taurusdb-core 0.5.0-rc.3 → 0.5.0-rc.5

package/dist/auth/sql-profile-loader/env-source.js

@@ -12,7 +12,8 @@ export function parseEngineFromDsnProtocol(protocol) {
 export function parseEnvProfile(env) {
     const dsn = asString(env.TAURUSDB_SQL_DSN);
     const explicitHost = asString(env.TAURUSDB_SQL_HOST);
-    const profileName = asString(env.TAURUSDB_SQL_DATASOURCE) ?? "taurus_mcp";
+    const explicitProfileName = asString(env.TAURUSDB_SQL_DATASOURCE);
+    const profileName = explicitProfileName ?? "taurus_mcp";
     let engine;
     let host;
     let port;
@@ -40,6 +41,7 @@ export function parseEnvProfile(env) {
     }
     if (!dsn &&
         !explicitHost &&
+        !explicitProfileName &&
         !asString(env.TAURUSDB_SQL_USER) &&
         !asString(env.TAURUSDB_SQL_PASSWORD) &&
         !database) {
@@ -49,23 +51,13 @@ export function parseEnvProfile(env) {
         throw new Error("Failed to resolve SQL port from environment.");
     }
     username = username ?? asString(env.TAURUSDB_SQL_USER);
-    if (!username) {
-        throw new Error("Missing SQL username in environment. Set TAURUSDB_SQL_USER or include it in DSN.");
-    }
     passwordRef =
         passwordRef ??
             (Object.hasOwn(env, "TAURUSDB_SQL_PASSWORD")
                 ? parseCredentialRef(env.TAURUSDB_SQL_PASSWORD, "TAURUSDB_SQL_PASSWORD")
                 : undefined);
-    if (!passwordRef) {
-        throw new Error("Missing SQL password in environment. Set TAURUSDB_SQL_PASSWORD or include it in DSN.");
-    }
-    const mutationUsername = asString(env.TAURUSDB_SQL_MUTATION_USER);
-    const mutationPasswordRef = Object.hasOwn(env, "TAURUSDB_SQL_MUTATION_PASSWORD")
-        ? parseCredentialRef(env.TAURUSDB_SQL_MUTATION_PASSWORD, "TAURUSDB_SQL_MUTATION_PASSWORD")
-        : undefined;
-    if ((mutationUsername && !mutationPasswordRef) || (!mutationUsername && mutationPasswordRef)) {
-        throw new Error("Mutation credentials require both TAURUSDB_SQL_MUTATION_USER and TAURUSDB_SQL_MUTATION_PASSWORD.");
+    if ((username && !passwordRef) || (!username && passwordRef)) {
+        throw new Error("SQL credentials require both username and password. Omit both to use the local database login page.");
     }
     const poolSize = asInteger(env.TAURUSDB_SQL_POOL_SIZE);
     if (poolSize !== undefined && poolSize <= 0) {
@@ -77,13 +69,7 @@ export function parseEnvProfile(env) {
         host,
         port,
         database,
-        user: {
-            username,
-            password: passwordRef,
-        },
-        mutationUser: mutationUsername && mutationPasswordRef
-            ? { username: mutationUsername, password: mutationPasswordRef }
-            : undefined,
+        user: username && passwordRef ? { username, password: passwordRef } : undefined,
         poolSize,
     });
 }

package/dist/auth/sql-profile-loader/parsing.js

@@ -196,19 +196,14 @@ export function parseProfileRecord(name, value, context) {
     if (poolSize !== undefined && poolSize <= 0) {
         throw new Error(`Invalid datasource profile ${name} in ${context}: poolSize must be positive.`);
     }
-    // `user` is the read-only credential. Keep older read-only aliases for compatibility.
+    // `user` is the session credential. Keep older read-only aliases for compatibility.
     const userRaw = value.user ??
         value.readonlyUser ??
         value.readonly ??
         value.readOnlyUser;
-    if (userRaw === undefined) {
-        throw new Error(`Invalid datasource profile ${name} in ${context}: missing user.`);
-    }
-    const user = parseUserCredential(userRaw, `${context}.${name}.user`);
-    const mutationUserRaw = value.mutationUser ?? value.writeUser ?? value.rwUser;
-    const mutationUser = mutationUserRaw === undefined
+    const user = userRaw === undefined
         ? undefined
-        : parseUserCredential(mutationUserRaw, `${context}.${name}.mutationUser`);
+        : parseUserCredential(userRaw, `${context}.${name}.user`);
     const tls = parseTlsOptions(value.tls, `${context}.${name}.tls`);
     return withRedactedToString({
         name,
@@ -219,7 +214,6 @@ export function parseProfileRecord(name, value, context) {
         instanceId,
         nodeId,
         user,
-        mutationUser,
         tls,
         poolSize,
     });

package/dist/auth/sql-profile-loader/types.d.ts

@@ -33,10 +33,8 @@ export interface DataSourceProfile {
     database?: string;
     instanceId?: string;
     nodeId?: string;
-    /** Read-only credential used by discovery, diagnostics, and query tools. */
+    /** Session credential used by guarded query tools and the human-gated recovery path. */
     user?: UserCredential;
-    /** Separate credential required for mutation tools. No fallback is allowed. */
-    mutationUser?: UserCredential;
     tls?: TlsOptions;
     poolSize?: number;
     toString(): string;

package/dist/config/env.js

@@ -161,6 +161,7 @@ export function buildRawConfigFromEnv(env) {
         },
         security: {
             dynamicTargetsEnabled: parseBoolean(env.TAURUSDB_ENABLE_DYNAMIC_TARGETS, "TAURUSDB_ENABLE_DYNAMIC_TARGETS"),
+            recycleBinRestoreEnabled: parseBoolean(env.TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE, "TAURUSDB_ENABLE_RECYCLE_BIN_RESTORE"),
             requireTls: parseBoolean(env.TAURUSDB_REQUIRE_TLS, "TAURUSDB_REQUIRE_TLS"),
             approvalSecretPath: expandTildePath(readString(env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE)),
             approvalTtlSeconds: parseInteger(env.TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS, "TAURUSDB_MUTATION_APPROVAL_TTL_SECONDS"),

package/dist/config/schema.d.ts

@@ -106,6 +106,7 @@ export declare const ConfigSchema: z.ZodObject<{
     }>>;
     security: z.ZodDefault<z.ZodObject<{
         dynamicTargetsEnabled: z.ZodDefault<z.ZodBoolean>;
+        recycleBinRestoreEnabled: z.ZodDefault<z.ZodBoolean>;
         requireTls: z.ZodDefault<z.ZodBoolean>;
         approvalSecretPath: z.ZodOptional<z.ZodString>;
         approvalTtlSeconds: z.ZodDefault<z.ZodNumber>;
@@ -113,6 +114,7 @@ export declare const ConfigSchema: z.ZodObject<{
         credentialMaxTtlMinutes: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         dynamicTargetsEnabled: boolean;
+        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
         credentialIdleTtlMinutes: number;
@@ -120,6 +122,7 @@ export declare const ConfigSchema: z.ZodObject<{
         approvalSecretPath?: string | undefined;
     }, {
         dynamicTargetsEnabled?: boolean | undefined;
+        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;
@@ -362,6 +365,7 @@ export declare const ConfigSchema: z.ZodObject<{
     };
     security: {
         dynamicTargetsEnabled: boolean;
+        recycleBinRestoreEnabled: boolean;
         requireTls: boolean;
         approvalTtlSeconds: number;
         credentialIdleTtlMinutes: number;
@@ -454,6 +458,7 @@ export declare const ConfigSchema: z.ZodObject<{
     } | undefined;
     security?: {
         dynamicTargetsEnabled?: boolean | undefined;
+        recycleBinRestoreEnabled?: boolean | undefined;
         requireTls?: boolean | undefined;
         approvalSecretPath?: string | undefined;
         approvalTtlSeconds?: number | undefined;

package/dist/config/schema.js

@@ -22,7 +22,8 @@ const AuditSchema = z
     .default({});
 const SecuritySchema = z
     .object({
-    dynamicTargetsEnabled: z.boolean().default(false),
+    dynamicTargetsEnabled: z.boolean().default(true),
+    recycleBinRestoreEnabled: z.boolean().default(true),
     requireTls: z.boolean().default(true),
     approvalSecretPath: z.string().min(1).optional(),
     approvalTtlSeconds: z.number().int().positive().max(3600).default(300),

package/dist/engine.d.ts

@@ -5,11 +5,12 @@ import type { CapabilitySnapshot, FeatureMatrix, KernelInfo } from "./capability
 import { type Config } from "./config/index.js";
 import type { DatasourceResolveInput, DatasourceResolver, SessionContext } from "./context/session-context.js";
 import { type ConnectionPool } from "./executor/connection-pool.js";
-import { type CancelResult, type ExplainResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
+import { type CancelResult, type ExplainResult, type MutationOptions, type MutationResult, type QueryResult, type QueryStatus, type ReadonlyOptions, type SqlExecutor } from "./executor/sql-executor.js";
 import { type ConfirmationStore, type ConfirmationRequest, type ConfirmationValidationResult } from "./safety/confirmation-store.js";
 import { type Guardrail, type GuardrailDecision, type InspectInput } from "./safety/guardrail.js";
 import { type DatabaseInfo, type SchemaIntrospector, type TableInfo, type TableSchema } from "./schema/introspector.js";
 import { type FlashbackInput } from "./taurus/flashback.js";
+import type { RestoreRecycleBinTableInput } from "./taurus/recycle-bin.js";
 import { type DbHotspotResult, type DiagnoseDbHotspotInput, type DiagnoseServiceLatencyInput, type FindTopSlowSqlInput, type FindTopSlowSqlResult, type DiagnoseConnectionSpikeInput, type DiagnoseLockContentionInput, type DiagnoseSlowQueryInput, type DiagnoseStoragePressureInput, type DiagnoseReplicationLagInput, type DiagnosticResult, type ServiceLatencyResult } from "./diagnostics/types.js";
 import { type SlowSqlSource } from "./diagnostics/slow-sql-source.js";
 import { type MetricsSource } from "./diagnostics/metrics-source.js";
@@ -66,6 +67,7 @@ export declare class TaurusDBEngine {
     executeReadonly(sql: string, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     flashbackQuery(input: FlashbackInput, ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
     listRecycleBin(ctx: SessionContext, opts?: ReadonlyOptions): Promise<QueryResult>;
+    restoreRecycleBinTable(input: RestoreRecycleBinTableInput, ctx: SessionContext, opts?: MutationOptions): Promise<MutationResult>;
     getQueryStatus(queryId: string): Promise<QueryStatus>;
     cancelQuery(queryId: string): Promise<CancelResult>;
     issueConfirmation(input: IssueConfirmationInput): Promise<ConfirmationRequest>;

package/dist/engine.js

@@ -18,7 +18,7 @@ import { createSlowSqlSource, } from "./diagnostics/slow-sql-source.js";
 import { createMetricsSource, } from "./diagnostics/metrics-source.js";
 import { findLatestDeadlock, findMetadataLockWaits, findStatementDigestCandidatesForSqlHints, findStatementDigestSample, findStatementDigestSampleForSql, findStatementWaitEvents, findStorageStatementDigests, findTableStorageStats, findTopStatementDigests, isPerformanceSchemaEnabled, showLockWaits, showProcesslist, } from "./engine/data-access.js";
 import { diagnoseConnectionSpike, diagnoseDbHotspot, diagnoseLockContention, diagnoseServiceLatency, diagnoseSlowQuery, diagnoseStoragePressure, findTopSlowSql, } from "./engine/diagnostics.js";
-import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, validateConfirmation, } from "./engine/runtime.js";
+import { cancelQuery, close, executeReadonly, explain, explainEnhanced, flashbackQuery, getQueryStatus, handleConfirmation, issueConfirmation, listRecycleBin, restoreRecycleBinTable, validateConfirmation, } from "./engine/runtime.js";
 async function readMutationApprovalSecret(filePath) {
     const info = await lstat(filePath);
     if (!info.isFile() || info.isSymbolicLink()) {
@@ -251,6 +251,9 @@ export class TaurusDBEngine {
     async listRecycleBin(ctx, opts) {
         return listRecycleBin(this, ctx, opts);
     }
+    async restoreRecycleBinTable(input, ctx, opts) {
+        return restoreRecycleBinTable(this, input, ctx, opts);
+    }
     async getQueryStatus(queryId) {
         return getQueryStatus(this, queryId);
     }

package/dist/executor/connection-pool.js

@@ -39,11 +39,10 @@ async function resolveTls(tls, secretResolver, host, requireTls) {
     }
     return resolved;
 }
-function selectCredential(profile, mode) {
-    const credential = mode === "rw" ? profile.mutationUser : profile.user;
+function selectCredential(profile, _mode) {
+    const credential = profile.user;
     if (!credential) {
-        const credentialKind = mode === "rw" ? "mutation" : "read-only";
-        throw new ConnectionPoolError(`Datasource "${profile.name}" does not define ${credentialKind} SQL credentials. Configure a dedicated ${credentialKind} database username and password reference.`);
+        throw new ConnectionPoolError(`Datasource "${profile.name}" has no active SQL credential session. Select a TaurusDB instance and open the returned local login URL, or call begin_sql_login.`);
     }
     return credential;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-core",
-  "version": "0.5.0-rc.3",
+  "version": "0.5.0-rc.5",
   "description": "Shared TaurusDB data-plane engine for schema, SQL execution, guardrails, and diagnostics.",
   "license": "MIT",
   "repository": {