harbor

INSTALL harbor FROM community;
LOAD harbor;

-- Load the extension and start the server in the background.
-- harbor_serve returns once the server is accepting connections;
-- harbor_wait keeps the process alive in daemon mode (containers,
-- systemd).
LOAD harbor;
CALL harbor_serve(bind := '127.0.0.1', port := 9494);
--                                                  ┌─────────────────────────────────┐
--                                                  │             token               │
--                                                  ├─────────────────────────────────┤
--                                                  │ a1b2c3d4e5f6...                 │
--                                                  └─────────────────────────────────┘

-- Hit it from another shell:
--   curl http://127.0.0.1:9494/health
--   curl -H "Authorization: Bearer <token>" \
--        -X POST http://127.0.0.1:9494/sql \
--        -H 'Content-Type: application/json' \
--        -d '{"sql":"SELECT 42 AS the_answer"}'
--
--   {"ok":true,"kind":"select","columns":[{"name":"the_answer","duckdbType":"INTEGER","lossless":true}],
--    "data":[[42]],"rowCount":1,"timeMs":0}

-- Browser users open http://127.0.0.1:9494/ — the harbor login
-- page asks for the token once, sets a HttpOnly SameSite=Strict
-- cookie, then proxies the official DuckDB UI through.

-- A second DuckDB attaches the server's catalog natively — catalog
-- discovery and table scans both ride /sql, so multi-table JOINs,
-- projection pushdown, and CLI autocomplete all work:
--   LOAD harbor;
--   ATTACH 'harbor:127.0.0.1:9494' AS h (TYPE harbor, TOKEN '<token>');
--   SELECT * FROM h.main.orders o JOIN h.main.customers c USING (customer_id);

-- Stop the server:
CALL harbor_stop();