taurusdb-mcp 0.3.0 → 0.4.0

package/README.md

@@ -38,7 +38,7 @@ claude mcp add huaweicloud-taurusdb \
   -e TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
   -e TAURUSDB_SQL_DATABASE=<your-database> \
   -e TAURUSDB_SQL_USER=<your-readonly-user> \
-  -e TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  -e TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -51,7 +51,7 @@ codex mcp add huaweicloud-taurusdb \
   --env TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
   --env TAURUSDB_SQL_DATABASE=<your-database> \
   --env TAURUSDB_SQL_USER=<your-readonly-user> \
-  --env TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  --env TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -63,7 +63,17 @@ npx taurusdb-mcp init --client cursor
 npx taurusdb-mcp init --client vscode
 ```
 
+Configure and verify the operating-system credential store:
+
+```bash
+npx taurusdb-mcp credentials configure
+npx taurusdb-mcp credentials check
+```
+
 ## Notes
 
 - Requires Node.js `>= 20`
 - Depends on `taurusdb-core`
+- Database passwords support `env:`, `file:`, `hw-csms:`, `hw-kms:`, and `hw-kms-file:` references
+- Huawei DEW CSMS is recommended when the database password should be stored and retrieved from Huawei Cloud
+- macOS Keychain, Linux Secret Service, or Windows Credential Manager cloud identity is enabled with `TAURUSDB_CLOUD_KEYCHAIN_SERVICE`

package/dist/commands/credentials.d.ts

@@ -0,0 +1,3 @@
+export declare function runCredentialsConfigure(args: string[]): number;
+export declare function runCredentialsCheck(args: string[]): Promise<number>;
+export declare function runCredentials(args: string[]): Promise<number>;

package/dist/commands/credentials.js

@@ -0,0 +1,190 @@
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { canAuthenticateHuaweiCloudRequests, createConfigFromEnv, createHuaweiCsmsSecretResolver, createHuaweiKmsSecretResolver, createSqlProfileLoader, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "taurusdb-core";
+function readOption(args, name, fallback) {
+    const index = args.indexOf(name);
+    if (index === -1) {
+        return fallback;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    return value;
+}
+function configureUsage() {
+    return `Usage: taurusdb-mcp credentials configure [options]
+
+Options:
+  --service <name>         Credential service prefix (default: taurusdb-mcp/huaweicloud)
+  --account <name>         Credential account (default: default)
+  --with-security-token    Also store a temporary security token`;
+}
+function checkUsage() {
+    return `Usage: taurusdb-mcp credentials check
+
+Checks the configured Huawei Cloud identity and cloud-backed database password
+references without printing or connecting with any secret values.`;
+}
+function runCommand(command, args, errorMessage) {
+    const result = spawnSync(command, args, { stdio: "inherit" });
+    if (result.error && "code" in result.error && result.error.code === "ENOENT") {
+        throw new Error(`${command} was not found.`);
+    }
+    if (result.status !== 0) {
+        throw new Error(errorMessage);
+    }
+}
+function storeMacOsSecret(service, account, label) {
+    process.stderr.write(`Enter ${label} in the macOS Keychain prompt.\n`);
+    runCommand("security", ["add-generic-password", "-U", "-s", service, "-a", account, "-w"], `Failed to store ${label} in macOS Keychain.`);
+}
+function storeLinuxSecret(service, account, key, label) {
+    process.stderr.write(`Enter ${label} when prompted by Linux Secret Service.\n`);
+    runCommand("secret-tool", [
+        "store",
+        `--label=TaurusDB MCP Huawei Cloud ${label}`,
+        "service",
+        service,
+        "account",
+        account,
+        "key",
+        key,
+    ], `Failed to store ${label} in Linux Secret Service.`);
+}
+function configureWindows(service, account, withSecurityToken) {
+    const scriptPath = fileURLToPath(new URL("../../scripts/windows-credential-configure.ps1", import.meta.url));
+    const args = [
+        "-NoLogo",
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        path.normalize(scriptPath),
+        "-Service",
+        service,
+        "-Account",
+        account,
+    ];
+    if (withSecurityToken) {
+        args.push("-WithSecurityToken");
+    }
+    runCommand("powershell.exe", args, "Failed to store credentials in Windows Credential Manager.");
+}
+export function runCredentialsConfigure(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${configureUsage()}\n`);
+        return 0;
+    }
+    const service = readOption(args, "--service", "taurusdb-mcp/huaweicloud");
+    const account = readOption(args, "--account", "default");
+    const withSecurityToken = args.includes("--with-security-token");
+    if (process.platform === "darwin") {
+        storeMacOsSecret(`${service}/access-key-id`, account, "Huawei Cloud access key ID");
+        storeMacOsSecret(`${service}/secret-access-key`, account, "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeMacOsSecret(`${service}/security-token`, account, "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "linux") {
+        storeLinuxSecret(service, account, "access-key-id", "Huawei Cloud access key ID");
+        storeLinuxSecret(service, account, "secret-access-key", "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeLinuxSecret(service, account, "security-token", "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "win32") {
+        configureWindows(service, account, withSecurityToken);
+    }
+    else {
+        throw new Error(`System credential storage is not supported on platform "${process.platform}".`);
+    }
+    process.stdout.write(`Stored Huawei Cloud credentials in service "${service}" for account "${account}".\n`);
+    return 0;
+}
+function printResult(ok, title, details) {
+    process.stdout.write(`${ok ? "[ok]" : "[fail]"} ${title}${details ? `: ${details}` : ""}\n`);
+}
+async function check(title, action) {
+    try {
+        printResult(true, title, await action());
+        return true;
+    }
+    catch (error) {
+        printResult(false, title, error instanceof Error ? error.message : String(error));
+        return false;
+    }
+}
+function getCloudResolver(uri, config) {
+    const normalized = uri.startsWith("uri:") ? uri.slice("uri:".length) : uri;
+    if (normalized.startsWith("hw-csms:")) {
+        return { kind: "CSMS", resolve: () => createHuaweiCsmsSecretResolver({ config })(normalized) };
+    }
+    if (normalized.startsWith("hw-kms:") || normalized.startsWith("hw-kms-file:")) {
+        return { kind: "KMS", resolve: () => createHuaweiKmsSecretResolver({ config })(normalized) };
+    }
+    return undefined;
+}
+export async function runCredentialsCheck(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${checkUsage()}\n`);
+        return 0;
+    }
+    const config = createConfigFromEnv(process.env);
+    const auth = getHuaweiCloudAuthFromConfig(config);
+    let failed = false;
+    failed ||= !(await check("Huawei Cloud identity source", async () => {
+        if (auth.authToken)
+            return "IAM token configured";
+        if (auth.accessKeyId && auth.secretAccessKey)
+            return "AK/SK configured in environment";
+        if (auth.credentialProvider) {
+            await auth.credentialProvider();
+            return "system credential store readable";
+        }
+        if (!canAuthenticateHuaweiCloudRequests(auth)) {
+            throw new Error("No IAM token, AK/SK, or system credential store is configured.");
+        }
+        return "configured";
+    }));
+    if (!failed) {
+        failed ||= !(await check("Huawei Cloud project", async () => {
+            const projectId = await resolveHuaweiCloudProjectId(auth);
+            if (!projectId) {
+                throw new Error("Project ID could not be resolved.");
+            }
+            return config.cloud.projectId ? "configured" : "resolved through IAM";
+        }));
+    }
+    const profiles = await createSqlProfileLoader({ config }).load();
+    const cloudRefs = [...profiles.values()]
+        .map((profile) => profile.user?.password)
+        .filter((ref) => ref?.type === "uri")
+        .map((ref) => getCloudResolver(ref.uri, config))
+        .filter((resolver) => resolver !== undefined);
+    if (cloudRefs.length === 0) {
+        printResult(true, "Cloud-backed database password references", "none configured; skipped");
+    }
+    else if (!failed) {
+        for (const resolver of cloudRefs) {
+            const readable = await check(`${resolver.kind} database password reference`, async () => {
+                await resolver.resolve();
+                return "readable";
+            });
+            failed ||= !readable;
+        }
+    }
+    return failed ? 1 : 0;
+}
+export async function runCredentials(args) {
+    const command = args[0];
+    if (command === "configure") {
+        return runCredentialsConfigure(args.slice(1));
+    }
+    if (command === "check") {
+        return runCredentialsCheck(args.slice(1));
+    }
+    process.stderr.write("Usage: taurusdb-mcp credentials <configure|check>\n");
+    return 1;
+}

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { runInit } from "./commands/init.js";
+import { runCredentials } from "./commands/credentials.js";
 import { startMcpServer } from "./server.js";
 import { VERSION } from "./version.js";
 async function main() {
@@ -9,6 +10,10 @@ async function main() {
         process.exitCode = await runInit(args.slice(1));
         return;
     }
+    if (firstArg === "credentials") {
+        process.exitCode = await runCredentials(args.slice(1));
+        return;
+    }
     if (firstArg === "--version" || firstArg === "-v") {
         process.stdout.write(`${VERSION}\n`);
         return;

package/dist/server.d.ts

@@ -1,11 +1,9 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { TaurusDBEngine, type Config, type RuntimeTargetProfileLoader } from "taurusdb-core";
-import { type CredentialLoginService } from "./security/local-credential-login.js";
 export interface ServerDeps {
     config: Config;
     profileLoader: RuntimeTargetProfileLoader;
     engine: TaurusDBEngine;
-    credentialLogin: CredentialLoginService;
     pingResponse: string;
 }
 export declare function bootstrapDependencies(): Promise<ServerDeps>;

package/dist/server.js

@@ -4,7 +4,6 @@ import { createSqlProfileLoader, getConfig, RuntimeOverrideProfileLoader, redact
 import { registerTools } from "./tools/registry.js";
 import { logger } from "taurusdb-core";
 import { VERSION } from "./version.js";
-import { LocalCredentialLoginService, } from "./security/local-credential-login.js";
 export async function bootstrapDependencies() {
     const config = getConfig();
     const profileLoader = new RuntimeOverrideProfileLoader(createSqlProfileLoader({ config }));
@@ -13,7 +12,6 @@ export async function bootstrapDependencies() {
         config,
         profileLoader,
         engine,
-        credentialLogin: new LocalCredentialLoginService(),
         pingResponse: "pong",
     };
 }
@@ -24,10 +22,7 @@ export function createServer(deps) {
     });
     let cleanupPromise;
     const cleanup = () => {
-        cleanupPromise ??= Promise.all([
-            deps.credentialLogin.close(),
-            deps.engine.close(),
-        ]).then(() => undefined);
+        cleanupPromise ??= deps.engine.close();
         return cleanupPromise;
     };
     server.server.onclose = () => {

package/dist/tools/registry.js

@@ -4,8 +4,7 @@ import { describeTableTool, listDatabasesTool, listTablesTool, } from "./discove
 import { showProcesslistTool } from "./processlist.js";
 import { pingTool } from "./ping.js";
 import { getKernelInfoTool, listTaurusFeaturesTool } from "./taurus/capability.js";
-import { clearSqlCredentialsTool, getSessionBindingTool, selectCloudTaurusInstanceTool, setCloudRegionTool, setDefaultDatabaseTool, } from "./taurus/cloud-context.js";
-import { beginSqlLoginTool } from "./taurus/sql-login.js";
+import { getSessionBindingTool, selectCloudTaurusInstanceTool, setCloudRegionTool, setDefaultDatabaseTool, } from "./taurus/cloud-context.js";
 import { listCloudTaurusInstancesTool } from "./taurus/cloud-instances.js";
 import { diagnosticToolDefinitions } from "./taurus/diagnostics.js";
 import { explainSqlEnhancedTool } from "./taurus/explain.js";
@@ -69,8 +68,6 @@ export const capabilityToolDefinitions = [
     listTaurusFeaturesTool,
     setCloudRegionTool,
     getSessionBindingTool,
-    beginSqlLoginTool,
-    clearSqlCredentialsTool,
     setDefaultDatabaseTool,
     listCloudTaurusInstancesTool,
     selectCloudTaurusInstanceTool,

package/dist/tools/taurus/cloud-context.d.ts

@@ -1,6 +1,5 @@
 import type { ToolDefinition } from "../registry.js";
 export declare const setCloudRegionTool: ToolDefinition;
 export declare const setDefaultDatabaseTool: ToolDefinition;
-export declare const clearSqlCredentialsTool: ToolDefinition;
 export declare const getSessionBindingTool: ToolDefinition;
 export declare const selectCloudTaurusInstanceTool: ToolDefinition;

package/dist/tools/taurus/cloud-context.js

@@ -75,6 +75,7 @@ export const setCloudRegionTool = {
             deps.config.cloud.region = region;
             deps.config.cloud.apiEndpoint = buildHuaweiCloudEndpoint("gaussdb", region, domainSuffix);
             deps.config.cloud.iamEndpoint = buildHuaweiCloudEndpoint("iam", region, domainSuffix);
+            deps.config.cloud.kmsEndpoint = buildHuaweiCloudEndpoint("kms", region, domainSuffix);
             deps.config.slowSqlSource.taurusApi.endpoint = buildHuaweiCloudEndpoint("gaussdb", region, domainSuffix);
             deps.config.slowSqlSource.das.endpoint = buildHuaweiCloudEndpoint("das", region, domainSuffix);
             deps.config.metricsSource.ces.endpoint = buildHuaweiCloudEndpoint("ces", region, domainSuffix);
@@ -84,6 +85,7 @@ export const setCloudRegionTool = {
                 region,
                 api_endpoint: deps.config.cloud.apiEndpoint,
                 iam_endpoint: deps.config.cloud.iamEndpoint,
+                kms_endpoint: deps.config.cloud.kmsEndpoint,
             }, {
                 summary: `Cloud region switched to ${region}.`,
                 metadata: metadata(context.taskId),
@@ -160,47 +162,9 @@ export const setDefaultDatabaseTool = {
         }
     },
 };
-export const clearSqlCredentialsTool = {
-    name: "clear_sql_credentials",
-    description: "Clear any session-scoped SQL credential override for a datasource and fall back to the configured profile credentials.",
-    inputSchema: {
-        datasource: z
-            .string()
-            .trim()
-            .min(1)
-            .optional()
-            .describe("Optional datasource template to clear. Defaults to the current default datasource."),
-    },
-    async handler(input, deps, context) {
-        try {
-            const datasource = await resolveBindingDatasource(deps, typeof input.datasource === "string" ? input.datasource : undefined);
-            if (!datasource) {
-                throw new ToolInputError("No datasource selected. Configure a default datasource or pass datasource explicitly.");
-            }
-            const profile = await deps.profileLoader.get(datasource);
-            if (!profile) {
-                throw new ToolInputError(`Datasource "${datasource}" was not found.`);
-            }
-            deps.profileLoader.clearRuntimeUser(datasource);
-            await reloadEngine(deps);
-            return formatSuccess({
-                datasource,
-            }, {
-                summary: `Session SQL credential override cleared for ${datasource}.`,
-                metadata: metadata(context.taskId),
-            });
-        }
-        catch (error) {
-            return formatToolError(error, {
-                action: "clear_sql_credentials",
-                metadata: metadata(context.taskId),
-            });
-        }
-    },
-};
 export const getSessionBindingTool = {
     name: "get_session_binding",
-    description: "Return the current session binding for a datasource, including selected instance, host, database, and whether SQL credentials are overridden in memory.",
+    description: "Return the current session binding for a datasource, including selected instance, host, database, and configured database username.",
     inputSchema: {
         datasource: z
             .string()
@@ -232,8 +196,6 @@ export const getSessionBindingTool = {
                     host: target?.host,
                     port: target?.port,
                     database: target?.database,
-                    has_sql_credentials_override: Boolean(target?.user),
-                    username_masked: maskUsername(target?.user?.username),
                 },
             }, {
                 summary: `Returned current session binding for ${datasource}.`,

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.4.0";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.0";
+export const VERSION = "0.4.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taurusdb-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "TaurusDB MCP server for Claude, Cursor, VS Code, and other MCP clients.",
   "type": "module",
   "main": "dist/index.js",
@@ -22,17 +22,18 @@
     "taurusdb-mcp": "dist/index.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "scripts"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "taurusdb-core": "0.3.0",
+    "taurusdb-core": "0.4.0",
     "@modelcontextprotocol/sdk": "^1.17.0",
     "mysql2": "^3.22.1",
     "zod": "^3.24.1"

package/scripts/windows-credential-configure.ps1

@@ -0,0 +1,51 @@
+param(
+  [Parameter(Mandatory = $true)][string]$Service,
+  [Parameter(Mandatory = $true)][string]$Account,
+  [switch]$WithSecurityToken
+)
+
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class TaurusCredentialWriter {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Credential {
+    public UInt32 Flags; public UInt32 Type; public string TargetName; public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public UInt32 CredentialBlobSize; public IntPtr CredentialBlob; public UInt32 Persist;
+    public UInt32 AttributeCount; public IntPtr Attributes; public string TargetAlias; public string UserName;
+  }
+  [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  public static extern bool CredWrite(ref Credential credential, UInt32 flags);
+}
+'@
+
+function Save-CredentialValue([string]$Key, [string]$Label) {
+  $secure = Read-Host "Enter $Label" -AsSecureString
+  $pointer = [Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($secure)
+  try {
+    $value = [Runtime.InteropServices.Marshal]::PtrToStringUni($pointer)
+    $bytes = [Text.Encoding]::Unicode.GetBytes($value)
+    $blob = [Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length)
+    try {
+      [Runtime.InteropServices.Marshal]::Copy($bytes, 0, $blob, $bytes.Length)
+      $credential = New-Object TaurusCredentialWriter+Credential
+      $credential.Type = 1
+      $credential.TargetName = "$Service/$Account/$Key"
+      $credential.CredentialBlobSize = $bytes.Length
+      $credential.CredentialBlob = $blob
+      $credential.Persist = 2
+      $credential.UserName = $Account
+      if (-not [TaurusCredentialWriter]::CredWrite([ref]$credential, 0)) { throw "CredWriteW failed." }
+    } finally {
+      [Runtime.InteropServices.Marshal]::FreeHGlobal($blob)
+      [Array]::Clear($bytes, 0, $bytes.Length)
+    }
+  } finally {
+    [Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($pointer)
+  }
+}
+
+Save-CredentialValue "access-key-id" "Huawei Cloud access key ID"
+Save-CredentialValue "secret-access-key" "Huawei Cloud secret access key"
+if ($WithSecurityToken) { Save-CredentialValue "security-token" "Huawei Cloud security token" }

package/dist/security/local-credential-login.d.ts

@@ -1,33 +0,0 @@
-export type SqlLoginCredentials = {
-    datasource: string;
-    username: string;
-    password: string;
-};
-export type SqlLoginRequest = {
-    datasource: string;
-    bind: (credentials: SqlLoginCredentials) => Promise<void>;
-};
-export type IssuedSqlLogin = {
-    loginUrl: string;
-    expiresAt: string;
-};
-export interface CredentialLoginService {
-    issueSqlLogin(request: SqlLoginRequest): Promise<IssuedSqlLogin>;
-    close(): Promise<void>;
-}
-export type LocalCredentialLoginServiceOptions = {
-    now?: () => number;
-    tokenTtlMs?: number;
-};
-export declare class LocalCredentialLoginService implements CredentialLoginService {
-    private readonly now;
-    private readonly tokenTtlMs;
-    private readonly pending;
-    private server;
-    private port;
-    constructor(options?: LocalCredentialLoginServiceOptions);
-    issueSqlLogin(request: SqlLoginRequest): Promise<IssuedSqlLogin>;
-    close(): Promise<void>;
-    private ensureStarted;
-    private handle;
-}

package/dist/security/local-credential-login.js

@@ -1,156 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { createServer, } from "node:http";
-const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000;
-const MAX_REQUEST_BODY_BYTES = 16 * 1024;
-function page(title, message, form = false) {
-    const formHtml = form
-        ? `<form method="post">
-  <label>Database username <input name="username" autocomplete="username" required></label>
-  <label>Database password <input name="password" type="password" autocomplete="current-password" required></label>
-  <button type="submit">Connect</button>
-</form>`
-        : "";
-    return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${title}</title>
-  <style>
-    body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto; padding: 0 1rem; }
-    form { display: grid; gap: 1rem; }
-    label { display: grid; gap: .35rem; }
-    input, button { font: inherit; padding: .65rem; }
-  </style>
-</head>
-<body>
-  <h1>${title}</h1>
-  <p>${message}</p>
-  ${formHtml}
-</body>
-</html>`;
-}
-function respond(res, status, body) {
-    res.writeHead(status, {
-        "cache-control": "no-store",
-        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
-        "content-type": "text/html; charset=utf-8",
-        "referrer-policy": "no-referrer",
-        "x-content-type-options": "nosniff",
-    });
-    res.end(body);
-}
-async function readBody(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buffer.length;
-        if (size > MAX_REQUEST_BODY_BYTES) {
-            throw new Error("Request body is too large.");
-        }
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks).toString("utf8");
-}
-export class LocalCredentialLoginService {
-    now;
-    tokenTtlMs;
-    pending = new Map();
-    server;
-    port;
-    constructor(options = {}) {
-        this.now = options.now ?? Date.now;
-        this.tokenTtlMs = options.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
-    }
-    async issueSqlLogin(request) {
-        await this.ensureStarted();
-        const token = randomBytes(32).toString("base64url");
-        const expiresAtMs = this.now() + this.tokenTtlMs;
-        this.pending.set(token, { ...request, expiresAtMs });
-        return {
-            loginUrl: `http://127.0.0.1:${this.port}/sql-login/${token}`,
-            expiresAt: new Date(expiresAtMs).toISOString(),
-        };
-    }
-    async close() {
-        this.pending.clear();
-        const server = this.server;
-        this.server = undefined;
-        this.port = undefined;
-        if (!server) {
-            return;
-        }
-        await new Promise((resolve, reject) => {
-            server.close((error) => (error ? reject(error) : resolve()));
-        });
-    }
-    async ensureStarted() {
-        if (this.server) {
-            return;
-        }
-        const server = createServer((req, res) => {
-            void this.handle(req, res);
-        });
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(0, "127.0.0.1", () => {
-                server.off("error", reject);
-                resolve();
-            });
-        });
-        const address = server.address();
-        if (!address || typeof address === "string") {
-            await new Promise((resolve) => server.close(() => resolve()));
-            throw new Error("Unable to resolve local credential login address.");
-        }
-        this.server = server;
-        this.port = address.port;
-    }
-    async handle(req, res) {
-        try {
-            const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            const match = url.pathname.match(/^\/sql-login\/([^/]+)$/);
-            const token = match?.[1];
-            const pending = token ? this.pending.get(token) : undefined;
-            if (!token || !pending || pending.expiresAtMs <= this.now()) {
-                if (token) {
-                    this.pending.delete(token);
-                }
-                respond(res, 410, page("Invalid login link", "This login link is invalid or has expired."));
-                return;
-            }
-            if (req.method === "GET") {
-                respond(res, 200, page("Connect to TaurusDB", "Enter your database credentials.", true));
-                return;
-            }
-            if (req.method !== "POST") {
-                respond(res, 405, page("Unsupported request", "Use the login form to continue."));
-                return;
-            }
-            const form = new URLSearchParams(await readBody(req));
-            const username = form.get("username")?.trim() ?? "";
-            const password = form.get("password") ?? "";
-            if (!username || !password) {
-                respond(res, 400, page("Connect to TaurusDB", "Username and password are required.", true));
-                return;
-            }
-            this.pending.delete(token);
-            try {
-                await pending.bind({
-                    datasource: pending.datasource,
-                    username,
-                    password,
-                });
-            }
-            catch {
-                respond(res, 500, page("Connection failed", "Credentials could not be bound to this session."));
-                return;
-            }
-            respond(res, 200, page("Connected", "Database credentials are now active for this MCP session."));
-        }
-        catch {
-            respond(res, 400, page("Invalid request", "The login request could not be processed."));
-        }
-    }
-}

package/dist/tools/taurus/sql-login.d.ts

@@ -1,2 +0,0 @@
-import type { ToolDefinition } from "../registry.js";
-export declare const beginSqlLoginTool: ToolDefinition;

package/dist/tools/taurus/sql-login.js

@@ -1,70 +0,0 @@
-import { TaurusDBEngine } from "taurusdb-core";
-import { z } from "zod";
-import { formatSuccess } from "../../utils/formatter.js";
-import { metadata } from "../common.js";
-import { formatToolError, ToolInputError } from "../error-handling.js";
-export const beginSqlLoginTool = {
-    name: "begin_sql_login",
-    description: "Create a short-lived local login URL where the user can enter SQL credentials without sending the password through the Agent or MCP tool arguments.",
-    inputSchema: {
-        datasource: z
-            .string()
-            .trim()
-            .min(1)
-            .optional()
-            .describe("Optional datasource template. Defaults to the current default datasource."),
-    },
-    async handler(input, deps, context) {
-        try {
-            const explicit = typeof input.datasource === "string" ? input.datasource.trim() : "";
-            const datasource = explicit || (await deps.engine.getDefaultDataSource());
-            if (!datasource) {
-                throw new ToolInputError("No datasource selected. Configure a default datasource or pass datasource explicitly.");
-            }
-            const profile = await deps.profileLoader.get(datasource);
-            if (!profile) {
-                throw new ToolInputError(`Datasource "${datasource}" was not found.`);
-            }
-            const issued = await deps.credentialLogin.issueSqlLogin({
-                datasource,
-                bind: async ({ username, password }) => {
-                    const currentTarget = deps.profileLoader.getRuntimeTarget(datasource);
-                    deps.profileLoader.setRuntimeTarget(datasource, {
-                        host: currentTarget?.host ?? profile.host,
-                        port: currentTarget?.port ?? profile.port,
-                        database: currentTarget?.database ?? profile.database,
-                        instanceId: currentTarget?.instanceId,
-                        nodeId: currentTarget?.nodeId,
-                        user: {
-                            username,
-                            password: { type: "plain", value: password },
-                        },
-                    });
-                    const nextEngine = await TaurusDBEngine.create({
-                        config: deps.config,
-                        profileLoader: deps.profileLoader,
-                    });
-                    const previousEngine = deps.engine;
-                    deps.engine = nextEngine;
-                    if (previousEngine?.close) {
-                        await previousEngine.close();
-                    }
-                },
-            });
-            return formatSuccess({
-                datasource,
-                login_url: issued.loginUrl,
-                expires_at: issued.expiresAt,
-            }, {
-                summary: `Created a secure local SQL login link for ${datasource}.`,
-                metadata: metadata(context.taskId),
-            });
-        }
-        catch (error) {
-            return formatToolError(error, {
-                action: "begin_sql_login",
-                metadata: metadata(context.taskId),
-            });
-        }
-    },
-};