Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions connections/connection-form.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,7 @@ Metadata connections are the extra ones opened to read a database's object list
| [ClickHouse](/databases/clickhouse) | 8123 | Yes | Yes | Yes | No | Yes | Yes |
| [Teradata](/databases/teradata) | 1025 | Yes | Yes | Yes | No | Yes | Yes |
| [Trino](/databases/trino) | 8080 | Yes | Yes | Yes | No | Yes | Yes |
| [Presto](/databases/trino) | 8080 | Yes | Yes | Yes | No | Yes | Yes |
| [MongoDB](/databases/mongodb) | 27017 | Yes | Yes | Yes | No | Yes | Yes |
| [Redis](/databases/redis) | 6379 | Yes | Yes | Yes | No | Yes | Yes |
| [Cassandra / ScyllaDB](/databases/cassandra) | 9042 | Yes | Yes | Yes | No | Yes | Yes |
Expand Down
10 changes: 5 additions & 5 deletions connections/ssl.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: SSL/TLS
description: Configure encrypted database connections, per-driver defaults, and certificate verification
---

Managed databases require TLS, every one of them, from RDS and Cloud SQL to Supabase, Neon, Atlas, and ClickHouse Cloud. Use **Verify Identity** when your provider hands you a CA certificate, or when the driver checks the system trust store on its own: ClickHouse, Trino, and SQL Server. Otherwise set **Required (skip verify)**.
Managed databases require TLS, every one of them, from RDS and Cloud SQL to Supabase, Neon, Atlas, and ClickHouse Cloud. Use **Verify Identity** when your provider hands you a CA certificate, or when the driver checks the system trust store on its own: ClickHouse, Trino, Presto, and SQL Server. Otherwise set **Required (skip verify)**.

## Modes

Expand All @@ -26,7 +26,7 @@ The certificate rows appear only once **SSL Mode** is anything but Disabled. Eac

| Field | When it appears | What it takes |
|---|---|---|
| **Certificate**, under **CA Certificate** | Verify CA and Verify Identity only | The PEM or DER certificate the server's certificate chains to, for example `/path/to/ca-cert.pem`. Saving without it is blocked, except under Verify Identity on ClickHouse, Kafka, SAP HANA and Trino, which check the system trust store when it is empty |
| **Certificate**, under **CA Certificate** | Verify CA and Verify Identity only | The PEM or DER certificate the server's certificate chains to, for example `/path/to/ca-cert.pem`. Saving without it is blocked, except under Verify Identity on ClickHouse, Kafka, Presto, SAP HANA and Trino, which check the system trust store when it is empty |
| **Client Certificate** | Any mode but Disabled | Your certificate, for a server that enforces mutual TLS. Optional otherwise |
| **Client Key** | Any mode but Disabled | The matching private key. Required once a client certificate is set |
| **Key Passphrase** | Once **Client Key** has a path, on drivers that support it (Cassandra and ScyllaDB) | The passphrase of an encrypted key. Stored in the Keychain |
Expand All @@ -45,7 +45,7 @@ A new connection starts on the mode that matches the driver's own default, and s
| Teradata | Disabled | Opens a TLS transport, retries on a plain socket if it fails to come up |
| MongoDB, Redis, Cassandra, ClickHouse, Elasticsearch, Typesense, SurrealDB, Weaviate | Disabled | Nothing. No fallback exists, so Preferred forces TLS exactly like Required |
| etcd | Disabled | Nothing. The driver never reads these fields. Set **TLS Mode** on the Options section instead, and see [etcd](/databases/etcd) |
| Trino | Disabled | Sends every request over HTTPS with no fallback, again like Required |
| Trino, Presto | Disabled | Sends every request over HTTPS with no fallback, again like Required |
| SAP HANA | Verify Identity | Nothing. No fallback exists, so Preferred forces TLS exactly like Required |
| Oracle | Disabled | Connects in plain TCP, so it behaves like Disabled. A red warning appears under the picker; use Required to enforce TCPS |
| Snowflake, BigQuery, Bigtable, Spanner, Firestore, Firebase Realtime Database, DynamoDB, Cloudflare D1, Cloudflare R2 SQL, libSQL / Turso | Always encrypted | These drivers are HTTPS and manage TLS themselves. No **SSL Mode** |
Expand All @@ -55,7 +55,7 @@ A new connection starts on the mode that matches the driver's own default, and s

| Driver | Ports |
|---|---|
| Trino | 443 |
| Trino, Presto | 443 |
| ClickHouse | 443, 8443 |

Type one of these ports while **SSL Mode** is still at the driver's default and the mode becomes **Verify Identity**, with a note under **Port**. Type a different port and the default comes back. A mode you picked yourself never changes.
Expand Down Expand Up @@ -106,7 +106,7 @@ The server enforces mutual TLS. Fill in **Client Certificate** and **Client Key*

### "client private key is encrypted" / "passphrase is incorrect"

Enter the key's passphrase in **Key Passphrase**, which appears once **Client Key** has a path. Trino and etcd have no **Key Passphrase**: decrypt the key first with `openssl pkey -in encrypted.key -out client.key` and choose the decrypted file.
Enter the key's passphrase in **Key Passphrase**, which appears once **Client Key** has a path. Trino, Presto and etcd have no **Key Passphrase**: decrypt the key first with `openssl pkey -in encrypted.key -out client.key` and choose the decrypted file.

## On iPhone and iPad

Expand Down
5 changes: 3 additions & 2 deletions connections/urls.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ Two readers take these URLs, and not the same set. The **Import from URL…** sh
| `ch://` | ClickHouse (alias) | Yes |
| `teradata://` | Teradata | No |
| `trino://` | Trino | No |
| `presto://` | Presto | No |
| `duckdb://` | DuckDB file | Yes |
| `quack://` | DuckDB remote (Quack protocol) | No |
| `beancount://` | Beancount ledger file | No |
Expand Down Expand Up @@ -139,10 +140,10 @@ mariadb://root@/shop?socket=(/tmp/mysql.sock)
|-----------|--------|-------------|
| `sslmode` | `disable`, `prefer`, `require`, `verify-ca`, `verify-full` | SSL mode under libpq's names, in any case and with `_` for `-`, so `VERIFY_FULL` works too. ClickHouse JDBC's `strict` and `none` read as Verify Identity and Required |
| `tlsmode` | `0`-`4` | The same modes as integers: 0=disable, 1=prefer, 2=require, 3=verify-ca, 4=verify-full |
| `tls` / `ssl` | `true`, `false` | `true` turns TLS on: Verify Identity for Trino and ClickHouse, Required for every other database. `false` sets Disabled, even on a port that means TLS |
| `tls` / `ssl` | `true`, `false` | `true` turns TLS on: Verify Identity for Trino, Presto and ClickHouse, Required for every other database. `false` sets Disabled, even on a port that means TLS |
| `SSLVerification` | `FULL`, `CA`, `NONE` | Trino's certificate check once TLS is on: Verify Identity, Verify CA, Required. Ignored while TLS is off. Verify CA also needs a CA certificate file |

`sslmode` or `tlsmode` wins over `ssl`, `tls` and `SSLVerification`. With none of them, a Trino URL on port `443` and a ClickHouse URL on `443` or `8443` import as Verify Identity, as in [Ports that mean TLS](/connections/ssl#ports-that-mean-tls), and every other URL takes the driver's default from [Per-driver defaults](/connections/ssl#per-driver-defaults). **Import from URL…** and a link opened from a browser or `open` resolve the mode the same way, so `ssl=false` or `sslmode=disable` is how a link asks for plain TCP. A URL that turns TLS on and names no port opens on the driver's TLS port, `443` for Trino and `8443` for ClickHouse, and a port written in the URL is kept.
`sslmode` or `tlsmode` wins over `ssl`, `tls` and `SSLVerification`. With none of them, a Trino or Presto URL on port `443` and a ClickHouse URL on `443` or `8443` import as Verify Identity, as in [Ports that mean TLS](/connections/ssl#ports-that-mean-tls), and every other URL takes the driver's default from [Per-driver defaults](/connections/ssl#per-driver-defaults). **Import from URL…** and a link opened from a browser or `open` resolve the mode the same way, so `ssl=false` or `sslmode=disable` is how a link asks for plain TCP. A URL that turns TLS on and names no port opens on the driver's TLS port, `443` for Trino and Presto and `8443` for ClickHouse, and a port written in the URL is kept.

```text
postgresql://user:pass@host/db?sslmode=require
Expand Down
9 changes: 5 additions & 4 deletions databases/index.mdx
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
---
title: Supported Databases
description: All 40 engines TablePro connects to, their default ports, and which ones need a plugin
description: All 41 engines TablePro connects to, their default ports, and which ones need a plugin
---

import DriverCounts from "/snippets/driver-counts.mdx";

Forty engines, and every one of them is free to use. What differs between them is where the
Forty-one engines, and every one of them is free to use. What differs between them is where the
driver comes from, not what the license covers.

<DriverCounts />
Expand Down Expand Up @@ -41,6 +41,7 @@ driver comes from, not what the license covers.
| [Oracle Database](/databases/oracle) | 1521 | Plugin |
| [PGlite](/databases/pglite) | 5432 | Built-in |
| [PostgreSQL](/databases/postgresql) | 5432 | Built-in |
| [Presto](/databases/trino) | 8080 | Plugin |
| [Redis](/databases/redis) | 6379 | Built-in |
| [SAP HANA](/databases/sap-hana) | 443 | Plugin |
| [ScyllaDB](/databases/cassandra) | 9042 | Plugin |
Expand All @@ -56,8 +57,8 @@ driver comes from, not what the license covers.
| [Weaviate](/databases/weaviate) | 8080 | Plugin |

Rows sharing a page share a driver. MariaDB reads as MySQL, ScyllaDB as Cassandra, Turso as libSQL,
and Redshift, CockroachDB and PGlite all speak the PostgreSQL wire protocol. TiDB, Databend and
OceanBase also run on the bundled MySQL driver.
Presto as Trino, and Redshift, CockroachDB and PGlite all speak the PostgreSQL wire protocol. TiDB,
Databend and OceanBase also run on the bundled MySQL driver.

## Built-in against plugin

Expand Down
24 changes: 17 additions & 7 deletions databases/trino.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: Trino
description: Catalogs and schemas, type mapping, EXPLAIN variants, and the auth a Trino cluster accepts
title: Trino / Presto
description: Catalogs and schemas, type mapping, EXPLAIN variants, and the auth a Trino or Presto cluster accepts
---

import RegistryPlugin from "/snippets/registry-plugin.mdx";
Expand All @@ -14,7 +14,7 @@ What a write does depends on the catalog's connector, not on TablePro. A stateme

## Quick setup

Click **New Connection…**, select **Trino**, enter the coordinator host and port, set **Username**, and click **Save & Connect**. A cluster with no authentication needs nothing else, and **Catalog** and **Schema** are optional starting points.
Click **New Connection…**, select **Trino** or **Presto**, enter the coordinator host and port, set **Username**, and click **Save & Connect**. A cluster with no authentication needs nothing else, and **Catalog** and **Schema** are optional starting points.

<RegistryPlugin name="Trino" plugin="Trino Driver" />

Expand All @@ -34,10 +34,11 @@ Click **New Connection…**, select **Trino**, enter the coordinator host and po
## Connection URL

```text
trino://user@host:8080/catalog
trino://user@host:8080/catalog/schema
presto://user@host:8080/catalog/schema
```

**Import from URL…** accepts the scheme; macOS does not route `trino://` links. See [Connection URL Reference](/connections/urls).
The path names the catalog and then the schema, and the schema is optional. **Import from URL…** accepts both schemes and their `jdbc:` forms; macOS does not route `trino://` or `presto://` links. See [Connection URL Reference](/connections/urls).

## Authentication

Expand Down Expand Up @@ -94,6 +95,16 @@ Click the Explain dropdown in the query editor to choose:
| **Explain (Validate)** | `EXPLAIN (TYPE VALIDATE)`, parses and validates without running the query |
| **Explain Analyze** | `EXPLAIN ANALYZE`, runs the query and reports actual timings |

## Presto

**Presto** is its own entry in the database type list and uses the same driver. Measured against Presto 0.299, it differs from Trino in five places:

- A table shows its first page of rows and no page navigation. Presto turns `OFFSET` off by default, so filter, sort, or query with `LIMIT` in the editor to reach other rows.
- Column comments show and cannot be changed, and table comments do not show. Presto has no `COMMENT ON` statement and no metadata table for table comments.
- Materialized views are listed from `information_schema.materialized_views`.
- `timestamp` values arrive at millisecond precision.
- An `array` inside an `array`, `map` or `row` shows as JSON text inside the outer value.

## SSL/TLS

**Disabled** is the default and speaks plain HTTP. There is no plaintext fallback, so every other mode forces TLS. Port `443` turns on **Verify Identity**. See [Ports that mean TLS](/connections/ssl#ports-that-mean-tls).
Expand All @@ -113,7 +124,6 @@ Click the Explain dropdown in the query editor to choose:
- Neither a connection's **Query timeout** override nor the inherited [global
setting](/customization/general-settings#query-timeout) reaches Trino. A long query runs until you
cancel it or the cluster ends it.
- Presto is not supported. It speaks the same protocol under an `X-Presto-` header prefix, and this driver always sends `X-Trino-`.

## Troubleshooting

Expand Down Expand Up @@ -147,7 +157,7 @@ The coordinator rejected the user, password or access token it was sent, and its

### "The server redirected the request to …"

Trino never redirects, so a proxy or load balancer in front of it sent this, and the redirect is not followed. A redirect to `https://` on the same host means the proxy serves HTTPS: set **Port** to the one named, usually `443`, and **SSL Mode** to **Verify Identity**. Any other address, often a sign-in page, means the host and port reach the proxy instead of Trino.
The coordinator never redirects, so a proxy or load balancer in front of it sent this, and the redirect is not followed. A redirect to `https://` on the same host means the proxy serves HTTPS: set **Port** to the one named, usually `443`, and **SSL Mode** to **Verify Identity**. Any other address, often a sign-in page, means the host and port reach the proxy instead of the coordinator.

### "The server requires a client certificate for TLS mutual authentication"

Expand Down
2 changes: 1 addition & 1 deletion features/data-grid.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ Any other SRID, such as the projected 27700 or 32633, draws nothing: the pane na

The map is one element to VoiceOver and does not publish its shapes, so the grid stays the readable representation of spatial rows.

SQL Server, Oracle, SpatiaLite, Teradata, Trino, Spanner, Cassandra and BigQuery hand geometry over in formats the reader does not cover yet. Their spatial columns show text and carry no Map segment, because the segment follows what the values are rather than what the column is called.
SQL Server, Oracle, SpatiaLite, Teradata, Trino, Presto, Spanner, Cassandra and BigQuery hand geometry over in formats the reader does not cover yet. Their spatial columns show text and carry no Map segment, because the segment follows what the values are rather than what the column is called.

## Editing and display

Expand Down
2 changes: 1 addition & 1 deletion features/explain-visualization.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ Properties the driver reported as false or zero are left out of **Details**.
| ClickHouse | Plan, Pipeline, AST, Syntax, Estimate | From the indented text |
| DuckDB | Explain | From the indented text |
| Snowflake | Explain (Text) | Raw text only |
| Trino | Logical, Distributed, IO, Validate, Analyze | Raw text only |
| Trino, Presto | Logical, Distributed, IO, Validate, Analyze | Raw text only |
| SurrealDB | Explain, Explain Full | Raw text only |
| Cloudflare R2 SQL | Explain, Explain (JSON) | Raw text only |
| BigQuery | Dry Run (Cost) | A dry run cost estimate, no plan |
Expand Down
2 changes: 1 addition & 1 deletion features/plugins.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ These install from the registry when you need them:
| Elasticsearch | Elasticsearch |
| SurrealDB | SurrealDB |
| Teradata | Teradata Vantage |
| Trino | Trino |
| Trino | Trino, Presto |
| Typesense | Typesense |
| Beancount | Beancount ledger files |
| Parquet | Parquet export |
Expand Down
2 changes: 1 addition & 1 deletion features/table-structure.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@ A row that is started and unfinished is never dropped from the generated SQL. **
Indexes run as their own `CREATE INDEX` statements after the table, in one transaction where the engine has transactional DDL.

<Info>
Visual table creation is supported for MySQL, MariaDB, PostgreSQL, PGlite, SQLite, SQL Server, ClickHouse, DuckDB, Oracle, Snowflake, libSQL, Cloudflare D1, Trino, Teradata, Dameng, and [MongoDB](/databases/mongodb#creating-a-collection). DynamoDB uses a form instead. On every other engine **New Table…** is dimmed.
Visual table creation is supported for MySQL, MariaDB, PostgreSQL, PGlite, SQLite, SQL Server, ClickHouse, DuckDB, Oracle, Snowflake, libSQL, Cloudflare D1, Trino, Presto, Teradata, Dameng, and [MongoDB](/databases/mongodb#creating-a-collection). DynamoDB uses a form instead. On every other engine **New Table…** is dimmed.
</Info>

## MongoDB collections
Expand Down
2 changes: 1 addition & 1 deletion index.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: Introduction
description: Native macOS database client for MySQL, PostgreSQL, SQLite, MongoDB, Redis, and 35 more
description: Native macOS database client for MySQL, PostgreSQL, SQLite, MongoDB, Redis, and 36 more
---

import DriverCounts from "/snippets/driver-counts.mdx";
Expand Down
2 changes: 1 addition & 1 deletion snippets/driver-counts.mdx
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
Five drivers ship inside the app and cover twelve databases. Twenty-five registry plugins cover the
other twenty-eight and install on the first connection that needs one. See
other twenty-nine and install on the first connection that needs one. See
[Plugins](/features/plugins).
2 changes: 1 addition & 1 deletion snippets/row-cap.mdx
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Your SQL reaches the server exactly as you wrote it. The cap applies to the rows read back, so a
query carrying its own `LIMIT`, `FETCH FIRST` or `TOP` is never touched, and `EXPLAIN`, `SHOW`,
writes and DDL are never capped. The read itself stops at the cap on MySQL, MariaDB, PostgreSQL,
CockroachDB, Redshift, SQLite, MSSQL, Oracle, Cassandra, Redis, DynamoDB, BigQuery, Snowflake, Trino,
CockroachDB, Redshift, SQLite, MSSQL, Oracle, Cassandra, Redis, DynamoDB, BigQuery, Snowflake, Trino, Presto,
ClickHouse, SAP HANA and MongoDB, so the rest of the result never crosses the network. Cloudflare D1, LibSQL,
Etcd, DuckDB, Elasticsearch, Typesense, SurrealDB, Beancount and Dameng still read the whole result and keep the
first rows. A plan that has to finish before it can return a first row, a sort with no index or a
Expand Down
Loading