taurusdb-mcp 0.5.0-rc.2 → 0.5.0-rc.4

package/README.md

@@ -10,7 +10,7 @@ TaurusDB MCP server for MCP clients such as:
 ## Install
 
 ```bash
-npm install taurusdb-mcp
+npm install taurusdb-mcp@latest
 ```
 
 Run directly with:
@@ -46,9 +46,6 @@ claude mcp add huaweicloud-taurusdb \
   -e TAURUSDB_CLOUD_REGION=<your-region> \
   -e TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
   -e TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
-  -e TAURUSDB_SQL_DATABASE=<your-database> \
-  -e TAURUSDB_SQL_USER=<your-readonly-user> \
-  -e TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
@@ -59,12 +56,19 @@ codex mcp add huaweicloud-taurusdb \
   --env TAURUSDB_CLOUD_REGION=<your-region> \
   --env TAURUSDB_CLOUD_KEYCHAIN_SERVICE=taurusdb-mcp/huaweicloud \
   --env TAURUSDB_ENABLE_DYNAMIC_TARGETS=true \
-  --env TAURUSDB_SQL_DATABASE=<your-database> \
-  --env TAURUSDB_SQL_USER=<your-readonly-user> \
-  --env TAURUSDB_SQL_PASSWORD='hw-kms-file:~/.taurusdb-mcp/password.ciphertext' \
   -- npx -y taurusdb-mcp
 ```
 
+Interactive connection flow:
+
+1. Call `list_cloud_taurus_instances`.
+2. Call `select_cloud_taurus_instance`.
+3. Open the returned `login_url` in a browser and enter the database credentials.
+4. Continue with `list_databases`, `set_default_database`, and readonly tools.
+
+The browser submits credentials directly to the loopback MCP process. They are not
+sent through Agent-visible tool arguments or persisted by MCP.
+
 Initialize local MCP client config:
 
 ```bash
@@ -84,32 +88,20 @@ npx taurusdb-mcp credentials check
 
 - Requires Node.js `>= 20`
 - Depends on `taurusdb-core`
-- Database passwords support `env:`, `file:`, `hw-csms:`, `hw-kms:`, and `hw-kms-file:` references
-- Huawei DEW CSMS is recommended when the database password should be stored and retrieved from Huawei Cloud
+- Interactive clients do not need database usernames or passwords in MCP configuration
+- Unattended static deployments may use `env:`, `file:`, `hw-csms:`, `hw-kms:`, or `hw-kms-file:` password references
 - macOS Keychain, Linux Secret Service, or Windows Credential Manager cloud identity is enabled with `TAURUSDB_CLOUD_KEYCHAIN_SERVICE`
 - SQL TLS with certificate verification is required by default
-- Mutation and dynamic-target tools are disabled by default
-- Mutation tools require a dedicated `TAURUSDB_SQL_MUTATION_USER` /
-  `TAURUSDB_SQL_MUTATION_PASSWORD` pair and an external operator-signed approval
+- General database mutation tools do not exist; the Agent-facing operating plane remains read-only regardless of database account privileges
+- Recycle-bin request/status tools are visible by default: `prepare_recycle_bin_restore` performs readonly preflight and the loopback-only operator page requires the Agent-invisible HttpOnly browser session established by database login before executing one target-bound native restore with the active in-memory SQL session; no secret file, direct restore tool, or Agent-held execution token is required
+- `analyze_mutation_sql` returns evidence-backed SQL Advice with `execution_status: not_executed`
+- Selecting a cloud instance returns a local SQL login link immediately; login validates the connection before binding credentials, allows at most three attempts per five-minute link, and never sends the password through Agent-visible tool arguments
+- Session SQL credentials expire after 30 idle minutes and eight absolute hours; administrators may shorten these limits with `TAURUSDB_SQL_CREDENTIAL_IDLE_TTL_MINUTES` and `TAURUSDB_SQL_CREDENTIAL_MAX_TTL_MINUTES`
 - MCP audit events are written to `~/.taurusdb-mcp/audit.jsonl` by default, with
   configurable size rotation for collection into centralized immutable storage
 - Run one stdio process per customer/client trust boundary; this package is not
   a shared multi-tenant HTTP service
 
-Enable mutations only when required:
-
-```bash
-export TAURUSDB_ENABLE_MUTATIONS=true
-export TAURUSDB_SQL_MUTATION_USER='<dedicated-writer>'
-export TAURUSDB_SQL_MUTATION_PASSWORD='hw-csms:<writer-secret-name>'
-export TAURUSDB_MUTATION_APPROVAL_SECRET_FILE='/run/secrets/taurusdb-approval'
-```
-
-Sign a returned `approval_request` outside the MCP client:
-
-```bash
-npx taurusdb-mcp approve \
-  --request '<approval_request>' \
-  --actor '<operator-identity>' \
-  --secret-file /run/secrets/taurusdb-approval
-```
+Customers execute reviewed general-purpose `advised_sql` through their own controlled
+change process. The only MCP database-state exception is the target-bound,
+same-browser-confirmed recycle-bin recovery described above.

package/dist/security/browser-operator-session.d.ts

@@ -0,0 +1,14 @@
+export declare class BrowserOperatorSessionStore {
+    private readonly now;
+    private readonly cookieName;
+    private readonly sessions;
+    constructor(options?: {
+        now?: () => number;
+    });
+    issue(datasource: string, ttlMs?: number): string;
+    authorizes(cookieHeader: string | undefined, datasource: string): boolean;
+    clear(): void;
+    revokeDatasource(datasource: string): void;
+    private readCookie;
+    private expire;
+}

package/dist/security/browser-operator-session.js

@@ -0,0 +1,57 @@
+import { randomBytes } from "node:crypto";
+const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
+export class BrowserOperatorSessionStore {
+    now;
+    cookieName;
+    sessions = new Map();
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+        this.cookieName = `taurusdb_mcp_operator_${randomBytes(8).toString("hex")}`;
+    }
+    issue(datasource, ttlMs = DEFAULT_TTL_MS) {
+        this.expire();
+        const token = randomBytes(32).toString("base64url");
+        const boundedTtlMs = Math.max(1, Math.min(ttlMs, DEFAULT_TTL_MS));
+        this.sessions.set(token, {
+            datasource,
+            expiresAtMs: this.now() + boundedTtlMs,
+        });
+        return `${this.cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${Math.ceil(boundedTtlMs / 1000)}`;
+    }
+    authorizes(cookieHeader, datasource) {
+        this.expire();
+        const token = this.readCookie(cookieHeader);
+        const session = token ? this.sessions.get(token) : undefined;
+        return session?.datasource === datasource;
+    }
+    clear() {
+        this.sessions.clear();
+    }
+    revokeDatasource(datasource) {
+        for (const [token, session] of this.sessions) {
+            if (session.datasource === datasource)
+                this.sessions.delete(token);
+        }
+    }
+    readCookie(cookieHeader) {
+        if (!cookieHeader)
+            return undefined;
+        for (const part of cookieHeader.split(";")) {
+            const separator = part.indexOf("=");
+            if (separator < 0)
+                continue;
+            const name = part.slice(0, separator).trim();
+            if (name === this.cookieName) {
+                return part.slice(separator + 1).trim() || undefined;
+            }
+        }
+        return undefined;
+    }
+    expire() {
+        const now = this.now();
+        for (const [token, session] of this.sessions) {
+            if (session.expiresAtMs <= now)
+                this.sessions.delete(token);
+        }
+    }
+}

package/dist/security/local-credential-login.d.ts

@@ -1,16 +1,30 @@
+import { BrowserOperatorSessionStore } from "./browser-operator-session.js";
 export type SqlLoginCredentials = {
     datasource: string;
     username: string;
     password: string;
 };
+export type SqlLoginTarget = {
+    datasource: string;
+    instanceId?: string;
+    region?: string;
+    credentialIdleTtlMinutes?: number;
+    credentialMaxTtlMinutes?: number;
+};
 export type SqlLoginRequest = {
     datasource: string;
+    target?: SqlLoginTarget;
     bind: (credentials: SqlLoginCredentials) => Promise<void>;
 };
 export type IssuedSqlLogin = {
     loginUrl: string;
     expiresAt: string;
 };
+export type CredentialValidationFailure = "credentials" | "connectivity" | "tls" | "timeout";
+export declare class SqlCredentialValidationError extends Error {
+    readonly kind: CredentialValidationFailure;
+    constructor(kind: CredentialValidationFailure);
+}
 export interface CredentialLoginService {
     issueSqlLogin(request: SqlLoginRequest): Promise<IssuedSqlLogin>;
     close(): Promise<void>;
@@ -18,10 +32,16 @@ export interface CredentialLoginService {
 export type LocalCredentialLoginServiceOptions = {
     now?: () => number;
     tokenTtlMs?: number;
+    maxAttempts?: number;
+    failureDelayMs?: number;
+    operatorSessions?: BrowserOperatorSessionStore;
 };
 export declare class LocalCredentialLoginService implements CredentialLoginService {
     private readonly now;
     private readonly tokenTtlMs;
+    private readonly maxAttempts;
+    private readonly failureDelayMs;
+    private readonly operatorSessions?;
     private readonly pending;
     private server;
     private port;

package/dist/security/local-credential-login.js

@@ -1,42 +1,247 @@
 import { randomBytes } from "node:crypto";
 import { createServer, } from "node:http";
 const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_FAILURE_DELAY_MS = 1_000;
 const MAX_REQUEST_BODY_BYTES = 16 * 1024;
-function page(title, message, form = false) {
-    const formHtml = form
-        ? `<form method="post">
-  <label>Database username <input name="username" autocomplete="username" required></label>
-  <label>Database password <input name="password" type="password" autocomplete="current-password" required></label>
-  <button type="submit">Connect</button>
-</form>`
-        : "";
+export class SqlCredentialValidationError extends Error {
+    kind;
+    constructor(kind) {
+        super(`SQL credential validation failed: ${kind}`);
+        this.name = "SqlCredentialValidationError";
+        this.kind = kind;
+    }
+}
+const COPY = {
+    "zh-CN": {
+        product: "TaurusDB MCP",
+        secureSession: "安全会话",
+        title: "连接数据库",
+        intro: "输入数据库账号和密码以验证连接。",
+        target: "连接目标",
+        instance: "实例",
+        region: "区域",
+        datasource: "数据源",
+        configured: "已配置的数据源",
+        unknown: "未指定",
+        username: "数据库账号",
+        password: "数据库密码",
+        usernamePlaceholder: "请输入数据库账号",
+        passwordPlaceholder: "请输入数据库密码",
+        submit: "连接数据库",
+        submitting: "正在验证连接…",
+        privacy: "凭据对 Agent 不可见，仅用于连接您选择的数据库，不会由 MCP 持久化保存。",
+        retention: (idle, maximum) => `空闲 ${idle} 分钟后清除 · 最长保留 ${maximum >= 60 ? `${maximum / 60} 小时` : `${maximum} 分钟`}`,
+        attempts: (remaining) => `本链接还可尝试 ${remaining} 次`,
+        required: "请输入数据库账号和密码。",
+        credentials: "无法验证账号信息，请检查账号和密码。",
+        connectivity: "数据库服务暂时不可达，请检查网络和实例状态。",
+        tls: "TLS 安全连接验证失败，请联系管理员检查证书配置。",
+        timeout: "连接验证超时，请稍后重试。",
+        busy: "连接正在验证，请勿重复提交。",
+        successTitle: "账号验证成功",
+        successMessage: "您现在可以返回 MCP 会话并选择需要访问的数据库。",
+        expiredTitle: "登录链接已失效",
+        expiredMessage: "请返回 MCP 会话并重新调用 begin_sql_login。",
+        lockedTitle: "尝试次数已用完",
+        lockedMessage: "为保护数据库账号，此链接已失效。请返回 MCP 会话重新生成登录链接。",
+        methodTitle: "不支持此请求",
+        methodMessage: "请使用登录表单继续。",
+        invalidTitle: "无法处理请求",
+        invalidMessage: "登录请求无效，请重新生成登录链接。",
+    },
+    en: {
+        product: "TaurusDB MCP",
+        secureSession: "Secure session",
+        title: "Connect to database",
+        intro: "Enter your database credentials to validate the connection.",
+        target: "Connection target",
+        instance: "Instance",
+        region: "Region",
+        datasource: "Datasource",
+        configured: "Configured datasource",
+        unknown: "Not specified",
+        username: "Database username",
+        password: "Database password",
+        usernamePlaceholder: "Enter database username",
+        passwordPlaceholder: "Enter database password",
+        submit: "Connect to database",
+        submitting: "Validating connection…",
+        privacy: "Credentials are not visible to the Agent. They are used only to connect to your selected database and are not persisted by MCP.",
+        retention: (idle, maximum) => `Cleared after ${idle} idle minutes · ${maximum >= 60 ? `${maximum / 60} ${maximum === 60 ? "hour" : "hours"}` : `${maximum} ${maximum === 1 ? "minute" : "minutes"}`} maximum`,
+        attempts: (remaining) => `${remaining} attempts remaining for this link`,
+        required: "Enter both the database username and password.",
+        credentials: "The account could not be validated. Check the username and password.",
+        connectivity: "The database is currently unreachable. Check the network and instance status.",
+        tls: "The TLS connection could not be validated. Ask an administrator to check the certificate configuration.",
+        timeout: "Connection validation timed out. Try again shortly.",
+        busy: "Connection validation is already in progress. Do not submit again.",
+        successTitle: "Account validated",
+        successMessage: "Return to your MCP session and select the database you want to access.",
+        expiredTitle: "Login link expired",
+        expiredMessage: "Return to your MCP session and call begin_sql_login again.",
+        lockedTitle: "Attempt limit reached",
+        lockedMessage: "This link has expired to protect the database account. Return to your MCP session and create a new login link.",
+        methodTitle: "Unsupported request",
+        methodMessage: "Use the login form to continue.",
+        invalidTitle: "Request could not be processed",
+        invalidMessage: "The login request is invalid. Create a new login link.",
+    },
+};
+function localeFromRequest(req) {
+    return /(?:^|,)\s*zh(?:-|_|;|,|$)/i.test(req.headers["accept-language"] ?? "")
+        ? "zh-CN"
+        : "en";
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function maskInstanceId(value, fallback) {
+    if (!value) {
+        return fallback;
+    }
+    if (value.length <= 10) {
+        return value;
+    }
+    return `${value.slice(0, 5)}…${value.slice(-4)}`;
+}
+function page(input) {
+    const copy = COPY[input.locale];
+    const isForm = input.state === "form";
+    const title = isForm
+        ? copy.title
+        : input.state === "success"
+            ? copy.successTitle
+            : input.state === "expired"
+                ? copy.expiredTitle
+                : input.state === "locked"
+                    ? copy.lockedTitle
+                    : input.state === "method"
+                        ? copy.methodTitle
+                        : copy.invalidTitle;
+    const message = input.message ?? (isForm
+        ? copy.intro
+        : input.state === "success"
+            ? copy.successMessage
+            : input.state === "expired"
+                ? copy.expiredMessage
+                : input.state === "locked"
+                    ? copy.lockedMessage
+                    : input.state === "method"
+                        ? copy.methodMessage
+                        : copy.invalidMessage);
+    const nonce = randomBytes(18).toString("base64url");
+    const target = input.target;
+    const formHtml = isForm
+        ? `<form method="post" autocomplete="on" data-login-form>
+        ${input.message ? `<div class="alert" role="alert">${escapeHtml(input.message)}</div>` : ""}
+        <label for="username">${copy.username}</label>
+        <input id="username" name="username" autocomplete="username" maxlength="256" value="${escapeHtml(input.username ?? "")}" placeholder="${copy.usernamePlaceholder}" required autofocus>
+        <label for="password">${copy.password}</label>
+        <input id="password" name="password" type="password" autocomplete="current-password" maxlength="4096" placeholder="${copy.passwordPlaceholder}" required>
+        <button type="submit" data-submit data-pending="${copy.submitting}">${copy.submit}</button>
+        ${input.remainingAttempts !== undefined ? `<p class="attempts">${copy.attempts(input.remainingAttempts)}</p>` : ""}
+      </form>`
+        : `<section class="result ${input.state}" aria-live="polite">
+        <span class="result-mark" aria-hidden="true">${input.state === "success" ? "✓" : "!"}</span>
+        <h1>${escapeHtml(title)}</h1>
+        <p>${escapeHtml(message)}</p>
+      </section>`;
     return `<!doctype html>
-<html lang="en">
+<html lang="${input.locale}">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${title}</title>
+  <meta name="color-scheme" content="light">
+  <title>${escapeHtml(title)} · ${copy.product}</title>
   <style>
-    body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto; padding: 0 1rem; }
-    form { display: grid; gap: 1rem; }
-    label { display: grid; gap: .35rem; }
-    input, button { font: inherit; padding: .65rem; }
+    :root { color-scheme: light; --ink:#172033; --muted:#637083; --cloud:#f3f6fa; --surface:#fff; --line:#dce3eb; --teal:#087f73; --teal-dark:#06665e; --teal-soft:#e7f5f2; --danger:#b42318; --danger-soft:#fff0ee; --shadow:0 22px 60px rgba(23,32,51,.12); }
+    * { box-sizing:border-box; }
+    body { margin:0; min-height:100vh; color:var(--ink); background:var(--cloud); font-family:Inter,ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif; }
+    .shell { width:min(980px,calc(100% - 32px)); margin:clamp(24px,7vh,72px) auto; }
+    .masthead { display:flex; justify-content:space-between; align-items:center; margin-bottom:18px; font-size:13px; letter-spacing:.04em; }
+    .brand { font-weight:760; font-size:15px; letter-spacing:-.01em; }
+    .session { color:var(--teal-dark); background:var(--teal-soft); padding:7px 11px; border-radius:999px; font-weight:650; }
+    .panel { display:grid; grid-template-columns:minmax(270px,.82fr) minmax(340px,1.18fr); overflow:hidden; border:1px solid rgba(23,32,51,.08); border-radius:22px; background:var(--surface); box-shadow:var(--shadow); }
+    .context { position:relative; padding:44px 40px; color:#f7fbff; background:var(--ink); }
+    .context:after { content:""; position:absolute; width:240px; height:240px; right:-120px; bottom:-130px; border:1px solid rgba(255,255,255,.14); border-radius:50%; box-shadow:0 0 0 34px rgba(255,255,255,.035),0 0 0 72px rgba(255,255,255,.025); }
+    .eyebrow { margin:0 0 28px; color:#9edbd4; font-size:12px; font-weight:720; letter-spacing:.11em; text-transform:uppercase; }
+    .rail { margin:0; }
+    .rail-item { display:grid; grid-template-columns:14px 1fr; gap:0 14px; }
+    .rail dt,.rail dd { margin:0; padding-bottom:25px; }
+    .rail dt { color:#aeb8c8; font-size:12px; }
+    .rail dd { margin-top:18px; font-size:15px; font-weight:650; overflow-wrap:anywhere; }
+    .node { position:relative; width:10px; height:10px; margin-top:4px; border:2px solid #73d2c8; border-radius:50%; background:var(--ink); }
+    .node:not(.last):after { content:""; position:absolute; left:2px; top:10px; width:2px; height:54px; background:linear-gradient(#3b8f88,rgba(59,143,136,.16)); }
+    .target-row { grid-column:2; display:grid; grid-template-columns:76px 1fr; }
+    .retention { position:relative; z-index:1; margin:18px 0 0; padding-top:18px; border-top:1px solid rgba(255,255,255,.13); color:#aeb8c8; font-size:12px; line-height:1.55; }
+    .content { padding:44px 48px 36px; }
+    .content h1 { margin:0 0 10px; font-size:clamp(28px,4vw,38px); line-height:1.08; letter-spacing:-.035em; }
+    .intro { margin:0 0 30px; color:var(--muted); line-height:1.65; }
+    form { display:grid; gap:9px; }
+    label { margin-top:9px; font-size:13px; font-weight:700; }
+    input { width:100%; min-height:48px; border:1px solid #cbd4df; border-radius:10px; padding:11px 13px; color:var(--ink); background:#fbfcfe; font:inherit; outline:none; transition:border-color .16s,box-shadow .16s,background .16s; }
+    input:focus { border-color:var(--teal); background:#fff; box-shadow:0 0 0 4px rgba(8,127,115,.12); }
+    button { min-height:50px; margin-top:17px; border:0; border-radius:10px; color:#fff; background:var(--teal); font:inherit; font-size:15px; font-weight:700; cursor:pointer; transition:background .16s,transform .16s; }
+    button:hover { background:var(--teal-dark); }
+    button:active { transform:translateY(1px); }
+    button:focus-visible { outline:3px solid rgba(8,127,115,.28); outline-offset:3px; }
+    button:disabled { cursor:wait; opacity:.72; }
+    .alert { margin-bottom:4px; border-left:3px solid var(--danger); border-radius:7px; padding:11px 13px; color:#8d1b13; background:var(--danger-soft); font-size:13px; line-height:1.5; }
+    .attempts { margin:2px 0 0; color:var(--muted); text-align:center; font-size:12px; }
+    .privacy { display:flex; gap:10px; align-items:flex-start; margin:27px 0 0; padding-top:20px; border-top:1px solid var(--line); color:var(--muted); font-size:12px; line-height:1.6; }
+    .shield { flex:0 0 auto; color:var(--teal); font-size:15px; line-height:1.3; }
+    .result { min-height:280px; display:flex; flex-direction:column; align-items:flex-start; justify-content:center; }
+    .result-mark { display:grid; place-items:center; width:46px; height:46px; margin-bottom:22px; border-radius:50%; color:#fff; background:var(--danger); font-size:22px; font-weight:800; }
+    .result.success .result-mark { background:var(--teal); }
+    .result p { max-width:35rem; color:var(--muted); line-height:1.7; }
+    @media (max-width:760px) { .shell{width:min(100% - 20px,560px);margin:18px auto}.panel{grid-template-columns:1fr;border-radius:17px}.context{padding:28px 26px 18px}.content{padding:30px 26px}.rail dt,.rail dd{padding-bottom:17px}.node:not(.last):after{height:44px}.content h1{font-size:30px} }
+    @media (prefers-reduced-motion:reduce) { *,*:before,*:after{scroll-behavior:auto!important;transition:none!important} }
   </style>
 </head>
 <body>
-  <h1>${title}</h1>
-  <p>${message}</p>
-  ${formHtml}
+  <main class="shell">
+    <header class="masthead"><span class="brand">${copy.product}</span><span class="session">${copy.secureSession}</span></header>
+    <section class="panel">
+      <aside class="context">
+        <p class="eyebrow">${copy.target}</p>
+        <dl class="rail">
+          <div class="rail-item"><span class="node"></span><div class="target-row"><dt>${copy.instance}</dt><dd>${escapeHtml(maskInstanceId(target?.instanceId, copy.configured))}</dd></div></div>
+          <div class="rail-item"><span class="node"></span><div class="target-row"><dt>${copy.region}</dt><dd>${escapeHtml(target?.region ?? copy.unknown)}</dd></div></div>
+          <div class="rail-item"><span class="node last"></span><div class="target-row"><dt>${copy.datasource}</dt><dd>${escapeHtml(target?.datasource ?? copy.unknown)}</dd></div></div>
+        </dl>
+        ${target?.credentialIdleTtlMinutes && target.credentialMaxTtlMinutes ? `<p class="retention">${copy.retention(target.credentialIdleTtlMinutes, target.credentialMaxTtlMinutes)}</p>` : ""}
+      </aside>
+      <div class="content">
+        ${isForm ? `<h1>${copy.title}</h1><p class="intro">${copy.intro}</p>` : ""}
+        ${formHtml}
+        ${isForm ? `<p class="privacy"><span class="shield" aria-hidden="true">◆</span><span>${copy.privacy}</span></p>` : ""}
+      </div>
+    </section>
+  </main>
+  ${isForm ? `<script nonce="${nonce}">document.querySelector('[data-login-form]').addEventListener('submit',()=>{const b=document.querySelector('[data-submit]');b.disabled=true;b.textContent=b.dataset.pending;});</script>` : ""}
 </body>
 </html>`;
 }
 function respond(res, status, body) {
+    const nonce = /<script nonce="([^"]+)"/.exec(body)?.[1];
     res.writeHead(status, {
         "cache-control": "no-store",
-        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
+        "content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${nonce ? `; script-src 'nonce-${nonce}'` : ""}`,
         "content-type": "text/html; charset=utf-8",
+        "cross-origin-opener-policy": "same-origin",
+        "cross-origin-resource-policy": "same-origin",
+        expires: "0",
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
+        pragma: "no-cache",
         "referrer-policy": "no-referrer",
         "x-content-type-options": "nosniff",
+        "x-frame-options": "DENY",
     });
     res.end(body);
 }
@@ -53,21 +258,30 @@ async function readBody(req) {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
+function delay(ms) {
+    return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+}
 export class LocalCredentialLoginService {
     now;
     tokenTtlMs;
+    maxAttempts;
+    failureDelayMs;
+    operatorSessions;
     pending = new Map();
     server;
     port;
     constructor(options = {}) {
         this.now = options.now ?? Date.now;
         this.tokenTtlMs = options.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+        this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+        this.failureDelayMs = options.failureDelayMs ?? DEFAULT_FAILURE_DELAY_MS;
+        this.operatorSessions = options.operatorSessions;
     }
     async issueSqlLogin(request) {
         await this.ensureStarted();
         const token = randomBytes(32).toString("base64url");
         const expiresAtMs = this.now() + this.tokenTtlMs;
-        this.pending.set(token, { ...request, expiresAtMs });
+        this.pending.set(token, { ...request, expiresAtMs, failedAttempts: 0, inFlight: false });
         return {
             loginUrl: `http://127.0.0.1:${this.port}/sql-login/${token}`,
             expiresAt: new Date(expiresAtMs).toISOString(),
@@ -75,6 +289,7 @@ export class LocalCredentialLoginService {
     }
     async close() {
         this.pending.clear();
+        this.operatorSessions?.clear();
         const server = this.server;
         this.server = undefined;
         this.port = undefined;
@@ -108,6 +323,7 @@ export class LocalCredentialLoginService {
         this.port = address.port;
     }
     async handle(req, res) {
+        const locale = localeFromRequest(req);
         try {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
             const match = url.pathname.match(/^\/sql-login\/([^/]+)$/);
@@ -117,40 +333,87 @@ export class LocalCredentialLoginService {
                 if (token) {
                     this.pending.delete(token);
                 }
-                respond(res, 410, page("Invalid login link", "This login link is invalid or has expired."));
+                respond(res, 410, page({ locale, state: "expired", target: pending?.target }));
                 return;
             }
             if (req.method === "GET") {
-                respond(res, 200, page("Connect to TaurusDB", "Enter your database credentials.", true));
+                respond(res, 200, page({
+                    locale,
+                    state: "form",
+                    target: pending.target,
+                    remainingAttempts: this.maxAttempts - pending.failedAttempts,
+                }));
                 return;
             }
             if (req.method !== "POST") {
-                respond(res, 405, page("Unsupported request", "Use the login form to continue."));
+                respond(res, 405, page({ locale, state: "method", target: pending.target }));
+                return;
+            }
+            const origin = req.headers.origin;
+            if (origin && origin !== `http://${req.headers.host}`) {
+                respond(res, 403, page({ locale, state: "invalid", target: pending.target }));
+                return;
+            }
+            if (pending.inFlight) {
+                respond(res, 409, page({
+                    locale,
+                    state: "form",
+                    target: pending.target,
+                    message: COPY[locale].busy,
+                    remainingAttempts: this.maxAttempts - pending.failedAttempts,
+                }));
                 return;
             }
             const form = new URLSearchParams(await readBody(req));
             const username = form.get("username")?.trim() ?? "";
             const password = form.get("password") ?? "";
             if (!username || !password) {
-                respond(res, 400, page("Connect to TaurusDB", "Username and password are required.", true));
+                respond(res, 400, page({
+                    locale,
+                    state: "form",
+                    target: pending.target,
+                    message: COPY[locale].required,
+                    username,
+                    remainingAttempts: this.maxAttempts - pending.failedAttempts,
+                }));
                 return;
             }
-            this.pending.delete(token);
             try {
-                await pending.bind({
-                    datasource: pending.datasource,
-                    username,
-                    password,
-                });
+                pending.inFlight = true;
+                await pending.bind({ datasource: pending.datasource, username, password });
             }
-            catch {
-                respond(res, 500, page("Connection failed", "Credentials could not be bound to this session."));
+            catch (error) {
+                pending.inFlight = false;
+                const kind = error instanceof SqlCredentialValidationError ? error.kind : "connectivity";
+                if (kind === "credentials") {
+                    pending.failedAttempts += 1;
+                    await delay(this.failureDelayMs * 2 ** (pending.failedAttempts - 1));
+                    if (pending.failedAttempts >= this.maxAttempts) {
+                        this.pending.delete(token);
+                        respond(res, 429, page({ locale, state: "locked", target: pending.target }));
+                        return;
+                    }
+                }
+                respond(res, kind === "credentials" ? 401 : kind === "timeout" ? 504 : 502, page({
+                    locale,
+                    state: "form",
+                    target: pending.target,
+                    message: COPY[locale][kind],
+                    username,
+                    remainingAttempts: this.maxAttempts - pending.failedAttempts,
+                }));
                 return;
             }
-            respond(res, 200, page("Connected", "Database credentials are now active for this MCP session."));
+            this.pending.delete(token);
+            const maxTtlMinutes = Math.min(pending.target?.credentialIdleTtlMinutes ?? 30, pending.target?.credentialMaxTtlMinutes ?? 480);
+            const operatorCookie = this.operatorSessions?.issue(pending.datasource, maxTtlMinutes * 60_000);
+            if (operatorCookie) {
+                res.setHeader("set-cookie", operatorCookie);
+            }
+            respond(res, 200, page({ locale, state: "success", target: pending.target }));
         }
         catch {
-            respond(res, 400, page("Invalid request", "The login request could not be processed."));
+            respond(res, 400, page({ locale, state: "invalid" }));
         }
     }
 }