taurusdb-mcp 0.3.0 → 0.5.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TaurusDB MCP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -28,17 +28,27 @@ Use this command in MCP client configs:
 }
 ```
 
+Configure Huawei Cloud identity through the operating-system credential store
+before adding the server. AK/SK values should not be copied into MCP client
+configuration:
+
+```bash
+npx -y taurusdb-mcp credentials configure
+TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  npx -y taurusdb-mcp credentials check
+```
+
 Claude Code:
 
 ```bash
 claude mcp add huaweicloud-taurusdb \
   --transport stdio \
   -e TAURUSDB_CLOUD_REGION=<your-region> \
-  -e TAURUSDB_CLOUD_ACCESS_KEY_ID=<your-ak> \
-  -e TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
+  -e TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  -e TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
   -e TAURUSDB_SQL_DATABASE=<your-database> \
   -e TAURUSDB_SQL_USER=<your-readonly-user> \
-  -e TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  -e TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -47,11 +57,11 @@ Codex:
 ```bash
 codex mcp add huaweicloud-taurusdb \
   --env TAURUSDB_CLOUD_REGION=<your-region> \
-  --env TAURUSDB_CLOUD_ACCESS_KEY_ID=<your-ak> \
-  --env TAURUSDB_CLOUD_SECRET_ACCESS_KEY=<your-sk> \
+  --env TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
+  --env TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
   --env TAURUSDB_SQL_DATABASE=<your-database> \
   --env TAURUSDB_SQL_USER=<your-readonly-user> \
-  --env TAURUSDB_SQL_PASSWORD=<your-readonly-password> \
+  --env TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -63,7 +73,43 @@ npx taurusdb-mcp init --client cursor
 npx taurusdb-mcp init --client vscode
 ```
 
+Configure and verify the operating-system credential store:
+
+```bash
+npx taurusdb-mcp credentials configure
+npx taurusdb-mcp credentials check
+```
+
 ## Notes
 
 - Requires Node.js `>= 20`
 - Depends on `taurusdb-core`
+- Database passwords support `env:`, `file:`, `hw-csms:`, `hw-kms:`, and `hw-kms-file:` references
+- Huawei DEW CSMS is recommended when the database password should be stored and retrieved from Huawei Cloud
+- macOS Keychain, Linux Secret Service, or Windows Credential Manager cloud identity is enabled with `TAURUSDB_CLOUD_KEYCHAIN_SERVICE`
+- SQL TLS with certificate verification is required by default
+- Mutation and dynamic-target tools are disabled by default
+- Mutation tools require a dedicated `TAURUSDB_SQL_MUTATION_USER` /
+  `TAURUSDB_SQL_MUTATION_PASSWORD` pair and an external operator-signed approval
+- MCP audit events are written to `~/.taurusdb-mcp/audit.jsonl` by default, with
+  configurable size rotation for collection into centralized immutable storage
+- Run one stdio process per customer/client trust boundary; this package is not
+  a shared multi-tenant HTTP service
+
+Enable mutations only when required:
+
+```bash
+export TAURUSDB_ENABLE_MUTATIONS=true
+export TAURUSDB_SQL_MUTATION_USER='<dedicated-writer>'
+export TAURUSDB_SQL_MUTATION_PASSWORD='hw-csms:<writer-secret-name>'
+export TAURUSDB_MUTATION_APPROVAL_SECRET_FILE='/run/secrets/taurusdb-approval'
+```
+
+Sign a returned `approval_request` outside the MCP client:
+
+```bash
+npx taurusdb-mcp approve \
+  --request '<approval_request>' \
+  --actor '<operator-identity>' \
+  --secret-file /run/secrets/taurusdb-approval
+```

package/dist/commands/approve.d.ts

@@ -0,0 +1 @@
+export declare function runApprove(args: string[]): Promise<number>;

package/dist/commands/approve.js

@@ -0,0 +1,66 @@
+import { readFile, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { signApprovalRequest } from "taurusdb-core";
+function readOption(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1) {
+        return undefined;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    return value;
+}
+function expandTilde(input) {
+    if (input === "~") {
+        return os.homedir();
+    }
+    return input.startsWith("~/") ? path.join(os.homedir(), input.slice(2)) : input;
+}
+function usage() {
+    return `Usage: taurusdb-mcp approve --request <approval-request> --actor <identity> [options]
+
+Options:
+  --secret-file <path>  Approval secret file; defaults to
+                        TAURUSDB_MUTATION_APPROVAL_SECRET_FILE
+  --request <value>     approval_request returned by a mutation tool
+  --actor <identity>    Human approver identity recorded in the signed token
+
+The command prints a one-time approval_token. Run it outside the MCP client
+after reviewing the SQL hash, datasource, database, risk, and expiry encoded
+in approval_request.`;
+}
+async function readProtectedSecret(filePath) {
+    const resolved = expandTilde(filePath);
+    const info = await stat(resolved);
+    if (!info.isFile()) {
+        throw new Error("Mutation approval secret path must reference a regular file.");
+    }
+    if (process.platform !== "win32" && (info.mode & 0o077) !== 0) {
+        throw new Error("Mutation approval secret file must not be accessible by group or other users.");
+    }
+    const secret = (await readFile(resolved, "utf8")).trim();
+    if (Buffer.byteLength(secret, "utf8") < 32) {
+        throw new Error("Mutation approval secret must contain at least 32 bytes.");
+    }
+    return secret;
+}
+export async function runApprove(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${usage()}\n`);
+        return 0;
+    }
+    const request = readOption(args, "--request");
+    const actor = readOption(args, "--actor");
+    const secretFile = readOption(args, "--secret-file") ??
+        process.env.TAURUSDB_MUTATION_APPROVAL_SECRET_FILE?.trim();
+    if (!request || !actor || !secretFile) {
+        process.stderr.write(`${usage()}\n`);
+        return 2;
+    }
+    const secret = await readProtectedSecret(secretFile);
+    process.stdout.write(`${signApprovalRequest(request, actor, secret)}\n`);
+    return 0;
+}

package/dist/commands/credentials.d.ts

@@ -0,0 +1,3 @@
+export declare function runCredentialsConfigure(args: string[]): number;
+export declare function runCredentialsCheck(args: string[]): Promise<number>;
+export declare function runCredentials(args: string[]): Promise<number>;

package/dist/commands/credentials.js

@@ -0,0 +1,190 @@
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { canAuthenticateHuaweiCloudRequests, createConfigFromEnv, createHuaweiCsmsSecretResolver, createHuaweiKmsSecretResolver, createSqlProfileLoader, getHuaweiCloudAuthFromConfig, resolveHuaweiCloudProjectId, } from "taurusdb-core";
+function readOption(args, name, fallback) {
+    const index = args.indexOf(name);
+    if (index === -1) {
+        return fallback;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`${name} requires a value.`);
+    }
+    return value;
+}
+function configureUsage() {
+    return `Usage: taurusdb-mcp credentials configure [options]
+
+Options:
+  --service <name>         Credential service prefix (default: taurusdb-mcp/huaweicloud)
+  --account <name>         Credential account (default: default)
+  --with-security-token    Also store a temporary security token`;
+}
+function checkUsage() {
+    return `Usage: taurusdb-mcp credentials check
+
+Checks the configured Huawei Cloud identity and cloud-backed database password
+references without printing or connecting with any secret values.`;
+}
+function runCommand(command, args, errorMessage) {
+    const result = spawnSync(command, args, { stdio: "inherit" });
+    if (result.error && "code" in result.error && result.error.code === "ENOENT") {
+        throw new Error(`${command} was not found.`);
+    }
+    if (result.status !== 0) {
+        throw new Error(errorMessage);
+    }
+}
+function storeMacOsSecret(service, account, label) {
+    process.stderr.write(`Enter ${label} in the macOS Keychain prompt.\n`);
+    runCommand("security", ["add-generic-password", "-U", "-s", service, "-a", account, "-w"], `Failed to store ${label} in macOS Keychain.`);
+}
+function storeLinuxSecret(service, account, key, label) {
+    process.stderr.write(`Enter ${label} when prompted by Linux Secret Service.\n`);
+    runCommand("secret-tool", [
+        "store",
+        `--label=TaurusDB MCP Huawei Cloud ${label}`,
+        "service",
+        service,
+        "account",
+        account,
+        "key",
+        key,
+    ], `Failed to store ${label} in Linux Secret Service.`);
+}
+function configureWindows(service, account, withSecurityToken) {
+    const scriptPath = fileURLToPath(new URL("../../scripts/windows-credential-configure.ps1", import.meta.url));
+    const args = [
+        "-NoLogo",
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        path.normalize(scriptPath),
+        "-Service",
+        service,
+        "-Account",
+        account,
+    ];
+    if (withSecurityToken) {
+        args.push("-WithSecurityToken");
+    }
+    runCommand("powershell.exe", args, "Failed to store credentials in Windows Credential Manager.");
+}
+export function runCredentialsConfigure(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${configureUsage()}\n`);
+        return 0;
+    }
+    const service = readOption(args, "--service", "taurusdb-mcp/huaweicloud");
+    const account = readOption(args, "--account", "default");
+    const withSecurityToken = args.includes("--with-security-token");
+    if (process.platform === "darwin") {
+        storeMacOsSecret(`${service}/access-key-id`, account, "Huawei Cloud access key ID");
+        storeMacOsSecret(`${service}/secret-access-key`, account, "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeMacOsSecret(`${service}/security-token`, account, "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "linux") {
+        storeLinuxSecret(service, account, "access-key-id", "Huawei Cloud access key ID");
+        storeLinuxSecret(service, account, "secret-access-key", "Huawei Cloud secret access key");
+        if (withSecurityToken) {
+            storeLinuxSecret(service, account, "security-token", "Huawei Cloud security token");
+        }
+    }
+    else if (process.platform === "win32") {
+        configureWindows(service, account, withSecurityToken);
+    }
+    else {
+        throw new Error(`System credential storage is not supported on platform "${process.platform}".`);
+    }
+    process.stdout.write(`Stored Huawei Cloud credentials in service "${service}" for account "${account}".\n`);
+    return 0;
+}
+function printResult(ok, title, details) {
+    process.stdout.write(`${ok ? "[ok]" : "[fail]"} ${title}${details ? `: ${details}` : ""}\n`);
+}
+async function check(title, action) {
+    try {
+        printResult(true, title, await action());
+        return true;
+    }
+    catch (error) {
+        printResult(false, title, error instanceof Error ? error.message : String(error));
+        return false;
+    }
+}
+function getCloudResolver(uri, config) {
+    const normalized = uri.startsWith("uri:") ? uri.slice("uri:".length) : uri;
+    if (normalized.startsWith("hw-csms:")) {
+        return { kind: "CSMS", resolve: () => createHuaweiCsmsSecretResolver({ config })(normalized) };
+    }
+    if (normalized.startsWith("hw-kms:") || normalized.startsWith("hw-kms-file:")) {
+        return { kind: "KMS", resolve: () => createHuaweiKmsSecretResolver({ config })(normalized) };
+    }
+    return undefined;
+}
+export async function runCredentialsCheck(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(`${checkUsage()}\n`);
+        return 0;
+    }
+    const config = createConfigFromEnv(process.env);
+    const auth = getHuaweiCloudAuthFromConfig(config);
+    let failed = false;
+    failed ||= !(await check("Huawei Cloud identity source", async () => {
+        if (auth.authToken)
+            return "IAM token configured";
+        if (auth.accessKeyId && auth.secretAccessKey)
+            return "AK/SK configured in environment";
+        if (auth.credentialProvider) {
+            await auth.credentialProvider();
+            return "system credential store readable";
+        }
+        if (!canAuthenticateHuaweiCloudRequests(auth)) {
+            throw new Error("No IAM token, AK/SK, or system credential store is configured.");
+        }
+        return "configured";
+    }));
+    if (!failed) {
+        failed ||= !(await check("Huawei Cloud project", async () => {
+            const projectId = await resolveHuaweiCloudProjectId(auth);
+            if (!projectId) {
+                throw new Error("Project ID could not be resolved.");
+            }
+            return config.cloud.projectId ? "configured" : "resolved through IAM";
+        }));
+    }
+    const profiles = await createSqlProfileLoader({ config }).load();
+    const cloudRefs = [...profiles.values()]
+        .map((profile) => profile.user?.password)
+        .filter((ref) => ref?.type === "uri")
+        .map((ref) => getCloudResolver(ref.uri, config))
+        .filter((resolver) => resolver !== undefined);
+    if (cloudRefs.length === 0) {
+        printResult(true, "Cloud-backed database password references", "none configured; skipped");
+    }
+    else if (!failed) {
+        for (const resolver of cloudRefs) {
+            const readable = await check(`${resolver.kind} database password reference`, async () => {
+                await resolver.resolve();
+                return "readable";
+            });
+            failed ||= !readable;
+        }
+    }
+    return failed ? 1 : 0;
+}
+export async function runCredentials(args) {
+    const command = args[0];
+    if (command === "configure") {
+        return runCredentialsConfigure(args.slice(1));
+    }
+    if (command === "check") {
+        return runCredentialsCheck(args.slice(1));
+    }
+    process.stderr.write("Usage: taurusdb-mcp credentials <configure|check>\n");
+    return 1;
+}

package/dist/index.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { runInit } from "./commands/init.js";
+import { runCredentials } from "./commands/credentials.js";
+import { runApprove } from "./commands/approve.js";
 import { startMcpServer } from "./server.js";
 import { VERSION } from "./version.js";
 async function main() {
@@ -9,6 +11,14 @@ async function main() {
         process.exitCode = await runInit(args.slice(1));
         return;
     }
+    if (firstArg === "credentials") {
+        process.exitCode = await runCredentials(args.slice(1));
+        return;
+    }
+    if (firstArg === "approve") {
+        process.exitCode = await runApprove(args.slice(1));
+        return;
+    }
     if (firstArg === "--version" || firstArg === "-v") {
         process.stdout.write(`${VERSION}\n`);
         return;

package/dist/security/session-coordinator.d.ts

@@ -0,0 +1,9 @@
+export declare class SessionCoordinator {
+    private readers;
+    private writerActive;
+    private readonly readerQueue;
+    private readonly writerQueue;
+    runShared<T>(operation: () => Promise<T>): Promise<T>;
+    runExclusive<T>(operation: () => Promise<T>): Promise<T>;
+    private drain;
+}

package/dist/security/session-coordinator.js

@@ -0,0 +1,46 @@
+export class SessionCoordinator {
+    readers = 0;
+    writerActive = false;
+    readerQueue = [];
+    writerQueue = [];
+    async runShared(operation) {
+        if (this.writerActive || this.writerQueue.length > 0) {
+            await new Promise((resolve) => this.readerQueue.push(resolve));
+        }
+        this.readers += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            this.readers -= 1;
+            this.drain();
+        }
+    }
+    runExclusive(operation) {
+        return new Promise((resolve, reject) => {
+            this.writerQueue.push({
+                operation,
+                resolve: resolve,
+                reject,
+            });
+            this.drain();
+        });
+    }
+    drain() {
+        if (this.writerActive || this.readers > 0) {
+            return;
+        }
+        const writer = this.writerQueue.shift();
+        if (writer) {
+            this.writerActive = true;
+            void writer.operation().then(writer.resolve, writer.reject).finally(() => {
+                this.writerActive = false;
+                this.drain();
+            });
+            return;
+        }
+        for (const resolve of this.readerQueue.splice(0)) {
+            resolve();
+        }
+    }
+}

package/dist/server.d.ts

@@ -1,11 +1,18 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { TaurusDBEngine, type Config, type RuntimeTargetProfileLoader } from "taurusdb-core";
+import { TaurusDBEngine, type Config, type AuditWriter, type RuntimeTargetProfileLoader } from "taurusdb-core";
 import { type CredentialLoginService } from "./security/local-credential-login.js";
+import { SessionCoordinator } from "./security/session-coordinator.js";
 export interface ServerDeps {
     config: Config;
     profileLoader: RuntimeTargetProfileLoader;
     engine: TaurusDBEngine;
     credentialLogin: CredentialLoginService;
+    auditWriter?: AuditWriter;
+    sessionCoordinator?: SessionCoordinator;
+    clientIdentityProvider?: () => {
+        name: string;
+        version: string;
+    } | undefined;
     pingResponse: string;
 }
 export declare function bootstrapDependencies(): Promise<ServerDeps>;

package/dist/server.js

@@ -1,19 +1,27 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createSqlProfileLoader, getConfig, RuntimeOverrideProfileLoader, redactConfigForLog, TaurusDBEngine, } from "taurusdb-core";
+import { createSqlProfileLoader, createJsonlAuditWriter, getConfig, RuntimeOverrideProfileLoader, redactConfigForLog, TaurusDBEngine, } from "taurusdb-core";
 import { registerTools } from "./tools/registry.js";
 import { logger } from "taurusdb-core";
 import { VERSION } from "./version.js";
 import { LocalCredentialLoginService, } from "./security/local-credential-login.js";
+import { SessionCoordinator } from "./security/session-coordinator.js";
 export async function bootstrapDependencies() {
     const config = getConfig();
     const profileLoader = new RuntimeOverrideProfileLoader(createSqlProfileLoader({ config }));
     const engine = await TaurusDBEngine.create({ config, profileLoader });
+    const auditWriter = await createJsonlAuditWriter({
+        logPath: config.audit.logPath,
+        maxBytes: config.audit.maxBytes,
+        maxFiles: config.audit.maxFiles,
+    });
     return {
         config,
         profileLoader,
         engine,
         credentialLogin: new LocalCredentialLoginService(),
+        auditWriter,
+        sessionCoordinator: new SessionCoordinator(),
         pingResponse: "pong",
     };
 }
@@ -22,11 +30,13 @@ export function createServer(deps) {
         name: "huaweicloud-taurusdb",
         version: VERSION,
     });
+    deps.clientIdentityProvider = () => server.server.getClientVersion();
     let cleanupPromise;
     const cleanup = () => {
         cleanupPromise ??= Promise.all([
             deps.credentialLogin.close(),
             deps.engine.close(),
+            deps.auditWriter?.close() ?? Promise.resolve(),
         ]).then(() => undefined);
         return cleanupPromise;
     };

package/dist/tools/common/public-formatters.d.ts

@@ -57,6 +57,8 @@ export declare function toPublicQueryResult(result: QueryResult): {
     row_truncated: boolean;
     column_truncated: boolean;
     field_truncated: boolean;
+    byte_truncated: boolean;
+    returned_bytes: number;
     redacted_columns: string[];
     dropped_columns: string[];
     truncated_columns: string[];
@@ -78,6 +80,8 @@ export declare function toPublicGuardrailDecision(decision: GuardrailDecision):
         max_rows: number;
         max_columns: number;
         max_field_chars: number;
+        max_result_bytes: number;
+        max_blob_bytes: number;
     };
 };
 export declare function toPublicExplainResult(result: ExplainResult, decision: GuardrailDecision): {
@@ -105,6 +109,8 @@ export declare function toPublicExplainResult(result: ExplainResult, decision: G
             max_rows: number;
             max_columns: number;
             max_field_chars: number;
+            max_result_bytes: number;
+            max_blob_bytes: number;
         };
     };
 };
@@ -146,6 +152,8 @@ export declare function toPublicEnhancedExplainResult(result: EnhancedExplainRes
                 max_rows: number;
                 max_columns: number;
                 max_field_chars: number;
+                max_result_bytes: number;
+                max_blob_bytes: number;
             };
         };
     };

package/dist/tools/common/public-formatters.js

@@ -67,6 +67,8 @@ export function toPublicQueryResult(result) {
         row_truncated: result.rowTruncated,
         column_truncated: result.columnTruncated,
         field_truncated: result.fieldTruncated,
+        byte_truncated: result.byteTruncated,
+        returned_bytes: result.returnedBytes,
         redacted_columns: result.redactedColumns,
         dropped_columns: result.droppedColumns,
         truncated_columns: result.truncatedColumns,
@@ -92,6 +94,8 @@ export function toPublicGuardrailDecision(decision) {
             max_rows: decision.runtimeLimits.maxRows,
             max_columns: decision.runtimeLimits.maxColumns,
             max_field_chars: decision.runtimeLimits.maxFieldChars,
+            max_result_bytes: decision.runtimeLimits.maxResultBytes,
+            max_blob_bytes: decision.runtimeLimits.maxBlobBytes,
         },
     };
 }

package/dist/tools/error-handling.js

@@ -1,4 +1,4 @@
-import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, logger, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
+import { ConnectionPoolError, DatasourceResolutionError, FlashbackNoViewError, logger, QueryConcurrencyError, SchemaIntrospectionError, UnsupportedFeatureError, } from "taurusdb-core";
 import { ErrorCode, formatError, } from "../utils/formatter.js";
 export class ToolInputError extends Error {
     constructor(message) {
@@ -100,6 +100,15 @@ export function formatToolError(error, context) {
             details: detailsOf(error),
         });
     }
+    if (error instanceof QueryConcurrencyError) {
+        return formatError({
+            code: ErrorCode.SERVER_BUSY,
+            message: error.message,
+            summary: `${context.action} could not start because query capacity is exhausted.`,
+            metadata: context.metadata,
+            retryable: true,
+        });
+    }
     if (cancelledLikely(error)) {
         return formatError({
             code: ErrorCode.QUERY_CANCELLED,