taurusdb-core 0.5.0-rc.2 → 0.5.0-rc.3

package/dist/config/env.js

@@ -160,11 +160,12 @@ export function buildRawConfigFromEnv(env) {
             maxFiles: parseInteger(env.TAURUSDB_MCP_AUDIT_MAX_FILES, "TAURUSDB_MCP_AUDIT_MAX_FILES"),
         },
         security: {
-            mutationsEnabled: parseBoolean(env.TAURUSDB_ENABLE_MUTATIONS, "TAURUSDB_ENABLE_MUTATIONS"),
             dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
             requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
             approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
             approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),
+            credentialIdleTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES"),
+            credentialMaxTtlMinutes: parseInteger(env.TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES, "TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES"),
         },
         slowSqlSource: {
             taurusApi: {

package/dist/config/schema.d.ts

@@ -105,23 +105,26 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     }>>;
     security: z.ZodDefault<z.ZodObject<{
-        mutationsEnabled: z.ZodDefault<z.ZodBoolean>;
         dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
         requireTls: z.ZodDefault<z.ZodBoolean>;
         approvalSecretPath: z.ZodOptional<z.ZodString>;
         approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        credentialIdleTtlMinutes: z.ZodDefault<z.ZodNumber>;
+        credentialMaxTtlMinutes: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
+        credentialIdleTtlMinutes: number;
+        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     }, {
-        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
+        credentialIdleTtlMinutes?: number | undefined;
+        credentialMaxTtlMinutes?: number | undefined;
     }>>;
     slowSqlSource: z.ZodDefault<z.ZodObject<{
         taurusApi: z.ZodDefault<z.ZodObject<{
@@ -358,10 +361,11 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles: number;
     };
     security: {
-        mutationsEnabled: boolean;
         dynamicTargetsEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
+        credentialIdleTtlMinutes: number;
+        credentialMaxTtlMinutes: number;
         approvalSecretPath?: string | undefined;
     };
     slowSqlSource: {
@@ -449,11 +453,12 @@ export declare const ConfigSchema: z.ZodObject<{
         maxFiles?: number | undefined;
     } | undefined;
     security?: {
-        mutationsEnabled?: boolean | undefined;
         dynamicTargetsEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
+        credentialIdleTtlMinutes?: number | undefined;
+        credentialMaxTtlMinutes?: number | undefined;
     } | undefined;
     slowSqlSource?: {
         taurusApi?: {

package/dist/config/schema.js

@@ -22,11 +22,12 @@ const AuditSchema = z
     .default({});
 const SecuritySchema = z
     .object({
-    mutationsEnabled: z.boolean().default(false),
     dynamicTargetsEnabled: z.boolean().default(false),
     requireTls: z.boolean().default(true),
     approvalSecretPath: z.string().min(1).optional(),
     approvalTtlSeconds: z.number().int().positive().max(3600).default(300),
+    credentialIdleTtlMinutes: z.number().int().positive().max(30).default(30),
+    credentialMaxTtlMinutes: z.number().int().positive().max(480).default(480),
 })
     .default({});
 const CloudSchema = z

package/dist/engine.d.ts

@@ -5,12 +5,11 @@ import type { CapabilitySnapshot, FeatureMatrix, KernelInfo } from "./capability
 import { type Config } from "./config/index.js";
 import type { DatasourceResolveInput, DatasourceResolver, SessionContext } from "./context/session-context.js";
 import { type ConnectionPool } from "./executor/connection-pool.js";
-import { type CancelResult, type ExplainResult, type MutationOptions, type MutationResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
+import { type CancelResult, type ExplainResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
 import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationValidationResult } from "./safety/confirmation-store.js";
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
-import { type RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
 import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
@@ -65,10 +64,8 @@ export declare class TaurusDBEngine {
     explain(sql: string, ctx: SessionContext): Promise<ExplainResult>;
     explainEnhanced(sql: string, ctx: SessionContext): Promise<EnhancedExplainResult>;
     executeReadonly(sql: string, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
-    executeMutation(sql: string, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     flashbackQuery(input: FlashbackInput, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     listRecycleBin(ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
-    restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     getQueryStatus(queryId: string): Promise<QueryStatus>;
     cancelQuery(queryId: string): Promise<CancelResult>;
     issueConfirmation(input: IssueConfirmationInput): Promise<ConfirmationRequest>;

package/dist/engine.js

@@ -18,7 +18,7 @@ import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
-import { cancelQuery, close, executeMutation, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
+import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, validateConfirmation, } from "./engine/runtime.js";
 async function readMutationApprovalSecret(filePath) {
     const info = await lstat(filePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -114,9 +114,6 @@ export class TaurusDBEngine {
         if (config.security.approvalSecretPath) {
             approvalSecret = await readMutationApprovalSecret(config.security.approvalSecretPath);
         }
-        if (config.security.mutationsEnabled && !approvalSecret && !options.confirmationStore) {
-            throw new Error("Mutations require TAURUSDB_MUTATION_APPROVAL_SECRET_FILE with at least 32 bytes.");
-        }
         const confirmationStore = options.confirmationStore ??
             createConfirmationStore({
                 approvalSecret,
@@ -248,18 +245,12 @@ export class TaurusDBEngine {
     async executeReadonly(sql, ctx, opts) {
         return executeReadonly(this, sql, ctx, opts);
     }
-    async executeMutation(sql, ctx, opts) {
-        return executeMutation(this, sql, ctx, opts);
-    }
     async flashbackQuery(input, ctx, opts) {
         return flashbackQuery(this, input, ctx, opts);
     }
     async listRecycleBin(ctx, opts) {
         return listRecycleBin(this, ctx, opts);
     }
-    async restoreRecycleBinTable(input, ctx, opts) {
-        return restoreRecycleBinTable(this, input, ctx, opts);
-    }
     async getQueryStatus(queryId) {
         return getQueryStatus(this, queryId);
     }

package/dist/index.d.ts

@@ -18,6 +18,8 @@ export type { CapabilitySnapshot, FeatureMatrix, FeatureStatus, KernelInfo, Taur
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export type { ConfirmationStore, ConfirmationRequest, ConfirmationValidationResult, IssueInput, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
+export { createSqlParser } from "./safety/parser/index.js";
+export type { SqlAst, StatementType as ParsedStatementType } from "./safety/parser/index.js";
 export type { Guardrail, GuardrailDecision, GuardrailRuntimeLimits, InspectInput, } from "./safety/guardrail.js";
 export type { ExplainRiskSummary, RiskLevel, ValidationResult } from "./safety/sql-validator.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";

package/dist/index.js

@@ -10,6 +10,7 @@ export { createCapabilityProbe } from "./capability/probe.js";
 export { UnsupportedFeatureError } from "./capability/types.js";
 export { createConfirmationStore, InMemoryConfirmationStore, parseApprovalRequest, signApprovalRequest, } from "./safety/confirmation-store.js";
 export { createGuardrail } from "./safety/guardrail.js";
+export { createSqlParser } from "./safety/parser/index.js";
 export { SchemaIntrospectionError } from "./schema/introspector.js";
 export { ErrorCode, formatBlocked, formatConfirmationRequired, formatError, formatSuccess, } from "./utils/formatter.js";
 export { normalizeSql, sqlHash } from "./utils/hash.js";

package/dist/safety/sql-validator.js

@@ -54,7 +54,7 @@ export function validateToolScope(toolName, cls) {
         if (!READONLY_STATEMENTS.has(cls.statementType)) {
             return block(["T001"], [
                 `Tool execute_readonly_sql only allows SELECT/SHOW/EXPLAIN/DESCRIBE, got ${cls.statementType}.`,
-                "Use execute_sql for controlled mutations.",
+                "Use analyze_mutation_sql to generate non-executing SQL Advice.",
             ]);
         }
         return allow("low");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.5.0-rc.2",
+  "version": "0.5.0-rc.3",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "license": "MIT",
   "repository": {