@bytebase/dbhub 1.3.1 → 1.5.0

package/dist/{chunk-5FL4XMWG.js → chunk-PDKPK25P.js}

@@ -1,6 +1,9 @@
 import {
   isDriverNotInstalled
 } from "./chunk-WVVMH6FJ.js";
+import {
+  MAX_QUERY_TIMEOUT_SECONDS
+} from "./chunk-5XSBOK3W.js";
 import {
   ConnectorRegistry,
   SafeURL,
@@ -27,8 +30,8 @@ var ALL_BUILTIN_TOOL_NAMES = [
 ];
 
 // src/utils/ssh-tunnel.ts
-import { Client } from "ssh2";
-import { readFileSync as readFileSync2 } from "fs";
+import ssh2, { Client } from "ssh2";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
 import { createServer } from "net";
 
 // src/utils/ssh-config-parser.ts
@@ -114,6 +117,9 @@ function parseSSHConfig(hostAlias, configPath, options = {}) {
         sshConfig.privateKey = defaultKey;
       }
     }
+    if (sshConfig.privateKey) {
+      sshConfig.privateKeyDiscovered = true;
+    }
     if (hostConfig.ProxyJump) {
       sshConfig.proxyJump = hostConfig.ProxyJump;
     }
@@ -265,16 +271,61 @@ var SSHTunnel = class {
     try {
       const jumpHosts = config.resolvedJumpHosts ?? (config.proxyJump ? parseJumpHosts(config.proxyJump) : []);
       const privateKeyBuffer = config.privateKey ? this.loadPrivateKey(config.privateKey) : void 0;
-      if (!config.password && !privateKeyBuffer) {
-        throw new Error("Either password or privateKey must be provided for SSH authentication");
+      const agent = this.resolveAgent(config.agent);
+      if (!config.password && !privateKeyBuffer && !agent) {
+        throw new Error("Either password, privateKey, or an SSH agent (agent or SSH_AUTH_SOCK) must be provided for SSH authentication");
       }
-      const finalClient = await this.establishChain(jumpHosts, config, privateKeyBuffer);
+      const finalClient = await this.establishChain(jumpHosts, config, privateKeyBuffer, agent);
       return await this.createLocalTunnel(finalClient, options);
     } catch (error) {
       this.cleanup();
       throw error;
     }
   }
+  /**
+   * Pick the SSH agent socket: an explicitly configured one wins over the ambient
+   * SSH_AUTH_SOCK. A configured socket that does not exist is an error; a stale
+   * SSH_AUTH_SOCK is ignored, since the user never asked DBHub to use it.
+   */
+  resolveAgent(configuredAgent) {
+    if (configuredAgent) {
+      if (!this.agentSocketExists(configuredAgent)) {
+        throw new Error(`SSH agent socket not found: ${configuredAgent}`);
+      }
+      return configuredAgent;
+    }
+    const ambientAgent = process.env.SSH_AUTH_SOCK;
+    if (!ambientAgent) {
+      return void 0;
+    }
+    if (!this.agentSocketExists(ambientAgent)) {
+      console.warn(`Ignoring SSH_AUTH_SOCK: no SSH agent socket at ${ambientAgent}`);
+      return void 0;
+    }
+    return ambientAgent;
+  }
+  /**
+   * Windows agents are named pipes or Pageant rather than files, so only Unix
+   * socket paths are checked.
+   */
+  agentSocketExists(agent) {
+    return process.platform === "win32" || existsSync(agent);
+  }
+  /**
+   * Why ssh2 would refuse this key, mirroring the checks its connect() runs before
+   * trying any auth method, or undefined when the key is usable.
+   */
+  unusableKeyReason(privateKey, passphrase) {
+    const parsed = ssh2.utils.parseKey(privateKey, passphrase);
+    if (parsed instanceof Error) {
+      return parsed.message;
+    }
+    const key = Array.isArray(parsed) ? parsed[0] : parsed;
+    if (key.getPrivatePEM() === null) {
+      return "not a private key";
+    }
+    return void 0;
+  }
   /**
    * Load an SSH private key, supporting both a file path (with symlink resolution)
    * and base64-encoded key content.
@@ -303,14 +354,18 @@ var SSHTunnel = class {
    * Establish a chain of SSH connections through jump hosts.
    * @returns The final SSH client connected to the target host
    */
-  async establishChain(jumpHosts, targetConfig, privateKey) {
+  async establishChain(jumpHosts, targetConfig, privateKey, agent) {
     let previousStream;
     for (let i = 0; i < jumpHosts.length; i++) {
       const jumpHost = jumpHosts[i];
       const nextHost = i + 1 < jumpHosts.length ? jumpHosts[i + 1] : { host: targetConfig.host, port: targetConfig.port || 22 };
-      const hopPrivateKey = jumpHost.privateKey ? this.loadPrivateKey(jumpHost.privateKey) : privateKey;
-      const hopPassword = targetConfig.password;
-      const hopPassphrase = jumpHost.passphrase ?? targetConfig.passphrase;
+      const hopAuth = {
+        password: targetConfig.password,
+        privateKey: jumpHost.privateKey ? this.loadPrivateKey(jumpHost.privateKey) : privateKey,
+        passphrase: jumpHost.passphrase ?? targetConfig.passphrase,
+        privateKeyDiscovered: jumpHost.privateKey ? true : targetConfig.privateKeyDiscovered,
+        agent
+      };
       let client = null;
       let forwardStream;
       try {
@@ -320,9 +375,7 @@ var SSHTunnel = class {
             port: jumpHost.port,
             username: jumpHost.username || targetConfig.username
           },
-          hopPassword,
-          hopPrivateKey,
-          hopPassphrase,
+          hopAuth,
           previousStream,
           `jump host ${i + 1}`,
           targetConfig.keepaliveInterval,
@@ -348,9 +401,13 @@ var SSHTunnel = class {
         port: targetConfig.port || 22,
         username: targetConfig.username
       },
-      targetConfig.password,
-      privateKey,
-      targetConfig.passphrase,
+      {
+        password: targetConfig.password,
+        privateKey,
+        passphrase: targetConfig.passphrase,
+        privateKeyDiscovered: targetConfig.privateKeyDiscovered,
+        agent
+      },
       previousStream,
       jumpHosts.length > 0 ? "target host" : void 0,
       targetConfig.keepaliveInterval,
@@ -362,7 +419,7 @@ var SSHTunnel = class {
   /**
    * Connect to a single SSH host.
    */
-  connectToHost(hostInfo, password, privateKey, passphrase, sock, label, keepaliveInterval, keepaliveCountMax) {
+  connectToHost(hostInfo, auth, sock, label, keepaliveInterval, keepaliveCountMax) {
     return new Promise((resolve, reject) => {
       const client = new Client();
       const sshConfig = {
@@ -370,15 +427,28 @@ var SSHTunnel = class {
         port: hostInfo.port,
         username: hostInfo.username
       };
+      const { password, privateKey, passphrase, agent } = auth;
       if (password) {
         sshConfig.password = password;
       }
       if (privateKey) {
-        sshConfig.privateKey = privateKey;
-        if (passphrase) {
-          sshConfig.passphrase = passphrase;
+        const canSkip = auth.privateKeyDiscovered && Boolean(password || agent);
+        const unusableReason = canSkip ? this.unusableKeyReason(privateKey, passphrase) : void 0;
+        if (unusableReason) {
+          const desc = label || `${hostInfo.host}:${hostInfo.port}`;
+          console.warn(
+            `Skipping unusable SSH private key from ~/.ssh/config for ${desc} (${unusableReason}).`
+          );
+        } else {
+          sshConfig.privateKey = privateKey;
+          if (passphrase) {
+            sshConfig.passphrase = passphrase;
+          }
         }
       }
+      if (agent) {
+        sshConfig.agent = agent;
+      }
       if (sock) {
         sshConfig.sock = sock;
       }
@@ -887,12 +957,14 @@ function resolveSSHConfig() {
   }
   if (args["ssh-key"]) {
     config.privateKey = args["ssh-key"];
+    config.privateKeyDiscovered = false;
     if (config.privateKey.startsWith("~/")) {
       config.privateKey = path.join(process.env.HOME || "", config.privateKey.substring(2));
     }
     sources.push("ssh-key from command line");
   } else if (process.env.SSH_KEY) {
     config.privateKey = process.env.SSH_KEY;
+    config.privateKeyDiscovered = false;
     if (config.privateKey.startsWith("~/")) {
       config.privateKey = path.join(process.env.HOME || "", config.privateKey.substring(2));
     }
@@ -905,6 +977,14 @@ function resolveSSHConfig() {
     config.passphrase = process.env.SSH_PASSPHRASE;
     sources.push("SSH_PASSPHRASE from environment");
   }
+  const cliAgent = requireFlagValue("ssh-agent", args, "~/.ssh/agent.sock");
+  if (cliAgent) {
+    config.agent = cliAgent;
+    if (config.agent.startsWith("~/")) {
+      config.agent = path.join(process.env.HOME || "", config.agent.substring(2));
+    }
+    sources.push("ssh-agent from command line");
+  }
   if (args["ssh-proxy-jump"]) {
     config.proxyJump = args["ssh-proxy-jump"];
     sources.push("ssh-proxy-jump from command line");
@@ -936,8 +1016,8 @@ function resolveSSHConfig() {
   if (!config.host || !config.username) {
     throw new Error("SSH tunnel configuration requires at least --ssh-host and --ssh-user");
   }
-  if (!config.password && !config.privateKey) {
-    throw new Error("SSH tunnel configuration requires either --ssh-password or --ssh-key for authentication");
+  if (!config.password && !config.privateKey && !config.agent && !process.env.SSH_AUTH_SOCK) {
+    throw new Error("SSH tunnel configuration requires either --ssh-password or --ssh-key (or an SSH agent via --ssh-agent or SSH_AUTH_SOCK) for authentication");
   }
   return {
     config,
@@ -1021,7 +1101,9 @@ async function resolveSourceConfigs() {
       source.ssh_user = sshResult.config.username;
       source.ssh_password = sshResult.config.password;
       source.ssh_key = sshResult.config.privateKey;
+      source.ssh_key_discovered = sshResult.config.privateKeyDiscovered;
       source.ssh_passphrase = sshResult.config.passphrase;
+      source.ssh_agent = sshResult.config.agent;
       source.ssh_keepalive_interval = sshResult.config.keepaliveInterval;
       source.ssh_keepalive_count_max = sshResult.config.keepaliveCountMax;
     }
@@ -1189,6 +1271,9 @@ function getRawDSNQueryParam(dsn, key) {
   if (queryStart === -1) {
     return null;
   }
+  if (key === "sslmode" && dsn.startsWith("sqlserver://")) {
+    return new URLSearchParams(dsn.substring(queryStart + 1)).get(key);
+  }
   for (const pair of dsn.substring(queryStart + 1).split("&")) {
     if (pair === "") {
       continue;
@@ -1206,6 +1291,30 @@ function getRawDSNQueryParam(dsn, key) {
   }
   return null;
 }
+var CLIENT_CERT_SSL_MODES = ["require", "verify-ca", "verify-full"];
+function validateReadableFile(source, field, filePath, configPath) {
+  const expandedPath = expandHomeDir(filePath);
+  let stats;
+  try {
+    stats = fs2.statSync(expandedPath);
+  } catch {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} file not found or not accessible: '${expandedPath}'`
+    );
+  }
+  if (!stats.isFile()) {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} path is not a regular file: '${expandedPath}'`
+    );
+  }
+  try {
+    fs2.accessSync(expandedPath, fs2.constants.R_OK);
+  } catch {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} file is not readable: '${expandedPath}'`
+    );
+  }
+}
 function validateDSNFieldConflicts(source, configPath) {
   const conflict = (field, fieldValue, dsnValue) => {
     throw new Error(
@@ -1256,12 +1365,22 @@ function validateDSNFieldConflicts(source, configPath) {
   }
   const dsnSslmode = getRawDSNQueryParam(source.dsn, "sslmode");
   if (source.sslmode && dsnSslmode !== null && dsnSslmode !== source.sslmode) {
+    if (source.type === "sqlserver") {
+      throw new Error("Conflicting SQL Server sslmode. Set sslmode in only one place, or make the two values match.");
+    }
     conflict("sslmode", source.sslmode, dsnSslmode);
   }
   const dsnSslrootcert = getRawDSNQueryParam(source.dsn, "sslrootcert");
   if (source.sslrootcert && dsnSslrootcert !== null && expandHomeDir(source.sslrootcert) !== expandHomeDir(dsnSslrootcert)) {
     conflict("sslrootcert", expandHomeDir(source.sslrootcert), expandHomeDir(dsnSslrootcert));
   }
+  for (const field of ["sslcert", "sslkey"]) {
+    const fieldValue = source[field];
+    const dsnValue = getRawDSNQueryParam(source.dsn, field);
+    if (fieldValue && dsnValue !== null && expandHomeDir(fieldValue) !== expandHomeDir(dsnValue)) {
+      conflict(field, expandHomeDir(fieldValue), expandHomeDir(dsnValue));
+    }
+  }
   const dsnInstanceName = getRawDSNQueryParam(source.dsn, "instanceName");
   if (source.instanceName && dsnInstanceName !== null && dsnInstanceName !== source.instanceName) {
     conflict("instanceName", source.instanceName, dsnInstanceName);
@@ -1338,9 +1457,9 @@ function validateSourceConfig(source, configPath) {
     }
   }
   if (source.query_timeout !== void 0) {
-    if (typeof source.query_timeout !== "number" || source.query_timeout <= 0) {
+    if (!Number.isFinite(source.query_timeout) || source.query_timeout <= 0 || source.query_timeout > MAX_QUERY_TIMEOUT_SECONDS) {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' has invalid query_timeout. Must be a positive number (in seconds).`
+        `Configuration file ${configPath}: source '${source.id}' has invalid query_timeout. Must be a positive number of seconds, at most ${MAX_QUERY_TIMEOUT_SECONDS}.`
       );
     }
   }
@@ -1363,6 +1482,13 @@ function validateSourceConfig(source, configPath) {
       );
     }
   }
+  if (source.ssh_agent !== void 0) {
+    if (typeof source.ssh_agent !== "string" || source.ssh_agent.trim() === "") {
+      throw new Error(
+        `Configuration file ${configPath}: source '${source.id}' has invalid ssh_agent. Must be a path to an SSH agent socket.`
+      );
+    }
+  }
   if (source.sslmode !== void 0) {
     if (source.type === "sqlite") {
       throw new Error(
@@ -1377,6 +1503,7 @@ function validateSourceConfig(source, configPath) {
     }
     const verifyModesByType = {
       postgres: ["verify-ca", "verify-full"],
+      sqlserver: ["verify-full"],
       oracle: ["verify-full"]
     };
     if ((source.sslmode === "verify-ca" || source.sslmode === "verify-full") && !(verifyModesByType[source.type] ?? []).includes(source.sslmode)) {
@@ -1400,27 +1527,26 @@ function validateSourceConfig(source, configPath) {
         `Configuration file ${configPath}: source '${source.id}' has sslrootcert but sslmode is '${source.sslmode ?? "not set"}'. sslrootcert requires sslmode 'verify-ca' or 'verify-full'`
       );
     }
-    const expandedPath = expandHomeDir(source.sslrootcert);
-    let stats;
-    try {
-      stats = fs2.statSync(expandedPath);
-    } catch {
+    validateReadableFile(source, "sslrootcert", source.sslrootcert, configPath);
+  }
+  if (source.sslcert !== void 0 || source.sslkey !== void 0) {
+    if (source.type !== "postgres") {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert file not found or not accessible: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has sslcert/sslkey but they are only supported for PostgreSQL.`
       );
     }
-    if (!stats.isFile()) {
+    if (source.sslcert === void 0 || source.sslkey === void 0) {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert path is not a regular file: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has ${source.sslcert !== void 0 ? "sslcert" : "sslkey"} without ${source.sslcert !== void 0 ? "sslkey" : "sslcert"}. sslcert and sslkey must be set together for client certificate authentication`
       );
     }
-    try {
-      fs2.accessSync(expandedPath, fs2.constants.R_OK);
-    } catch {
+    if (!CLIENT_CERT_SSL_MODES.includes(source.sslmode ?? "")) {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert file is not readable: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has sslcert/sslkey but sslmode is '${source.sslmode ?? "not set"}'. sslcert/sslkey require sslmode 'require', 'verify-ca' or 'verify-full'`
       );
     }
+    validateReadableFile(source, "sslcert", source.sslcert, configPath);
+    validateReadableFile(source, "sslkey", source.sslkey, configPath);
   }
   if (source.authentication !== void 0) {
     if (source.type !== "sqlserver") {
@@ -1536,8 +1662,14 @@ function processSourceConfigs(sources, configPath) {
     if (processed.ssh_key) {
       processed.ssh_key = expandHomeDir(processed.ssh_key);
     }
-    if (processed.sslrootcert) {
-      processed.sslrootcert = expandHomeDir(processed.sslrootcert);
+    delete processed.ssh_key_discovered;
+    if (typeof processed.ssh_agent === "string" && processed.ssh_agent) {
+      processed.ssh_agent = expandHomeDir(processed.ssh_agent);
+    }
+    for (const field of ["sslrootcert", "sslcert", "sslkey"]) {
+      if (processed[field]) {
+        processed[field] = expandHomeDir(processed[field]);
+      }
     }
     if (processed.type === "sqlite" && processed.database) {
       processed.database = resolveSqliteDatabasePath(processed.database, configPath);
@@ -1567,12 +1699,14 @@ function processSourceConfigs(sources, configPath) {
       try {
         const url = new SafeURL(processed.dsn);
         const dsnSslmode = url.getSearchParam("sslmode");
-        if (!processed.sslmode && dsnSslmode) {
+        if (processed.sslmode === void 0 && dsnSslmode) {
           processed.sslmode = dsnSslmode;
         }
-        const dsnSslrootcert = url.getSearchParam("sslrootcert");
-        if (!processed.sslrootcert && dsnSslrootcert) {
-          processed.sslrootcert = dsnSslrootcert;
+        for (const field of ["sslrootcert", "sslcert", "sslkey"]) {
+          const dsnValue = url.getSearchParam(field);
+          if (!processed[field] && dsnValue) {
+            processed[field] = dsnValue;
+          }
         }
       } catch {
       }
@@ -1631,10 +1765,7 @@ function mergeSourceFieldsIntoDSN(dsn, source) {
   if (source.sslmode && !hasParam("sslmode")) {
     additions.push(`sslmode=${source.sslmode}`);
   }
-  if (source.sslrootcert && source.type === "postgres" && (source.sslmode === "verify-ca" || source.sslmode === "verify-full") && !hasParam("sslrootcert")) {
-    const expandedCertPath = expandHomeDir(source.sslrootcert);
-    additions.push(`sslrootcert=${encodeURIComponent(expandedCertPath)}`);
-  }
+  additions.push(...postgresSslFileParams(source).filter(({ key }) => !hasParam(key)).map(({ param }) => param));
   if (additions.length === 0) {
     return dsn;
   }
@@ -1648,6 +1779,23 @@ function mergeSourceFieldsIntoDSN(dsn, source) {
   }
   return `${dsn}${separator}${additions.join("&")}`;
 }
+function postgresSslFileParams(source) {
+  if (source.type !== "postgres") {
+    return [];
+  }
+  const params = [];
+  const push = (key) => {
+    params.push({ key, param: `${key}=${encodeURIComponent(expandHomeDir(source[key]))}` });
+  };
+  if (source.sslrootcert && (source.sslmode === "verify-ca" || source.sslmode === "verify-full")) {
+    push("sslrootcert");
+  }
+  if (source.sslcert && source.sslkey && CLIENT_CERT_SSL_MODES.includes(source.sslmode ?? "")) {
+    push("sslcert");
+    push("sslkey");
+  }
+  return params;
+}
 function buildDSNFromSource(source) {
   if (source.dsn) {
     return mergeSourceFieldsIntoDSN(source.dsn, source);
@@ -1700,10 +1848,7 @@ function buildDSNFromSource(source) {
   if (source.sslmode && source.type !== "sqlite") {
     queryParams.push(`sslmode=${source.sslmode}`);
   }
-  if (source.sslrootcert && source.type === "postgres" && (source.sslmode === "verify-ca" || source.sslmode === "verify-full")) {
-    const expandedCertPath = expandHomeDir(source.sslrootcert);
-    queryParams.push(`sslrootcert=${encodeURIComponent(expandedCertPath)}`);
-  }
+  queryParams.push(...postgresSslFileParams(source).map(({ param }) => param));
   if (queryParams.length > 0) {
     dsn += `?${queryParams.join("&")}`;
   }
@@ -1792,7 +1937,6 @@ function classifyConnectionError(error, connectorType, sourceId) {
 var managerInstance = null;
 var AWS_IAM_TOKEN_REFRESH_MS = 14 * 60 * 1e3;
 var ConnectorManager = class {
-  // Prevent race conditions
   constructor() {
     // Maps for multi-source support
     this.connectors = /* @__PURE__ */ new Map();
@@ -1802,11 +1946,17 @@ var ConnectorManager = class {
     this.sourceIds = [];
     // Ordered list of source IDs (first is default)
     this.iamRefreshTimers = /* @__PURE__ */ new Map();
+    this.pendingIamRefreshes = /* @__PURE__ */ new Map();
+    // In-flight refresh per source
     this.isDisconnecting = false;
     // Lazy connection support
     this.lazySources = /* @__PURE__ */ new Map();
     // Sources pending lazy connection
     this.pendingConnections = /* @__PURE__ */ new Map();
+    // Prevent race conditions
+    // A socket timeout does not cancel a credential helper. Share its in-flight
+    // attempt across retries of the same config, but never across changed profiles.
+    this.pendingIamTokens = /* @__PURE__ */ new WeakMap();
     if (!managerInstance) {
       managerInstance = this;
     }
@@ -1892,7 +2042,8 @@ var ConnectorManager = class {
    */
   async connectSource(source) {
     const sourceId = source.id;
-    const dsn = await this.buildConnectionDSN(source);
+    const config = {};
+    const dsn = await this.buildConnectionDSN(source, config);
     console.error(`  - ${sourceId}: ${redactDSN(dsn)}`);
     let actualDSN = dsn;
     let tunnel;
@@ -1920,7 +2071,9 @@ var ConnectorManager = class {
         username: username || "",
         password: source.ssh_password,
         privateKey: source.ssh_key || resolvedSSHConfig?.privateKey,
+        privateKeyDiscovered: source.ssh_key ? source.ssh_key_discovered : resolvedSSHConfig?.privateKeyDiscovered,
         passphrase: source.ssh_passphrase,
+        agent: source.ssh_agent,
         proxyJump,
         resolvedJumpHosts,
         keepaliveInterval: source.ssh_keepalive_interval,
@@ -1931,9 +2084,9 @@ var ConnectorManager = class {
           `Source '${sourceId}': SSH tunnel requires ssh_user (or a matching Host entry in ~/.ssh/config with User)`
         );
       }
-      if (!sshConfig.password && !sshConfig.privateKey) {
+      if (!sshConfig.password && !sshConfig.privateKey && !sshConfig.agent && !process.env.SSH_AUTH_SOCK) {
         throw new Error(
-          `Source '${sourceId}': SSH tunnel requires either ssh_password or ssh_key (or a matching Host entry in ~/.ssh/config with IdentityFile)`
+          `Source '${sourceId}': SSH tunnel requires either ssh_password or ssh_key (or a matching Host entry in ~/.ssh/config with IdentityFile, or an SSH agent via ssh_agent or SSH_AUTH_SOCK)`
         );
       }
       const url = new URL(dsn);
@@ -1960,37 +2113,37 @@ var ConnectorManager = class {
         `  SSH tunnel established through localhost:${tunnelInfo.localPort}`
       );
     }
-    const connectorPrototype = ConnectorRegistry.getConnectorForDSN(actualDSN);
-    if (!connectorPrototype) {
-      throw new Error(
-        `Source '${sourceId}': No connector found for DSN: ${actualDSN}`
-      );
-    }
-    const connector = connectorPrototype.clone();
-    connector.sourceId = sourceId;
-    const config = {};
-    if (source.connection_timeout !== void 0) {
-      config.connectionTimeoutSeconds = source.connection_timeout;
-    }
-    if (source.query_timeout !== void 0 && connector.id !== "sqlite") {
-      config.queryTimeoutSeconds = source.query_timeout;
-    }
-    if (source.pool_max_connections !== void 0) {
-      config.poolMaxConnections = source.pool_max_connections;
-    }
-    if (source.search_path) {
-      config.searchPath = source.search_path;
-    }
-    if (source.timezone) {
-      config.timezone = source.timezone;
-    }
-    if (source.charset) {
-      config.charset = source.charset;
-    }
-    if (source.collation) {
-      config.collation = source.collation;
-    }
+    let connector;
     try {
+      const connectorPrototype = ConnectorRegistry.getConnectorForDSN(actualDSN);
+      if (!connectorPrototype) {
+        throw new Error(
+          `Source '${sourceId}': No connector found for DSN: ${actualDSN}`
+        );
+      }
+      connector = connectorPrototype.clone();
+      connector.sourceId = sourceId;
+      if (source.connection_timeout !== void 0) {
+        config.connectionTimeoutSeconds = source.connection_timeout;
+      }
+      if (source.query_timeout !== void 0 && connector.id !== "sqlite") {
+        config.queryTimeoutSeconds = source.query_timeout;
+      }
+      if (source.pool_max_connections !== void 0) {
+        config.poolMaxConnections = source.pool_max_connections;
+      }
+      if (source.search_path) {
+        config.searchPath = source.search_path;
+      }
+      if (source.timezone) {
+        config.timezone = source.timezone;
+      }
+      if (source.charset) {
+        config.charset = source.charset;
+      }
+      if (source.collation) {
+        config.collation = source.collation;
+      }
       await connector.connect(actualDSN, source.init_script, config);
     } catch (error) {
       if (tunnel) {
@@ -2010,6 +2163,77 @@ var ConnectorManager = class {
     this.sourceConfigs.set(sourceId, source);
     this.scheduleIamRefresh(source);
   }
+  /**
+   * Add a single source without touching the others. Eager sources connect now;
+   * lazy ones are registered and connect on first use. Used by the TOML hot reload
+   * to apply only the entries that changed.
+   */
+  async addSource(source) {
+    if (this.sourceIds.includes(source.id)) {
+      throw new Error(`Source '${source.id}' already exists`);
+    }
+    if (source.lazy) {
+      this.registerLazySource(source);
+    } else {
+      await this.connectSource(source);
+    }
+  }
+  /**
+   * Disconnect and forget a single source, leaving every other source's pool and
+   * tunnel untouched. Resolves silently for an unknown id.
+   */
+  async removeSource(sourceId) {
+    const pending = this.pendingConnections.get(sourceId);
+    if (pending) {
+      try {
+        await pending;
+      } catch {
+      }
+    }
+    const refresh = this.pendingIamRefreshes.get(sourceId);
+    if (refresh) {
+      await refresh;
+    }
+    const timer = this.iamRefreshTimers.get(sourceId);
+    if (timer) {
+      clearTimeout(timer);
+      this.iamRefreshTimers.delete(sourceId);
+    }
+    const connector = this.connectors.get(sourceId);
+    this.connectors.delete(sourceId);
+    if (connector) {
+      try {
+        await connector.disconnect();
+        console.error(`Disconnected from source '${sourceId}'`);
+      } catch (error) {
+        console.error(`Error disconnecting from source '${sourceId}':`, error);
+      }
+    }
+    const tunnel = this.sshTunnels.get(sourceId);
+    this.sshTunnels.delete(sourceId);
+    if (tunnel) {
+      try {
+        await tunnel.close();
+      } catch (error) {
+        console.error(`Error closing SSH tunnel for source '${sourceId}':`, error);
+      }
+    }
+    this.sourceConfigs.delete(sourceId);
+    this.lazySources.delete(sourceId);
+    this.pendingConnections.delete(sourceId);
+    this.sourceIds = this.sourceIds.filter((id) => id !== sourceId);
+  }
+  /**
+   * Reorder known sources to match `orderedIds` (the first entry is the default
+   * source). Unknown ids are ignored; known ids missing from the list keep their
+   * relative order after the listed ones.
+   */
+  reorderSources(orderedIds) {
+    const known = new Set(this.sourceIds);
+    const ordered = orderedIds.filter((id) => known.has(id));
+    const listed = new Set(ordered);
+    this.sourceIds = [...ordered, ...this.sourceIds.filter((id) => !listed.has(id))];
+  }
   /**
    * Close all database connections
    */
@@ -2039,6 +2263,7 @@ var ConnectorManager = class {
     this.sourceConfigs.clear();
     this.lazySources.clear();
     this.pendingConnections.clear();
+    this.pendingIamRefreshes.clear();
     this.sourceIds = [];
     this.isDisconnecting = false;
   }
@@ -2159,25 +2384,29 @@ var ConnectorManager = class {
       clearTimeout(existingTimer);
       this.iamRefreshTimers.delete(sourceId);
     }
-    if (!source.aws_iam_auth) {
+    if (!source.aws_iam_auth || source.type === "postgres") {
       return;
     }
-    const timer = setTimeout(async () => {
+    const timer = setTimeout(() => {
       if (this.isDisconnecting) {
         return;
       }
-      try {
-        await this.refreshIamSourceConnection(source);
-      } catch (error) {
-        console.error(
-          `Error refreshing AWS IAM auth token for source '${sourceId}':`,
-          error
-        );
-      } finally {
-        if (!this.isDisconnecting && this.connectors.has(sourceId)) {
-          this.scheduleIamRefresh(source);
+      const run = (async () => {
+        try {
+          await this.refreshIamSourceConnection(source);
+        } catch (error) {
+          console.error(
+            `Error refreshing AWS IAM auth token for source '${sourceId}':`,
+            error
+          );
+        } finally {
+          this.pendingIamRefreshes.delete(sourceId);
+          if (!this.isDisconnecting && this.ownsSource(source) && this.connectors.has(sourceId)) {
+            this.scheduleIamRefresh(source);
+          }
         }
-      }
+      })();
+      this.pendingIamRefreshes.set(sourceId, run);
     }, AWS_IAM_TOKEN_REFRESH_MS);
     timer.unref?.();
     this.iamRefreshTimers.set(sourceId, timer);
@@ -2198,23 +2427,31 @@ var ConnectorManager = class {
       await existingTunnel.close();
       this.sshTunnels.delete(sourceId);
     }
-    if (this.isDisconnecting) {
+    if (this.isDisconnecting || !this.ownsSource(source)) {
       return;
     }
     try {
       await this.connectSource(source);
     } catch (error) {
-      if (!this.isDisconnecting && this.sourceConfigs.has(sourceId)) {
+      if (!this.isDisconnecting && this.ownsSource(source)) {
         this.lazySources.set(sourceId, source);
       }
       throw error;
     }
   }
+  /**
+   * True while `source` is the config object registered under its id. Every
+   * registration path stores the same object, so identity tells an in-flight
+   * operation whether its source was removed or replaced underneath it.
+   */
+  ownsSource(source) {
+    return this.sourceConfigs.get(source.id) === source;
+  }
   /**
    * Build a connection DSN, optionally replacing password with
    * an AWS RDS IAM auth token when aws_iam_auth is enabled.
    */
-  async buildConnectionDSN(source) {
+  async buildConnectionDSN(source, config = {}) {
     const dsn = buildDSNFromSource(source);
     if (!source.aws_iam_auth) {
       return dsn;
@@ -2240,13 +2477,26 @@ var ConnectorManager = class {
         `Source '${source.id}': unable to resolve host, username, or port for AWS IAM authentication`
       );
     }
-    const token = await generateRdsAuthToken({
-      hostname,
-      port,
-      username,
-      region: source.aws_region,
-      profile: source.aws_profile
-    });
+    const password = () => {
+      let pending = this.pendingIamTokens.get(source);
+      if (!pending) {
+        pending = generateRdsAuthToken({
+          hostname,
+          port,
+          username,
+          region: source.aws_region,
+          profile: source.aws_profile
+        }).finally(() => {
+          this.pendingIamTokens.delete(source);
+        });
+        this.pendingIamTokens.set(source, pending);
+      }
+      return pending;
+    };
+    if (source.type === "postgres") {
+      config.password = password;
+    }
+    const token = source.type === "postgres" ? "" : await password();
     const queryParams = new Map(parsed.searchParams);
     const currentSslMode = queryParams.get("sslmode");
     if (currentSslMode !== "verify-ca" && currentSslMode !== "verify-full") {