@kazurolabs/psql-explorer 0.1.0 → 0.3.1

package/dist/commands/explore.js

@@ -5,6 +5,7 @@ import { addressOf, findEnvironment, listEnvironments, } from '../environments.j
 import { describeTable, listSchemas, listTables, parseTableRef, serverInfo, tableLabel, } from '../explorer/catalog.js';
 import { commandSummary, formatBytes, formatDuration, formatEstimate, formatResult, outputFormats, } from '../explorer/format.js';
 import { browseRows, DEFAULT_PAGE_SIZE } from '../explorer/rows.js';
+import { compareSchemas } from '../explorer/schema-diff.js';
 import { DEFAULT_MAX_ROWS, describeQueryError, } from '../explorer/session.js';
 import { connectEntry } from '../explorer/connect-entry.js';
 export const commandNames = [
@@ -16,6 +17,7 @@ export const commandNames = [
     'query',
     'info',
     'history',
+    'diff',
 ];
 export const isCommand = (name) => commandNames.includes(name);
 /** Thrown for a wrong command line: exit code 2. */
@@ -41,8 +43,7 @@ function formatOf(flags) {
     }
     return format;
 }
-function environmentFor(options) {
-    const { env } = options.flags;
+function environmentFor(options, env = options.flags.env) {
     if (!env)
         throw new UsageError(`${options.command} needs --env <name>`);
     const entry = findEnvironment(options.services, env);
@@ -66,8 +67,6 @@ async function withSession(options, work) {
     }
     finally {
         await session.close();
-        // Credentials issued for this command end with it.
-        await options.services.groups?.release(entry.name);
     }
 }
 function envs(options) {
@@ -253,6 +252,87 @@ async function info(options, session, entry) {
     ]), format));
     return 0;
 }
+const indent = (text, prefix) => text
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+/** One object that differs, as text: its parts with each side's value, or a line by line diff. */
+function describeChange(change, a, b) {
+    const name = change.kind === 'schema' || change.kind === 'extension'
+        ? change.name
+        : `${change.schema}.${change.name}`;
+    const status = change.status === 'only-a'
+        ? `only in ${a}`
+        : change.status === 'only-b'
+            ? `only in ${b}`
+            : 'differs';
+    const out = [`${change.kind} ${name}: ${status}`];
+    const width = Math.max(a.length, b.length) + 1;
+    for (const part of change.parts) {
+        const value = part.a ?? part.b ?? '';
+        const label = change.status === 'changed' && (part.a === null || part.b === null)
+            ? `${part.part}, only in ${part.a === null ? b : a}`
+            : part.part;
+        if (change.status !== 'changed' || part.a === null || part.b === null) {
+            out.push(value.includes('\n') ? `  ${label}:\n${indent(value, '      ')}` : `  ${label}: ${value}`);
+        }
+        else if (part.lines) {
+            out.push(`  ${part.part}  (- ${a}, + ${b})`);
+            for (const line of part.lines) {
+                out.push(`    ${line.side === 'a' ? '-' : line.side === 'b' ? '+' : ' '} ${line.text}`);
+            }
+        }
+        else {
+            out.push(`  ${part.part}`, `    ${`${a}:`.padEnd(width)} ${part.a}`, `    ${`${b}:`.padEnd(width)} ${part.b}`);
+        }
+    }
+    return out.join('\n');
+}
+async function diff(options) {
+    const format = formatOf(options.flags);
+    const entry = environmentFor(options);
+    if (!options.flags.with)
+        throw new UsageError('diff needs --with <name>, the environment to compare with');
+    const other = environmentFor(options, options.flags.with);
+    const { schema, withSchema } = options.flags;
+    const session = await connect(options, entry);
+    let found;
+    try {
+        const otherSession = await connect(options, other);
+        try {
+            found = await compareSchemas(session, otherSession, { schema, withSchema });
+        }
+        finally {
+            await otherSession.close();
+        }
+    }
+    finally {
+        await session.close();
+    }
+    if (format === 'json') {
+        json(options, { a: entry.name, b: other.name, ...found });
+        return 0;
+    }
+    if (format === 'csv') {
+        options.out(formatResult(result(['schema', 'kind', 'name', 'status', 'part', entry.name, other.name], found.changes.flatMap((change) => (change.parts.length > 0 ? change.parts : [{ part: null, a: null, b: null }]).map((part) => [
+            change.schema,
+            change.kind,
+            change.name,
+            change.status,
+            part.part,
+            part.a,
+            part.b,
+        ]))), 'csv'));
+        return 0;
+    }
+    for (const change of found.changes)
+        options.out(`${describeChange(change, entry.name, other.name)}\n\n`);
+    const differ = found.changes.length;
+    options.out(differ === 0
+        ? `${entry.name} and ${other.name} are the same (${found.same} objects).\n`
+        : `${differ} ${differ === 1 ? 'object differs' : 'objects differ'}, ${found.same} the same.\n`);
+    return 0;
+}
 function history(options) {
     const format = formatOf(options.flags);
     const entry = environmentFor(options);
@@ -296,6 +376,8 @@ export async function runCommand(options) {
             }
             case 'info':
                 return await withSession(options, (session, entry) => info(options, session, entry));
+            case 'diff':
+                return await diff(options);
         }
     }
     catch (error) {

package/dist/config/load.js

@@ -4,7 +4,6 @@ import { createSource, SourceError } from './source.js';
 export const environmentNamePattern = /^[a-z0-9][a-z0-9-_]*$/;
 const envVariablePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const vaultPattern = /^[^#\s]+#[^#\s]+$/;
-const vaultRolePattern = /^[^#\s/][^#\s]*$/;
 const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 export const environmentsVariable = 'PSQL_EXPLORER_ENVIRONMENTS';
 /**
@@ -121,38 +120,28 @@ class Checker {
             'schema',
             'username',
             'password',
-            'credentials',
             'auth',
             'tls',
             'readOnly',
             'confirm',
+            'seeder',
+            'designer',
         ]);
         const tier = this.choice(raw.tier, [...path, 'tier'], tiers, undefined);
         const auth = this.choice(raw.auth, [...path, 'auth'], authModes, 'password');
         const host = this.value(raw.host, [...path, 'host'], { required: true });
         const port = this.value(raw.port, [...path, 'port'], { required: true, number: true });
         const database = this.value(raw.database, [...path, 'database'], { required: true });
-        const credentials = this.credentials(raw.credentials, [...path, 'credentials']);
-        const hasCredentials = raw.credentials !== undefined;
         const schema = this.value(raw.schema, [...path, 'schema']);
-        const username = this.value(raw.username, [...path, 'username'], { required: !hasCredentials });
+        const username = this.value(raw.username, [...path, 'username'], { required: true });
         const password = this.value(raw.password, [...path, 'password']);
         const isProtected = raw.protected === undefined ? undefined : this.flag(raw.protected, [...path, 'protected']);
         const readOnly = raw.readOnly === undefined ? undefined : this.flag(raw.readOnly, [...path, 'readOnly']);
         const confirm = raw.confirm === undefined ? undefined : this.flag(raw.confirm, [...path, 'confirm']);
+        const seeder = raw.seeder === undefined ? undefined : this.flag(raw.seeder, [...path, 'seeder']);
+        const designer = raw.designer === undefined ? undefined : this.flag(raw.designer, [...path, 'designer']);
         const tls = this.tls(raw.tls, [...path, 'tls']);
-        if (hasCredentials) {
-            // Username and password come from Vault: setting them too would be two answers.
-            for (const field of ['username', 'password']) {
-                if (raw[field] !== undefined) {
-                    this.add([...path, field], 'must not be set when credentials is given: Vault supplies it', true);
-                }
-            }
-            if (auth === 'none') {
-                this.add([...path, 'auth'], 'must be password when credentials is given', true);
-            }
-        }
-        else if (auth === 'password' && raw.password === undefined) {
+        if (auth === 'password' && raw.password === undefined) {
             this.add([...path, 'password'], 'is required when auth is password');
         }
         if (auth === 'none' && raw.password !== undefined) {
@@ -168,12 +157,13 @@ class Checker {
             protected: guarded,
             readOnly: readOnly ?? guarded,
             confirm: confirm ?? guarded,
+            seeder: seeder ?? (tier === 'development' || tier === 'local'),
+            designer: designer ?? (tier === 'development' || tier === 'local'),
             host: host,
             port: port,
             database: database,
             ...(schema === undefined ? {} : { schema }),
-            ...(username === undefined ? {} : { username }),
-            ...(credentials === undefined ? {} : { credentials }),
+            username: username,
             auth: auth,
             ...(password === undefined ? {} : { password }),
             tls: tls,
@@ -185,9 +175,8 @@ class Checker {
         if (!isRecord(raw))
             return this.fail(path, 'must be a mapping');
         const before = this.problems.length;
-        this.unknownKeys(raw, path, ['mode', 'client', 'ca', 'cert', 'key', 'keyPassphrase']);
+        this.unknownKeys(raw, path, ['mode', 'ca', 'cert', 'key', 'keyPassphrase']);
         const mode = this.choice(raw.mode, [...path, 'mode'], tlsModes, 'disable');
-        const client = this.client(raw.client, [...path, 'client']);
         const ca = this.value(raw.ca, [...path, 'ca']);
         const cert = this.value(raw.cert, [...path, 'cert']);
         const key = this.value(raw.key, [...path, 'key']);
@@ -198,20 +187,7 @@ class Checker {
         if (raw.key !== undefined && raw.cert === undefined) {
             this.add([...path, 'key'], 'cert and key must be given together', true);
         }
-        if (raw.client !== undefined) {
-            // The certificate, its key and (unless given) the CA all come from Vault.
-            for (const field of ['cert', 'key', 'keyPassphrase']) {
-                if (raw[field] !== undefined) {
-                    this.add([...path, field], 'must not be set when client is given: Vault supplies the certificate and key', true);
-                }
-            }
-            if (mode === 'disable') {
-                this.add([...path, 'client'], 'has no effect when tls mode is disable', true);
-            }
-        }
-        if ((mode === 'verify-ca' || mode === 'verify-full') &&
-            raw.ca === undefined &&
-            raw.client === undefined) {
+        if ((mode === 'verify-ca' || mode === 'verify-full') && raw.ca === undefined) {
             this.add([...path, 'ca'], `is required when tls mode is ${mode}`);
         }
         if (this.problems.length > before)
@@ -219,47 +195,9 @@ class Checker {
         const optional = { ca, cert, key, keyPassphrase };
         return {
             mode: mode,
-            ...(client === undefined ? {} : { client }),
             ...Object.fromEntries(Object.entries(optional).filter(([, value]) => value !== undefined)),
         };
     }
-    credentials(raw, path) {
-        if (raw === undefined)
-            return undefined;
-        if (!isRecord(raw)) {
-            return this.fail(path, 'must be a mapping: source: vault-database and value: <role path>');
-        }
-        this.unknownKeys(raw, path, ['source', 'value']);
-        this.sourceIs(raw, path, 'vault-database');
-        const vaultDatabase = this.vaultPath(raw.value, [...path, 'value'], 'database/creds/<role>');
-        return vaultDatabase === undefined ? undefined : { vaultDatabase };
-    }
-    client(raw, path) {
-        if (raw === undefined)
-            return undefined;
-        if (!isRecord(raw)) {
-            return this.fail(path, 'must be a mapping: source: vault-pki, value: <role path> and commonName');
-        }
-        this.unknownKeys(raw, path, ['source', 'value', 'commonName']);
-        this.sourceIs(raw, path, 'vault-pki');
-        const vaultPki = this.vaultPath(raw.value, [...path, 'value'], 'pki/issue/<role>');
-        const commonName = this.text(raw.commonName, [...path, 'commonName'], { required: true });
-        return vaultPki === undefined || commonName === undefined ? undefined : { vaultPki, commonName };
-    }
-    // A group of fields filled by one Vault lease names its kind as the source.
-    sourceIs(raw, path, expected) {
-        if (raw.source !== expected) {
-            this.add([...path, 'source'], `must be ${expected}`, raw.source !== undefined);
-        }
-    }
-    // An API path in Vault, e.g. "pki/issue/migrator".
-    vaultPath(raw, path, example) {
-        if (raw === undefined)
-            return this.fail(path, 'is required');
-        return typeof raw === 'string' && vaultRolePattern.test(raw)
-            ? raw
-            : this.fail(path, `must be a Vault API path such as ${example}`);
-    }
     // A literal text setting.
     text(raw, path, options) {
         if (raw === undefined) {

package/dist/config/resolve-environment.js

@@ -17,20 +17,6 @@ export async function resolveEnvironment(env, ctx) {
         interactive: ctx.interactive,
         signal: ctx.signal,
     }, registry);
-    const groupContext = (field) => {
-        if (!ctx.groups)
-            throw fail(field, 'no resolver for Vault credentials or certificates');
-        return {
-            groups: ctx.groups,
-            ctx: {
-                envName: env.name,
-                field,
-                configDir: env.dir,
-                interactive: ctx.interactive,
-                signal: ctx.signal,
-            },
-        };
-    };
     // Text from a file or a prompt often carries a stray newline or space.
     const checked = async (field, value, rule) => {
         const text = (await resolve(field, value)).trim();
@@ -59,48 +45,20 @@ export async function resolveEnvironment(env, ctx) {
     const schema = env.schema === undefined
         ? defaultSchemaName
         : await checked('schema', env.schema, (v) => identifierError('Schema', v));
-    let username;
+    const username = await checked('username', env.username, (v) => identifierError('Username', v));
     let password;
-    if (env.credentials) {
-        // One lease supplies both, so they are looked up together.
-        const { groups, ctx: credentialsCtx } = groupContext('credentials');
-        const issued = await groups.databaseCredentials(env.credentials.vaultDatabase, credentialsCtx);
-        username = issued.username.trim();
-        const userMessage = identifierError('Username', username);
-        if (userMessage)
-            throw fail('credentials', `Vault issued an invalid username: ${userMessage}`);
-        const passwordMessage = passwordError(issued.password);
-        if (passwordMessage)
-            throw fail('credentials', `Vault issued an invalid password`);
-        password = issued.password;
-    }
-    else {
-        username = await checked('username', env.username, (v) => identifierError('Username', v));
-        if (env.auth === 'password' && env.password !== undefined) {
-            const text = await resolve('password', env.password);
-            const message = passwordError(text);
-            if (message)
-                throw fail('password', message);
-            password = text;
-        }
+    if (env.auth === 'password' && env.password !== undefined) {
+        const text = await resolve('password', env.password);
+        const message = passwordError(text);
+        if (message)
+            throw fail('password', message);
+        password = text;
     }
     const tls = { mode: env.tls.mode };
     // With TLS off these are never used, so they are not looked up (or prompted for).
     if (env.tls.mode !== 'disable') {
         if (env.tls.ca !== undefined)
             tls.ca = await pem('tls.ca', env.tls.ca);
-        if (env.tls.client) {
-            const { ctx: clientCtx, groups } = groupContext('tls.client');
-            const issued = await groups.clientCertificate(env.tls.client.vaultPki, env.tls.client.commonName, clientCtx);
-            if (!issued.cert.includes('-----BEGIN') || !issued.key.includes('-----BEGIN')) {
-                throw fail('tls.client', 'Vault did not issue PEM text');
-            }
-            tls.cert = issued.cert;
-            tls.key = issued.key;
-            // The issuing CA stands in for a ca that was not written in the file.
-            if (tls.ca === undefined && issued.ca)
-                tls.ca = issued.ca;
-        }
         if (env.tls.cert !== undefined)
             tls.cert = await pem('tls.cert', env.tls.cert);
         if (env.tls.key !== undefined)
@@ -143,19 +101,9 @@ export function describeEnvironment(env, registry = defaultRegistry()) {
     add('port', env.port);
     add('database', env.database);
     add('schema', env.schema);
-    if (env.credentials) {
-        labels.username = `vault database: ${env.credentials.vaultDatabase}`;
-        labels.password = labels.username;
-    }
-    else {
-        add('username', env.username);
-        if (env.auth === 'password')
-            add('password', env.password);
-    }
-    if (env.tls.client) {
-        labels['tls.cert'] = `vault pki: ${env.tls.client.vaultPki}`;
-        labels['tls.key'] = labels['tls.cert'];
-    }
+    add('username', env.username);
+    if (env.auth === 'password')
+        add('password', env.password);
     add('tls.ca', env.tls.ca);
     add('tls.cert', env.tls.cert);
     add('tls.key', env.tls.key);

package/dist/config/resolvers/index.js

@@ -17,7 +17,7 @@ export const createRegistry = (resolvers) => new Map(resolvers.map((resolver) =>
 // `prompter` enables `prompt` values and `store` `stored` ones; without them those
 // fail with "no resolver".
 export const defaultRegistry = (environment, prompter, store, 
-// Share one Vault client (its token and leases) with whoever needs the group resolvers.
+// Share one Vault client (its login token) with whoever else reads from Vault.
 vault = createVaultClient({ env: environment })) => createRegistry([
     literalResolver,
     createEnvResolver(environment),

package/dist/config/resolvers/prompt.js

@@ -115,11 +115,11 @@ export function createPromptResolver(prompter) {
             return answer;
         },
         confirm(ctx) {
-            const write = ctx.purpose === 'write';
+            const write = ctx.purpose === 'write' || ctx.purpose === 'drop';
             const remembered = write ? undefined : confirmed.get(ctx.envName);
             if (remembered)
                 return remembered;
-            const field = write ? 'write' : 'confirm';
+            const field = ctx.purpose === 'drop' ? 'drop' : write ? 'write' : 'confirm';
             if (!ctx.interactive)
                 return Promise.reject(new PromptRequiredError(ctx.envName, field));
             const challenge = challengeWords();

package/dist/config/resolvers/vault.js

@@ -260,88 +260,6 @@ export function createVaultClient(options = {}) {
             throw fail(ctx, `unexpected response from Vault for ${metadata}`);
         },
     };
-    const leases = new Map();
-    const issued = new Map();
-    const text = (ctx, data, key, path) => {
-        const value = data[key];
-        if (typeof value !== 'string' || value === '') {
-            throw fail(ctx, `key ${key} not in the answer of ${path}`);
-        }
-        return value;
-    };
-    // Asks Vault for something new once per environment and path (every time when `reuse` is false),
-    // and remembers its lease so release() can revoke it. A lease that has run out is replaced.
-    const issue = async (ctx, path, request, read, reuse = true) => {
-        const cacheKey = `${ctx.envName}\0${path}`;
-        const cached = reuse ? issued.get(cacheKey) : undefined;
-        if (cached) {
-            const entry = await cached;
-            if (entry.expiresAt === undefined || now() < entry.expiresAt)
-                return entry.values;
-            if (issued.get(cacheKey) === cached)
-                issued.delete(cacheKey);
-        }
-        const pending = (async () => {
-            const body = await call(ctx, path, request, 'role');
-            const values = read((body.data ?? {}));
-            const leaseId = typeof body.lease_id === 'string' ? body.lease_id : '';
-            const duration = typeof body.lease_duration === 'number' ? body.lease_duration : 0;
-            const expiresAt = duration > 0 ? now() + duration * 1000 - expiryMarginMs : undefined;
-            if (leaseId) {
-                leases.set(ctx.envName, [...(leases.get(ctx.envName) ?? []), { id: leaseId, expiresAt }]);
-            }
-            return { values, expiresAt };
-        })();
-        if (reuse) {
-            issued.set(cacheKey, pending);
-            pending.catch(() => {
-                if (issued.get(cacheKey) === pending)
-                    issued.delete(cacheKey);
-            });
-        }
-        return (await pending).values;
-    };
-    const revoke = async (envName) => {
-        const held = leases.get(envName) ?? [];
-        leases.delete(envName);
-        for (const key of [...issued.keys()])
-            if (key.startsWith(`${envName}\0`))
-                issued.delete(key);
-        const ctx = { envName, field: 'lease', configDir: '', interactive: false };
-        for (const lease of held) {
-            try {
-                await authed(ctx, 'sys/leases/revoke', { method: 'PUT', body: { lease_id: lease.id } });
-            }
-            catch {
-                // Best effort: a lease that cannot be revoked still ends when its TTL does.
-            }
-        }
-    };
-    const groups = {
-        async databaseCredentials(path, ctx) {
-            // Never reused: a password is asked for again every time it is needed.
-            const values = await issue(ctx, path, {}, (data) => ({
-                username: text(ctx, data, 'username', path),
-                password: text(ctx, data, 'password', path),
-            }), false);
-            return { username: values.username, password: values.password };
-        },
-        async clientCertificate(path, commonName, ctx) {
-            const values = await issue(ctx, path, { method: 'POST', body: { common_name: commonName } }, (data) => ({
-                cert: text(ctx, data, 'certificate', path),
-                key: text(ctx, data, 'private_key', path),
-                ...(typeof data.issuing_ca === 'string' && data.issuing_ca !== ''
-                    ? { ca: data.issuing_ca }
-                    : {}),
-            }));
-            return { cert: values.cert, key: values.key, ...(values.ca ? { ca: values.ca } : {}) };
-        },
-        release: revoke,
-        releaseAll: async () => {
-            for (const envName of [...leases.keys()])
-                await revoke(envName);
-        },
-    };
     const resolver = {
         kind: 'vault',
         async resolve(ref, ctx) {
@@ -360,6 +278,6 @@ export function createVaultClient(options = {}) {
         },
         describe: ({ vault }) => `vault: ${vault}`,
     };
-    return { resolver, groups, kv };
+    return { resolver, kv };
 }
 export const createVaultResolver = (options = {}) => createVaultClient(options).resolver;

package/dist/db/store.js

@@ -82,6 +82,18 @@ const migrations = [
 		error TEXT NULL
 	);
 	CREATE INDEX history_env ON history (env_name, id)`,
+    // Queries kept by name, per environment, for the web UI.
+    `CREATE TABLE saved_queries (
+		id INTEGER PRIMARY KEY,
+		env_name TEXT NOT NULL,
+		name TEXT NOT NULL,
+		folder TEXT NOT NULL DEFAULT '',
+		sql TEXT NOT NULL,
+		pinned INTEGER NOT NULL DEFAULT 0,
+		created_at TEXT NOT NULL,
+		updated_at TEXT NOT NULL
+	);
+	CREATE INDEX saved_queries_env ON saved_queries (env_name)`,
 ];
 export const schemaVersion = migrations.length;
 function migrate(db) {
@@ -102,6 +114,16 @@ function migrate(db) {
         }
     }
 }
+const toSaved = (row) => ({
+    id: row.id,
+    envName: row.env_name,
+    name: row.name,
+    folder: row.folder,
+    sql: row.sql,
+    pinned: row.pinned === 1,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+});
 const toHistory = (row) => ({
     id: row.id,
     at: row.at,
@@ -203,6 +225,14 @@ export function openStore(dir) {
     const historyByEnv = database.prepare(`SELECT * FROM history WHERE id IN (
 			SELECT MAX(id) FROM history WHERE env_name = ? GROUP BY sql
 		) ORDER BY id DESC LIMIT ?`);
+    const insertSaved = database.prepare(`INSERT INTO saved_queries (env_name, name, folder, sql, pinned, created_at, updated_at)
+		VALUES (:envName, :name, :folder, :sql, :pinned, :now, :now)`);
+    const selectSaved = database.prepare('SELECT * FROM saved_queries WHERE id = ?');
+    const savedByEnv = database.prepare(`SELECT * FROM saved_queries WHERE env_name = ?
+		ORDER BY pinned DESC, folder COLLATE NOCASE, name COLLATE NOCASE, id`);
+    const changeSaved = database.prepare(`UPDATE saved_queries SET name = :name, folder = :folder, sql = :sql, pinned = :pinned,
+			updated_at = :now WHERE id = :id`);
+    const removeSaved = database.prepare('DELETE FROM saved_queries WHERE id = ?');
     const selectSetting = database.prepare('SELECT value FROM settings WHERE key = ?');
     const upsertSetting = database.prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value');
     const selectSecret = database.prepare('SELECT value FROM secrets WHERE key = ?');
@@ -246,6 +276,33 @@ export function openStore(dir) {
             return toHistory(selectHistory.get(Number(lastInsertRowid)));
         },
         historyFor: (envName, limit = 200) => historyByEnv.all(envName, limit).map(toHistory),
+        savedQueries: (envName) => savedByEnv.all(envName).map(toSaved),
+        saveQuery: (input) => {
+            const { lastInsertRowid } = insertSaved.run({
+                envName: input.envName,
+                name: input.name,
+                folder: input.folder ?? '',
+                sql: input.sql,
+                pinned: input.pinned ? 1 : 0,
+                now: now(),
+            });
+            return toSaved(selectSaved.get(Number(lastInsertRowid)));
+        },
+        updateSavedQuery: (id, changes) => {
+            const row = selectSaved.get(id);
+            if (!row)
+                return undefined;
+            changeSaved.run({
+                id,
+                name: changes.name ?? row.name,
+                folder: changes.folder ?? row.folder,
+                sql: changes.sql ?? row.sql,
+                pinned: (changes.pinned ?? row.pinned === 1) ? 1 : 0,
+                now: now(),
+            });
+            return toSaved(selectSaved.get(id));
+        },
+        deleteSavedQuery: (id) => Number(removeSaved.run(id).changes) > 0,
         getSetting: (key) => selectSetting.get(key)?.value,
         setSetting: (key, value) => {
             upsertSetting.run(key, value);

package/dist/environments.js

@@ -34,8 +34,10 @@ export function listEnvironments(services) {
         tier: config.tier,
         protected: config.protected,
         readOnly: config.readOnly,
+        seeder: config.seeder,
+        designer: config.designer,
         tlsMode: config.tls.mode,
-        user: config.username === undefined ? '‹vault›' : display(config.username),
+        user: display(config.username),
         host: display(config.host),
         port: display(config.port),
         database: display(config.database),
@@ -49,6 +51,8 @@ export function listEnvironments(services) {
         tier: 'local',
         protected: false,
         readOnly: false,
+        seeder: true,
+        designer: true,
         tlsMode: connection.ssl ? 'require' : 'disable',
         user: connection.username,
         host: connection.host,
@@ -69,7 +73,6 @@ options = {}) {
         return resolveEnvironment(config, {
             interactive: options.interactive ?? true,
             registry: services.resolvers,
-            groups: services.groups,
             signal: options.signal,
         });
     }