL credential session. Select a TaurusDB instance and open the returned local login URL, or call begin_sql_login.`);
+        const credentialKind = mode === "rw" ? "mutation" : "read-only";
+        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define ${credentialKind} SQL credentials. Configure a dedicated ${credentialKind} database username and password reference.`);
     }
     return credential;
 }

package/dist/utils/formatter.d.ts

@@ -10,11 +10,6 @@ export declare const ErrorCode: {
     readonly QUERY_TIMEOUT: "QUERY_TIMEOUT";
     readonly QUERY_CANCELLED: "QUERY_CANCELLED";
     readonly CONNECTION_FAILED: "CONNECTION_FAILED";
-    readonly DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE";
-    readonly DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED";
-    readonly DB_TLS_FAILED: "DB_TLS_FAILED";
-    readonly DB_AUTH_FAILED: "DB_AUTH_FAILED";
-    readonly DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT";
     readonly RESULT_TOO_LARGE: "RESULT_TOO_LARGE";
     readonly AUDIT_FAILED: "AUDIT_FAILED";
     readonly SERVER_BUSY: "SERVER_BUSY";

package/dist/utils/formatter.js

@@ -9,11 +9,6 @@ export const ErrorCode = {
     QUERY_TIMEOUT: "QUERY_TIMEOUT",
     QUERY_CANCELLED: "QUERY_CANCELLED",
     CONNECTION_FAILED: "CONNECTION_FAILED",
-    DB_ENDPOINT_UNREACHABLE: "DB_ENDPOINT_UNREACHABLE",
-    DB_CONNECTION_REFUSED: "DB_CONNECTION_REFUSED",
-    DB_TLS_FAILED: "DB_TLS_FAILED",
-    DB_AUTH_FAILED: "DB_AUTH_FAILED",
-    DB_VALIDATION_TIMEOUT: "DB_VALIDATION_TIMEOUT",
     RESULT_TOO_LARGE: "RESULT_TOO_LARGE",
     AUDIT_FAILED: "AUDIT_FAILED",
     SERVER_BUSY: "SERVER_BUSY",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.5.0-rc.10",
+  "version": "0.5.0-rc.3",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "license": "MIT",
   "repository": {