@malloy-publisher/server 0.0.225 → 0.0.227

package/dist/app/assets/{index-JXgvyZna.js → index-gEWxu09x.js}

@@ -1,4 +1,4 @@
-import{aI as ci}from"./index-C6gZ6sSY.js";import{r as di}from"./index-w_0OQJgZ.js";function pi(u,re){for(var j=0;j<re.length;j++){const N=re[j];if(typeof N!="string"&&!Array.isArray(N)){for(const E in N)if(E!=="default"&&!(E in u)){const S=Object.getOwnPropertyDescriptor(N,E);S&&Object.defineProperty(u,E,S.get?S:{enumerable:!0,get:()=>N[E]})}}}return Object.freeze(Object.defineProperty(u,Symbol.toStringTag,{value:"Module"}))}var bt={},ut={},Or;function Vt(){if(Or)return ut;Or=1,Object.defineProperty(ut,"__esModule",{value:!0}),ut.isChainOp=u,ut.isStringCondition=re,ut.isStringFilter=j,ut.isBooleanFilter=N,ut.isNumberFilter=E,ut.isTemporalFilter=S,ut.isFilterExpression=w,ut.isFilterable=y;function u(o){return["and","or",","].includes(o)}function re(o){return["starts","ends","contains","="].includes(o.operator)}function j(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["starts","ends","contains","=","~","null","empty","and","or",",","()"].includes(o.operator)}function N(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["null","true","false","=false","=true"].includes(o.operator)}function E(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["range","<=",">=","!=","=",">","<","and","or","()","null"].includes(o.operator)}function S(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["literal","before","after","to","for","in","and","or","in_last","this","last","next","()","null"].includes(o.operator)}function w(o){return typeof o=="object"&&o!==null&&"operator"in o}function y(o){return["string","number","boolean","timestamp","timestamptz","date"].includes(o)}return ut}var Pt={},Er;function hi(){return Er||(Er=1,Object.defineProperty(Pt,"__esModule",{value:!0}),Pt.BooleanFilterExpression=void 0,Pt.BooleanFilterExpression={parse(u){var re;if(u.match(/^\s*$/))return{parsed:null,log:[]};const j={parsed:null,log:[]};let N=u.toLowerCase().trim().replace(/\s\s+/," "),E=!1;if(N.startsWith("not ")&&(E=!0,N=N.slice(4)),N==="true")j.parsed={operator:"true"};else if(N==="=true")j.parsed={operator:"=true"};else if(N==="false")j.parsed={operator:"false"};else if(N==="=false")j.parsed={operator:"=false"};else if(N==="null")j.parsed={operator:"null"};else{const S=u.match(/[^\s]/),w=S&&(re=S.index)!==null&&re!==void 0?re:0;j.log=[{message:`Illegal boolean filter '${N}'. Must be one of true,=true,false,=false,null`,severity:"error",startIndex:w,endIndex:w+u.length-1}]}return E&&j.parsed&&(j.parsed.not=!0),j},unparse(u){return u===null?"":(u.not?"not ":"")+u.operator}}),Pt}var pr={},Ue={},kr;function Ht(){if(kr)return Ue;kr=1,Object.defineProperty(Ue,"__esModule",{value:!0}),Ue.maybeNot=re,Ue.unescape=j,Ue.escape=N,Ue.matchOp=S,Ue.conjoin=y,Ue.joinNumbers=o,Ue.mkRange=d,Ue.mkValues=t,Ue.numNot=D,Ue.temporalNot=x,Ue.joinTemporal=Z,Ue.timeLiteral=ee,Ue.mkUnits=ce;const u=Vt();function re(O){const[A,b]=O;return A&&b&&(0,u.isStringFilter)(b)?{...b,not:!0}:b}function j(O){return O.replace(/\\(.)/g,"$1")}function N(O){const A=O.toLowerCase();return A==="null"||A==="empty"?"\\"+O:O.replace(/([,; |()\\%_-])/g,"\\$1")}function E(O){let A=!1,b=!1,B=0,de=!1;const Fe=O.length;for(let ve=0;ve<Fe;ve+=1){const Ye=O[ve];if(Ye===" "||Ye==="	"){B+=1;continue}B=0,Ye==="%"?(de=!0,ve===0&&(A=!0),b=!0):(b=!1,Ye==="\\"?ve+=1:Ye==="_"&&(de=!0))}return{hasLike:de,percentEnd:b&&Fe>1,percentStart:A&&Fe>1,endSpace:B}}function S(O){let A=O.trimStart();const{hasLike:b,percentEnd:B,percentStart:de,endSpace:Fe}=E(A);if(Fe>0&&(A=A.slice(0,-Fe)),b){if(de&&B){const ve=A.slice(1,-1);if(!E(ve).hasLike&&ve.length>0)return{operator:"contains",values:[j(ve)]}}else if(B){const ve=A.slice(0,-1);if(!E(ve).hasLike)return{operator:"starts",values:[j(ve)]}}else if(de){const ve=A.slice(1);if(!E(ve).hasLike)return{operator:"ends",values:[j(ve)]}}return{operator:"~",escaped_values:[A]}}return A.toLowerCase()==="null"?{operator:"null"}:A.toLowerCase()==="empty"?{operator:"empty"}:{operator:"=",values:[j(A)]}}function w(O,A){var b,B;return O.operator===A.operator&&((b=O.not)!==null&&b!==void 0?b:!1)===((B=A.not)!==null&&B!==void 0?B:!1)}function y(O,A,b){if(A=A.toLowerCase(),(0,u.isStringFilter)(O)&&(0,u.isStringFilter)(b)){if(A===","){if(O.operator==="~"&&w(O,b))return{...O,escaped_values:[...O.escaped_values,...b.escaped_values]};if((0,u.isStringCondition)(O)&&w(O,b))return{...O,values:[...O.values,...b.values]}}const B=A===","?",":A==="|"?"or":A===";"?"and":void 0;if(B)return O.operator===B?{...O,members:[...O.members,b]}:{operator:B,members:[O,b]}}return null}function o(O,A,b){if(A=A.toLowerCase(),(0,u.isNumberFilter)(O)&&(0,u.isNumberFilter)(b)){if(A==="or"&&O.operator==="="&&w(O,b)){const B={operator:"=",values:[...O.values,...b.values]};return O.not&&(B.not=!0),B}if(A==="and"||A==="or")return O.operator===A?{...O,members:[...O.members,b]}:{operator:A,members:[O,b]}}return null}function d(O,A,b,B){return{operator:"range",startValue:A,startOperator:O==="("?">":">=",endValue:b,endOperator:B===")"?"<":"<="}}function t(O,A){return{values:[O,...A]}}function D(O,A){return(0,u.isNumberFilter)(O)&&A?O.operator==="="?{operator:"!=",values:O.values}:O.operator==="!="?{operator:"=",values:O.values}:{...O,not:!0}:O}function x(O,A){if((0,u.isTemporalFilter)(O)&&A){if("not"in O){const b={...O};return O.not?delete b.not:b.not=!0,b}return{...O,not:!0}}return O}function Z(O,A,b){return A=A.toLowerCase(),(0,u.isTemporalFilter)(O)&&(0,u.isTemporalFilter)(b)&&(A==="and"||A==="or")?O.operator===A?{...O,members:[...O.members,b]}:{operator:A,members:[O,b]}:null}function ee(O,A){const b={moment:"literal",literal:O};return A&&(b.units=A),b}function ce(O){switch(O.toLowerCase()){case"second":case"seconds":return"second";case"minute":case"minutes":return"minute";case"hour":case"hours":return"hour";case"day":case"days":return"day";case"week":case"weeks":return"week";case"month":case"months":return"month";case"quarter":case"quarters":return"quarter";case"year":case"years":return"year"}}return Ue}var hr,Rr;function mi(){if(Rr)return hr;Rr=1;const{numNot:u,mkRange:re,joinNumbers:j,mkValues:N}=Ht();function E(o,d){function t(){this.constructor=o}t.prototype=d.prototype,o.prototype=new t}function S(o,d,t,D){var x=Error.call(this,o);return Object.setPrototypeOf&&Object.setPrototypeOf(x,S.prototype),x.expected=d,x.found=t,x.location=D,x.name="SyntaxError",x}E(S,Error);function w(o,d,t){return t=t||" ",o.length>d?o:(d-=o.length,t+=t.repeat(d),o+t.slice(0,d))}S.prototype.format=function(o){var d="Error: "+this.message;if(this.location){var t=null,D;for(D=0;D<o.length;D++)if(o[D].source===this.location.source){t=o[D].text.split(/\r\n|\n|\r/g);break}var x=this.location.start,Z=this.location.source&&typeof this.location.source.offset=="function"?this.location.source.offset(x):x,ee=this.location.source+":"+Z.line+":"+Z.column;if(t){var ce=this.location.end,O=w("",Z.line.toString().length," "),A=t[x.line-1],b=x.line===ce.line?ce.column:A.length+1,B=b-x.column||1;d+=`
+import{aI as ci}from"./index-DNUZpnaa.js";import{r as di}from"./index-w_0OQJgZ.js";function pi(u,re){for(var j=0;j<re.length;j++){const N=re[j];if(typeof N!="string"&&!Array.isArray(N)){for(const E in N)if(E!=="default"&&!(E in u)){const S=Object.getOwnPropertyDescriptor(N,E);S&&Object.defineProperty(u,E,S.get?S:{enumerable:!0,get:()=>N[E]})}}}return Object.freeze(Object.defineProperty(u,Symbol.toStringTag,{value:"Module"}))}var bt={},ut={},Or;function Vt(){if(Or)return ut;Or=1,Object.defineProperty(ut,"__esModule",{value:!0}),ut.isChainOp=u,ut.isStringCondition=re,ut.isStringFilter=j,ut.isBooleanFilter=N,ut.isNumberFilter=E,ut.isTemporalFilter=S,ut.isFilterExpression=w,ut.isFilterable=y;function u(o){return["and","or",","].includes(o)}function re(o){return["starts","ends","contains","="].includes(o.operator)}function j(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["starts","ends","contains","=","~","null","empty","and","or",",","()"].includes(o.operator)}function N(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["null","true","false","=false","=true"].includes(o.operator)}function E(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["range","<=",">=","!=","=",">","<","and","or","()","null"].includes(o.operator)}function S(o){return typeof o=="object"&&o!==null&&"operator"in o&&typeof o.operator=="string"&&["literal","before","after","to","for","in","and","or","in_last","this","last","next","()","null"].includes(o.operator)}function w(o){return typeof o=="object"&&o!==null&&"operator"in o}function y(o){return["string","number","boolean","timestamp","timestamptz","date"].includes(o)}return ut}var Pt={},Er;function hi(){return Er||(Er=1,Object.defineProperty(Pt,"__esModule",{value:!0}),Pt.BooleanFilterExpression=void 0,Pt.BooleanFilterExpression={parse(u){var re;if(u.match(/^\s*$/))return{parsed:null,log:[]};const j={parsed:null,log:[]};let N=u.toLowerCase().trim().replace(/\s\s+/," "),E=!1;if(N.startsWith("not ")&&(E=!0,N=N.slice(4)),N==="true")j.parsed={operator:"true"};else if(N==="=true")j.parsed={operator:"=true"};else if(N==="false")j.parsed={operator:"false"};else if(N==="=false")j.parsed={operator:"=false"};else if(N==="null")j.parsed={operator:"null"};else{const S=u.match(/[^\s]/),w=S&&(re=S.index)!==null&&re!==void 0?re:0;j.log=[{message:`Illegal boolean filter '${N}'. Must be one of true,=true,false,=false,null`,severity:"error",startIndex:w,endIndex:w+u.length-1}]}return E&&j.parsed&&(j.parsed.not=!0),j},unparse(u){return u===null?"":(u.not?"not ":"")+u.operator}}),Pt}var pr={},Ue={},kr;function Ht(){if(kr)return Ue;kr=1,Object.defineProperty(Ue,"__esModule",{value:!0}),Ue.maybeNot=re,Ue.unescape=j,Ue.escape=N,Ue.matchOp=S,Ue.conjoin=y,Ue.joinNumbers=o,Ue.mkRange=d,Ue.mkValues=t,Ue.numNot=D,Ue.temporalNot=x,Ue.joinTemporal=Z,Ue.timeLiteral=ee,Ue.mkUnits=ce;const u=Vt();function re(O){const[A,b]=O;return A&&b&&(0,u.isStringFilter)(b)?{...b,not:!0}:b}function j(O){return O.replace(/\\(.)/g,"$1")}function N(O){const A=O.toLowerCase();return A==="null"||A==="empty"?"\\"+O:O.replace(/([,; |()\\%_-])/g,"\\$1")}function E(O){let A=!1,b=!1,B=0,de=!1;const Fe=O.length;for(let ve=0;ve<Fe;ve+=1){const Ye=O[ve];if(Ye===" "||Ye==="	"){B+=1;continue}B=0,Ye==="%"?(de=!0,ve===0&&(A=!0),b=!0):(b=!1,Ye==="\\"?ve+=1:Ye==="_"&&(de=!0))}return{hasLike:de,percentEnd:b&&Fe>1,percentStart:A&&Fe>1,endSpace:B}}function S(O){let A=O.trimStart();const{hasLike:b,percentEnd:B,percentStart:de,endSpace:Fe}=E(A);if(Fe>0&&(A=A.slice(0,-Fe)),b){if(de&&B){const ve=A.slice(1,-1);if(!E(ve).hasLike&&ve.length>0)return{operator:"contains",values:[j(ve)]}}else if(B){const ve=A.slice(0,-1);if(!E(ve).hasLike)return{operator:"starts",values:[j(ve)]}}else if(de){const ve=A.slice(1);if(!E(ve).hasLike)return{operator:"ends",values:[j(ve)]}}return{operator:"~",escaped_values:[A]}}return A.toLowerCase()==="null"?{operator:"null"}:A.toLowerCase()==="empty"?{operator:"empty"}:{operator:"=",values:[j(A)]}}function w(O,A){var b,B;return O.operator===A.operator&&((b=O.not)!==null&&b!==void 0?b:!1)===((B=A.not)!==null&&B!==void 0?B:!1)}function y(O,A,b){if(A=A.toLowerCase(),(0,u.isStringFilter)(O)&&(0,u.isStringFilter)(b)){if(A===","){if(O.operator==="~"&&w(O,b))return{...O,escaped_values:[...O.escaped_values,...b.escaped_values]};if((0,u.isStringCondition)(O)&&w(O,b))return{...O,values:[...O.values,...b.values]}}const B=A===","?",":A==="|"?"or":A===";"?"and":void 0;if(B)return O.operator===B?{...O,members:[...O.members,b]}:{operator:B,members:[O,b]}}return null}function o(O,A,b){if(A=A.toLowerCase(),(0,u.isNumberFilter)(O)&&(0,u.isNumberFilter)(b)){if(A==="or"&&O.operator==="="&&w(O,b)){const B={operator:"=",values:[...O.values,...b.values]};return O.not&&(B.not=!0),B}if(A==="and"||A==="or")return O.operator===A?{...O,members:[...O.members,b]}:{operator:A,members:[O,b]}}return null}function d(O,A,b,B){return{operator:"range",startValue:A,startOperator:O==="("?">":">=",endValue:b,endOperator:B===")"?"<":"<="}}function t(O,A){return{values:[O,...A]}}function D(O,A){return(0,u.isNumberFilter)(O)&&A?O.operator==="="?{operator:"!=",values:O.values}:O.operator==="!="?{operator:"=",values:O.values}:{...O,not:!0}:O}function x(O,A){if((0,u.isTemporalFilter)(O)&&A){if("not"in O){const b={...O};return O.not?delete b.not:b.not=!0,b}return{...O,not:!0}}return O}function Z(O,A,b){return A=A.toLowerCase(),(0,u.isTemporalFilter)(O)&&(0,u.isTemporalFilter)(b)&&(A==="and"||A==="or")?O.operator===A?{...O,members:[...O.members,b]}:{operator:A,members:[O,b]}:null}function ee(O,A){const b={moment:"literal",literal:O};return A&&(b.units=A),b}function ce(O){switch(O.toLowerCase()){case"second":case"seconds":return"second";case"minute":case"minutes":return"minute";case"hour":case"hours":return"hour";case"day":case"days":return"day";case"week":case"weeks":return"week";case"month":case"months":return"month";case"quarter":case"quarters":return"quarter";case"year":case"years":return"year"}}return Ue}var hr,Rr;function mi(){if(Rr)return hr;Rr=1;const{numNot:u,mkRange:re,joinNumbers:j,mkValues:N}=Ht();function E(o,d){function t(){this.constructor=o}t.prototype=d.prototype,o.prototype=new t}function S(o,d,t,D){var x=Error.call(this,o);return Object.setPrototypeOf&&Object.setPrototypeOf(x,S.prototype),x.expected=d,x.found=t,x.location=D,x.name="SyntaxError",x}E(S,Error);function w(o,d,t){return t=t||" ",o.length>d?o:(d-=o.length,t+=t.repeat(d),o+t.slice(0,d))}S.prototype.format=function(o){var d="Error: "+this.message;if(this.location){var t=null,D;for(D=0;D<o.length;D++)if(o[D].source===this.location.source){t=o[D].text.split(/\r\n|\n|\r/g);break}var x=this.location.start,Z=this.location.source&&typeof this.location.source.offset=="function"?this.location.source.offset(x):x,ee=this.location.source+":"+Z.line+":"+Z.column;if(t){var ce=this.location.end,O=w("",Z.line.toString().length," "),A=t[x.line-1],b=x.line===ce.line?ce.column:A.length+1,B=b-x.column||1;d+=`
  --> `+ee+`
 `+O+` |
 `+Z.line+" | "+A+`

package/dist/app/index.html

@@ -11,7 +11,7 @@
          href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
       />
       <title>Malloy Publisher</title>
-     <script type="module" crossorigin src="/assets/index-C6gZ6sSY.js"></script>
+     <script type="module" crossorigin src="/assets/index-DNUZpnaa.js"></script>
      <link rel="stylesheet" crossorigin href="/assets/index-5eLCcNmP.css">
    </head>
    <body>

package/dist/instrumentation.mjs

@@ -115106,6 +115106,50 @@ function formatDuration(durationMs) {
   }
   return `${durationMs.toFixed(2)}ms`;
 }
+function redactSensitive(value, seen = new WeakSet) {
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (seen.has(value)) {
+    return "[Circular]";
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSensitive(item, seen));
+  }
+  const result = {};
+  for (const [key, val] of Object.entries(value)) {
+    result[key] = SENSITIVE_KEYS.has(key.toLowerCase()) ? REDACTED : redactSensitive(val, seen);
+  }
+  return result;
+}
+function buildAxiosErrorLog(error) {
+  if (error.response) {
+    return {
+      message: "Axios server-side error",
+      meta: {
+        url: error.response.config.url,
+        status: error.response.status,
+        headers: redactSensitive(error.response.headers),
+        data: redactSensitive(error.response.data)
+      }
+    };
+  }
+  if (error.request) {
+    return {
+      message: "Axios client-side error",
+      meta: {
+        method: error.config?.method,
+        url: error.config?.url,
+        code: error.code
+      }
+    };
+  }
+  return {
+    message: "Axios unknown error",
+    meta: { message: error.message }
+  };
+}
 var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
   if (process.env.LOG_LEVEL) {
     const logLevel = process.env.LOG_LEVEL.toLowerCase();
@@ -115116,7 +115160,7 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
     }
   }
   return "debug";
-}, logger, DISABLE_RESPONSE_LOGGING, loggerMiddleware = (req, res, next) => {
+}, logger, DISABLE_RESPONSE_LOGGING, SENSITIVE_KEY_NAMES, SENSITIVE_KEYS, REDACTED = "[REDACTED]", loggerMiddleware = (req, res, next) => {
   const startTime = performance.now();
   const resJson = res.json;
   res.json = (body) => {
@@ -115131,12 +115175,12 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
     const logMetadata = {
       statusCode: res.statusCode,
       duration: formatDuration(durationMs),
-      payload: req.body,
+      payload: redactSensitive(req.body),
       params: req.params,
       query: req.query
     };
     if (!DISABLE_RESPONSE_LOGGING) {
-      logMetadata.response = res.locals.body;
+      logMetadata.response = redactSensitive(res.locals.body);
     }
     if (traceId) {
       logMetadata.traceId = traceId;
@@ -115147,18 +115191,8 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
   });
   next();
 }, logAxiosError = (error) => {
-  if (error.response) {
-    logger.error("Axios server-side error", {
-      url: error.response.config.url,
-      status: error.response.status,
-      headers: error.response.headers,
-      data: error.response.data
-    });
-  } else if (error.request) {
-    logger.error("Axios client-side error", { error: error.request });
-  } else {
-    logger.error("Axios unknown error", { error });
-  }
+  const { message, meta } = buildAxiosErrorLog(error);
+  logger.error(message, meta);
 };
 var init_logger = __esm(() => {
   import_winston = __toESM(require_winston(), 1);
@@ -115170,6 +115204,28 @@ var init_logger = __esm(() => {
     transports: [new import_winston.default.transports.Console]
   });
   DISABLE_RESPONSE_LOGGING = process.env.DISABLE_RESPONSE_LOGGING === "true" || process.env.DISABLE_RESPONSE_LOGGING === "1";
+  SENSITIVE_KEY_NAMES = [
+    "password",
+    "connectionString",
+    "serviceAccountKeyJson",
+    "privateKey",
+    "privateKeyPass",
+    "secret",
+    "secretAccessKey",
+    "sessionToken",
+    "sasUrl",
+    "clientSecret",
+    "oauthClientSecret",
+    "peakaKey",
+    "token",
+    "accessToken",
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key"
+  ];
+  SENSITIVE_KEYS = new Set(SENSITIVE_KEY_NAMES.map((name) => name.toLowerCase()));
 });
 
 // src/instrumentation.ts

package/dist/package_load_worker.mjs

@@ -11323,6 +11323,50 @@ function formatDuration(durationMs) {
   }
   return `${durationMs.toFixed(2)}ms`;
 }
+function redactSensitive(value, seen = new WeakSet) {
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (seen.has(value)) {
+    return "[Circular]";
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map((item) => redactSensitive(item, seen));
+  }
+  const result = {};
+  for (const [key, val] of Object.entries(value)) {
+    result[key] = SENSITIVE_KEYS.has(key.toLowerCase()) ? REDACTED : redactSensitive(val, seen);
+  }
+  return result;
+}
+function buildAxiosErrorLog(error) {
+  if (error.response) {
+    return {
+      message: "Axios server-side error",
+      meta: {
+        url: error.response.config.url,
+        status: error.response.status,
+        headers: redactSensitive(error.response.headers),
+        data: redactSensitive(error.response.data)
+      }
+    };
+  }
+  if (error.request) {
+    return {
+      message: "Axios client-side error",
+      meta: {
+        method: error.config?.method,
+        url: error.config?.url,
+        code: error.code
+      }
+    };
+  }
+  return {
+    message: "Axios unknown error",
+    meta: { message: error.message }
+  };
+}
 var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
   if (process.env.LOG_LEVEL) {
     const logLevel = process.env.LOG_LEVEL.toLowerCase();
@@ -11333,7 +11377,7 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
     }
   }
   return "debug";
-}, logger, DISABLE_RESPONSE_LOGGING, loggerMiddleware = (req, res, next) => {
+}, logger, DISABLE_RESPONSE_LOGGING, SENSITIVE_KEY_NAMES, SENSITIVE_KEYS, REDACTED = "[REDACTED]", loggerMiddleware = (req, res, next) => {
   const startTime = performance.now();
   const resJson = res.json;
   res.json = (body) => {
@@ -11348,12 +11392,12 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
     const logMetadata = {
       statusCode: res.statusCode,
       duration: formatDuration(durationMs),
-      payload: req.body,
+      payload: redactSensitive(req.body),
       params: req.params,
       query: req.query
     };
     if (!DISABLE_RESPONSE_LOGGING) {
-      logMetadata.response = res.locals.body;
+      logMetadata.response = redactSensitive(res.locals.body);
     }
     if (traceId) {
       logMetadata.traceId = traceId;
@@ -11364,18 +11408,8 @@ var import_winston, isTelemetryEnabled, VALID_LOG_LEVELS, getLogLevel = () => {
   });
   next();
 }, logAxiosError = (error) => {
-  if (error.response) {
-    logger.error("Axios server-side error", {
-      url: error.response.config.url,
-      status: error.response.status,
-      headers: error.response.headers,
-      data: error.response.data
-    });
-  } else if (error.request) {
-    logger.error("Axios client-side error", { error: error.request });
-  } else {
-    logger.error("Axios unknown error", { error });
-  }
+  const { message, meta } = buildAxiosErrorLog(error);
+  logger.error(message, meta);
 };
 var init_logger = __esm(() => {
   import_winston = __toESM(require_winston(), 1);
@@ -11387,6 +11421,28 @@ var init_logger = __esm(() => {
     transports: [new import_winston.default.transports.Console]
   });
   DISABLE_RESPONSE_LOGGING = process.env.DISABLE_RESPONSE_LOGGING === "true" || process.env.DISABLE_RESPONSE_LOGGING === "1";
+  SENSITIVE_KEY_NAMES = [
+    "password",
+    "connectionString",
+    "serviceAccountKeyJson",
+    "privateKey",
+    "privateKeyPass",
+    "secret",
+    "secretAccessKey",
+    "sessionToken",
+    "sasUrl",
+    "clientSecret",
+    "oauthClientSecret",
+    "peakaKey",
+    "token",
+    "accessToken",
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key"
+  ];
+  SENSITIVE_KEYS = new Set(SENSITIVE_KEY_NAMES.map((name) => name.toLowerCase()));
 });
 
 // src/errors.ts
@@ -11714,6 +11770,16 @@ function unwrapQuotedExpression(body) {
 
 // src/service/package_manifest.ts
 var FRESHNESS_FALLBACKS = ["live", "stale_ok", "fail"];
+var PACKAGE_SCOPES = ["version", "package"];
+function parsePackageScope(raw) {
+  if (raw === undefined || raw === null) {
+    return "package";
+  }
+  if (PACKAGE_SCOPES.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`Invalid "scope" in the package manifest: ${JSON.stringify(raw)}. ` + `Expected "version" or "package" (default "package").`);
+}
 function parseFreshness(raw) {
   if (!raw || typeof raw !== "object") {
     return null;
@@ -12081,6 +12147,47 @@ function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
 
+// src/package_load/rpc_wait_accountant.ts
+class RpcWaitAccountant {
+  now;
+  inFlight = 0;
+  waitStartMs = 0;
+  accumMs = 0;
+  startedCount = 0;
+  activeJobId;
+  constructor(now = () => performance.now()) {
+    this.now = now;
+  }
+  begin(jobId) {
+    this.activeJobId = jobId;
+    this.inFlight = 0;
+    this.waitStartMs = 0;
+    this.accumMs = 0;
+    this.startedCount = 0;
+  }
+  noteStart(jobId) {
+    if (jobId !== this.activeJobId)
+      return;
+    if (this.inFlight === 0)
+      this.waitStartMs = this.now();
+    this.inFlight += 1;
+    this.startedCount += 1;
+  }
+  noteSettle(jobId) {
+    if (jobId !== this.activeJobId)
+      return;
+    this.inFlight -= 1;
+    if (this.inFlight === 0)
+      this.accumMs += this.now() - this.waitStartMs;
+  }
+  get waitMs() {
+    return this.accumMs;
+  }
+  get fetches() {
+    return this.startedCount;
+  }
+}
+
 // src/package_load/package_load_worker.ts
 if (!parentPort) {
   throw new Error("package_load_worker.ts must be loaded inside a worker_threads Worker");
@@ -12102,6 +12209,7 @@ function callMain(send) {
     send(requestId);
   });
 }
+var schemaWait = new RpcWaitAccountant;
 function dispatchMainResponse(message) {
   if (message.type === "schema-for-tables-response" || message.type === "schema-for-sql-response" || message.type === "read-url-response" || message.type === "connection-metadata-response") {
     const pending = pendingRpc.get(message.requestId);
@@ -12136,31 +12244,42 @@ class ProxyConnection {
     return this.digest;
   }
   async fetchSchemaForTables(tables, options) {
-    const response = await callMain((requestId) => {
-      const req = {
-        type: "schema-for-tables",
-        requestId,
-        jobId: this.jobId,
-        connectionName: this.name,
-        tables,
-        options: serializeFetchOptions(options)
-      };
-      port.postMessage(req);
-    });
-    return { schemas: response.schemas, errors: response.errors };
+    schemaWait.noteStart(this.jobId);
+    try {
+      const response = await callMain((requestId) => {
+        const req = {
+          type: "schema-for-tables",
+          requestId,
+          jobId: this.jobId,
+          connectionName: this.name,
+          tables,
+          options: serializeFetchOptions(options)
+        };
+        port.postMessage(req);
+      });
+      return { schemas: response.schemas, errors: response.errors };
+    } finally {
+      schemaWait.noteSettle(this.jobId);
+    }
   }
   async fetchSchemaForSQLStruct(sentence, options) {
-    const response = await callMain((requestId) => {
-      const req = {
-        type: "schema-for-sql",
-        requestId,
-        jobId: this.jobId,
-        connectionName: this.name,
-        sentence,
-        options: serializeFetchOptions(options)
-      };
-      port.postMessage(req);
-    });
+    schemaWait.noteStart(this.jobId);
+    let response;
+    try {
+      response = await callMain((requestId) => {
+        const req = {
+          type: "schema-for-sql",
+          requestId,
+          jobId: this.jobId,
+          connectionName: this.name,
+          sentence,
+          options: serializeFetchOptions(options)
+        };
+        port.postMessage(req);
+      });
+    } finally {
+      schemaWait.noteSettle(this.jobId);
+    }
     if (response.error !== undefined)
       return { error: response.error };
     if (response.structDef === undefined) {
@@ -12263,7 +12382,8 @@ async function readPackageMetadata(packagePath) {
     explores: Array.isArray(parsed.explores) ? parsed.explores.map(normalizeModelPath) : undefined,
     queryableSources: parsed.queryableSources === "all" ? "all" : "declared",
     manifestLocation: typeof parsed.manifestLocation === "string" ? parsed.manifestLocation : null,
-    materialization: parsePackageMaterialization(parsed.materialization)
+    materialization: parsePackageMaterialization(parsed.materialization),
+    scope: parsePackageScope(parsed.scope)
   };
 }
 async function listPackageFiles(packagePath) {
@@ -12492,13 +12612,22 @@ async function loadPackage(job) {
   const malloyConfig = buildWorkerMalloyConfig(job);
   const allFiles = await listPackageFiles(job.packagePath);
   const modelPaths = filterModelPaths(allFiles);
+  const compileRegionStart = performance.now();
+  schemaWait.begin(job.requestId);
   const models = await Promise.all(modelPaths.map((modelPath) => compileOneModel(job, malloyConfig, modelPath)));
+  const loadEnd = performance.now();
+  const schemaFetchDurationMs = schemaWait.waitMs;
   return {
     type: "load-package-result",
     requestId: job.requestId,
     packageMetadata,
     models,
-    loadDurationMs: performance.now() - loadStart
+    loadDurationMs: loadEnd - loadStart,
+    timings: {
+      compileDurationMs: Math.max(0, loadEnd - compileRegionStart - schemaFetchDurationMs),
+      schemaFetchDurationMs,
+      schemaFetchCount: schemaWait.fetches
+    }
   };
 }
 function serializeError(error) {