neonctl 2.28.0 → 2.29.0

package/dist/psql/index.js

@@ -1,17 +1,17 @@
-import { PgConnection } from './wire/connection.js';
-import { applyEnvOverrides, defaultSettings } from './core/settings.js';
-import { createVarStore } from './core/variables.js';
-import { syncConnectionVars } from './core/syncVars.js';
-import { defaultRegistry } from './command/dispatch.js';
-import { createCondStack } from './command/cmd_cond.js';
-import { runMainLoop, EXIT_BADCONN, EXIT_FAILURE, EXIT_SUCCESS, EXIT_USER, } from './core/mainloop.js';
-import { applyStartupArgs, parseStartupArgs } from './core/startup.js';
-import { executeInputString, loadPsqlrc } from './io/psqlrc.js';
-import { loadPgPass } from './io/pgpass.js';
-import { loadPgServices } from './io/pgservice.js';
-import { promises as fs, existsSync } from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
+import { existsSync, promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { createCondStack } from "./command/cmd_cond.js";
+import { defaultRegistry } from "./command/dispatch.js";
+import { EXIT_BADCONN, EXIT_FAILURE, EXIT_SUCCESS, EXIT_USER, runMainLoop, } from "./core/mainloop.js";
+import { applyEnvOverrides, defaultSettings } from "./core/settings.js";
+import { applyStartupArgs, parseStartupArgs } from "./core/startup.js";
+import { syncConnectionVars } from "./core/syncVars.js";
+import { createVarStore } from "./core/variables.js";
+import { loadPgPass } from "./io/pgpass.js";
+import { loadPgServices } from "./io/pgservice.js";
+import { executeInputString, loadPsqlrc } from "./io/psqlrc.js";
+import { PgConnection } from "./wire/connection.js";
 /**
  * Embedded TypeScript psql entrypoint.
  *
@@ -27,7 +27,7 @@ export const runPsql = async (argv, stdio = {}) => {
     const stdin = stdio.stdin ?? process.stdin;
     const stdout = stdio.stdout ?? process.stdout;
     const stderr = stdio.stderr ?? process.stderr;
-    const connectionUri = argv[0] ?? '';
+    const connectionUri = argv[0] ?? "";
     // Parse argv[0] in one of three shapes:
     //   - URI scheme (`postgres://…` / `postgresql://…`): the URI-partial
     //     parser handles authority, query, and `?service=…`.
@@ -45,10 +45,10 @@ export const runPsql = async (argv, stdio = {}) => {
     // ConnectOptions layers.
     let uriPartial = {};
     let uriService;
-    if (connectionUri !== '' && looksLikeConnectionString(connectionUri)) {
+    if (connectionUri !== "" && looksLikeConnectionString(connectionUri)) {
         try {
-            if (connectionUri.startsWith('postgres://') ||
-                connectionUri.startsWith('postgresql://')) {
+            if (connectionUri.startsWith("postgres://") ||
+                connectionUri.startsWith("postgresql://")) {
                 uriPartial = parseConnectionUriPartial(connectionUri);
                 uriService = parseConnectionUriService(connectionUri);
             }
@@ -58,7 +58,8 @@ export const runPsql = async (argv, stdio = {}) => {
                 // part of ConnectOptions); pull it out so the layered resolver
                 // can look it up.
                 const parsed = parseConninfo(connectionUri);
-                if (typeof parsed._service === 'string' && parsed._service.length > 0) {
+                if (typeof parsed._service === "string" &&
+                    parsed._service.length > 0) {
                     uriService = parsed._service;
                 }
                 delete parsed._service;
@@ -72,11 +73,11 @@ export const runPsql = async (argv, stdio = {}) => {
     }
     // Parse psql args (argv[1..]). argv[0] is the connection URI consumed above.
     const parsed = parseStartupArgs(argv.slice(1));
-    if ('kind' in parsed) {
-        if (parsed.kind === 'help' || parsed.kind === 'version') {
+    if ("kind" in parsed) {
+        if (parsed.kind === "help" || parsed.kind === "version") {
             stdout.write(parsed.message);
-            if (!parsed.message.endsWith('\n'))
-                stdout.write('\n');
+            if (!parsed.message.endsWith("\n"))
+                stdout.write("\n");
             return EXIT_SUCCESS;
         }
         stderr.write(`psql: error: ${parsed.message}\n`);
@@ -212,7 +213,7 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
     // count as a "failed switch" for exit-code purposes.
     if (singleTransaction && settings.db) {
         try {
-            await settings.db.execSimple('BEGIN');
+            await settings.db.execSimple("BEGIN");
             beganTransaction = true;
         }
         catch (err) {
@@ -224,10 +225,12 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
     for (const action of preActions) {
         if (connectionLost)
             break;
-        if (action.kind === 'command') {
+        if (action.kind === "command") {
             let outcome;
             try {
-                outcome = await executeInputString(action.sql, ctx, { print: true });
+                outcome = await executeInputString(action.sql, ctx, {
+                    print: true,
+                });
             }
             catch (err) {
                 // Defensive: executeInputString shouldn't throw, but if a downstream
@@ -266,7 +269,7 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
             // upstream, which only escalates to a stop when ON_ERROR_STOP fires).
             let contents;
             try {
-                contents = await fs.readFile(action.path, 'utf8');
+                contents = await fs.readFile(action.path, "utf8");
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
@@ -280,7 +283,9 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
             }
             let outcome;
             try {
-                outcome = await executeInputString(contents, ctx, { print: true });
+                outcome = await executeInputString(contents, ctx, {
+                    print: true,
+                });
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
@@ -310,7 +315,7 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
     // and ON_ERROR_STOP fired, roll back. Otherwise commit — upstream commits
     // even when individual statements failed without ON_ERROR_STOP.
     if (beganTransaction && settings.db && !connectionLost) {
-        const closing = earlyStopOnError ? 'ROLLBACK' : 'COMMIT';
+        const closing = earlyStopOnError ? "ROLLBACK" : "COMMIT";
         try {
             await settings.db.execSimple(closing);
         }
@@ -328,7 +333,7 @@ const runPreActions = async (ctx, preActions, singleTransaction) => {
     return status;
 };
 const writeStartupBanner = (connection, out) => {
-    const serverVersion = connection.parameterStatus('server_version') ?? 'unknown';
+    const serverVersion = connection.parameterStatus("server_version") ?? "unknown";
     // Client identifier. Matches upstream's `psql (18.4, server X.Y)` shape
     // but signals that this is the embedded TS implementation so users can tell
     // when they're on the fallback path.
@@ -342,7 +347,7 @@ const writeStartupBanner = (connection, out) => {
         ];
         if (tls.alpn)
             parts.push(`ALPN: ${tls.alpn}`);
-        out.write(`SSL connection (${parts.join(', ')})\n`);
+        out.write(`SSL connection (${parts.join(", ")})\n`);
     }
     out.write('Type "help" for help.\n\n');
 };
@@ -352,45 +357,45 @@ const writeStartupBanner = (connection, out) => {
 // recognize them as valid keys so callers don't get a spurious "unknown key"
 // rejection for a libpq-spec key they expect to work.
 const KNOWN_QUERY_KEYS = new Set([
-    'host',
-    'hostaddr',
-    'port',
-    'dbname',
-    'user',
-    'password',
-    'passfile',
-    'channel_binding',
-    'require_auth',
-    'connect_timeout',
-    'client_encoding',
-    'options',
-    'application_name',
-    'fallback_application_name',
-    'keepalives',
-    'keepalives_idle',
-    'keepalives_interval',
-    'keepalives_count',
-    'sslmode',
-    'sslnegotiation',
-    'sslcompression',
-    'sslcert',
-    'sslkey',
-    'sslcertmode',
-    'sslrootcert',
-    'sslcrl',
-    'sslcrldir',
-    'sslkeylogfile',
-    'sslsni',
-    'requirepeer',
-    'ssl_min_protocol_version',
-    'ssl_max_protocol_version',
-    'krbsrvname',
-    'gsslib',
-    'gssencmode',
-    'service',
-    'target_session_attrs',
-    'load_balance_hosts',
-    'replication',
+    "host",
+    "hostaddr",
+    "port",
+    "dbname",
+    "user",
+    "password",
+    "passfile",
+    "channel_binding",
+    "require_auth",
+    "connect_timeout",
+    "client_encoding",
+    "options",
+    "application_name",
+    "fallback_application_name",
+    "keepalives",
+    "keepalives_idle",
+    "keepalives_interval",
+    "keepalives_count",
+    "sslmode",
+    "sslnegotiation",
+    "sslcompression",
+    "sslcert",
+    "sslkey",
+    "sslcertmode",
+    "sslrootcert",
+    "sslcrl",
+    "sslcrldir",
+    "sslkeylogfile",
+    "sslsni",
+    "requirepeer",
+    "ssl_min_protocol_version",
+    "ssl_max_protocol_version",
+    "krbsrvname",
+    "gsslib",
+    "gssencmode",
+    "service",
+    "target_session_attrs",
+    "load_balance_hosts",
+    "replication",
 ]);
 /**
  * Tokenize a postgres connection URI into raw components.
@@ -405,33 +410,33 @@ const tokenizeConnectionUri = (uri) => {
     // Strip scheme. Only postgres:// and postgresql:// are accepted; libpq
     // rejects everything else with a "missing schema" error.
     let rest;
-    if (uri.startsWith('postgresql://')) {
-        rest = uri.slice('postgresql://'.length);
+    if (uri.startsWith("postgresql://")) {
+        rest = uri.slice("postgresql://".length);
     }
-    else if (uri.startsWith('postgres://')) {
-        rest = uri.slice('postgres://'.length);
+    else if (uri.startsWith("postgres://")) {
+        rest = uri.slice("postgres://".length);
     }
     else {
         throw new Error(`unsupported scheme in URI: ${uri}`);
     }
     // Split off query string.
-    let query = '';
-    const qIdx = rest.indexOf('?');
+    let query = "";
+    const qIdx = rest.indexOf("?");
     if (qIdx >= 0) {
         query = rest.slice(qIdx + 1);
         rest = rest.slice(0, qIdx);
     }
     // Split off path (database).
     let database;
-    const pIdx = rest.indexOf('/');
+    const pIdx = rest.indexOf("/");
     if (pIdx >= 0) {
         const pathRaw = rest.slice(pIdx + 1);
-        database = pathRaw === '' ? undefined : decodePercent(pathRaw);
+        database = pathRaw === "" ? undefined : decodePercent(pathRaw);
         rest = rest.slice(0, pIdx);
     }
     // What's left is the authority: [userinfo@][host[:port]]
     let userinfo;
-    const atIdx = rest.lastIndexOf('@');
+    const atIdx = rest.lastIndexOf("@");
     if (atIdx >= 0) {
         userinfo = rest.slice(0, atIdx);
         rest = rest.slice(atIdx + 1);
@@ -439,7 +444,7 @@ const tokenizeConnectionUri = (uri) => {
     let user;
     let password;
     if (userinfo !== undefined) {
-        const colon = userinfo.indexOf(':');
+        const colon = userinfo.indexOf(":");
         if (colon >= 0) {
             user = decodePercent(userinfo.slice(0, colon));
             password = decodePercent(userinfo.slice(colon + 1));
@@ -490,22 +495,22 @@ const tokenizeConnectionUri = (uri) => {
  *                                              treat as no-host)
  */
 const splitAuthorityTuples = (rest, uri) => {
-    if (rest === '')
-        return [''];
+    if (rest === "")
+        return [""];
     const tuples = [];
     let start = 0;
     let i = 0;
     while (i < rest.length) {
         const ch = rest[i];
-        if (ch === '[') {
-            const closeIdx = rest.indexOf(']', i);
+        if (ch === "[") {
+            const closeIdx = rest.indexOf("]", i);
             if (closeIdx < 0) {
                 throw new Error(`missing matching "]" in IPv6 host address: ${uri}`);
             }
             i = closeIdx + 1;
             continue;
         }
-        if (ch === ',') {
+        if (ch === ",") {
             tuples.push(rest.slice(start, i));
             i += 1;
             start = i;
@@ -517,26 +522,26 @@ const splitAuthorityTuples = (rest, uri) => {
     return tuples;
 };
 const parseAuthorityTuple = (tuple, uri) => {
-    if (tuple === '')
+    if (tuple === "")
         return {};
-    if (tuple.startsWith('[')) {
-        const closeIdx = tuple.indexOf(']');
+    if (tuple.startsWith("[")) {
+        const closeIdx = tuple.indexOf("]");
         if (closeIdx < 0) {
             throw new Error(`missing matching "]" in IPv6 host address: ${uri}`);
         }
         const host = tuple.slice(1, closeIdx);
-        if (host === '') {
+        if (host === "") {
             throw new Error(`IPv6 host address may not be empty: ${uri}`);
         }
         const after = tuple.slice(closeIdx + 1);
-        if (after === '')
+        if (after === "")
             return { host };
-        if (after.startsWith(':')) {
+        if (after.startsWith(":")) {
             return { host, port: after.slice(1) };
         }
         throw new Error(`unexpected characters after IPv6 host address in URI: ${uri}`);
     }
-    const colon = tuple.indexOf(':');
+    const colon = tuple.indexOf(":");
     if (colon >= 0) {
         return {
             host: decodePercent(tuple.slice(0, colon)),
@@ -547,12 +552,12 @@ const parseAuthorityTuple = (tuple, uri) => {
 };
 const parseQuery = (raw) => {
     const out = new Map();
-    if (raw === '')
+    if (raw === "")
         return out;
-    for (const segment of raw.split('&')) {
-        if (segment === '')
+    for (const segment of raw.split("&")) {
+        if (segment === "")
             continue;
-        const eq = segment.indexOf('=');
+        const eq = segment.indexOf("=");
         if (eq < 0) {
             // libpq: every query parameter must be `key=value`. Bare keys (no `=`)
             // are rejected. Matches the upstream 001_uri.pl `?zzz` and
@@ -563,12 +568,12 @@ const parseQuery = (raw) => {
         const valueRaw = segment.slice(eq + 1);
         // libpq rejects an extra `=` in either key or value; matches the
         // `?key=key=value` upstream case.
-        if (valueRaw.includes('=')) {
+        if (valueRaw.includes("=")) {
             throw new Error(`extra "=" in query parameter "${decodePercent(keyRaw).trim()}"`);
         }
         const key = decodePercent(keyRaw).trim();
         const value = decodePercent(valueRaw).trim();
-        if (key === '')
+        if (key === "")
             continue;
         if (!KNOWN_QUERY_KEYS.has(key)) {
             throw new Error(`invalid URI query parameter: "${key}"`);
@@ -594,7 +599,7 @@ const decodePercent = (s) => {
     catch {
         throw new Error(`invalid percent-encoded token in URI: ${s}`);
     }
-    if (decoded.includes('\x00')) {
+    if (decoded.includes("\x00")) {
         throw new Error(`forbidden NUL byte (%00) in URI: ${s}`);
     }
     return decoded;
@@ -602,11 +607,11 @@ const decodePercent = (s) => {
 export const parseConnectionUri = (uri) => {
     const raw = tokenizeConnectionUri(uri);
     // libpq-style: query string can override authority components.
-    const queryUser = raw.query.get('user');
-    const queryPassword = raw.query.get('password');
-    const queryPort = raw.query.get('port');
-    const queryDbname = raw.query.get('dbname');
-    const queryHost = raw.query.get('host');
+    const queryUser = raw.query.get("user");
+    const queryPassword = raw.query.get("password");
+    const queryPort = raw.query.get("port");
+    const queryDbname = raw.query.get("dbname");
+    const queryHost = raw.query.get("host");
     // Multi-host: either from the authority (`h1,h2,h3:5434`) or from
     // `?host=h1,h2,h3&port=5432,5433,5434`. Query-string overrides authority
     // (matching libpq: query params take precedence over URI structural
@@ -621,55 +626,55 @@ export const parseConnectionUri = (uri) => {
     });
     // Single-host fallbacks (preserve current behaviour for the `host` / `port`
     // surface — the wire layer prefers `hosts` when set).
-    const host = hostsTuples.length > 0 && hostsTuples[0].host !== ''
+    const host = hostsTuples.length > 0 && hostsTuples[0].host !== ""
         ? hostsTuples[0].host
-        : 'localhost';
+        : "localhost";
     const port = hostsTuples.length > 0 ? hostsTuples[0].port : 5432;
-    const user = queryUser !== undefined && queryUser !== ''
+    const user = queryUser !== undefined && queryUser !== ""
         ? queryUser
-        : raw.user !== undefined && raw.user !== ''
+        : raw.user !== undefined && raw.user !== ""
             ? raw.user
-            : (process.env.USER ?? '');
+            : (process.env.USER ?? "");
     const password = queryPassword ?? raw.password;
     const database = queryDbname ?? raw.database ?? user;
-    let ssl = normalizeSslMode(raw.query.get('sslmode') ?? null);
-    const channelBinding = normalizeChannelBinding(raw.query.get('channel_binding') ?? null);
+    let ssl = normalizeSslMode(raw.query.get("sslmode") ?? null);
+    const channelBinding = normalizeChannelBinding(raw.query.get("channel_binding") ?? null);
     // GSSAPI is unsupported (no native Kerberos dep); validate+reject require.
-    validateGssEncMode(raw.query.get('gssencmode') ?? null);
-    const options = raw.query.get('options');
+    validateGssEncMode(raw.query.get("gssencmode") ?? null);
+    const options = raw.query.get("options");
     // Match upstream psql: default `application_name` to `'psql'` so users see
     // the expected value in `pg_stat_activity`. The neonctl-specific identifier
     // is still discoverable via the User-Agent the protocol layer sends.
-    const applicationName = raw.query.get('application_name') ?? 'psql';
-    const replication = normalizeReplication(raw.query.get('replication') ?? null);
-    const targetSessionAttrs = normalizeTargetSessionAttrs(raw.query.get('target_session_attrs') ?? null);
-    const loadBalanceHosts = normalizeLoadBalanceHosts(raw.query.get('load_balance_hosts') ?? null);
+    const applicationName = raw.query.get("application_name") ?? "psql";
+    const replication = normalizeReplication(raw.query.get("replication") ?? null);
+    const targetSessionAttrs = normalizeTargetSessionAttrs(raw.query.get("target_session_attrs") ?? null);
+    const loadBalanceHosts = normalizeLoadBalanceHosts(raw.query.get("load_balance_hosts") ?? null);
     // libpq PEM file paths. Empty string is treated as "not set" so a URI
     // like `?sslcert=` doesn't surface as an attempt to load `""` from disk.
-    const sslcert = nonEmpty(raw.query.get('sslcert'));
-    const sslkey = nonEmpty(raw.query.get('sslkey'));
-    const sslcertmode = normalizeSslCertMode(raw.query.get('sslcertmode') ?? null);
-    const sslnegotiation = normalizeSslNegotiation(raw.query.get('sslnegotiation') ?? null);
-    const sslrootcert = nonEmpty(raw.query.get('sslrootcert'));
-    const sslcrl = nonEmpty(raw.query.get('sslcrl'));
-    const sslcrldir = nonEmpty(raw.query.get('sslcrldir'));
-    const sslkeylogfile = nonEmpty(raw.query.get('sslkeylogfile'));
+    const sslcert = nonEmpty(raw.query.get("sslcert"));
+    const sslkey = nonEmpty(raw.query.get("sslkey"));
+    const sslcertmode = normalizeSslCertMode(raw.query.get("sslcertmode") ?? null);
+    const sslnegotiation = normalizeSslNegotiation(raw.query.get("sslnegotiation") ?? null);
+    const sslrootcert = nonEmpty(raw.query.get("sslrootcert"));
+    const sslcrl = nonEmpty(raw.query.get("sslcrl"));
+    const sslcrldir = nonEmpty(raw.query.get("sslcrldir"));
+    const sslkeylogfile = nonEmpty(raw.query.get("sslkeylogfile"));
     // libpq sslsni / keepalives toggles (0/1) + keepalives_idle (seconds) +
     // requirepeer (OS user, validated but not enforceable in Node).
-    const sslsni = parseLibpqBool(nonEmpty(raw.query.get('sslsni')));
-    const keepalives = parseLibpqBool(nonEmpty(raw.query.get('keepalives')));
-    const keepalivesIdle = parseKeepalivesIdle(nonEmpty(raw.query.get('keepalives_idle')));
-    const requirepeer = nonEmpty(raw.query.get('requirepeer'));
+    const sslsni = parseLibpqBool(nonEmpty(raw.query.get("sslsni")));
+    const keepalives = parseLibpqBool(nonEmpty(raw.query.get("keepalives")));
+    const keepalivesIdle = parseKeepalivesIdle(nonEmpty(raw.query.get("keepalives_idle")));
+    const requirepeer = nonEmpty(raw.query.get("requirepeer"));
     // libpq: `sslrootcert=system` raises the effective sslmode to verify-full.
     // verify-full is the strongest mode, so this only ever raises it.
-    if (sslrootcert === 'system' && ssl !== 'verify-full') {
-        ssl = 'verify-full';
+    if (sslrootcert === "system" && ssl !== "verify-full") {
+        ssl = "verify-full";
     }
     // libpq `hostaddr`: a fixed IP that bypasses DNS while `host` still drives
     // TLS SNI / cert verification. Empty string is "not set".
-    const hostaddr = nonEmpty(raw.query.get('hostaddr'));
-    const sslMinProtocolVersion = normalizeTlsProtocolVersion(nonEmpty(raw.query.get('ssl_min_protocol_version')), 'ssl_min_protocol_version');
-    const sslMaxProtocolVersion = normalizeTlsProtocolVersion(nonEmpty(raw.query.get('ssl_max_protocol_version')), 'ssl_max_protocol_version');
+    const hostaddr = nonEmpty(raw.query.get("hostaddr"));
+    const sslMinProtocolVersion = normalizeTlsProtocolVersion(nonEmpty(raw.query.get("ssl_min_protocol_version")), "ssl_min_protocol_version");
+    const sslMaxProtocolVersion = normalizeTlsProtocolVersion(nonEmpty(raw.query.get("ssl_max_protocol_version")), "ssl_max_protocol_version");
     assertTlsProtocolRange(sslMinProtocolVersion, sslMaxProtocolVersion);
     assertTlsMaxProtocolSupported(sslMaxProtocolVersion);
     // libpq rejects `sslnegotiation=direct` paired with a weak sslmode. The URI
@@ -690,7 +695,12 @@ export const parseConnectionUri = (uri) => {
         ...(hostaddr !== undefined ? { hostaddr } : {}),
         ...(replication !== undefined ? { replication } : {}),
         ...(hostsTuples.length > 1
-            ? { hosts: hostsTuples.map((t) => ({ host: t.host, port: t.port })) }
+            ? {
+                hosts: hostsTuples.map((t) => ({
+                    host: t.host,
+                    port: t.port,
+                })),
+            }
             : {}),
         ...(targetSessionAttrs !== undefined ? { targetSessionAttrs } : {}),
         ...(loadBalanceHosts !== undefined ? { loadBalanceHosts } : {}),
@@ -705,8 +715,12 @@ export const parseConnectionUri = (uri) => {
         ...(keepalives !== undefined ? { keepalives } : {}),
         ...(keepalivesIdle !== undefined ? { keepalivesIdle } : {}),
         ...(requirepeer !== undefined ? { requirepeer } : {}),
-        ...(sslMinProtocolVersion !== undefined ? { sslMinProtocolVersion } : {}),
-        ...(sslMaxProtocolVersion !== undefined ? { sslMaxProtocolVersion } : {}),
+        ...(sslMinProtocolVersion !== undefined
+            ? { sslMinProtocolVersion }
+            : {}),
+        ...(sslMaxProtocolVersion !== undefined
+            ? { sslMaxProtocolVersion }
+            : {}),
     };
 };
 /**
@@ -716,18 +730,18 @@ export const parseConnectionUri = (uri) => {
  * unrecognised so the caller falls back to libpq's default (enabled).
  */
 const parseLibpqBool = (raw) => {
-    if (raw === undefined || raw === '')
+    if (raw === undefined || raw === "")
         return undefined;
     switch (raw.toLowerCase()) {
-        case '1':
-        case 'true':
-        case 'yes':
-        case 'on':
+        case "1":
+        case "true":
+        case "yes":
+        case "on":
             return true;
-        case '0':
-        case 'false':
-        case 'no':
-        case 'off':
+        case "0":
+        case "false":
+        case "no":
+        case "off":
             return false;
         default:
             return undefined;
@@ -739,12 +753,12 @@ const parseLibpqBool = (raw) => {
  * milliseconds for `socket.setKeepAlive`'s `initialDelay`).
  */
 const parseKeepalivesIdle = (raw) => {
-    if (raw === undefined || raw === '')
+    if (raw === undefined || raw === "")
         return undefined;
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) && n >= 0 ? n : undefined;
 };
-const nonEmpty = (v) => v === undefined || v === '' ? undefined : v;
+const nonEmpty = (v) => v === undefined || v === "" ? undefined : v;
 /**
  * Resolve the final {host, port}[] list for a URI:
  *
@@ -764,10 +778,10 @@ const computeHostsTuples = (input) => {
     // Case A: ?host=… overrides the authority host(s). Port resolution still
     // prefers `?port=` (if supplied), but falls back to the authority port so
     // e.g. `postgres://:12345?host=/path/to/socket` keeps `port=12345`.
-    if (queryHost !== undefined && queryHost !== '') {
-        const hosts = queryHost.split(',').map((h) => h.trim());
-        const portList = queryPort !== undefined && queryPort !== ''
-            ? queryPort.split(',').map((p) => p.trim())
+    if (queryHost !== undefined && queryHost !== "") {
+        const hosts = queryHost.split(",").map((h) => h.trim());
+        const portList = queryPort !== undefined && queryPort !== ""
+            ? queryPort.split(",").map((p) => p.trim())
             : null;
         if (portList !== null &&
             portList.length !== 1 &&
@@ -790,8 +804,8 @@ const computeHostsTuples = (input) => {
     // Case B: authority carried a comma-list (`postgresql://h1,h2:5433/db`).
     // Query-string `?port=` can still broadcast or pair with this list.
     if (rawAuthorityHosts !== undefined && rawAuthorityHosts.length > 0) {
-        const portList = queryPort !== undefined && queryPort !== ''
-            ? queryPort.split(',').map((p) => p.trim())
+        const portList = queryPort !== undefined && queryPort !== ""
+            ? queryPort.split(",").map((p) => p.trim())
             : null;
         if (portList !== null &&
             portList.length !== 1 &&
@@ -809,11 +823,11 @@ const computeHostsTuples = (input) => {
     }
     // Case C: single-host. Honour `?port=` (single value) if provided.
     const portStr = queryPort ?? rawPort;
-    const host = rawHost !== undefined && rawHost !== '' ? rawHost : '';
+    const host = rawHost !== undefined && rawHost !== "" ? rawHost : "";
     return [{ host, port: parsePort(portStr) }];
 };
 const parsePort = (raw) => {
-    if (raw === undefined || raw === '')
+    if (raw === undefined || raw === "")
         return 5432;
     // `Number.parseInt` silently tolerates trailing junk (`parseInt("12345 12")`
     // === 12345), which would let an internal-whitespace value like the upstream
@@ -862,15 +876,15 @@ export const parseConninfo = (input) => {
             break;
         // Parse key: chars up to `=` or whitespace.
         const keyStart = i;
-        while (i < n && input[i] !== '=' && !/\s/.test(input[i]))
+        while (i < n && input[i] !== "=" && !/\s/.test(input[i]))
             i += 1;
         const key = input.slice(keyStart, i).toLowerCase();
-        if (key === '')
+        if (key === "")
             break;
         // Skip whitespace before `=`.
         while (i < n && /\s/.test(input[i]))
             i += 1;
-        if (i >= n || input[i] !== '=') {
+        if (i >= n || input[i] !== "=") {
             throw new Error(`missing "=" after "${key}" in conninfo string`);
         }
         i += 1; // consume `=`
@@ -884,7 +898,7 @@ export const parseConninfo = (input) => {
             i += 1; // consume opening quote
             const parts = [];
             while (i < n && input[i] !== "'") {
-                if (input[i] === '\\' && i + 1 < n) {
+                if (input[i] === "\\" && i + 1 < n) {
                     parts.push(input[i + 1]);
                     i += 2;
                 }
@@ -897,7 +911,7 @@ export const parseConninfo = (input) => {
                 throw new Error(`unterminated single quote in conninfo string for key "${key}"`);
             }
             i += 1; // consume closing quote
-            value = parts.join('');
+            value = parts.join("");
         }
         else {
             const valStart = i;
@@ -942,12 +956,12 @@ export const parseConninfo = (input) => {
 };
 const applyConninfoPair = (out, key, value) => {
     switch (key) {
-        case 'host': {
+        case "host": {
             // Multi-host: `host=h1,h2,h3`. Store the list aside; the post-pass
             // (finalizeConninfo) materialises it into `hosts` + matches up against
             // any `port=p1,p2,p3` list.
-            if (value.includes(',')) {
-                out._hostList = value.split(',').map((h) => h.trim());
+            if (value.includes(",")) {
+                out._hostList = value.split(",").map((h) => h.trim());
                 out.host = out._hostList[0];
             }
             else {
@@ -956,9 +970,9 @@ const applyConninfoPair = (out, key, value) => {
             }
             return;
         }
-        case 'port': {
-            if (value.includes(',')) {
-                out._portList = value.split(',').map((p) => p.trim());
+        case "port": {
+            if (value.includes(",")) {
+                out._portList = value.split(",").map((p) => p.trim());
                 // First port still goes into the scalar slot for back-compat.
                 out.port = parsePort(out._portList[0]);
             }
@@ -968,160 +982,161 @@ const applyConninfoPair = (out, key, value) => {
             }
             return;
         }
-        case 'user':
+        case "user":
             out.user = value;
             return;
-        case 'password':
+        case "password":
             out.password = value;
             return;
-        case 'dbname':
+        case "dbname":
             out.database = value;
             return;
-        case 'application_name':
+        case "application_name":
             out.applicationName = value;
             return;
-        case 'sslmode':
+        case "sslmode":
             out.ssl = normalizeSslMode(value);
             return;
-        case 'channel_binding': {
+        case "channel_binding": {
             const cb = normalizeChannelBinding(value);
             if (cb !== undefined)
                 out.channelBinding = cb;
             return;
         }
-        case 'require_auth': {
+        case "require_auth": {
             const ra = normalizeRequireAuth(value);
             if (ra !== undefined)
                 out.requireAuth = ra;
             return;
         }
-        case 'connect_timeout': {
+        case "connect_timeout": {
             const t = Number.parseInt(value, 10);
             if (Number.isFinite(t) && t >= 0) {
                 out.connectTimeoutMs = t * 1000;
             }
             return;
         }
-        case 'client_encoding':
+        case "client_encoding":
             out.clientEncoding = value;
             return;
-        case 'options':
+        case "options":
             out.options = value;
             return;
-        case 'replication': {
+        case "replication": {
             const rep = normalizeReplication(value);
             if (rep !== undefined)
                 out.replication = rep;
             return;
         }
-        case 'target_session_attrs': {
+        case "target_session_attrs": {
             const tsa = normalizeTargetSessionAttrs(value);
             if (tsa !== undefined)
                 out.targetSessionAttrs = tsa;
             return;
         }
-        case 'load_balance_hosts': {
+        case "load_balance_hosts": {
             const lbh = normalizeLoadBalanceHosts(value);
             if (lbh !== undefined)
                 out.loadBalanceHosts = lbh;
             return;
         }
-        case 'gssencmode':
+        case "gssencmode":
             // Unsupported (no GSSAPI); accept disable/prefer, reject require.
             validateGssEncMode(value);
             return;
-        case 'sslcert':
-            if (value !== '')
+        case "sslcert":
+            if (value !== "")
                 out.sslcert = value;
             return;
-        case 'sslkey':
-            if (value !== '')
+        case "sslkey":
+            if (value !== "")
                 out.sslkey = value;
             return;
-        case 'sslcertmode': {
+        case "sslcertmode": {
             const cm = normalizeSslCertMode(value);
             if (cm !== undefined)
                 out.sslcertmode = cm;
             return;
         }
-        case 'sslnegotiation': {
+        case "sslnegotiation": {
             const sn = normalizeSslNegotiation(value);
             if (sn !== undefined)
                 out.sslnegotiation = sn;
             return;
         }
-        case 'sslrootcert':
-            if (value !== '')
+        case "sslrootcert":
+            if (value !== "")
                 out.sslrootcert = value;
             return;
-        case 'sslcrl':
-            if (value !== '')
+        case "sslcrl":
+            if (value !== "")
                 out.sslcrl = value;
             return;
-        case 'sslcrldir':
-            if (value !== '')
+        case "sslcrldir":
+            if (value !== "")
                 out.sslcrldir = value;
             return;
-        case 'sslkeylogfile':
-            if (value !== '')
+        case "sslkeylogfile":
+            if (value !== "")
                 out.sslkeylogfile = value;
             return;
-        case 'hostaddr':
-            if (value !== '')
+        case "hostaddr":
+            if (value !== "")
                 out.hostaddr = value;
             return;
-        case 'ssl_min_protocol_version': {
-            const v = normalizeTlsProtocolVersion(value === '' ? undefined : value, 'ssl_min_protocol_version');
+        case "ssl_min_protocol_version": {
+            const v = normalizeTlsProtocolVersion(value === "" ? undefined : value, "ssl_min_protocol_version");
             if (v !== undefined)
                 out.sslMinProtocolVersion = v;
             return;
         }
-        case 'ssl_max_protocol_version': {
-            const v = normalizeTlsProtocolVersion(value === '' ? undefined : value, 'ssl_max_protocol_version');
+        case "ssl_max_protocol_version": {
+            const v = normalizeTlsProtocolVersion(value === "" ? undefined : value, "ssl_max_protocol_version");
             if (v !== undefined)
                 out.sslMaxProtocolVersion = v;
             return;
         }
-        case 'sslsni': {
+        case "sslsni": {
             const b = parseLibpqBool(value);
             if (b !== undefined)
                 out.sslsni = b;
             return;
         }
-        case 'keepalives': {
+        case "keepalives": {
             const b = parseLibpqBool(value);
             if (b !== undefined)
                 out.keepalives = b;
             return;
         }
-        case 'keepalives_idle': {
+        case "keepalives_idle": {
             const n = parseKeepalivesIdle(value);
             if (n !== undefined)
                 out.keepalivesIdle = n;
             return;
         }
-        case 'requirepeer':
-            if (value !== '')
+        case "requirepeer":
+            if (value !== "")
                 out.requirepeer = value;
             return;
         // Recognised libpq keys that we don't model — accept silently so we
         // don't reject legitimate connection strings. keepalives_interval /
         // keepalives_count have no Node net API equivalent (setKeepAlive only
         // exposes enable + initial delay) — recognised but cannot be applied.
-        case 'passfile':
-        case 'sslcompression':
-        case 'krbsrvname':
-        case 'gsslib':
-        case 'fallback_application_name':
-        case 'keepalives_interval':
-        case 'keepalives_count':
+        case "passfile":
+        case "sslcompression":
+        case "krbsrvname":
+        case "gsslib":
+        case "fallback_application_name":
+        case "keepalives_interval":
+        case "keepalives_count":
             return;
-        case 'service': {
+        case "service": {
             // Service name is NOT a ConnectOptions field — it's resolved by
             // the layered connect resolver in `core/startup.ts`. Stash it on
             // a private staging slot so the caller (`runPsql`) can extract it
             // alongside the URI-side `?service=…` parser.
-            out._service = value;
+            out._service =
+                value;
             return;
         }
         default:
@@ -1134,12 +1149,12 @@ const applyConninfoPair = (out, key, value) => {
  * `recognized_connection_string()` test.
  */
 export const looksLikeConnectionString = (s) => {
-    if (s.startsWith('postgresql://') || s.startsWith('postgres://'))
+    if (s.startsWith("postgresql://") || s.startsWith("postgres://"))
         return true;
     // A bare key=value pair (or several) — conninfo. We require the `=` to
     // appear before any whitespace so values like "weird name" (a bareword
     // database name with a space) don't get misclassified.
-    const eq = s.indexOf('=');
+    const eq = s.indexOf("=");
     if (eq < 0)
         return false;
     const head = s.slice(0, eq);
@@ -1152,15 +1167,15 @@ const normalizeSslMode = (raw) => {
     // downgrade. Mirrors libpq's `invalid sslmode value: "..."` and every
     // sibling validator (normalizeChannelBinding, normalizeSslCertMode, …).
     if (raw === null)
-        return 'prefer';
+        return "prefer";
     const value = raw.toLowerCase();
     switch (value) {
-        case 'disable':
-        case 'allow':
-        case 'prefer':
-        case 'require':
-        case 'verify-ca':
-        case 'verify-full':
+        case "disable":
+        case "allow":
+        case "prefer":
+        case "require":
+        case "verify-ca":
+        case "verify-full":
             return value;
         default:
             throw new Error(`invalid sslmode value: "${raw}"`);
@@ -1173,14 +1188,14 @@ const normalizeSslMode = (raw) => {
  * keep the canonical mixed-case spelling Node's `tls` module expects for
  * `minVersion` / `maxVersion`.
  */
-const TLS_PROTOCOL_VERSIONS = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3'];
+const TLS_PROTOCOL_VERSIONS = ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"];
 /**
  * Validate and canonicalise a `ssl_{min,max}_protocol_version` value. Returns
  * the canonical spelling (`TLSv1.2` etc.) or `undefined` for empty / unset.
  * Throws libpq's `invalid <key> value: "<raw>"` wording on a malformed value.
  */
 const normalizeTlsProtocolVersion = (raw, key) => {
-    if (raw === undefined || raw === '')
+    if (raw === undefined || raw === "")
         return undefined;
     const match = TLS_PROTOCOL_VERSIONS.find((v) => v.toLowerCase() === raw.toLowerCase());
     if (match === undefined) {
@@ -1201,7 +1216,7 @@ const normalizeTlsProtocolVersion = (raw, key) => {
  * libpq's ordering.
  */
 const assertTlsMaxProtocolSupported = (max) => {
-    if (max === 'TLSv1' || max === 'TLSv1.1') {
+    if (max === "TLSv1" || max === "TLSv1.1") {
         throw new Error(`ssl_max_protocol_version "${max}" is not supported by this ` +
             `runtime's TLS library — TLS 1.0/1.1 are disabled in Node's OpenSSL; ` +
             `the minimum negotiable version is TLSv1.2`);
@@ -1222,13 +1237,13 @@ const assertTlsProtocolRange = (min, max) => {
     }
 };
 const normalizeChannelBinding = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
     switch (value) {
-        case 'disable':
-        case 'prefer':
-        case 'require':
+        case "disable":
+        case "prefer":
+        case "require":
             return value;
         default:
             // Mirror libpq's `invalid channel_binding value: "<raw>"`
@@ -1255,13 +1270,13 @@ const normalizeChannelBinding = (raw) => {
  * working against Neon.
  */
 const validateGssEncMode = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return;
     const value = raw.toLowerCase();
-    if (value === 'disable' || value === 'prefer')
+    if (value === "disable" || value === "prefer")
         return;
-    if (value === 'require') {
-        throw new Error('gssencmode=require is not supported: this client has no GSSAPI support');
+    if (value === "require") {
+        throw new Error("gssencmode=require is not supported: this client has no GSSAPI support");
     }
     throw new Error(`invalid gssencmode value: "${raw}"`);
 };
@@ -1272,13 +1287,13 @@ const validateGssEncMode = (raw) => {
  * `invalid sslcertmode value: "<raw>"` diagnostic.
  */
 const normalizeSslCertMode = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
     switch (value) {
-        case 'disable':
-        case 'allow':
-        case 'require':
+        case "disable":
+        case "allow":
+        case "require":
             return value;
         default:
             throw new Error(`invalid sslcertmode value: "${raw}"`);
@@ -1291,12 +1306,12 @@ const normalizeSslCertMode = (raw) => {
  * `invalid sslnegotiation value: "<raw>"` diagnostic.
  */
 const normalizeSslNegotiation = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
     switch (value) {
-        case 'postgres':
-        case 'direct':
+        case "postgres":
+        case "direct":
             return value;
         default:
             throw new Error(`invalid sslnegotiation value: "${raw}"`);
@@ -1310,21 +1325,21 @@ const normalizeSslNegotiation = (raw) => {
  * exact `pqConnectOptions2` wording. No-op unless `sslnegotiation` is `direct`.
  */
 const assertSslNegotiationModeCompatible = (ssl, sslnegotiation) => {
-    if (sslnegotiation !== 'direct')
+    if (sslnegotiation !== "direct")
         return;
-    if (ssl === 'require' || ssl === 'verify-ca' || ssl === 'verify-full') {
+    if (ssl === "require" || ssl === "verify-ca" || ssl === "verify-full") {
         return;
     }
     throw new Error(`weak sslmode "${ssl}" may not be used with sslnegotiation=direct`);
 };
 const VALID_REQUIRE_AUTH_METHODS = new Set([
-    'password',
-    'md5',
-    'gss',
-    'sspi',
-    'scram-sha-256',
-    'creds',
-    'none',
+    "password",
+    "md5",
+    "gss",
+    "sspi",
+    "scram-sha-256",
+    "creds",
+    "none",
 ]);
 /**
  * Parse libpq's `require_auth` value: a comma-separated list of method
@@ -1336,10 +1351,10 @@ const VALID_REQUIRE_AUTH_METHODS = new Set([
  * outer `psql: error: ...` channel.
  */
 const normalizeRequireAuth = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const tokens = raw
-        .split(',')
+        .split(",")
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
     if (tokens.length === 0)
@@ -1347,7 +1362,7 @@ const normalizeRequireAuth = (raw) => {
     const methods = new Set();
     let polarity = null;
     for (const token of tokens) {
-        const isNeg = token.startsWith('!');
+        const isNeg = token.startsWith("!");
         const name = (isNeg ? token.slice(1) : token).toLowerCase();
         if (!VALID_REQUIRE_AUTH_METHODS.has(name)) {
             throw new Error(`invalid require_auth method: "${token}"`);
@@ -1358,7 +1373,7 @@ const normalizeRequireAuth = (raw) => {
         else if (polarity !== isNeg) {
             // libpq wording: "negative require_auth method ... cannot be mixed
             // with non-negative methods". We use a slightly shorter form here.
-            throw new Error('require_auth methods cannot mix positive and negative entries');
+            throw new Error("require_auth methods cannot mix positive and negative entries");
         }
         methods.add(name);
     }
@@ -1372,16 +1387,16 @@ const normalizeRequireAuth = (raw) => {
  * applies. Throws on unrecognised values, matching libpq behaviour.
  */
 const normalizeTargetSessionAttrs = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
     switch (value) {
-        case 'any':
-        case 'read-write':
-        case 'read-only':
-        case 'primary':
-        case 'standby':
-        case 'prefer-standby':
+        case "any":
+        case "read-write":
+        case "read-only":
+        case "primary":
+        case "standby":
+        case "prefer-standby":
             return value;
         default:
             throw new Error(`invalid value for "target_session_attrs": "${raw}"`);
@@ -1396,10 +1411,10 @@ const normalizeTargetSessionAttrs = (raw) => {
  * default ('disable') applies.
  */
 const normalizeLoadBalanceHosts = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
-    if (value === 'disable' || value === 'random')
+    if (value === "disable" || value === "random")
         return value;
     throw new Error(`invalid value for "load_balance_hosts": "${raw}"`);
 };
@@ -1415,15 +1430,21 @@ const normalizeLoadBalanceHosts = (raw) => {
  * silently sending an unexpected startup-message parameter).
  */
 const normalizeReplication = (raw) => {
-    if (raw === null || raw === '')
+    if (raw === null || raw === "")
         return undefined;
     const value = raw.toLowerCase();
-    if (value === 'database')
-        return 'database';
-    if (value === 'true' || value === 'on' || value === 'yes' || value === '1') {
-        return 'true';
-    }
-    if (value === 'false' || value === 'off' || value === 'no' || value === '0') {
+    if (value === "database")
+        return "database";
+    if (value === "true" ||
+        value === "on" ||
+        value === "yes" ||
+        value === "1") {
+        return "true";
+    }
+    if (value === "false" ||
+        value === "off" ||
+        value === "no" ||
+        value === "0") {
         return undefined;
     }
     throw new Error(`invalid value for "replication": "${raw}"`);
@@ -1455,8 +1476,8 @@ const normalizeReplication = (raw) => {
  */
 export const parseConnectionUriService = (uri) => {
     const raw = tokenizeConnectionUri(uri);
-    const value = raw.query.get('service');
-    return value === undefined || value === '' ? undefined : value;
+    const value = raw.query.get("service");
+    return value === undefined || value === "" ? undefined : value;
 };
 /**
  * Parse a URI into a `Partial<ConnectOptions>` containing only the fields
@@ -1475,11 +1496,11 @@ export const parseConnectionUriService = (uri) => {
  */
 export const parseConnectionUriPartial = (uri) => {
     const raw = tokenizeConnectionUri(uri);
-    const queryUser = raw.query.get('user');
-    const queryPassword = raw.query.get('password');
-    const queryPort = raw.query.get('port');
-    const queryDbname = raw.query.get('dbname');
-    const queryHost = raw.query.get('host');
+    const queryUser = raw.query.get("user");
+    const queryPassword = raw.query.get("password");
+    const queryPort = raw.query.get("port");
+    const queryDbname = raw.query.get("dbname");
+    const queryHost = raw.query.get("host");
     // Multi-host: same resolution as the full parser, but we treat its absence
     // as "URI didn't say anything about hosts" rather than synthesising a
     // localhost default.
@@ -1497,26 +1518,30 @@ export const parseConnectionUriPartial = (uri) => {
     // about a port" so the service-file's port wins when we layer this
     // partial above the service layer. Mirrors libpq's behaviour for
     // `006_service.pl`'s `postgres:///?service=…` cases.
-    const portInUri = (raw.port !== undefined && raw.port !== '') ||
-        (queryPort !== undefined && queryPort !== '') ||
-        (raw.hosts?.some((t) => t.port !== undefined && t.port !== '') ?? false);
+    const portInUri = (raw.port !== undefined && raw.port !== "") ||
+        (queryPort !== undefined && queryPort !== "") ||
+        (raw.hosts?.some((t) => t.port !== undefined && t.port !== "") ??
+            false);
     const out = {};
     if (hostsTuples.length > 0) {
         // First tuple drives the single-host surface; the full multi-host list
         // is included only when the URI specified more than one. An empty-host
         // tuple (e.g. `postgres://:12345/`) means "explicit port, no host" —
         // we record the port but leave host to the next layer.
-        if (hostsTuples[0].host !== '')
+        if (hostsTuples[0].host !== "")
             out.host = hostsTuples[0].host;
         if (portInUri && hostsTuples[0].port !== 0)
             out.port = hostsTuples[0].port;
         if (hostsTuples.length > 1) {
-            out.hosts = hostsTuples.map((t) => ({ host: t.host, port: t.port }));
+            out.hosts = hostsTuples.map((t) => ({
+                host: t.host,
+                port: t.port,
+            }));
         }
     }
-    const userExplicit = queryUser !== undefined && queryUser !== ''
+    const userExplicit = queryUser !== undefined && queryUser !== ""
         ? queryUser
-        : raw.user !== undefined && raw.user !== ''
+        : raw.user !== undefined && raw.user !== ""
             ? raw.user
             : undefined;
     if (userExplicit !== undefined)
@@ -1527,87 +1552,87 @@ export const parseConnectionUriPartial = (uri) => {
     const database = queryDbname ?? raw.database;
     if (database !== undefined)
         out.database = database;
-    const sslRaw = raw.query.get('sslmode');
-    if (sslRaw !== undefined && sslRaw !== '') {
+    const sslRaw = raw.query.get("sslmode");
+    if (sslRaw !== undefined && sslRaw !== "") {
         out.ssl = normalizeSslMode(sslRaw);
     }
-    const cb = normalizeChannelBinding(raw.query.get('channel_binding') ?? null);
+    const cb = normalizeChannelBinding(raw.query.get("channel_binding") ?? null);
     if (cb !== undefined)
         out.channelBinding = cb;
-    const ra = normalizeRequireAuth(raw.query.get('require_auth') ?? null);
+    const ra = normalizeRequireAuth(raw.query.get("require_auth") ?? null);
     if (ra !== undefined)
         out.requireAuth = ra;
-    const options = raw.query.get('options');
-    if (options !== undefined && options !== '')
+    const options = raw.query.get("options");
+    if (options !== undefined && options !== "")
         out.options = options;
-    const appName = raw.query.get('application_name');
-    if (appName !== undefined && appName !== '')
+    const appName = raw.query.get("application_name");
+    if (appName !== undefined && appName !== "")
         out.applicationName = appName;
-    const replication = normalizeReplication(raw.query.get('replication') ?? null);
+    const replication = normalizeReplication(raw.query.get("replication") ?? null);
     if (replication !== undefined)
         out.replication = replication;
-    const targetSessionAttrs = normalizeTargetSessionAttrs(raw.query.get('target_session_attrs') ?? null);
+    const targetSessionAttrs = normalizeTargetSessionAttrs(raw.query.get("target_session_attrs") ?? null);
     if (targetSessionAttrs !== undefined) {
         out.targetSessionAttrs = targetSessionAttrs;
     }
-    const loadBalanceHosts = normalizeLoadBalanceHosts(raw.query.get('load_balance_hosts') ?? null);
+    const loadBalanceHosts = normalizeLoadBalanceHosts(raw.query.get("load_balance_hosts") ?? null);
     if (loadBalanceHosts !== undefined)
         out.loadBalanceHosts = loadBalanceHosts;
-    const sslcert = nonEmpty(raw.query.get('sslcert'));
+    const sslcert = nonEmpty(raw.query.get("sslcert"));
     if (sslcert !== undefined)
         out.sslcert = sslcert;
-    const sslkey = nonEmpty(raw.query.get('sslkey'));
+    const sslkey = nonEmpty(raw.query.get("sslkey"));
     if (sslkey !== undefined)
         out.sslkey = sslkey;
-    const sslcertmode = normalizeSslCertMode(raw.query.get('sslcertmode') ?? null);
+    const sslcertmode = normalizeSslCertMode(raw.query.get("sslcertmode") ?? null);
     if (sslcertmode !== undefined)
         out.sslcertmode = sslcertmode;
-    const sslnegotiation = normalizeSslNegotiation(raw.query.get('sslnegotiation') ?? null);
+    const sslnegotiation = normalizeSslNegotiation(raw.query.get("sslnegotiation") ?? null);
     if (sslnegotiation !== undefined)
         out.sslnegotiation = sslnegotiation;
-    const sslrootcert = nonEmpty(raw.query.get('sslrootcert'));
+    const sslrootcert = nonEmpty(raw.query.get("sslrootcert"));
     if (sslrootcert !== undefined)
         out.sslrootcert = sslrootcert;
-    const sslcrl = nonEmpty(raw.query.get('sslcrl'));
+    const sslcrl = nonEmpty(raw.query.get("sslcrl"));
     if (sslcrl !== undefined)
         out.sslcrl = sslcrl;
-    const sslcrldir = nonEmpty(raw.query.get('sslcrldir'));
+    const sslcrldir = nonEmpty(raw.query.get("sslcrldir"));
     if (sslcrldir !== undefined)
         out.sslcrldir = sslcrldir;
-    const sslkeylogfile = nonEmpty(raw.query.get('sslkeylogfile'));
+    const sslkeylogfile = nonEmpty(raw.query.get("sslkeylogfile"));
     if (sslkeylogfile !== undefined)
         out.sslkeylogfile = sslkeylogfile;
-    const sslsni = parseLibpqBool(nonEmpty(raw.query.get('sslsni')));
+    const sslsni = parseLibpqBool(nonEmpty(raw.query.get("sslsni")));
     if (sslsni !== undefined)
         out.sslsni = sslsni;
-    const keepalives = parseLibpqBool(nonEmpty(raw.query.get('keepalives')));
+    const keepalives = parseLibpqBool(nonEmpty(raw.query.get("keepalives")));
     if (keepalives !== undefined)
         out.keepalives = keepalives;
-    const keepalivesIdle = parseKeepalivesIdle(nonEmpty(raw.query.get('keepalives_idle')));
+    const keepalivesIdle = parseKeepalivesIdle(nonEmpty(raw.query.get("keepalives_idle")));
     if (keepalivesIdle !== undefined)
         out.keepalivesIdle = keepalivesIdle;
-    const requirepeer = nonEmpty(raw.query.get('requirepeer'));
+    const requirepeer = nonEmpty(raw.query.get("requirepeer"));
     if (requirepeer !== undefined)
         out.requirepeer = requirepeer;
-    const hostaddr = nonEmpty(raw.query.get('hostaddr'));
+    const hostaddr = nonEmpty(raw.query.get("hostaddr"));
     if (hostaddr !== undefined)
         out.hostaddr = hostaddr;
-    const sslMin = normalizeTlsProtocolVersion(nonEmpty(raw.query.get('ssl_min_protocol_version')), 'ssl_min_protocol_version');
+    const sslMin = normalizeTlsProtocolVersion(nonEmpty(raw.query.get("ssl_min_protocol_version")), "ssl_min_protocol_version");
     if (sslMin !== undefined)
         out.sslMinProtocolVersion = sslMin;
-    const sslMax = normalizeTlsProtocolVersion(nonEmpty(raw.query.get('ssl_max_protocol_version')), 'ssl_max_protocol_version');
+    const sslMax = normalizeTlsProtocolVersion(nonEmpty(raw.query.get("ssl_max_protocol_version")), "ssl_max_protocol_version");
     if (sslMax !== undefined)
         out.sslMaxProtocolVersion = sslMax;
     assertTlsProtocolRange(out.sslMinProtocolVersion, out.sslMaxProtocolVersion);
     assertTlsMaxProtocolSupported(out.sslMaxProtocolVersion);
-    const connectTimeoutSec = raw.query.get('connect_timeout');
-    if (connectTimeoutSec !== undefined && connectTimeoutSec !== '') {
+    const connectTimeoutSec = raw.query.get("connect_timeout");
+    if (connectTimeoutSec !== undefined && connectTimeoutSec !== "") {
         const t = Number.parseInt(connectTimeoutSec, 10);
         if (Number.isFinite(t) && t >= 0)
             out.connectTimeoutMs = t * 1000;
     }
-    const clientEncoding = raw.query.get('client_encoding');
-    if (clientEncoding !== undefined && clientEncoding !== '') {
+    const clientEncoding = raw.query.get("client_encoding");
+    if (clientEncoding !== undefined && clientEncoding !== "") {
         out.clientEncoding = clientEncoding;
     }
     return out;
@@ -1615,25 +1640,25 @@ export const parseConnectionUriPartial = (uri) => {
 // Field map for PG* env vars. Order in the table is documentation; resolution
 // only depends on whether the var is set.
 const PG_ENV_FIELD_MAP = {
-    PGHOST: 'host',
-    PGHOSTADDR: 'hostaddr',
-    PGPORT: 'port',
-    PGUSER: 'user',
-    PGDATABASE: 'database',
-    PGPASSWORD: 'password',
-    PGAPPNAME: 'applicationName',
-    PGOPTIONS: 'options',
-    PGCLIENTENCODING: 'clientEncoding',
-    PGSSLMODE: 'ssl',
-    PGSSLROOTCERT: 'sslrootcert',
-    PGSSLCERT: 'sslcert',
-    PGSSLKEY: 'sslkey',
-    PGSSLCERTMODE: 'sslcertmode',
-    PGSSLNEGOTIATION: 'sslnegotiation',
-    PGSSLCRL: 'sslcrl',
-    PGSSLCRLDIR: 'sslcrldir',
-    PGSSLKEYLOGFILE: 'sslkeylogfile',
-    PGCHANNELBINDING: 'channelBinding',
+    PGHOST: "host",
+    PGHOSTADDR: "hostaddr",
+    PGPORT: "port",
+    PGUSER: "user",
+    PGDATABASE: "database",
+    PGPASSWORD: "password",
+    PGAPPNAME: "applicationName",
+    PGOPTIONS: "options",
+    PGCLIENTENCODING: "clientEncoding",
+    PGSSLMODE: "ssl",
+    PGSSLROOTCERT: "sslrootcert",
+    PGSSLCERT: "sslcert",
+    PGSSLKEY: "sslkey",
+    PGSSLCERTMODE: "sslcertmode",
+    PGSSLNEGOTIATION: "sslnegotiation",
+    PGSSLCRL: "sslcrl",
+    PGSSLCRLDIR: "sslcrldir",
+    PGSSLKEYLOGFILE: "sslkeylogfile",
+    PGCHANNELBINDING: "channelBinding",
 };
 /**
  * Resolve the PG* env vars into a `Partial<ConnectOptions>`. Only set keys
@@ -1660,7 +1685,7 @@ export const envConnectionDefaults = (env) => {
     const out = {};
     const get = (k) => {
         const v = env[k];
-        return v !== undefined && v !== '' ? v : undefined;
+        return v !== undefined && v !== "" ? v : undefined;
     };
     for (const [envName, field] of Object.entries(PG_ENV_FIELD_MAP)) {
         const value = get(envName);
@@ -1668,7 +1693,7 @@ export const envConnectionDefaults = (env) => {
             continue;
         applyEnvValue(out, field, value);
     }
-    const timeoutRaw = get('PGCONNECT_TIMEOUT');
+    const timeoutRaw = get("PGCONNECT_TIMEOUT");
     if (timeoutRaw !== undefined) {
         const t = Number.parseInt(timeoutRaw, 10);
         if (Number.isFinite(t) && t >= 0)
@@ -1676,75 +1701,75 @@ export const envConnectionDefaults = (env) => {
     }
     // GSSAPI is unsupported; PGGSSENCMODE=require is rejected, disable/prefer
     // accepted-and-ignored. Same contract as the URI/conninfo `gssencmode`.
-    validateGssEncMode(get('PGGSSENCMODE') ?? null);
+    validateGssEncMode(get("PGGSSENCMODE") ?? null);
     return out;
 };
 const applyEnvValue = (out, field, value) => {
     switch (field) {
-        case 'host':
+        case "host":
             out.host = value;
             return;
-        case 'port': {
+        case "port": {
             const p = Number.parseInt(value, 10);
             if (Number.isFinite(p) && p > 0 && p <= 65535)
                 out.port = p;
             return;
         }
-        case 'user':
+        case "user":
             out.user = value;
             return;
-        case 'database':
+        case "database":
             out.database = value;
             return;
-        case 'password':
+        case "password":
             out.password = value;
             return;
-        case 'applicationName':
+        case "applicationName":
             out.applicationName = value;
             return;
-        case 'options':
+        case "options":
             out.options = value;
             return;
-        case 'clientEncoding':
+        case "clientEncoding":
             out.clientEncoding = value;
             return;
-        case 'ssl':
+        case "ssl":
             out.ssl = normalizeSslMode(value);
             return;
-        case 'sslrootcert':
+        case "sslrootcert":
             out.sslrootcert = value;
             return;
-        case 'sslcert':
+        case "sslcert":
             out.sslcert = value;
             return;
-        case 'sslkey':
+        case "sslkey":
             out.sslkey = value;
             return;
-        case 'sslcertmode': {
+        case "sslcertmode": {
             const cm = normalizeSslCertMode(value);
             if (cm !== undefined)
                 out.sslcertmode = cm;
             return;
         }
-        case 'sslnegotiation': {
+        case "sslnegotiation": {
             const sn = normalizeSslNegotiation(value);
             if (sn !== undefined)
                 out.sslnegotiation = sn;
             return;
         }
-        case 'sslcrl':
+        case "sslcrl":
             out.sslcrl = value;
             return;
-        case 'sslcrldir':
+        case "sslcrldir":
             out.sslcrldir = value;
             return;
-        case 'sslkeylogfile':
+        case "sslkeylogfile":
             out.sslkeylogfile = value;
             return;
-        case 'hostaddr':
+        case "hostaddr":
             out.hostaddr = value;
             return;
-        case 'channelBinding': {
+        case "channelBinding": {
             const cb = normalizeChannelBinding(value);
             if (cb !== undefined)
                 out.channelBinding = cb;
@@ -1778,12 +1803,12 @@ const applyEnvValue = (out, field, value) => {
  *     surfaces an error (at TLS-load time, in the wire layer).
  */
 export const libpqConnectionDefaults = (env) => ({
-    host: 'localhost',
+    host: "localhost",
     port: 5432,
-    user: env.USER ?? '',
-    database: '',
-    ssl: 'prefer',
-    applicationName: 'psql',
+    user: env.USER ?? "",
+    database: "",
+    ssl: "prefer",
+    applicationName: "psql",
     ...defaultClientCertDefaults(env),
 });
 /**
@@ -1802,13 +1827,13 @@ export const libpqConnectionDefaults = (env) => ({
  */
 export const defaultClientCertDefaults = (env) => {
     const home = env.HOME ?? os.homedir();
-    if (home === undefined || home === '')
+    if (home === undefined || home === "")
         return {};
     const out = {};
-    const certPath = path.join(home, '.postgresql', 'postgresql.crt');
+    const certPath = path.join(home, ".postgresql", "postgresql.crt");
     if (existsSync(certPath))
         out.sslcert = certPath;
-    const keyPath = path.join(home, '.postgresql', 'postgresql.key');
+    const keyPath = path.join(home, ".postgresql", "postgresql.key");
     if (existsSync(keyPath))
         out.sslkey = keyPath;
     return out;
@@ -1827,130 +1852,130 @@ export const serviceEntryToConnectOptions = (entry) => {
     for (const [k, v] of Object.entries(entry)) {
         const key = k.toLowerCase();
         switch (key) {
-            case 'host':
-                if (v !== '')
+            case "host":
+                if (v !== "")
                     out.host = v;
                 break;
-            case 'port': {
+            case "port": {
                 const p = Number.parseInt(v, 10);
                 if (Number.isFinite(p) && p > 0 && p <= 65535)
                     out.port = p;
                 break;
             }
-            case 'user':
-                if (v !== '')
+            case "user":
+                if (v !== "")
                     out.user = v;
                 break;
-            case 'dbname':
-                if (v !== '')
+            case "dbname":
+                if (v !== "")
                     out.database = v;
                 break;
-            case 'password':
+            case "password":
                 out.password = v;
                 break;
-            case 'application_name':
-                if (v !== '')
+            case "application_name":
+                if (v !== "")
                     out.applicationName = v;
                 break;
-            case 'sslmode':
-                if (v !== '')
+            case "sslmode":
+                if (v !== "")
                     out.ssl = normalizeSslMode(v);
                 break;
-            case 'channel_binding': {
+            case "channel_binding": {
                 const cb = normalizeChannelBinding(v);
                 if (cb !== undefined)
                     out.channelBinding = cb;
                 break;
             }
-            case 'require_auth': {
+            case "require_auth": {
                 const ra = normalizeRequireAuth(v);
                 if (ra !== undefined)
                     out.requireAuth = ra;
                 break;
             }
-            case 'options':
-                if (v !== '')
+            case "options":
+                if (v !== "")
                     out.options = v;
                 break;
-            case 'client_encoding':
-                if (v !== '')
+            case "client_encoding":
+                if (v !== "")
                     out.clientEncoding = v;
                 break;
-            case 'sslcert':
-                if (v !== '')
+            case "sslcert":
+                if (v !== "")
                     out.sslcert = v;
                 break;
-            case 'sslkey':
-                if (v !== '')
+            case "sslkey":
+                if (v !== "")
                     out.sslkey = v;
                 break;
-            case 'sslcertmode': {
+            case "sslcertmode": {
                 const cm = normalizeSslCertMode(v);
                 if (cm !== undefined)
                     out.sslcertmode = cm;
                 break;
             }
-            case 'sslnegotiation': {
+            case "sslnegotiation": {
                 const sn = normalizeSslNegotiation(v);
                 if (sn !== undefined)
                     out.sslnegotiation = sn;
                 break;
             }
-            case 'sslrootcert':
-                if (v !== '')
+            case "sslrootcert":
+                if (v !== "")
                     out.sslrootcert = v;
                 break;
-            case 'sslcrl':
-                if (v !== '')
+            case "sslcrl":
+                if (v !== "")
                     out.sslcrl = v;
                 break;
-            case 'sslcrldir':
-                if (v !== '')
+            case "sslcrldir":
+                if (v !== "")
                     out.sslcrldir = v;
                 break;
-            case 'sslkeylogfile':
-                if (v !== '')
+            case "sslkeylogfile":
+                if (v !== "")
                     out.sslkeylogfile = v;
                 break;
-            case 'sslsni': {
+            case "sslsni": {
                 const b = parseLibpqBool(v);
                 if (b !== undefined)
                     out.sslsni = b;
                 break;
             }
-            case 'keepalives': {
+            case "keepalives": {
                 const b = parseLibpqBool(v);
                 if (b !== undefined)
                     out.keepalives = b;
                 break;
             }
-            case 'keepalives_idle': {
+            case "keepalives_idle": {
                 const n = parseKeepalivesIdle(v);
                 if (n !== undefined)
                     out.keepalivesIdle = n;
                 break;
             }
-            case 'requirepeer':
-                if (v !== '')
+            case "requirepeer":
+                if (v !== "")
                     out.requirepeer = v;
                 break;
-            case 'hostaddr':
-                if (v !== '')
+            case "hostaddr":
+                if (v !== "")
                     out.hostaddr = v;
                 break;
-            case 'ssl_min_protocol_version': {
-                const pv = normalizeTlsProtocolVersion(v === '' ? undefined : v, 'ssl_min_protocol_version');
+            case "ssl_min_protocol_version": {
+                const pv = normalizeTlsProtocolVersion(v === "" ? undefined : v, "ssl_min_protocol_version");
                 if (pv !== undefined)
                     out.sslMinProtocolVersion = pv;
                 break;
             }
-            case 'ssl_max_protocol_version': {
-                const pv = normalizeTlsProtocolVersion(v === '' ? undefined : v, 'ssl_max_protocol_version');
+            case "ssl_max_protocol_version": {
+                const pv = normalizeTlsProtocolVersion(v === "" ? undefined : v, "ssl_max_protocol_version");
                 if (pv !== undefined)
                     out.sslMaxProtocolVersion = pv;
                 break;
             }
-            case 'connect_timeout': {
+            case "connect_timeout": {
                 const t = Number.parseInt(v, 10);
                 if (Number.isFinite(t) && t >= 0)
                     out.connectTimeoutMs = t * 1000;
@@ -1987,15 +2012,15 @@ export const mergeConnectOptions = (layers, defaults) => {
     // libpq: database defaults to the resolved user when no layer set it.
     // The default `database: ''` from `libpqConnectionDefaults` is the
     // sentinel for "nothing supplied".
-    if (out.database === '') {
+    if (out.database === "") {
         out.database = out.user;
     }
     // libpq: `sslrootcert=system` raises the effective sslmode to verify-full
     // (it makes no sense to trust the public CA store without verifying the
     // chain AND the hostname). verify-full is the strongest mode, so this can
     // only ever raise — never downgrade — an explicitly requested mode.
-    if (out.sslrootcert === 'system' && out.ssl !== 'verify-full') {
-        out.ssl = 'verify-full';
+    if (out.sslrootcert === "system" && out.ssl !== "verify-full") {
+        out.ssl = "verify-full";
     }
     // libpq validates `sslnegotiation=direct` against the FINAL sslmode (after
     // any `sslrootcert=system` raise and cross-layer merge), rejecting a weak