@malloy-publisher/server 0.0.218 → 0.0.220

package/dist/server.mjs

@@ -161487,11 +161487,11 @@ var require_agent = __commonJS((exports, module) => {
     };
   })();
   var WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
-  function createAgent(path4) {
-    if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path4)) {
-      return path4 === "pageant" ? new PageantAgent : new CygwinAgent(path4);
+  function createAgent(path3) {
+    if (process.platform === "win32" && !WINDOWS_PIPE_REGEX.test(path3)) {
+      return path3 === "pageant" ? new PageantAgent : new CygwinAgent(path3);
     }
-    return new OpenSSHAgent(path4);
+    return new OpenSSHAgent(path3);
   }
   var AgentProtocol = (() => {
     const SSH_AGENTC_REQUEST_IDENTITIES = 11;
@@ -166093,17 +166093,17 @@ var require_SFTP = __commonJS((exports, module) => {
       if (!this.server)
         sendOrBuffer(this, CLIENT_VERSION_BUFFER);
     }
-    createReadStream(path4, options) {
+    createReadStream(path3, options) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      return new ReadStream(this, path4, options);
+      return new ReadStream(this, path3, options);
     }
-    createWriteStream(path4, options) {
+    createWriteStream(path3, options) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      return new WriteStream(this, path4, options);
+      return new WriteStream(this, path3, options);
     }
-    open(path4, flags_, attrs, cb) {
+    open(path3, flags_, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       if (typeof attrs === "function") {
@@ -166122,7 +166122,7 @@ var require_SFTP = __commonJS((exports, module) => {
         attrsFlags = attrs.flags;
         attrsLen = attrs.nb;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166130,7 +166130,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       writeUInt32BE(buf, attrsFlags, p += 4);
       if (attrsLen) {
@@ -166250,7 +166250,7 @@ var require_SFTP = __commonJS((exports, module) => {
         throw new Error("Client-only method called in server mode");
       fastXfer(fs2, this, localPath, remotePath, opts, cb);
     }
-    readFile(path4, options, callback_) {
+    readFile(path3, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166323,13 +166323,13 @@ var require_SFTP = __commonJS((exports, module) => {
           return callback && callback(er, buffer);
         });
       };
-      this.open(path4, flag, 438, (er, handle_) => {
+      this.open(path3, flag, 438, (er, handle_) => {
         if (er)
           return callback && callback(er);
         handle = handle_;
         const tryStat = (er2, st) => {
           if (er2) {
-            this.stat(path4, (er_, st_) => {
+            this.stat(path3, (er_, st_) => {
               if (er_) {
                 return this.close(handle, () => {
                   callback && callback(er2);
@@ -166350,7 +166350,7 @@ var require_SFTP = __commonJS((exports, module) => {
         this.fstat(handle, tryStat);
       });
     }
-    writeFile(path4, data, options, callback_) {
+    writeFile(path3, data, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166369,7 +166369,7 @@ var require_SFTP = __commonJS((exports, module) => {
       if (options.encoding && !Buffer.isEncoding(options.encoding))
         throw new Error(`Unknown encoding: ${options.encoding}`);
       const flag = options.flag || "w";
-      this.open(path4, flag, options.mode, (openErr, handle) => {
+      this.open(path3, flag, options.mode, (openErr, handle) => {
         if (openErr) {
           callback && callback(openErr);
         } else {
@@ -166378,7 +166378,7 @@ var require_SFTP = __commonJS((exports, module) => {
           if (position === null) {
             const tryStat = (er, st) => {
               if (er) {
-                this.stat(path4, (er_, st_) => {
+                this.stat(path3, (er_, st_) => {
                   if (er_) {
                     return this.close(handle, () => {
                       callback && callback(er);
@@ -166397,7 +166397,7 @@ var require_SFTP = __commonJS((exports, module) => {
         }
       });
     }
-    appendFile(path4, data, options, callback_) {
+    appendFile(path3, data, options, callback_) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let callback;
@@ -166415,12 +166415,12 @@ var require_SFTP = __commonJS((exports, module) => {
         throw new TypeError("Bad arguments");
       if (!options.flag)
         options = Object.assign({ flag: "a" }, options);
-      this.writeFile(path4, data, options, callback);
+      this.writeFile(path3, data, options, callback);
     }
-    exists(path4, cb) {
+    exists(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      this.stat(path4, (err) => {
+      this.stat(path3, (err) => {
         cb && cb(err ? false : true);
       });
     }
@@ -166459,7 +166459,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RENAME`);
     }
-    mkdir(path4, attrs, cb) {
+    mkdir(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let flags = 0;
@@ -166473,7 +166473,7 @@ var require_SFTP = __commonJS((exports, module) => {
         flags = attrs.flags;
         attrsLen = attrs.nb;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166481,7 +166481,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166495,10 +166495,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} MKDIR`);
     }
-    rmdir(path4, cb) {
+    rmdir(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166506,7 +166506,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} RMDIR`);
@@ -166590,10 +166590,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} FSTAT`);
     }
-    stat(path4, cb) {
+    stat(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166601,15 +166601,15 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} STAT`);
     }
-    lstat(path4, cb) {
+    lstat(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166617,15 +166617,15 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} LSTAT`);
     }
-    opendir(path4, cb) {
+    opendir(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166633,12 +166633,12 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { cb };
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} OPENDIR`);
     }
-    setstat(path4, attrs, cb) {
+    setstat(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       let flags = 0;
@@ -166650,7 +166650,7 @@ var require_SFTP = __commonJS((exports, module) => {
       } else if (typeof attrs === "function") {
         cb = attrs;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166658,7 +166658,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166714,8 +166714,8 @@ var require_SFTP = __commonJS((exports, module) => {
         mtime: toUnixTimestamp(mtime)
       }, cb);
     }
-    utimes(path4, atime, mtime, cb) {
-      return this.setstat(path4, {
+    utimes(path3, atime, mtime, cb) {
+      return this.setstat(path3, {
         atime: toUnixTimestamp(atime),
         mtime: toUnixTimestamp(mtime)
       }, cb);
@@ -166726,8 +166726,8 @@ var require_SFTP = __commonJS((exports, module) => {
         gid
       }, cb);
     }
-    chown(path4, uid, gid, cb) {
-      return this.setstat(path4, {
+    chown(path3, uid, gid, cb) {
+      return this.setstat(path3, {
         uid,
         gid
       }, cb);
@@ -166737,15 +166737,15 @@ var require_SFTP = __commonJS((exports, module) => {
         mode
       }, cb);
     }
-    chmod(path4, mode, cb) {
-      return this.setstat(path4, {
+    chmod(path3, mode, cb) {
+      return this.setstat(path3, {
         mode
       }, cb);
     }
-    readlink(path4, cb) {
+    readlink(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166753,7 +166753,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -166794,10 +166794,10 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} SYMLINK`);
     }
-    realpath(path4, cb) {
+    realpath(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166805,7 +166805,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const reqid = this._writeReqid = this._writeReqid + 1 & MAX_REQID;
       writeUInt32BE(buf, reqid, 5);
       writeUInt32BE(buf, pathLen, p);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -166847,13 +166847,13 @@ var require_SFTP = __commonJS((exports, module) => {
         this._debug(`SFTP: Outbound: ${which} posix-rename@openssh.com`);
       }
     }
-    ext_openssh_statvfs(path4, cb) {
+    ext_openssh_statvfs(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["statvfs@openssh.com"];
       if (!ext || ext !== "2")
         throw new Error("Server does not support this extended request");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 19 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166863,7 +166863,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 19, p);
       buf.utf8Write("statvfs@openssh.com", p += 4, 19);
       writeUInt32BE(buf, pathLen, p += 19);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = { extended: "statvfs@openssh.com", cb };
       const isBuffered = sendOrBuffer(this, buf);
       if (this._debug) {
@@ -166947,7 +166947,7 @@ var require_SFTP = __commonJS((exports, module) => {
       const isBuffered = sendOrBuffer(this, buf);
       this._debug && this._debug(`SFTP: Outbound: ${isBuffered ? "Buffered" : "Sending"} fsync@openssh.com`);
     }
-    ext_openssh_lsetstat(path4, attrs, cb) {
+    ext_openssh_lsetstat(path3, attrs, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["lsetstat@openssh.com"];
@@ -166962,7 +166962,7 @@ var require_SFTP = __commonJS((exports, module) => {
       } else if (typeof attrs === "function") {
         cb = attrs;
       }
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 20 + 4 + pathLen + 4 + attrsLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -166972,7 +166972,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 20, p);
       buf.utf8Write("lsetstat@openssh.com", p += 4, 20);
       writeUInt32BE(buf, pathLen, p += 20);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       writeUInt32BE(buf, flags, p += pathLen);
       if (attrsLen) {
         p += 4;
@@ -166989,13 +166989,13 @@ var require_SFTP = __commonJS((exports, module) => {
         this._debug(`SFTP: Outbound: ${status} lsetstat@openssh.com`);
       }
     }
-    ext_openssh_expandPath(path4, cb) {
+    ext_openssh_expandPath(path3, cb) {
       if (this.server)
         throw new Error("Client-only method called in server mode");
       const ext = this._extensions["expand-path@openssh.com"];
       if (ext !== "1")
         throw new Error("Server does not support this extended request");
-      const pathLen = Buffer.byteLength(path4);
+      const pathLen = Buffer.byteLength(path3);
       let p = 9;
       const buf = Buffer.allocUnsafe(4 + 1 + 4 + 4 + 23 + 4 + pathLen);
       writeUInt32BE(buf, buf.length - 4, 0);
@@ -167005,7 +167005,7 @@ var require_SFTP = __commonJS((exports, module) => {
       writeUInt32BE(buf, 23, p);
       buf.utf8Write("expand-path@openssh.com", p += 4, 23);
       writeUInt32BE(buf, pathLen, p += 20);
-      buf.utf8Write(path4, p += 4, pathLen);
+      buf.utf8Write(path3, p += 4, pathLen);
       this._requests[reqid] = {
         cb: (err, names) => {
           if (typeof cb !== "function")
@@ -168222,12 +168222,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.LSTAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed LSTAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received LSTAT (id:${reqID})`);
-      if (!sftp.emit("LSTAT", reqID, path4)) {
+      if (!sftp.emit("LSTAT", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168246,13 +168246,13 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.SETSTAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       const attrs = readAttrs(sftp._biOpt);
       bufferParser.clear();
       if (attrs === undefined)
         return doFatalSFTPError(sftp, "Malformed SETSTAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received SETSTAT (id:${reqID})`);
-      if (!sftp.emit("SETSTAT", reqID, path4, attrs)) {
+      if (!sftp.emit("SETSTAT", reqID, path3, attrs)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168272,12 +168272,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.OPENDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed OPENDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received OPENDIR (id:${reqID})`);
-      if (!sftp.emit("OPENDIR", reqID, path4)) {
+      if (!sftp.emit("OPENDIR", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168296,61 +168296,61 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.REMOVE]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed REMOVE packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received REMOVE (id:${reqID})`);
-      if (!sftp.emit("REMOVE", reqID, path4)) {
+      if (!sftp.emit("REMOVE", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.MKDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       const attrs = readAttrs(sftp._biOpt);
       bufferParser.clear();
       if (attrs === undefined)
         return doFatalSFTPError(sftp, "Malformed MKDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received MKDIR (id:${reqID})`);
-      if (!sftp.emit("MKDIR", reqID, path4, attrs)) {
+      if (!sftp.emit("MKDIR", reqID, path3, attrs)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.RMDIR]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed RMDIR packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received RMDIR (id:${reqID})`);
-      if (!sftp.emit("RMDIR", reqID, path4)) {
+      if (!sftp.emit("RMDIR", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.REALPATH]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed REALPATH packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received REALPATH (id:${reqID})`);
-      if (!sftp.emit("REALPATH", reqID, path4)) {
+      if (!sftp.emit("REALPATH", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
     [REQUEST.STAT]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed STAT packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received STAT (id:${reqID})`);
-      if (!sftp.emit("STAT", reqID, path4)) {
+      if (!sftp.emit("STAT", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168370,12 +168370,12 @@ var require_SFTP = __commonJS((exports, module) => {
     [REQUEST.READLINK]: (sftp, payload) => {
       bufferParser.init(payload, 1);
       const reqID = bufferParser.readUInt32BE();
-      const path4 = bufferParser.readString(true);
+      const path3 = bufferParser.readString(true);
       bufferParser.clear();
-      if (path4 === undefined)
+      if (path3 === undefined)
         return doFatalSFTPError(sftp, "Malformed READLINK packet");
       sftp._debug && sftp._debug(`SFTP: Inbound: Received READLINK (id:${reqID})`);
-      if (!sftp.emit("READLINK", reqID, path4)) {
+      if (!sftp.emit("READLINK", reqID, path3)) {
         sftp.status(reqID, STATUS_CODE.OP_UNSUPPORTED);
       }
     },
@@ -168444,7 +168444,7 @@ var require_SFTP = __commonJS((exports, module) => {
   function roundUpToMultipleOf8(n) {
     return n + 7 & ~7;
   }
-  function ReadStream(sftp, path4, options) {
+  function ReadStream(sftp, path3, options) {
     if (options === undefined)
       options = {};
     else if (typeof options === "string")
@@ -168458,7 +168458,7 @@ var require_SFTP = __commonJS((exports, module) => {
     options.emitClose = false;
     options.autoDestroy = false;
     ReadableStream3.call(this, options);
-    this.path = path4;
+    this.path = path3;
     this.flags = options.flags === undefined ? "r" : options.flags;
     this.mode = options.mode === undefined ? 438 : options.mode;
     this.start = options.start;
@@ -168578,7 +168578,7 @@ var require_SFTP = __commonJS((exports, module) => {
     },
     configurable: true
   });
-  function WriteStream(sftp, path4, options) {
+  function WriteStream(sftp, path3, options) {
     if (options === undefined)
       options = {};
     else if (typeof options === "string")
@@ -168590,7 +168590,7 @@ var require_SFTP = __commonJS((exports, module) => {
     options.emitClose = false;
     options.autoDestroy = false;
     WritableStream.call(this, options);
-    this.path = path4;
+    this.path = path3;
     this.flags = options.flags === undefined ? "w" : options.flags;
     this.mode = options.mode === undefined ? 438 : options.mode;
     this.start = options.start;
@@ -242929,6 +242929,15 @@ function resolvePublisherConfigPath(serverRoot) {
   }
   return null;
 }
+var PER_MODE_COLOR_KEYS = [
+  "background",
+  "tableHeader",
+  "tableHeaderBackground",
+  "tableBody",
+  "tile",
+  "tileTitle",
+  "mapColor"
+];
 var DEFAULT_HIGH_WATER_FRACTION = 0.8;
 var DEFAULT_LOW_WATER_FRACTION = 0.7;
 var DEFAULT_CHECK_INTERVAL_MS = 5000;
@@ -243118,11 +243127,98 @@ var getPublisherConfig = (serverRoot) => {
   if (processedConfig && typeof processedConfig === "object" && "frozenConfig" in processedConfig) {
     frozenConfig = Boolean(processedConfig.frozenConfig);
   }
+  const instanceTheme = sanitizeTheme(processedConfig && typeof processedConfig === "object" && "theme" in processedConfig ? processedConfig.theme : undefined, "publisher.config.json");
   return {
     frozenConfig,
+    ...instanceTheme ? { theme: instanceTheme } : {},
     environments
   };
 };
+function sanitizeTheme(raw, context) {
+  if (raw === undefined || raw === null)
+    return;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    logger.warn(`Invalid "theme" in ${context}: expected an object. Ignoring.`);
+    return;
+  }
+  const obj = raw;
+  const theme = {};
+  if ("defaultMode" in obj) {
+    const mode = obj.defaultMode;
+    if (mode === "light" || mode === "dark" || mode === "auto") {
+      theme.defaultMode = mode;
+    } else {
+      logger.warn(`Invalid "theme.defaultMode" in ${context}: expected "light" | "dark" | "auto" (got ${JSON.stringify(mode)}). Ignoring field.`);
+    }
+  }
+  if ("allowUserToggle" in obj) {
+    const value = obj.allowUserToggle;
+    if (typeof value === "boolean") {
+      theme.allowUserToggle = value;
+    } else {
+      logger.warn(`Invalid "theme.allowUserToggle" in ${context}: expected a boolean (got ${JSON.stringify(value)}). Ignoring field.`);
+    }
+  }
+  if ("palette" in obj && obj.palette && typeof obj.palette === "object") {
+    const palette = obj.palette;
+    const sanitized = {};
+    if (Array.isArray(palette.series)) {
+      sanitized.series = palette.series.filter((c) => typeof c === "string");
+    }
+    for (const key of PER_MODE_COLOR_KEYS) {
+      const raw2 = palette[key];
+      if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2))
+        continue;
+      const r = raw2;
+      const out = {};
+      if (typeof r.light === "string")
+        out.light = r.light;
+      if (typeof r.dark === "string")
+        out.dark = r.dark;
+      if (Object.keys(out).length > 0) {
+        sanitized[key] = out;
+      }
+    }
+    if (Object.keys(sanitized).length > 0)
+      theme.palette = sanitized;
+  }
+  if ("font" in obj && obj.font && typeof obj.font === "object") {
+    const font = obj.font;
+    const sanitized = {};
+    if (typeof font.family === "string")
+      sanitized.family = font.family;
+    if (typeof font.size === "number" && Number.isFinite(font.size)) {
+      sanitized.size = font.size;
+    }
+    if (Object.keys(sanitized).length > 0)
+      theme.font = sanitized;
+  }
+  return Object.keys(theme).length > 0 ? theme : undefined;
+}
+function mergeThemes(base, override) {
+  if (!base)
+    return override;
+  if (!override)
+    return base;
+  const merged = { ...base, ...override };
+  if (base.palette || override.palette) {
+    merged.palette = {
+      ...base.palette ?? {},
+      ...override.palette ?? {}
+    };
+    for (const key of PER_MODE_COLOR_KEYS) {
+      const b = base.palette?.[key];
+      const o = override.palette?.[key];
+      if (b || o) {
+        merged.palette[key] = { ...b ?? {}, ...o ?? {} };
+      }
+    }
+  }
+  if (base.font || override.font) {
+    merged.font = { ...base.font ?? {}, ...override.font ?? {} };
+  }
+  return merged;
+}
 var isPublisherConfigFrozen = (serverRoot) => {
   try {
     const publisherConfig = getPublisherConfig(serverRoot);
@@ -243198,17 +243294,29 @@ var getProcessedPublisherConfig = (serverRoot) => {
       logger.warn(`Environment "${environment.name}" has no valid packages. Skipping entry.`);
       continue;
     }
+    const envTheme = sanitizeTheme(environment.theme, `environment "${environment.name}"`);
+    const resolvedTheme = mergeThemes(rawConfig.theme, envTheme);
     validEnvironments.push({
       name: environment.name,
       packages: validPackages,
-      connections: convertConnectionsToApiConnections(environment.connections || [])
+      connections: convertConnectionsToApiConnections(environment.connections || []),
+      ...resolvedTheme ? { theme: resolvedTheme } : {}
     });
   }
   return {
     frozenConfig: rawConfig.frozenConfig ?? false,
+    ...rawConfig.theme ? { theme: rawConfig.theme } : {},
     environments: validEnvironments
   };
 };
+var getInstanceTheme = (serverRoot) => {
+  try {
+    return getPublisherConfig(serverRoot).theme;
+  } catch (error) {
+    logger.error(`Error reading instance theme from ${PUBLISHER_CONFIG_NAME}`, { error });
+    return;
+  }
+};
 
 // src/controller/connection.controller.ts
 init_errors();
@@ -246665,7 +246773,138 @@ function safeJoinUnderRoot(root, ...segments) {
 
 // src/service/connection_config.ts
 import { createPrivateKey } from "crypto";
+import { existsSync } from "fs";
 import path3 from "path";
+
+// src/service/proxy.ts
+init_logger();
+var import_ssh2 = __toESM(require_lib10(), 1);
+import net from "net";
+var SSH_CONNECT_TIMEOUT_MS = 15000;
+var SSH_KEEPALIVE_INTERVAL_MS = 15000;
+function parseHostKeys(raw) {
+  const keys = new Set;
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const tokens = trimmed.split(/\s+/);
+    const blob = tokens.find((t) => /^AAAA[A-Za-z0-9+/]+={0,2}$/.test(t));
+    const key = blob ?? tokens[tokens.length - 1];
+    if (key)
+      keys.add(key);
+  }
+  return keys;
+}
+async function openProxy(proxy, target) {
+  if (proxy.type === "ssh") {
+    if (!proxy.ssh) {
+      throw new Error("ConnectionProxy type is 'ssh' but the 'ssh' config object is missing.");
+    }
+    return openSshProxy(proxy.ssh, target);
+  }
+  throw new Error(`Proxy type '${proxy.type}' is not supported yet.  Only 'ssh' is implemented.`);
+}
+function openSshProxy(ssh, target) {
+  return new Promise((resolve2, reject) => {
+    const client = new import_ssh2.Client;
+    let localPort = 0;
+    let server;
+    let settled = false;
+    const sockets = new Set;
+    function fail(err) {
+      if (settled)
+        return;
+      settled = true;
+      server?.close();
+      client.end();
+      reject(err);
+    }
+    const connectConfig = {
+      host: ssh.host,
+      port: ssh.port ?? 22,
+      username: ssh.username,
+      privateKey: ssh.privateKey,
+      ...ssh.privateKeyPass ? { passphrase: ssh.privateKeyPass } : {},
+      readyTimeout: SSH_CONNECT_TIMEOUT_MS,
+      keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
+      keepaliveCountMax: 3,
+      hostVerifier: (key) => {
+        const presented = key.toString("base64");
+        if (ssh.hostKey) {
+          const pinned = parseHostKeys(ssh.hostKey);
+          if (pinned.has(presented)) {
+            return true;
+          }
+          fail(new Error(`SSH host-key verification failed for ${ssh.host}: the presented key ` + `(${presented.slice(0, 24)}…) is not among the ${pinned.size} pinned ` + `host key(s).`));
+          return false;
+        }
+        logger.warn(`Connecting to SSH bastion ${ssh.host} without host-key verification (no hostKey pinned).`);
+        return true;
+      }
+    };
+    client.on("error", (err) => fail(err));
+    client.on("ready", () => {
+      server = net.createServer((socket) => {
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+        const earlyData = [];
+        socket.on("data", (chunk) => earlyData.push(chunk));
+        client.forwardOut("127.0.0.1", localPort, target.host, target.port, (err, channel) => {
+          if (err) {
+            socket.destroy(err);
+            return;
+          }
+          if (socket.destroyed) {
+            channel.destroy();
+            return;
+          }
+          for (const chunk of earlyData) {
+            channel.write(chunk);
+          }
+          earlyData.length = 0;
+          socket.removeAllListeners("data");
+          socket.pipe(channel);
+          channel.pipe(socket);
+          socket.on("error", () => channel.destroy());
+          channel.on("error", () => socket.destroy());
+          socket.on("close", () => channel.destroy());
+          channel.on("close", () => socket.destroy());
+        });
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const addr = server.address();
+        if (!addr || typeof addr === "string") {
+          fail(new Error("Failed to obtain local listen port for SSH proxy."));
+          return;
+        }
+        localPort = addr.port;
+        if (settled)
+          return;
+        settled = true;
+        resolve2({
+          host: "127.0.0.1",
+          port: localPort,
+          close() {
+            return new Promise((res) => {
+              for (const s of sockets)
+                s.destroy();
+              server.close(() => {
+                client.end();
+                res();
+              });
+            });
+          }
+        });
+      });
+      server.on("error", (err) => fail(err));
+    });
+    client.connect(connectConfig);
+  });
+}
+
+// src/service/connection_config.ts
+var PROXIED_SSLMODES = ["disable", "no-verify", "verify-ca"];
 var PUBLISHER_DUCKDB_API_FIELDS = new Set(["attachedDatabases"]);
 function normalizeSnowflakePrivateKey(privateKey) {
   let privateKeyContent = privateKey.trim();
@@ -246850,6 +247089,29 @@ function validateConnectionShape(connection) {
     if (!connection.postgresConnection?.host || !connection.postgresConnection?.port) {
       throw new Error(`Connection proxy on '${connection.name}' requires explicit host and port on the ` + `postgres connection; the connectionString form is not supported with a proxy.`);
     }
+    const hostKey = connection.proxy.ssh?.hostKey;
+    if (hostKey && parseHostKeys(hostKey).size === 0) {
+      throw new Error(`Connection proxy on '${connection.name}' has a hostKey with no usable host-key line ` + `(only blanks/comments). Provide an OpenSSH known_hosts line or base64 blob, or omit ` + `hostKey to connect unpinned.`);
+    }
+    const sslmode = connection.postgresConnection?.sslmode;
+    if (sslmode != null) {
+      if (!PROXIED_SSLMODES.includes(sslmode)) {
+        throw new Error(`Connection proxy on '${connection.name}' has unsupported sslmode '${sslmode}' ` + `(expected ${PROXIED_SSLMODES.join(" | ")}).`);
+      }
+      if (sslmode === "verify-ca") {
+        const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+        if (!caBundle || !existsSync(caBundle)) {
+          throw new Error(`Connection proxy on '${connection.name}' uses sslmode 'verify-ca' but no readable ` + `CA bundle is available (NODE_EXTRA_CA_CERTS is unset or points at a missing file). ` + `Add the CA bundle to the image or use sslmode 'no-verify'.`);
+        }
+      }
+    }
+    const dbName = connection.postgresConnection?.databaseName;
+    if (dbName && decodeURI(encodeURIComponent(dbName)) !== dbName) {
+      throw new Error(`Connection proxy on '${connection.name}' has a database name with characters that can't ` + `be carried over a proxied connection (${JSON.stringify(dbName)}). Use a database name ` + `without URI-reserved characters (; , / ? : @ & = + $ #).`);
+    }
+  }
+  if (!connection.proxy && connection.postgresConnection?.sslmode) {
+    throw new Error(`Connection '${connection.name}' sets postgresConnection.sslmode but has no proxy; sslmode is ` + `only supported for proxied connections (direct connections use the deployment PGSSLMODE).`);
   }
   switch (connection.type) {
     case "postgres":
@@ -247126,126 +247388,6 @@ function validateAndBuildTrinoCoreConfig(trinoConfig) {
   throw new Error(`Invalid Trino connection: expected "http://server:port" or "https://server:port".`);
 }
 
-// src/service/proxy.ts
-var import_ssh2 = __toESM(require_lib10(), 1);
-import net from "net";
-var SSH_CONNECT_TIMEOUT_MS = 15000;
-var SSH_KEEPALIVE_INTERVAL_MS = 15000;
-function extractHostKeyBase64(raw) {
-  const tokens = raw.trim().split(/\s+/);
-  const blob = tokens.find((t) => /^AAAA[A-Za-z0-9+/]+={0,2}$/.test(t));
-  return blob ?? tokens[tokens.length - 1] ?? "";
-}
-async function openProxy(proxy, target) {
-  if (proxy.type === "ssh") {
-    if (!proxy.ssh) {
-      throw new Error("ConnectionProxy type is 'ssh' but the 'ssh' config object is missing.");
-    }
-    return openSshProxy(proxy.ssh, target);
-  }
-  throw new Error(`Proxy type '${proxy.type}' is not supported yet.  Only 'ssh' is implemented.`);
-}
-function openSshProxy(ssh, target) {
-  return new Promise((resolve2, reject) => {
-    const client = new import_ssh2.Client;
-    let localPort = 0;
-    let server;
-    let settled = false;
-    const sockets = new Set;
-    function fail(err) {
-      if (settled)
-        return;
-      settled = true;
-      server?.close();
-      client.end();
-      reject(err);
-    }
-    const connectConfig = {
-      host: ssh.host,
-      port: ssh.port ?? 22,
-      username: ssh.username,
-      privateKey: ssh.privateKey,
-      ...ssh.privateKeyPass ? { passphrase: ssh.privateKeyPass } : {},
-      readyTimeout: SSH_CONNECT_TIMEOUT_MS,
-      keepaliveInterval: SSH_KEEPALIVE_INTERVAL_MS,
-      keepaliveCountMax: 3,
-      hostVerifier: (key) => {
-        const presented = key.toString("base64");
-        if (ssh.hostKey) {
-          const expected = extractHostKeyBase64(ssh.hostKey);
-          if (presented !== expected) {
-            fail(new Error(`SSH host-key mismatch for ${ssh.host}: expected ${expected.slice(0, 24)}… but got ${presented.slice(0, 24)}….`));
-            return false;
-          }
-          return true;
-        }
-        if (process.env.PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY === "true") {
-          return true;
-        }
-        fail(new Error(`SSH connection to ${ssh.host} refused: no hostKey provided and ` + `PUBLISHER_SSH_ALLOW_UNKNOWN_HOSTKEY is not 'true'.  ` + `Set hostKey to the bastion's host public key (an OpenSSH ` + `known_hosts line or its base64 blob, e.g. from ssh-keyscan).`));
-        return false;
-      }
-    };
-    client.on("error", (err) => fail(err));
-    client.on("ready", () => {
-      server = net.createServer((socket) => {
-        sockets.add(socket);
-        socket.on("close", () => sockets.delete(socket));
-        const earlyData = [];
-        socket.on("data", (chunk) => earlyData.push(chunk));
-        client.forwardOut("127.0.0.1", localPort, target.host, target.port, (err, channel) => {
-          if (err) {
-            socket.destroy(err);
-            return;
-          }
-          if (socket.destroyed) {
-            channel.destroy();
-            return;
-          }
-          for (const chunk of earlyData) {
-            channel.write(chunk);
-          }
-          earlyData.length = 0;
-          socket.removeAllListeners("data");
-          socket.pipe(channel);
-          channel.pipe(socket);
-          socket.on("error", () => channel.destroy());
-          channel.on("error", () => socket.destroy());
-          socket.on("close", () => channel.destroy());
-          channel.on("close", () => socket.destroy());
-        });
-      });
-      server.listen(0, "127.0.0.1", () => {
-        const addr = server.address();
-        if (!addr || typeof addr === "string") {
-          fail(new Error("Failed to obtain local listen port for SSH proxy."));
-          return;
-        }
-        localPort = addr.port;
-        if (settled)
-          return;
-        settled = true;
-        resolve2({
-          host: "127.0.0.1",
-          port: localPort,
-          close() {
-            return new Promise((res) => {
-              for (const s of sockets)
-                s.destroy();
-              server.close(() => {
-                client.end();
-                res();
-              });
-            });
-          }
-        });
-      });
-      server.on("error", (err) => fail(err));
-    });
-    client.connect(connectConfig);
-  });
-}
-
 // src/service/connection.ts
 async function installAndLoadExtension(connection, extensionName, fromCommunity = false) {
   try {
@@ -247798,19 +247940,37 @@ function buildSnowflakePrivateKeyConnection(metadata) {
     poolOptions: buildPoolOptions({ poolMin: 1, poolMax: 20 })
   });
 }
+function buildProxiedSslQuery(name, sslmode) {
+  const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+  const mode = sslmode ?? "no-verify";
+  switch (mode) {
+    case "disable":
+      return "?sslmode=disable";
+    case "no-verify":
+      return "?sslmode=no-verify";
+    case "verify-ca":
+      if (!caBundle) {
+        throw new Error(`Connection proxy on '${name}' uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset). Add the CA bundle to the image or use sslmode 'no-verify'.`);
+      }
+      return `?uselibpqcompat=true&sslmode=verify-ca&sslrootcert=${encodeURIComponent(caBundle)}`;
+    default:
+      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${mode}' (expected disable | no-verify | verify-ca).`);
+  }
+}
 function buildProxiedPostgresConnection(metadata, endpoint) {
   const name = metadata.apiConnection.name;
   const pg = metadata.apiConnection.postgresConnection;
   if (!pg) {
     throw new Error(`Proxied connection '${name}' has type 'postgres' but no postgresConnection config.`);
   }
+  const enc = encodeURIComponent;
+  const auth = pg.userName ? `${enc(pg.userName)}${pg.password ? `:${enc(pg.password)}` : ""}@` : "";
+  const db = pg.databaseName ? `/${enc(pg.databaseName)}` : "";
+  const ssl = buildProxiedSslQuery(name, pg.sslmode);
+  const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${ssl}`;
   return new PooledPostgresConnection({
     name,
-    host: endpoint.host,
-    port: endpoint.port,
-    username: pg.userName,
-    password: pg.password,
-    databaseName: pg.databaseName,
+    connectionString,
     poolMin: 1,
     poolMax: 20
   });
@@ -247824,6 +247984,13 @@ function buildAzureDuckDBConnection(metadata, entry) {
 function getMetadataForLookup(metadata, name) {
   return name ? metadata.get(name) : undefined;
 }
+function applyConnectionFingerprint(connection, metadata) {
+  const fingerprint = metadata?.apiConnection.fingerprint;
+  if (fingerprint) {
+    connection.getDigest = () => fingerprint;
+  }
+  return connection;
+}
 function isDuckDBConnection(connection) {
   return connection instanceof DuckDBConnection;
 }
@@ -247849,9 +248016,8 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
     }
     await attachPromise;
   }
-  malloyConfig.wrapConnections((base) => ({
-    lookupConnection: async (name) => {
-      const metadata = getMetadataForLookup(assembled.metadata, name);
+  malloyConfig.wrapConnections((base) => {
+    const resolveConnection = async (name, metadata) => {
       if (metadata?.isDuckLake) {
         let connectionPromise = duckLakeCache.get(name);
         if (!connectionPromise) {
@@ -247923,8 +248089,14 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
         await attachOnce(connection, metadata);
       }
       return connection;
-    }
-  }));
+    };
+    return {
+      lookupConnection: async (name) => {
+        const metadata = getMetadataForLookup(assembled.metadata, name);
+        return applyConnectionFingerprint(await resolveConnection(name, metadata), metadata);
+      }
+    };
+  });
   return {
     malloyConfig,
     apiConnections: assembled.apiConnections,
@@ -256465,13 +256637,10 @@ class DuckDBRepository {
 init_logger();
 async function initializeSchema(db, force = false) {
   const initialized = await db.isInitialized();
-  if (initialized && !force) {
-    return;
-  }
   if (force) {
     logger.info("Reinitializing database schema dropping and recreating all tables");
     await dropAllTables(db);
-  } else {
+  } else if (!initialized) {
     await dropLegacyProjectSchema(db);
     logger.info("Creating database schema for the first time...");
   }
@@ -256530,6 +256699,14 @@ async function initializeSchema(db, force = false) {
       FOREIGN KEY (environment_id) REFERENCES environments(id)
     )
   `);
+  await db.run(`
+    CREATE TABLE IF NOT EXISTS themes (
+      id VARCHAR PRIMARY KEY,
+      payload JSON NOT NULL,
+      created_at TIMESTAMP NOT NULL,
+      updated_at TIMESTAMP NOT NULL
+    )
+  `);
   await db.run("CREATE INDEX IF NOT EXISTS idx_packages_environment_id ON packages(environment_id)");
   await db.run("CREATE INDEX IF NOT EXISTS idx_connections_environment_id ON connections(environment_id)");
   await db.run("CREATE INDEX IF NOT EXISTS idx_materializations_environment_package ON materializations(environment_id, package_name)");
@@ -256562,7 +256739,8 @@ async function dropAllTables(db) {
     "materializations",
     "packages",
     "connections",
-    "environments"
+    "environments",
+    "themes"
   ];
   logger.info("Dropping tables:", tables.join(", "));
   for (const table of tables) {
@@ -256608,6 +256786,15 @@ class StorageManager {
     this.connection = connection;
     this.repository = new DuckDBRepository(connection);
   }
+  getDuckDbConnection() {
+    if (!this.connection) {
+      throw new Error("Storage not initialized");
+    }
+    if (!(this.connection instanceof DuckDBConnection2)) {
+      throw new Error("Underlying storage connection is not DuckDB");
+    }
+    return this.connection;
+  }
   getRepository() {
     if (!this.repository) {
       throw new Error("Storage not initialized. Call initialize() first.");
@@ -256754,16 +256941,16 @@ async function fetchManifestEntries(uri) {
     throw new Error(`Failed to parse build manifest at ${uri}: ${err instanceof Error ? err.message : String(err)}`);
   }
   const entries = {};
-  for (const [buildId, entry] of Object.entries(parsed.entries ?? {})) {
+  for (const [sourceEntityId, entry] of Object.entries(parsed.entries ?? {})) {
     const physicalTableName = entry?.physicalTableName;
     if (!physicalTableName) {
       logger.warn("Manifest entry has no physicalTableName; skipping", {
         uri,
-        buildId
+        sourceEntityId
       });
       continue;
     }
-    entries[buildId] = { tableName: physicalTableName };
+    entries[sourceEntityId] = { tableName: physicalTableName };
   }
   return entries;
 }
@@ -258255,7 +258442,7 @@ function* iterGraphSources(graph, sources) {
     }
   }
 }
-function computeBuildId(source, connectionDigests) {
+function computeSourceEntityId(source, connectionDigests) {
   return source.makeBuildId(connectionDigests[source.connectionName], source.getSQL());
 }
 async function resolvePackageConnections(pkg, names) {
@@ -258343,7 +258530,7 @@ function deriveBuildPlan(graphs, sources, connectionDigests, sourceNames, source
       sourceID: source.sourceID,
       connectionName: source.connectionName,
       dialect: source.dialectName,
-      buildId: computeBuildId(source, connectionDigests),
+      sourceEntityId: computeSourceEntityId(source, connectionDigests),
       sql: source.getSQL(),
       columns: deriveColumns(source),
       annotationFields: deriveAnnotationFields(source),
@@ -260983,7 +261170,7 @@ class MaterializationController {
     }
     const instruction = raw;
     const required = [
-      "buildId",
+      "sourceEntityId",
       "materializedTableId",
       "physicalTableName",
       "realization"
@@ -260997,7 +261184,7 @@ class MaterializationController {
       throw new BadRequestError("Build instruction 'realization' must be COPY or SNAPSHOT");
     }
     return {
-      buildId: instruction.buildId,
+      sourceEntityId: instruction.sourceEntityId,
       sourceID: typeof instruction.sourceID === "string" ? instruction.sourceID : undefined,
       materializedTableId: instruction.materializedTableId,
       physicalTableName: instruction.physicalTableName,
@@ -261018,6 +261205,40 @@ class MaterializationController {
   }
 }
 
+// src/controller/theme.controller.ts
+init_errors();
+class ThemeController {
+  themeStore;
+  serverRoot;
+  constructor(themeStore, serverRoot) {
+    this.themeStore = themeStore;
+    this.serverRoot = serverRoot;
+  }
+  getTheme = async () => {
+    const theme = await this.themeStore.get();
+    return theme ?? {};
+  };
+  putTheme = async (body) => {
+    if (isPublisherConfigFrozen(this.serverRoot)) {
+      throw new FrozenConfigError('Cannot edit theme: publisher.config.json has "frozenConfig": true.');
+    }
+    const isEmptyObject2 = typeof body === "object" && body !== null && !Array.isArray(body) && Object.keys(body).length === 0;
+    const sanitized = sanitizeTheme(body, "PUT /api/v0/theme");
+    if (!sanitized && !isEmptyObject2) {
+      throw new BadRequestError("Theme payload was malformed (expected an object).");
+    }
+    const saved = await this.themeStore.set(sanitized ?? {});
+    return saved;
+  };
+  resetTheme = async () => {
+    if (isPublisherConfigFrozen(this.serverRoot)) {
+      throw new FrozenConfigError('Cannot reset theme: publisher.config.json has "frozenConfig": true.');
+    }
+    const reseeded = await this.themeStore.reset();
+    return reseeded ?? {};
+  };
+}
+
 // ../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 60000;
 
@@ -267581,9 +267802,9 @@ async function resolveEnvironmentId(repository, environmentName) {
 }
 
 // src/service/materialization_service.ts
-var STAGING_BUILD_ID_LEN = 12;
-function stagingSuffix(buildId) {
-  return `_${buildId.substring(0, STAGING_BUILD_ID_LEN)}`;
+var STAGING_ID_LEN = 12;
+function stagingSuffix(sourceEntityId) {
+  return `_${sourceEntityId.replace(/-/g, "").substring(0, STAGING_ID_LEN)}`;
 }
 function selfAssignTableName(persistSource) {
   return deriveAnnotationFields(persistSource).name || persistSource.name;
@@ -267745,18 +267966,18 @@ class MaterializationService {
       for (const persistSource of iterGraphSources(graph, compiled.sources)) {
         if (include && !include.has(persistSource.name))
           continue;
-        const buildId = computeBuildId(persistSource, compiled.connectionDigests);
-        if (seen.has(buildId))
+        const sourceEntityId = computeSourceEntityId(persistSource, compiled.connectionDigests);
+        if (seen.has(sourceEntityId))
           continue;
-        seen.add(buildId);
-        const prior = priorEntries[buildId];
+        seen.add(sourceEntityId);
+        const prior = priorEntries[sourceEntityId];
         if (prior && prior.physicalTableName) {
-          carried[buildId] = prior;
+          carried[sourceEntityId] = prior;
           continue;
         }
         instructions.push({
-          buildId,
-          materializedTableId: `local-${buildId.substring(0, STAGING_BUILD_ID_LEN)}`,
+          sourceEntityId,
+          materializedTableId: `local-${sourceEntityId.substring(0, STAGING_ID_LEN)}`,
           physicalTableName: selfAssignTableName(persistSource),
           realization: "COPY"
         });
@@ -267777,9 +267998,11 @@ class MaterializationService {
   }
   async autoLoadManifest(environment, packageName, entries) {
     const manifestEntries = {};
-    for (const [buildId, entry] of Object.entries(entries)) {
+    for (const [sourceEntityId, entry] of Object.entries(entries)) {
       if (entry.physicalTableName) {
-        manifestEntries[buildId] = { tableName: entry.physicalTableName };
+        manifestEntries[sourceEntityId] = {
+          tableName: entry.physicalTableName
+        };
       }
     }
     try {
@@ -267801,13 +268024,13 @@ class MaterializationService {
     if (!plan) {
       throw new BadRequestError("Package has no persist sources; buildInstructions cannot be applied");
     }
-    const plannedBuildIds = new Set;
+    const plannedSourceEntityIds = new Set;
     for (const source of Object.values(plan.sources)) {
-      plannedBuildIds.add(source.buildId);
+      plannedSourceEntityIds.add(source.sourceEntityId);
     }
     for (const instruction of instructions) {
-      if (!plannedBuildIds.has(instruction.buildId)) {
-        throw new BadRequestError(`Instruction references unknown buildId '${instruction.buildId}'`);
+      if (!plannedSourceEntityIds.has(instruction.sourceEntityId)) {
+        throw new BadRequestError(`Instruction references unknown sourceEntityId '${instruction.sourceEntityId}'`);
       }
       if (instruction.realization === "SNAPSHOT") {
         throw new BadRequestError("realization=SNAPSHOT is not supported (COPY only)");
@@ -267817,20 +268040,22 @@ class MaterializationService {
   async executeInstructedBuild(compiled, instructions, seedEntries, signal) {
     const { graphs, sources, connectionDigests, connections } = compiled;
     const bySourceID = new Map;
-    const byBuildId = new Map;
+    const bySourceEntityId = new Map;
     for (const instruction of instructions) {
       if (instruction.sourceID) {
         bySourceID.set(instruction.sourceID, instruction);
       }
-      byBuildId.set(instruction.buildId, instruction);
+      bySourceEntityId.set(instruction.sourceEntityId, instruction);
     }
     const manifest = new Manifest;
     const entries = {};
-    for (const [buildId, entry] of Object.entries(seedEntries)) {
+    for (const [sourceEntityId, entry] of Object.entries(seedEntries)) {
       if (entry.physicalTableName) {
-        manifest.update(buildId, { tableName: entry.physicalTableName });
+        manifest.update(sourceEntityId, {
+          tableName: entry.physicalTableName
+        });
       }
-      entries[buildId] = entry;
+      entries[sourceEntityId] = entry;
     }
     for (const graph of graphs) {
       const connection = connections.get(graph.connectionName);
@@ -267840,25 +268065,25 @@ class MaterializationService {
       for (const persistSource of iterGraphSources(graph, sources)) {
         if (signal.aborted)
           throw new Error("Build cancelled");
-        const buildId = computeBuildId(persistSource, connectionDigests);
-        const instruction = bySourceID.get(persistSource.sourceID) ?? byBuildId.get(buildId);
+        const sourceEntityId = computeSourceEntityId(persistSource, connectionDigests);
+        const instruction = bySourceID.get(persistSource.sourceID) ?? bySourceEntityId.get(sourceEntityId);
         if (!instruction)
           continue;
         const entry = await this.buildOneSource(persistSource, instruction, connection, connectionDigests, manifest);
-        entries[buildId] = entry;
+        entries[sourceEntityId] = entry;
       }
     }
     return entries;
   }
   async buildOneSource(persistSource, instruction, connection, connectionDigests, manifest) {
-    const buildId = instruction.buildId;
+    const sourceEntityId = instruction.sourceEntityId;
     const physicalTableName = instruction.physicalTableName;
     const buildSQL = persistSource.getSQL({
       buildManifest: manifest.buildManifest,
       connectionDigests
     });
     const bareName = bareTableName(physicalTableName);
-    const stagingTableName = `${physicalTableName}${stagingSuffix(buildId)}`;
+    const stagingTableName = `${physicalTableName}${stagingSuffix(sourceEntityId)}`;
     const dialect = persistSource.dialectName;
     const quotedStaging = quoteTablePath(stagingTableName, dialect);
     const quotedPhysical = quoteTablePath(physicalTableName, dialect);
@@ -267881,7 +268106,7 @@ class MaterializationService {
       }
       throw err;
     }
-    manifest.update(buildId, { tableName: physicalTableName });
+    manifest.update(sourceEntityId, { tableName: physicalTableName });
     const durationMs = Math.round(performance.now() - startTime);
     recordSourceBuildDuration(durationMs);
     logger.info(`Built materialized source ${persistSource.name}`, {
@@ -267889,7 +268114,7 @@ class MaterializationService {
       durationMs
     });
     return {
-      buildId,
+      sourceEntityId,
       sourceName: persistSource.name,
       materializedTableId: instruction.materializedTableId,
       physicalTableName,
@@ -267946,7 +268171,7 @@ class MaterializationService {
       if (!connectionName || !physicalTableName) {
         logger.warn("Skipping manifest entry with no connection/table", {
           materializationId: m.id,
-          buildId: entry.buildId
+          sourceEntityId: entry.sourceEntityId
         });
         continue;
       }
@@ -267958,7 +268183,7 @@ class MaterializationService {
         }
         const dialect = connection.dialectName;
         await connection.runSQL(`DROP TABLE IF EXISTS ${quoteTablePath(physicalTableName, dialect)}`);
-        await connection.runSQL(`DROP TABLE IF EXISTS ${quoteTablePath(`${physicalTableName}${stagingSuffix(entry.buildId)}`, dialect)}`);
+        await connection.runSQL(`DROP TABLE IF EXISTS ${quoteTablePath(`${physicalTableName}${stagingSuffix(entry.sourceEntityId)}`, dialect)}`);
         recordDropTables("success");
         logger.info("Dropped materialized table on delete", {
           materializationId: m.id,
@@ -268125,6 +268350,122 @@ class PackageMemoryGovernor {
   }
 }
 
+// src/service/theme_store.ts
+init_logger();
+var THEME_ROW_ID = "default";
+
+class ThemeStore {
+  storageManager;
+  serverRoot;
+  mutex = new Mutex;
+  cached;
+  cacheLoaded = false;
+  constructor(storageManager, serverRoot) {
+    this.storageManager = storageManager;
+    this.serverRoot = serverRoot;
+  }
+  get db() {
+    return this.storageManager.getDuckDbConnection();
+  }
+  async initialize() {
+    await this.mutex.runExclusive(async () => {
+      await this.loadLocked();
+    });
+  }
+  async get() {
+    if (!this.cacheLoaded) {
+      await this.initialize();
+    }
+    return this.cached;
+  }
+  async set(theme) {
+    return this.mutex.runExclusive(async () => {
+      await this.persistLocked(theme);
+      this.cached = theme;
+      this.cacheLoaded = true;
+      return theme;
+    });
+  }
+  async reset() {
+    return this.mutex.runExclusive(async () => {
+      await this.db.run("DELETE FROM themes WHERE id = ?", [THEME_ROW_ID]);
+      this.cached = undefined;
+      this.cacheLoaded = false;
+      await this.loadLocked();
+      return this.cached;
+    });
+  }
+  async loadLocked() {
+    if (this.cacheLoaded)
+      return;
+    const row = await this.db.get("SELECT payload FROM themes WHERE id = ?", [THEME_ROW_ID]);
+    if (row?.payload) {
+      let parsed;
+      try {
+        parsed = JSON.parse(row.payload);
+      } catch (error) {
+        logger.warn("ThemeStore: stored theme JSON is unparseable; treating as empty", { error });
+        this.cacheLoaded = true;
+        return;
+      }
+      const sanitized = sanitizeTheme(parsed, "ThemeStore.load");
+      const dropped = listSanitizerDrops(parsed, sanitized);
+      if (dropped.length > 0) {
+        logger.info("ThemeStore: dropped stale fields from stored theme during load", { dropped });
+      }
+      this.cached = sanitized;
+    } else {
+      const seed = getInstanceTheme(this.serverRoot);
+      if (seed) {
+        this.cached = seed;
+        await this.persistLocked(seed);
+      }
+    }
+    this.cacheLoaded = true;
+  }
+  async persistLocked(theme) {
+    const now = new Date().toISOString();
+    const payload = JSON.stringify(theme);
+    await this.db.run(`INSERT INTO themes (id, payload, created_at, updated_at)
+          VALUES (?, ?, ?, ?)
+          ON CONFLICT (id) DO UPDATE SET
+            payload = EXCLUDED.payload,
+            updated_at = EXCLUDED.updated_at`, [THEME_ROW_ID, payload, now, now]);
+  }
+}
+function listSanitizerDrops(raw, sanitized) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return [];
+  const r = raw;
+  const drops = [];
+  const topKeys = ["defaultMode", "allowUserToggle"];
+  for (const k of topKeys) {
+    if (r[k] !== undefined && sanitized?.[k] === undefined)
+      drops.push(k);
+  }
+  if (r.palette && typeof r.palette === "object" && !Array.isArray(r.palette)) {
+    const rp = r.palette;
+    const sp = sanitized?.palette ?? {};
+    for (const k of Object.keys(rp)) {
+      if (rp[k] !== undefined && sp[k] === undefined)
+        drops.push(`palette.${k}`);
+    }
+  } else if (r.palette !== undefined && (!sanitized || sanitized.palette === undefined)) {
+    drops.push("palette");
+  }
+  if (r.font && typeof r.font === "object" && !Array.isArray(r.font)) {
+    const rf = r.font;
+    const sf = sanitized?.font ?? {};
+    for (const k of Object.keys(rf)) {
+      if (rf[k] !== undefined && sf[k] === undefined)
+        drops.push(`font.${k}`);
+    }
+  } else if (r.font !== undefined && (!sanitized || sanitized.font === undefined)) {
+    drops.push("font");
+  }
+  return drops;
+}
+
 // src/server.ts
 function parseArgs() {
   const args = process.argv.slice(2);
@@ -268219,6 +268560,8 @@ var queryController = new QueryController(environmentStore);
 var compileController = new CompileController(environmentStore);
 var materializationService = new MaterializationService(environmentStore);
 var materializationController = new MaterializationController(materializationService);
+var themeStore = new ThemeStore(environmentStore.storageManager, SERVER_ROOT);
+var themeController = new ThemeController(themeStore, SERVER_ROOT);
 var mcpApp = import_express2.default();
 registerHealthEndpoints(mcpApp);
 mcpApp.use(MCP_ENDPOINT, import_express2.default.json());
@@ -268492,13 +268835,44 @@ app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/page
 app.get(`${API_PREFIX2}/status`, async (_req, res) => {
   try {
     const status = await environmentStore.getStatus();
-    res.status(200).json(status);
+    const theme = environmentStore.storageManager.isInitialized() ? await themeStore.get() : undefined;
+    res.status(200).json({ ...status, theme: theme ?? {} });
   } catch (error) {
     logger.error("Error getting status", { error });
     const { json, status } = internalErrorToHttpError(error);
     res.status(status).json(json);
   }
 });
+app.get(`${API_PREFIX2}/theme`, async (_req, res) => {
+  try {
+    if (!environmentStore.storageManager.isInitialized()) {
+      throw new ServiceUnavailableError("Theme storage is still initializing. Retry shortly.");
+    }
+    res.status(200).json(await themeController.getTheme());
+  } catch (error) {
+    logger.error("Error getting theme", { error });
+    const { json, status } = internalErrorToHttpError(error);
+    res.status(status).json(json);
+  }
+});
+app.put(`${API_PREFIX2}/theme`, async (req, res) => {
+  try {
+    res.status(200).json(await themeController.putTheme(req.body));
+  } catch (error) {
+    logger.error("Error saving theme", { error });
+    const { json, status } = internalErrorToHttpError(error);
+    res.status(status).json(json);
+  }
+});
+app.delete(`${API_PREFIX2}/theme`, async (_req, res) => {
+  try {
+    res.status(200).json(await themeController.resetTheme());
+  } catch (error) {
+    logger.error("Error resetting theme", { error });
+    const { json, status } = internalErrorToHttpError(error);
+    res.status(status).json(json);
+  }
+});
 app.get(`${API_PREFIX2}/watch-mode/status`, watchModeController.getWatchStatus);
 app.post(`${API_PREFIX2}/watch-mode/start`, watchModeController.startWatching);
 app.post(`${API_PREFIX2}/watch-mode/stop`, watchModeController.stopWatchMode);