@bytebase/dbhub 1.2.4 → 1.3.0

package/README.md

@@ -1,5 +1,5 @@
 > [!NOTE]  
-> Brought to you by [Bytebase](https://www.bytebase.com/), open-source database governance platform.
+> If you need an enterprise-level database MCP server with built-in guardrails like approval flow, access control, data masking, and audit logging beyond what DBHub offers, check out [Bytebase](https://www.bytebase.com/).
 
 <p align="center">
  <a href="https://www.star-history.com/bytebase/dbhub">
@@ -24,17 +24,17 @@
 ```bash
             +------------------+    +--------------+    +------------------+
             |                  |    |              |    |                  |
-            |                  |    |              |    |                  |
             |  Claude Desktop  +--->+              +--->+    PostgreSQL    |
             |                  |    |              |    |                  |
             |  Claude Code     +--->+              +--->+    SQL Server    |
             |                  |    |              |    |                  |
-            |  Cursor          +--->+    DBHub     +--->+    SQLite        |
+            |  Cursor          +--->+    DBHub     +--->+    Oracle        |
             |                  |    |              |    |                  |
-            |  VS Code         +--->+              +--->+    MySQL         |
+            |  VS Code         +--->+              +--->+    SQLite        |
             |                  |    |              |    |                  |
-            |  Copilot CLI     +--->+              +--->+    MariaDB       |
+            |  Copilot CLI     +--->+              +--->+    MySQL         |
             |                  |    |              |    |                  |
+            |                  |    |              +--->+    MariaDB       |
             |                  |    |              |    |                  |
             +------------------+    +--------------+    +------------------+
                  MCP Clients           MCP Server             Databases
@@ -43,7 +43,7 @@
 DBHub is a minimal MCP server: token-efficient, zero-dependency, and just two tools by default with opt-in extras. This lightweight gateway allows MCP-compatible clients to connect to and explore different databases:
 
 - **Minimal**: Zero dependency, token efficient with a minimal set of MCP tools to maximize context window
-- **Multi-Database**: PostgreSQL, MySQL, MariaDB, SQL Server, and SQLite through a single interface
+- **Multi-Database**: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, and SQLite through a single interface
 - **Multi-Connection**: Connect to multiple databases simultaneously with TOML configuration
 - **Guardrails**: Read-only mode, row limiting, and query timeout to prevent runaway operations
 - **Secure Access**: SSH tunneling and SSL/TLS encryption
@@ -69,7 +69,7 @@ DBHub loads just 2 tools by default at **1.4k tokens** — 13-14x fewer than alt
 
 ## Supported Databases
 
-PostgreSQL, MySQL, SQL Server, MariaDB, and SQLite.
+PostgreSQL, MySQL, SQL Server, MariaDB, Oracle, and SQLite.
 
 ## MCP Tools
 

package/dist/{chunk-A4TSDCPY.js → chunk-6SZKW6GD.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-FU2ZJE4E.js";
 import {
   obfuscateDSNPassword
-} from "./chunk-MF6LSVWK.js";
+} from "./chunk-IXC4NQGC.js";
 
 // src/connectors/mysql-family-health-check.ts
 async function getMySQLFamilyHealthCheck(query) {

package/dist/{chunk-F5TPYAVO.js → chunk-77BJNE6E.js}

@@ -6,9 +6,10 @@ import {
   SafeURL,
   getDatabaseTypeFromDSN,
   getDefaultPortForType,
+  obfuscateDSNPassword,
   parseConnectionInfoFromDSN,
   stripCommentsAndStrings
-} from "./chunk-MF6LSVWK.js";
+} from "./chunk-IXC4NQGC.js";
 
 // src/tools/builtin-tools.ts
 var BUILTIN_TOOL_EXECUTE_SQL = "execute_sql";
@@ -660,7 +661,7 @@ function buildDSNFromEnvParams() {
       return null;
     }
   }
-  const supportedTypes = ["postgres", "postgresql", "mysql", "mariadb", "sqlserver", "sqlite"];
+  const supportedTypes = ["postgres", "postgresql", "mysql", "mariadb", "sqlserver", "sqlite", "oracle"];
   if (!supportedTypes.includes(dbType.toLowerCase())) {
     throw new Error(`Unsupported DB_TYPE: ${dbType}. Supported types: ${supportedTypes.join(", ")}`);
   }
@@ -678,6 +679,9 @@ function buildDSNFromEnvParams() {
       case "sqlserver":
         port = "1433";
         break;
+      case "oracle":
+        port = "1521";
+        break;
       case "sqlite":
         return {
           dsn: `sqlite:///${dbName}`,
@@ -821,15 +825,7 @@ function splitTokenList(value) {
   return value.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
 }
 function redactDSN(dsn) {
-  try {
-    const url = new URL(dsn);
-    if (url.password) {
-      url.password = "*******";
-    }
-    return url.toString();
-  } catch (error) {
-    return dsn.replace(/\/\/([^:]+):([^@]+)@/, "//$1:***@");
-  }
+  return obfuscateDSNPassword(dsn);
 }
 function resolveId() {
   const args = parseCommandLineArgs();
@@ -976,7 +972,7 @@ async function resolveSourceConfigs() {
       dsnUrl = new SafeURL(dsnResult.dsn);
     } catch (error) {
       throw new Error(
-        `Invalid DSN format: ${dsnResult.dsn}. Expected format: protocol://[user[:password]@]host[:port]/database`
+        `Invalid DSN format: ${redactDSN(dsnResult.dsn)}. Expected format: protocol://[user[:password]@]host[:port]/database`
       );
     }
     const protocol = dsnUrl.protocol.replace(":", "");
@@ -991,6 +987,8 @@ async function resolveSourceConfigs() {
       dbType = "sqlserver";
     } else if (protocol === "sqlite") {
       dbType = "sqlite";
+    } else if (protocol === "oracle") {
+      dbType = "oracle";
     } else {
       throw new Error(`Unsupported database type in DSN: ${protocol}`);
     }
@@ -1288,7 +1286,7 @@ function validateSourceConfig(source, configPath) {
     );
   }
   if (source.type) {
-    const validTypes = ["postgres", "mysql", "mariadb", "sqlserver", "sqlite"];
+    const validTypes = ["postgres", "mysql", "mariadb", "sqlserver", "sqlite", "oracle"];
     if (!validTypes.includes(source.type)) {
       throw new Error(
         `Configuration file ${configPath}: source '${source.id}' has invalid type '${source.type}'. Valid types: ${validTypes.join(", ")}`
@@ -1346,6 +1344,18 @@ function validateSourceConfig(source, configPath) {
       );
     }
   }
+  if (source.pool_max_connections !== void 0) {
+    if (source.type !== "postgres") {
+      throw new Error(
+        `Configuration file ${configPath}: source '${source.id}' has 'pool_max_connections' but it is only supported for PostgreSQL sources.`
+      );
+    }
+    if (!Number.isInteger(source.pool_max_connections) || source.pool_max_connections < 1 || source.pool_max_connections > 1e3) {
+      throw new Error(
+        `Configuration file ${configPath}: source '${source.id}' has invalid pool_max_connections. Must be an integer between 1 and 1000.`
+      );
+    }
+  }
   if (source.ssh_port !== void 0) {
     if (typeof source.ssh_port !== "number" || source.ssh_port <= 0 || source.ssh_port > 65535) {
       throw new Error(
@@ -1365,9 +1375,14 @@ function validateSourceConfig(source, configPath) {
         `Configuration file ${configPath}: source '${source.id}' has invalid sslmode '${source.sslmode}'. Valid values: ${validSslModes.join(", ")}`
       );
     }
-    if ((source.sslmode === "verify-ca" || source.sslmode === "verify-full") && source.type !== "postgres") {
+    const verifyModesByType = {
+      postgres: ["verify-ca", "verify-full"],
+      oracle: ["verify-full"]
+    };
+    if ((source.sslmode === "verify-ca" || source.sslmode === "verify-full") && !(verifyModesByType[source.type] ?? []).includes(source.sslmode)) {
+      const supported = ["disable", "require", ...verifyModesByType[source.type] ?? []];
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' has sslmode '${source.sslmode}' which is only supported for PostgreSQL. Valid values for ${source.type}: disable, require`
+        `Configuration file ${configPath}: source '${source.id}' has sslmode '${source.sslmode}' which is not supported for ${source.type}. Valid values for ${source.type}: ${supported.join(", ")}`
       );
     }
   }
@@ -1375,6 +1390,11 @@ function validateSourceConfig(source, configPath) {
     validateDSNFieldConflicts(source, configPath);
   }
   if (source.sslrootcert !== void 0) {
+    if (source.type !== "postgres") {
+      throw new Error(
+        `Configuration file ${configPath}: source '${source.id}' has sslrootcert but it is only supported for PostgreSQL.`
+      );
+    }
     if (source.sslmode !== "verify-ca" && source.sslmode !== "verify-full") {
       throw new Error(
         `Configuration file ${configPath}: source '${source.id}' has sslrootcert but sslmode is '${source.sslmode ?? "not set"}'. sslrootcert requires sslmode 'verify-ca' or 'verify-full'`
@@ -1727,11 +1747,17 @@ var NETWORK_CODES = /* @__PURE__ */ new Set([
   "ENETUNREACH",
   "ECONNRESET"
 ]);
+var NETWORK_CODES_BY_TYPE = {
+  // NJS-503: "connection to host ... could not be established" (Thin mode)
+  oracle: /* @__PURE__ */ new Set(["NJS-503"])
+};
 var AUTH_CODES = {
   postgres: ["28P01", "28000"],
   mysql: ["ER_ACCESS_DENIED_ERROR", 1045, 1698],
   mariadb: ["ER_ACCESS_DENIED_ERROR", 1045, 1698],
   sqlserver: ["ELOGIN"],
+  // ORA-01017: invalid username/password; ORA-28000: account locked
+  oracle: ["ORA-01017", "ORA-28000"],
   sqlite: []
   // no network/auth layer
 };
@@ -1753,7 +1779,7 @@ function classifyConnectionError(error, connectorType, sourceId) {
     return { code: "TUNNEL_FAILED", message: tunnelMessage(sourceId) };
   }
   const code = err.code;
-  if (typeof code === "string" && NETWORK_CODES.has(code)) {
+  if (typeof code === "string" && (NETWORK_CODES.has(code) || NETWORK_CODES_BY_TYPE[connectorType]?.has(code))) {
     return { code: "SOURCE_UNREACHABLE", message: unreachableMessage(sourceId) };
   }
   const authCodes = AUTH_CODES[connectorType];
@@ -1832,7 +1858,7 @@ var ConnectorManager = class {
     if (!lazySource) {
       if (sourceId) {
         throw new Error(
-          `Source '${sourceId}' not found. Available sources: ${this.sourceIds.join(", ")}`
+          `Source '${sourceId}' not found. Available sources: ${this.getAvailableSourceIds().join(", ")}`
         );
       } else {
         throw new Error("No sources configured. Call connectWithSources() first.");
@@ -1871,6 +1897,7 @@ var ConnectorManager = class {
     const dsn = await this.buildConnectionDSN(source);
     console.error(`  - ${sourceId}: ${redactDSN(dsn)}`);
     let actualDSN = dsn;
+    let tunnel;
     if (source.ssh_host) {
       const sshConfigPath = getDefaultSSHConfigPath();
       let resolvedSSHConfig = null;
@@ -1914,7 +1941,7 @@ var ConnectorManager = class {
       const url = new URL(dsn);
       const targetHost = url.hostname;
       const targetPort = parseInt(url.port) || this.getDefaultPort(dsn);
-      const tunnel = new SSHTunnel();
+      tunnel = new SSHTunnel();
       let tunnelInfo;
       try {
         tunnelInfo = await tunnel.establish(sshConfig, {
@@ -1950,6 +1977,9 @@ var ConnectorManager = class {
     if (source.query_timeout !== void 0 && connector.id !== "sqlite") {
       config.queryTimeoutSeconds = source.query_timeout;
     }
+    if (source.pool_max_connections !== void 0) {
+      config.poolMaxConnections = source.pool_max_connections;
+    }
     if (source.search_path) {
       config.searchPath = source.search_path;
     }
@@ -1962,7 +1992,19 @@ var ConnectorManager = class {
     if (source.collation) {
       config.collation = source.collation;
     }
-    await connector.connect(actualDSN, source.init_script, config);
+    try {
+      await connector.connect(actualDSN, source.init_script, config);
+    } catch (error) {
+      if (tunnel) {
+        this.sshTunnels.delete(sourceId);
+        try {
+          await tunnel.close();
+        } catch (closeError) {
+          console.error(`Error closing SSH tunnel for source '${sourceId}':`, closeError);
+        }
+      }
+      throw error;
+    }
     this.connectors.set(sourceId, connector);
     if (!this.sourceIds.includes(sourceId)) {
       this.sourceIds.push(sourceId);
@@ -2012,7 +2054,7 @@ var ConnectorManager = class {
     if (!connector) {
       if (sourceId) {
         throw new Error(
-          `Source '${sourceId}' not found. Available sources: ${this.sourceIds.join(", ")}`
+          `Source '${sourceId}' not found. Available sources: ${this.getAvailableSourceIds().join(", ")}`
         );
       } else {
         throw new Error("No sources connected. Call connectWithSources() first.");
@@ -2049,6 +2091,14 @@ var ConnectorManager = class {
   getSourceIds() {
     return [...this.sourceIds];
   }
+  /**
+   * Source IDs that can actually serve a request: connected, or registered for
+   * lazy (re)connection on first use. Used for error messages so a source that
+   * is neither is not reported as available.
+   */
+  getAvailableSourceIds() {
+    return this.sourceIds.filter((id) => this.connectors.has(id) || this.lazySources.has(id));
+  }
   /** Get all available source IDs */
   static getAvailableSourceIds() {
     if (!managerInstance) {
@@ -2126,7 +2176,7 @@ var ConnectorManager = class {
           error
         );
       } finally {
-        if (!this.isDisconnecting && this.sourceConfigs.has(sourceId)) {
+        if (!this.isDisconnecting && this.connectors.has(sourceId)) {
           this.scheduleIamRefresh(source);
         }
       }
@@ -2153,7 +2203,14 @@ var ConnectorManager = class {
     if (this.isDisconnecting) {
       return;
     }
-    await this.connectSource(source);
+    try {
+      await this.connectSource(source);
+    } catch (error) {
+      if (!this.isDisconnecting && this.sourceConfigs.has(sourceId)) {
+        this.lazySources.set(sourceId, source);
+      }
+      throw error;
+    }
   }
   /**
    * Build a connection DSN, optionally replacing password with
@@ -2218,24 +2275,29 @@ var PARAMETER_STYLES = {
   // ?, ?, ?
   sqlserver: "named",
   // @p1, @p2, @p3
-  sqlite: "positional"
+  sqlite: "positional",
   // ?, ?, ?
+  oracle: "colon"
+  // :1, :2, :3
 };
-function detectParameterStyle(statement) {
-  const cleanedSQL = stripCommentsAndStrings(statement);
+function detectParameterStyle(statement, connectorType) {
+  const cleanedSQL = stripCommentsAndStrings(statement, connectorType);
   if (/\$\d+/.test(cleanedSQL)) {
     return "numbered";
   }
   if (/@p\d+/.test(cleanedSQL)) {
     return "named";
   }
+  if (/(?<!:):\d+/.test(cleanedSQL)) {
+    return "colon";
+  }
   if (/\?/.test(cleanedSQL)) {
     return "positional";
   }
   return "none";
 }
 function validateParameterStyle(statement, connectorType) {
-  const detectedStyle = detectParameterStyle(statement);
+  const detectedStyle = detectParameterStyle(statement, connectorType);
   const expectedStyle = PARAMETER_STYLES[connectorType];
   if (detectedStyle === "none") {
     return;
@@ -2244,57 +2306,53 @@ function validateParameterStyle(statement, connectorType) {
     const examples = {
       numbered: "$1, $2, $3",
       positional: "?, ?, ?",
-      named: "@p1, @p2, @p3"
+      named: "@p1, @p2, @p3",
+      colon: ":1, :2, :3"
     };
     throw new Error(
       `Invalid parameter syntax for ${connectorType}. Expected ${expectedStyle} style (${examples[expectedStyle]}), but found ${detectedStyle} style in statement.`
     );
   }
 }
-function countParameters(statement) {
-  const style = detectParameterStyle(statement);
-  const cleanedSQL = stripCommentsAndStrings(statement);
+function countParameters(statement, connectorType) {
+  const style = detectParameterStyle(statement, connectorType);
+  const cleanedSQL = stripCommentsAndStrings(statement, connectorType);
   switch (style) {
-    case "numbered": {
-      const matches = cleanedSQL.match(/\$\d+/g);
-      if (!matches) return 0;
-      const numbers = matches.map((m) => parseInt(m.slice(1), 10));
-      const uniqueIndices = Array.from(new Set(numbers)).sort((a, b) => a - b);
-      const maxIndex = Math.max(...uniqueIndices);
-      for (let i = 1; i <= maxIndex; i++) {
-        if (!uniqueIndices.includes(i)) {
-          throw new Error(
-            `Non-sequential numbered parameters detected. Found placeholders: ${uniqueIndices.map((n) => `$${n}`).join(", ")}. Parameters must be sequential starting from $1 (missing $${i}).`
-          );
-        }
-      }
-      return maxIndex;
-    }
-    case "named": {
-      const matches = cleanedSQL.match(/@p\d+/g);
-      if (!matches) return 0;
-      const numbers = matches.map((m) => parseInt(m.slice(2), 10));
-      const uniqueIndices = Array.from(new Set(numbers)).sort((a, b) => a - b);
-      const maxIndex = Math.max(...uniqueIndices);
-      for (let i = 1; i <= maxIndex; i++) {
-        if (!uniqueIndices.includes(i)) {
-          throw new Error(
-            `Non-sequential named parameters detected. Found placeholders: ${uniqueIndices.map((n) => `@p${n}`).join(", ")}. Parameters must be sequential starting from @p1 (missing @p${i}).`
-          );
-        }
-      }
-      return maxIndex;
-    }
-    case "positional": {
+    case "numbered":
+      return countIndexedParameters(cleanedSQL, /\$\d+/g, "$", "numbered");
+    case "named":
+      return countIndexedParameters(cleanedSQL, /@p\d+/g, "@p", "named");
+    case "colon":
+      return countIndexedParameters(cleanedSQL, /(?<!:):\d+/g, ":", "colon-numbered");
+    case "positional":
       return (cleanedSQL.match(/\?/g) || []).length;
-    }
     default:
       return 0;
   }
 }
+function countIndexedParameters(cleanedSQL, pattern, sigil, styleName) {
+  const matches = cleanedSQL.match(pattern);
+  if (!matches) return 0;
+  const indices = new Set(matches.map((m) => parseInt(m.slice(sigil.length), 10)));
+  if (indices.has(0)) {
+    throw new Error(
+      `Invalid ${styleName} parameter ${sigil}0. Parameters must be sequential starting from ${sigil}1.`
+    );
+  }
+  const maxIndex = Math.max(...indices);
+  for (let i = 1; i <= maxIndex; i++) {
+    if (!indices.has(i)) {
+      const found = Array.from(indices).sort((a, b) => a - b).map((n) => `${sigil}${n}`).join(", ");
+      throw new Error(
+        `Non-sequential ${styleName} parameters detected. Found placeholders: ${found}. Parameters must be sequential starting from ${sigil}1 (missing ${sigil}${i}).`
+      );
+    }
+  }
+  return maxIndex;
+}
 function validateParameters(statement, parameters, connectorType) {
   validateParameterStyle(statement, connectorType);
-  const paramCount = countParameters(statement);
+  const paramCount = countParameters(statement, connectorType);
   const definedCount = parameters?.length || 0;
   if (paramCount !== definedCount) {
     throw new Error(

package/dist/{chunk-IQRBLAB4.js → chunk-ABTVMHD6.js}

@@ -1,6 +1,6 @@
 import {
   stripCommentsAndStrings
-} from "./chunk-MF6LSVWK.js";
+} from "./chunk-IXC4NQGC.js";
 
 // src/utils/allowed-keywords.ts
 var allowedKeywords = {
@@ -10,7 +10,12 @@ var allowedKeywords = {
   sqlite: ["select", "with", "explain", "pragma"],
   // SQL Server has no native EXPLAIN statement; the connector translates a
   // leading `EXPLAIN` into a SET SHOWPLAN_XML request (see SQLServerConnector).
-  sqlserver: ["select", "with", "explain"]
+  sqlserver: ["select", "with", "explain"],
+  // Oracle's native form is `EXPLAIN PLAN FOR <stmt>`; the connector accepts
+  // both that and a bare `EXPLAIN <stmt>` and reads the plan back through
+  // DBMS_XPLAN (see OracleConnector.explainQuery). EXPLAIN PLAN only parses
+  // the statement, it never executes it.
+  oracle: ["select", "with", "explain"]
 };
 var mutatingKeywords = [
   "insert",
@@ -56,12 +61,35 @@ var escapeHatchFunctionKeywords = {
   mysql: ["load_file", "get_lock", "release_lock", "release_all_locks"],
   mariadb: ["load_file", "get_lock", "release_lock", "release_all_locks"],
   postgres: ["pg_read_file", "pg_read_binary_file", "pg_ls_dir"],
-  sqlserver: sqlServerPassThroughKeywords
+  sqlserver: sqlServerPassThroughKeywords,
+  // Oracle packages a SELECT can call to reach outside the database, matched
+  // as `package.member(` (see escapeHatchCallSuffix).
+  oracle: [
+    "utl_http",
+    "utl_tcp",
+    "utl_smtp",
+    "utl_inaddr",
+    "utl_file",
+    "dbms_ldap",
+    "dbms_sql",
+    "dbms_scheduler",
+    "dbms_java",
+    "dbms_lob",
+    "dbms_xslprocessor",
+    "dbms_advisor"
+  ]
 };
+var escapeHatchCallSuffix = {
+  oracle: "\\s*\\.\\s*[a-z_][a-z0-9_$#]*\\s*\\("
+};
+var DEFAULT_CALL_SUFFIX = "\\s*\\(";
 var escapeHatchFunctionPatterns = Object.fromEntries(
   Object.entries(escapeHatchFunctionKeywords).map(([type, keywords]) => [
     type,
-    new RegExp(`\\b(?:${keywords.join("|")})\\s*\\(`, "i")
+    new RegExp(
+      `\\b(?:${keywords.join("|")})${escapeHatchCallSuffix[type] ?? DEFAULT_CALL_SUFFIX}`,
+      "i"
+    )
   ])
 );
 function hasEscapeHatchFunction(strippedSQL, connectorType) {
@@ -77,8 +105,12 @@ var mutatingPatterns = {
   mysql: mutatingPatternWithReplace,
   mariadb: mutatingPatternWithReplace,
   sqlite: mutatingPatternWithReplace,
-  sqlserver: mutatingPatternSqlServer
+  sqlserver: mutatingPatternSqlServer,
+  oracle: mutatingPattern
 };
+function hasMutatingKeyword(strippedSQL, connectorType) {
+  return (mutatingPatterns[connectorType] ?? mutatingPattern).test(strippedSQL);
+}
 var selectIntoPattern = /\bselect\b[\s\S]+\binto\b/i;
 var sqliteReadOnlyArgPragmas = /* @__PURE__ */ new Set([
   "table_info",
@@ -110,11 +142,8 @@ function checkReadOnly(cleanedSQL, connectorType) {
   if (hasEscapeHatchFunction(cleanedSQL, connectorType)) {
     return false;
   }
-  if (firstWord === "with") {
-    const pattern = mutatingPatterns[connectorType] ?? mutatingPattern;
-    if (pattern.test(cleanedSQL)) {
-      return false;
-    }
+  if (firstWord === "with" && hasMutatingKeyword(cleanedSQL, connectorType)) {
+    return false;
   }
   if (firstWord === "pragma" && connectorType === "sqlite") {
     if (cleanedSQL.includes("=")) {
@@ -147,6 +176,7 @@ export {
   sqlServerPassThroughKeywords,
   sqlServerPassThroughPattern,
   hasEscapeHatchFunction,
+  hasMutatingKeyword,
   isReadOnlySQL,
   getFirstKeyword
 };

package/dist/{chunk-MF6LSVWK.js → chunk-IXC4NQGC.js}

@@ -188,6 +188,7 @@ function parseConnectionInfoFromDSN(dsn) {
     return null;
   }
 }
+var REDACTED_DSN = "<redacted DSN>";
 function obfuscateDSNPassword(dsn) {
   if (!dsn) {
     return dsn;
@@ -198,6 +199,9 @@ function obfuscateDSNPassword(dsn) {
       return dsn;
     }
     const url = new SafeURL(dsn);
+    if (url.port && !/^\d+$/.test(url.port)) {
+      return REDACTED_DSN;
+    }
     if (!url.password) {
       return dsn;
     }
@@ -222,7 +226,7 @@ function obfuscateDSNPassword(dsn) {
     }
     return result;
   } catch {
-    return dsn;
+    return REDACTED_DSN;
   }
 }
 function getDatabaseTypeFromDSN(dsn) {
@@ -239,7 +243,8 @@ function protocolToConnectorType(protocol) {
     "mysql": "mysql",
     "mariadb": "mariadb",
     "sqlserver": "sqlserver",
-    "sqlite": "sqlite"
+    "sqlite": "sqlite",
+    "oracle": "oracle"
   };
   return mapping[protocol];
 }
@@ -249,6 +254,7 @@ function getDefaultPortForType(type) {
     "mysql": 3306,
     "mariadb": 3306,
     "sqlserver": 1433,
+    "oracle": 1521,
     "sqlite": void 0
   };
   return ports[type];
@@ -429,12 +435,30 @@ function scanTokenSQLite(sql, i) {
 function scanTokenSQLServer(sql, i) {
   return scanSingleLineComment(sql, i) ?? scanMultiLineComment(sql, i) ?? scanSingleQuotedString(sql, i) ?? scanDoubleQuotedString(sql, i) ?? scanBracketQuotedIdentifier(sql, i) ?? plainToken(i);
 }
+function scanOracleAlternativeQuotedString(sql, i) {
+  if (sql[i] !== "q" && sql[i] !== "Q" || sql[i + 1] !== "'") {
+    return null;
+  }
+  const open = sql[i + 2];
+  if (open === void 0 || open === " " || open === "	" || open === "\n") {
+    return null;
+  }
+  const mirrors = { "(": ")", "[": "]", "{": "}", "<": ">" };
+  const close = (mirrors[open] ?? open) + "'";
+  const closeIdx = sql.indexOf(close, i + 3);
+  const end = closeIdx !== -1 ? closeIdx + close.length : sql.length;
+  return { type: TokenType.QuotedBlock, end };
+}
+function scanTokenOracle(sql, i) {
+  return scanSingleLineComment(sql, i) ?? scanMultiLineComment(sql, i) ?? scanOracleAlternativeQuotedString(sql, i) ?? scanSingleQuotedString(sql, i) ?? scanDoubleQuotedString(sql, i) ?? plainToken(i);
+}
 var dialectScanners = {
   postgres: scanTokenPostgres,
   mysql: scanTokenMySQL,
   mariadb: scanTokenMySQL,
   sqlite: scanTokenSQLite,
-  sqlserver: scanTokenSQLServer
+  sqlserver: scanTokenSQLServer,
+  oracle: scanTokenOracle
 };
 function getScanner(dialect) {
   return dialect ? dialectScanners[dialect] ?? scanTokenAnsi : scanTokenAnsi;
@@ -479,6 +503,7 @@ function blankCommentsAndStrings(sql, dialect) {
   }
   return result;
 }
+var LEADING_SQL_NOISE = /^(?:\s+|--[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*/;
 function splitSQLStatements(sql, dialect) {
   const scanToken = getScanner(dialect);
   const statements = [];
@@ -513,5 +538,6 @@ export {
   getDefaultPortForType,
   stripCommentsAndStrings,
   blankCommentsAndStrings,
+  LEADING_SQL_NOISE,
   splitSQLStatements
 };

package/dist/{chunk-JFWX35TB.js → chunk-X2EC47W4.js}

@@ -9,6 +9,7 @@ function quoteIdentifier(identifier, dbType) {
   switch (dbType) {
     case "postgres":
     case "sqlite":
+    case "oracle":
       return `"${identifier.replace(/"/g, '""')}"`;
     case "mysql":
     case "mariadb":