sql-preview 0.6.1 → 0.6.3

package/out/server/standalone.js

@@ -19037,7 +19037,7 @@ var require_mime_types = __commonJS({
     exports.charset = charset;
     exports.charsets = { lookup: charset };
     exports.contentType = contentType;
-    exports.extension = extension;
+    exports.extension = extension2;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
     exports.types = /* @__PURE__ */ Object.create(null);
@@ -19072,7 +19072,7 @@ var require_mime_types = __commonJS({
       }
       return mime;
     }
-    function extension(type) {
+    function extension2(type) {
       if (!type || typeof type !== "string") {
         return false;
       }
@@ -19087,11 +19087,11 @@ var require_mime_types = __commonJS({
       if (!path8 || typeof path8 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path8).toLowerCase().slice(1);
-      if (!extension2) {
+      var extension3 = extname("x." + path8).toLowerCase().slice(1);
+      if (!extension3) {
         return false;
       }
-      return exports.types[extension2] || false;
+      return exports.types[extension3] || false;
     }
     function populateMaps(extensions, types) {
       Object.keys(db).forEach(function forEachMimeType(type) {
@@ -19102,15 +19102,15 @@ var require_mime_types = __commonJS({
         }
         extensions[type] = exts;
         for (var i = 0; i < exts.length; i++) {
-          var extension2 = exts[i];
-          types[extension2] = _preferredType(extension2, types[extension2], type);
+          var extension3 = exts[i];
+          types[extension3] = _preferredType(extension3, types[extension3], type);
           const legacyType = _preferredTypeLegacy(
-            extension2,
-            types[extension2],
+            extension3,
+            types[extension3],
             type
           );
-          if (legacyType !== types[extension2]) {
-            exports._extensionConflicts.push([extension2, legacyType, types[extension2]]);
+          if (legacyType !== types[extension3]) {
+            exports._extensionConflicts.push([extension3, legacyType, types[extension3]]);
           }
         }
       });
@@ -19124,7 +19124,7 @@ var require_mime_types = __commonJS({
       var SOURCE_RANK = ["nginx", "apache", void 0, "iana"];
       var score0 = type0 ? SOURCE_RANK.indexOf(db[type0].source) : 0;
       var score1 = type1 ? SOURCE_RANK.indexOf(db[type1].source) : 0;
-      if (exports.types[extension] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension]?.slice(0, 12) === "application/")) {
+      if (exports.types[extension2] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension2]?.slice(0, 12) === "application/")) {
         return type0;
       }
       return score0 > score1 ? type0 : type1;
@@ -19555,10 +19555,7 @@ var require_json = __commonJS({
       var index = str.indexOf(char);
       var partial2 = "";
       if (index !== -1) {
-        partial2 = str.substring(0, index) + JSON_SYNTAX_CHAR;
-        for (var i = index + 1; i < str.length; i++) {
-          partial2 += JSON_SYNTAX_CHAR;
-        }
+        partial2 = str.substring(0, index) + JSON_SYNTAX_CHAR.repeat(str.length - index);
       }
       try {
         JSON.parse(partial2);
@@ -21634,7 +21631,7 @@ var require_stringify = __commonJS({
       }
       if (obj === null) {
         if (strictNullHandling) {
-          return encoder && !encodeValuesOnly ? encoder(prefix, defaults2.encoder, charset, "key", format) : prefix;
+          return formatter(encoder && !encodeValuesOnly ? encoder(prefix, defaults2.encoder, charset, "key", format) : prefix);
         }
         obj = "";
       }
@@ -21652,7 +21649,9 @@ var require_stringify = __commonJS({
       var objKeys;
       if (generateArrayPrefix === "comma" && isArray2(obj)) {
         if (encodeValuesOnly && encoder) {
-          obj = utils.maybeMap(obj, encoder);
+          obj = utils.maybeMap(obj, function(v) {
+            return v == null ? v : encoder(v);
+          });
         }
         objKeys = [{ value: obj.length > 0 ? obj.join(",") || null : void 0 }];
       } else if (isArray2(filter2)) {
@@ -21790,6 +21789,9 @@ var require_stringify = __commonJS({
       var sideChannel = getSideChannel();
       for (var i = 0; i < objKeys.length; ++i) {
         var key = objKeys[i];
+        if (typeof key === "undefined" || key === null) {
+          continue;
+        }
         var value = obj[key];
         if (options.skipNulls && value === null) {
           continue;
@@ -21819,9 +21821,9 @@ var require_stringify = __commonJS({
       var prefix = options.addQueryPrefix === true ? "?" : "";
       if (options.charsetSentinel) {
         if (options.charset === "iso-8859-1") {
-          prefix += "utf8=%26%2310003%3B&";
+          prefix += "utf8=%26%2310003%3B" + options.delimiter;
         } else {
-          prefix += "utf8=%E2%9C%93&";
+          prefix += "utf8=%E2%9C%93" + options.delimiter;
         }
       }
       return joined.length > 0 ? prefix + joined : "";
@@ -22004,8 +22006,8 @@ var require_parse = __commonJS({
       }
       return leaf;
     };
-    var splitKeyIntoSegments = function splitKeyIntoSegments2(givenKey, options) {
-      var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, "[$1]") : givenKey;
+    var splitKeyIntoSegments = function splitKeyIntoSegments2(originalKey, options) {
+      var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, "[$1]") : originalKey;
       if (options.depth <= 0) {
         if (!options.plainObjects && has.call(Object.prototype, key)) {
           if (!options.allowPrototypes) {
@@ -22014,37 +22016,56 @@ var require_parse = __commonJS({
         }
         return [key];
       }
-      var brackets = /(\[[^[\]]*])/;
-      var child = /(\[[^[\]]*])/g;
-      var segment = brackets.exec(key);
-      var parent = segment ? key.slice(0, segment.index) : key;
-      var keys = [];
+      var segments = [];
+      var first = key.indexOf("[");
+      var parent = first >= 0 ? key.slice(0, first) : key;
       if (parent) {
         if (!options.plainObjects && has.call(Object.prototype, parent)) {
           if (!options.allowPrototypes) {
             return;
           }
         }
-        keys[keys.length] = parent;
+        segments[segments.length] = parent;
       }
-      var i = 0;
-      while ((segment = child.exec(key)) !== null && i < options.depth) {
-        i += 1;
-        var segmentContent = segment[1].slice(1, -1);
-        if (!options.plainObjects && has.call(Object.prototype, segmentContent)) {
-          if (!options.allowPrototypes) {
-            return;
+      var n = key.length;
+      var open = first;
+      var collected = 0;
+      while (open >= 0 && collected < options.depth) {
+        var level = 1;
+        var i = open + 1;
+        var close = -1;
+        while (i < n && close < 0) {
+          var cu = key.charCodeAt(i);
+          if (cu === 91) {
+            level += 1;
+          } else if (cu === 93) {
+            level -= 1;
+            if (level === 0) {
+              close = i;
+            }
           }
+          i += 1;
         }
-        keys[keys.length] = segment[1];
+        if (close < 0) {
+          segments[segments.length] = "[" + key.slice(open) + "]";
+          return segments;
+        }
+        var seg = key.slice(open, close + 1);
+        var content = seg.slice(1, -1);
+        if (!options.plainObjects && has.call(Object.prototype, content) && !options.allowPrototypes) {
+          return;
+        }
+        segments[segments.length] = seg;
+        collected += 1;
+        open = key.indexOf("[", close + 1);
       }
-      if (segment) {
+      if (open >= 0) {
         if (options.strictDepth === true) {
           throw new RangeError("Input depth exceeded depth option of " + options.depth + " and strictDepth is true");
         }
-        keys[keys.length] = "[" + key.slice(segment.index) + "]";
+        segments[segments.length] = "[" + key.slice(open) + "]";
       }
-      return keys;
+      return segments;
     };
     var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
       if (!givenKey) {
@@ -22194,7 +22215,7 @@ var require_urlencoded = __commonJS({
             type: "parameters.too.many"
           });
         }
-        var arrayLimit = extended ? Math.max(100, paramCount) : 0;
+        var arrayLimit = extended ? Math.max(100, paramCount) : paramCount;
         debug("parse " + (extended ? "extended " : "") + "urlencoding");
         try {
           return qs.parse(body, {
@@ -22306,8 +22327,8 @@ var require_escape_html = __commonJS({
   "node_modules/escape-html/index.js"(exports, module2) {
     "use strict";
     var matchHtmlRegExp = /["'&<>]/;
-    module2.exports = escapeHtml;
-    function escapeHtml(string3) {
+    module2.exports = escapeHtml2;
+    function escapeHtml2(string3) {
       var str = "" + string3;
       var match = matchHtmlRegExp.exec(str);
       if (!match) {
@@ -22432,13 +22453,13 @@ var require_finalhandler = __commonJS({
     "use strict";
     var debug = require_src()("finalhandler");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var onFinished = require_on_finished();
     var parseUrl2 = require_parseurl();
     var statuses = require_statuses();
     var isFinished = onFinished.isFinished;
     function createHtmlDocument(message) {
-      var body = escapeHtml(message).replaceAll("\n", "<br>").replaceAll("  ", " &nbsp;");
+      var body = escapeHtml2(message).replaceAll("\n", "<br>").replaceAll("  ", " &nbsp;");
       return '<!DOCTYPE html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>Error</title>\n</head>\n<body>\n<pre>' + body + "</pre>\n</body>\n</html>\n";
     }
     module2.exports = finalhandler;
@@ -22652,14 +22673,14 @@ var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports, module2) {
     "use strict";
     module2.exports = etag;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var Stats = require("fs").Stats;
     var toString3 = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash = crypto6.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash = crypto7.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash + '"';
     }
@@ -32100,7 +32121,7 @@ var require_mime_types2 = __commonJS({
     exports.charset = charset;
     exports.charsets = { lookup: charset };
     exports.contentType = contentType;
-    exports.extension = extension;
+    exports.extension = extension2;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
     exports.types = /* @__PURE__ */ Object.create(null);
@@ -32135,7 +32156,7 @@ var require_mime_types2 = __commonJS({
       }
       return mime;
     }
-    function extension(type) {
+    function extension2(type) {
       if (!type || typeof type !== "string") {
         return false;
       }
@@ -32150,11 +32171,11 @@ var require_mime_types2 = __commonJS({
       if (!path8 || typeof path8 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path8).toLowerCase().slice(1);
-      if (!extension2) {
+      var extension3 = extname("x." + path8).toLowerCase().slice(1);
+      if (!extension3) {
         return false;
       }
-      return exports.types[extension2] || false;
+      return exports.types[extension3] || false;
     }
     function populateMaps(extensions, types) {
       Object.keys(db).forEach(function forEachMimeType(type) {
@@ -32165,15 +32186,15 @@ var require_mime_types2 = __commonJS({
         }
         extensions[type] = exts;
         for (var i = 0; i < exts.length; i++) {
-          var extension2 = exts[i];
-          types[extension2] = _preferredType(extension2, types[extension2], type);
+          var extension3 = exts[i];
+          types[extension3] = _preferredType(extension3, types[extension3], type);
           const legacyType = _preferredTypeLegacy(
-            extension2,
-            types[extension2],
+            extension3,
+            types[extension3],
             type
           );
-          if (legacyType !== types[extension2]) {
-            exports._extensionConflicts.push([extension2, legacyType, types[extension2]]);
+          if (legacyType !== types[extension3]) {
+            exports._extensionConflicts.push([extension3, legacyType, types[extension3]]);
           }
         }
       });
@@ -32187,7 +32208,7 @@ var require_mime_types2 = __commonJS({
       var SOURCE_RANK = ["nginx", "apache", void 0, "iana"];
       var score0 = type0 ? SOURCE_RANK.indexOf(db[type0].source) : 0;
       var score1 = type1 ? SOURCE_RANK.indexOf(db[type1].source) : 0;
-      if (exports.types[extension] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension]?.slice(0, 12) === "application/")) {
+      if (exports.types[extension2] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension2]?.slice(0, 12) === "application/")) {
         return type0;
       }
       return score0 > score1 ? type0 : type1;
@@ -34413,8 +34434,8 @@ var require_application = __commonJS({
       if (typeof fn !== "function") {
         throw new Error("callback function required");
       }
-      var extension = ext[0] !== "." ? "." + ext : ext;
-      this.engines[extension] = fn;
+      var extension2 = ext[0] !== "." ? "." + ext : ext;
+      this.engines[extension2] = fn;
       return this;
     };
     app.param = function param(name, fn) {
@@ -44473,7 +44494,7 @@ var require_mime_types3 = __commonJS({
     exports.charset = charset;
     exports.charsets = { lookup: charset };
     exports.contentType = contentType;
-    exports.extension = extension;
+    exports.extension = extension2;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
     exports.types = /* @__PURE__ */ Object.create(null);
@@ -44508,7 +44529,7 @@ var require_mime_types3 = __commonJS({
       }
       return mime;
     }
-    function extension(type) {
+    function extension2(type) {
       if (!type || typeof type !== "string") {
         return false;
       }
@@ -44523,11 +44544,11 @@ var require_mime_types3 = __commonJS({
       if (!path8 || typeof path8 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path8).toLowerCase().slice(1);
-      if (!extension2) {
+      var extension3 = extname("x." + path8).toLowerCase().slice(1);
+      if (!extension3) {
         return false;
       }
-      return exports.types[extension2] || false;
+      return exports.types[extension3] || false;
     }
     function populateMaps(extensions, types) {
       Object.keys(db).forEach(function forEachMimeType(type) {
@@ -44538,15 +44559,15 @@ var require_mime_types3 = __commonJS({
         }
         extensions[type] = exts;
         for (var i = 0; i < exts.length; i++) {
-          var extension2 = exts[i];
-          types[extension2] = _preferredType(extension2, types[extension2], type);
+          var extension3 = exts[i];
+          types[extension3] = _preferredType(extension3, types[extension3], type);
           const legacyType = _preferredTypeLegacy(
-            extension2,
-            types[extension2],
+            extension3,
+            types[extension3],
             type
           );
-          if (legacyType !== types[extension2]) {
-            exports._extensionConflicts.push([extension2, legacyType, types[extension2]]);
+          if (legacyType !== types[extension3]) {
+            exports._extensionConflicts.push([extension3, legacyType, types[extension3]]);
           }
         }
       });
@@ -44560,7 +44581,7 @@ var require_mime_types3 = __commonJS({
       var SOURCE_RANK = ["nginx", "apache", void 0, "iana"];
       var score0 = type0 ? SOURCE_RANK.indexOf(db[type0].source) : 0;
       var score1 = type1 ? SOURCE_RANK.indexOf(db[type1].source) : 0;
-      if (exports.types[extension] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension]?.slice(0, 12) === "application/")) {
+      if (exports.types[extension2] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension2]?.slice(0, 12) === "application/")) {
         return type0;
       }
       return score0 > score1 ? type0 : type1;
@@ -45120,13 +45141,13 @@ var require_content_disposition = __commonJS({
 // node_modules/cookie-signature/index.js
 var require_cookie_signature = __commonJS({
   "node_modules/cookie-signature/index.js"(exports) {
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     exports.sign = function(val, secret) {
       if ("string" != typeof val)
         throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret)
         throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto6.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto7.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports.unsign = function(input, secret) {
       if ("string" != typeof input)
@@ -45134,7 +45155,7 @@ var require_cookie_signature = __commonJS({
       if (null == secret)
         throw new TypeError("Secret key must be provided.");
       var tentativeValue = input.slice(0, input.lastIndexOf(".")), expectedInput = exports.sign(tentativeValue, secret), expectedBuffer = Buffer.from(expectedInput), inputBuffer = Buffer.from(input);
-      return expectedBuffer.length === inputBuffer.length && crypto6.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      return expectedBuffer.length === inputBuffer.length && crypto7.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
     };
   }
 });
@@ -54721,7 +54742,7 @@ var require_mime_types4 = __commonJS({
     exports.charset = charset;
     exports.charsets = { lookup: charset };
     exports.contentType = contentType;
-    exports.extension = extension;
+    exports.extension = extension2;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
     exports.types = /* @__PURE__ */ Object.create(null);
@@ -54756,7 +54777,7 @@ var require_mime_types4 = __commonJS({
       }
       return mime;
     }
-    function extension(type) {
+    function extension2(type) {
       if (!type || typeof type !== "string") {
         return false;
       }
@@ -54771,11 +54792,11 @@ var require_mime_types4 = __commonJS({
       if (!path8 || typeof path8 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path8).toLowerCase().slice(1);
-      if (!extension2) {
+      var extension3 = extname("x." + path8).toLowerCase().slice(1);
+      if (!extension3) {
         return false;
       }
-      return exports.types[extension2] || false;
+      return exports.types[extension3] || false;
     }
     function populateMaps(extensions, types) {
       Object.keys(db).forEach(function forEachMimeType(type) {
@@ -54786,15 +54807,15 @@ var require_mime_types4 = __commonJS({
         }
         extensions[type] = exts;
         for (var i = 0; i < exts.length; i++) {
-          var extension2 = exts[i];
-          types[extension2] = _preferredType(extension2, types[extension2], type);
+          var extension3 = exts[i];
+          types[extension3] = _preferredType(extension3, types[extension3], type);
           const legacyType = _preferredTypeLegacy(
-            extension2,
-            types[extension2],
+            extension3,
+            types[extension3],
             type
           );
-          if (legacyType !== types[extension2]) {
-            exports._extensionConflicts.push([extension2, legacyType, types[extension2]]);
+          if (legacyType !== types[extension3]) {
+            exports._extensionConflicts.push([extension3, legacyType, types[extension3]]);
           }
         }
       });
@@ -54808,7 +54829,7 @@ var require_mime_types4 = __commonJS({
       var SOURCE_RANK = ["nginx", "apache", void 0, "iana"];
       var score0 = type0 ? SOURCE_RANK.indexOf(db[type0].source) : 0;
       var score1 = type1 ? SOURCE_RANK.indexOf(db[type1].source) : 0;
-      if (exports.types[extension] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension]?.slice(0, 12) === "application/")) {
+      if (exports.types[extension2] !== "application/octet-stream" && (score0 > score1 || score0 === score1 && exports.types[extension2]?.slice(0, 12) === "application/")) {
         return type0;
       }
       return score0 > score1 ? type0 : type1;
@@ -54823,7 +54844,7 @@ var require_send = __commonJS({
     var createError = require_http_errors();
     var debug = require_src()("send");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
     var fs11 = require("fs");
@@ -54876,7 +54897,7 @@ var require_send = __commonJS({
       }
       var res = this.res;
       var msg = statuses.message[status] || String(status);
-      var doc = createHtmlDocument("Error", escapeHtml(msg));
+      var doc = createHtmlDocument("Error", escapeHtml2(msg));
       clearHeaders(res);
       if (err && err.headers) {
         setHeaders(res, err.headers);
@@ -54976,7 +54997,7 @@ var require_send = __commonJS({
         return;
       }
       var loc = encodeUrl(collapseLeadingSlashes(this.path + "/"));
-      var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml(loc));
+      var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml2(loc));
       res.statusCode = 301;
       res.setHeader("Content-Type", "text/html; charset=UTF-8");
       res.setHeader("Content-Length", Buffer.byteLength(doc));
@@ -55390,7 +55411,7 @@ var require_response = __commonJS({
     var createError = require_http_errors();
     var deprecate = require_depd()("express");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var http4 = require("node:http");
     var onFinished = require_on_finished();
     var mime = require_mime_types2();
@@ -55732,7 +55753,7 @@ var require_response = __commonJS({
           body = statuses.message[status] + ". Redirecting to " + address;
         },
         html: function() {
-          var u = escapeHtml(address);
+          var u = escapeHtml2(address);
           body = "<p>" + statuses.message[status] + ". Redirecting to " + u + "</p>";
         },
         default: function() {
@@ -55868,7 +55889,7 @@ var require_serve_static = __commonJS({
   "node_modules/serve-static/index.js"(exports, module2) {
     "use strict";
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var parseUrl2 = require_parseurl();
     var resolve2 = require("path").resolve;
     var send = require_send();
@@ -55954,7 +55975,7 @@ var require_serve_static = __commonJS({
         originalUrl.path = null;
         originalUrl.pathname = collapseLeadingSlashes(originalUrl.pathname + "/");
         var loc = encodeUrl(url2.format(originalUrl));
-        var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml(loc));
+        var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml2(loc));
         res.statusCode = 301;
         res.setHeader("Content-Type", "text/html; charset=UTF-8");
         res.setHeader("Content-Length", Buffer.byteLength(doc));
@@ -66177,7 +66198,7 @@ var require_mime_types5 = __commonJS({
     exports.charset = charset;
     exports.charsets = { lookup: charset };
     exports.contentType = contentType;
-    exports.extension = extension;
+    exports.extension = extension2;
     exports.extensions = /* @__PURE__ */ Object.create(null);
     exports.lookup = lookup;
     exports.types = /* @__PURE__ */ Object.create(null);
@@ -66211,7 +66232,7 @@ var require_mime_types5 = __commonJS({
       }
       return mime;
     }
-    function extension(type) {
+    function extension2(type) {
       if (!type || typeof type !== "string") {
         return false;
       }
@@ -66226,11 +66247,11 @@ var require_mime_types5 = __commonJS({
       if (!path8 || typeof path8 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path8).toLowerCase().substr(1);
-      if (!extension2) {
+      var extension3 = extname("x." + path8).toLowerCase().substr(1);
+      if (!extension3) {
         return false;
       }
-      return exports.types[extension2] || false;
+      return exports.types[extension3] || false;
     }
     function populateMaps(extensions, types) {
       var preference = ["nginx", "apache", void 0, "iana"];
@@ -66242,15 +66263,15 @@ var require_mime_types5 = __commonJS({
         }
         extensions[type] = exts;
         for (var i = 0; i < exts.length; i++) {
-          var extension2 = exts[i];
-          if (types[extension2]) {
-            var from = preference.indexOf(db[types[extension2]].source);
+          var extension3 = exts[i];
+          if (types[extension3]) {
+            var from = preference.indexOf(db[types[extension3]].source);
             var to = preference.indexOf(mime.source);
-            if (types[extension2] !== "application/octet-stream" && (from > to || from === to && types[extension2].substr(0, 12) === "application/")) {
+            if (types[extension3] !== "application/octet-stream" && (from > to || from === to && types[extension3].substr(0, 12) === "application/")) {
               continue;
             }
           }
-          types[extension2] = type;
+          types[extension3] = type;
         }
       });
     }
@@ -66534,7 +66555,7 @@ var require_form_data = __commonJS({
     var parseUrl2 = require("url").parse;
     var fs11 = require("fs");
     var Stream = require("stream").Stream;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var mime = require_mime_types5();
     var asynckit = require_asynckit();
     var setToStringTag = require_es_set_tostringtag();
@@ -66740,7 +66761,7 @@ var require_form_data = __commonJS({
       return Buffer.concat([dataBuffer, Buffer.from(this._lastBoundary())]);
     };
     FormData3.prototype._generateBoundary = function() {
-      this._boundary = "--------------------------" + crypto6.randomBytes(12).toString("hex");
+      this._boundary = "--------------------------" + crypto7.randomBytes(12).toString("hex");
     };
     FormData3.prototype.getLengthSync = function() {
       var knownLength = this._overheadLength + this._valueLength;
@@ -74771,6 +74792,9 @@ var src_exports7 = {};
 __export(src_exports7, {
   default: () => SnowflakeConnector
 });
+function isDriverManagerLike(value) {
+  return typeof value === "object" && value !== null && "getDriver" in value && typeof value.getDriver === "function";
+}
 function normaliseAccount(account) {
   let a = account.trim();
   a = a.replace(/\/+$/, "");
@@ -74816,6 +74840,9 @@ function mapSnowflakeTableType(tableType) {
   return "UNKNOWN";
 }
 function connectAsync(connection) {
+  if (typeof connection.connectAsync === "function") {
+    return connection.connectAsync();
+  }
   return new Promise((resolve2, reject) => {
     connection.connect((err) => {
       if (err) {
@@ -74877,10 +74904,11 @@ var init_src8 = __esm({
     init_descriptor7();
     SNOWFLAKE_SYSTEM_SCHEMAS = /* @__PURE__ */ new Set(["INFORMATION_SCHEMA"]);
     SnowflakeConnector = class {
-      constructor() {
+      constructor(driverManager) {
         this.id = "snowflake";
         this.supportsPagination = false;
         this.configSchema = snowflakeConnectorConfigSchema;
+        this.driverManager = isDriverManagerLike(driverManager) ? driverManager : { getDriver: async (driverName) => driverName };
       }
       // ── validateConfig ──────────────────────────────────────────────────────
       validateConfig(config2) {
@@ -74888,17 +74916,34 @@ var init_src8 = __esm({
         if (!cfg.account) {
           return "account is required";
         }
-        if (!cfg.username) {
+        if (!this.resolveUsername(cfg)) {
           return "username is required";
         }
+        const authMode = this.resolveAuthMode(cfg);
+        if (!["password", "keypair", "externalbrowser"].includes(authMode)) {
+          return `unsupported Snowflake auth mode: ${String(cfg.authMode)}`;
+        }
+        if (authMode === "keypair" && !cfg.privateKeyPath) {
+          return "privateKeyPath is required for Snowflake key pair authentication";
+        }
         return void 0;
       }
       // ── Private: build connection options ───────────────────────────────────
+      resolveAuthMode(cfg) {
+        if (cfg.authenticator?.trim().toLowerCase() === "externalbrowser") {
+          return "externalbrowser";
+        }
+        return cfg.authMode ?? (cfg.privateKeyPath ? "keypair" : "password");
+      }
+      resolveUsername(cfg) {
+        return cfg.username || cfg.user;
+      }
       buildConnectionOptions(cfg) {
         const account = normaliseAccount(cfg.account);
+        const authMode = this.resolveAuthMode(cfg);
         const opts = {
           account,
-          username: cfg.username,
+          username: this.resolveUsername(cfg),
           warehouse: cfg.warehouse,
           database: cfg.database,
           schema: cfg.schema,
@@ -74906,7 +74951,12 @@ var init_src8 = __esm({
           loginTimeout: cfg.loginTimeout ?? 60,
           application: cfg.application ?? "sql-preview"
         };
-        if (cfg.privateKeyPath) {
+        if (authMode === "externalbrowser") {
+          opts["authenticator"] = "EXTERNALBROWSER";
+          if (cfg.clientStoreTemporaryCredential) {
+            opts["clientStoreTemporaryCredential"] = true;
+          }
+        } else if (authMode === "keypair") {
           const keyContent = (0, import_fs.readFileSync)(cfg.privateKeyPath, "utf8");
           const pk = (0, import_crypto2.createPrivateKey)({
             key: keyContent,
@@ -74921,7 +74971,8 @@ var init_src8 = __esm({
       }
       // ── Private: create and connect ─────────────────────────────────────────
       async createConnection(cfg) {
-        const snowflake = require("snowflake-sdk");
+        const driverPath = await this.driverManager.getDriver("snowflake-sdk");
+        const snowflake = require(driverPath);
         const connection = snowflake.createConnection(this.buildConnectionOptions(cfg));
         try {
           await connectAsync(connection);
@@ -75087,6 +75138,15 @@ var init_descriptor7 = __esm({
     snowflakeConnectorConfigSchema = {
       type: "object",
       properties: {
+        authMode: {
+          type: "string",
+          title: "Authentication",
+          description: "Choose password, key-pair, or local browser SSO authentication",
+          enum: ["password", "keypair", "externalbrowser"],
+          enumNames: ["Password", "Key pair", "Browser SSO"],
+          default: "password",
+          ui: { fullWidth: true }
+        },
         account: {
           type: "string",
           title: "Account",
@@ -75097,20 +75157,51 @@ var init_descriptor7 = __esm({
           type: "string",
           title: "Password",
           description: "Password (stored securely)",
-          ui: { widget: "password" }
+          ui: { widget: "password", visibleWhen: { field: "authMode", equals: "password" } }
+        },
+        privateKeyPath: {
+          type: "string",
+          title: "Private key path",
+          description: "Absolute path to a PEM private key file",
+          ui: { visibleWhen: { field: "authMode", equals: "keypair" } }
+        },
+        privateKeyPassphrase: {
+          type: "string",
+          title: "Private key passphrase",
+          description: "Passphrase for the private key, if one is required",
+          ui: { widget: "password", visibleWhen: { field: "authMode", equals: "keypair" } }
+        },
+        clientStoreTemporaryCredential: {
+          type: "boolean",
+          title: "Cache browser SSO token",
+          description: "Requests Snowflake driver token caching when the account allows ID-token caching",
+          default: true,
+          ui: { visibleWhen: { field: "authMode", equals: "externalbrowser" }, advanced: true }
         },
         warehouse: {
           type: "string",
           title: "Warehouse",
-          description: "Virtual warehouse to use (optional)"
+          description: "Virtual warehouse to use (optional)",
+          ui: { advanced: true }
         },
         database: {
           type: "string",
           title: "Database",
-          description: "Default database (optional)"
+          description: "Default database (optional)",
+          ui: { advanced: true }
+        },
+        schema: {
+          type: "string",
+          title: "Schema",
+          description: "Default schema (optional)",
+          ui: { advanced: true }
         },
-        schema: { type: "string", title: "Schema", description: "Default schema (optional)" },
-        role: { type: "string", title: "Role", description: "Role to assume (optional)" }
+        role: {
+          type: "string",
+          title: "Role",
+          description: "Role to assume (optional)",
+          ui: { advanced: true }
+        }
       },
       required: ["account", "username"]
     };
@@ -75119,9 +75210,9 @@ var init_descriptor7 = __esm({
       displayName: "Snowflake",
       supportsPagination: false,
       configSchema: snowflakeConnectorConfigSchema,
-      create: () => {
+      create: (driverManager) => {
         const { default: SnowflakeConnector2 } = (init_src8(), __toCommonJS(src_exports7));
-        return new SnowflakeConnector2();
+        return new SnowflakeConnector2(driverManager);
       }
     };
   }
@@ -76682,6 +76773,22 @@ var init_querySplitter = __esm({
 });
 
 // src/server/DaemonMcpToolManager.ts
+function isSnowflakeBrowserSsoProfile(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const profile = value;
+  return profile["type"] === "snowflake" && (profile["authMode"] === "externalbrowser" || typeof profile["authenticator"] === "string" && profile["authenticator"].toLowerCase() === "externalbrowser");
+}
+function normalizeConnectionProfileForSave(profile) {
+  const profileToSave = { ...profile };
+  if (isSnowflakeBrowserSsoProfile(profileToSave)) {
+    profileToSave["password"] = "";
+    delete profileToSave["privateKeyPath"];
+    delete profileToSave["privateKeyPassphrase"];
+  }
+  return profileToSave;
+}
 function stripCommentsAndStrings(sql) {
   let result = "";
   let inSingleQuote = false;
@@ -76770,6 +76877,7 @@ var init_DaemonMcpToolManager = __esm({
         this.queryExecutor = queryExecutor;
         this.connectionManager = connectionManager;
         this.connectorRegistry = connectorRegistry;
+        this.options = options;
         this.safeMode = options.safeMode ?? true;
         this.queryOperationRunner = queryOperationRunner ?? new QueryOperationRunner(sessionManager, queryExecutor);
       }
@@ -76892,6 +77000,20 @@ var init_DaemonMcpToolManager = __esm({
               required: ["connectionProfile"]
             }
           },
+          {
+            name: "request_connection_credentials",
+            description: "Create a short-lived local browser form where the user can enter credentials for a saved connection without exposing the secret in the MCP transcript. Share only the returned URL with the user; never ask them to paste credentials into chat.",
+            inputSchema: {
+              type: "object",
+              properties: {
+                connectionId: {
+                  type: "string",
+                  description: "Connection ID that should receive the safely submitted password."
+                }
+              },
+              required: ["connectionId"]
+            }
+          },
           {
             name: "test_connection",
             description: "Test connectivity for a specific connection profile.",
@@ -77010,6 +77132,8 @@ var init_DaemonMcpToolManager = __esm({
             return this.handleListConnections();
           case "save_connection":
             return this.handleSaveConnection(args);
+          case "request_connection_credentials":
+            return this.handleRequestConnectionCredentials(args);
           case "test_connection":
             return this.handleTestConnection(args);
           case "delete_connection":
@@ -77181,11 +77305,45 @@ var init_DaemonMcpToolManager = __esm({
         if (!profile || !profile.id || !profile.name || !profile.type) {
           throw new Error("Invalid connection profile: missing id, name, or type");
         }
-        await this.connectionManager.saveProfile(profile);
+        const profileToSave = normalizeConnectionProfileForSave(
+          profile
+        );
+        await this.connectionManager.saveProfile(profileToSave);
         return {
           content: [{ type: "text", text: `Connection '${profile.id}' saved.` }]
         };
       }
+      async handleRequestConnectionCredentials(args) {
+        const service = this.options.credentialRequestService;
+        if (!service) {
+          throw new Error("Credential request UI is not available for this SQL Preview daemon.");
+        }
+        const connectionId = args?.connectionId;
+        if (!connectionId) {
+          throw new Error("connectionId is required");
+        }
+        const request = await service.create(connectionId);
+        return {
+          structuredContent: {
+            connectionId: request.connectionId,
+            connectionName: request.connectionName,
+            url: request.url,
+            expiresAt: new Date(request.expiresAt).toISOString()
+          },
+          content: [
+            {
+              type: "text",
+              text: `Open this one-time SQL Preview credential form for '${request.connectionName}' and enter the password there; do not paste the password into chat.
+
+${request.url}
+
+This link expires at ${new Date(
+                request.expiresAt
+              ).toISOString()}.`
+            }
+          ]
+        };
+      }
       async handleTestConnection(args) {
         const typedArgs = args;
         let typeToTest;
@@ -77681,6 +77839,7 @@ var init_DaemonQueryExecutor = __esm({
           this.logger.info(`Query execution completed for session ${sessionId}`);
         } catch (e) {
           const message = e instanceof Error ? e.message : String(e);
+          const lowerMessage = message.toLowerCase();
           const looksLikeMissingDuckDb = message.includes("@duckdb/node-api") || message.includes("Cannot find module") || message.includes("native module is not available");
           if (isAutoRoutedDuckDbFileQuery && looksLikeMissingDuckDb) {
             throw new OptionalDependencyError({
@@ -77692,6 +77851,17 @@ var init_DaemonQueryExecutor = __esm({
               cause: message
             });
           }
+          const looksLikeMissingSnowflakeSdk = message.includes("snowflake-sdk") || lowerMessage.includes("snowflake sdk") || lowerMessage.includes("sdk is not available");
+          if (profile.type === "snowflake" && looksLikeMissingSnowflakeSdk) {
+            throw new OptionalDependencyError({
+              connector: "snowflake",
+              dependency: "snowflake-sdk",
+              capability: "Snowflake connections",
+              installCommand: "npm install snowflake-sdk",
+              guidance: "Snowflake connections require optional Snowflake SDK support, but the SDK is not available in this extension runtime.",
+              cause: message
+            });
+          }
           if (querySignal.didTimeout()) {
             throw new Error(`Query timed out after ${this.queryConfig.timeoutMs}ms`);
           }
@@ -77774,6 +77944,79 @@ var init_DaemonQueryExecutor = __esm({
   }
 });
 
+// src/server/CredentialRequestService.ts
+var import_crypto3, DEFAULT_TTL_MS, CredentialRequestService;
+var init_CredentialRequestService = __esm({
+  "src/server/CredentialRequestService.ts"() {
+    "use strict";
+    import_crypto3 = __toESM(require("crypto"));
+    DEFAULT_TTL_MS = 10 * 60 * 1e3;
+    CredentialRequestService = class {
+      constructor(connectionManager, baseUrl, ttlMs = DEFAULT_TTL_MS) {
+        this.connectionManager = connectionManager;
+        this.baseUrl = baseUrl;
+        this.ttlMs = ttlMs;
+        this.requests = /* @__PURE__ */ new Map();
+      }
+      async create(connectionId) {
+        this.pruneExpired();
+        const profile = await this.connectionManager.getProfile(connectionId);
+        if (!profile) {
+          throw new Error(`Connection profile '${connectionId}' not found`);
+        }
+        const id = import_crypto3.default.randomUUID();
+        const token = import_crypto3.default.randomBytes(24).toString("base64url");
+        const request = {
+          id,
+          token,
+          connectionId,
+          connectionName: profile.name,
+          expiresAt: Date.now() + this.ttlMs,
+          url: `${this.baseUrl}/credential-requests/${encodeURIComponent(id)}?token=${encodeURIComponent(
+            token
+          )}`
+        };
+        this.requests.set(id, request);
+        return request;
+      }
+      get(id, token) {
+        this.pruneExpired();
+        const request = this.requests.get(id);
+        if (!request || request.token !== token) {
+          return void 0;
+        }
+        return request;
+      }
+      async fulfill(id, token, password) {
+        const request = this.get(id, token);
+        if (!request) {
+          throw new Error("Credential request is invalid or expired.");
+        }
+        if (!password) {
+          throw new Error("Password is required.");
+        }
+        const profile = await this.connectionManager.getProfile(request.connectionId);
+        if (!profile) {
+          throw new Error(`Connection profile '${request.connectionId}' not found`);
+        }
+        await this.connectionManager.saveProfile({
+          ...profile,
+          password
+        });
+        this.requests.delete(id);
+        return request;
+      }
+      pruneExpired(now = Date.now()) {
+        for (const [id, request] of this.requests.entries()) {
+          if (request.expiresAt <= now) {
+            this.requests.delete(id);
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/server/SessionManager.ts
 var import_events2, SessionManager;
 var init_SessionManager = __esm({
@@ -77971,6 +78214,42 @@ function registerDaemonHttpRoutes(context2, mcpHttpSurface) {
       configPath: context2.resolvedConfig.configPath
     });
   });
+  app.get("/credential-requests/:id", (req, res) => {
+    setCredentialPageHeaders(res);
+    const id = req.params.id;
+    const token = typeof req.query["token"] === "string" ? req.query["token"] : "";
+    const request = id ? context2.credentialRequestService.get(id, token) : void 0;
+    if (!request) {
+      res.status(404).send(renderCredentialPage({ error: "This credential request is invalid or expired." }));
+      return;
+    }
+    res.send(renderCredentialPage({ request }));
+  });
+  app.post(
+    "/credential-requests/:id",
+    import_express.default.urlencoded({ extended: false }),
+    async (req, res) => {
+      setCredentialPageHeaders(res);
+      const id = req.params.id;
+      const body = req.body;
+      const token = typeof body.token === "string" ? body.token : "";
+      const password = typeof body.password === "string" ? body.password : "";
+      try {
+        if (!id) {
+          throw new Error("Credential request is invalid or expired.");
+        }
+        const request = await context2.credentialRequestService.fulfill(id, token, password);
+        res.send(
+          renderCredentialPage({
+            success: `Password saved for '${request.connectionName}'. You can close this tab and ask your tool to retry the query.`
+          })
+        );
+      } catch (err) {
+        logger.warn("[Daemon] Credential request failed:", err);
+        res.status(400).send(renderCredentialPage({ error: err instanceof Error ? err.message : String(err) }));
+      }
+    }
+  );
   app.get("/embedded-app", async (_req, res) => {
     serveHtmlFile(res, "mcp-app.html", 'UI bundle not found. Please run "npm run build" first.');
   });
@@ -78154,7 +78433,7 @@ async function handleQueryRoute(context2, req, res, options) {
       res.status(400).json({ error: options.missingQueryMessage });
       return;
     }
-    const sessionId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : `${options.sessionPrefix}-${import_crypto3.default.randomUUID()}`;
+    const sessionId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : `${options.sessionPrefix}-${import_crypto4.default.randomUUID()}`;
     const controller = new AbortController();
     const cleanupDisconnectAbort = attachAbortOnHttpDisconnect(
       req,
@@ -78233,11 +78512,77 @@ function findDistFile(fileName) {
   ];
   return candidates.find((candidate) => fs6.existsSync(candidate)) || candidates[0] || fileName;
 }
-var import_crypto3, import_express, fs6, path4;
+function setCredentialPageHeaders(res) {
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+}
+function renderCredentialPage(input) {
+  const title = "SQL Preview Credential Request";
+  const message = input.success || input.error || "";
+  const escapedMessage = escapeHtml(message);
+  const request = input.request;
+  const form = request ? `<p>Enter the password for <strong>${escapeHtml(request.connectionName)}</strong>.</p>
+       <p class="hint">The password is sent directly to the local SQL Preview daemon and is not shown in the MCP/chat transcript.</p>
+       <form method="post" autocomplete="off">
+         <input type="hidden" name="token" value="${escapeHtml(request.token)}" />
+         <label for="password">Password</label>
+         <input id="password" name="password" type="password" autocomplete="current-password" autofocus required />
+         <button type="submit">Save password</button>
+       </form>
+       <p class="hint">This request expires at ${escapeHtml(new Date(request.expiresAt).toLocaleString())}.</p>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>
+    :root { color-scheme: light dark; font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: Canvas; color: CanvasText; }
+    main { width: min(92vw, 32rem); padding: 2rem; border: 1px solid color-mix(in srgb, CanvasText 18%, transparent); border-radius: 12px; box-shadow: 0 12px 40px color-mix(in srgb, CanvasText 12%, transparent); }
+    h1 { margin-top: 0; font-size: 1.35rem; }
+    label { display: block; margin-bottom: 0.4rem; font-weight: 600; }
+    input[type="password"] { box-sizing: border-box; width: 100%; padding: 0.75rem; border: 1px solid color-mix(in srgb, CanvasText 30%, transparent); border-radius: 8px; font: inherit; }
+    button { margin-top: 1rem; padding: 0.7rem 1rem; border: 0; border-radius: 8px; background: #2563eb; color: white; font: inherit; font-weight: 700; cursor: pointer; }
+    .hint { color: color-mix(in srgb, CanvasText 72%, transparent); }
+    .success { color: #15803d; }
+    .error { color: #b91c1c; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${title}</h1>
+    ${input.success ? `<p class="success">${escapedMessage}</p>` : ""}
+    ${input.error ? `<p class="error">${escapedMessage}</p>` : ""}
+    ${form}
+  </main>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case "'":
+        return "&#39;";
+      case '"':
+        return "&quot;";
+      default:
+        return char;
+    }
+  });
+}
+var import_crypto4, import_express, fs6, path4;
 var init_DaemonHttpRoutes = __esm({
   "src/server/surfaces/DaemonHttpRoutes.ts"() {
     "use strict";
-    import_crypto3 = __toESM(require("crypto"));
+    import_crypto4 = __toESM(require("crypto"));
     import_express = __toESM(require_express2());
     fs6 = __toESM(require("fs"));
     path4 = __toESM(require("path"));
@@ -78292,13 +78637,13 @@ function writeFromReadableStream(stream4, writable) {
   }
   return writeFromReadableStreamDefaultReader(stream4.getReader(), writable);
 }
-var import_http22, import_http23, import_stream5, import_crypto4, RequestError, toRequestError, GlobalRequest, Request, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, incomingDraining, DRAIN_TIMEOUT_MS, MAX_DRAIN_BYTES, drainIncoming, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener;
+var import_http22, import_http23, import_stream5, import_crypto5, RequestError, toRequestError, GlobalRequest, Request, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, incomingDraining, DRAIN_TIMEOUT_MS, MAX_DRAIN_BYTES, drainIncoming, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener;
 var init_dist = __esm({
   "node_modules/@hono/node-server/dist/index.mjs"() {
     import_http22 = require("http2");
     import_http23 = require("http2");
     import_stream5 = require("stream");
-    import_crypto4 = __toESM(require("crypto"), 1);
+    import_crypto5 = __toESM(require("crypto"), 1);
     RequestError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -78592,7 +78937,7 @@ var init_dist = __esm({
     };
     X_ALREADY_SENT = "x-hono-already-sent";
     if (typeof global.crypto === "undefined") {
-      global.crypto = import_crypto4.default;
+      global.crypto = import_crypto5.default;
     }
     outgoingEnded = Symbol("outgoingEnded");
     incomingDraining = Symbol("incomingDraining");
@@ -126667,11 +127012,11 @@ var init_McpServerFactory = __esm({
 });
 
 // src/server/surfaces/DaemonMcpHttpSurface.ts
-var import_crypto5, DaemonMcpHttpSurface;
+var import_crypto6, DaemonMcpHttpSurface;
 var init_DaemonMcpHttpSurface = __esm({
   "src/server/surfaces/DaemonMcpHttpSurface.ts"() {
     "use strict";
-    import_crypto5 = __toESM(require("crypto"));
+    import_crypto6 = __toESM(require("crypto"));
     init_streamableHttp();
     init_ConsoleLogger();
     init_logRedaction();
@@ -126751,7 +127096,7 @@ var init_DaemonMcpHttpSurface = __esm({
         if (typeof headerSessionId === "string" && headerSessionId.length > 0) {
           return headerSessionId;
         }
-        return `session-${import_crypto5.default.randomUUID()}`;
+        return `session-${import_crypto6.default.randomUUID()}`;
       }
       async getOrCreateSession(sessionId) {
         const existingSession = this.sessions.get(sessionId);
@@ -127265,7 +127610,7 @@ var require_permessage_deflate = __commonJS({
     var kBuffers = Symbol("buffers");
     var kError = Symbol("error");
     var zlibLimiter;
-    var PerMessageDeflate = class {
+    var PerMessageDeflate2 = class {
       /**
        * Creates a PerMessageDeflate instance.
        *
@@ -127276,6 +127621,9 @@ var require_permessage_deflate = __commonJS({
        *     acknowledge disabling of client context takeover
        * @param {Number} [options.concurrencyLimit=10] The number of concurrent
        *     calls to zlib
+       * @param {Boolean} [options.isServer=false] Create the instance in either
+       *     server or client mode
+       * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {(Boolean|Number)} [options.serverMaxWindowBits] Request/confirm the
        *     use of a custom server window size
        * @param {Boolean} [options.serverNoContextTakeover=false] Request/accept
@@ -127286,15 +127634,12 @@ var require_permessage_deflate = __commonJS({
        *     deflate
        * @param {Object} [options.zlibInflateOptions] Options to pass to zlib on
        *     inflate
-       * @param {Boolean} [isServer=false] Create the instance in either server or
-       *     client mode
-       * @param {Number} [maxPayload=0] The maximum allowed message length
        */
-      constructor(options, isServer, maxPayload) {
-        this._maxPayload = maxPayload | 0;
+      constructor(options) {
         this._options = options || {};
         this._threshold = this._options.threshold !== void 0 ? this._options.threshold : 1024;
-        this._isServer = !!isServer;
+        this._maxPayload = this._options.maxPayload | 0;
+        this._isServer = !!this._options.isServer;
         this._deflate = null;
         this._inflate = null;
         this.params = null;
@@ -127604,7 +127949,7 @@ var require_permessage_deflate = __commonJS({
         });
       }
     };
-    module2.exports = PerMessageDeflate;
+    module2.exports = PerMessageDeflate2;
     function deflateOnData(chunk) {
       this[kBuffers].push(chunk);
       this[kTotalLength] += chunk.length;
@@ -127839,7 +128184,7 @@ var require_receiver = __commonJS({
   "node_modules/ws/lib/receiver.js"(exports, module2) {
     "use strict";
     var { Writable } = require("stream");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var {
       BINARY_TYPES,
       EMPTY_BUFFER,
@@ -127869,6 +128214,10 @@ var require_receiver = __commonJS({
        *     extensions
        * @param {Boolean} [options.isServer=false] Specifies whether to operate in
        *     client or server mode
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -127879,6 +128228,8 @@ var require_receiver = __commonJS({
         this._binaryType = options.binaryType || BINARY_TYPES[0];
         this._extensions = options.extensions || {};
         this._isServer = !!options.isServer;
+        this._maxBufferedChunks = options.maxBufferedChunks | 0;
+        this._maxFragments = options.maxFragments | 0;
         this._maxPayload = options.maxPayload | 0;
         this._skipUTF8Validation = !!options.skipUTF8Validation;
         this[kWebSocket] = void 0;
@@ -127909,6 +128260,18 @@ var require_receiver = __commonJS({
       _write(chunk, encoding, cb) {
         if (this._opcode === 8 && this._state == GET_INFO)
           return cb();
+        if (this._maxBufferedChunks > 0 && this._buffers.length >= this._maxBufferedChunks) {
+          cb(
+            this.createError(
+              RangeError,
+              "Too many buffered chunks",
+              false,
+              1008,
+              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+            )
+          );
+          return;
+        }
         this._bufferedBytes += chunk.length;
         this._buffers.push(chunk);
         this.startLoop(cb);
@@ -128009,7 +128372,7 @@ var require_receiver = __commonJS({
           return;
         }
         const compressed = (buf[0] & 64) === 64;
-        if (compressed && !this._extensions[PerMessageDeflate.extensionName]) {
+        if (compressed && !this._extensions[PerMessageDeflate2.extensionName]) {
           const error2 = this.createError(
             RangeError,
             "RSV1 must be clear",
@@ -128246,6 +128609,17 @@ var require_receiver = __commonJS({
           return;
         }
         if (data.length) {
+          if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+            const error2 = this.createError(
+              RangeError,
+              "Too many message fragments",
+              false,
+              1008,
+              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+            );
+            cb(error2);
+            return;
+          }
           this._messageLength = this._totalPayloadLength;
           this._fragments.push(data);
         }
@@ -128259,7 +128633,7 @@ var require_receiver = __commonJS({
        * @private
        */
       decompress(data, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         perMessageDeflate.decompress(data, this._fin, (err, buf) => {
           if (err)
             return cb(err);
@@ -128276,6 +128650,17 @@ var require_receiver = __commonJS({
               cb(error2);
               return;
             }
+            if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+              const error2 = this.createError(
+                RangeError,
+                "Too many message fragments",
+                false,
+                1008,
+                "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+              );
+              cb(error2);
+              return;
+            }
             this._fragments.push(buf);
           }
           this.dataMessage(cb);
@@ -128443,7 +128828,10 @@ var require_sender = __commonJS({
     "use strict";
     var { Duplex } = require("stream");
     var { randomFillSync } = require("crypto");
-    var PerMessageDeflate = require_permessage_deflate();
+    var {
+      types: { isUint8Array }
+    } = require("util");
+    var PerMessageDeflate2 = require_permessage_deflate();
     var { EMPTY_BUFFER, kWebSocket, NOOP } = require_constants3();
     var { isBlob: isBlob2, isValidStatusCode } = require_validation3();
     var { mask: applyMask, toBuffer } = require_buffer_util();
@@ -128599,8 +128987,10 @@ var require_sender = __commonJS({
           buf.writeUInt16BE(code, 0);
           if (typeof data === "string") {
             buf.write(data, 2);
-          } else {
+          } else if (isUint8Array(data)) {
             buf.set(data, 2);
+          } else {
+            throw new TypeError("Second argument must be a string or a Uint8Array");
           }
         }
         const options = {
@@ -128730,7 +129120,7 @@ var require_sender = __commonJS({
        * @public
        */
       send(data, options, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         let opcode = options.binary ? 2 : 1;
         let rsv1 = options.compress;
         let byteLength;
@@ -128855,7 +129245,7 @@ var require_sender = __commonJS({
           this.sendFrame(Sender2.frame(data, options), cb);
           return;
         }
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         this._bufferedBytes += options[kByteLength];
         this._state = DEFLATING;
         perMessageDeflate.compress(data, options.fin, (_, buf) => {
@@ -129310,12 +129700,12 @@ var require_extension = __commonJS({
       return offers;
     }
     function format(extensions) {
-      return Object.keys(extensions).map((extension) => {
-        let configurations = extensions[extension];
+      return Object.keys(extensions).map((extension2) => {
+        let configurations = extensions[extension2];
         if (!Array.isArray(configurations))
           configurations = [configurations];
         return configurations.map((params) => {
-          return [extension].concat(
+          return [extension2].concat(
             Object.keys(params).map((k) => {
               let values = params[k];
               if (!Array.isArray(values))
@@ -129342,7 +129732,7 @@ var require_websocket = __commonJS({
     var { randomBytes, createHash } = require("crypto");
     var { Duplex, Readable: Readable4 } = require("stream");
     var { URL: URL2 } = require("url");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
     var Sender2 = require_sender();
     var { isBlob: isBlob2 } = require_validation3();
@@ -129504,6 +129894,10 @@ var require_websocket = __commonJS({
        *     multiple times in the same tick
        * @param {Function} [options.generateMask] The function used to generate the
        *     masking key
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message size
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -129515,6 +129909,8 @@ var require_websocket = __commonJS({
           binaryType: this.binaryType,
           extensions: this._extensions,
           isServer: this._isServer,
+          maxBufferedChunks: options.maxBufferedChunks,
+          maxFragments: options.maxFragments,
           maxPayload: options.maxPayload,
           skipUTF8Validation: options.skipUTF8Validation
         });
@@ -129556,8 +129952,8 @@ var require_websocket = __commonJS({
           this.emit("close", this._closeCode, this._closeMessage);
           return;
         }
-        if (this._extensions[PerMessageDeflate.extensionName]) {
-          this._extensions[PerMessageDeflate.extensionName].cleanup();
+        if (this._extensions[PerMessageDeflate2.extensionName]) {
+          this._extensions[PerMessageDeflate2.extensionName].cleanup();
         }
         this._receiver.removeAllListeners();
         this._readyState = WebSocket2.CLOSED;
@@ -129727,7 +130123,7 @@ var require_websocket = __commonJS({
           fin: true,
           ...options
         };
-        if (!this._extensions[PerMessageDeflate.extensionName]) {
+        if (!this._extensions[PerMessageDeflate2.extensionName]) {
           opts.compress = false;
         }
         this._sender.send(data || EMPTY_BUFFER, opts, cb);
@@ -129828,6 +130224,8 @@ var require_websocket = __commonJS({
         autoPong: true,
         closeTimeout: CLOSE_TIMEOUT,
         protocolVersion: protocolVersions[1],
+        maxBufferedChunks: 1024 * 1024,
+        maxFragments: 128 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: true,
@@ -129856,7 +130254,7 @@ var require_websocket = __commonJS({
       } else {
         try {
           parsedUrl = new URL2(address);
-        } catch (e) {
+        } catch {
           throw new SyntaxError(`Invalid URL: ${address}`);
         }
       }
@@ -129904,13 +130302,13 @@ var require_websocket = __commonJS({
       opts.path = parsedUrl.pathname + parsedUrl.search;
       opts.timeout = opts.handshakeTimeout;
       if (opts.perMessageDeflate) {
-        perMessageDeflate = new PerMessageDeflate(
-          opts.perMessageDeflate !== true ? opts.perMessageDeflate : {},
-          false,
-          opts.maxPayload
-        );
+        perMessageDeflate = new PerMessageDeflate2({
+          ...opts.perMessageDeflate,
+          isServer: false,
+          maxPayload: opts.maxPayload
+        });
         opts.headers["Sec-WebSocket-Extensions"] = format({
-          [PerMessageDeflate.extensionName]: perMessageDeflate.offer()
+          [PerMessageDeflate2.extensionName]: perMessageDeflate.offer()
         });
       }
       if (protocols.length) {
@@ -130057,23 +130455,25 @@ var require_websocket = __commonJS({
             return;
           }
           const extensionNames = Object.keys(extensions);
-          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate.extensionName) {
+          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate2.extensionName) {
             const message = "Server indicated an extension that was not requested";
             abortHandshake(websocket, socket, message);
             return;
           }
           try {
-            perMessageDeflate.accept(extensions[PerMessageDeflate.extensionName]);
+            perMessageDeflate.accept(extensions[PerMessageDeflate2.extensionName]);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
             return;
           }
-          websocket._extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+          websocket._extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
         }
         websocket.setSocket(socket, head, {
           allowSynchronousEvents: opts.allowSynchronousEvents,
           generateMask: opts.generateMask,
+          maxBufferedChunks: opts.maxBufferedChunks,
+          maxFragments: opts.maxFragments,
           maxPayload: opts.maxPayload,
           skipUTF8Validation: opts.skipUTF8Validation
         });
@@ -130407,9 +130807,9 @@ var require_websocket_server = __commonJS({
     var http4 = require("http");
     var { Duplex } = require("stream");
     var { createHash } = require("crypto");
-    var extension = require_extension();
-    var PerMessageDeflate = require_permessage_deflate();
-    var subprotocol = require_subprotocol();
+    var extension2 = require_extension();
+    var PerMessageDeflate2 = require_permessage_deflate();
+    var subprotocol2 = require_subprotocol();
     var WebSocket2 = require_websocket();
     var { CLOSE_TIMEOUT, GUID, kWebSocket } = require_constants3();
     var keyRegex = /^[+/0-9A-Za-z]{22}==$/;
@@ -130435,6 +130835,10 @@ var require_websocket_server = __commonJS({
        *     called
        * @param {Function} [options.handleProtocols] A hook to handle protocols
        * @param {String} [options.host] The hostname where to bind the server
+       * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=131072] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=104857600] The maximum allowed message
        *     size
        * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -130456,6 +130860,8 @@ var require_websocket_server = __commonJS({
         options = {
           allowSynchronousEvents: true,
           autoPong: true,
+          maxBufferedChunks: 1024 * 1024,
+          maxFragments: 128 * 1024,
           maxPayload: 100 * 1024 * 1024,
           skipUTF8Validation: false,
           perMessageDeflate: false,
@@ -130637,7 +131043,7 @@ var require_websocket_server = __commonJS({
         let protocols = /* @__PURE__ */ new Set();
         if (secWebSocketProtocol !== void 0) {
           try {
-            protocols = subprotocol.parse(secWebSocketProtocol);
+            protocols = subprotocol2.parse(secWebSocketProtocol);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Protocol header";
             abortHandshakeOrEmitwsClientError(this, req, socket, 400, message);
@@ -130647,16 +131053,16 @@ var require_websocket_server = __commonJS({
         const secWebSocketExtensions = req.headers["sec-websocket-extensions"];
         const extensions = {};
         if (this.options.perMessageDeflate && secWebSocketExtensions !== void 0) {
-          const perMessageDeflate = new PerMessageDeflate(
-            this.options.perMessageDeflate,
-            true,
-            this.options.maxPayload
-          );
+          const perMessageDeflate = new PerMessageDeflate2({
+            ...this.options.perMessageDeflate,
+            isServer: true,
+            maxPayload: this.options.maxPayload
+          });
           try {
-            const offers = extension.parse(secWebSocketExtensions);
-            if (offers[PerMessageDeflate.extensionName]) {
-              perMessageDeflate.accept(offers[PerMessageDeflate.extensionName]);
-              extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+            const offers = extension2.parse(secWebSocketExtensions);
+            if (offers[PerMessageDeflate2.extensionName]) {
+              perMessageDeflate.accept(offers[PerMessageDeflate2.extensionName]);
+              extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
             }
           } catch (err) {
             const message = "Invalid or unacceptable Sec-WebSocket-Extensions header";
@@ -130730,10 +131136,10 @@ var require_websocket_server = __commonJS({
             ws._protocol = protocol;
           }
         }
-        if (extensions[PerMessageDeflate.extensionName]) {
-          const params = extensions[PerMessageDeflate.extensionName].params;
-          const value = extension.format({
-            [PerMessageDeflate.extensionName]: [params]
+        if (extensions[PerMessageDeflate2.extensionName]) {
+          const params = extensions[PerMessageDeflate2.extensionName].params;
+          const value = extension2.format({
+            [PerMessageDeflate2.extensionName]: [params]
           });
           headers.push(`Sec-WebSocket-Extensions: ${value}`);
           ws._extensions = extensions;
@@ -130743,6 +131149,8 @@ var require_websocket_server = __commonJS({
         socket.removeListener("error", socketOnError);
         ws.setSocket(socket, head, {
           allowSynchronousEvents: this.options.allowSynchronousEvents,
+          maxBufferedChunks: this.options.maxBufferedChunks,
+          maxFragments: this.options.maxFragments,
           maxPayload: this.options.maxPayload,
           skipUTF8Validation: this.options.skipUTF8Validation
         });
@@ -130802,12 +131210,15 @@ var require_websocket_server = __commonJS({
 });
 
 // node_modules/ws/wrapper.mjs
-var import_stream7, import_receiver, import_sender, import_websocket, import_websocket_server;
+var import_stream7, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server;
 var init_wrapper = __esm({
   "node_modules/ws/wrapper.mjs"() {
     import_stream7 = __toESM(require_stream(), 1);
+    import_extension = __toESM(require_extension(), 1);
+    import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
     import_receiver = __toESM(require_receiver(), 1);
     import_sender = __toESM(require_sender(), 1);
+    import_subprotocol = __toESM(require_subprotocol(), 1);
     import_websocket = __toESM(require_websocket(), 1);
     import_websocket_server = __toESM(require_websocket_server(), 1);
   }
@@ -131047,7 +131458,8 @@ var init_DaemonSurfaceManager = __esm({
             refreshActivity: this.options.refreshActivity,
             resolvedConfig: this.options.resolvedConfig,
             sessionManager: this.options.sessionManager,
-            getSurfaceStatus: () => this.getStatus()
+            getSurfaceStatus: () => this.getStatus(),
+            credentialRequestService: this.options.credentialRequestService
           },
           this.mcpHttpSurface
         );
@@ -131146,6 +131558,7 @@ var init_Daemon = __esm({
     init_DaemonMcpToolManager();
     init_DaemonQueryExecutor();
     init_QueryOperationRunner();
+    init_CredentialRequestService();
     init_SessionManager();
     init_DaemonSurfaceManager();
     Daemon = class {
@@ -131182,13 +131595,20 @@ var init_Daemon = __esm({
           this.config.query
         );
         this.queryOperationRunner = new QueryOperationRunner(this.sessionManager, this.queryExecutor);
+        this.credentialRequestService = new CredentialRequestService(
+          this.connectionManager,
+          this.getHttpBaseUrl()
+        );
         this.toolManager = new DaemonMcpToolManager(
           this.sessionManager,
           this.queryExecutor,
           this.connectionManager,
           this.connectorRegistry,
           this.queryOperationRunner,
-          { safeMode: this.config.mcp.safeMode }
+          {
+            safeMode: this.config.mcp.safeMode,
+            credentialRequestService: this.credentialRequestService
+          }
         );
         this.surfaceManager = new DaemonSurfaceManager({
           app: this.app,
@@ -131201,7 +131621,8 @@ var init_Daemon = __esm({
           resolvedConfig: this.resolvedConfig,
           sessionManager: this.sessionManager,
           socketPath: this.SOCKET_PATH,
-          toolManager: this.toolManager
+          toolManager: this.toolManager,
+          credentialRequestService: this.credentialRequestService
         });
         this.surfaceManager.registerHttpRoutes();
         this.setupLifecycle();
@@ -131210,6 +131631,10 @@ var init_Daemon = __esm({
           (e) => logger.warn("[Daemon] Failed to create built-in connections:", e)
         );
       }
+      getHttpBaseUrl() {
+        const host = ["0.0.0.0", "::", ""].includes(this.config.server.host) ? "127.0.0.1" : this.config.server.host;
+        return `http://${host}:${this.HTTP_PORT}`;
+      }
       /**
        * Auto-provisions built-in connections that should always be available.
        * DuckDB :memory: allows CSV/Parquet queries without any manual setup.