@youtyan/code-viewer 0.8.8 → 0.9.0

package/dist/code-viewer.js

@@ -1127,7 +1127,7 @@ var init_name_pattern = __esm(() => {
 
 // web-src/server/runtime.ts
 import { spawn, spawnSync } from "node:child_process";
-import { createReadStream, promises as fs } from "node:fs";
+import { createReadStream, promises as fs, statSync as statSync2 } from "node:fs";
 import {
   createServer
 } from "node:http";
@@ -1278,10 +1278,20 @@ function appendProcessError(stderr, err) {
   return `${stderr}${stderr ? `
 ` : ""}${err.message}`;
 }
+function assertReadableRegularFile(path) {
+  const stats = statSync2(path);
+  if (stats.isFile())
+    return;
+  const error = new Error(`not a regular file: ${path}`);
+  error.code = stats.isDirectory() ? "EISDIR" : "EINVAL";
+  throw error;
+}
 function fileReadableStream(path) {
+  assertReadableRegularFile(path);
   return Readable.toWeb(createReadStream(path));
 }
 function fileByteRangeResponseBody(path, start, endInclusive) {
+  assertReadableRegularFile(path);
   return Readable.toWeb(createReadStream(path, { start, end: endInclusive }));
 }
 async function readFileTextRange(path, start, endExclusive) {
@@ -1415,7 +1425,7 @@ import {
   readFileSync,
   readlinkSync,
   realpathSync as realpathSync2,
-  statSync as statSync2
+  statSync as statSync3
 } from "node:fs";
 import { open, stat } from "node:fs/promises";
 import { dirname as dirname3, join as join4, posix, relative as relative2 } from "node:path";
@@ -2060,7 +2070,7 @@ function isGitInternalPath(path) {
 function syntheticUncommittedBlameFromWorktree(cwd, path) {
   const filePath = join4(cwd, path);
   try {
-    const stat2 = statSync2(filePath);
+    const stat2 = statSync3(filePath);
     if (!stat2.isFile())
       return { lines: [], commits: {}, error: "not a file" };
     const text = readFileSync(filePath, "utf8");
@@ -2250,7 +2260,7 @@ function resolveWorktreeSymlinkTarget(cwd, full) {
   let symlink_target_type = "missing";
   if (realpathWithinRepo(cwd, full, false) !== null) {
     try {
-      const stat2 = statSync2(full);
+      const stat2 = statSync3(full);
       symlink_target_type = stat2.isDirectory() ? "tree" : stat2.isFile() ? "blob" : "missing";
     } catch {
       symlink_target_type = "missing";
@@ -3982,7 +3992,7 @@ __export(exports_file_cli, {
   FILE_DEFAULT_HISTORY_LIMIT: () => FILE_DEFAULT_HISTORY_LIMIT,
   FILE_AGENT_HELP: () => FILE_AGENT_HELP
 });
-import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync as realpathSync4, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { join as join6, relative as relative3 } from "node:path";
 function validatePath(value) {
   return validateRepoRelativePathValue(value, "--path");
@@ -4381,7 +4391,7 @@ async function readShowTextAsync(root, command) {
     };
   }
   try {
-    const stat2 = statSync3(full);
+    const stat2 = statSync4(full);
     if (!stat2.isFile()) {
       return { code: 1, stdout: "", stderr: "not a file" };
     }
@@ -10531,6 +10541,38 @@ var init_sql_capture = __esm(() => {
   storage = new AsyncLocalStorage;
 });
 
+// web-src/server/database/adapters/table-meta-cache.ts
+function createTableMetaCache(now = () => Date.now()) {
+  const columns = new Map;
+  const rowCounts = new Map;
+  async function readThrough(store, table, ttlMs, load) {
+    const cached = store.get(table);
+    if (cached && cached.expires > now())
+      return cached.value;
+    const value = await load();
+    store.set(table, { value, expires: now() + ttlMs });
+    return value;
+  }
+  return {
+    getColumns(table, load) {
+      return readThrough(columns, table, COLUMNS_TTL_MS, load);
+    },
+    getRowCount(table, load) {
+      return readThrough(rowCounts, table, ROWCOUNT_TTL_MS, load);
+    },
+    invalidate(table) {
+      if (table) {
+        columns.delete(table);
+        rowCounts.delete(table);
+        return;
+      }
+      columns.clear();
+      rowCounts.clear();
+    }
+  };
+}
+var COLUMNS_TTL_MS = 30000, ROWCOUNT_TTL_MS = 15000;
+
 // web-src/server/database/adapters/docker.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import mysql from "mysql2/promise";
@@ -10966,39 +11008,6 @@ function buildTableSelectList(columns, kind) {
   });
   return hasSpatialColumn ? parts.join(", ") : "*";
 }
-function createTableMetaCache(now = () => Date.now()) {
-  const columns = new Map;
-  const rowCounts = new Map;
-  return {
-    async getColumns(table, fetch2) {
-      const cached = columns.get(table);
-      const current = now();
-      if (cached && cached.expires > current)
-        return cached.value;
-      const value = await fetch2();
-      columns.set(table, { value, expires: now() + COLUMNS_TTL_MS });
-      return value;
-    },
-    async getRowCount(table, fetch2) {
-      const cached = rowCounts.get(table);
-      const current = now();
-      if (cached && cached.expires > current)
-        return cached.value;
-      const value = await fetch2();
-      rowCounts.set(table, { value, expires: now() + ROWCOUNT_TTL_MS });
-      return value;
-    },
-    invalidate(table) {
-      if (table) {
-        columns.delete(table);
-        rowCounts.delete(table);
-        return;
-      }
-      columns.clear();
-      rowCounts.clear();
-    }
-  };
-}
 function observeBackgroundRejection(promise) {
   promise.catch(() => {
     return;
@@ -11618,7 +11627,7 @@ async function openDockerAdapterAsync(serviceName, kind, env, cwd, overrideDatab
     ...kind === "postgresql" && schema ? { schema } : {}
   });
 }
-var createPgPoolImpl = (config) => new pg.Pool(config), createMysqlPoolImpl = (config) => mysql.createPool(config), COLUMNS_TTL_MS = 30000, ROWCOUNT_TTL_MS = 15000, DOCKER_DATABASES_POSITIVE_TTL_MS = 15000, DOCKER_DATABASES_NEGATIVE_TTL_MS = 3000, dockerDatabasesCache, dockerSchemasCache, spawnSyncImpl2, PG_RECORD_SEPARATOR = "\x1E", PG_FIELD_SEPARATOR = "\x1F", MYSQL_SPATIAL_TYPES, createDockerAdapter, SUPABASE_LOCAL_DB_USER = "postgres", SUPABASE_LOCAL_DB_PASSWORD = "postgres", SUPABASE_LOCAL_DB_NAME = "postgres";
+var createPgPoolImpl = (config) => new pg.Pool(config), createMysqlPoolImpl = (config) => mysql.createPool(config), DOCKER_DATABASES_POSITIVE_TTL_MS = 15000, DOCKER_DATABASES_NEGATIVE_TTL_MS = 3000, dockerDatabasesCache, dockerSchemasCache, spawnSyncImpl2, PG_RECORD_SEPARATOR = "\x1E", PG_FIELD_SEPARATOR = "\x1F", MYSQL_SPATIAL_TYPES, createDockerAdapter, SUPABASE_LOCAL_DB_USER = "postgres", SUPABASE_LOCAL_DB_PASSWORD = "postgres", SUPABASE_LOCAL_DB_NAME = "postgres";
 var init_docker = __esm(() => {
   init_mutate();
   init_sql_snapshot();
@@ -12956,7 +12965,8 @@ var init_source_meta = __esm(() => {
     cts: "typescript",
     kts: "kotlin",
     cxx: "cpp",
-    hxx: "cpp"
+    hxx: "cpp",
+    gd: "gdscript"
   };
   TEXT_SOURCE_EXTENSIONS = new Set([
     ...Object.keys(EXT_TO_LANG),
@@ -13859,6 +13869,72 @@ var init_s3 = __esm(() => {
   s3DockerCurlTimeoutMs = DEFAULT_S3_DOCKER_CURL_TIMEOUT_MS;
 });
 
+// web-src/server/database/adapters/sqlite-introspection.ts
+function sqliteTableInfoSql(table) {
+  return `PRAGMA table_info(${sanitizeIdentifier(table)})`;
+}
+function sqliteIndexListSql(table) {
+  return `PRAGMA index_list(${sanitizeIdentifier(table)})`;
+}
+function sqliteIndexInfoSql(index) {
+  return `PRAGMA index_info(${sanitizeIdentifier(index)})`;
+}
+function sqliteForeignKeyListSql(table) {
+  return `PRAGMA foreign_key_list(${sanitizeIdentifier(table)})`;
+}
+function sqliteColumnFromPragmaRow(row) {
+  return {
+    name: row.name,
+    type: row.type || "TEXT",
+    nullable: row.notnull === 0,
+    primaryKey: row.pk > 0,
+    defaultValue: row.dflt_value
+  };
+}
+function sqliteTableInfoFromRow(row) {
+  return {
+    name: row.name,
+    type: row.type,
+    rowCount: null
+  };
+}
+function sqliteRowCountUnionSql(tables) {
+  return tables.map((table) => `SELECT ${escapeSqlString(table)} AS tbl, COUNT(*) AS cnt FROM ${sanitizeIdentifier(table)}`).join(" UNION ALL ");
+}
+function sqliteRowCountSql(table) {
+  return `SELECT COUNT(*) AS cnt FROM ${sanitizeIdentifier(table)}`;
+}
+function assertReadonlySqliteStatement(sql) {
+  const upper = sql.trim().toUpperCase();
+  if (!SQLITE_READONLY_FIRST_WORDS.has(upper.split(/\s/)[0])) {
+    throw new Error("Only SELECT, PRAGMA, EXPLAIN, and WITH queries are allowed");
+  }
+  if (SQLITE_BLOCKED_KEYWORDS_RE.test(upper)) {
+    throw new Error("Query contains a disallowed statement keyword");
+  }
+}
+function stripTrailingSemicolon(sql) {
+  return sql.trim().replace(/;\s*$/, "");
+}
+var SQLITE_INTROSPECTION_SQL, SQLITE_READONLY_FIRST_WORDS, SQLITE_BLOCKED_KEYWORDS_RE;
+var init_sqlite_introspection = __esm(() => {
+  init_sql_utils();
+  SQLITE_INTROSPECTION_SQL = {
+    listTables: "SELECT name, type FROM sqlite_master WHERE type IN ('table', 'view') AND name NOT LIKE 'sqlite_%' ORDER BY name",
+    listIndexes: "SELECT name, tbl_name FROM sqlite_master WHERE type = 'index' AND name NOT LIKE 'sqlite_%' ORDER BY name",
+    listForeignKeyTables: "SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND sql NOT LIKE '%VIRTUAL%' ORDER BY name",
+    createStatement: "SELECT sql FROM sqlite_master WHERE name = ?",
+    triggers: "SELECT name, sql FROM sqlite_master WHERE type = 'trigger' AND tbl_name = ?"
+  };
+  SQLITE_READONLY_FIRST_WORDS = new Set([
+    "SELECT",
+    "PRAGMA",
+    "EXPLAIN",
+    "WITH"
+  ]);
+  SQLITE_BLOCKED_KEYWORDS_RE = /\b(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|ATTACH|DETACH|REPLACE|VACUUM|REINDEX|LOAD_EXTENSION)\b/;
+});
+
 // web-src/server/database/adapters/sqlite.ts
 function safePrepare(db, sql) {
   const stmt = db.prepare(sql);
@@ -13885,14 +13961,8 @@ function queryRowsToResult(rows, columns) {
   };
 }
 function queryColumns(db, table) {
-  const rows = db.prepare(`PRAGMA table_info(${sanitizeIdentifier(table)})`).all();
-  return rows.map((row) => ({
-    name: row.name,
-    type: row.type || "TEXT",
-    nullable: row.notnull === 0,
-    primaryKey: row.pk > 0,
-    defaultValue: row.dflt_value
-  }));
+  const rows = db.prepare(sqliteTableInfoSql(table)).all();
+  return rows.map(sqliteColumnFromPragmaRow);
 }
 function wrapDbWithSqlCapture(rawDb) {
   return new Proxy(rawDb, {
@@ -13923,12 +13993,8 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
     model: "sql",
     capabilities: { snapshot: true },
     getTables() {
-      const rows = db.prepare("SELECT name, type FROM sqlite_master WHERE type IN ('table', 'view') AND name NOT LIKE 'sqlite_%' ORDER BY name").all();
-      return rows.map((row) => ({
-        name: row.name,
-        type: row.type,
-        rowCount: null
-      }));
+      const rows = db.prepare(SQLITE_INTROSPECTION_SQL.listTables).all();
+      return rows.map(sqliteTableInfoFromRow);
     },
     async getTablesAsync() {
       return this.getTables();
@@ -13940,10 +14006,10 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       return this.getColumns(table);
     },
     getIndexes() {
-      const rows = db.prepare("SELECT name, tbl_name FROM sqlite_master WHERE type = 'index' AND name NOT LIKE 'sqlite_%' ORDER BY name").all();
+      const rows = db.prepare(SQLITE_INTROSPECTION_SQL.listIndexes).all();
       return rows.map((row) => {
-        const info = db.prepare(`PRAGMA index_info(${sanitizeIdentifier(row.name)})`).all();
-        const indexList = db.prepare(`PRAGMA index_list(${sanitizeIdentifier(row.tbl_name)})`).all();
+        const info = db.prepare(sqliteIndexInfoSql(row.name)).all();
+        const indexList = db.prepare(sqliteIndexListSql(row.tbl_name)).all();
         const entry = indexList.find((i) => i.name === row.name);
         return {
           name: row.name,
@@ -13957,11 +14023,11 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       return this.getIndexes();
     },
     getForeignKeys() {
-      const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND sql NOT LIKE '%VIRTUAL%' ORDER BY name").all();
+      const tables = db.prepare(SQLITE_INTROSPECTION_SQL.listForeignKeyTables).all();
       const fks = [];
       for (const t of tables) {
         try {
-          const rows = db.prepare(`PRAGMA foreign_key_list(${sanitizeIdentifier(t.name)})`).all();
+          const rows = db.prepare(sqliteForeignKeyListSql(t.name)).all();
           for (const row of rows) {
             fks.push({
               fromTable: t.name,
@@ -13988,7 +14054,7 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       return this.getColumnsMulti(tables);
     },
     getTableRowCount(table) {
-      const row = db.prepare(`SELECT COUNT(*) AS cnt FROM ${sanitizeIdentifier(table)}`).get();
+      const row = db.prepare(sqliteRowCountSql(table)).get();
       return row?.cnt ?? 0;
     },
     async getTableRowCountAsync(table) {
@@ -13998,16 +14064,14 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       const result = new Map;
       if (tables.length === 0)
         return result;
-      const parts = tables.map((t) => `SELECT '${t.replace(/'/g, "''")}' AS tbl, COUNT(*) AS cnt FROM ${sanitizeIdentifier(t)}`);
-      const sql = parts.join(" UNION ALL ");
       try {
-        const rows = db.prepare(sql).all();
+        const rows = db.prepare(sqliteRowCountUnionSql(tables)).all();
         for (const row of rows) {
           result.set(row.tbl, row.cnt);
         }
       } catch {
         for (const t of tables) {
-          const row = db.prepare(`SELECT COUNT(*) AS cnt FROM ${sanitizeIdentifier(t)}`).get();
+          const row = db.prepare(sqliteRowCountSql(t)).get();
           result.set(t, row?.cnt ?? 0);
         }
       }
@@ -14059,17 +14123,8 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       };
     },
     executeReadonlyQuery(sql, params, maxRows = 1000) {
-      const trimmed = sql.trim();
-      const upper = trimmed.toUpperCase();
-      const firstWord = upper.split(/\s/)[0];
-      if (firstWord !== "SELECT" && firstWord !== "PRAGMA" && firstWord !== "EXPLAIN" && firstWord !== "WITH") {
-        throw new Error("Only SELECT, PRAGMA, EXPLAIN, and WITH queries are allowed");
-      }
-      const BLOCKED_RE = /\b(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|ATTACH|DETACH|REPLACE|VACUUM|REINDEX|LOAD_EXTENSION)\b/;
-      if (BLOCKED_RE.test(upper)) {
-        throw new Error("Query contains a disallowed statement keyword");
-      }
-      const limited = trimmed.replace(/;\s*$/, "");
+      assertReadonlySqliteStatement(sql);
+      const limited = stripTrailingSemicolon(sql);
       const wrappedSql = `SELECT * FROM (${limited}) LIMIT ${maxRows + 1}`;
       let rows;
       try {
@@ -14100,14 +14155,14 @@ function createSqliteAdapter(rawDb, openRawWriteDb) {
       return this.executeReadonlyQuery(sql, params, maxRows);
     },
     getCreateStatement(table) {
-      const row = db.prepare("SELECT sql FROM sqlite_master WHERE name = ?").get(table);
+      const row = db.prepare(SQLITE_INTROSPECTION_SQL.createStatement).get(table);
       return row?.sql ?? "";
     },
     async getCreateStatementAsync(table) {
       return this.getCreateStatement(table);
     },
     getTriggers(table) {
-      const rows = db.prepare("SELECT name, sql FROM sqlite_master WHERE type = 'trigger' AND tbl_name = ?").all(table);
+      const rows = db.prepare(SQLITE_INTROSPECTION_SQL.triggers).all(table);
       return rows.map((row) => ({ name: row.name, sql: row.sql ?? "" }));
     },
     async getTriggersAsync(table) {
@@ -14187,6 +14242,7 @@ var init_sqlite = __esm(() => {
   init_sql_utils();
   init_sqlite_driver();
   init_sql_capture();
+  init_sqlite_introspection();
   sqliteAdapterFactory = {
     async open(path) {
       const DbClass = await loadSqliteClass();
@@ -14219,13 +14275,13 @@ import {
   openSync,
   readSync,
   realpathSync as realpathSync5,
-  statSync as statSync4
+  statSync as statSync5
 } from "node:fs";
 import { lstat, open as open2, readdir, readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { basename, join as join9, relative as relative4 } from "node:path";
 function isSqliteFile(fullPath) {
   try {
-    const stat3 = statSync4(fullPath);
+    const stat3 = statSync5(fullPath);
     if (!stat3.isFile() || stat3.size < 16)
       return false;
     const buf = Buffer.alloc(16);
@@ -14423,6 +14479,8 @@ function dbKindDisplayName(kind) {
       return "MySQL";
     case "sqlite":
       return "SQLite";
+    case "d1":
+      return "Cloudflare D1";
   }
 }
 function detectDbKindFromContainerPort(port) {
@@ -15849,6 +15907,310 @@ function asAsyncDoc(source) {
   };
 }
 
+// web-src/server/database/adapters/d1.ts
+function isD1InternalName(name) {
+  return D1_INTERNAL_NAME_RE.test(name);
+}
+function isD1HttpError(err) {
+  return err instanceof D1HttpError;
+}
+function d1ErrorMessage(envelope, status, sql) {
+  const first = envelope.errors?.find((entry) => entry?.message);
+  const detail = first?.message?.replace(/\s+/g, " ").trim().slice(0, 240);
+  const statement = sql.replace(/\s+/g, " ").trim().slice(0, 160);
+  return `${detail || `D1 HTTP ${status}`} (sql: ${statement})`;
+}
+function toDbValue(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value === "number" || typeof value === "string")
+    return value;
+  if (typeof value === "boolean")
+    return value;
+  if (Array.isArray(value)) {
+    return value.every((byte) => typeof byte === "number") ? new Uint8Array(value) : JSON.stringify(value);
+  }
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+function parseRawResult(result) {
+  const columns = Array.isArray(result?.results?.columns) ? result.results.columns.map((name) => String(name)) : [];
+  const rawRows = Array.isArray(result?.results?.rows) ? result.results.rows : [];
+  const rows = rawRows.map((row) => Array.isArray(row) ? row.map(toDbValue) : []);
+  return {
+    columns,
+    columnTypes: columns.map(() => "TEXT"),
+    rows,
+    rowCount: rows.length
+  };
+}
+async function d1Fetch(url, init, signal) {
+  if (signal?.aborted)
+    throw new D1HttpError(503, "D1 request aborted");
+  const controller = new AbortController;
+  const onParentAbort = () => controller.abort();
+  signal?.addEventListener("abort", onParentAbort, { once: true });
+  const timer = setTimeout(() => controller.abort(), d1RequestTimeoutMs);
+  try {
+    const d1FetchImpl = d1FetchOverride ?? globalThis.fetch;
+    return await d1FetchImpl(url, { ...init, signal: controller.signal });
+  } catch (err) {
+    if (signal?.aborted)
+      throw new D1HttpError(503, "D1 request aborted");
+    if (controller.signal.aborted) {
+      throw new D1HttpError(503, `D1 request timed out after ${d1RequestTimeoutMs}ms`);
+    }
+    throw new D1HttpError(503, `D1 request failed: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onParentAbort);
+  }
+}
+function createD1Adapter(config) {
+  const baseUrl = (config.apiBaseUrl || DEFAULT_D1_API_BASE_URL).replace(/\/$/, "");
+  const rawUrl = `${baseUrl}/accounts/${encodeURIComponent(config.accountId)}/d1/database/${encodeURIComponent(config.databaseId)}/raw`;
+  const tableMetaCache = createTableMetaCache();
+  async function runSql(sql, params = [], signal) {
+    if (!config.apiToken) {
+      throw new D1HttpError(401, "D1 API token is missing. Reopen the connection dialog and enter the API token again (credentials are never stored in the repository).");
+    }
+    recordSql(sql);
+    const res = await d1Fetch(rawUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.apiToken}`
+      },
+      body: JSON.stringify({ sql, params })
+    }, signal);
+    let envelope;
+    try {
+      envelope = await res.json();
+    } catch {
+      throw new D1HttpError(res.status, `D1 HTTP ${res.status}: invalid JSON`);
+    }
+    if (!res.ok || envelope.success === false) {
+      const status = res.ok ? 400 : res.status;
+      throw new D1HttpError(status, d1ErrorMessage(envelope, status, sql));
+    }
+    return parseRawResult(envelope.result?.[0]);
+  }
+  async function runSqlRecords(sql, params = [], signal) {
+    const result = await runSql(sql, params, signal);
+    return result.rows.map((row) => {
+      const record = {};
+      result.columns.forEach((column, index) => {
+        record[column] = row[index] ?? null;
+      });
+      return record;
+    });
+  }
+  async function loadColumns(table, signal) {
+    const rows = await runSqlRecords(sqliteTableInfoSql(table), [], signal);
+    return rows.map(sqliteColumnFromPragmaRow);
+  }
+  function getColumnsAsync(table, signal) {
+    return tableMetaCache.getColumns(table, () => loadColumns(table, signal));
+  }
+  async function countRows(table, signal) {
+    const result = await runSql(sqliteRowCountSql(table), [], signal);
+    return Number(result.rows[0]?.[0] ?? 0);
+  }
+  async function selectPage(table, columns, options, signal) {
+    const order = buildOrderClause(filterOrderByColumns(options.orderBy, columns.map((column) => column.name)));
+    const whereClause = options.where ? ` WHERE ${options.where}` : "";
+    return runSql(`SELECT * FROM ${sanitizeIdentifier(table)}${whereClause}${order} LIMIT ? OFFSET ?`, [...options.params ?? [], options.limit, options.offset], signal);
+  }
+  const adapter = {
+    kind: "d1",
+    model: "sql",
+    capabilities: { snapshot: true },
+    async getTablesAsync(signal) {
+      const rows = await runSqlRecords(SQLITE_INTROSPECTION_SQL.listTables, [], signal);
+      return rows.filter((row) => !isD1InternalName(row.name)).map(sqliteTableInfoFromRow);
+    },
+    getColumnsAsync,
+    async getColumnsMultiAsync(tables, signal) {
+      const entries = await Promise.all(tables.map(async (table) => [table, await getColumnsAsync(table, signal)]));
+      return new Map(entries);
+    },
+    async getIndexesAsync(signal) {
+      const indexes = await runSqlRecords(SQLITE_INTROSPECTION_SQL.listIndexes, [], signal);
+      const described = await Promise.all(indexes.filter((index) => !isD1InternalName(index.name) && !isD1InternalName(index.tbl_name)).map(async (index) => {
+        try {
+          const [info, indexList] = await Promise.all([
+            runSqlRecords(sqliteIndexInfoSql(index.name), [], signal),
+            runSqlRecords(sqliteIndexListSql(index.tbl_name), [], signal)
+          ]);
+          const entry = indexList.find((row) => row.name === index.name);
+          return {
+            name: index.name,
+            table: index.tbl_name,
+            columns: info.map((row) => row.name),
+            unique: entry ? Number(entry.unique) === 1 : false
+          };
+        } catch (err) {
+          if (isAbortLikeError(err, signal))
+            throw err;
+          return null;
+        }
+      }));
+      return described.filter((index) => index !== null);
+    },
+    async getForeignKeysAsync(signal) {
+      const tables = await runSqlRecords(SQLITE_INTROSPECTION_SQL.listForeignKeyTables, [], signal);
+      const perTable = await Promise.all(tables.filter((table) => !isD1InternalName(table.name)).map(async (table) => {
+        try {
+          const rows = await runSqlRecords(sqliteForeignKeyListSql(table.name), [], signal);
+          return rows.map((row) => ({
+            fromTable: table.name,
+            fromColumn: row.from,
+            toTable: row.table,
+            toColumn: row.to
+          }));
+        } catch (err) {
+          if (isAbortLikeError(err, signal))
+            throw err;
+          return [];
+        }
+      }));
+      return perTable.flat();
+    },
+    getTableRowCountAsync(table, signal) {
+      return tableMetaCache.getRowCount(table, () => countRows(table, signal));
+    },
+    async getTableRowCountsAsync(tables, signal) {
+      const result = new Map;
+      const countable = tables.filter((table) => !isD1InternalName(table));
+      if (countable.length === 0)
+        return result;
+      try {
+        const rows = await runSqlRecords(sqliteRowCountUnionSql(countable), [], signal);
+        for (const row of rows)
+          result.set(String(row.tbl), Number(row.cnt));
+        return result;
+      } catch {
+        for (const table of countable) {
+          try {
+            result.set(table, await countRows(table, signal));
+          } catch (err) {
+            if (isAbortLikeError(err, signal))
+              throw err;
+          }
+        }
+        return result;
+      }
+    },
+    async getTablePageAsync(table, options, signal) {
+      const columns = await getColumnsAsync(table, signal);
+      return selectPage(table, columns, options, signal);
+    },
+    async getTablePageWithMeta(table, options, signal) {
+      const columns = await getColumnsAsync(table, signal);
+      const [page, totalRows] = await Promise.all([
+        selectPage(table, columns, options, signal),
+        countRows(table, signal)
+      ]);
+      return {
+        columns,
+        rows: page.rows,
+        rowCount: page.rowCount,
+        totalRows
+      };
+    },
+    async getFilteredTablePageWithMeta(table, options, signal) {
+      const columns = await getColumnsAsync(table, signal);
+      const columnNames = columns.map((column) => column.name);
+      const filter = buildFilterWhere(filterGroupedColumns(options.grouped, columnNames), "sqlite", filterExactColumns(options.exact, columnNames));
+      const whereClause = filter.where ? ` WHERE ${filter.where}` : "";
+      const [page, countResult] = await Promise.all([
+        selectPage(table, columns, { ...options, where: filter.where, params: filter.params }, signal),
+        runSql(`SELECT COUNT(*) AS cnt FROM ${sanitizeIdentifier(table)}${whereClause}`, filter.params, signal)
+      ]);
+      return {
+        columns,
+        rows: page.rows,
+        rowCount: page.rowCount,
+        totalRows: Number(countResult.rows[0]?.[0] ?? 0)
+      };
+    },
+    async executeReadonlyQueryAsync(sql, params, maxRows = 1000, signal) {
+      assertReadonlySqliteStatement(sql);
+      const limited = stripTrailingSemicolon(sql);
+      let result;
+      try {
+        result = await runSql(`SELECT * FROM (${limited}) LIMIT ${maxRows + 1}`, params, signal);
+      } catch (wrapErr) {
+        try {
+          result = await runSql(`${limited} LIMIT ${maxRows + 1}`, params, signal);
+        } catch {
+          throw wrapErr;
+        }
+      }
+      return result.rows.length > maxRows ? { ...result, rows: result.rows.slice(0, maxRows), rowCount: maxRows } : result;
+    },
+    invalidateTableMetaCache(table) {
+      tableMetaCache.invalidate(table);
+    },
+    async getCreateStatementAsync(table, signal) {
+      const rows = await runSqlRecords(SQLITE_INTROSPECTION_SQL.createStatement, [table], signal);
+      return rows[0]?.sql ?? "";
+    },
+    async getTriggersAsync(table, signal) {
+      const rows = await runSqlRecords(SQLITE_INTROSPECTION_SQL.triggers, [table], signal);
+      return rows.map((row) => ({ name: row.name, sql: row.sql ?? "" }));
+    },
+    close() {},
+    async* iterateForSnapshot(table, signal) {
+      const columns = await adapter.getColumnsAsync(table, signal);
+      const colNames = columns.map((column) => column.name);
+      const pkColumns = columns.filter((column) => column.primaryKey).map((column) => column.name);
+      let offset = 0;
+      let rowIndex = 0;
+      for (;; ) {
+        if (signal?.aborted)
+          return;
+        const result = await adapter.getTablePageAsync(table, { offset, limit: SQL_SNAPSHOT_BATCH_SIZE }, signal);
+        if (result.rows.length === 0)
+          return;
+        for (const row of result.rows) {
+          yield {
+            keyJson: buildRowKeyJson(pkColumns, colNames, row, rowIndex),
+            rowHash: computeRowHash(colNames, row),
+            payloadJson: rowToPayloadJson(colNames, row)
+          };
+          rowIndex++;
+        }
+        offset += result.rows.length;
+        if (result.rows.length < SQL_SNAPSHOT_BATCH_SIZE)
+          return;
+      }
+    },
+    async listSnapshotContainers() {
+      const tables = await adapter.getTablesAsync();
+      return tables.filter((table) => table.type === "table").map((table) => ({ id: table.name, label: table.name }));
+    }
+  };
+  return adapter;
+}
+var DEFAULT_D1_API_BASE_URL = "https://api.cloudflare.com/client/v4", D1_INTERNAL_NAME_RE, DEFAULT_D1_REQUEST_TIMEOUT_MS = 20000, d1RequestTimeoutMs, d1FetchOverride = null, D1HttpError;
+var init_d1 = __esm(() => {
+  init_sql_snapshot();
+  init_sql_utils();
+  init_sql_capture();
+  init_sqlite_introspection();
+  D1_INTERNAL_NAME_RE = /^_cf_/i;
+  d1RequestTimeoutMs = DEFAULT_D1_REQUEST_TIMEOUT_MS;
+  D1HttpError = class D1HttpError extends Error {
+    status;
+    constructor(status, message) {
+      super(message);
+      this.status = status;
+    }
+  };
+});
+
 // web-src/server/database/adapters/dynamodb.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash5, createHmac as createHmac2 } from "node:crypto";
@@ -16387,6 +16749,136 @@ var init_connection_pool = __esm(() => {
   pool = new Map;
 });
 
+// web-src/server/database/credential-store.ts
+function isKeychainAvailable() {
+  if (keychainEnabledOverride !== null)
+    return keychainEnabledOverride;
+  if (false)
+    ;
+  return process.platform === "darwin";
+}
+function accountFor(cwd, connectionId) {
+  return `${cwd}#${connectionId}`;
+}
+function quoteSecurityArg(value) {
+  if (hasControlCharacter(value))
+    return null;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+async function runSecurityAsync(opts) {
+  if (!keychainSpawnOverride && false) {}
+  const spawn3 = keychainSpawnOverride ?? spawnCollectAsync;
+  const result = await spawn3({
+    command: SECURITY_COMMAND,
+    args: opts.args,
+    ...opts.input === undefined ? {} : { input: opts.input },
+    timeoutMs: KEYCHAIN_TIMEOUT_MS,
+    abortMessage: "keychain access aborted",
+    timeoutMessage: `keychain access timed out after ${KEYCHAIN_TIMEOUT_MS}ms`,
+    rejectOnError: false
+  });
+  return {
+    stdout: result.stdout.toString("utf8"),
+    stderr: result.stderr.toString("utf8"),
+    code: result.code
+  };
+}
+function warnKeychain(action, detail) {
+  console.warn(`[code-viewer] keychain ${action} failed: ${detail.replace(/\s+/g, " ").trim().slice(0, 200)}`);
+}
+async function saveConnectionSecretsAsync(cwd, connectionId, secrets) {
+  if (!isKeychainAvailable())
+    return false;
+  if (Object.keys(secrets).length === 0) {
+    return deleteConnectionSecretsAsync(cwd, connectionId);
+  }
+  const account = quoteSecurityArg(accountFor(cwd, connectionId));
+  const label = quoteSecurityArg(`code-viewer: ${connectionId}`);
+  if (!account || !label) {
+    warnKeychain("save", "connection id or path contains control characters");
+    return false;
+  }
+  const payload = Buffer.from(JSON.stringify(secrets), "utf8").toString("base64");
+  try {
+    const result = await runSecurityAsync({
+      args: ["-i"],
+      input: `add-generic-password -U -s "${KEYCHAIN_SERVICE}" -a ${account} -l ${label} -w "${payload}"
+`
+    });
+    if (result.code !== 0) {
+      warnKeychain("save", result.stderr || `exit ${result.code}`);
+      return false;
+    }
+    return true;
+  } catch (err) {
+    warnKeychain("save", err instanceof Error ? err.message : String(err));
+    return false;
+  }
+}
+async function loadConnectionSecretsAsync(cwd, connectionId) {
+  if (!isKeychainAvailable())
+    return null;
+  const account = accountFor(cwd, connectionId);
+  if (hasControlCharacter(account))
+    return null;
+  try {
+    const result = await runSecurityAsync({
+      args: [
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        account,
+        "-w"
+      ]
+    });
+    if (result.code === ERR_SEC_ITEM_NOT_FOUND)
+      return null;
+    if (result.code !== 0) {
+      warnKeychain("read", result.stderr || `exit ${result.code}`);
+      return null;
+    }
+    const decoded = Buffer.from(result.stdout.trim(), "base64").toString("utf8");
+    const parsed = JSON.parse(decoded);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const secrets = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof value === "string")
+        secrets[key] = value;
+    }
+    return Object.keys(secrets).length > 0 ? secrets : null;
+  } catch (err) {
+    warnKeychain("read", err instanceof Error ? err.message : String(err));
+    return null;
+  }
+}
+async function deleteConnectionSecretsAsync(cwd, connectionId) {
+  if (!isKeychainAvailable())
+    return false;
+  const account = accountFor(cwd, connectionId);
+  if (hasControlCharacter(account))
+    return false;
+  try {
+    const result = await runSecurityAsync({
+      args: ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account]
+    });
+    if (result.code !== 0 && result.code !== ERR_SEC_ITEM_NOT_FOUND) {
+      warnKeychain("delete", result.stderr || `exit ${result.code}`);
+      return false;
+    }
+    return true;
+  } catch (err) {
+    warnKeychain("delete", err instanceof Error ? err.message : String(err));
+    return false;
+  }
+}
+var SECURITY_COMMAND = "/usr/bin/security", KEYCHAIN_SERVICE = "code-viewer", KEYCHAIN_TIMEOUT_MS = 5000, ERR_SEC_ITEM_NOT_FOUND = 44, keychainEnabledOverride = null, keychainSpawnOverride = null;
+var init_credential_store = __esm(() => {
+  init_spawn_runner();
+});
+
 // web-src/server/database/connections-store.ts
 import { randomUUID } from "node:crypto";
 import { chmod } from "node:fs/promises";
@@ -16394,15 +16886,45 @@ import { join as join12 } from "node:path";
 function secretKey(cwd, id) {
   return `${cwd}\x00${id}`;
 }
+async function hydrateFromKeychainAsync(cwd, connections) {
+  if (!isKeychainAvailable())
+    return;
+  await Promise.all(connections.map((connection) => {
+    const key = secretKey(cwd, connection.id);
+    if (runtimeSecrets.has(key))
+      return;
+    const inFlight = keychainLookups.get(key);
+    if (inFlight)
+      return inFlight;
+    const lookup = loadConnectionSecretsAsync(cwd, connection.id).then((stored) => {
+      if (stored)
+        runtimeSecrets.set(key, extractSecrets(stored));
+    }).catch(() => {
+      keychainLookups.delete(key);
+    });
+    keychainLookups.set(key, lookup);
+    return lookup;
+  }));
+}
 function extractSecrets(value) {
-  return {
-    ...typeof value.user === "string" ? { user: value.user } : {},
-    ...typeof value.username === "string" ? { username: value.username } : {},
-    ...typeof value.accessKeyId === "string" ? { accessKeyId: value.accessKeyId } : {},
-    ...typeof value.password === "string" ? { password: value.password } : {},
-    ...typeof value.secretAccessKey === "string" ? { secretAccessKey: value.secretAccessKey } : {},
-    ...typeof value.sessionToken === "string" ? { sessionToken: value.sessionToken } : {}
-  };
+  const secrets = {};
+  for (const field of RUNTIME_ONLY_FIELDS) {
+    if (typeof value[field] === "string")
+      secrets[field] = value[field];
+  }
+  return secrets;
+}
+function preservedSecrets(input, existing) {
+  if (!existing)
+    return {};
+  const preserved = {};
+  const source = existing;
+  for (const field of PRESERVED_SECRET_FIELDS) {
+    if (input[field] === undefined && field in source) {
+      preserved[field] = source[field];
+    }
+  }
+  return preserved;
 }
 function withRuntimeSecrets(cwd, connection) {
   return {
@@ -16496,6 +17018,19 @@ function sanitizeConnection(raw) {
       password: requiredString(input.password)
     };
   }
+  if (input.kind === "d1") {
+    const accountId = requiredString(input.accountId, 128).trim();
+    const databaseId = requiredString(input.databaseId, 128).trim();
+    if (!accountId || !databaseId)
+      return null;
+    return {
+      ...base,
+      kind: "d1",
+      accountId,
+      databaseId,
+      apiToken: requiredString(input.apiToken)
+    };
+  }
   if (input.kind === "s3" || input.kind === "dynamodb") {
     const endpoint = validEndpoint(input.endpoint);
     const region = requiredString(input.region).trim();
@@ -16514,16 +17049,19 @@ function sanitizeConnection(raw) {
   }
   return null;
 }
+function assertConnectionCredentials(connection) {
+  const missing = !connection || (connection.kind === "postgresql" || connection.kind === "mysql") && !connection.user || (connection.kind === "s3" || connection.kind === "dynamodb") && !connection.accessKeyId || connection.kind === "d1" && !connection.apiToken;
+  if (!connection || missing) {
+    throw new Error("invalid datastore connection");
+  }
+  return connection;
+}
 function validateDatastoreConnection(raw, fallbackId = "connection:0000000000000000") {
   const input = raw && typeof raw === "object" ? raw : {};
-  const connection = sanitizeConnection({
+  return assertConnectionCredentials(sanitizeConnection({
     ...input,
     id: typeof input.id === "string" && input.id ? input.id : fallbackId
-  });
-  if (!connection || (connection.kind === "postgresql" || connection.kind === "mysql") && !connection.user || (connection.kind === "s3" || connection.kind === "dynamodb") && !connection.accessKeyId) {
-    throw new Error("invalid datastore connection");
-  }
-  return connection;
+  }));
 }
 function sanitizeState(raw) {
   if (!raw || typeof raw !== "object")
@@ -16551,7 +17089,9 @@ async function protectFile(cwd) {
   });
 }
 async function loadDatastoreConnections(cwd) {
-  return (await store.load(cwd)).connections.map((connection) => withRuntimeSecrets(cwd, connection));
+  const { connections } = await store.load(cwd);
+  await hydrateFromKeychainAsync(cwd, connections);
+  return connections.map((connection) => withRuntimeSecrets(cwd, connection));
 }
 async function findDatastoreConnection(cwd, id) {
   return (await loadDatastoreConnections(cwd)).find((entry) => entry.id === id) ?? null;
@@ -16563,17 +17103,12 @@ async function saveDatastoreConnection(cwd, raw) {
   const result = await store.update(cwd, (state) => {
     const storedExisting = state.connections.find((entry) => entry.id === id);
     const existing = storedExisting ? withRuntimeSecrets(cwd, storedExisting) : undefined;
-    const merged = sanitizeConnection({
+    const merged = assertConnectionCredentials(sanitizeConnection({
       ...existing ?? {},
       ...input,
       id,
-      password: input.password === undefined && existing && "password" in existing ? existing.password : input.password,
-      secretAccessKey: input.secretAccessKey === undefined && existing && "secretAccessKey" in existing ? existing.secretAccessKey : input.secretAccessKey,
-      sessionToken: input.sessionToken === undefined && existing && "sessionToken" in existing ? existing.sessionToken : input.sessionToken
-    });
-    if (!merged || (merged.kind === "postgresql" || merged.kind === "mysql") && !merged.user || (merged.kind === "s3" || merged.kind === "dynamodb") && !merged.accessKeyId) {
-      throw new Error("invalid datastore connection");
-    }
+      ...preservedSecrets(input, existing)
+    }));
     const connections = state.connections.filter((entry) => entry.id !== id);
     if (!storedExisting && connections.length >= MAX_CONNECTIONS2) {
       throw new Error("too many datastore connections");
@@ -16584,7 +17119,10 @@ async function saveDatastoreConnection(cwd, raw) {
       result: merged
     };
   });
-  runtimeSecrets.set(secretKey(cwd, result.id), extractSecrets(result));
+  const secrets = extractSecrets(result);
+  runtimeSecrets.set(secretKey(cwd, result.id), secrets);
+  keychainLookups.set(secretKey(cwd, result.id), Promise.resolve());
+  await saveConnectionSecretsAsync(cwd, result.id, secrets);
   await protectFile(cwd);
   return result;
 }
@@ -16597,8 +17135,10 @@ async function deleteDatastoreConnection(cwd, id) {
     };
   });
   runtimeSecrets.delete(secretKey(cwd, id));
+  keychainLookups.delete(secretKey(cwd, id));
+  const secretsRemoved = isKeychainAvailable() ? await deleteConnectionSecretsAsync(cwd, id) : true;
   await protectFile(cwd);
-  return deleted;
+  return { deleted, secretsRemoved };
 }
 function connectionToFileInfo(connection) {
   return {
@@ -16611,25 +17151,33 @@ function connectionToFileInfo(connection) {
   };
 }
 function publicConnection(connection) {
-  const {
-    password: _password,
-    user: _user,
-    username: _username,
-    accessKeyId: _accessKeyId,
-    ...withoutPassword
-  } = connection;
-  const {
-    secretAccessKey: _secret,
-    sessionToken: _token,
-    ...safe
-  } = withoutPassword;
+  const safe = { ...connection };
+  for (const field of RUNTIME_ONLY_FIELDS)
+    delete safe[field];
   return safe;
 }
-var CONNECTIONS_FILE_NAME = "datastore-connections.json", MAX_CONNECTIONS2 = 64, MAX_JSON_BYTES, MAX_NAME_LENGTH = 120, MAX_HOST_LENGTH = 253, MAX_VALUE_LENGTH = 4096, runtimeSecrets, store;
+var CONNECTIONS_FILE_NAME = "datastore-connections.json", MAX_CONNECTIONS2 = 64, MAX_JSON_BYTES, MAX_NAME_LENGTH = 120, MAX_HOST_LENGTH = 253, MAX_VALUE_LENGTH = 4096, RUNTIME_ONLY_FIELDS, PRESERVED_SECRET_FIELDS, runtimeSecrets, keychainLookups, store;
 var init_connections_store = __esm(() => {
   init_json_store();
+  init_credential_store();
   MAX_JSON_BYTES = 256 * 1024;
+  RUNTIME_ONLY_FIELDS = [
+    "user",
+    "username",
+    "accessKeyId",
+    "password",
+    "secretAccessKey",
+    "sessionToken",
+    "apiToken"
+  ];
+  PRESERVED_SECRET_FIELDS = [
+    "password",
+    "secretAccessKey",
+    "sessionToken",
+    "apiToken"
+  ];
   runtimeSecrets = new Map;
+  keychainLookups = new Map;
   store = createJsonFileStore({
     filePath: connectionsFilePath,
     empty: emptyState,
@@ -16654,7 +17202,7 @@ function escapeLikeTerm(term) {
   return term.replace(/=/g, "==").replace(/%/g, "=%").replace(/_/g, "=_");
 }
 async function searchTableAsync(adapter, table, columns, term, maxHits, includeNonText, pkColumns, signal) {
-  const kind = adapter.kind;
+  const kind = adapter.kind === "d1" ? "sqlite" : adapter.kind;
   const searchCols = includeNonText ? columns.filter((c) => c.type.toUpperCase() !== "BLOB" && c.type.toUpperCase() !== "BYTEA") : columns.filter((c) => isTextLikeType(c.type));
   if (searchCols.length === 0)
     return [];
@@ -17023,6 +17571,9 @@ function handleError(prefix, action, err, signal) {
   if (isDockerComposeServiceUnavailableError(err)) {
     return textError(message, err.status);
   }
+  if (isD1HttpError(err)) {
+    return textError(message, err.status);
+  }
   if (isFilesystemAccessError(err)) {
     return textError(`failed to ${action}`, 500);
   }
@@ -17030,6 +17581,7 @@ function handleError(prefix, action, err, signal) {
 }
 var DEFAULT_MAX_DOCKER_ADAPTER_CACHE = 8, DEFAULT_DOCKER_ADAPTER_IDLE_MS, MAX_LOGGED_ERROR_BODY = 500, logQueue;
 var init_handle_shared = __esm(() => {
+  init_d1();
   init_docker_utils();
   init_connections_store();
   init_discovery();
@@ -19201,6 +19753,10 @@ function ensureInit() {
   initialized = true;
 }
 async function getAdapter(r, _cwd, signal) {
+  if (r.d1) {
+    const connection = r.d1;
+    return dockerAdapterCache.getOrOpenAsync(r.dbId, () => createD1Adapter(connection));
+  }
   if (r.saved) {
     const cacheKey = r.schema ? `${r.dbId}\x00schema=${r.schema}` : r.dbId;
     return dockerAdapterCache.getOrOpenAsync(cacheKey, () => createSqlCliAdapter({ ...r.saved, schema: r.schema }));
@@ -19256,6 +19812,9 @@ async function resolveDb(cwd, dbParam, omitDirNames, schemaParam, signal) {
     const connection = await findDatastoreConnection(cwd, dbParam);
     if (!connection)
       return textError("datastore connection not found", 404);
+    if (connection.kind === "d1") {
+      return { resolved: dbParam, dbId: dbParam, d1: connection };
+    }
     if (connection.kind !== "postgresql" && connection.kind !== "mysql") {
       return textError(`${connection.kind} must use its datastore routes`, 400);
     }
@@ -20465,7 +21024,7 @@ async function handleDbUiGet(cwd) {
   return jsonLoadResponse(() => loadDbUiState(cwd), "db UI", "failed to load db UI state");
 }
 function closeSavedConnection(id, kind) {
-  if (kind === "postgresql" || kind === "mysql") {
+  if (kind === "postgresql" || kind === "mysql" || kind === "d1") {
     dockerAdapterCache.close(id);
     dockerAdapterCache.closePrefix(`${id}\x00`);
     return;
@@ -20497,9 +21056,9 @@ async function handleConnections(cwd, req) {
   const existing = await findDatastoreConnection(cwd, id);
   if (!existing)
     return textError("datastore connection not found", 404);
-  await deleteDatastoreConnection(cwd, id);
+  const { secretsRemoved } = await deleteDatastoreConnection(cwd, id);
   closeSavedConnection(id, existing.kind);
-  return json({ ok: true });
+  return json({ ok: true, secretsRemoved });
 }
 async function probeDatastoreConnection(connection, signal) {
   if (connection.kind === "postgresql" || connection.kind === "mysql") {
@@ -20511,6 +21070,15 @@ async function probeDatastoreConnection(connection, signal) {
     }
     return;
   }
+  if (connection.kind === "d1") {
+    const adapter2 = createD1Adapter(connection);
+    try {
+      await adapter2.getTablesAsync(signal);
+    } finally {
+      adapter2.close();
+    }
+    return;
+  }
   if (connection.kind === "redis") {
     const adapter2 = createRedisAdapter(connection);
     try {
@@ -20830,6 +21398,7 @@ async function handleDatabaseRoute(req, url, cwd, omitDirNames, sideEffectAllowe
 var initialized = false, dockerAdapterCache, DEFAULT_DB_FILE_DISCOVERY_DEPS, MAX_SCHEMA_NAME_LEN2 = 1024, MAX_COLUMN_VALUE_PAIRS = 64, MAX_FILTER_COLUMN_LEN = 128, MAX_FILTER_VALUE_LEN = 4096, DB_QUERY_DEFAULT_MAX_ROWS = 1000, DB_QUERY_HARD_CAP_MAX_ROWS = 1e4, EXPORT_MAX_ROWS = 1e5, MAX_TABS_BODY_BYTES = 1e6, MAX_DB_UI_BODY_BYTES = 1e6, MAX_SNAPSHOT_TABLES = 512, MAX_SNAPSHOT_TABLE_NAME_LEN = 1024, searchJobs, snapshotJobs, DOCKER_CLOSE_REGISTRY, SNAPSHOT_DOCKER_SOURCE_REGISTRY;
 var init_handle = __esm(() => {
   init_state_store();
+  init_d1();
   init_docker();
   init_docker_utils();
   init_dynamodb();
@@ -20899,7 +21468,7 @@ var init_handle = __esm(() => {
 });
 
 // web-src/server/doctor.ts
-import { accessSync as accessSync2, constants as constants2, readFileSync as readFileSync6, statSync as statSync5 } from "node:fs";
+import { accessSync as accessSync2, constants as constants2, readFileSync as readFileSync6, statSync as statSync6 } from "node:fs";
 import { dirname as dirname5, join as join16, relative as relative6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function statusWorse(a, b) {
@@ -21092,7 +21661,7 @@ async function checkSqlite(cwd) {
 async function trySnapshotDbOpen(cwd) {
   const dbPath = join16(cwd, SNAPSHOT_DB_REL);
   try {
-    statSync5(dbPath);
+    statSync6(dbPath);
   } catch {
     return { kind: "skipped" };
   }
@@ -21121,7 +21690,7 @@ function checkSnapshotStore(cwd) {
     dirDetail = `${dir} (writable)`;
   } catch {
     try {
-      statSync5(dir);
+      statSync6(dir);
       dirStatus = "error";
       dirDetail = `${dir} (not writable)`;
       dirHint = "Snapshot creation will fail until the directory is writable. " + "Check filesystem permissions on the .code-viewer directory.";
@@ -21131,7 +21700,7 @@ function checkSnapshotStore(cwd) {
   }
   let dbDetail = dbPath;
   try {
-    const stat3 = statSync5(dbPath);
+    const stat3 = statSync6(dbPath);
     dbDetail = `${dbPath} (${stat3.size.toLocaleString()} bytes)`;
   } catch {
     dbDetail = `${dbPath} (not created yet — created on first snapshot)`;
@@ -24535,7 +25104,7 @@ import {
   readFileSync as readFileSync8,
   realpathSync as realpathSync7,
   renameSync,
-  statSync as statSync6,
+  statSync as statSync7,
   unlinkSync as unlinkSync2,
   watch,
   writeFileSync as writeFileSync2
@@ -25055,7 +25624,7 @@ function worktreeFileMetadata(path, knownSize) {
   if (!full)
     return {};
   try {
-    const stat3 = statSync6(full);
+    const stat3 = statSync7(full);
     return {
       size: knownSize ?? stat3.size,
       created_at: isoDate(stat3.birthtimeMs),
@@ -25080,7 +25649,7 @@ async function directoryMetadata(target, path) {
     if (!full)
       return {};
     try {
-      const stat3 = statSync6(full);
+      const stat3 = statSync7(full);
       return {
         created_at: isoDate(stat3.birthtimeMs),
         updated_at: isoDate(stat3.mtimeMs)
@@ -25357,7 +25926,7 @@ async function handleLog(url) {
 }
 function blamePathKey(p) {
   try {
-    const st = statSync6(join20(cwd, p));
+    const st = statSync7(join20(cwd, p));
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "missing";
@@ -25512,7 +26081,7 @@ async function handleFileDiff(url) {
 }
 function worktreeLineIndexSignature(full) {
   try {
-    const stat3 = statSync6(full);
+    const stat3 = statSync7(full);
     return `size:${stat3.size}|mtime:${stat3.mtimeMs}|ctime:${stat3.ctimeMs}|ino:${stat3.ino || 0}`;
   } catch {
     return null;
@@ -25528,7 +26097,7 @@ async function getWorktreeLineIndex(full) {
     lineIndexCache.set(full, cached);
     return cached.index;
   }
-  const stat3 = statSync6(full);
+  const stat3 = statSync7(full);
   if (stat3.size > LINE_INDEX_MAX_FILE_BYTES)
     return null;
   const index = await buildLineOffsetIndexFromStream(fileReadableStream(full), stat3.size);
@@ -25660,6 +26229,8 @@ async function handleFileRange(url) {
     const full = safeWorktreePath2(path);
     if (!full)
       return text("no file", 404);
+    if (await rawFileSize(path, ref) == null)
+      return text("no file", 404);
     const responseGeneration = generation;
     const result = await collectIndexedWorktreeLineRange(full, start, end);
     const body = {
@@ -25808,7 +26379,8 @@ async function rawFileSize(path, ref) {
   if (!full)
     return null;
   try {
-    return statSync6(full).size;
+    const stats = statSync7(full);
+    return stats.isFile() ? stats.size : null;
   } catch {
     return null;
   }
@@ -25869,7 +26441,7 @@ async function handleUploadFiles(req) {
   const realDir = safeOpenWorktreePath(dir);
   if (!realDir)
     return text("not found", 404);
-  const stats = statSync6(realDir);
+  const stats = statSync7(realDir);
   if (!stats.isDirectory())
     return text("not a directory", 400);
   const files = form.getAll("files").filter((item) => item instanceof File);
@@ -26118,7 +26690,7 @@ async function handleOpenPath(req) {
   const target = safeOpenWorktreePath(targetPath);
   if (!target)
     return text("not found", 404);
-  const stats = statSync6(target);
+  const stats = statSync7(target);
   if (!stats.isDirectory())
     return text("not a directory", 400);
   openOsPath(target);
@@ -26156,7 +26728,7 @@ async function handleTrashPath(req) {
     return text("not found", 404);
   let changedPaths;
   try {
-    const stats = statSync6(originalFullPath);
+    const stats = statSync7(originalFullPath);
     if (!stats.isDirectory())
       changedPaths = [path];
   } catch {}
@@ -26209,7 +26781,7 @@ async function handleCreateDirectory(req) {
   const parent = safeOpenWorktreePath(dir);
   if (!parent)
     return text("not found", 404);
-  const stats = statSync6(parent);
+  const stats = statSync7(parent);
   if (!stats.isDirectory())
     return text("not a directory", 400);
   const targetPath = dir ? `${dir}/${name}` : name;
@@ -26259,7 +26831,7 @@ async function handleRestoreTrash(req) {
     return text(restored.error || "undo failed", 409);
   let changedPaths;
   try {
-    const stats = statSync6(worktreePath(originalPath));
+    const stats = statSync7(worktreePath(originalPath));
     if (!stats.isDirectory())
       changedPaths = [originalPath];
   } catch {}
@@ -27025,6 +27597,12 @@ data: ${watchLimitReached}
     root: cwd,
     started_at: new Date().toISOString()
   });
+  process.on("uncaughtException", (error) => {
+    console.error("[code-viewer] uncaught exception (server kept running):", error);
+  });
+  process.on("unhandledRejection", (reason) => {
+    console.error("[code-viewer] unhandled rejection (server kept running):", reason);
+  });
   process.on("exit", () => {
     removeServerRegistry(cwd, process.pid);
     closeSseClients();