@malloy-publisher/server 0.0.218 → 0.0.219

package/dist/server.mjs

@@ -158407,11 +158407,6 @@ var require_utils74 = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
-var require_sshcrypto = __commonJS((exports, module) => {
-  module.exports = __require("./sshcrypto-8m50vnmb.node");
-});
-
 // ../../node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -158898,7 +158893,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = require_sshcrypto();
+    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -161487,11 +161482,11 @@ var require_agent = __commonJS((exports, module) => {
     };
   })();
   var WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
-  function createAgent(path4) {
-    if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path4)) {
-      return path4 === "pageant" ? new PageantAgent : new CygwinAgent(path4);
+  function createAgent(path3) {
+    if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path3)) {
+      return path3 === "pageant" ? new PageantAgent : new CygwinAgent(path3);
     }
-    return new OpenSSHAgent(path4);
+    return new OpenSSHAgent(path3);
   }
   var AgentProtocol = (() => {
     const SSH_AGENTC_REQUEST_IDENTITIES = 11;
@@ -166093,17 +166088,17 @@ var require_SFTP = __commonJS((exports, module) => {
       if (!this.server)
         sendOrBuffer(this, CLIENT_VERSION_BUFFER);
     }
-    createReadStream(path4, options) {
+    createReadStream(path3, options) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      return new ReadStream(this, path4, options);
+      return new ReadStream(this, path3, options);
     }
-    createWriteStream(path4, options) {
+    createWriteStream(path3, options) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      return new WriteStream(this, path4, options);
+      return new WriteStream(this, path3, options);
     }
-    open(path4, flags_, attrs, cb) {
+    open(path3, flags_, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       if (typeof attrs === "function") {
@@ -166122,7 +166117,7 @@ var require_SFTP = __commonJS((exports, module) => {
         attrsFlags = attrs.flags;
         attrsLen = attrs.nb;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166130,7 +166125,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       writeUInt32BE(buf, attrsFlags, p += 4);
       if (attrsLen) {
@@ -166250,7 +166245,7 @@ var require_SFTP = __commonJS((exports, module) => {
         throw new Error("Client-only method called in server mode");
       fastXfer(fs2, this, localPath, remotePath, opts, cb);
     }
-    readFile(path4, options, callback_) {
+    readFile(path3, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166323,13 +166318,13 @@ var require_SFTP = __commonJS((exports, module) => {
           return callback && callback(er, buffer);
         });
       };
-      this.open(path4, flag, 438, (er, handle_) => {
+      this.open(path3, flag, 438, (er, handle_) => {
         if (er)
           return callback && callback(er);
         handle = handle_;
         const tryStat = (er2, st) => {
           if (er2) {
-            this.stat(path4, (er_, st_) => {
+            this.stat(path3, (er_, st_) => {
               if (er_) {
                 return this.close(handle, () => {
                   callback && callback(er2);
@@ -166350,7 +166345,7 @@ var require_SFTP = __commonJS((exports, module) => {
         this.fstat(handle, tryStat);
       });
     }
-    writeFile(path4, data, options, callback_) {
+    writeFile(path3, data, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166369,7 +166364,7 @@ var require_SFTP = __commonJS((exports, module) => {
       if (options.encoding && !Buffer.isEncoding(options.encoding))
         throw new Error(`Unknown encoding: ${options.encoding}`);
       const flag = options.flag || "w";
-      this.open(path4, flag, options.mode, (openErr, handle) => {
+      this.open(path3, flag, options.mode, (openErr, handle) => {
         if (openErr) {
           callback && callback(openErr);
         } else {
@@ -166378,7 +166373,7 @@ var require_SFTP = __commonJS((exports, module) => {
           if (position === null) {
             const tryStat = (er, st) => {
               if (er) {
-                this.stat(path4, (er_, st_) => {
+                this.stat(path3, (er_, st_) => {
                   if (er_) {
                     return this.close(handle, () => {
                       callback && callback(er);
@@ -166397,7 +166392,7 @@ var require_SFTP = __commonJS((exports, module) => {
         }
       });
     }
-    appendFile(path4, data, options, callback_) {
+    appendFile(path3, data, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166415,12 +166410,12 @@ var require_SFTP = __commonJS((exports, module) => {
         throw new TypeError("Bad arguments");
       if (!options.flag)
         options = Object.assign({ flag: "a" }, options);
-      this.writeFile(path4, data, options, callback);
+      this.writeFile(path3, data, options, callback);
     }
-    exists(path4, cb) {
+    exists(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      this.stat(path4, (err) => {
+      this.stat(path3, (err) => {
         cb && cb(err ? false : true);
       });
     }
@@ -166459,7 +166454,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RENAME`);
     }
-    mkdir(path4, attrs, cb) {
+    mkdir(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let flags = 0;
@@ -166473,7 +166468,7 @@ var require_SFTP = __commonJS((exports, module) => {
         flags = attrs.flags;
         attrsLen = attrs.nb;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166481,7 +166476,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166495,10 +166490,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} MKDIR`);
     }
-    rmdir(path4, cb) {
+    rmdir(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166506,7 +166501,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RMDIR`);
@@ -166590,10 +166585,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} FSTAT`);
     }
-    stat(path4, cb) {
+    stat(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166601,15 +166596,15 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} STAT`);
     }
-    lstat(path4, cb) {
+    lstat(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166617,15 +166612,15 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} LSTAT`);
     }
-    opendir(path4, cb) {
+    opendir(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166633,12 +166628,12 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} OPENDIR`);
     }
-    setstat(path4, attrs, cb) {
+    setstat(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let flags = 0;
@@ -166650,7 +166645,7 @@ var require_SFTP = __commonJS((exports, module) => {
       } else if (typeof attrs === "function") {
         cb = attrs;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166658,7 +166653,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166714,8 +166709,8 @@ var require_SFTP = __commonJS((exports, module) => {
         mtime: toUnixTimestamp(mtime)
       }, cb);
     }
-    utimes(path4, atime, mtime, cb) {
-      return this.setstat(path4, {
+    utimes(path3, atime, mtime, cb) {
+      return this.setstat(path3, {
         atime: toUnixTimestamp(atime),
         mtime: toUnixTimestamp(mtime)
       }, cb);
@@ -166726,8 +166721,8 @@ var require_SFTP = __commonJS((exports, module) => {
         gid
       }, cb);
     }
-    chown(path4, uid, gid, cb) {
-      return this.setstat(path4, {
+    chown(path3, uid, gid, cb) {
+      return this.setstat(path3, {
         uid,
         gid
       }, cb);
@@ -166737,15 +166732,15 @@ var require_SFTP = __commonJS((exports, module) => {
         mode
       }, cb);
     }
-    chmod(path4, mode, cb) {
-      return this.setstat(path4, {
+    chmod(path3, mode, cb) {
+      return this.setstat(path3, {
         mode
       }, cb);
     }
-    readlink(path4, cb) {
+    readlink(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166753,7 +166748,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -166794,10 +166789,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} SYMLINK`);
     }
-    realpath(path4, cb) {
+    realpath(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166805,7 +166800,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -166847,13 +166842,13 @@ var require_SFTP = __commonJS((exports, module) => {
         this._debug(`SFTP: Outbound: ${which} posix-rename@openssh.com`);
       }
     }
-    ext_openssh_statvfs(path4, cb) {
+    ext_openssh_statvfs(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["statvfs@openssh.com"];
       if (!ext || ext !== "2")
         throw new Error("Server does not support this extended request");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 19 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166863,7 +166858,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 19, p);
       buf.utf8Write("statvfs@openssh.com", p += 4, 19);
       writeUInt32BE(buf, pathLen, p += 19);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { extended: "statvfs@openssh.com", cb };
       const isBuffered = sendOrBuffer(this, buf);
       if (this._debug) {
@@ -166947,7 +166942,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} fsync@openssh.com`);
     }
-    ext_openssh_lsetstat(path4, attrs, cb) {
+    ext_openssh_lsetstat(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["lsetstat@openssh.com"];
@@ -166962,7 +166957,7 @@ var require_SFTP = __commonJS((exports, module) => {
       } else if (typeof attrs === "function") {
         cb = attrs;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 20 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166972,7 +166967,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 20, p);
       buf.utf8Write("lsetstat@openssh.com", p += 4, 20);
       writeUInt32BE(buf, pathLen, p += 20);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166989,13 +166984,13 @@ var require_SFTP = __commonJS((exports, module) => {
         this._debug(`SFTP: Outbound: ${status} lsetstat@openssh.com`);
       }
     }
-    ext_openssh_expandPath(path4, cb) {
+    ext_openssh_expandPath(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["expand-path@openssh.com"];
       if (ext !== "1")
         throw new Error("Server does not support this extended request");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 23 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -167005,7 +167000,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 23, p);
       buf.utf8Write("expand-path@openssh.com", p += 4, 23);
       writeUInt32BE(buf, pathLen, p += 20);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -168222,12 +168217,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.LSTAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed LSTAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received LSTAT (id:${reqID})`);
-      if (!sftp.emit("LSTAT", reqID, path4)) {
+      if (!sftp.emit("LSTAT", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168246,13 +168241,13 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.SETSTAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       const attrs = readAttrs(sftp._biOpt);
       bufferParser.clear();
       if (attrs === undefined)
         return doFatalSFTPError(sftp, "Malformed SETSTAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received SETSTAT (id:${reqID})`);
-      if (!sftp.emit("SETSTAT", reqID, path4, attrs)) {
+      if (!sftp.emit("SETSTAT", reqID, path3, attrs)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168272,12 +168267,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.OPENDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed OPENDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received OPENDIR (id:${reqID})`);
-      if (!sftp.emit("OPENDIR", reqID, path4)) {
+      if (!sftp.emit("OPENDIR", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168296,61 +168291,61 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.REMOVE]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed REMOVE packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received REMOVE (id:${reqID})`);
-      if (!sftp.emit("REMOVE", reqID, path4)) {
+      if (!sftp.emit("REMOVE", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.MKDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       const attrs = readAttrs(sftp._biOpt);
       bufferParser.clear();
       if (attrs === undefined)
         return doFatalSFTPError(sftp, "Malformed MKDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received MKDIR (id:${reqID})`);
-      if (!sftp.emit("MKDIR", reqID, path4, attrs)) {
+      if (!sftp.emit("MKDIR", reqID, path3, attrs)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.RMDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed RMDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received RMDIR (id:${reqID})`);
-      if (!sftp.emit("RMDIR", reqID, path4)) {
+      if (!sftp.emit("RMDIR", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.REALPATH]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed REALPATH packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received REALPATH (id:${reqID})`);
-      if (!sftp.emit("REALPATH", reqID, path4)) {
+      if (!sftp.emit("REALPATH", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.STAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed STAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received STAT (id:${reqID})`);
-      if (!sftp.emit("STAT", reqID, path4)) {
+      if (!sftp.emit("STAT", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168370,12 +168365,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.READLINK]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed READLINK packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received READLINK (id:${reqID})`);
-      if (!sftp.emit("READLINK", reqID, path4)) {
+      if (!sftp.emit("READLINK", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168444,7 +168439,7 @@ var require_SFTP = __commonJS((exports, module) => {
   function roundUpToMultipleOf8(n) {
     return n + 7 & ~7;
   }
-  function ReadStream(sftp, path4, options) {
+  function ReadStream(sftp, path3, options) {
     if (options === undefined)
       options = {};
     else if (typeof options === "string")
@@ -168458,7 +168453,7 @@ var require_SFTP = __commonJS((exports, module) => {
     options.emitClose = false;
     options.autoDestroy = false;
     ReadableStream3.call(this, options);
-    this.path = path4;
+    this.path = path3;
     this.flags = options.flags === undefined ? "r" : options.flags;
     this.mode = options.mode === undefined ? 438 : options.mode;
     this.start = options.start;
@@ -168578,7 +168573,7 @@ var require_SFTP = __commonJS((exports, module) => {
     },
     configurable: true
   });
-  function WriteStream(sftp, path4, options) {
+  function WriteStream(sftp, path3, options) {
     if (options === undefined)
       options = {};
     else if (typeof options === "string")
@@ -168590,7 +168585,7 @@ var require_SFTP = __commonJS((exports, module) => {
     options.emitClose = false;
     options.autoDestroy = false;
     WritableStream.call(this, options);
-    this.path = path4;
+    this.path = path3;
     this.flags = options.flags === undefined ? "w" : options.flags;
     this.mode = options.mode === undefined ? 438 : options.mode;
     this.start = options.start;
@@ -246665,7 +246660,138 @@ function safeJoinUnderRoot(root, ...segments) {
 
 // src/service/connection_config.ts
 import { createPrivateKey } from "crypto";
+import { existsSync } from "fs";
 import path3 from "path";
+
+// src/service/proxy.ts
+init_logger();
+var import_ssh2 = __toESM(require_lib10(), 1);
+import net from "net";
+var SSH_CONNECT_TIMEOUT_MS = 15000;
+var SSH_KEEPALIVE_INTERVAL_MS = 15000;
+function parseHostKeys(raw) {
+  const keys = new Set;
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const tokens = trimmed.split(/\s+/);
+    const blob = tokens.find((t) => /^AAAA[A-Za-z0-9+/]+={0,2}$/.test(t));
+    const key = blob ?? tokens[tokens.length - 1];
+    if (key)
+      keys.add(key);
+  }
+  return keys;
+}
+async function openProxy(proxy, target) {
+  if (proxy.type === "ssh") {
+    if (!proxy.ssh) {
+      throw new Error("ConnectionProxy type is 'ssh' but the 'ssh' config object is missing.");
+    }
+    return openSshProxy(proxy.ssh, target);
+  }
+  throw new Error(`Proxy type '${proxy.type}' is not supported yet.  Only 'ssh' is implemented.`);
+}
+function openSshProxy(ssh, target) {
+  return new Promise((resolve2, reject) => {
+    const client = new import_ssh2.Client;
+    let localPort = 0;
+    let server;
+    let settled = false;
+    const sockets = new Set;
+    function fail(err) {
+      if (settled)
+        return;
+      settled = true;
+      server?.close();
+      client.end();
+      reject(err);
+    }
+    const connectConfig = {
+      host: ssh.host,
+      port: ssh.port ?? 22,
+      username: ssh.username,
+      privateKey: ssh.privateKey,
+      ...ssh.privateKeyPass ? { passphrase: ssh.privateKeyPass } : {},
+      readyTimeout: SSH_CONNECT_TIMEOUT_MS,
+      keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
+      keepaliveCountMax: 3,
+      hostVerifier: (key) => {
+        const presented = key.toString("base64");
+        if (ssh.hostKey) {
+          const pinned = parseHostKeys(ssh.hostKey);
+          if (pinned.has(presented)) {
+            return true;
+          }
+          fail(new Error(`SSH host-key verification failed for ${ssh.host}: the presented key ` + `(${presented.slice(0, 24)}…) is not among the ${pinned.size} pinned ` + `host key(s).`));
+          return false;
+        }
+        logger.warn(`Connecting to SSH bastion ${ssh.host} without host-key verification (no hostKey pinned).`);
+        return true;
+      }
+    };
+    client.on("error", (err) => fail(err));
+    client.on("ready", () => {
+      server = net.createServer((socket) => {
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+        const earlyData = [];
+        socket.on("data", (chunk) => earlyData.push(chunk));
+        client.forwardOut("127.0.0.1", localPort, target.host, target.port, (err, channel) => {
+          if (err) {
+            socket.destroy(err);
+            return;
+          }
+          if (socket.destroyed) {
+            channel.destroy();
+            return;
+          }
+          for (const chunk of earlyData) {
+            channel.write(chunk);
+          }
+          earlyData.length = 0;
+          socket.removeAllListeners("data");
+          socket.pipe(channel);
+          channel.pipe(socket);
+          socket.on("error", () => channel.destroy());
+          channel.on("error", () => socket.destroy());
+          socket.on("close", () => channel.destroy());
+          channel.on("close", () => socket.destroy());
+        });
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const addr = server.address();
+        if (!addr || typeof addr === "string") {
+          fail(new Error("Failed to obtain local listen port for SSH proxy."));
+          return;
+        }
+        localPort = addr.port;
+        if (settled)
+          return;
+        settled = true;
+        resolve2({
+          host: "127.0.0.1",
+          port: localPort,
+          close() {
+            return new Promise((res) => {
+              for (const s of sockets)
+                s.destroy();
+              server.close(() => {
+                client.end();
+                res();
+              });
+            });
+          }
+        });
+      });
+      server.on("error", (err) => fail(err));
+    });
+    client.connect(connectConfig);
+  });
+}
+
+// src/service/connection_config.ts
+var PROXIED_SSLMODES = ["disable", "no-verify", "verify-ca"];
 var PUBLISHER_DUCKDB_API_FIELDS = new Set(["attachedDatabases"]);
 function normalizeSnowflakePrivateKey(privateKey) {
   let privateKeyContent = privateKey.trim();
@@ -246850,6 +246976,29 @@ function validateConnectionShape(connection) {
     if (!connection.postgresConnection?.host || !connection.postgresConnection?.port) {
       throw new Error(`Connection proxy on '${connection.name}' requires explicit host and port on the ` + `postgres connection; the connectionString form is not supported with a proxy.`);
     }
+    const hostKey = connection.proxy.ssh?.hostKey;
+    if (hostKey && parseHostKeys(hostKey).size === 0) {
+      throw new Error(`Connection proxy on '${connection.name}' has a hostKey with no usable host-key line ` + `(only blanks/comments). Provide an OpenSSH known_hosts line or base64 blob, or omit ` + `hostKey to connect unpinned.`);
+    }
+    const sslmode = connection.postgresConnection?.sslmode;
+    if (sslmode != null) {
+      if (!PROXIED_SSLMODES.includes(sslmode)) {
+        throw new Error(`Connection proxy on '${connection.name}' has unsupported sslmode '${sslmode}' ` + `(expected ${PROXIED_SSLMODES.join(" | ")}).`);
+      }
+      if (sslmode === "verify-ca") {
+        const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+        if (!caBundle || !existsSync(caBundle)) {
+          throw new Error(`Connection proxy on '${connection.name}' uses sslmode 'verify-ca' but no readable ` + `CA bundle is available (NODE_EXTRA_CA_CERTS is unset or points at a missing file). ` + `Add the CA bundle to the image or use sslmode 'no-verify'.`);
+        }
+      }
+    }
+    const dbName = connection.postgresConnection?.databaseName;
+    if (dbName && decodeURI(encodeURIComponent(dbName)) !== dbName) {
+      throw new Error(`Connection proxy on '${connection.name}' has a database name with characters that can't ` + `be carried over a proxied connection (${JSON.stringify(dbName)}). Use a database name ` + `without URI-reserved characters (; , / ? : @ & = + $ #).`);
+    }
+  }
+  if (!connection.proxy && connection.postgresConnection?.sslmode) {
+    throw new Error(`Connection '${connection.name}' sets postgresConnection.sslmode but has no proxy; sslmode is ` + `only supported for proxied connections (direct connections use the deployment PGSSLMODE).`);
   }
   switch (connection.type) {
     case "postgres":
@@ -247126,126 +247275,6 @@ function validateAndBuildTrinoCoreConfig(trinoConfig) {
   throw new Error(`Invalid Trino connection: expected "http://server:port" or "https://server:port".`);
 }
 
-// src/service/proxy.ts
-var import_ssh2 = __toESM(require_lib10(), 1);
-import net from "net";
-var SSH_CONNECT_TIMEOUT_MS = 15000;
-var SSH_KEEPALIVE_INTERVAL_MS = 15000;
-function extractHostKeyBase64(raw) {
-  const tokens = raw.trim().split(/\s+/);
-  const blob = tokens.find((t) => /^AAAA[A-Za-z0-9+/]+={0,2}$/.test(t));
-  return blob ?? tokens[tokens.length - 1] ?? "";
-}
-async function openProxy(proxy, target) {
-  if (proxy.type === "ssh") {
-    if (!proxy.ssh) {
-      throw new Error("ConnectionProxy type is 'ssh' but the 'ssh' config object is missing.");
-    }
-    return openSshProxy(proxy.ssh, target);
-  }
-  throw new Error(`Proxy type '${proxy.type}' is not supported yet.  Only 'ssh' is implemented.`);
-}
-function openSshProxy(ssh, target) {
-  return new Promise((resolve2, reject) => {
-    const client = new import_ssh2.Client;
-    let localPort = 0;
-    let server;
-    let settled = false;
-    const sockets = new Set;
-    function fail(err) {
-      if (settled)
-        return;
-      settled = true;
-      server?.close();
-      client.end();
-      reject(err);
-    }
-    const connectConfig = {
-      host: ssh.host,
-      port: ssh.port ?? 22,
-      username: ssh.username,
-      privateKey: ssh.privateKey,
-      ...ssh.privateKeyPass ? { passphrase: ssh.privateKeyPass } : {},
-      readyTimeout: SSH_CONNECT_TIMEOUT_MS,
-      keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
-      keepaliveCountMax: 3,
-      hostVerifier: (key) => {
-        const presented = key.toString("base64");
-        if (ssh.hostKey) {
-          const expected = extractHostKeyBase64(ssh.hostKey);
-          if (presented !== expected) {
-            fail(new Error(`SSH host-key mismatch for ${ssh.host}: expected ${expected.slice(0, 24)}… but got ${presented.slice(0, 24)}….`));
-            return false;
-          }
-          return true;
-        }
-        if (process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY === "true") {
-          return true;
-        }
-        fail(new Error(`SSH connection to ${ssh.host} refused: no hostKey provided and ` + `PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY is not 'true'.  ` + `Set hostKey to the bastion's host public key (an OpenSSH ` + `known_hosts line or its base64 blob, e.g. from ssh-keyscan).`));
-        return false;
-      }
-    };
-    client.on("error", (err) => fail(err));
-    client.on("ready", () => {
-      server = net.createServer((socket) => {
-        sockets.add(socket);
-        socket.on("close", () => sockets.delete(socket));
-        const earlyData = [];
-        socket.on("data", (chunk) => earlyData.push(chunk));
-        client.forwardOut("127.0.0.1", localPort, target.host, target.port, (err, channel) => {
-          if (err) {
-            socket.destroy(err);
-            return;
-          }
-          if (socket.destroyed) {
-            channel.destroy();
-            return;
-          }
-          for (const chunk of earlyData) {
-            channel.write(chunk);
-          }
-          earlyData.length = 0;
-          socket.removeAllListeners("data");
-          socket.pipe(channel);
-          channel.pipe(socket);
-          socket.on("error", () => channel.destroy());
-          channel.on("error", () => socket.destroy());
-          socket.on("close", () => channel.destroy());
-          channel.on("close", () => socket.destroy());
-        });
-      });
-      server.listen(0, "127.0.0.1", () => {
-        const addr = server.address();
-        if (!addr || typeof addr === "string") {
-          fail(new Error("Failed to obtain local listen port for SSH proxy."));
-          return;
-        }
-        localPort = addr.port;
-        if (settled)
-          return;
-        settled = true;
-        resolve2({
-          host: "127.0.0.1",
-          port: localPort,
-          close() {
-            return new Promise((res) => {
-              for (const s of sockets)
-                s.destroy();
-              server.close(() => {
-                client.end();
-                res();
-              });
-            });
-          }
-        });
-      });
-      server.on("error", (err) => fail(err));
-    });
-    client.connect(connectConfig);
-  });
-}
-
 // src/service/connection.ts
 async function installAndLoadExtension(connection, extensionName, fromCommunity = false) {
   try {
@@ -247798,19 +247827,37 @@ function buildSnowflakePrivateKeyConnection(metadata) {
     poolOptions: buildPoolOptions({ poolMin: 1, poolMax: 20 })
   });
 }
+function buildProxiedSslQuery(name, sslmode) {
+  const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+  const mode = sslmode ?? "no-verify";
+  switch (mode) {
+    case "disable":
+      return "?sslmode=disable";
+    case "no-verify":
+      return "?sslmode=no-verify";
+    case "verify-ca":
+      if (!caBundle) {
+        throw new Error(`Connection proxy on '${name}' uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset). Add the CA bundle to the image or use sslmode 'no-verify'.`);
+      }
+      return `?uselibpqcompat=true&sslmode=verify-ca&sslrootcert=${encodeURIComponent(caBundle)}`;
+    default:
+      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${mode}' (expected disable | no-verify | verify-ca).`);
+  }
+}
 function buildProxiedPostgresConnection(metadata, endpoint) {
   const name = metadata.apiConnection.name;
   const pg = metadata.apiConnection.postgresConnection;
   if (!pg) {
     throw new Error(`Proxied connection '${name}' has type 'postgres' but no postgresConnection config.`);
   }
+  const enc = encodeURIComponent;
+  const auth = pg.userName ? `${enc(pg.userName)}${pg.password ? `:${enc(pg.password)}` : ""}@` : "";
+  const db = pg.databaseName ? `/${enc(pg.databaseName)}` : "";
+  const ssl = buildProxiedSslQuery(name, pg.sslmode);
+  const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${ssl}`;
   return new PooledPostgresConnection({
     name,
-    host: endpoint.host,
-    port: endpoint.port,
-    username: pg.userName,
-    password: pg.password,
-    databaseName: pg.databaseName,
+    connectionString,
     poolMin: 1,
     poolMax: 20
   });