planche 0.5.3 → 0.6.0

package/dist/index.js

@@ -6,421 +6,9 @@ import { createRequire } from "module";
 import { spawn } from "child_process";
 import { parseArgs } from "util";
 
-// src/server.ts
-import express from "express";
-import { createHash as createHash2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-
-// ../shared/contract.ts
-var PROTOCOL_VERSION = 2;
-
-// src/ssh-tunnel.ts
-import { createServer } from "net";
-import { mkdir, readFile as readFile2, appendFile } from "fs/promises";
-import { createHash, createHmac, timingSafeEqual } from "crypto";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join2 } from "path";
-import { Client } from "ssh2";
-
-// src/ssh-config.ts
-import { readFile, readdir } from "fs/promises";
-import { homedir } from "os";
-import { dirname, isAbsolute, join, basename } from "path";
-var SSH_CONFIG_DISABLED = process.env.PLANCHE_SSH_CONFIG === "none";
-var DEFAULT_SSH_CONFIG = SSH_CONFIG_DISABLED ? "" : process.env.PLANCHE_SSH_CONFIG || join(homedir(), ".ssh", "config");
-var DEFAULT_IDENTITY_FILES = ["id_ed25519", "id_ecdsa", "id_rsa", "id_ed25519_sk", "id_ecdsa_sk"].map(
-  (f) => join(homedir(), ".ssh", f)
-);
-function expandHome(path) {
-  return path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path;
-}
-function globToRegExp(pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
-  return new RegExp(`^${escaped}$`, "i");
-}
-function hostPatternMatches(patterns, host) {
-  let matched = false;
-  for (const raw of patterns) {
-    const negated = raw.startsWith("!");
-    const pattern = negated ? raw.slice(1) : raw;
-    if (!globToRegExp(pattern).test(host)) continue;
-    if (negated) return false;
-    matched = true;
-  }
-  return matched;
-}
-function tokenize(line) {
-  const tokens = [];
-  const re = /"([^"]*)"|(\S+)/g;
-  let m;
-  while (m = re.exec(line)) tokens.push(m[1] ?? m[2]);
-  return tokens;
-}
-function parseLine(line) {
-  const trimmed = line.trim();
-  if (!trimmed || trimmed.startsWith("#")) return void 0;
-  const eq = trimmed.match(/^([A-Za-z]+)\s*=\s*(.*)$/);
-  const [keyword, rest] = eq ? [eq[1], eq[2]] : [trimmed.split(/\s+/, 1)[0], trimmed.slice(trimmed.split(/\s+/, 1)[0].length)];
-  return { keyword: keyword.toLowerCase(), args: tokenize(rest) };
-}
-async function expandGlob(path) {
-  const base = basename(path);
-  if (!/[*?]/.test(base)) return [path];
-  const dir = dirname(path);
-  try {
-    const re = globToRegExp(base);
-    return (await readdir(dir)).filter((name) => re.test(name)).sort().map((name) => join(dir, name));
-  } catch {
-    return [];
-  }
-}
-async function loadLines(file, seen) {
-  if (seen.has(file)) return [];
-  seen.add(file);
-  try {
-    return (await readFile(file, "utf8")).split(/\r?\n/);
-  } catch {
-    return [];
-  }
-}
-async function resolveSshHost(host, file = DEFAULT_SSH_CONFIG) {
-  const result = { identityFiles: [] };
-  if (!file) return result;
-  const seen = /* @__PURE__ */ new Set();
-  async function walk(path, active) {
-    let blockActive = active;
-    for (const line of await loadLines(path, seen)) {
-      const d = parseLine(line);
-      if (!d) continue;
-      switch (d.keyword) {
-        case "host":
-          blockActive = hostPatternMatches(d.args, host);
-          continue;
-        case "match":
-          blockActive = d.args.length === 1 && d.args[0].toLowerCase() === "all";
-          continue;
-        case "include":
-          for (const inc of d.args) {
-            const target = expandHome(inc);
-            const abs = isAbsolute(target) ? target : join(homedir(), ".ssh", target);
-            for (const expanded of await expandGlob(abs)) await walk(expanded, blockActive);
-          }
-          continue;
-      }
-      if (!blockActive) continue;
-      const value = d.args[0];
-      if (value === void 0) continue;
-      switch (d.keyword) {
-        case "hostname":
-          result.hostName ??= value.replace(/%h/g, host);
-          break;
-        case "port":
-          result.port ??= Number(value) || void 0;
-          break;
-        case "user":
-          result.user ??= value;
-          break;
-        case "identityfile":
-          for (const f of d.args) {
-            const expanded = expandHome(f.replace(/%d/g, homedir()).replace(/%h/g, host));
-            if (expanded.split(/[\\/]/).includes("..")) continue;
-            result.identityFiles.push(expanded);
-          }
-          break;
-        case "identityagent":
-          result.identityAgent ??= value === "none" ? void 0 : expandHome(value.replace(/%d/g, homedir()));
-          break;
-        case "proxyjump":
-          result.proxyJump ??= value;
-          break;
-      }
-    }
-  }
-  await walk(file, true);
-  return result;
-}
-
-// src/ssh-tunnel.ts
-var TunnelError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "TunnelError";
-  }
-  status;
-};
-var HostKeyError = class extends TunnelError {
-  hostKey;
-  constructor(host, port, type, fingerprint2) {
-    super(`The SSH host key of ${host}:${port} is not known yet (${type} ${fingerprint2}). Verify the fingerprint and accept it to continue.`, 409);
-    this.name = "HostKeyError";
-    this.hostKey = { host, port, type, fingerprint: fingerprint2 };
-  }
-};
-var CONNECT_TIMEOUT_MS = 2e4;
-var PLANCHE_DIR = join2(homedir2(), ".planche");
-var PLANCHE_KNOWN_HOSTS = join2(PLANCHE_DIR, "known_hosts");
-var OPENSSH_KNOWN_HOSTS = join2(homedir2(), ".ssh", "known_hosts");
-function parseSshConfig(value) {
-  if (value === void 0 || value === null) return void 0;
-  if (typeof value !== "object") throw new TunnelError("ssh must be an object", 400);
-  const body = value;
-  const host = typeof body.host === "string" ? body.host.trim() : "";
-  const user = typeof body.user === "string" ? body.user.trim() : "";
-  const auth = body.auth;
-  if (!host) throw new TunnelError("ssh.host is required", 400);
-  if (host.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(host) || /^[.-]+$/.test(host)) throw new TunnelError("ssh.host is not a valid host name", 400);
-  if (user.length > 64 || /[\s\x00-\x1f]/.test(user)) throw new TunnelError("ssh.user is not valid", 400);
-  const port = Math.trunc(Number(body.port)) || 22;
-  if (port < 1 || port > 65535) throw new TunnelError("ssh.port must be between 1 and 65535", 400);
-  if (auth !== "password" && auth !== "key" && auth !== "agent") {
-    throw new TunnelError("ssh.auth must be one of password, key, agent", 400);
-  }
-  const str = (v) => typeof v === "string" && v ? v : void 0;
-  const config = {
-    host,
-    port,
-    user,
-    auth,
-    password: auth === "password" ? str(body.password) ?? "" : void 0,
-    privateKey: auth === "key" ? str(body.privateKey) : void 0,
-    passphrase: auth === "key" ? str(body.passphrase) : void 0,
-    acceptHostKey: typeof body.acceptHostKey === "string" && /^SHA256:[A-Za-z0-9+/]{43}$/.test(body.acceptHostKey) ? body.acceptHostKey : void 0
-  };
-  return config;
-}
-function keyType(blob) {
-  if (blob.length < 4) throw new TunnelError("Malformed host key", 400);
-  const len = blob.readUInt32BE(0);
-  if (len <= 0 || len > 64 || blob.length < 4 + len) throw new TunnelError("Malformed host key", 400);
-  const type = blob.subarray(4, 4 + len).toString("ascii");
-  if (!/^[A-Za-z0-9@.-]+$/.test(type)) throw new TunnelError("Malformed host key", 400);
-  return type;
-}
-function knownHostsEntryMatches(field, patterns) {
-  if (field.startsWith("|1|")) {
-    const [, , salt, hash] = field.split("|");
-    if (!salt || !hash) return false;
-    const key = Buffer.from(salt, "base64");
-    const want = Buffer.from(hash, "base64");
-    return patterns.some((p) => {
-      const got = createHmac("sha1", key).update(p).digest();
-      return got.length === want.length && timingSafeEqual(got, want);
-    });
-  }
-  const entries = field.toLowerCase().split(",");
-  return patterns.some((p) => hostPatternMatches(entries, p));
-}
-function hostPatterns(host, port) {
-  const h = host.toLowerCase();
-  return port === 22 ? [h, `[${h}]:22`] : [`[${h}]:${port}`];
-}
-async function readKnownHosts(file) {
-  try {
-    return (await readFile2(file, "utf8")).split(/\r?\n/);
-  } catch {
-    return [];
-  }
-}
-async function lookupHostKey(host, port, blob) {
-  const patterns = hostPatterns(host, port);
-  const type = keyType(blob);
-  const encoded = blob.toString("base64");
-  let sawHost = false;
-  const lines = [...await readKnownHosts(OPENSSH_KNOWN_HOSTS), ...await readKnownHosts(PLANCHE_KNOWN_HOSTS)];
-  for (const raw of lines) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const fields = line.split(/\s+/);
-    const marker = fields[0].startsWith("@") ? fields.shift() : void 0;
-    const [hosts, lineType, lineKey] = fields;
-    if (!hosts || !lineType || !lineKey) continue;
-    if (!knownHostsEntryMatches(hosts, patterns)) continue;
-    if (marker === "@revoked") {
-      if (lineType === type && lineKey === encoded) throw new TunnelError(`The host key of ${host}:${port} is marked @revoked in known_hosts`, 400);
-      continue;
-    }
-    if (marker === "@cert-authority") continue;
-    sawHost = true;
-    if (lineType === type && lineKey === encoded) return "match";
-  }
-  return sawHost ? "mismatch" : "unknown";
-}
-async function rememberHostKey(host, port, blob) {
-  await mkdir(PLANCHE_DIR, { recursive: true, mode: 448 });
-  const name = port === 22 ? host.toLowerCase() : `[${host.toLowerCase()}]:${port}`;
-  await appendFile(PLANCHE_KNOWN_HOSTS, `${name} ${keyType(blob)} ${blob.toString("base64")}
-`, { mode: 384 });
-}
-function fingerprint(blob) {
-  return "SHA256:" + createHash("sha256").update(blob).digest("base64").replace(/=+$/, "");
-}
-async function resolveConfig(ssh) {
-  const cfg = await resolveSshHost(ssh.host);
-  if (cfg.proxyJump) {
-    throw new TunnelError(`ProxyJump (${cfg.proxyJump}) configured for ${ssh.host} in ~/.ssh/config is not supported`, 400);
-  }
-  if (cfg.hostName && (cfg.hostName.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(cfg.hostName))) {
-    throw new TunnelError(`HostName for ${ssh.host} in ~/.ssh/config is not a valid host name`, 400);
-  }
-  const resolved = {
-    ...ssh,
-    host: cfg.hostName ?? ssh.host,
-    port: ssh.port === 22 && cfg.port ? cfg.port : ssh.port,
-    user: ssh.user || cfg.user || ""
-  };
-  if (!resolved.user) {
-    throw new TunnelError(
-      SSH_CONFIG_DISABLED ? "ssh.user is required" : `ssh.user is required (no User for ${ssh.host} in ~/.ssh/config)`,
-      400
-    );
-  }
-  if (resolved.auth === "key" && !resolved.privateKey) {
-    if (SSH_CONFIG_DISABLED) {
-      throw new TunnelError("ssh.privateKey is required (the agent runs with PLANCHE_SSH_CONFIG=none)", 400);
-    }
-    const candidates = cfg.identityFiles.length ? cfg.identityFiles : DEFAULT_IDENTITY_FILES;
-    for (const file of candidates) {
-      try {
-        resolved.privateKey = await readFile2(file, "utf8");
-        console.log(`[ssh] Using identity file ${file} for ${ssh.host}`);
-        break;
-      } catch {
-      }
-    }
-    if (!resolved.privateKey) {
-      throw new TunnelError(
-        `No private key given and none readable for ${ssh.host} (tried ${candidates.map((f) => basename2(f)).join(", ")} in ~/.ssh)`,
-        400
-      );
-    }
-  }
-  return { ...resolved, identityAgent: cfg.identityAgent };
-}
-function toConnectConfig(ssh) {
-  const base = {
-    host: ssh.host,
-    port: ssh.port,
-    username: ssh.user,
-    readyTimeout: CONNECT_TIMEOUT_MS,
-    keepaliveInterval: 3e4
-  };
-  switch (ssh.auth) {
-    case "password":
-      return { ...base, password: ssh.password ?? "", tryKeyboard: true };
-    case "key":
-      return { ...base, privateKey: ssh.privateKey, passphrase: ssh.passphrase };
-    case "agent": {
-      const agent = process.env.SSH_AUTH_SOCK || ssh.identityAgent || (process.platform === "win32" ? "pageant" : void 0);
-      if (!agent) throw new TunnelError("No ssh-agent found (SSH_AUTH_SOCK is not set)", 400);
-      return { ...base, agent };
-    }
-  }
-}
-function describeSshError(err, ssh) {
-  const target = `${ssh.user}@${ssh.host}:${ssh.port}`;
-  if (err instanceof TunnelError) return err;
-  switch (err.level) {
-    case "client-authentication":
-      return new TunnelError(`SSH authentication failed for ${target}`, 401);
-    case "client-timeout":
-      return new TunnelError(`SSH connection to ${target} timed out`, 400);
-    default:
-      return new TunnelError(`SSH connection to ${target} failed: ${err.message}`, 400);
-  }
-}
-async function openSshTunnel(requested, target) {
-  const ssh = await resolveConfig(requested);
-  const client = new Client();
-  const connectConfig = toConnectConfig(ssh);
-  let verifyError;
-  connectConfig.hostVerifier = (key, verified) => {
-    lookupHostKey(ssh.host, ssh.port, key).then(async (result) => {
-      const fp = fingerprint(key);
-      if (result === "mismatch") {
-        verifyError = new TunnelError(
-          `Host key for ${ssh.host}:${ssh.port} has changed (${fp}). Remove the old entry from ~/.ssh/known_hosts or ~/.planche/known_hosts if this is expected.`,
-          400
-        );
-        verified(false);
-        return;
-      }
-      if (result === "unknown") {
-        if (ssh.acceptHostKey !== fp) {
-          verifyError = new HostKeyError(ssh.host, ssh.port, keyType(key), fp);
-          verified(false);
-          return;
-        }
-        console.log(`[ssh] Host key for ${ssh.host}:${ssh.port} (${fp}) accepted by the user, saved to ~/.planche/known_hosts`);
-        await rememberHostKey(ssh.host, ssh.port, key).catch((e) => console.warn(`[ssh] Could not save host key: ${e.message}`));
-      }
-      verified(true);
-    }).catch((err) => {
-      verifyError = err instanceof TunnelError ? err : new TunnelError(`Host key verification failed: ${err instanceof Error ? err.message : String(err)}`, 400);
-      verified(false);
-    });
-  };
-  await new Promise((resolve2, reject) => {
-    client.once("ready", resolve2);
-    client.once("error", (err) => reject(verifyError ?? describeSshError(err, ssh)));
-    try {
-      client.connect(connectConfig);
-    } catch (err) {
-      reject(describeSshError(err, ssh));
-    }
-  });
-  client.on("error", (err) => console.error(`[ssh] ${ssh.host}:${ssh.port}: ${err.message}`));
-  const sockets = /* @__PURE__ */ new Set();
-  let forwardError;
-  const server = createServer((socket) => {
-    sockets.add(socket);
-    socket.once("close", () => sockets.delete(socket));
-    socket.on("error", () => socket.destroy());
-    client.forwardOut(socket.localAddress ?? "127.0.0.1", socket.localPort ?? 0, target.host, target.port, (err, stream) => {
-      if (err) {
-        const local = /^(localhost|127\.0\.0\.1|::1)$/i.test(target.host);
-        const hint = local ? `"${target.host}" is resolved on the jump host itself; use the database's real address (e.g. the RDS endpoint) as the database host` : "is the database reachable from the jump host, and does it allow TCP forwarding?";
-        forwardError = `SSH port forwarding to ${target.host}:${target.port} failed: ${err.message} (${hint})`;
-        console.error(`[ssh] ${forwardError}`);
-        socket.destroy();
-        return;
-      }
-      stream.on("error", () => socket.destroy());
-      socket.pipe(stream).pipe(socket);
-      stream.once("close", () => socket.destroy());
-      socket.once("close", () => stream.destroy());
-    });
-  });
-  await new Promise((resolve2, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve2());
-  }).catch((err) => {
-    client.end();
-    throw new TunnelError(`Could not open local tunnel port: ${err.message}`, 400);
-  });
-  const { port } = server.address();
-  let closed = false;
-  const close = () => new Promise((resolve2) => {
-    if (closed) return resolve2();
-    closed = true;
-    for (const s of sockets) s.destroy();
-    server.close(() => {
-      client.end();
-      resolve2();
-    });
-  });
-  client.once("close", () => void close());
-  return {
-    host: "127.0.0.1",
-    port,
-    get forwardError() {
-      return forwardError;
-    },
-    close
-  };
-}
-
-// src/tunneling.ts
-import { randomUUID } from "crypto";
+// src/gateway.ts
+import { readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
 
 // src/drivers/mysql.ts
 import mysql from "mysql2/promise";
@@ -510,225 +98,592 @@ var MySqlDriver = class {
       );
       return { fields: mappedFields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
     }
-    const header = results;
+    const header = results;
+    return {
+      fields: [],
+      records: [],
+      affectedRows: header.affectedRows ?? 0,
+      insertId: header.insertId ?? 0,
+      isResultQuery: false
+    };
+  }
+  async setReadOnly() {
+    await this.connection.query("SET SESSION TRANSACTION READ ONLY");
+  }
+  async close() {
+    await this.connection.end();
+  }
+};
+var mysqlDriverFactory = {
+  async open(config) {
+    const connection = await mysql.createConnection(toConnectionOptions(config));
+    connection.on("error", (err) => console.error("[mysql] Connection error:", err.message));
+    return new MySqlDriver(connection, config);
+  },
+  async test(config) {
+    const connection = await mysql.createConnection({
+      ...toConnectionOptions(config),
+      database: void 0
+    });
+    await connection.end();
+  },
+  parseConfig(body) {
+    const host = typeof body.host === "string" ? body.host.trim() : "";
+    const user = typeof body.user === "string" ? body.user : "";
+    if (!host || !user) {
+      throw new Error("host and user are required");
+    }
+    return {
+      driver: "mysql",
+      host,
+      port: Number(body.port) || 3306,
+      user,
+      password: typeof body.password === "string" ? body.password : "",
+      database: typeof body.database === "string" && body.database ? body.database : void 0,
+      charset: typeof body.charset === "string" && body.charset ? body.charset : void 0,
+      ssl: body.ssl === true,
+      sslVerify: body.sslVerify === true
+    };
+  }
+};
+
+// src/drivers/postgres.ts
+import pg from "pg";
+var TEXT_OIDS = [
+  20,
+  // int8
+  1700,
+  // numeric
+  1082,
+  // date
+  1114,
+  // timestamp
+  1184,
+  // timestamptz
+  1083,
+  // time
+  1266,
+  // timetz
+  1186
+  // interval
+];
+var types = new pg.TypeOverrides();
+for (const oid of TEXT_OIDS) types.setTypeParser(oid, (value) => value);
+var BUILTIN_TYPES = {
+  16: "bool",
+  17: "bytea",
+  18: "char",
+  19: "name",
+  20: "int8",
+  21: "int2",
+  23: "int4",
+  25: "text",
+  26: "oid",
+  114: "json",
+  142: "xml",
+  700: "float4",
+  701: "float8",
+  1042: "bpchar",
+  1043: "varchar",
+  1082: "date",
+  1083: "time",
+  1114: "timestamp",
+  1184: "timestamptz",
+  1186: "interval",
+  1266: "timetz",
+  1700: "numeric",
+  2950: "uuid",
+  3802: "jsonb",
+  1560: "bit",
+  1562: "varbit",
+  600: "point",
+  869: "inet",
+  650: "cidr",
+  829: "macaddr",
+  1007: "_int4",
+  1009: "_text"
+};
+function toClientConfig(config) {
+  return {
+    host: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: config.database,
+    ssl: config.ssl ? { rejectUnauthorized: config.sslVerify === true } : void 0,
+    types
+  };
+}
+var SEARCH_PATH_STATEMENT = /^\s*SET\s+(SESSION\s+|LOCAL\s+)?search_path\b/i;
+var quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
+var PostgresDriver = class {
+  constructor(client, config) {
+    this.client = client;
+    this.label = `${config.user}@${config.host}:${config.port}/${config.database}`;
+  }
+  client;
+  type = "postgres";
+  label;
+  /**
+   * Schema currently first in `search_path`, or null when unknown (after the
+   * client set it itself). The app's "database" for a Postgres connection is
+   * a schema of the bound database, switched with `SET search_path`.
+   */
+  currentSchema = null;
+  typeNames = { ...BUILTIN_TYPES };
+  /**
+   * Result fields name their source only by OID (`tableID` / `columnID`);
+   * the frontend needs schema/table/column names to decide whether a grid is
+   * editable and to build UPDATEs, so they are resolved here and cached.
+   */
+  relations = /* @__PURE__ */ new Map();
+  async loadTypeNames() {
+    try {
+      const res = await this.client.query(
+        "SELECT oid, typname FROM pg_type WHERE typtype IN ('b', 'e', 'd', 'r')"
+      );
+      for (const row of res.rows) this.typeNames[Number(row.oid)] = row.typname;
+    } catch {
+    }
+  }
+  async resolveRelations(tableIds) {
+    const missing = [...new Set(tableIds)].filter((id) => id > 0 && !this.relations.has(id));
+    if (missing.length === 0) return;
+    try {
+      const res = await this.client.query(
+        `SELECT c.oid, n.nspname, c.relname, a.attnum, a.attname
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+         WHERE c.oid = ANY($1::oid[])`,
+        [missing]
+      );
+      for (const row of res.rows) {
+        const oid = Number(row.oid);
+        let rel = this.relations.get(oid);
+        if (!rel) {
+          rel = { schema: row.nspname, table: row.relname, columns: /* @__PURE__ */ new Map() };
+          this.relations.set(oid, rel);
+        }
+        rel.columns.set(Number(row.attnum), row.attname);
+      }
+    } catch {
+    }
+  }
+  async query(sql2, database) {
+    if (database && database !== this.currentSchema) {
+      await this.client.query(`SET search_path TO ${quoteIdent(database)}, public`);
+      this.currentSchema = database;
+    }
+    const result = await this.client.query({ text: sql2, rowMode: "array" });
+    if (SEARCH_PATH_STATEMENT.test(sql2)) this.currentSchema = null;
+    const results = Array.isArray(result) ? result : [result];
+    const last = [...results].reverse().find((r) => r.fields.length > 0) ?? results[results.length - 1];
+    if (last.fields.length > 0) {
+      await this.resolveRelations(last.fields.map((f) => f.tableID));
+      const fields = last.fields.map((field) => {
+        const rel = this.relations.get(field.tableID);
+        return {
+          name: field.name,
+          orgName: rel?.columns.get(field.columnID) ?? field.name,
+          type: this.typeNames[field.dataTypeID] ?? `oid:${field.dataTypeID}`,
+          table: rel?.table ?? "",
+          orgTable: rel?.table ?? "",
+          db: rel?.schema ?? "",
+          maxLength: field.dataTypeSize > 0 ? field.dataTypeSize : 0
+        };
+      });
+      return { fields, records: last.rows, affectedRows: 0, insertId: 0, isResultQuery: true };
+    }
     return {
       fields: [],
       records: [],
-      affectedRows: header.affectedRows ?? 0,
-      insertId: header.insertId ?? 0,
+      affectedRows: results.reduce((sum, r) => sum + (r.rowCount ?? 0), 0),
+      insertId: 0,
       isResultQuery: false
     };
   }
+  async setReadOnly() {
+    await this.client.query("SET default_transaction_read_only = on");
+  }
   async close() {
-    await this.connection.end();
+    await this.client.end();
   }
 };
-var mysqlDriverFactory = {
+var postgresDriverFactory = {
   async open(config) {
-    const connection = await mysql.createConnection(toConnectionOptions(config));
-    connection.on("error", (err) => console.error("[mysql] Connection error:", err.message));
-    return new MySqlDriver(connection, config);
+    const client = new pg.Client(toClientConfig(config));
+    await client.connect();
+    client.on("error", (err) => console.error("[postgres] Connection error:", err.message));
+    const driver = new PostgresDriver(client, config);
+    await driver.loadTypeNames();
+    return driver;
   },
   async test(config) {
-    const connection = await mysql.createConnection({
-      ...toConnectionOptions(config),
-      database: void 0
+    const client = new pg.Client(toClientConfig(config));
+    await client.connect();
+    await client.end();
+  },
+  parseConfig(body) {
+    const host = typeof body.host === "string" ? body.host.trim() : "";
+    const user = typeof body.user === "string" ? body.user : "";
+    if (!host || !user) {
+      throw new Error("host and user are required");
+    }
+    return {
+      driver: "postgres",
+      host,
+      port: Number(body.port) || 5432,
+      user,
+      password: typeof body.password === "string" ? body.password : "",
+      database: typeof body.database === "string" && body.database ? body.database : "postgres",
+      ssl: body.ssl === true,
+      sslVerify: body.sslVerify === true
+    };
+  }
+};
+
+// src/drivers/sqlite.ts
+import Database from "better-sqlite3";
+import { existsSync, realpathSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, join, relative, resolve, sep } from "path";
+function normalizeDeclaredType(declared) {
+  if (!declared) return null;
+  const base = declared.trim().toLowerCase().replace(/\(.*$/, "").trim();
+  return base || null;
+}
+function inferTypeFromValue(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "real";
+  if (typeof value === "bigint") return "bigint";
+  if (Buffer.isBuffer(value)) return "blob";
+  return "text";
+}
+var SQLITE_DIR = process.env.PLANCHE_SQLITE_DIR ? resolve(expandHome(process.env.PLANCHE_SQLITE_DIR)) : null;
+var DEFAULT_ROOT = homedir();
+var DENIED_UNDER_HOME = process.platform === "darwin" ? ["Library"] : process.platform === "win32" ? ["AppData"] : [];
+var ALLOW_ATTACH = process.env.PLANCHE_SQLITE_ATTACH === "1";
+var DB_EXTENSIONS = /\.(db|db3|s3db|sl3|sqlite|sqlite3)$/i;
+function expandHome(path) {
+  return path === "~" || path.startsWith("~/") ? resolve(homedir(), path.slice(2)) : path;
+}
+function realish(file) {
+  let probe = file;
+  const rest = [];
+  for (; ; ) {
+    try {
+      return rest.length ? join(realpathSync.native(probe), ...rest) : realpathSync.native(probe);
+    } catch {
+      const parent = dirname(probe);
+      if (parent === probe) return file;
+      rest.unshift(basename(probe));
+      probe = parent;
+    }
+  }
+}
+function isInside(path, root) {
+  return path === root || path.startsWith(root + sep);
+}
+function resolveFile(file, forCreate = false) {
+  if (file === ":memory:") return file;
+  if (file.startsWith("file:")) throw new Error("SQLite URI filenames are not supported by the agent; give a plain path");
+  const resolved = realish(resolve(SQLITE_DIR ?? process.cwd(), expandHome(file)));
+  if (SQLITE_DIR) {
+    if (!isInside(resolved, realish(SQLITE_DIR))) throw new Error("SQLite file is outside the directory allowed by PLANCHE_SQLITE_DIR");
+  } else {
+    const root = realish(DEFAULT_ROOT);
+    if (!isInside(resolved, root)) throw new Error("SQLite files outside your home directory need PLANCHE_SQLITE_DIR on the agent");
+    const parts = relative(root, resolved).split(sep);
+    if (parts.some((part) => part.startsWith("."))) throw new Error("SQLite files in hidden directories need PLANCHE_SQLITE_DIR on the agent");
+    if (DENIED_UNDER_HOME.some((d) => d.toLowerCase() === parts[0].toLowerCase())) throw new Error(`SQLite files under ~/${parts[0]} need PLANCHE_SQLITE_DIR on the agent`);
+  }
+  if (forCreate && !DB_EXTENSIONS.test(resolved)) {
+    throw new Error("A new SQLite file must end with .db, .db3, .s3db, .sl3, .sqlite or .sqlite3");
+  }
+  return resolved;
+}
+function openDatabase(config) {
+  const file = resolveFile(config.file, config.createIfMissing === true);
+  const isMemory = file === ":memory:";
+  if (!isMemory && !config.createIfMissing && !existsSync(file)) {
+    throw new Error(`SQLite file not found: ${config.file}`);
+  }
+  const db = new Database(file, {
+    readonly: config.readonly ?? false,
+    fileMustExist: !isMemory && !config.createIfMissing
+  });
+  db.pragma("trusted_schema = OFF");
+  if (config.readonly) db.pragma("query_only = ON");
+  return db;
+}
+function stripLiteralsAndComments(sql2) {
+  let out = "";
+  let i = 0;
+  while (i < sql2.length) {
+    const c = sql2[i];
+    if (c === "'" || c === '"' || c === "`") {
+      let j = i + 1;
+      while (j < sql2.length) {
+        if (sql2[j] === c) {
+          if (sql2[j + 1] === c) j += 2;
+          else {
+            j++;
+            break;
+          }
+        } else j++;
+      }
+      out += c + c;
+      i = j;
+      continue;
+    }
+    if (c === "[") {
+      const j = sql2.indexOf("]", i);
+      i = j < 0 ? sql2.length : j + 1;
+      out += "[]";
+      continue;
+    }
+    if (c === "-" && sql2[i + 1] === "-") {
+      const j = sql2.indexOf("\n", i);
+      i = j < 0 ? sql2.length : j;
+      out += " ";
+      continue;
+    }
+    if (c === "/" && sql2[i + 1] === "*") {
+      const j = sql2.indexOf("*/", i + 2);
+      i = j < 0 ? sql2.length : j + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+function assertNoFileStatements(sql2) {
+  const text = stripLiteralsAndComments(sql2);
+  if (!ALLOW_ATTACH && /\bATTACH\b/i.test(text)) {
+    throw new Error("ATTACH DATABASE is disabled on the agent (set PLANCHE_SQLITE_ATTACH=1 to allow it)");
+  }
+  if (/\bVACUUM\b[^;]*\bINTO\b/i.test(text)) {
+    throw new Error("VACUUM INTO is not available through the agent");
+  }
+  if (/\bPRAGMA\s+temp_store_directory\b/i.test(text)) {
+    throw new Error("PRAGMA temp_store_directory is not available through the agent");
+  }
+}
+var SqliteDriver = class {
+  constructor(db, config) {
+    this.db = db;
+    this.label = config.file;
+  }
+  db;
+  type = "sqlite";
+  label;
+  async query(sql2) {
+    assertNoFileStatements(sql2);
+    let statement;
+    try {
+      statement = this.db.prepare(sql2);
+    } catch (err) {
+      if (err instanceof RangeError && /more than one statement/i.test(err.message)) {
+        this.db.exec(sql2);
+        return { fields: [], records: [], affectedRows: 0, insertId: 0, isResultQuery: false };
+      }
+      throw err;
+    }
+    if (!statement.reader) {
+      const info = statement.run();
+      return {
+        fields: [],
+        records: [],
+        affectedRows: info.changes,
+        insertId: Number(info.lastInsertRowid),
+        isResultQuery: false
+      };
+    }
+    const columns = statement.columns();
+    const records = statement.raw(true).all();
+    const fields = columns.map((col, index) => {
+      const declared = normalizeDeclaredType(col.type);
+      const type = declared ?? inferTypeFromValue(firstNonNull(records, index));
+      return {
+        name: col.name,
+        orgName: col.column ?? col.name,
+        type,
+        table: col.table ?? "",
+        orgTable: col.table ?? "",
+        db: col.database ?? "",
+        maxLength: 0
+      };
     });
-    await connection.end();
+    return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+  }
+  async setReadOnly() {
+    this.db.pragma("query_only = 1");
+  }
+  async close() {
+    if (this.db.inTransaction) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {
+      }
+    }
+    this.db.close();
+  }
+};
+function firstNonNull(records, index) {
+  for (const row of records) {
+    const value = row[index];
+    if (value !== null && value !== void 0) return value;
+  }
+  return null;
+}
+var sqliteDriverFactory = {
+  async open(config) {
+    return new SqliteDriver(openDatabase(config), config);
+  },
+  async test(config) {
+    const db = openDatabase(config);
+    try {
+      db.prepare("SELECT 1").get();
+    } finally {
+      db.close();
+    }
   },
   parseConfig(body) {
-    const host = typeof body.host === "string" ? body.host.trim() : "";
-    const user = typeof body.user === "string" ? body.user : "";
-    if (!host || !user) {
-      throw new Error("host and user are required");
+    const file = typeof body.file === "string" ? body.file.trim() : "";
+    if (!file) {
+      throw new Error("file is required");
     }
     return {
-      driver: "mysql",
-      host,
-      port: Number(body.port) || 3306,
-      user,
-      password: typeof body.password === "string" ? body.password : "",
-      database: typeof body.database === "string" && body.database ? body.database : void 0,
-      charset: typeof body.charset === "string" && body.charset ? body.charset : void 0,
-      ssl: body.ssl === true,
-      sslVerify: body.sslVerify === true
+      driver: "sqlite",
+      file,
+      createIfMissing: body.createIfMissing === true,
+      readonly: body.readonly === true
     };
   }
 };
 
-// src/drivers/postgres.ts
-import pg from "pg";
-var TEXT_OIDS = [
-  20,
-  // int8
-  1700,
-  // numeric
-  1082,
-  // date
-  1114,
-  // timestamp
-  1184,
-  // timestamptz
-  1083,
-  // time
-  1266,
-  // timetz
-  1186
-  // interval
-];
-var types = new pg.TypeOverrides();
-for (const oid of TEXT_OIDS) types.setTypeParser(oid, (value) => value);
-var BUILTIN_TYPES = {
-  16: "bool",
-  17: "bytea",
-  18: "char",
-  19: "name",
-  20: "int8",
-  21: "int2",
-  23: "int4",
-  25: "text",
-  26: "oid",
-  114: "json",
-  142: "xml",
-  700: "float4",
-  701: "float8",
-  1042: "bpchar",
-  1043: "varchar",
-  1082: "date",
-  1083: "time",
-  1114: "timestamp",
-  1184: "timestamptz",
-  1186: "interval",
-  1266: "timetz",
-  1700: "numeric",
-  2950: "uuid",
-  3802: "jsonb",
-  1560: "bit",
-  1562: "varbit",
-  600: "point",
-  869: "inet",
-  650: "cidr",
-  829: "macaddr",
-  1007: "_int4",
-  1009: "_text"
-};
-function toClientConfig(config) {
+// src/drivers/mssql.ts
+import sql from "mssql";
+function toPoolConfig(config) {
   return {
-    host: config.host,
+    server: config.host,
     port: config.port,
     user: config.user,
     password: config.password,
     database: config.database,
-    ssl: config.ssl ? { rejectUnauthorized: config.sslVerify === true } : void 0,
-    types
+    // One physical connection: manual transactions and USE need session affinity.
+    pool: { min: 1, max: 1, idleTimeoutMillis: 24 * 60 * 60 * 1e3 },
+    options: {
+      encrypt: config.ssl === true,
+      trustServerCertificate: config.sslVerify !== true,
+      // Keep date/time values as sent by the server rather than shifting to UTC.
+      useUTC: false,
+      enableArithAbort: true
+    },
+    requestTimeout: 0
   };
 }
-var SEARCH_PATH_STATEMENT = /^\s*SET\s+(SESSION\s+|LOCAL\s+)?search_path\b/i;
-var quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
-var PostgresDriver = class {
-  constructor(client, config) {
-    this.client = client;
+var pad = (n, width = 2) => String(n).padStart(width, "0");
+function formatDate(d) {
+  const date = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+  const ms = d.getMilliseconds();
+  return `${date} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}${ms ? "." + pad(ms, 3) : ""}`;
+}
+function normalizeValue(value) {
+  if (value instanceof Date) return formatDate(value);
+  if (Buffer.isBuffer(value)) return value.toString("hex");
+  return value;
+}
+var RESULT_QUERY = /^\s*(?:WITH|SELECT|\()/i;
+var MssqlDriver = class {
+  constructor(pool, config) {
+    this.pool = pool;
     this.label = `${config.user}@${config.host}:${config.port}/${config.database}`;
   }
-  client;
-  type = "postgres";
+  pool;
+  type = "mssql";
   label;
+  /** Source columns per SQL text; `sys.dm_exec_describe_first_result_set` is not free. */
+  sources = /* @__PURE__ */ new Map();
   /**
-   * Schema currently first in `search_path`, or null when unknown (after the
-   * client set it itself). The app's "database" for a Postgres connection is
-   * a schema of the bound database, switched with `SET search_path`.
-   */
-  currentSchema = null;
-  typeNames = { ...BUILTIN_TYPES };
-  /**
-   * Result fields name their source only by OID (`tableID` / `columnID`);
-   * the frontend needs schema/table/column names to decide whether a grid is
-   * editable and to build UPDATEs, so they are resolved here and cached.
+   * The `mssql` driver does not report which table a result column comes
+   * from; ask the server to describe the statement instead so the grid can
+   * decide whether it is editable and address rows by primary key.
    */
-  relations = /* @__PURE__ */ new Map();
-  async loadTypeNames() {
-    try {
-      const res = await this.client.query(
-        "SELECT oid, typname FROM pg_type WHERE typtype IN ('b', 'e', 'd', 'r')"
-      );
-      for (const row of res.rows) this.typeNames[Number(row.oid)] = row.typname;
-    } catch {
-    }
-  }
-  async resolveRelations(tableIds) {
-    const missing = [...new Set(tableIds)].filter((id) => id > 0 && !this.relations.has(id));
-    if (missing.length === 0) return;
+  async describe(text) {
+    const cached = this.sources.get(text);
+    if (cached !== void 0) return cached;
+    let result = null;
     try {
-      const res = await this.client.query(
-        `SELECT c.oid, n.nspname, c.relname, a.attnum, a.attname
-         FROM pg_class c
-         JOIN pg_namespace n ON n.oid = c.relnamespace
-         JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
-         WHERE c.oid = ANY($1::oid[])`,
-        [missing]
+      const req = this.pool.request();
+      req.input("sql", sql.NVarChar(sql.MAX), text);
+      const res = await req.query(
+        "SELECT name, source_schema, source_table, source_column, system_type_name FROM sys.dm_exec_describe_first_result_set(@sql, NULL, 1) WHERE is_hidden = 0 ORDER BY column_ordinal"
       );
-      for (const row of res.rows) {
-        const oid = Number(row.oid);
-        let rel = this.relations.get(oid);
-        if (!rel) {
-          rel = { schema: row.nspname, table: row.relname, columns: /* @__PURE__ */ new Map() };
-          this.relations.set(oid, rel);
-        }
-        rel.columns.set(Number(row.attnum), row.attname);
-      }
+      result = res.recordset.map((r) => ({
+        schema: r.source_schema ?? "",
+        table: r.source_table ?? "",
+        column: r.source_column ?? "",
+        type: (r.system_type_name ?? "").toLowerCase()
+      }));
     } catch {
+      result = null;
     }
+    if (this.sources.size > 200) this.sources.clear();
+    this.sources.set(text, result);
+    return result;
   }
-  async query(sql2, database) {
-    if (database && database !== this.currentSchema) {
-      await this.client.query(`SET search_path TO ${quoteIdent(database)}, public`);
-      this.currentSchema = database;
-    }
-    const result = await this.client.query({ text: sql2, rowMode: "array" });
-    if (SEARCH_PATH_STATEMENT.test(sql2)) this.currentSchema = null;
-    const results = Array.isArray(result) ? result : [result];
-    const last = [...results].reverse().find((r) => r.fields.length > 0) ?? results[results.length - 1];
-    if (last.fields.length > 0) {
-      await this.resolveRelations(last.fields.map((f) => f.tableID));
-      const fields = last.fields.map((field) => {
-        const rel = this.relations.get(field.tableID);
+  async query(text) {
+    const req = this.pool.request();
+    req.arrayRowMode = true;
+    const res = await req.query(text);
+    const sets = res.recordsets;
+    const last = sets.length > 0 ? sets[sets.length - 1] : void 0;
+    const columns = last?.columns;
+    if (last && columns) {
+      const meta = Object.values(columns).sort((a, b) => a.index - b.index);
+      const sources = RESULT_QUERY.test(text) ? await this.describe(text) : null;
+      const fields = meta.map((col, i) => {
+        const src = sources && sources.length === meta.length ? sources[i] : void 0;
+        const typeName = col.type?.declaration ?? "";
         return {
-          name: field.name,
-          orgName: rel?.columns.get(field.columnID) ?? field.name,
-          type: this.typeNames[field.dataTypeID] ?? `oid:${field.dataTypeID}`,
-          table: rel?.table ?? "",
-          orgTable: rel?.table ?? "",
-          db: rel?.schema ?? "",
-          maxLength: field.dataTypeSize > 0 ? field.dataTypeSize : 0
+          name: col.name,
+          orgName: src?.column || col.name,
+          type: src?.type || typeName.toLowerCase(),
+          table: src?.table ?? "",
+          orgTable: src?.table ?? "",
+          db: src?.schema ?? "",
+          maxLength: typeof col.length === "number" ? col.length : 0
         };
       });
-      return { fields, records: last.rows, affectedRows: 0, insertId: 0, isResultQuery: true };
+      const records = last.map((row) => row.map(normalizeValue));
+      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
     }
     return {
       fields: [],
       records: [],
-      affectedRows: results.reduce((sum, r) => sum + (r.rowCount ?? 0), 0),
+      affectedRows: res.rowsAffected.reduce((sum, n) => sum + n, 0),
       insertId: 0,
       isResultQuery: false
     };
   }
   async close() {
-    await this.client.end();
+    await this.pool.close();
   }
 };
-var postgresDriverFactory = {
+var mssqlDriverFactory = {
   async open(config) {
-    const client = new pg.Client(toClientConfig(config));
-    await client.connect();
-    client.on("error", (err) => console.error("[postgres] Connection error:", err.message));
-    const driver = new PostgresDriver(client, config);
-    await driver.loadTypeNames();
-    return driver;
+    const pool = new sql.ConnectionPool(toPoolConfig(config));
+    await pool.connect();
+    return new MssqlDriver(pool, config);
   },
   async test(config) {
-    const client = new pg.Client(toClientConfig(config));
-    await client.connect();
-    await client.end();
+    const pool = new sql.ConnectionPool(toPoolConfig(config));
+    await pool.connect();
+    await pool.close();
   },
   parseConfig(body) {
     const host = typeof body.host === "string" ? body.host.trim() : "";
@@ -737,694 +692,742 @@ var postgresDriverFactory = {
       throw new Error("host and user are required");
     }
     return {
-      driver: "postgres",
+      driver: "mssql",
       host,
-      port: Number(body.port) || 5432,
+      port: Number(body.port) || 1433,
       user,
       password: typeof body.password === "string" ? body.password : "",
-      database: typeof body.database === "string" && body.database ? body.database : "postgres",
+      database: typeof body.database === "string" && body.database ? body.database : "master",
       ssl: body.ssl === true,
       sslVerify: body.sslVerify === true
     };
   }
 };
 
-// src/drivers/sqlite.ts
-import Database from "better-sqlite3";
-import { existsSync, realpathSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname2, join as join3, relative, resolve, sep } from "path";
-function normalizeDeclaredType(declared) {
-  if (!declared) return null;
-  const base = declared.trim().toLowerCase().replace(/\(.*$/, "").trim();
-  return base || null;
-}
-function inferTypeFromValue(value) {
-  if (value === null || value === void 0) return "null";
-  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "real";
-  if (typeof value === "bigint") return "bigint";
-  if (Buffer.isBuffer(value)) return "blob";
-  return "text";
-}
-var SQLITE_DIR = process.env.PLANCHE_SQLITE_DIR ? resolve(expandHome2(process.env.PLANCHE_SQLITE_DIR)) : null;
-var DEFAULT_ROOT = homedir3();
-var DENIED_UNDER_HOME = process.platform === "darwin" ? ["Library"] : process.platform === "win32" ? ["AppData"] : [];
-var ALLOW_ATTACH = process.env.PLANCHE_SQLITE_ATTACH === "1";
-var DB_EXTENSIONS = /\.(db|db3|s3db|sl3|sqlite|sqlite3)$/i;
-function expandHome2(path) {
-  return path === "~" || path.startsWith("~/") ? resolve(homedir3(), path.slice(2)) : path;
-}
-function realish(file) {
-  let probe = file;
-  const rest = [];
-  for (; ; ) {
-    try {
-      return rest.length ? join3(realpathSync.native(probe), ...rest) : realpathSync.native(probe);
-    } catch {
-      const parent = dirname2(probe);
-      if (parent === probe) return file;
-      rest.unshift(basename3(probe));
-      probe = parent;
-    }
-  }
-}
-function isInside(path, root) {
-  return path === root || path.startsWith(root + sep);
-}
-function resolveFile(file, forCreate = false) {
-  if (file === ":memory:") return file;
-  if (file.startsWith("file:")) throw new Error("SQLite URI filenames are not supported by the agent; give a plain path");
-  const resolved = realish(resolve(SQLITE_DIR ?? process.cwd(), expandHome2(file)));
-  if (SQLITE_DIR) {
-    if (!isInside(resolved, realish(SQLITE_DIR))) throw new Error("SQLite file is outside the directory allowed by PLANCHE_SQLITE_DIR");
-  } else {
-    const root = realish(DEFAULT_ROOT);
-    if (!isInside(resolved, root)) throw new Error("SQLite files outside your home directory need PLANCHE_SQLITE_DIR on the agent");
-    const parts = relative(root, resolved).split(sep);
-    if (parts.some((part) => part.startsWith("."))) throw new Error("SQLite files in hidden directories need PLANCHE_SQLITE_DIR on the agent");
-    if (DENIED_UNDER_HOME.some((d) => d.toLowerCase() === parts[0].toLowerCase())) throw new Error(`SQLite files under ~/${parts[0]} need PLANCHE_SQLITE_DIR on the agent`);
-  }
-  if (forCreate && !DB_EXTENSIONS.test(resolved)) {
-    throw new Error("A new SQLite file must end with .db, .db3, .s3db, .sl3, .sqlite or .sqlite3");
-  }
-  return resolved;
+// src/drivers/oracle.ts
+import oracledb from "oracledb";
+oracledb.autoCommit = true;
+oracledb.fetchAsString = [oracledb.CLOB];
+var fetchTypeHandler = (meta) => meta.dbType === oracledb.DB_TYPE_NUMBER ? { type: oracledb.STRING } : void 0;
+var pad2 = (n, width = 2) => String(n).padStart(width, "0");
+function formatDate2(d) {
+  const ms = d.getMilliseconds();
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}${ms ? "." + pad2(ms, 3) : ""}`;
 }
-function openDatabase(config) {
-  const file = resolveFile(config.file, config.createIfMissing === true);
-  const isMemory = file === ":memory:";
-  if (!isMemory && !config.createIfMissing && !existsSync(file)) {
-    throw new Error(`SQLite file not found: ${config.file}`);
-  }
-  const db = new Database(file, {
-    readonly: config.readonly ?? false,
-    fileMustExist: !isMemory && !config.createIfMissing
-  });
-  db.pragma("trusted_schema = OFF");
-  if (config.readonly) db.pragma("query_only = ON");
-  return db;
+function normalizeValue2(value) {
+  if (value instanceof Date) return formatDate2(value);
+  if (Buffer.isBuffer(value)) return value.toString("hex");
+  return value;
 }
-function stripLiteralsAndComments(sql2) {
-  let out = "";
-  let i = 0;
-  while (i < sql2.length) {
-    const c = sql2[i];
-    if (c === "'" || c === '"' || c === "`") {
-      let j = i + 1;
-      while (j < sql2.length) {
-        if (sql2[j] === c) {
-          if (sql2[j + 1] === c) j += 2;
-          else {
-            j++;
-            break;
-          }
-        } else j++;
-      }
-      out += c + c;
-      i = j;
-      continue;
-    }
-    if (c === "[") {
-      const j = sql2.indexOf("]", i);
-      i = j < 0 ? sql2.length : j + 1;
-      out += "[]";
-      continue;
-    }
-    if (c === "-" && sql2[i + 1] === "-") {
-      const j = sql2.indexOf("\n", i);
-      i = j < 0 ? sql2.length : j;
-      out += " ";
-      continue;
-    }
-    if (c === "/" && sql2[i + 1] === "*") {
-      const j = sql2.indexOf("*/", i + 2);
-      i = j < 0 ? sql2.length : j + 2;
-      out += " ";
-      continue;
-    }
-    out += c;
-    i++;
-  }
-  return out;
+var SESSION_FORMATS = [
+  "ALTER SESSION SET NLS_DATE_FORMAT = 'YYYY-MM-DD HH24:MI:SS'",
+  "ALTER SESSION SET NLS_TIMESTAMP_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3'",
+  "ALTER SESSION SET NLS_TIMESTAMP_TZ_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3 TZH:TZM'"
+];
+var quoteIdent2 = (name) => `"${name.replaceAll('"', '""')}"`;
+var PLSQL = /^\s*(BEGIN|DECLARE|CREATE\s+(OR\s+REPLACE\s+)?((NON)?EDITIONABLE\s+)?(PROCEDURE|FUNCTION|TRIGGER|PACKAGE|TYPE)\b)/i;
+function normalizeStatement(sql2) {
+  const trimmed = sql2.trim().replace(/\n\/\s*$/, "");
+  if (PLSQL.test(trimmed)) return trimmed.endsWith(";") ? trimmed : `${trimmed};`;
+  return trimmed.replace(/;\s*$/, "");
 }
-function assertNoFileStatements(sql2) {
-  const text = stripLiteralsAndComments(sql2);
-  if (!ALLOW_ATTACH && /\bATTACH\b/i.test(text)) {
-    throw new Error("ATTACH DATABASE is disabled on the agent (set PLANCHE_SQLITE_ATTACH=1 to allow it)");
-  }
-  if (/\bVACUUM\b[^;]*\bINTO\b/i.test(text)) {
-    throw new Error("VACUUM INTO is not available through the agent");
-  }
-  if (/\bPRAGMA\s+temp_store_directory\b/i.test(text)) {
-    throw new Error("PRAGMA temp_store_directory is not available through the agent");
-  }
+var SET_SCHEMA = /^\s*ALTER\s+SESSION\s+SET\s+CURRENT_SCHEMA\b/i;
+var START_TX = /^\s*SET\s+TRANSACTION\b/i;
+var END_TX = /^\s*(COMMIT|ROLLBACK)\b/i;
+function singleSourceTable(sql2) {
+  const m = /\bFROM\s+("?[\w$#]+"?)(?:\s*\.\s*("?[\w$#]+"?))?([\s\S]*)$/i.exec(sql2);
+  if (!m) return null;
+  const rest = m[3].replace(/\b(WHERE|ORDER\s+BY|GROUP\s+BY|HAVING|FETCH|OFFSET|UNION|MINUS|INTERSECT|FOR\s+UPDATE)\b[\s\S]*$/i, "");
+  if (/,|\bJOIN\b|\(/i.test(rest) || rest.trim().split(/\s+/).filter(Boolean).length > 2) return null;
+  const unquote = (v) => v.startsWith('"') ? v.slice(1, -1).replaceAll('""', '"') : v.toUpperCase();
+  return m[2] ? { schema: unquote(m[1]), table: unquote(m[2]) } : { table: unquote(m[1]) };
 }
-var SqliteDriver = class {
-  constructor(db, config) {
-    this.db = db;
-    this.label = config.file;
+var OracleDriver = class {
+  constructor(conn, config) {
+    this.conn = conn;
+    this.label = `${config.user}@${config.host}:${config.port}/${config.serviceName}`;
+    this.currentSchema = config.user.toUpperCase();
   }
-  db;
-  type = "sqlite";
+  conn;
+  type = "oracle";
   label;
-  async query(sql2) {
-    assertNoFileStatements(sql2);
-    let statement;
+  currentSchema;
+  manualTx = false;
+  /** Column names per `OWNER.TABLE`, for result-source resolution. */
+  columns = /* @__PURE__ */ new Map();
+  async init() {
+    for (const stmt of SESSION_FORMATS) await this.conn.execute(stmt);
+  }
+  async tableColumns(schema, table) {
+    const key = `${schema}.${table}`;
+    const cached = this.columns.get(key);
+    if (cached !== void 0) return cached;
+    let out = null;
     try {
-      statement = this.db.prepare(sql2);
-    } catch (err) {
-      if (err instanceof RangeError && /more than one statement/i.test(err.message)) {
-        this.db.exec(sql2);
-        return { fields: [], records: [], affectedRows: 0, insertId: 0, isResultQuery: false };
-      }
-      throw err;
+      const res = await this.conn.execute(
+        "SELECT column_name FROM all_tab_columns WHERE owner = :o AND table_name = :t",
+        { o: schema, t: table },
+        { outFormat: oracledb.OUT_FORMAT_ARRAY }
+      );
+      out = res.rows && res.rows.length > 0 ? new Set(res.rows.map((r) => r[0])) : null;
+    } catch {
+      out = null;
     }
-    if (!statement.reader) {
-      const info = statement.run();
-      return {
-        fields: [],
-        records: [],
-        affectedRows: info.changes,
-        insertId: Number(info.lastInsertRowid),
-        isResultQuery: false
-      };
+    if (this.columns.size > 200) this.columns.clear();
+    this.columns.set(key, out);
+    return out;
+  }
+  async query(sql2, database) {
+    if (database && database !== this.currentSchema) {
+      await this.conn.execute(`ALTER SESSION SET CURRENT_SCHEMA = ${quoteIdent2(database)}`);
+      this.currentSchema = database;
     }
-    const columns = statement.columns();
-    const records = statement.raw(true).all();
-    const fields = columns.map((col, index) => {
-      const declared = normalizeDeclaredType(col.type);
-      const type = declared ?? inferTypeFromValue(firstNonNull(records, index));
-      return {
-        name: col.name,
-        orgName: col.column ?? col.name,
-        type,
-        table: col.table ?? "",
-        orgTable: col.table ?? "",
-        db: col.database ?? "",
-        maxLength: 0
-      };
+    const text = normalizeStatement(sql2);
+    if (START_TX.test(text)) this.manualTx = true;
+    const res = await this.conn.execute(text, [], {
+      outFormat: oracledb.OUT_FORMAT_ARRAY,
+      fetchTypeHandler,
+      autoCommit: !this.manualTx
     });
-    return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+    if (SET_SCHEMA.test(text)) this.currentSchema = null;
+    if (END_TX.test(text)) this.manualTx = false;
+    if (res.metaData && res.metaData.length > 0) {
+      const source = singleSourceTable(text);
+      const schema = source?.schema ?? this.currentSchema ?? "";
+      const known = source && schema ? await this.tableColumns(schema, source.table) : null;
+      const fields = res.metaData.map((col) => {
+        const fromTable = known?.has(col.name) ?? false;
+        return {
+          name: col.name,
+          orgName: col.name,
+          type: (col.dbTypeName ?? "").toLowerCase(),
+          table: fromTable ? source.table : "",
+          orgTable: fromTable ? source.table : "",
+          db: fromTable ? schema : "",
+          maxLength: col.byteSize ?? 0
+        };
+      });
+      const records = (res.rows ?? []).map((row) => row.map(normalizeValue2));
+      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+    }
+    return { fields: [], records: [], affectedRows: res.rowsAffected ?? 0, insertId: 0, isResultQuery: false };
   }
   async close() {
-    if (this.db.inTransaction) {
-      try {
-        this.db.exec("ROLLBACK");
-      } catch {
-      }
-    }
-    this.db.close();
+    await this.conn.close();
   }
 };
-function firstNonNull(records, index) {
-  for (const row of records) {
-    const value = row[index];
-    if (value !== null && value !== void 0) return value;
-  }
-  return null;
+function connectionAttributes(config) {
+  return {
+    user: config.user,
+    password: config.password,
+    connectString: `${config.host}:${config.port}/${config.serviceName}`
+  };
 }
-var sqliteDriverFactory = {
+var oracleDriverFactory = {
   async open(config) {
-    return new SqliteDriver(openDatabase(config), config);
+    const conn = await oracledb.getConnection(connectionAttributes(config));
+    const driver = new OracleDriver(conn, config);
+    await driver.init();
+    return driver;
   },
   async test(config) {
-    const db = openDatabase(config);
-    try {
-      db.prepare("SELECT 1").get();
-    } finally {
-      db.close();
-    }
+    const conn = await oracledb.getConnection(connectionAttributes(config));
+    await conn.close();
   },
   parseConfig(body) {
-    const file = typeof body.file === "string" ? body.file.trim() : "";
-    if (!file) {
-      throw new Error("file is required");
+    const host = typeof body.host === "string" ? body.host.trim() : "";
+    const user = typeof body.user === "string" ? body.user : "";
+    if (!host || !user) {
+      throw new Error("host and user are required");
     }
+    if (!/^[A-Za-z0-9._[\]-]{1,253}$/.test(host)) throw new Error("host is not a valid host name");
+    const serviceName = typeof body.serviceName === "string" && body.serviceName ? body.serviceName.trim() : "FREEPDB1";
+    if (!/^[A-Za-z0-9._$#-]{1,128}$/.test(serviceName)) throw new Error("serviceName may only contain letters, digits, . _ $ # -");
     return {
-      driver: "sqlite",
-      file,
-      createIfMissing: body.createIfMissing === true,
-      readonly: body.readonly === true
+      driver: "oracle",
+      host,
+      port: Number(body.port) || 1521,
+      user,
+      password: typeof body.password === "string" ? body.password : "",
+      serviceName
     };
   }
 };
 
-// src/drivers/mssql.ts
-import sql from "mssql";
-function toPoolConfig(config) {
-  return {
-    server: config.host,
-    port: config.port,
-    user: config.user,
-    password: config.password,
-    database: config.database,
-    // One physical connection: manual transactions and USE need session affinity.
-    pool: { min: 1, max: 1, idleTimeoutMillis: 24 * 60 * 60 * 1e3 },
-    options: {
-      encrypt: config.ssl === true,
-      trustServerCertificate: config.sslVerify !== true,
-      // Keep date/time values as sent by the server rather than shifting to UTC.
-      useUTC: false,
-      enableArithAbort: true
-    },
-    requestTimeout: 0
-  };
+// src/drivers/d1.ts
+var API = "https://api.cloudflare.com/client/v4";
+var D1Error = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+var SCHEMA_PRAGMA = /^\s*PRAGMA\s+(?:"main"|main|'main'|\[main\])\s*\.\s*/i;
+var DATABASE_LIST = /^\s*PRAGMA\s+database_list\s*;?\s*$/i;
+var RESULT_KIND = /^\s*(SELECT|WITH|PRAGMA|EXPLAIN|VALUES)\b/i;
+function singleSourceTable2(sql2) {
+  const m = /\bFROM\s+(?:"?main"?\s*\.\s*)?("[^"]+"|`[^`]+`|\[[^\]]+\]|[\w$]+)([\s\S]*)$/i.exec(sql2);
+  if (!m) return null;
+  const rest = m[2].replace(/\b(WHERE|ORDER\s+BY|GROUP\s+BY|HAVING|LIMIT|OFFSET|UNION|EXCEPT|INTERSECT|WINDOW)\b[\s\S]*$/i, "");
+  if (/,|\bJOIN\b|\(/i.test(rest) || rest.trim().split(/\s+/).filter(Boolean).length > 2) return null;
+  const raw = m[1];
+  const first = raw[0];
+  if (first === '"') return raw.slice(1, -1).replaceAll('""', '"');
+  if (first === "`") return raw.slice(1, -1).replaceAll("``", "`");
+  if (first === "[") return raw.slice(1, -1);
+  return raw;
 }
-var pad = (n, width = 2) => String(n).padStart(width, "0");
-function formatDate(d) {
-  const date = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
-  const ms = d.getMilliseconds();
-  return `${date} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}${ms ? "." + pad(ms, 3) : ""}`;
+function normalizeDeclaredType2(declared) {
+  if (typeof declared !== "string") return null;
+  const base = declared.trim().toLowerCase().replace(/\(.*$/, "").trim();
+  return base || null;
 }
-function normalizeValue(value) {
-  if (value instanceof Date) return formatDate(value);
-  if (Buffer.isBuffer(value)) return value.toString("hex");
-  return value;
+function inferTypeFromValue2(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "real";
+  if (Array.isArray(value)) return "blob";
+  return "text";
 }
-var RESULT_QUERY = /^\s*(?:WITH|SELECT|\()/i;
-var MssqlDriver = class {
-  constructor(pool, config) {
-    this.pool = pool;
-    this.label = `${config.user}@${config.host}:${config.port}/${config.database}`;
+function firstNonNull2(records, index) {
+  for (const row of records) {
+    const value = row[index];
+    if (value !== null && value !== void 0) return value;
   }
-  pool;
-  type = "mssql";
+  return null;
+}
+var D1Driver = class {
+  type = "d1";
   label;
-  /** Source columns per SQL text; `sys.dm_exec_describe_first_result_set` is not free. */
-  sources = /* @__PURE__ */ new Map();
-  /**
-   * The `mssql` driver does not report which table a result column comes
-   * from; ask the server to describe the statement instead so the grid can
-   * decide whether it is editable and address rows by primary key.
-   */
-  async describe(text) {
-    const cached = this.sources.get(text);
-    if (cached !== void 0) return cached;
-    let result = null;
+  url;
+  headers;
+  /** Declared column types per table, for result-source resolution. */
+  columns = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.label = `d1:${config.databaseId}`;
+    this.url = `${API}/accounts/${encodeURIComponent(config.accountId)}/d1/database/${encodeURIComponent(config.databaseId)}/raw`;
+    this.headers = { Authorization: `Bearer ${config.apiToken}`, "Content-Type": "application/json" };
+  }
+  async raw(sql2) {
+    let res;
     try {
-      const req = this.pool.request();
-      req.input("sql", sql.NVarChar(sql.MAX), text);
-      const res = await req.query(
-        "SELECT name, source_schema, source_table, source_column, system_type_name FROM sys.dm_exec_describe_first_result_set(@sql, NULL, 1) WHERE is_hidden = 0 ORDER BY column_ordinal"
-      );
-      result = res.recordset.map((r) => ({
-        schema: r.source_schema ?? "",
-        table: r.source_table ?? "",
-        column: r.source_column ?? "",
-        type: (r.system_type_name ?? "").toLowerCase()
-      }));
+      res = await fetch(this.url, { method: "POST", headers: this.headers, body: JSON.stringify({ sql: sql2 }), signal: AbortSignal.timeout(6e4) });
+    } catch (err) {
+      throw new D1Error(`Cannot reach the Cloudflare API: ${err instanceof Error ? err.message : String(err)}`, 400);
+    }
+    let body = null;
+    try {
+      body = await res.json();
     } catch {
-      result = null;
     }
-    if (this.sources.size > 200) this.sources.clear();
-    this.sources.set(text, result);
+    if (!res.ok || !body?.success) {
+      const message = (body?.errors?.map((e) => String(e.message)).join("; ") || `Cloudflare API responded ${res.status}`).slice(0, 500);
+      throw new D1Error(message, res.status === 401 || res.status === 403 ? 401 : res.ok ? void 0 : 400);
+    }
+    const result = body.result?.[0];
+    if (!result) throw new D1Error("Cloudflare API returned no result");
     return result;
   }
-  async query(text) {
-    const req = this.pool.request();
-    req.arrayRowMode = true;
-    const res = await req.query(text);
-    const sets = res.recordsets;
-    const last = sets.length > 0 ? sets[sets.length - 1] : void 0;
-    const columns = last?.columns;
-    if (last && columns) {
-      const meta = Object.values(columns).sort((a, b) => a.index - b.index);
-      const sources = RESULT_QUERY.test(text) ? await this.describe(text) : null;
-      const fields = meta.map((col, i) => {
-        const src = sources && sources.length === meta.length ? sources[i] : void 0;
-        const typeName = col.type?.declaration ?? "";
-        return {
-          name: col.name,
-          orgName: src?.column || col.name,
-          type: src?.type || typeName.toLowerCase(),
-          table: src?.table ?? "",
-          orgTable: src?.table ?? "",
-          db: src?.schema ?? "",
-          maxLength: typeof col.length === "number" ? col.length : 0
-        };
-      });
-      const records = last.map((row) => row.map(normalizeValue));
-      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+  async tableColumns(table) {
+    const cached = this.columns.get(table);
+    if (cached !== void 0) return cached;
+    let out = null;
+    try {
+      const info = await this.raw(`PRAGMA table_info("${table.replaceAll('"', '""')}")`);
+      const cols = info.results?.columns ?? [];
+      const name = cols.indexOf("name");
+      const type = cols.indexOf("type");
+      const rows = info.results?.rows ?? [];
+      if (rows.length > 0 && name >= 0) {
+        out = new Map(rows.map((r) => [String(r[name]), normalizeDeclaredType2(type >= 0 ? r[type] : null)]));
+      }
+    } catch {
+      out = null;
+    }
+    if (this.columns.size > 200) this.columns.clear();
+    this.columns.set(table, out);
+    return out;
+  }
+  async query(sql2) {
+    if (DATABASE_LIST.test(sql2)) {
+      return {
+        fields: [
+          { name: "seq", orgName: "seq", type: "integer", table: "", orgTable: "", db: "", maxLength: 0 },
+          { name: "name", orgName: "name", type: "text", table: "", orgTable: "", db: "", maxLength: 0 },
+          { name: "file", orgName: "file", type: "text", table: "", orgTable: "", db: "", maxLength: 0 }
+        ],
+        records: [[0, "main", ""]],
+        affectedRows: 0,
+        insertId: 0,
+        isResultQuery: true
+      };
+    }
+    const text = sql2.replace(SCHEMA_PRAGMA, "PRAGMA ");
+    if (/^\s*(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) {
+      throw new D1Error("Cloudflare D1 does not support transaction statements over the API; every request auto-commits.");
+    }
+    if (this.isDdl(text)) this.columns.clear();
+    const result = await this.raw(text);
+    const columns = result.results?.columns ?? [];
+    const records = result.results?.rows ?? [];
+    if (columns.length === 0 && !RESULT_KIND.test(text)) {
+      return {
+        fields: [],
+        records: [],
+        affectedRows: result.meta?.changes ?? 0,
+        insertId: result.meta?.last_row_id ?? 0,
+        isResultQuery: false
+      };
     }
-    return {
-      fields: [],
-      records: [],
-      affectedRows: res.rowsAffected.reduce((sum, n) => sum + n, 0),
-      insertId: 0,
-      isResultQuery: false
-    };
+    const source = RESULT_KIND.test(text) ? singleSourceTable2(text) : null;
+    const known = source ? await this.tableColumns(source) : null;
+    const fields = columns.map((name, index) => {
+      const fromTable = known?.has(name) ?? false;
+      const type = (fromTable ? known?.get(name) : null) ?? inferTypeFromValue2(firstNonNull2(records, index));
+      return {
+        name,
+        orgName: name,
+        type,
+        table: fromTable && source ? source : "",
+        orgTable: fromTable && source ? source : "",
+        db: fromTable ? "main" : "",
+        maxLength: 0
+      };
+    });
+    return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+  }
+  isDdl(sql2) {
+    return /^\s*(CREATE|ALTER|DROP)\b/i.test(sql2);
   }
   async close() {
-    await this.pool.close();
+    this.columns.clear();
   }
 };
-var mssqlDriverFactory = {
+var d1DriverFactory = {
   async open(config) {
-    const pool = new sql.ConnectionPool(toPoolConfig(config));
-    await pool.connect();
-    return new MssqlDriver(pool, config);
+    const driver = new D1Driver(config);
+    await driver.raw("SELECT 1");
+    return driver;
   },
   async test(config) {
-    const pool = new sql.ConnectionPool(toPoolConfig(config));
-    await pool.connect();
-    await pool.close();
+    await new D1Driver(config).raw("SELECT 1");
   },
   parseConfig(body) {
-    const host = typeof body.host === "string" ? body.host.trim() : "";
-    const user = typeof body.user === "string" ? body.user : "";
-    if (!host || !user) {
-      throw new Error("host and user are required");
+    const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
+    const databaseId = typeof body.databaseId === "string" ? body.databaseId.trim() : "";
+    const apiToken = typeof body.apiToken === "string" ? body.apiToken.trim() : "";
+    if (!accountId || !databaseId || !apiToken) {
+      throw new Error("accountId, databaseId and apiToken are required");
     }
-    return {
-      driver: "mssql",
-      host,
-      port: Number(body.port) || 1433,
-      user,
-      password: typeof body.password === "string" ? body.password : "",
-      database: typeof body.database === "string" && body.database ? body.database : "master",
-      ssl: body.ssl === true,
-      sslVerify: body.sslVerify === true
-    };
+    return { driver: "d1", accountId, databaseId, apiToken };
   }
 };
 
-// src/drivers/oracle.ts
-import oracledb from "oracledb";
-oracledb.autoCommit = true;
-oracledb.fetchAsString = [oracledb.CLOB];
-var fetchTypeHandler = (meta) => meta.dbType === oracledb.DB_TYPE_NUMBER ? { type: oracledb.STRING } : void 0;
-var pad2 = (n, width = 2) => String(n).padStart(width, "0");
-function formatDate2(d) {
-  const ms = d.getMilliseconds();
-  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}${ms ? "." + pad2(ms, 3) : ""}`;
+// src/ssh-tunnel.ts
+import { createServer } from "net";
+import { mkdir, readFile as readFile2, appendFile } from "fs/promises";
+import { createHash, createHmac, timingSafeEqual } from "crypto";
+import { homedir as homedir3 } from "os";
+import { basename as basename3, join as join3 } from "path";
+import { Client } from "ssh2";
+
+// src/ssh-config.ts
+import { readFile, readdir } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, isAbsolute, join as join2, basename as basename2 } from "path";
+var SSH_CONFIG_DISABLED = process.env.PLANCHE_SSH_CONFIG === "none";
+var DEFAULT_SSH_CONFIG = SSH_CONFIG_DISABLED ? "" : process.env.PLANCHE_SSH_CONFIG || join2(homedir2(), ".ssh", "config");
+var DEFAULT_IDENTITY_FILES = ["id_ed25519", "id_ecdsa", "id_rsa", "id_ed25519_sk", "id_ecdsa_sk"].map(
+  (f) => join2(homedir2(), ".ssh", f)
+);
+function expandHome2(path) {
+  return path === "~" || path.startsWith("~/") ? join2(homedir2(), path.slice(1)) : path;
 }
-function normalizeValue2(value) {
-  if (value instanceof Date) return formatDate2(value);
-  if (Buffer.isBuffer(value)) return value.toString("hex");
-  return value;
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
 }
-var SESSION_FORMATS = [
-  "ALTER SESSION SET NLS_DATE_FORMAT = 'YYYY-MM-DD HH24:MI:SS'",
-  "ALTER SESSION SET NLS_TIMESTAMP_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3'",
-  "ALTER SESSION SET NLS_TIMESTAMP_TZ_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3 TZH:TZM'"
-];
-var quoteIdent2 = (name) => `"${name.replaceAll('"', '""')}"`;
-var PLSQL = /^\s*(BEGIN|DECLARE|CREATE\s+(OR\s+REPLACE\s+)?((NON)?EDITIONABLE\s+)?(PROCEDURE|FUNCTION|TRIGGER|PACKAGE|TYPE)\b)/i;
-function normalizeStatement(sql2) {
-  const trimmed = sql2.trim().replace(/\n\/\s*$/, "");
-  if (PLSQL.test(trimmed)) return trimmed.endsWith(";") ? trimmed : `${trimmed};`;
-  return trimmed.replace(/;\s*$/, "");
+function hostPatternMatches(patterns, host) {
+  let matched = false;
+  for (const raw of patterns) {
+    const negated = raw.startsWith("!");
+    const pattern = negated ? raw.slice(1) : raw;
+    if (!globToRegExp(pattern).test(host)) continue;
+    if (negated) return false;
+    matched = true;
+  }
+  return matched;
 }
-var SET_SCHEMA = /^\s*ALTER\s+SESSION\s+SET\s+CURRENT_SCHEMA\b/i;
-var START_TX = /^\s*SET\s+TRANSACTION\b/i;
-var END_TX = /^\s*(COMMIT|ROLLBACK)\b/i;
-function singleSourceTable(sql2) {
-  const m = /\bFROM\s+("?[\w$#]+"?)(?:\s*\.\s*("?[\w$#]+"?))?([\s\S]*)$/i.exec(sql2);
-  if (!m) return null;
-  const rest = m[3].replace(/\b(WHERE|ORDER\s+BY|GROUP\s+BY|HAVING|FETCH|OFFSET|UNION|MINUS|INTERSECT|FOR\s+UPDATE)\b[\s\S]*$/i, "");
-  if (/,|\bJOIN\b|\(/i.test(rest) || rest.trim().split(/\s+/).filter(Boolean).length > 2) return null;
-  const unquote = (v) => v.startsWith('"') ? v.slice(1, -1).replaceAll('""', '"') : v.toUpperCase();
-  return m[2] ? { schema: unquote(m[1]), table: unquote(m[2]) } : { table: unquote(m[1]) };
+function tokenize(line) {
+  const tokens = [];
+  const re = /"([^"]*)"|(\S+)/g;
+  let m;
+  while (m = re.exec(line)) tokens.push(m[1] ?? m[2]);
+  return tokens;
 }
-var OracleDriver = class {
-  constructor(conn, config) {
-    this.conn = conn;
-    this.label = `${config.user}@${config.host}:${config.port}/${config.serviceName}`;
-    this.currentSchema = config.user.toUpperCase();
-  }
-  conn;
-  type = "oracle";
-  label;
-  currentSchema;
-  manualTx = false;
-  /** Column names per `OWNER.TABLE`, for result-source resolution. */
-  columns = /* @__PURE__ */ new Map();
-  async init() {
-    for (const stmt of SESSION_FORMATS) await this.conn.execute(stmt);
+function parseLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return void 0;
+  const eq = trimmed.match(/^([A-Za-z]+)\s*=\s*(.*)$/);
+  const [keyword, rest] = eq ? [eq[1], eq[2]] : [trimmed.split(/\s+/, 1)[0], trimmed.slice(trimmed.split(/\s+/, 1)[0].length)];
+  return { keyword: keyword.toLowerCase(), args: tokenize(rest) };
+}
+async function expandGlob(path) {
+  const base = basename2(path);
+  if (!/[*?]/.test(base)) return [path];
+  const dir = dirname2(path);
+  try {
+    const re = globToRegExp(base);
+    return (await readdir(dir)).filter((name) => re.test(name)).sort().map((name) => join2(dir, name));
+  } catch {
+    return [];
   }
-  async tableColumns(schema, table) {
-    const key = `${schema}.${table}`;
-    const cached = this.columns.get(key);
-    if (cached !== void 0) return cached;
-    let out = null;
-    try {
-      const res = await this.conn.execute(
-        "SELECT column_name FROM all_tab_columns WHERE owner = :o AND table_name = :t",
-        { o: schema, t: table },
-        { outFormat: oracledb.OUT_FORMAT_ARRAY }
-      );
-      out = res.rows && res.rows.length > 0 ? new Set(res.rows.map((r) => r[0])) : null;
-    } catch {
-      out = null;
-    }
-    if (this.columns.size > 200) this.columns.clear();
-    this.columns.set(key, out);
-    return out;
+}
+async function loadLines(file, seen) {
+  if (seen.has(file)) return [];
+  seen.add(file);
+  try {
+    return (await readFile(file, "utf8")).split(/\r?\n/);
+  } catch {
+    return [];
   }
-  async query(sql2, database) {
-    if (database && database !== this.currentSchema) {
-      await this.conn.execute(`ALTER SESSION SET CURRENT_SCHEMA = ${quoteIdent2(database)}`);
-      this.currentSchema = database;
-    }
-    const text = normalizeStatement(sql2);
-    if (START_TX.test(text)) this.manualTx = true;
-    const res = await this.conn.execute(text, [], {
-      outFormat: oracledb.OUT_FORMAT_ARRAY,
-      fetchTypeHandler,
-      autoCommit: !this.manualTx
-    });
-    if (SET_SCHEMA.test(text)) this.currentSchema = null;
-    if (END_TX.test(text)) this.manualTx = false;
-    if (res.metaData && res.metaData.length > 0) {
-      const source = singleSourceTable(text);
-      const schema = source?.schema ?? this.currentSchema ?? "";
-      const known = source && schema ? await this.tableColumns(schema, source.table) : null;
-      const fields = res.metaData.map((col) => {
-        const fromTable = known?.has(col.name) ?? false;
-        return {
-          name: col.name,
-          orgName: col.name,
-          type: (col.dbTypeName ?? "").toLowerCase(),
-          table: fromTable ? source.table : "",
-          orgTable: fromTable ? source.table : "",
-          db: fromTable ? schema : "",
-          maxLength: col.byteSize ?? 0
-        };
-      });
-      const records = (res.rows ?? []).map((row) => row.map(normalizeValue2));
-      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+}
+async function resolveSshHost(host, file = DEFAULT_SSH_CONFIG) {
+  const result = { identityFiles: [] };
+  if (!file) return result;
+  const seen = /* @__PURE__ */ new Set();
+  async function walk(path, active) {
+    let blockActive = active;
+    for (const line of await loadLines(path, seen)) {
+      const d = parseLine(line);
+      if (!d) continue;
+      switch (d.keyword) {
+        case "host":
+          blockActive = hostPatternMatches(d.args, host);
+          continue;
+        case "match":
+          blockActive = d.args.length === 1 && d.args[0].toLowerCase() === "all";
+          continue;
+        case "include":
+          for (const inc of d.args) {
+            const target = expandHome2(inc);
+            const abs = isAbsolute(target) ? target : join2(homedir2(), ".ssh", target);
+            for (const expanded of await expandGlob(abs)) await walk(expanded, blockActive);
+          }
+          continue;
+      }
+      if (!blockActive) continue;
+      const value = d.args[0];
+      if (value === void 0) continue;
+      switch (d.keyword) {
+        case "hostname":
+          result.hostName ??= value.replace(/%h/g, host);
+          break;
+        case "port":
+          result.port ??= Number(value) || void 0;
+          break;
+        case "user":
+          result.user ??= value;
+          break;
+        case "identityfile":
+          for (const f of d.args) {
+            const expanded = expandHome2(f.replace(/%d/g, homedir2()).replace(/%h/g, host));
+            if (expanded.split(/[\\/]/).includes("..")) continue;
+            result.identityFiles.push(expanded);
+          }
+          break;
+        case "identityagent":
+          result.identityAgent ??= value === "none" ? void 0 : expandHome2(value.replace(/%d/g, homedir2()));
+          break;
+        case "proxyjump":
+          result.proxyJump ??= value;
+          break;
+      }
     }
-    return { fields: [], records: [], affectedRows: res.rowsAffected ?? 0, insertId: 0, isResultQuery: false };
-  }
-  async close() {
-    await this.conn.close();
   }
-};
-function connectionAttributes(config) {
-  return {
-    user: config.user,
-    password: config.password,
-    connectString: `${config.host}:${config.port}/${config.serviceName}`
-  };
+  await walk(file, true);
+  return result;
 }
-var oracleDriverFactory = {
-  async open(config) {
-    const conn = await oracledb.getConnection(connectionAttributes(config));
-    const driver = new OracleDriver(conn, config);
-    await driver.init();
-    return driver;
-  },
-  async test(config) {
-    const conn = await oracledb.getConnection(connectionAttributes(config));
-    await conn.close();
-  },
-  parseConfig(body) {
-    const host = typeof body.host === "string" ? body.host.trim() : "";
-    const user = typeof body.user === "string" ? body.user : "";
-    if (!host || !user) {
-      throw new Error("host and user are required");
-    }
-    if (!/^[A-Za-z0-9._[\]-]{1,253}$/.test(host)) throw new Error("host is not a valid host name");
-    const serviceName = typeof body.serviceName === "string" && body.serviceName ? body.serviceName.trim() : "FREEPDB1";
-    if (!/^[A-Za-z0-9._$#-]{1,128}$/.test(serviceName)) throw new Error("serviceName may only contain letters, digits, . _ $ # -");
-    return {
-      driver: "oracle",
-      host,
-      port: Number(body.port) || 1521,
-      user,
-      password: typeof body.password === "string" ? body.password : "",
-      serviceName
-    };
-  }
-};
 
-// src/drivers/d1.ts
-var API = "https://api.cloudflare.com/client/v4";
-var D1Error = class extends Error {
+// src/ssh-tunnel.ts
+var TunnelError = class extends Error {
   constructor(message, status) {
     super(message);
     this.status = status;
+    this.name = "TunnelError";
   }
   status;
 };
-var SCHEMA_PRAGMA = /^\s*PRAGMA\s+(?:"main"|main|'main'|\[main\])\s*\.\s*/i;
-var DATABASE_LIST = /^\s*PRAGMA\s+database_list\s*;?\s*$/i;
-var RESULT_KIND = /^\s*(SELECT|WITH|PRAGMA|EXPLAIN|VALUES)\b/i;
-function singleSourceTable2(sql2) {
-  const m = /\bFROM\s+(?:"?main"?\s*\.\s*)?("[^"]+"|`[^`]+`|\[[^\]]+\]|[\w$]+)([\s\S]*)$/i.exec(sql2);
-  if (!m) return null;
-  const rest = m[2].replace(/\b(WHERE|ORDER\s+BY|GROUP\s+BY|HAVING|LIMIT|OFFSET|UNION|EXCEPT|INTERSECT|WINDOW)\b[\s\S]*$/i, "");
-  if (/,|\bJOIN\b|\(/i.test(rest) || rest.trim().split(/\s+/).filter(Boolean).length > 2) return null;
-  const raw = m[1];
-  const first = raw[0];
-  if (first === '"') return raw.slice(1, -1).replaceAll('""', '"');
-  if (first === "`") return raw.slice(1, -1).replaceAll("``", "`");
-  if (first === "[") return raw.slice(1, -1);
-  return raw;
-}
-function normalizeDeclaredType2(declared) {
-  if (typeof declared !== "string") return null;
-  const base = declared.trim().toLowerCase().replace(/\(.*$/, "").trim();
-  return base || null;
+var HostKeyError = class extends TunnelError {
+  hostKey;
+  constructor(host, port, type, fingerprint2) {
+    super(`The SSH host key of ${host}:${port} is not known yet (${type} ${fingerprint2}). Verify the fingerprint and accept it to continue.`, 409);
+    this.name = "HostKeyError";
+    this.hostKey = { host, port, type, fingerprint: fingerprint2 };
+  }
+};
+var CONNECT_TIMEOUT_MS = 2e4;
+var PLANCHE_DIR = join3(homedir3(), ".planche");
+var PLANCHE_KNOWN_HOSTS = join3(PLANCHE_DIR, "known_hosts");
+var OPENSSH_KNOWN_HOSTS = join3(homedir3(), ".ssh", "known_hosts");
+function parseSshConfig(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "object") throw new TunnelError("ssh must be an object", 400);
+  const body = value;
+  const host = typeof body.host === "string" ? body.host.trim() : "";
+  const user = typeof body.user === "string" ? body.user.trim() : "";
+  const auth = body.auth;
+  if (!host) throw new TunnelError("ssh.host is required", 400);
+  if (host.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(host) || /^[.-]+$/.test(host)) throw new TunnelError("ssh.host is not a valid host name", 400);
+  if (user.length > 64 || /[\s\x00-\x1f]/.test(user)) throw new TunnelError("ssh.user is not valid", 400);
+  const port = Math.trunc(Number(body.port)) || 22;
+  if (port < 1 || port > 65535) throw new TunnelError("ssh.port must be between 1 and 65535", 400);
+  if (auth !== "password" && auth !== "key" && auth !== "agent") {
+    throw new TunnelError("ssh.auth must be one of password, key, agent", 400);
+  }
+  const str = (v) => typeof v === "string" && v ? v : void 0;
+  const config = {
+    host,
+    port,
+    user,
+    auth,
+    password: auth === "password" ? str(body.password) ?? "" : void 0,
+    privateKey: auth === "key" ? str(body.privateKey) : void 0,
+    passphrase: auth === "key" ? str(body.passphrase) : void 0,
+    acceptHostKey: typeof body.acceptHostKey === "string" && /^SHA256:[A-Za-z0-9+/]{43}$/.test(body.acceptHostKey) ? body.acceptHostKey : void 0
+  };
+  return config;
 }
-function inferTypeFromValue2(value) {
-  if (value === null || value === void 0) return "null";
-  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "real";
-  if (Array.isArray(value)) return "blob";
-  return "text";
+function keyType(blob) {
+  if (blob.length < 4) throw new TunnelError("Malformed host key", 400);
+  const len = blob.readUInt32BE(0);
+  if (len <= 0 || len > 64 || blob.length < 4 + len) throw new TunnelError("Malformed host key", 400);
+  const type = blob.subarray(4, 4 + len).toString("ascii");
+  if (!/^[A-Za-z0-9@.-]+$/.test(type)) throw new TunnelError("Malformed host key", 400);
+  return type;
 }
-function firstNonNull2(records, index) {
-  for (const row of records) {
-    const value = row[index];
-    if (value !== null && value !== void 0) return value;
+function knownHostsEntryMatches(field, patterns) {
+  if (field.startsWith("|1|")) {
+    const [, , salt, hash] = field.split("|");
+    if (!salt || !hash) return false;
+    const key = Buffer.from(salt, "base64");
+    const want = Buffer.from(hash, "base64");
+    return patterns.some((p) => {
+      const got = createHmac("sha1", key).update(p).digest();
+      return got.length === want.length && timingSafeEqual(got, want);
+    });
   }
-  return null;
+  const entries = field.toLowerCase().split(",");
+  return patterns.some((p) => hostPatternMatches(entries, p));
 }
-var D1Driver = class {
-  type = "d1";
-  label;
-  url;
-  headers;
-  /** Declared column types per table, for result-source resolution. */
-  columns = /* @__PURE__ */ new Map();
-  constructor(config) {
-    this.label = `d1:${config.databaseId}`;
-    this.url = `${API}/accounts/${encodeURIComponent(config.accountId)}/d1/database/${encodeURIComponent(config.databaseId)}/raw`;
-    this.headers = { Authorization: `Bearer ${config.apiToken}`, "Content-Type": "application/json" };
+function hostPatterns(host, port) {
+  const h = host.toLowerCase();
+  return port === 22 ? [h, `[${h}]:22`] : [`[${h}]:${port}`];
+}
+async function readKnownHosts(file) {
+  try {
+    return (await readFile2(file, "utf8")).split(/\r?\n/);
+  } catch {
+    return [];
   }
-  async raw(sql2) {
-    let res;
-    try {
-      res = await fetch(this.url, { method: "POST", headers: this.headers, body: JSON.stringify({ sql: sql2 }), signal: AbortSignal.timeout(6e4) });
-    } catch (err) {
-      throw new D1Error(`Cannot reach the Cloudflare API: ${err instanceof Error ? err.message : String(err)}`, 400);
-    }
-    let body = null;
-    try {
-      body = await res.json();
-    } catch {
-    }
-    if (!res.ok || !body?.success) {
-      const message = (body?.errors?.map((e) => String(e.message)).join("; ") || `Cloudflare API responded ${res.status}`).slice(0, 500);
-      throw new D1Error(message, res.status === 401 || res.status === 403 ? 401 : res.ok ? void 0 : 400);
+}
+async function lookupHostKey(host, port, blob) {
+  const patterns = hostPatterns(host, port);
+  const type = keyType(blob);
+  const encoded = blob.toString("base64");
+  let sawHost = false;
+  const lines = [...await readKnownHosts(OPENSSH_KNOWN_HOSTS), ...await readKnownHosts(PLANCHE_KNOWN_HOSTS)];
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const fields = line.split(/\s+/);
+    const marker = fields[0].startsWith("@") ? fields.shift() : void 0;
+    const [hosts, lineType, lineKey] = fields;
+    if (!hosts || !lineType || !lineKey) continue;
+    if (!knownHostsEntryMatches(hosts, patterns)) continue;
+    if (marker === "@revoked") {
+      if (lineType === type && lineKey === encoded) throw new TunnelError(`The host key of ${host}:${port} is marked @revoked in known_hosts`, 400);
+      continue;
     }
-    const result = body.result?.[0];
-    if (!result) throw new D1Error("Cloudflare API returned no result");
-    return result;
+    if (marker === "@cert-authority") continue;
+    sawHost = true;
+    if (lineType === type && lineKey === encoded) return "match";
   }
-  async tableColumns(table) {
-    const cached = this.columns.get(table);
-    if (cached !== void 0) return cached;
-    let out = null;
-    try {
-      const info = await this.raw(`PRAGMA table_info("${table.replaceAll('"', '""')}")`);
-      const cols = info.results?.columns ?? [];
-      const name = cols.indexOf("name");
-      const type = cols.indexOf("type");
-      const rows = info.results?.rows ?? [];
-      if (rows.length > 0 && name >= 0) {
-        out = new Map(rows.map((r) => [String(r[name]), normalizeDeclaredType2(type >= 0 ? r[type] : null)]));
-      }
-    } catch {
-      out = null;
-    }
-    if (this.columns.size > 200) this.columns.clear();
-    this.columns.set(table, out);
-    return out;
+  return sawHost ? "mismatch" : "unknown";
+}
+async function rememberHostKey(host, port, blob) {
+  await mkdir(PLANCHE_DIR, { recursive: true, mode: 448 });
+  const name = port === 22 ? host.toLowerCase() : `[${host.toLowerCase()}]:${port}`;
+  await appendFile(PLANCHE_KNOWN_HOSTS, `${name} ${keyType(blob)} ${blob.toString("base64")}
+`, { mode: 384 });
+}
+function fingerprint(blob) {
+  return "SHA256:" + createHash("sha256").update(blob).digest("base64").replace(/=+$/, "");
+}
+async function resolveConfig(ssh) {
+  const cfg = await resolveSshHost(ssh.host);
+  if (cfg.proxyJump) {
+    throw new TunnelError(`ProxyJump (${cfg.proxyJump}) configured for ${ssh.host} in ~/.ssh/config is not supported`, 400);
   }
-  async query(sql2) {
-    if (DATABASE_LIST.test(sql2)) {
-      return {
-        fields: [
-          { name: "seq", orgName: "seq", type: "integer", table: "", orgTable: "", db: "", maxLength: 0 },
-          { name: "name", orgName: "name", type: "text", table: "", orgTable: "", db: "", maxLength: 0 },
-          { name: "file", orgName: "file", type: "text", table: "", orgTable: "", db: "", maxLength: 0 }
-        ],
-        records: [[0, "main", ""]],
-        affectedRows: 0,
-        insertId: 0,
-        isResultQuery: true
-      };
+  if (cfg.hostName && (cfg.hostName.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(cfg.hostName))) {
+    throw new TunnelError(`HostName for ${ssh.host} in ~/.ssh/config is not a valid host name`, 400);
+  }
+  const resolved = {
+    ...ssh,
+    host: cfg.hostName ?? ssh.host,
+    port: ssh.port === 22 && cfg.port ? cfg.port : ssh.port,
+    user: ssh.user || cfg.user || ""
+  };
+  if (!resolved.user) {
+    throw new TunnelError(
+      SSH_CONFIG_DISABLED ? "ssh.user is required" : `ssh.user is required (no User for ${ssh.host} in ~/.ssh/config)`,
+      400
+    );
+  }
+  if (resolved.auth === "key" && !resolved.privateKey) {
+    if (SSH_CONFIG_DISABLED) {
+      throw new TunnelError("ssh.privateKey is required (the agent runs with PLANCHE_SSH_CONFIG=none)", 400);
     }
-    const text = sql2.replace(SCHEMA_PRAGMA, "PRAGMA ");
-    if (/^\s*(BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(text)) {
-      throw new D1Error("Cloudflare D1 does not support transaction statements over the API; every request auto-commits.");
+    const candidates = cfg.identityFiles.length ? cfg.identityFiles : DEFAULT_IDENTITY_FILES;
+    for (const file of candidates) {
+      try {
+        resolved.privateKey = await readFile2(file, "utf8");
+        console.log(`[ssh] Using identity file ${file} for ${ssh.host}`);
+        break;
+      } catch {
+      }
     }
-    if (this.isDdl(text)) this.columns.clear();
-    const result = await this.raw(text);
-    const columns = result.results?.columns ?? [];
-    const records = result.results?.rows ?? [];
-    if (columns.length === 0 && !RESULT_KIND.test(text)) {
-      return {
-        fields: [],
-        records: [],
-        affectedRows: result.meta?.changes ?? 0,
-        insertId: result.meta?.last_row_id ?? 0,
-        isResultQuery: false
-      };
+    if (!resolved.privateKey) {
+      throw new TunnelError(
+        `No private key given and none readable for ${ssh.host} (tried ${candidates.map((f) => basename3(f)).join(", ")} in ~/.ssh)`,
+        400
+      );
     }
-    const source = RESULT_KIND.test(text) ? singleSourceTable2(text) : null;
-    const known = source ? await this.tableColumns(source) : null;
-    const fields = columns.map((name, index) => {
-      const fromTable = known?.has(name) ?? false;
-      const type = (fromTable ? known?.get(name) : null) ?? inferTypeFromValue2(firstNonNull2(records, index));
-      return {
-        name,
-        orgName: name,
-        type,
-        table: fromTable && source ? source : "",
-        orgTable: fromTable && source ? source : "",
-        db: fromTable ? "main" : "",
-        maxLength: 0
-      };
-    });
-    return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
   }
-  isDdl(sql2) {
-    return /^\s*(CREATE|ALTER|DROP)\b/i.test(sql2);
+  return { ...resolved, identityAgent: cfg.identityAgent };
+}
+function toConnectConfig(ssh) {
+  const base = {
+    host: ssh.host,
+    port: ssh.port,
+    username: ssh.user,
+    readyTimeout: CONNECT_TIMEOUT_MS,
+    keepaliveInterval: 3e4
+  };
+  switch (ssh.auth) {
+    case "password":
+      return { ...base, password: ssh.password ?? "", tryKeyboard: true };
+    case "key":
+      return { ...base, privateKey: ssh.privateKey, passphrase: ssh.passphrase };
+    case "agent": {
+      const agent = process.env.SSH_AUTH_SOCK || ssh.identityAgent || (process.platform === "win32" ? "pageant" : void 0);
+      if (!agent) throw new TunnelError("No ssh-agent found (SSH_AUTH_SOCK is not set)", 400);
+      return { ...base, agent };
+    }
   }
-  async close() {
-    this.columns.clear();
+}
+function describeSshError(err, ssh) {
+  const target = `${ssh.user}@${ssh.host}:${ssh.port}`;
+  if (err instanceof TunnelError) return err;
+  switch (err.level) {
+    case "client-authentication":
+      return new TunnelError(`SSH authentication failed for ${target}`, 401);
+    case "client-timeout":
+      return new TunnelError(`SSH connection to ${target} timed out`, 400);
+    default:
+      return new TunnelError(`SSH connection to ${target} failed: ${err.message}`, 400);
   }
-};
-var d1DriverFactory = {
-  async open(config) {
-    const driver = new D1Driver(config);
-    await driver.raw("SELECT 1");
-    return driver;
-  },
-  async test(config) {
-    await new D1Driver(config).raw("SELECT 1");
-  },
-  parseConfig(body) {
-    const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
-    const databaseId = typeof body.databaseId === "string" ? body.databaseId.trim() : "";
-    const apiToken = typeof body.apiToken === "string" ? body.apiToken.trim() : "";
-    if (!accountId || !databaseId || !apiToken) {
-      throw new Error("accountId, databaseId and apiToken are required");
+}
+async function openSshTunnel(requested, target) {
+  const ssh = await resolveConfig(requested);
+  const client = new Client();
+  const connectConfig = toConnectConfig(ssh);
+  let verifyError;
+  connectConfig.hostVerifier = (key, verified) => {
+    lookupHostKey(ssh.host, ssh.port, key).then(async (result) => {
+      const fp = fingerprint(key);
+      if (result === "mismatch") {
+        verifyError = new TunnelError(
+          `Host key for ${ssh.host}:${ssh.port} has changed (${fp}). Remove the old entry from ~/.ssh/known_hosts or ~/.planche/known_hosts if this is expected.`,
+          400
+        );
+        verified(false);
+        return;
+      }
+      if (result === "unknown") {
+        if (ssh.acceptHostKey !== fp) {
+          verifyError = new HostKeyError(ssh.host, ssh.port, keyType(key), fp);
+          verified(false);
+          return;
+        }
+        console.log(`[ssh] Host key for ${ssh.host}:${ssh.port} (${fp}) accepted by the user, saved to ~/.planche/known_hosts`);
+        await rememberHostKey(ssh.host, ssh.port, key).catch((e) => console.warn(`[ssh] Could not save host key: ${e.message}`));
+      }
+      verified(true);
+    }).catch((err) => {
+      verifyError = err instanceof TunnelError ? err : new TunnelError(`Host key verification failed: ${err instanceof Error ? err.message : String(err)}`, 400);
+      verified(false);
+    });
+  };
+  await new Promise((resolve3, reject) => {
+    client.once("ready", resolve3);
+    client.once("error", (err) => reject(verifyError ?? describeSshError(err, ssh)));
+    try {
+      client.connect(connectConfig);
+    } catch (err) {
+      reject(describeSshError(err, ssh));
     }
-    return { driver: "d1", accountId, databaseId, apiToken };
-  }
-};
+  });
+  client.on("error", (err) => console.error(`[ssh] ${ssh.host}:${ssh.port}: ${err.message}`));
+  const sockets = /* @__PURE__ */ new Set();
+  let forwardError;
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.destroy());
+    client.forwardOut(socket.localAddress ?? "127.0.0.1", socket.localPort ?? 0, target.host, target.port, (err, stream) => {
+      if (err) {
+        const local = /^(localhost|127\.0\.0\.1|::1)$/i.test(target.host);
+        const hint = local ? `"${target.host}" is resolved on the jump host itself; use the database's real address (e.g. the RDS endpoint) as the database host` : "is the database reachable from the jump host, and does it allow TCP forwarding?";
+        forwardError = `SSH port forwarding to ${target.host}:${target.port} failed: ${err.message} (${hint})`;
+        console.error(`[ssh] ${forwardError}`);
+        socket.destroy();
+        return;
+      }
+      stream.on("error", () => socket.destroy());
+      socket.pipe(stream).pipe(socket);
+      stream.once("close", () => socket.destroy());
+      socket.once("close", () => stream.destroy());
+    });
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve3());
+  }).catch((err) => {
+    client.end();
+    throw new TunnelError(`Could not open local tunnel port: ${err.message}`, 400);
+  });
+  const { port } = server.address();
+  let closed = false;
+  const close = () => new Promise((resolve3) => {
+    if (closed) return resolve3();
+    closed = true;
+    for (const s of sockets) s.destroy();
+    server.close(() => {
+      client.end();
+      resolve3();
+    });
+  });
+  client.once("close", () => void close());
+  return {
+    host: "127.0.0.1",
+    port,
+    get forwardError() {
+      return forwardError;
+    },
+    close
+  };
+}
 
 // src/drivers/index.ts
 var factories = {
@@ -1463,6 +1466,7 @@ function tunneled(driver, tunnel, label) {
     type: driver.type,
     label,
     query: (sql2, database) => driver.query(sql2, database),
+    setReadOnly: driver.setReadOnly ? () => driver.setReadOnly() : void 0,
     async close() {
       try {
         await driver.close();
@@ -1522,6 +1526,59 @@ function testDirect(config) {
   }
 }
 
+// src/gateway.ts
+function loadGatewayConfig(file) {
+  const path = resolve2(file);
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new Error(`Cannot read gateway config ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const data = raw;
+  if (!data || typeof data !== "object" || !Array.isArray(data.profiles) || data.profiles.length === 0) {
+    throw new Error(`Gateway config ${path} needs a non-empty "profiles" array`);
+  }
+  const names = /* @__PURE__ */ new Set();
+  const profiles = data.profiles.map((entry, i) => {
+    const e = entry ?? {};
+    const name = typeof e.name === "string" ? e.name.trim() : "";
+    if (!name) throw new Error(`Gateway profile #${i + 1} has no "name"`);
+    if (names.has(name)) throw new Error(`Gateway profile name is not unique: ${name}`);
+    names.add(name);
+    const { name: _n, readOnly, ...driver } = e;
+    void _n;
+    let config;
+    try {
+      config = parseDriverConfig(driver);
+    } catch (err) {
+      throw new Error(`Gateway profile "${name}": ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { name, readOnly: readOnly !== false, config };
+  });
+  return { name: typeof data.name === "string" && data.name.trim() ? data.name.trim() : "Planche gateway", profiles };
+}
+function describeProfile(entry) {
+  const c = entry.config;
+  const database = "database" in c && typeof c.database === "string" ? c.database : c.driver === "oracle" ? c.serviceName : void 0;
+  return { name: entry.name, driver: c.driver, readOnly: entry.readOnly, ...database ? { database } : {} };
+}
+
+// src/index.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join5 } from "path";
+import { fileURLToPath } from "url";
+
+// src/server.ts
+import express from "express";
+import { createHash as createHash2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// ../shared/contract.ts
+var PROTOCOL_VERSION = 2;
+
+// src/tunneling.ts
+import { randomUUID } from "crypto";
+
 // src/drivers/connection-lost.ts
 var ConnectionLostError = class extends Error {
   status = 404;
@@ -1585,12 +1642,105 @@ function isConnectionLost(err) {
   return e.originalError !== void 0 && e.originalError !== err && isConnectionLost(e.originalError);
 }
 
+// src/read-only.ts
+var ReadOnlyViolation = class extends Error {
+  status = 403;
+  constructor(message) {
+    super(message);
+    this.name = "ReadOnlyViolation";
+  }
+};
+var READ_KEYWORDS = /* @__PURE__ */ new Set(["SELECT", "WITH", "SHOW", "DESCRIBE", "DESC", "EXPLAIN", "VALUES", "TABLE", "PRAGMA"]);
+function splitStatements(sql2) {
+  const out = [];
+  let cur = "";
+  let i = 0;
+  const n = sql2.length;
+  while (i < n) {
+    const ch = sql2[i];
+    const next = sql2[i + 1];
+    if (ch === "-" && next === "-") {
+      while (i < n && sql2[i] !== "\n") i++;
+      cur += " ";
+      continue;
+    }
+    if (ch === "#") {
+      while (i < n && sql2[i] !== "\n") i++;
+      cur += " ";
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < n && !(sql2[i] === "*" && sql2[i + 1] === "/")) i++;
+      i += 2;
+      cur += " ";
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`" || ch === "[") {
+      const close = ch === "[" ? "]" : ch;
+      i++;
+      while (i < n) {
+        if (sql2[i] === "\\" && close === "'") {
+          i += 2;
+          continue;
+        }
+        if (sql2[i] === close) {
+          if (sql2[i + 1] === close && close !== "]") {
+            i += 2;
+            continue;
+          }
+          break;
+        }
+        i++;
+      }
+      i++;
+      cur += ch === "[" ? " x " : " 'x' ";
+      continue;
+    }
+    if (ch === "$" && next === "$") {
+      const end = sql2.indexOf("$$", i + 2);
+      i = end === -1 ? n : end + 2;
+      cur += " 'x' ";
+      continue;
+    }
+    if (ch === ";") {
+      out.push(cur);
+      cur = "";
+      i++;
+      continue;
+    }
+    cur += ch;
+    i++;
+  }
+  out.push(cur);
+  return out.map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function assertReadOnlyStatement(sql2) {
+  const statements = splitStatements(sql2);
+  if (statements.length === 0) return;
+  if (statements.length > 1) throw new ReadOnlyViolation("Read-only profile: one statement per request");
+  const stmt = statements[0];
+  const first = /^[A-Za-z]+/.exec(stmt)?.[0].toUpperCase() ?? "";
+  if (!READ_KEYWORDS.has(first)) throw new ReadOnlyViolation(`Read-only profile: ${first || "this statement"} is not allowed`);
+  if (first === "WITH") {
+    const words = stmt.toUpperCase().match(/\b(INSERT|UPDATE|DELETE|MERGE|REPLACE)\b/);
+    if (words) throw new ReadOnlyViolation(`Read-only profile: ${words[1]} inside WITH is not allowed`);
+  }
+  if (first === "PRAGMA" && /[=(]/.test(stmt)) throw new ReadOnlyViolation("Read-only profile: PRAGMA may only read");
+  if (/\bINTO\s+(OUTFILE|DUMPFILE)\b/i.test(stmt)) throw new ReadOnlyViolation("Read-only profile: INTO OUTFILE is not allowed");
+  if (/\bFOR\s+(UPDATE|SHARE|NO\s+KEY\s+UPDATE|KEY\s+SHARE)\b/i.test(stmt)) throw new ReadOnlyViolation("Read-only profile: locking reads are not allowed");
+  if (/\bLOCK\s+IN\s+SHARE\s+MODE\b/i.test(stmt)) throw new ReadOnlyViolation("Read-only profile: locking reads are not allowed");
+  if (first === "SELECT" && /\bINTO\b/i.test(stmt) && !/\bINTO\s+@/i.test(stmt)) throw new ReadOnlyViolation("Read-only profile: SELECT INTO is not allowed");
+}
+
 // src/tunneling.ts
 var IDLE_TIMEOUT_MS = Number(process.env.PLANCHE_IDLE_TIMEOUT_MS) || 30 * 60 * 1e3;
 var MAX_CONNECTIONS = Number(process.env.PLANCHE_MAX_CONNECTIONS) || 64;
 var ConnectionManager = class {
   connections = /* @__PURE__ */ new Map();
   lastUsed = /* @__PURE__ */ new Map();
+  /** Connections opened for a read-only gateway profile: writes are refused before reaching the driver. */
+  readOnly = /* @__PURE__ */ new Set();
   constructor() {
     const timer = setInterval(() => void this.closeIdle(), 6e4);
     timer.unref();
@@ -1608,14 +1758,23 @@ var ConnectionManager = class {
   /**
    * Open a new connection and return a unique connection ID.
    */
-  async connect(config) {
+  async connect(config, options = {}) {
     if (this.connections.size >= MAX_CONNECTIONS) {
       throw new Error(`Too many open connections (${MAX_CONNECTIONS}); disconnect some first`);
     }
     const driver = await openDriver(config);
+    if (options.readOnly && driver.setReadOnly) {
+      try {
+        await driver.setReadOnly();
+      } catch (err) {
+        await driver.close().catch(() => void 0);
+        throw err;
+      }
+    }
     const connectionId = randomUUID();
     this.connections.set(connectionId, driver);
     this.lastUsed.set(connectionId, Date.now());
+    if (options.readOnly) this.readOnly.add(connectionId);
     console.log(`[ConnectionManager] New ${driver.type} connection: ${connectionId} -> ${driver.label}`);
     return connectionId;
   }
@@ -1632,6 +1791,7 @@ var ConnectionManager = class {
       throw new Error(`Connection not found: ${connectionId}`);
     }
     this.lastUsed.set(connectionId, Date.now());
+    if (this.readOnly.has(connectionId)) assertReadOnlyStatement(sql2);
     try {
       return await driver.query(sql2, database);
     } catch (err) {
@@ -1639,6 +1799,7 @@ var ConnectionManager = class {
       console.log(`[ConnectionManager] Connection lost, evicting: ${connectionId}`);
       this.connections.delete(connectionId);
       this.lastUsed.delete(connectionId);
+      this.readOnly.delete(connectionId);
       await driver.close().catch(() => void 0);
       throw new ConnectionLostError(`Connection lost: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -1654,6 +1815,7 @@ var ConnectionManager = class {
     await driver.close();
     this.connections.delete(connectionId);
     this.lastUsed.delete(connectionId);
+    this.readOnly.delete(connectionId);
     console.log(`[ConnectionManager] Disconnected: ${connectionId}`);
   }
   /**
@@ -1685,10 +1847,13 @@ var ConnectionManager = class {
     await Promise.all(promises);
     this.connections.clear();
     this.lastUsed.clear();
+    this.readOnly.clear();
   }
 };
 
 // src/server.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
 function errorStatus(err) {
   const status = err?.status;
   return typeof status === "number" && status >= 400 && status < 600 ? status : 400;
@@ -1810,6 +1975,7 @@ function createAgent(options) {
     next();
   });
   app.use(accessControl(allowedOrigins));
+  if (options.appDir) serveApp(app, options.appDir);
   app.get("/health", (req, res) => {
     const body = {
       success: true,
@@ -1819,6 +1985,7 @@ function createAgent(options) {
       activeConnections: manager.activeConnections,
       uptime: process.uptime()
     };
+    if (options.gateway) body.gateway = { name: options.gateway.name, profiles: options.gateway.profiles.length };
     if (req.headers.authorization !== void 0) {
       if (throttle.locked(peerOf(req))) {
         fail(res, 429, "Too many failed authentication attempts; try again shortly");
@@ -1855,10 +2022,28 @@ function createAgent(options) {
     next();
   });
   app.use(express.json({ limit: options.bodyLimit }));
+  app.get("/profiles", (_req, res) => {
+    if (!options.gateway) {
+      fail(res, 404, "Not a gateway");
+      return;
+    }
+    const body = { success: true, gateway: options.gateway.name, profiles: options.gateway.profiles.map(describeProfile) };
+    res.json(body);
+  });
+  const resolveConnect = (body) => {
+    const b = body ?? {};
+    if (options.gateway) {
+      if (typeof b.profile !== "string") throw Object.assign(new Error("Gateway mode: choose a profile (POST { profile })"), { status: 403 });
+      const entry = options.gateway.profiles.find((p) => p.name === b.profile);
+      if (!entry) throw Object.assign(new Error(`Unknown gateway profile: ${b.profile}`), { status: 404 });
+      return { config: entry.config, readOnly: entry.readOnly };
+    }
+    return { config: parseDriverConfig(b), readOnly: false };
+  };
   app.post("/connect", async (req, res) => {
     try {
-      const config = parseDriverConfig(req.body ?? {});
-      const connectionId = await manager.connect(config);
+      const { config, readOnly } = resolveConnect(req.body);
+      const connectionId = await manager.connect(config, { readOnly });
       res.json({ success: true, connectionId, message: "Connection Successful" });
     } catch (err) {
       const message = errorMessage(err);
@@ -1920,7 +2105,7 @@ function createAgent(options) {
   });
   app.post("/test-connection", async (req, res) => {
     try {
-      await manager.testConnection(parseDriverConfig(req.body ?? {}));
+      await manager.testConnection(resolveConnect(req.body).config);
       res.json({ success: true, message: "Connection test successful" });
     } catch (err) {
       const message = errorMessage(err);
@@ -1938,6 +2123,45 @@ function createAgent(options) {
   });
   return { app, manager };
 }
+function serveApp(app, appDir) {
+  const csp = [
+    "default-src 'self'",
+    "script-src 'self' 'wasm-unsafe-eval'",
+    "connect-src 'self'",
+    "img-src 'self' data: blob:",
+    "style-src 'self' 'unsafe-inline'",
+    "font-src 'self' data:",
+    "worker-src 'self' blob:",
+    "child-src 'self' blob:",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'"
+  ].join("; ");
+  const indexFile = join4(appDir, "index.html");
+  const indexHtml = existsSync2(indexFile) ? readFileSync2(indexFile, "utf8").replace("<head>", '<head>\n    <meta name="planche-agent" content="same-origin" />') : null;
+  const headers = (res) => {
+    res.setHeader("Content-Security-Policy", csp);
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+  };
+  app.get(["/", "/index.html"], (_req, res) => {
+    if (!indexHtml) {
+      fail(res, 404, "App not bundled");
+      return;
+    }
+    headers(res);
+    res.type("html").send(indexHtml);
+  });
+  app.use(express.static(appDir, {
+    index: false,
+    setHeaders: (res, path) => {
+      if (path.endsWith(".html")) headers(res);
+      if (/\/assets\//.test(path)) res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+    }
+  }));
+}
 
 // src/index.ts
 var { version: VERSION } = createRequire(import.meta.url)("../package.json");
@@ -1962,6 +2186,12 @@ Options:
       --origin <url>   Extra browser origin allowed to use the agent (repeatable,
                        env PLANCHE_ALLOWED_ORIGINS as a comma-separated list)
       --allow-remote   Required with a non-loopback --addr (see README: no TLS)
+      --gateway <file> Gateway mode: serve named read-only profiles from a JSON
+                       config instead of accepting credentials (env PLANCHE_GATEWAY)
+      --public-url <u> URL users open when the agent serves the app itself
+                       (behind your TLS proxy; env PLANCHE_PUBLIC_URL)
+      --no-serve-app   Do not serve the bundled web app at / (served by default
+                       in gateway mode)
       --no-open        Do not open the browser
       --verbose        Log every request
   -v, --version        Print the version
@@ -2011,6 +2241,9 @@ function main() {
         verbose: { type: "boolean" },
         "allow-remote": { type: "boolean" },
         "print-token": { type: "boolean" },
+        gateway: { type: "string" },
+        "public-url": { type: "string" },
+        "serve-app": { type: "boolean" },
         version: { type: "boolean", short: "v" },
         help: { type: "boolean", short: "h" }
       },
@@ -2035,7 +2268,24 @@ function main() {
   const addr = flags.addr ?? process.env.PLANCHE_ADDR ?? "127.0.0.1";
   const tokenFromEnv = !flags.token && !!process.env.PLANCHE_AUTH_TOKEN;
   const authToken = flags.token ?? process.env.PLANCHE_AUTH_TOKEN ?? randomUUID2();
-  const appUrl = (flags.app ?? process.env.PLANCHE_APP_URL ?? DEFAULT_APP_URL).replace(/\/+$/, "");
+  const gatewayFile = flags.gateway ?? process.env.PLANCHE_GATEWAY;
+  let gateway;
+  if (gatewayFile) {
+    try {
+      gateway = loadGatewayConfig(gatewayFile);
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(2);
+    }
+  }
+  const appDir = fileURLToPath(new URL("../app/", import.meta.url));
+  const serveApp2 = flags["serve-app"] ?? Boolean(gateway);
+  if (serveApp2 && !existsSync3(join5(appDir, "index.html"))) {
+    console.error(`The web app is not bundled with this build (${appDir}); run without --serve-app or use the npm package.`);
+    process.exit(2);
+  }
+  const publicUrl = (flags["public-url"] ?? process.env.PLANCHE_PUBLIC_URL ?? "").replace(/\/+$/, "");
+  const appUrl = (serveApp2 ? publicUrl || null : null) ?? (flags.app ?? process.env.PLANCHE_APP_URL ?? DEFAULT_APP_URL).replace(/\/+$/, "");
   const shouldOpen = flags.open ?? true;
   const bodyLimit = process.env.PLANCHE_BODY_LIMIT || "50mb";
   const appOrigin = originOf(appUrl);
@@ -2068,6 +2318,7 @@ function main() {
   }
   const devApp = LOOPBACK_ADDRS.has(new URL(appUrl).hostname);
   const allowedOrigins = [appOrigin, ...devApp ? DEV_ORIGINS : [], ...extraOrigins];
+  if (serveApp2) allowedOrigins.push(`http://127.0.0.1:${port}`, `http://localhost:${port}`, `http://[::1]:${port}`);
   const pairingCode = { code: randomUUID2(), expiresAt: Date.now() + 10 * 60 * 1e3 };
   const listenAddr = addr.replace(/^\[(.*)\]$/, "$1");
   const agentUrl = `http://${listenAddr.includes(":") ? `[${listenAddr}]` : listenAddr}:${port}`;
@@ -2079,9 +2330,11 @@ function main() {
     logRequests: flags.verbose ?? false,
     // Browsers omit a default port from `Host`, so the bare names are allowed too.
     allowedHosts: loopback ? ["127.0.0.1", "localhost", "[::1]", `127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`] : void 0,
-    pairingCode
+    pairingCode,
+    gateway,
+    appDir: serveApp2 ? appDir : void 0
   });
-  const pairUrl = `${appUrl}/#agent=${encodeURIComponent(agentUrl)}&pair=${encodeURIComponent(pairingCode.code)}`;
+  const pairUrl = serveApp2 ? `${publicUrl || agentUrl}/#pair=${encodeURIComponent(pairingCode.code)}` : `${appUrl}/#agent=${encodeURIComponent(agentUrl)}&pair=${encodeURIComponent(pairingCode.code)}`;
   const server = app.listen(port, listenAddr, () => {
     const line = "-".repeat(72);
     console.log(line);