@malloy-publisher/server 0.3.0 → 0.4.0

package/dist/server.mjs

@@ -176443,6 +176443,11 @@ function internalErrorToHttpError(error) {
     return httpError(409, error.message);
   } else if (error instanceof InvalidStateTransitionError) {
     return httpError(409, error.message);
+  } else if (error instanceof WriteConflictError) {
+    return httpError(409, error.message);
+  } else if (error instanceof WriteRolledBackError) {
+    logInternalFailure("Dashboard write rolled back", error, "warn");
+    return httpError(500, error.message);
   } else if (error instanceof ServiceUnavailableError) {
     return httpError(503, error.message);
   } else if (error instanceof PayloadTooLargeError) {
@@ -176466,7 +176471,7 @@ function httpError(code, message, reason) {
     }
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, NotImplementedError, BadRequestError, InvalidArgumentError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, MaterializationEligibilityError, PublisherConfigError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, MaterializationEligibilityError, PublisherConfigError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
@@ -176482,6 +176487,8 @@ var init_errors = __esm(() => {
   };
   InvalidArgumentError = class InvalidArgumentError extends BadRequestError {
   };
+  CompileRefusedError = class CompileRefusedError extends BadRequestError {
+  };
   EnvironmentNotFoundError = class EnvironmentNotFoundError extends Error {
     constructor(message) {
       super(message);
@@ -176581,6 +176588,18 @@ var init_errors = __esm(() => {
       super(message);
     }
   };
+  WriteConflictError = class WriteConflictError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "WriteConflictError";
+    }
+  };
+  WriteRolledBackError = class WriteRolledBackError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "WriteRolledBackError";
+    }
+  };
   InvalidStateTransitionError = class InvalidStateTransitionError extends Error {
     constructor(message) {
       super(message);
@@ -176654,6 +176673,65 @@ var init_query_cap_metrics = __esm(() => {
   init_config();
 });
 
+// src/path_safety.ts
+import * as path2 from "path";
+function assertSafePackageName(packageName) {
+  if (typeof packageName !== "string" || !SAFE_NAME_RE.test(packageName)) {
+    throw new BadRequestError(`Invalid package name: must be 1-255 characters of letters, digits, "-", "_", or "." and must not start with "."`);
+  }
+}
+function assertSafeRelativeModelPath(modelPath) {
+  if (typeof modelPath !== "string" || modelPath.length === 0 || modelPath.length > MAX_MODEL_PATH_LEN || modelPath.includes("\x00") || modelPath.includes("\\") || path2.isAbsolute(modelPath) || modelPath.startsWith("/")) {
+    throw new BadRequestError(`Invalid model path`);
+  }
+  const segments = modelPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") {
+      throw new BadRequestError(`Invalid model path`);
+    }
+    if (segment.startsWith(".")) {
+      throw new BadRequestError(`Invalid model path`);
+    }
+  }
+}
+function assertSafeEnvironmentPath(environmentPath) {
+  if (typeof environmentPath !== "string") {
+    throw new BadRequestError(`Invalid environment path: must be a string`);
+  }
+  if (environmentPath.length === 0 || environmentPath.length > MAX_ENVIRONMENT_PATH_LEN) {
+    throw new BadRequestError(`Invalid environment path: bad length`);
+  }
+  if (environmentPath.indexOf("\x00") !== -1) {
+    throw new BadRequestError(`Invalid environment path: contains NUL byte`);
+  }
+  if (environmentPath.indexOf("..") !== -1) {
+    throw new BadRequestError(`Invalid environment path: contains ".." traversal segment`);
+  }
+  if (!SAFE_ENVIRONMENT_PATH_RE.test(environmentPath)) {
+    throw new BadRequestError(`Invalid environment path: must be an absolute path of printable ASCII characters`);
+  }
+}
+function safeJoinUnderRoot(root, ...segments) {
+  const resolvedRoot = path2.resolve(root);
+  const joined = path2.resolve(resolvedRoot, ...segments);
+  const rootWithSep = resolvedRoot.endsWith(path2.sep) ? resolvedRoot : resolvedRoot + path2.sep;
+  if (joined !== resolvedRoot && !joined.startsWith(rootWithSep)) {
+    throw new BadRequestError(`Resolved path is outside of root`);
+  }
+  return joined;
+}
+var SAFE_NAME_RE, MAX_MODEL_PATH_LEN = 1024, SAFE_ENVIRONMENT_PATH_RE, MAX_ENVIRONMENT_PATH_LEN = 4096;
+var init_path_safety = __esm(() => {
+  init_errors();
+  SAFE_NAME_RE = /^(?!\.\.?$)(?!\.)[A-Za-z0-9._-]{1,255}$/;
+  SAFE_ENVIRONMENT_PATH_RE = /^(?:\/|[A-Za-z]:[\\/])[\x20-\x7E]*$/;
+});
+
+// src/pg_helpers.ts
+function redactPgSecrets(s) {
+  return s.replace(/([a-z][a-z0-9+.-]*:\/\/[^:/?#\s]*):([^/\s]+)@/gi, "$1:***@").replace(/((?:postgres|postgresql):\/\/[^:/?#\s]*):([^@\s]+)@/gi, "$1:***@").replace(/password=('(?:\\.|[^'\\])*'|"[^"]*"|\S+)/gi, "password=***");
+}
+
 // ../../node_modules/delayed-stream/lib/delayed_stream.js
 var require_delayed_stream = __commonJS((exports, module) => {
   var Stream = __require("stream").Stream;
@@ -185494,11 +185572,11 @@ var require_mime_types3 = __commonJS((exports) => {
     }
     return exts[0];
   }
-  function lookup(path2) {
-    if (!path2 || typeof path2 !== "string") {
+  function lookup(path3) {
+    if (!path3 || typeof path3 !== "string") {
       return false;
     }
-    var extension2 = extname("x." + path2).toLowerCase().substr(1);
+    var extension2 = extname("x." + path3).toLowerCase().substr(1);
     if (!extension2) {
       return false;
     }
@@ -185768,7 +185846,7 @@ var require_populate = __commonJS((exports, module) => {
 var require_form_data = __commonJS((exports, module) => {
   var CombinedStream = require_combined_stream();
   var util3 = __require("util");
-  var path2 = __require("path");
+  var path3 = __require("path");
   var http = __require("http");
   var https = __require("https");
   var parseUrl = __require("url").parse;
@@ -185895,11 +185973,11 @@ var require_form_data = __commonJS((exports, module) => {
   FormData2.prototype._getContentDisposition = function(value, options) {
     var filename;
     if (typeof options.filepath === "string") {
-      filename = path2.normalize(options.filepath).replace(/\\/g, "/");
+      filename = path3.normalize(options.filepath).replace(/\\/g, "/");
     } else if (options.filename || value && (value.name || value.path)) {
-      filename = path2.basename(options.filename || value && (value.name || value.path));
+      filename = path3.basename(options.filename || value && (value.name || value.path));
     } else if (value && value.readable && hasOwn(value, "httpVersion")) {
-      filename = path2.basename(value.client._httpMessage.path || "");
+      filename = path3.basename(value.client._httpMessage.path || "");
     }
     if (filename) {
       return 'filename="' + filename + '"';
@@ -186635,10 +186713,10 @@ var require_axios = __commonJS((exports, module) => {
   function removeBrackets(key) {
     return utils$1.endsWith(key, "[]") ? key.slice(0, -2) : key;
   }
-  function renderKey(path2, key, dots) {
-    if (!path2)
+  function renderKey(path3, key, dots) {
+    if (!path3)
       return key;
-    return path2.concat(key).map(function each(token, i) {
+    return path3.concat(key).map(function each(token, i) {
       token = removeBrackets(token);
       return !dots && i ? "[" + token + "]" : token;
     }).join(dots ? "." : "");
@@ -186687,9 +186765,9 @@ var require_axios = __commonJS((exports, module) => {
       }
       return value;
     }
-    function defaultVisitor(value, key, path2) {
+    function defaultVisitor(value, key, path3) {
       let arr = value;
-      if (value && !path2 && typeof value === "object") {
+      if (value && !path3 && typeof value === "object") {
         if (utils$1.endsWith(key, "{}")) {
           key = metaTokens ? key : key.slice(0, -2);
           value = JSON.stringify(value);
@@ -186704,7 +186782,7 @@ var require_axios = __commonJS((exports, module) => {
       if (isVisitable(value)) {
         return true;
       }
-      formData.append(renderKey(path2, key, dots), convertValue(value));
+      formData.append(renderKey(path3, key, dots), convertValue(value));
       return false;
     }
     const stack = [];
@@ -186713,17 +186791,17 @@ var require_axios = __commonJS((exports, module) => {
       convertValue,
       isVisitable
     });
-    function build(value, path2) {
+    function build(value, path3) {
       if (utils$1.isUndefined(value))
         return;
       if (stack.indexOf(value) !== -1) {
-        throw Error("Circular reference detected in " + path2.join("."));
+        throw Error("Circular reference detected in " + path3.join("."));
       }
       stack.push(value);
       utils$1.forEach(value, function each(el, key) {
-        const result = !(utils$1.isUndefined(el) || el === null) && visitor.call(formData, el, utils$1.isString(key) ? key.trim() : key, path2, exposedHelpers);
+        const result = !(utils$1.isUndefined(el) || el === null) && visitor.call(formData, el, utils$1.isString(key) ? key.trim() : key, path3, exposedHelpers);
         if (result === true) {
-          build(el, path2 ? path2.concat(key) : [key]);
+          build(el, path3 ? path3.concat(key) : [key]);
         }
       });
       stack.pop();
@@ -186881,7 +186959,7 @@ var require_axios = __commonJS((exports, module) => {
   };
   function toURLEncodedForm(data, options) {
     return toFormData(data, new platform.classes.URLSearchParams, {
-      visitor: function(value, key, path2, helpers) {
+      visitor: function(value, key, path3, helpers) {
         if (platform.isNode && utils$1.isBuffer(value)) {
           this.append(key, value.toString("base64"));
           return false;
@@ -186909,12 +186987,12 @@ var require_axios = __commonJS((exports, module) => {
     return obj;
   }
   function formDataToJSON(formData) {
-    function buildPath(path2, value, target, index) {
-      let name = path2[index++];
+    function buildPath(path3, value, target, index) {
+      let name = path3[index++];
       if (name === "__proto__")
         return true;
       const isNumericKey = Number.isFinite(+name);
-      const isLast = index >= path2.length;
+      const isLast = index >= path3.length;
       name = !name && utils$1.isArray(target) ? target.length : name;
       if (isLast) {
         if (utils$1.hasOwnProp(target, name)) {
@@ -186927,7 +187005,7 @@ var require_axios = __commonJS((exports, module) => {
       if (!target[name] || !utils$1.isObject(target[name])) {
         target[name] = [];
       }
-      const result = buildPath(path2, value, target[name], index);
+      const result = buildPath(path3, value, target[name], index);
       if (result && utils$1.isArray(target[name])) {
         target[name] = arrayToObject(target[name]);
       }
@@ -187336,10 +187414,10 @@ var require_axios = __commonJS((exports, module) => {
   utils$1.inherits(CanceledError, AxiosError, {
     __CANCEL__: true
   });
-  function settle(resolve, reject, response) {
+  function settle(resolve2, reject, response) {
     const validateStatus = response.config.validateStatus;
     if (!response.status || !validateStatus || validateStatus(response.status)) {
-      resolve(response);
+      resolve2(response);
     } else {
       reject(new AxiosError("Request failed with status code " + response.status, [AxiosError.ERR_BAD_REQUEST, AxiosError.ERR_BAD_RESPONSE][Math.floor(response.status / 100) - 4], response.config, response.request, response));
     }
@@ -187836,7 +187914,7 @@ var require_axios = __commonJS((exports, module) => {
   }
   var isHttpAdapterSupported = typeof process !== "undefined" && utils$1.kindOf(process) === "process";
   var wrapAsync = (asyncExecutor) => {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let onDone;
       let isDone;
       const done = (value, isRejected) => {
@@ -187847,7 +187925,7 @@ var require_axios = __commonJS((exports, module) => {
       };
       const _resolve = (value) => {
         done(value);
-        resolve(value);
+        resolve2(value);
       };
       const _reject = (reason) => {
         done(reason, true);
@@ -187867,7 +187945,7 @@ var require_axios = __commonJS((exports, module) => {
   };
   var buildAddressEntry = (address, family) => resolveFamily(utils$1.isObject(address) ? address : { address, family });
   var httpAdapter = isHttpAdapterSupported && function httpAdapter2(config) {
-    return wrapAsync(async function dispatchHttpRequest(resolve, reject, onDone) {
+    return wrapAsync(async function dispatchHttpRequest(resolve2, reject, onDone) {
       let { data, lookup, family } = config;
       const { responseType, responseEncoding } = config;
       const method = config.method.toUpperCase();
@@ -187926,7 +188004,7 @@ var require_axios = __commonJS((exports, module) => {
         }
         let convertedData;
         if (method !== "GET") {
-          return settle(resolve, reject, {
+          return settle(resolve2, reject, {
             status: 405,
             statusText: "method not allowed",
             headers: {},
@@ -187948,7 +188026,7 @@ var require_axios = __commonJS((exports, module) => {
         } else if (responseType === "stream") {
           convertedData = stream__default["default"].Readable.from(convertedData);
         }
-        return settle(resolve, reject, {
+        return settle(resolve2, reject, {
           data: convertedData,
           status: 200,
           statusText: "OK",
@@ -188028,9 +188106,9 @@ var require_axios = __commonJS((exports, module) => {
         auth = urlUsername + ":" + urlPassword;
       }
       auth && headers.delete("authorization");
-      let path2;
+      let path3;
       try {
-        path2 = buildURL(parsed.pathname + parsed.search, config.params, config.paramsSerializer).replace(/^\?/, "");
+        path3 = buildURL(parsed.pathname + parsed.search, config.params, config.paramsSerializer).replace(/^\?/, "");
       } catch (err) {
         const customErr = new Error(err.message);
         customErr.config = config;
@@ -188040,7 +188118,7 @@ var require_axios = __commonJS((exports, module) => {
       }
       headers.set("Accept-Encoding", "gzip, compress, deflate" + (isBrotliSupported ? ", br" : ""), false);
       const options = {
-        path: path2,
+        path: path3,
         method,
         headers: headers.toJSON(),
         agents: { http: config.httpAgent, https: config.httpsAgent },
@@ -188134,7 +188212,7 @@ var require_axios = __commonJS((exports, module) => {
         };
         if (responseType === "stream") {
           response.data = responseStream;
-          settle(resolve, reject, response);
+          settle(resolve2, reject, response);
         } else {
           const responseBuffer = [];
           let totalResponseBytes = 0;
@@ -188173,7 +188251,7 @@ var require_axios = __commonJS((exports, module) => {
             } catch (err) {
               return reject(AxiosError.from(err, null, config, response.request, response));
             }
-            settle(resolve, reject, response);
+            settle(resolve2, reject, response);
           });
         }
         emitter.once("abort", (err) => {
@@ -188237,10 +188315,10 @@ var require_axios = __commonJS((exports, module) => {
     return origin2.protocol === url2.protocol && origin2.host === url2.host && (isMSIE || origin2.port === url2.port);
   })(new URL(platform.origin), platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)) : () => true;
   var cookies = platform.hasStandardBrowserEnv ? {
-    write(name, value, expires, path2, domain, secure) {
+    write(name, value, expires, path3, domain, secure) {
       const cookie = [name + "=" + encodeURIComponent(value)];
       utils$1.isNumber(expires) && cookie.push("expires=" + new Date(expires).toGMTString());
-      utils$1.isString(path2) && cookie.push("path=" + path2);
+      utils$1.isString(path3) && cookie.push("path=" + path3);
       utils$1.isString(domain) && cookie.push("domain=" + domain);
       secure === true && cookie.push("secure");
       document.cookie = cookie.join("; ");
@@ -188371,7 +188449,7 @@ var require_axios = __commonJS((exports, module) => {
   };
   var isXHRAdapterSupported = typeof XMLHttpRequest !== "undefined";
   var xhrAdapter = isXHRAdapterSupported && function(config) {
-    return new Promise(function dispatchXhrRequest(resolve, reject) {
+    return new Promise(function dispatchXhrRequest(resolve2, reject) {
       const _config = resolveConfig(config);
       let requestData = _config.data;
       const requestHeaders = AxiosHeaders$1.from(_config.headers).normalize();
@@ -188403,7 +188481,7 @@ var require_axios = __commonJS((exports, module) => {
           request
         };
         settle(function _resolve(value) {
-          resolve(value);
+          resolve2(value);
           done();
         }, function _reject(err) {
           reject(err);
@@ -188754,8 +188832,8 @@ var require_axios = __commonJS((exports, module) => {
         responseType = responseType || "text";
         let responseData = await resolvers[utils$1.findKey(resolvers, responseType) || "text"](response, config);
         !isStreamResponse && unsubscribe && unsubscribe();
-        return await new Promise((resolve, reject) => {
-          settle(resolve, reject, {
+        return await new Promise((resolve2, reject) => {
+          settle(resolve2, reject, {
             data: responseData,
             headers: AxiosHeaders$1.from(response.headers),
             status: response.status,
@@ -189095,8 +189173,8 @@ var require_axios = __commonJS((exports, module) => {
         throw new TypeError("executor must be a function.");
       }
       let resolvePromise;
-      this.promise = new Promise(function promiseExecutor(resolve) {
-        resolvePromise = resolve;
+      this.promise = new Promise(function promiseExecutor(resolve2) {
+        resolvePromise = resolve2;
       });
       const token = this;
       this.promise.then((cancel) => {
@@ -189110,9 +189188,9 @@ var require_axios = __commonJS((exports, module) => {
       });
       this.promise.then = (onfulfilled) => {
         let _resolve;
-        const promise = new Promise((resolve) => {
-          token.subscribe(resolve);
-          _resolve = resolve;
+        const promise = new Promise((resolve2) => {
+          token.subscribe(resolve2);
+          _resolve = resolve2;
         }).then(onfulfilled);
         promise.cancel = function reject() {
           token.unsubscribe(_resolve);
@@ -190420,12 +190498,12 @@ var require_api2 = __commonJS((exports) => {
   };
   var ModelsApiAxiosParamCreator = function(configuration) {
     return {
-      compileModelSource: async (projectName, packageName, path2, compileRequest, options = {}) => {
+      compileModelSource: async (projectName, packageName, path3, compileRequest, options = {}) => {
         (0, common_1.assertParamExists)("compileModelSource", "projectName", projectName);
         (0, common_1.assertParamExists)("compileModelSource", "packageName", packageName);
-        (0, common_1.assertParamExists)("compileModelSource", "path", path2);
+        (0, common_1.assertParamExists)("compileModelSource", "path", path3);
         (0, common_1.assertParamExists)("compileModelSource", "compileRequest", compileRequest);
-        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}/compile`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path2)));
+        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}/compile`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path3)));
         const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
         let baseOptions;
         if (configuration) {
@@ -190444,12 +190522,12 @@ var require_api2 = __commonJS((exports) => {
           options: localVarRequestOptions
         };
       },
-      executeQueryModel: async (projectName, packageName, path2, queryRequest, options = {}) => {
+      executeQueryModel: async (projectName, packageName, path3, queryRequest, options = {}) => {
         (0, common_1.assertParamExists)("executeQueryModel", "projectName", projectName);
         (0, common_1.assertParamExists)("executeQueryModel", "packageName", packageName);
-        (0, common_1.assertParamExists)("executeQueryModel", "path", path2);
+        (0, common_1.assertParamExists)("executeQueryModel", "path", path3);
         (0, common_1.assertParamExists)("executeQueryModel", "queryRequest", queryRequest);
-        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}/query`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path2)));
+        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}/query`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path3)));
         const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
         let baseOptions;
         if (configuration) {
@@ -190468,11 +190546,11 @@ var require_api2 = __commonJS((exports) => {
           options: localVarRequestOptions
         };
       },
-      getModel: async (projectName, packageName, path2, versionId, options = {}) => {
+      getModel: async (projectName, packageName, path3, versionId, options = {}) => {
         (0, common_1.assertParamExists)("getModel", "projectName", projectName);
         (0, common_1.assertParamExists)("getModel", "packageName", packageName);
-        (0, common_1.assertParamExists)("getModel", "path", path2);
-        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path2)));
+        (0, common_1.assertParamExists)("getModel", "path", path3);
+        const localVarPath = `/projects/{projectName}/packages/{packageName}/models/{path}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path3)));
         const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
         let baseOptions;
         if (configuration) {
@@ -190521,23 +190599,23 @@ var require_api2 = __commonJS((exports) => {
   var ModelsApiFp = function(configuration) {
     const localVarAxiosParamCreator = (0, exports.ModelsApiAxiosParamCreator)(configuration);
     return {
-      async compileModelSource(projectName, packageName, path2, compileRequest, options) {
+      async compileModelSource(projectName, packageName, path3, compileRequest, options) {
         var _a, _b, _c;
-        const localVarAxiosArgs = await localVarAxiosParamCreator.compileModelSource(projectName, packageName, path2, compileRequest, options);
+        const localVarAxiosArgs = await localVarAxiosParamCreator.compileModelSource(projectName, packageName, path3, compileRequest, options);
         const localVarOperationServerIndex = (_a = configuration === null || configuration === undefined ? undefined : configuration.serverIndex) !== null && _a !== undefined ? _a : 0;
         const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap["ModelsApi.compileModelSource"]) === null || _b === undefined ? undefined : _b[localVarOperationServerIndex]) === null || _c === undefined ? undefined : _c.url;
         return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
       },
-      async executeQueryModel(projectName, packageName, path2, queryRequest, options) {
+      async executeQueryModel(projectName, packageName, path3, queryRequest, options) {
         var _a, _b, _c;
-        const localVarAxiosArgs = await localVarAxiosParamCreator.executeQueryModel(projectName, packageName, path2, queryRequest, options);
+        const localVarAxiosArgs = await localVarAxiosParamCreator.executeQueryModel(projectName, packageName, path3, queryRequest, options);
         const localVarOperationServerIndex = (_a = configuration === null || configuration === undefined ? undefined : configuration.serverIndex) !== null && _a !== undefined ? _a : 0;
         const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap["ModelsApi.executeQueryModel"]) === null || _b === undefined ? undefined : _b[localVarOperationServerIndex]) === null || _c === undefined ? undefined : _c.url;
         return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
       },
-      async getModel(projectName, packageName, path2, versionId, options) {
+      async getModel(projectName, packageName, path3, versionId, options) {
         var _a, _b, _c;
-        const localVarAxiosArgs = await localVarAxiosParamCreator.getModel(projectName, packageName, path2, versionId, options);
+        const localVarAxiosArgs = await localVarAxiosParamCreator.getModel(projectName, packageName, path3, versionId, options);
         const localVarOperationServerIndex = (_a = configuration === null || configuration === undefined ? undefined : configuration.serverIndex) !== null && _a !== undefined ? _a : 0;
         const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap["ModelsApi.getModel"]) === null || _b === undefined ? undefined : _b[localVarOperationServerIndex]) === null || _c === undefined ? undefined : _c.url;
         return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -190555,14 +190633,14 @@ var require_api2 = __commonJS((exports) => {
   var ModelsApiFactory = function(configuration, basePath, axios) {
     const localVarFp = (0, exports.ModelsApiFp)(configuration);
     return {
-      compileModelSource(projectName, packageName, path2, compileRequest, options) {
-        return localVarFp.compileModelSource(projectName, packageName, path2, compileRequest, options).then((request) => request(axios, basePath));
+      compileModelSource(projectName, packageName, path3, compileRequest, options) {
+        return localVarFp.compileModelSource(projectName, packageName, path3, compileRequest, options).then((request) => request(axios, basePath));
       },
-      executeQueryModel(projectName, packageName, path2, queryRequest, options) {
-        return localVarFp.executeQueryModel(projectName, packageName, path2, queryRequest, options).then((request) => request(axios, basePath));
+      executeQueryModel(projectName, packageName, path3, queryRequest, options) {
+        return localVarFp.executeQueryModel(projectName, packageName, path3, queryRequest, options).then((request) => request(axios, basePath));
       },
-      getModel(projectName, packageName, path2, versionId, options) {
-        return localVarFp.getModel(projectName, packageName, path2, versionId, options).then((request) => request(axios, basePath));
+      getModel(projectName, packageName, path3, versionId, options) {
+        return localVarFp.getModel(projectName, packageName, path3, versionId, options).then((request) => request(axios, basePath));
       },
       listModels(projectName, packageName, versionId, options) {
         return localVarFp.listModels(projectName, packageName, versionId, options).then((request) => request(axios, basePath));
@@ -190572,14 +190650,14 @@ var require_api2 = __commonJS((exports) => {
   exports.ModelsApiFactory = ModelsApiFactory;
 
   class ModelsApi extends base_1.BaseAPI {
-    compileModelSource(projectName, packageName, path2, compileRequest, options) {
-      return (0, exports.ModelsApiFp)(this.configuration).compileModelSource(projectName, packageName, path2, compileRequest, options).then((request) => request(this.axios, this.basePath));
+    compileModelSource(projectName, packageName, path3, compileRequest, options) {
+      return (0, exports.ModelsApiFp)(this.configuration).compileModelSource(projectName, packageName, path3, compileRequest, options).then((request) => request(this.axios, this.basePath));
     }
-    executeQueryModel(projectName, packageName, path2, queryRequest, options) {
-      return (0, exports.ModelsApiFp)(this.configuration).executeQueryModel(projectName, packageName, path2, queryRequest, options).then((request) => request(this.axios, this.basePath));
+    executeQueryModel(projectName, packageName, path3, queryRequest, options) {
+      return (0, exports.ModelsApiFp)(this.configuration).executeQueryModel(projectName, packageName, path3, queryRequest, options).then((request) => request(this.axios, this.basePath));
     }
-    getModel(projectName, packageName, path2, versionId, options) {
-      return (0, exports.ModelsApiFp)(this.configuration).getModel(projectName, packageName, path2, versionId, options).then((request) => request(this.axios, this.basePath));
+    getModel(projectName, packageName, path3, versionId, options) {
+      return (0, exports.ModelsApiFp)(this.configuration).getModel(projectName, packageName, path3, versionId, options).then((request) => request(this.axios, this.basePath));
     }
     listModels(projectName, packageName, versionId, options) {
       return (0, exports.ModelsApiFp)(this.configuration).listModels(projectName, packageName, versionId, options).then((request) => request(this.axios, this.basePath));
@@ -190588,12 +190666,12 @@ var require_api2 = __commonJS((exports) => {
   exports.ModelsApi = ModelsApi;
   var NotebooksApiAxiosParamCreator = function(configuration) {
     return {
-      executeNotebookCell: async (projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options = {}) => {
+      executeNotebookCell: async (projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options = {}) => {
         (0, common_1.assertParamExists)("executeNotebookCell", "projectName", projectName);
         (0, common_1.assertParamExists)("executeNotebookCell", "packageName", packageName);
-        (0, common_1.assertParamExists)("executeNotebookCell", "path", path2);
+        (0, common_1.assertParamExists)("executeNotebookCell", "path", path3);
         (0, common_1.assertParamExists)("executeNotebookCell", "cellIndex", cellIndex);
-        const localVarPath = `/projects/{projectName}/packages/{packageName}/notebooks/{path}/cells/{cellIndex}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path2))).replace(`{${"cellIndex"}}`, encodeURIComponent(String(cellIndex)));
+        const localVarPath = `/projects/{projectName}/packages/{packageName}/notebooks/{path}/cells/{cellIndex}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path3))).replace(`{${"cellIndex"}}`, encodeURIComponent(String(cellIndex)));
         const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
         let baseOptions;
         if (configuration) {
@@ -190619,11 +190697,11 @@ var require_api2 = __commonJS((exports) => {
           options: localVarRequestOptions
         };
       },
-      getNotebook: async (projectName, packageName, path2, versionId, options = {}) => {
+      getNotebook: async (projectName, packageName, path3, versionId, options = {}) => {
         (0, common_1.assertParamExists)("getNotebook", "projectName", projectName);
         (0, common_1.assertParamExists)("getNotebook", "packageName", packageName);
-        (0, common_1.assertParamExists)("getNotebook", "path", path2);
-        const localVarPath = `/projects/{projectName}/packages/{packageName}/notebooks/{path}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path2)));
+        (0, common_1.assertParamExists)("getNotebook", "path", path3);
+        const localVarPath = `/projects/{projectName}/packages/{packageName}/notebooks/{path}`.replace(`{${"projectName"}}`, encodeURIComponent(String(projectName))).replace(`{${"packageName"}}`, encodeURIComponent(String(packageName))).replace(`{${"path"}}`, encodeURIComponent(String(path3)));
         const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
         let baseOptions;
         if (configuration) {
@@ -190672,16 +190750,16 @@ var require_api2 = __commonJS((exports) => {
   var NotebooksApiFp = function(configuration) {
     const localVarAxiosParamCreator = (0, exports.NotebooksApiAxiosParamCreator)(configuration);
     return {
-      async executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options) {
+      async executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options) {
         var _a, _b, _c;
-        const localVarAxiosArgs = await localVarAxiosParamCreator.executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options);
+        const localVarAxiosArgs = await localVarAxiosParamCreator.executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options);
         const localVarOperationServerIndex = (_a = configuration === null || configuration === undefined ? undefined : configuration.serverIndex) !== null && _a !== undefined ? _a : 0;
         const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap["NotebooksApi.executeNotebookCell"]) === null || _b === undefined ? undefined : _b[localVarOperationServerIndex]) === null || _c === undefined ? undefined : _c.url;
         return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
       },
-      async getNotebook(projectName, packageName, path2, versionId, options) {
+      async getNotebook(projectName, packageName, path3, versionId, options) {
         var _a, _b, _c;
-        const localVarAxiosArgs = await localVarAxiosParamCreator.getNotebook(projectName, packageName, path2, versionId, options);
+        const localVarAxiosArgs = await localVarAxiosParamCreator.getNotebook(projectName, packageName, path3, versionId, options);
         const localVarOperationServerIndex = (_a = configuration === null || configuration === undefined ? undefined : configuration.serverIndex) !== null && _a !== undefined ? _a : 0;
         const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap["NotebooksApi.getNotebook"]) === null || _b === undefined ? undefined : _b[localVarOperationServerIndex]) === null || _c === undefined ? undefined : _c.url;
         return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -190699,11 +190777,11 @@ var require_api2 = __commonJS((exports) => {
   var NotebooksApiFactory = function(configuration, basePath, axios) {
     const localVarFp = (0, exports.NotebooksApiFp)(configuration);
     return {
-      executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options) {
-        return localVarFp.executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options).then((request) => request(axios, basePath));
+      executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options) {
+        return localVarFp.executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options).then((request) => request(axios, basePath));
       },
-      getNotebook(projectName, packageName, path2, versionId, options) {
-        return localVarFp.getNotebook(projectName, packageName, path2, versionId, options).then((request) => request(axios, basePath));
+      getNotebook(projectName, packageName, path3, versionId, options) {
+        return localVarFp.getNotebook(projectName, packageName, path3, versionId, options).then((request) => request(axios, basePath));
       },
       listNotebooks(projectName, packageName, versionId, options) {
         return localVarFp.listNotebooks(projectName, packageName, versionId, options).then((request) => request(axios, basePath));
@@ -190713,11 +190791,11 @@ var require_api2 = __commonJS((exports) => {
   exports.NotebooksApiFactory = NotebooksApiFactory;
 
   class NotebooksApi extends base_1.BaseAPI {
-    executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options) {
-      return (0, exports.NotebooksApiFp)(this.configuration).executeNotebookCell(projectName, packageName, path2, cellIndex, versionId, filterParams, bypassFilters, options).then((request) => request(this.axios, this.basePath));
+    executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options) {
+      return (0, exports.NotebooksApiFp)(this.configuration).executeNotebookCell(projectName, packageName, path3, cellIndex, versionId, filterParams, bypassFilters, options).then((request) => request(this.axios, this.basePath));
     }
-    getNotebook(projectName, packageName, path2, versionId, options) {
-      return (0, exports.NotebooksApiFp)(this.configuration).getNotebook(projectName, packageName, path2, versionId, options).then((request) => request(this.axios, this.basePath));
+    getNotebook(projectName, packageName, path3, versionId, options) {
+      return (0, exports.NotebooksApiFp)(this.configuration).getNotebook(projectName, packageName, path3, versionId, options).then((request) => request(this.axios, this.basePath));
     }
     listNotebooks(projectName, packageName, versionId, options) {
       return (0, exports.NotebooksApiFp)(this.configuration).listNotebooks(projectName, packageName, versionId, options).then((request) => request(this.axios, this.basePath));
@@ -192019,10 +192097,10 @@ function isVisitable(thing) {
 function removeBrackets(key) {
   return utils_default.endsWith(key, "[]") ? key.slice(0, -2) : key;
 }
-function renderKey(path2, key, dots) {
-  if (!path2)
+function renderKey(path3, key, dots) {
+  if (!path3)
     return key;
-  return path2.concat(key).map(function each(token, i) {
+  return path3.concat(key).map(function each(token, i) {
     token = removeBrackets(token);
     return !dots && i ? "[" + token + "]" : token;
   }).join(dots ? "." : "");
@@ -192068,9 +192146,9 @@ function toFormData(obj, formData, options) {
     }
     return value;
   }
-  function defaultVisitor(value, key, path2) {
+  function defaultVisitor(value, key, path3) {
     let arr = value;
-    if (value && !path2 && typeof value === "object") {
+    if (value && !path3 && typeof value === "object") {
       if (utils_default.endsWith(key, "{}")) {
         key = metaTokens ? key : key.slice(0, -2);
         value = JSON.stringify(value);
@@ -192085,7 +192163,7 @@ function toFormData(obj, formData, options) {
     if (isVisitable(value)) {
       return true;
     }
-    formData.append(renderKey(path2, key, dots), convertValue(value));
+    formData.append(renderKey(path3, key, dots), convertValue(value));
     return false;
   }
   const stack = [];
@@ -192094,17 +192172,17 @@ function toFormData(obj, formData, options) {
     convertValue,
     isVisitable
   });
-  function build(value, path2) {
+  function build(value, path3) {
     if (utils_default.isUndefined(value))
       return;
     if (stack.indexOf(value) !== -1) {
-      throw Error("Circular reference detected in " + path2.join("."));
+      throw Error("Circular reference detected in " + path3.join("."));
     }
     stack.push(value);
     utils_default.forEach(value, function each(el, key) {
-      const result = !(utils_default.isUndefined(el) || el === null) && visitor.call(formData, el, utils_default.isString(key) ? key.trim() : key, path2, exposedHelpers);
+      const result = !(utils_default.isUndefined(el) || el === null) && visitor.call(formData, el, utils_default.isString(key) ? key.trim() : key, path3, exposedHelpers);
       if (result === true) {
-        build(el, path2 ? path2.concat(key) : [key]);
+        build(el, path3 ? path3.concat(key) : [key]);
       }
     });
     stack.pop();
@@ -192320,7 +192398,7 @@ var init_platform = __esm(() => {
 // ../../node_modules/axios/lib/helpers/toURLEncodedForm.js
 function toURLEncodedForm(data, options) {
   return toFormData_default(data, new platform_default.classes.URLSearchParams, {
-    visitor: function(value, key, path2, helpers) {
+    visitor: function(value, key, path3, helpers) {
       if (platform_default.isNode && utils_default.isBuffer(value)) {
         this.append(key, value.toString("base64"));
         return false;
@@ -192355,12 +192433,12 @@ function arrayToObject(arr) {
   return obj;
 }
 function formDataToJSON(formData) {
-  function buildPath(path2, value, target, index) {
-    let name = path2[index++];
+  function buildPath(path3, value, target, index) {
+    let name = path3[index++];
     if (name === "__proto__")
       return true;
     const isNumericKey = Number.isFinite(+name);
-    const isLast = index >= path2.length;
+    const isLast = index >= path3.length;
     name = !name && utils_default.isArray(target) ? target.length : name;
     if (isLast) {
       if (utils_default.hasOwnProp(target, name)) {
@@ -192373,7 +192451,7 @@ function formDataToJSON(formData) {
     if (!target[name] || !utils_default.isObject(target[name])) {
       target[name] = [];
     }
-    const result = buildPath(path2, value, target[name], index);
+    const result = buildPath(path3, value, target[name], index);
     if (result && utils_default.isArray(target[name])) {
       target[name] = arrayToObject(target[name]);
     }
@@ -192828,10 +192906,10 @@ var init_CanceledError = __esm(() => {
 });
 
 // ../../node_modules/axios/lib/core/settle.js
-function settle(resolve, reject, response) {
+function settle(resolve2, reject, response) {
   const validateStatus2 = response.config.validateStatus;
   if (!response.status || !validateStatus2 || validateStatus2(response.status)) {
-    resolve(response);
+    resolve2(response);
   } else {
     reject(new AxiosError_default("Request failed with status code " + response.status, [AxiosError_default.ERR_BAD_REQUEST, AxiosError_default.ERR_BAD_RESPONSE][Math.floor(response.status / 100) - 4], response.config, response.request, response));
   }
@@ -193387,7 +193465,7 @@ var import_proxy_from_env, import_follow_redirects, zlibOptions, brotliOptions,
   stream4.on("end", flush).on("error", flush);
   return throttled;
 }, isHttpAdapterSupported, wrapAsync = (asyncExecutor) => {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let onDone;
     let isDone;
     const done = (value, isRejected) => {
@@ -193398,7 +193476,7 @@ var import_proxy_from_env, import_follow_redirects, zlibOptions, brotliOptions,
     };
     const _resolve = (value) => {
       done(value);
-      resolve(value);
+      resolve2(value);
     };
     const _reject = (reason) => {
       done(reason, true);
@@ -193450,7 +193528,7 @@ var init_http = __esm(() => {
   });
   isHttpAdapterSupported = typeof process !== "undefined" && utils_default.kindOf(process) === "process";
   http_default = isHttpAdapterSupported && function httpAdapter(config) {
-    return wrapAsync(async function dispatchHttpRequest(resolve, reject, onDone) {
+    return wrapAsync(async function dispatchHttpRequest(resolve2, reject, onDone) {
       let { data, lookup, family } = config;
       const { responseType, responseEncoding } = config;
       const method = config.method.toUpperCase();
@@ -193509,7 +193587,7 @@ var init_http = __esm(() => {
         }
         let convertedData;
         if (method !== "GET") {
-          return settle(resolve, reject, {
+          return settle(resolve2, reject, {
             status: 405,
             statusText: "method not allowed",
             headers: {},
@@ -193531,7 +193609,7 @@ var init_http = __esm(() => {
         } else if (responseType === "stream") {
           convertedData = stream3.Readable.from(convertedData);
         }
-        return settle(resolve, reject, {
+        return settle(resolve2, reject, {
           data: convertedData,
           status: 200,
           statusText: "OK",
@@ -193609,9 +193687,9 @@ var init_http = __esm(() => {
         auth = urlUsername + ":" + urlPassword;
       }
       auth && headers.delete("authorization");
-      let path2;
+      let path3;
       try {
-        path2 = buildURL(parsed.pathname + parsed.search, config.params, config.paramsSerializer).replace(/^\?/, "");
+        path3 = buildURL(parsed.pathname + parsed.search, config.params, config.paramsSerializer).replace(/^\?/, "");
       } catch (err) {
         const customErr = new Error(err.message);
         customErr.config = config;
@@ -193621,7 +193699,7 @@ var init_http = __esm(() => {
       }
       headers.set("Accept-Encoding", "gzip, compress, deflate" + (isBrotliSupported ? ", br" : ""), false);
       const options = {
-        path: path2,
+        path: path3,
         method,
         headers: headers.toJSON(),
         agents: { http: config.httpAgent, https: config.httpsAgent },
@@ -193715,7 +193793,7 @@ var init_http = __esm(() => {
         };
         if (responseType === "stream") {
           response.data = responseStream;
-          settle(resolve, reject, response);
+          settle(resolve2, reject, response);
         } else {
           const responseBuffer = [];
           let totalResponseBytes = 0;
@@ -193754,7 +193832,7 @@ var init_http = __esm(() => {
             } catch (err) {
               return reject(AxiosError_default.from(err, null, config, response.request, response));
             }
-            settle(resolve, reject, response);
+            settle(resolve2, reject, response);
           });
         }
         emitter.once("abort", (err) => {
@@ -193831,10 +193909,10 @@ var init_cookies = __esm(() => {
   init_utils();
   init_platform();
   cookies_default = platform_default.hasStandardBrowserEnv ? {
-    write(name, value, expires, path2, domain, secure) {
+    write(name, value, expires, path3, domain, secure) {
       const cookie = [name + "=" + encodeURIComponent(value)];
       utils_default.isNumber(expires) && cookie.push("expires=" + new Date(expires).toGMTString());
-      utils_default.isString(path2) && cookie.push("path=" + path2);
+      utils_default.isString(path3) && cookie.push("path=" + path3);
       utils_default.isString(domain) && cookie.push("domain=" + domain);
       secure === true && cookie.push("secure");
       document.cookie = cookie.join("; ");
@@ -193997,7 +194075,7 @@ var init_xhr = __esm(() => {
   init_resolveConfig();
   isXHRAdapterSupported = typeof XMLHttpRequest !== "undefined";
   xhr_default = isXHRAdapterSupported && function(config) {
-    return new Promise(function dispatchXhrRequest(resolve, reject) {
+    return new Promise(function dispatchXhrRequest(resolve2, reject) {
       const _config = resolveConfig_default(config);
       let requestData = _config.data;
       const requestHeaders = AxiosHeaders_default.from(_config.headers).normalize();
@@ -194029,7 +194107,7 @@ var init_xhr = __esm(() => {
           request
         };
         settle(function _resolve(value) {
-          resolve(value);
+          resolve2(value);
           done();
         }, function _reject(err) {
           reject(err);
@@ -194378,8 +194456,8 @@ var DEFAULT_CHUNK_SIZE, isFunction2, globalFetchAPI, ReadableStream2, TextEncode
       responseType = responseType || "text";
       let responseData = await resolvers[utils_default.findKey(resolvers, responseType) || "text"](response, config);
       !isStreamResponse && unsubscribe && unsubscribe();
-      return await new Promise((resolve, reject) => {
-        settle(resolve, reject, {
+      return await new Promise((resolve2, reject) => {
+        settle(resolve2, reject, {
           data: responseData,
           headers: AxiosHeaders_default.from(response.headers),
           status: response.status,
@@ -194772,8 +194850,8 @@ class CancelToken {
       throw new TypeError("executor must be a function.");
     }
     let resolvePromise;
-    this.promise = new Promise(function promiseExecutor(resolve) {
-      resolvePromise = resolve;
+    this.promise = new Promise(function promiseExecutor(resolve2) {
+      resolvePromise = resolve2;
     });
     const token = this;
     this.promise.then((cancel) => {
@@ -194787,9 +194865,9 @@ class CancelToken {
     });
     this.promise.then = (onfulfilled) => {
       let _resolve;
-      const promise = new Promise((resolve) => {
-        token.subscribe(resolve);
-        _resolve = resolve;
+      const promise = new Promise((resolve2) => {
+        token.subscribe(resolve2);
+        _resolve = resolve2;
       }).then(onfulfilled);
       promise.cancel = function reject() {
         token.unsubscribe(_resolve);
@@ -195075,65 +195153,6 @@ var init_ducklake_version = __esm(() => {
   CATALOG_FORMAT_RE = /^(\d+)\.(\d+)(?:-([0-9A-Za-z.]+))?$/;
 });
 
-// src/pg_helpers.ts
-function redactPgSecrets(s) {
-  return s.replace(/([a-z][a-z0-9+.-]*:\/\/[^:/?#\s]*):([^/\s]+)@/gi, "$1:***@").replace(/((?:postgres|postgresql):\/\/[^:/?#\s]*):([^@\s]+)@/gi, "$1:***@").replace(/password=('[^']*'|"[^"]*"|\S+)/gi, "password=***");
-}
-
-// src/path_safety.ts
-import * as path2 from "path";
-function assertSafePackageName(packageName) {
-  if (typeof packageName !== "string" || !SAFE_NAME_RE.test(packageName)) {
-    throw new BadRequestError(`Invalid package name: must be 1-255 characters of letters, digits, "-", "_", or "." and must not start with "."`);
-  }
-}
-function assertSafeRelativeModelPath(modelPath) {
-  if (typeof modelPath !== "string" || modelPath.length === 0 || modelPath.length > MAX_MODEL_PATH_LEN || modelPath.includes("\x00") || modelPath.includes("\\") || path2.isAbsolute(modelPath) || modelPath.startsWith("/")) {
-    throw new BadRequestError(`Invalid model path`);
-  }
-  const segments = modelPath.split("/");
-  for (const segment of segments) {
-    if (segment === "" || segment === "." || segment === "..") {
-      throw new BadRequestError(`Invalid model path`);
-    }
-    if (segment.startsWith(".")) {
-      throw new BadRequestError(`Invalid model path`);
-    }
-  }
-}
-function assertSafeEnvironmentPath(environmentPath) {
-  if (typeof environmentPath !== "string") {
-    throw new BadRequestError(`Invalid environment path: must be a string`);
-  }
-  if (environmentPath.length === 0 || environmentPath.length > MAX_ENVIRONMENT_PATH_LEN) {
-    throw new BadRequestError(`Invalid environment path: bad length`);
-  }
-  if (environmentPath.indexOf("\x00") !== -1) {
-    throw new BadRequestError(`Invalid environment path: contains NUL byte`);
-  }
-  if (environmentPath.indexOf("..") !== -1) {
-    throw new BadRequestError(`Invalid environment path: contains ".." traversal segment`);
-  }
-  if (!SAFE_ENVIRONMENT_PATH_RE.test(environmentPath)) {
-    throw new BadRequestError(`Invalid environment path: must be an absolute path of printable ASCII characters`);
-  }
-}
-function safeJoinUnderRoot(root, ...segments) {
-  const resolvedRoot = path2.resolve(root);
-  const joined = path2.resolve(resolvedRoot, ...segments);
-  const rootWithSep = resolvedRoot.endsWith(path2.sep) ? resolvedRoot : resolvedRoot + path2.sep;
-  if (joined !== resolvedRoot && !joined.startsWith(rootWithSep)) {
-    throw new BadRequestError(`Resolved path is outside of root`);
-  }
-  return joined;
-}
-var SAFE_NAME_RE, MAX_MODEL_PATH_LEN = 1024, SAFE_ENVIRONMENT_PATH_RE, MAX_ENVIRONMENT_PATH_LEN = 4096;
-var init_path_safety = __esm(() => {
-  init_errors();
-  SAFE_NAME_RE = /^(?!\.\.?$)(?!\.)[A-Za-z0-9._-]{1,255}$/;
-  SAFE_ENVIRONMENT_PATH_RE = /^(?:\/|[A-Za-z]:[\\/])[\x20-\x7E]*$/;
-});
-
 // ../../node_modules/@smithy/types/dist-cjs/index.js
 var require_dist_cjs = __commonJS((exports) => {
   exports.HttpAuthLocation = undefined;
@@ -253350,7 +253369,12 @@ import {
   contextOverlay,
   MalloyConfig
 } from "@malloydata/malloy";
+import { createHash } from "crypto";
+import { mkdtempSync, readFileSync, writeFileSync } from "fs";
 import fs3 from "fs/promises";
+import os2 from "os";
+import path4 from "path";
+import tls from "tls";
 async function applyDuckLakeRowGroupBound(connection, dbName) {
   const bytes = getDuckLakeRowGroupSizeBytes();
   if (bytes === undefined) {
@@ -253358,7 +253382,7 @@ async function applyDuckLakeRowGroupBound(connection, dbName) {
   }
   try {
     await connection.runSQL("SET preserve_insertion_order=false");
-    await connection.runSQL(`CALL ${dbName}.set_option('parquet_row_group_size_bytes', '${escapeSQL(bytes)}')`);
+    await connection.runSQL(`CALL ${quoteIdentifier(dbName, "duckdb")}.set_option('parquet_row_group_size_bytes', '${escapeSQL(bytes)}')`);
     logger.info(`DuckLake row group bound applied to ${dbName}: ${bytes}`);
   } catch (error) {
     logger.warn(`Could not set the DuckLake row group bound on ${dbName}; the lake keeps ` + `its existing value: ${error instanceof Error ? error.message : String(error)}`);
@@ -253370,7 +253394,7 @@ async function applyDuckLakeTargetFileSize(connection, dbName) {
     return;
   }
   try {
-    await connection.runSQL(`CALL ${dbName}.set_option('target_file_size', '${escapeSQL(bytes)}')`);
+    await connection.runSQL(`CALL ${quoteIdentifier(dbName, "duckdb")}.set_option('target_file_size', '${escapeSQL(bytes)}')`);
     logger.info(`DuckLake target file size applied to ${dbName}: ${bytes}`);
   } catch (error) {
     logger.warn(`Could not set the DuckLake target file size on ${dbName}; the lake keeps ` + `its existing value: ${error instanceof Error ? error.message : String(error)}`);
@@ -253459,7 +253483,9 @@ async function isDatabaseAttached(connection, dbName) {
     });
     return rows.some((row) => Object.values(row).some((value) => typeof value === "string" && value === dbName));
   } catch (error) {
-    logger.warn(`Failed to check existing databases:`, error);
+    logger.warn("Failed to check existing databases", {
+      error: redactPgSecrets(error instanceof Error ? error.message : String(error))
+    });
     return false;
   }
 }
@@ -253613,10 +253639,13 @@ async function attachPostgres(connection, attachedDb) {
   if (!attachedDb.postgresConnection) {
     throw new Error(`PostgreSQL connection configuration missing for: ${attachedDb.name}`);
   }
+  if (!attachedDb.name) {
+    throw new Error("Attached database name is required");
+  }
   await installAndLoadExtension(connection, "postgres");
   const config = attachedDb.postgresConnection;
   const attachString = buildPgConnectionString(config);
-  const attachCommand = `ATTACH '${escapeSQL(attachString)}' AS ${attachedDb.name} (TYPE postgres, READ_ONLY);`;
+  const attachCommand = `ATTACH '${escapeSQL(attachString)}' AS ${quoteIdentifier(attachedDb.name, "duckdb")} (TYPE postgres, READ_ONLY);`;
   await connection.runSQL(attachCommand);
   logger.info(`Successfully attached PostgreSQL database: ${attachedDb.name}`);
 }
@@ -253628,10 +253657,11 @@ function runSQLRows(result) {
 }
 async function preflightDuckLakeCatalogFormat(connection, dbName, pgConnString, metadataSchema) {
   const tempDb = `${dbName}_fmt_preflight_${++ducklakePreflightSeq}`;
-  const metadataRef = metadataSchema ? `${tempDb}."${metadataSchema}".ducklake_metadata` : `${tempDb}.ducklake_metadata`;
+  const tempDbRef = quoteIdentifier(tempDb, "duckdb");
+  const metadataRef = metadataSchema ? `${tempDbRef}."${metadataSchema}".ducklake_metadata` : `${tempDbRef}.ducklake_metadata`;
   let catalogFormat;
   try {
-    await connection.runSQL(`ATTACH '${escapeSQL(pgConnString)}' AS ${tempDb} (TYPE postgres, READ_ONLY);`);
+    await connection.runSQL(`ATTACH '${escapeSQL(pgConnString)}' AS ${tempDbRef} (TYPE postgres, READ_ONLY);`);
     const result = await connection.runSQL(`SELECT value FROM ${metadataRef} WHERE key = 'version' LIMIT 1;`);
     const value = runSQLRows(result)[0]?.value;
     catalogFormat = typeof value === "string" ? value : undefined;
@@ -253645,7 +253675,7 @@ async function preflightDuckLakeCatalogFormat(connection, dbName, pgConnString,
     return;
   } finally {
     try {
-      await connection.runSQL(`DETACH ${tempDb};`);
+      await connection.runSQL(`DETACH ${tempDbRef};`);
     } catch {}
   }
   if (!catalogFormat) {
@@ -253719,7 +253749,7 @@ async function attachDuckLakeWithMode(connection, dbName, ducklakeConfig, option
   await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString, metadataSchema);
   const readOnlyClause = options.readOnly ? ", READ_ONLY true" : "";
   const metadataSchemaClause = metadataSchema ? `, METADATA_SCHEMA '${escapeSQL(metadataSchema)}'` : "";
-  const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true${readOnlyClause}${metadataSchemaClause});`;
+  const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${quoteIdentifier(dbName, "duckdb")} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true${readOnlyClause}${metadataSchemaClause});`;
   logger.debug(`Attaching DuckLake database using command: ${redactPgSecrets(attachCommand)}`);
   try {
     await connection.runSQL(attachCommand);
@@ -253746,14 +253776,14 @@ async function attachDuckLakeReadWrite(connection, dbName, ducklakeConfig) {
     readOnly: false
   });
 }
-async function federateSourceForPassthrough(connection, sourceType, config) {
+async function federateSourceForPassthrough(connection, sourceType, config, deps = {}) {
   switch (sourceType) {
     case "bigquery":
       return federateBigQuery(connection, config);
     case "snowflake":
       return federateSnowflake(connection, config);
     case "postgres":
-      return federatePostgres(connection, config);
+      return federatePostgres(connection, config, deps);
     default: {
       const exhaustive = sourceType;
       throw new Error(`No native query-passthrough for source type '${String(exhaustive)}'`);
@@ -253856,17 +253886,113 @@ ${secretLines.join(`,
   logger.info(`Federated Snowflake source for passthrough: ${secretName}`);
   return { handle: secretName, sourceType: "snowflake" };
 }
-async function federatePostgres(connection, config) {
+async function federatePostgres(connection, config, deps = {}) {
   const pg = config.postgresConnection;
   if (!pg) {
     throw new Error(`PostgreSQL connection configuration missing for: ${config.name}`);
   }
   await installAndLoadExtension(connection, "postgres");
-  const attachString = buildPgConnectionString(pg);
   const alias = config.name;
-  logger.info(`Federating Postgres source for passthrough as alias '${alias}': ${redactPgSecrets(attachString)}`);
-  await connection.runSQL(`ATTACH OR REPLACE '${escapeSQL(attachString)}' AS ${quoteIdentifier(alias, "duckdb")} (TYPE postgres, READ_ONLY);`);
-  return { handle: alias, sourceType: "postgres" };
+  let endpoint;
+  try {
+    let attachString;
+    if (config.proxy) {
+      if (!pg.host || !pg.port) {
+        throw new Error(`Connection proxy on '${config.name}' requires explicit host and port on the postgres connection.`);
+      }
+      endpoint = await (deps.openProxy ?? openProxy)(config.proxy, {
+        host: pg.host,
+        port: pg.port
+      });
+      attachString = buildProxiedPgAttachString(config.name, pg, endpoint);
+    } else {
+      attachString = buildPgConnectionString(pg);
+    }
+    logger.info(`Federating Postgres source for passthrough as alias '${alias}'${endpoint ? " through its SSH proxy" : ""}: ${redactPgSecrets(attachString)}`);
+    await connection.runSQL(`ATTACH OR REPLACE '${escapeSQL(attachString)}' AS ${quoteIdentifier(alias, "duckdb")} (TYPE postgres, READ_ONLY);`);
+  } catch (e) {
+    await endpoint?.close().catch((closeErr) => logger.warn(`Failed to close the SSH proxy opened for Postgres source '${config.name}' after its federation failed: ${String(closeErr)}`));
+    throw e;
+  }
+  return {
+    handle: alias,
+    sourceType: "postgres",
+    ...endpoint ? { close: () => endpoint.close() } : {}
+  };
+}
+function pgConninfoPair(key, value) {
+  if (value !== "" && !/[\s'\\]/.test(value))
+    return `${key}=${value}`;
+  return `${key}='${value.replace(/([\\'])/g, "\\$1")}'`;
+}
+function defaultProxiedAttachTrust() {
+  return {
+    caBundle: process.env.NODE_EXTRA_CA_CERTS || undefined,
+    ambientBundle: ambientTrustBundlePath
+  };
+}
+function ambientTrustBundlePath() {
+  const extra = process.env.NODE_EXTRA_CA_CERTS || undefined;
+  const cached = ambientTrustBundles.get(extra);
+  if (cached)
+    return cached;
+  let extraPem;
+  if (extra) {
+    try {
+      extraPem = readFileSync(extra, "utf8").trim();
+    } catch (err) {
+      logger.warn(`Ignoring NODE_EXTRA_CA_CERTS for the storage build's trust bundle: ${extra} could not be read (${err instanceof Error ? err.message : String(err)}).`);
+    }
+  }
+  const pem = [...tls.rootCertificates, ...extraPem ? [extraPem] : []].join(`
+`) + `
+`;
+  const digest = createHash("sha256").update(pem).digest("hex").slice(0, 16);
+  ambientTrustDir ??= mkdtempSync(path4.join(os2.tmpdir(), "publisher-ambient-ca-"));
+  const file = path4.join(ambientTrustDir, `${digest}.pem`);
+  writeFileSync(file, pem, { mode: 384 });
+  ambientTrustBundles.set(extra, file);
+  return file;
+}
+function buildProxiedPgAttachString(name, pg, endpoint, trust = defaultProxiedAttachTrust()) {
+  if (!pg.host) {
+    throw new Error(`Connection proxy on '${name}' requires an explicit host on the postgres connection.`);
+  }
+  const parts = [
+    pgConninfoPair("host", pg.host),
+    pgConninfoPair("hostaddr", endpoint.host),
+    pgConninfoPair("port", String(endpoint.port))
+  ];
+  if (pg.databaseName)
+    parts.push(pgConninfoPair("dbname", pg.databaseName));
+  if (pg.userName)
+    parts.push(pgConninfoPair("user", pg.userName));
+  if (pg.password)
+    parts.push(pgConninfoPair("password", pg.password));
+  const mode = pg.sslmode ?? "no-verify";
+  switch (mode) {
+    case "disable":
+      parts.push("sslmode=disable");
+      break;
+    case "no-verify":
+      parts.push("sslmode=require");
+      break;
+    case "verify-ca": {
+      if (!trust.caBundle) {
+        throw new Error(`Connection proxy on '${name}' uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset).`);
+      }
+      parts.push("sslmode=verify-ca", pgConninfoPair("sslrootcert", trust.caBundle));
+      break;
+    }
+    case "verify-full":
+      parts.push("sslmode=verify-full", pgConninfoPair("sslrootcert", trust.ambientBundle()));
+      break;
+    default: {
+      const unhandled = mode;
+      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${String(unhandled)}' (expected ${PROXIED_SSLMODES.join(" | ")}).`);
+    }
+  }
+  return parts.join(" ");
 }
 function shouldRenewStorageSecret(opts) {
   return opts.hasRenewer && !opts.alreadyRenewing && isExpiredCredentialError(opts.error);
@@ -254051,7 +254177,9 @@ async function attachDatabasesToDuckDB(duckdbConnection, attachedDatabases) {
         handleAlreadyAttachedError(attachError, attachedDb.name || "");
       }
     } catch (error) {
-      logger.error(`Failed to attach database ${attachedDb.name}:`, error);
+      logger.error(`Failed to attach database ${attachedDb.name}`, {
+        error: redactPgSecrets(error instanceof Error ? error.message : String(error))
+      });
       throw new Error(`Failed to attach database ${attachedDb.name}: ${error.message}`);
     }
   }
@@ -254423,7 +254551,7 @@ async function testDuckDBConnection(duckdbConnection, connectionConfig) {
       }
     } catch (error) {
       const errorMessage = `Attached database '${attachedDb.name}' (${attachedDb.type}) test failed: ${error.message}`;
-      logger.error(errorMessage);
+      logger.error(redactPgSecrets(errorMessage));
       failedAttachments.push(errorMessage);
     }
   }
@@ -254435,11 +254563,16 @@ ${failedAttachments.join(`
 }
 async function testConnectionConfig(connectionConfig) {
   let environmentConfig = null;
+  let testRoot = null;
   try {
     if (!connectionConfig.name) {
       throw new Error("Connection name is required");
     }
-    environmentConfig = buildEnvironmentMalloyConfig([connectionConfig]);
+    if (connectionConfig.type === "duckdb" || connectionConfig.type === "ducklake") {
+      assertSafePackageName(connectionConfig.name);
+    }
+    testRoot = await fs3.mkdtemp(path4.join(os2.tmpdir(), "publisher-conn-test-"));
+    environmentConfig = buildEnvironmentMalloyConfig([connectionConfig], testRoot);
     const connection = await environmentConfig.malloyConfig.connections.lookupConnection(connectionConfig.name);
     if (connectionConfig.type === "duckdb") {
       await testDuckDBConnection(connection, connectionConfig);
@@ -254462,11 +254595,13 @@ async function testConnectionConfig(connectionConfig) {
     if (error instanceof AxiosError2) {
       logAxiosError(error);
     } else {
-      logger.error(error);
+      logger.error("Connection test failed", {
+        error: redactPgSecrets(error instanceof Error ? error.stack ?? error.message : String(error))
+      });
     }
     return {
       status: "failed",
-      errorMessage: error.message
+      errorMessage: redactPgSecrets(error instanceof Error ? error.message : String(error))
     };
   } finally {
     if (environmentConfig) {
@@ -254478,12 +254613,18 @@ async function testConnectionConfig(connectionConfig) {
         });
       }
     }
-    if (connectionConfig.type === "ducklake" && connectionConfig.name) {
-      await deleteDuckLakeConnectionFile(connectionConfig.name, process.cwd());
+    if (testRoot) {
+      try {
+        await fs3.rm(testRoot, { recursive: true, force: true });
+      } catch (cleanupError) {
+        logger.warn("Error cleaning up connection test directory", {
+          error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+        });
+      }
     }
   }
 }
-var import_db_publisher, extensionSessionPinned, sessionLimitsApplied, ducklakePreflightSeq = 0, AzureDuckDBConnection, DuckLakeConnection;
+var import_db_publisher, extensionSessionPinned, sessionLimitsApplied, ducklakePreflightSeq = 0, ambientTrustBundles, ambientTrustDir, AzureDuckDBConnection, DuckLakeConnection;
 var init_connection = __esm(() => {
   init_axios2();
   init_config();
@@ -254499,6 +254640,7 @@ var init_connection = __esm(() => {
   import_db_publisher = __toESM(require_dist5(), 1);
   extensionSessionPinned = new WeakSet;
   sessionLimitsApplied = new WeakMap;
+  ambientTrustBundles = new Map;
   AzureDuckDBConnection = class AzureDuckDBConnection extends DuckDBConnection {
     azureDatabases;
     constructor(options, azureDatabases) {
@@ -262429,7 +262571,7 @@ var require_table = __commonJS((exports) => {
   var events_1 = __require("events");
   var fs4 = __require("fs");
   var is = require_is();
-  var path4 = __require("path");
+  var path5 = __require("path");
   var streamEvents = require_stream_events();
   var uuid = require_dist10();
   var _1 = require_src139();
@@ -262675,7 +262817,7 @@ var require_table = __commonJS((exports) => {
           if (!common_1.util.isCustomType(dest, "storage/file")) {
             throw new Error("Destination must be a File object.");
           }
-          const format = path4.extname(dest.name).substr(1).toLowerCase();
+          const format = path5.extname(dest.name).substr(1).toLowerCase();
           if (!options.destinationFormat && !options.format && FORMATS[format]) {
             options.destinationFormat = FORMATS[format];
           }
@@ -262733,7 +262875,7 @@ var require_table = __commonJS((exports) => {
         metadata.location = this.location;
       }
       if (typeof source === "string") {
-        const detectedFormat = FORMATS[path4.extname(source).substr(1).toLowerCase()];
+        const detectedFormat = FORMATS[path5.extname(source).substr(1).toLowerCase()];
         if (!metadata.sourceFormat && detectedFormat) {
           metadata.sourceFormat = detectedFormat;
         }
@@ -262769,7 +262911,7 @@ var require_table = __commonJS((exports) => {
           if (!common_1.util.isCustomType(src, "storage/file")) {
             throw new Error("Source must be a File object.");
           }
-          const format = FORMATS[path4.extname(src.name).substr(1).toLowerCase()];
+          const format = FORMATS[path5.extname(src.name).substr(1).toLowerCase()];
           if (!metadata.sourceFormat && format) {
             body.configuration.load.sourceFormat = format;
           }
@@ -267522,16 +267664,16 @@ function parseMotly(texts) {
   const after = parseGuarded(rescued);
   return { tag: after.tag, errors: [...envErrors, ...after.messages] };
 }
-function tagText(tag, ...path5) {
+function tagText(tag, ...path6) {
   try {
-    return tag?.text(...path5);
+    return tag?.text(...path6);
   } catch {
     return;
   }
 }
-function tagNumeric(tag, ...path5) {
+function tagNumeric(tag, ...path6) {
   try {
-    const raw = tagText(tag, ...path5);
+    const raw = tagText(tag, ...path6);
     if (raw === undefined)
       return;
     const DECIMAL = /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][-+]?\d+)?$/;
@@ -267595,8 +267737,8 @@ var init_motly = __esm(() => {
 import {
   isSourceDef
 } from "@malloydata/malloy";
-function presentText(tag, ...path5) {
-  const raw = tagText(tag, ...path5);
+function presentText(tag, ...path6) {
+  const raw = tagText(tag, ...path6);
   return raw !== undefined && raw.trim() !== "" ? raw : undefined;
 }
 function readGivenControlSpec(annotationTexts2) {
@@ -267877,8 +268019,8 @@ function readDrillTag(annotations) {
 function isString2(value) {
   return value !== undefined;
 }
-function tagTextArray(tag, ...path5) {
-  const items = tag?.array(...path5);
+function tagTextArray(tag, ...path6) {
+  const items = tag?.array(...path6);
   return items?.map((item) => tagText(item)).filter(isString2);
 }
 function resolveTileGivens(tile, facts) {
@@ -269057,7 +269199,7 @@ var require_yauzl = __commonJS((exports) => {
   exports.ZipFile = ZipFile;
   exports.Entry = Entry;
   exports.RandomAccessReader = RandomAccessReader;
-  function open2(path5, options, callback) {
+  function open2(path6, options, callback) {
     if (typeof options === "function") {
       callback = options;
       options = null;
@@ -269076,7 +269218,7 @@ var require_yauzl = __commonJS((exports) => {
       options.strictFileNames = false;
     if (callback == null)
       callback = defaultCallback;
-    fs4.open(path5, "r", function(err, fd) {
+    fs4.open(path6, "r", function(err, fd) {
       if (err)
         return callback(err);
       fromFd(fd, options, function(err2, zipfile) {
@@ -269740,7 +269882,7 @@ var require_extract_zip = __commonJS((exports, module) => {
   var debug = require_src5()("extract-zip");
   var { createWriteStream, promises: fs4 } = __require("fs");
   var getStream = require_get_stream();
-  var path5 = __require("path");
+  var path6 = __require("path");
   var { promisify } = __require("util");
   var stream4 = __require("stream");
   var yauzl = require_yauzl();
@@ -269778,12 +269920,12 @@ var require_extract_zip = __commonJS((exports, module) => {
             this.zipfile.readEntry();
             return;
           }
-          const destDir = path5.dirname(path5.join(this.opts.dir, entry.fileName));
+          const destDir = path6.dirname(path6.join(this.opts.dir, entry.fileName));
           try {
             await fs4.mkdir(destDir, { recursive: true });
             const canonicalDestDir = await fs4.realpath(destDir);
-            const relativeDestDir = path5.relative(this.opts.dir, canonicalDestDir);
-            if (relativeDestDir.split(path5.sep).includes("..")) {
+            const relativeDestDir = path6.relative(this.opts.dir, canonicalDestDir);
+            if (relativeDestDir.split(path6.sep).includes("..")) {
               throw new Error(`Out of bound path "${canonicalDestDir}" found while processing file ${entry.fileName}`);
             }
             await this.extractEntry(entry);
@@ -269805,7 +269947,7 @@ var require_extract_zip = __commonJS((exports, module) => {
       if (this.opts.onEntry) {
         this.opts.onEntry(entry, this.zipfile);
       }
-      const dest = path5.join(this.opts.dir, entry.fileName);
+      const dest = path6.join(this.opts.dir, entry.fileName);
       const mode = entry.externalFileAttributes >> 16 & 65535;
       const IFMT = 61440;
       const IFDIR = 16384;
@@ -269820,7 +269962,7 @@ var require_extract_zip = __commonJS((exports, module) => {
         isDir = madeBy === 0 && entry.externalFileAttributes === 16;
       debug("extracting entry", { filename: entry.fileName, isDir, isSymlink: symlink });
       const procMode = this.getExtractedMode(mode, isDir) & 511;
-      const destDir = isDir ? dest : path5.dirname(dest);
+      const destDir = isDir ? dest : path6.dirname(dest);
       const mkdirOptions = { recursive: true };
       if (isDir) {
         mkdirOptions.mode = procMode;
@@ -269863,7 +270005,7 @@ var require_extract_zip = __commonJS((exports, module) => {
   }
   module.exports = async function(zipPath, opts) {
     debug("creating target directory", opts.dir);
-    if (!path5.isAbsolute(opts.dir)) {
+    if (!path6.isAbsolute(opts.dir)) {
       throw new Error("Target directory is expected to be absolute");
     }
     await fs4.mkdir(opts.dir, { recursive: true });
@@ -269881,10 +270023,10 @@ var require_src140 = __commonJS((exports) => {
   var fs_1 = __require("fs");
   var debug_1 = __importDefault(require_src5());
   var log = debug_1.default("@kwsites/file-exists");
-  function check(path5, isFile2, isDirectory) {
-    log(`checking %s`, path5);
+  function check(path6, isFile2, isDirectory) {
+    log(`checking %s`, path6);
     try {
-      const stat4 = fs_1.statSync(path5);
+      const stat4 = fs_1.statSync(path6);
       if (stat4.isFile() && isFile2) {
         log(`[OK] path represents a file`);
         return true;
@@ -269904,8 +270046,8 @@ var require_src140 = __commonJS((exports) => {
       throw e;
     }
   }
-  function exists(path5, type = exports.READABLE) {
-    return check(path5, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+  function exists(path6, type = exports.READABLE) {
+    return check(path6, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
   }
   exports.exists = exists;
   exports.FILE = 1;
@@ -270494,14 +270636,14 @@ var init_authorize_metrics = __esm(() => {
 });
 
 // src/materialization_metrics.ts
-function lazyCounter2(name, description) {
+function lazyCounter3(name, description) {
   let instrument2 = null;
-  resetHooks2.push(() => instrument2 = null);
+  resetHooks3.push(() => instrument2 = null);
   return () => instrument2 ??= publisherMeter().createCounter(name, { description });
 }
-function lazyHistogram(name, description, unit) {
+function lazyHistogram2(name, description, unit) {
   let instrument2 = null;
-  resetHooks2.push(() => instrument2 = null);
+  resetHooks3.push(() => instrument2 = null);
   return () => instrument2 ??= publisherMeter().createHistogram(name, {
     description,
     unit
@@ -270585,43 +270727,43 @@ function recordChainedStorageBuild(outcome) {
 function recordColocatedBindDropped(reason) {
   colocatedBindDroppedCounter().add(1, { reason });
 }
-var resetHooks2, runCounter, runDuration, sourcesCounter, incrementalStepCounter, buildPlanComputeDuration, buildPlanComputeFailedCounter, autoLoadCounter, connectionDigestSkipCounter, manifestBindCounter, manifestBindDegradedCounter, duplicateTargetSkipCounter, sharedAddressInstructionCounter, tableCollisionCounter, sourceBuildDuration, dropTablesCounter, scheduledFireCounter, storageServeRoutingCounter, storageTableRetainedCounter, storageBuildFailureCounter, attributionSkippedCounter, eligibilityRefusedCounter, serveShapeTierDropCounter, serveShapeTypeFallbackCounter, chainedStorageBuildCounter, colocatedBindDroppedCounter;
+var resetHooks3, runCounter, runDuration, sourcesCounter, incrementalStepCounter, buildPlanComputeDuration, buildPlanComputeFailedCounter, autoLoadCounter, connectionDigestSkipCounter, manifestBindCounter, manifestBindDegradedCounter, duplicateTargetSkipCounter, sharedAddressInstructionCounter, tableCollisionCounter, sourceBuildDuration, dropTablesCounter, scheduledFireCounter, storageServeRoutingCounter, storageTableRetainedCounter, storageBuildFailureCounter, attributionSkippedCounter, eligibilityRefusedCounter, serveShapeTierDropCounter, serveShapeTypeFallbackCounter, chainedStorageBuildCounter, colocatedBindDroppedCounter;
 var init_materialization_metrics = __esm(() => {
   init_telemetry();
-  resetHooks2 = [];
-  runCounter = lazyCounter2("publisher_materialization_runs_total", "Materialization builds completed. Labels: mode ('auto'|'orchestrated'), outcome ('success'|'partial'|'failed'|'cancelled').");
-  runDuration = lazyHistogram("publisher_materialization_run_duration_ms", "Wall-clock duration of a materialization build. Label: mode ('auto'|'orchestrated').", "ms");
-  sourcesCounter = lazyCounter2("publisher_materialization_sources_total", "Persist sources processed by a materialization run. Label: outcome ('built'|'reused'|'failed').");
-  incrementalStepCounter = lazyCounter2("publisher_materialization_incremental_step_total", 'Refreshes of a source declared refresh="incremental". Labels: step ' + "('delta'|'seed'|'skip'), and for seed/skip a bounded reason code " + "(IncrementalStepReasonCode). A 'seed' is a full rebuild the delta path " + "declined, so a rising seed rate means the feature is not engaging — and " + "the reason label says why without a log dive.");
-  buildPlanComputeDuration = lazyHistogram("publisher_materialization_build_plan_compute_duration_ms", "Wall-clock duration of compiling a package's build plan (Package.buildPlan).", "ms");
-  buildPlanComputeFailedCounter = lazyCounter2("publisher_materialization_build_plan_compute_failed_total", "Package loads whose build plan failed to compute. The ROOT-CAUSE signal for " + "colocated_bind_dropped{reason='build_plan_unavailable'}, which fires only " + "per dropped entry per load -- a package that loads once and is never " + "reloaded ticks that counter once and then sits with its colocated tier " + "off and a flat total, indistinguishable from healthy.");
-  autoLoadCounter = lazyCounter2("publisher_materialization_auto_load_total", "Auto-run manifest auto-load attempts. Label: outcome ('success'|'failure').");
-  connectionDigestSkipCounter = lazyCounter2("publisher_materialization_connection_digest_skipped_total", "Connection digests skipped during build-plan compile because the connection did not resolve.");
-  manifestBindCounter = lazyCounter2("publisher_materialization_manifest_bind_total", "Manifest bind attempts. Label: outcome ('success'|'failure'|'timeout').");
-  manifestBindDegradedCounter = lazyCounter2("publisher_materialization_manifest_bind_degraded_total", "Manifest entries bound with an UNQUOTED table path because their connection " + "could not be resolved (serve-side bind) or is absent from the build " + "(build-side seed). A misconfiguration that breaks the source on a " + "case-folding engine (Snowflake); alertable.");
-  duplicateTargetSkipCounter = lazyCounter2("publisher_materialization_duplicate_target_skipped_total", "Sources skipped because the physical table they name was already built in " + "this run. Ordinary for a package that extends a persisted source; a " + "rising count against a package with no extension means the plan is " + "enumerating one table under more names than expected.");
-  sharedAddressInstructionCounter = lazyCounter2("publisher_materialization_shared_address_instructions_total", "Content addresses that arrived with more than one instruction naming a " + "DIFFERENT physical table. The host minted a table per source where " + "several sources share one artifact. With a sourceID on each instruction " + "every table is built and only one is recorded, so the rest are orphaned; " + "without one the last instruction wins and the earlier names are never " + "built. Wasteful, not wrong — the table's CONTENT is the same either way.");
-  tableCollisionCounter = lazyCounter2("publisher_materialization_table_collision_total", "Two definitions with DIFFERENT content addresses materializing into ONE " + "physical table. Each build overwrites the other's rows while both " + "addresses resolve to the table at serve time, so a query is answered " + "from another source's data. A wrong answer, not wasted work — page on " + "this one. Refused instead of counted-and-continued when " + "PERSIST_COLLISION_ENFORCE is set, so a non-zero rate here is also the " + "measure of what flipping that flag would start refusing.");
-  sourceBuildDuration = lazyHistogram("publisher_materialization_source_build_duration_ms", "Wall-clock duration of building a single persist source.", "ms");
-  dropTablesCounter = lazyCounter2("publisher_materialization_drop_tables_total", "Physical tables dropped on delete. Label: outcome ('success'|'failure').");
-  scheduledFireCounter = lazyCounter2("publisher_materialization_scheduled_fires_total", "Standalone-scheduler attempts to fire a package's materialization.schedule. " + "Label: outcome ('fired'|'conflict'|'error').");
-  storageServeRoutingCounter = lazyCounter2("publisher_storage_serve_routing_total", "storage= serve routing decisions. Label: outcome ('storage'|'live_fallback'|" + "'runtime_live_fallback'|'blocked_by_row_level_gate'). Covers the storage= " + "tier only; a colocated #@ persist hit is in neither the numerator nor the " + "denominator. NOTE 'live_fallback' here means the transform was INELIGIBLE, " + "which QueryResult.servedFrom reports as null - that field's " + "'live_fallback' is this counter's 'runtime_live_fallback'.");
-  storageTableRetainedCounter = lazyCounter2("publisher_storage_tables_retained_total", "Tables a FAILED run left in a storage= destination and deliberately did not " + "reclaim, because the source is refreshed incrementally and the name may be " + "the one it serves from. Label: destination. Not all of these are orphans — " + "a rebuild at a fresh generational name is, a seed on the live serving name " + "is not, and the manifest entry cannot separate them — so read this as an " + "upper bound on what is accumulating rather than a leak count. It is the " + "only accounting there is until reclaiming a destination exists, which is " + "why it is a counter and not just a log line: the question is a rate, not " + "whether it ever happened.");
-  storageBuildFailureCounter = lazyCounter2("publisher_storage_build_failures_total", "storage= build failures (federation/passthrough/attach/CTAS), distinct from " + "in-warehouse build failures. Labels: destination (connection name), " + "reason ('build_failed'|'billed_read_not_captured'). The second is the " + "expensive one: the warehouse read ran and was charged, and the rows could " + "not be captured — so a re-drive pays for it again. Worth alerting on " + "separately from a failure that costs only a retry.");
-  attributionSkippedCounter = lazyCounter2("publisher_storage_build_attribution_skipped_total", "storage= builds whose warehouse read went out UNATTRIBUTED while tagging was " + "on. Label: reason ('job_listing_unavailable'|'tag_failed'|" + "'read_row_not_found'|'read_row_ambiguous'|'cost_query_failed'). " + "The read still ran and the " + "build still succeeded — what was lost is the label in the customer's own " + "query history, and the cost on this side. Without this an operator who " + "turns tagging on and sees nothing has a single log line to go on.");
-  eligibilityRefusedCounter = lazyCounter2("publisher_materialization_eligibility_refused_total", "storage= materialization-eligibility refusals. Label: reason " + "('free_parameter'|'given'|'authorize'|'not_duckdb_portable'|" + "'public_surface_unknown').");
-  serveShapeTierDropCounter = lazyCounter2("publisher_storage_serve_shape_tier_drop_total", "storage serve-shape compile escalations: a refinement tier failed to " + "compile and the riskiest category was dropped. Label: tier (the failed " + "tier index, 0=full).");
-  serveShapeTypeFallbackCounter = lazyCounter2("publisher_storage_serve_shape_type_fallback_total", "Captured DuckDB column types mapped to json in the serve shape (type " + "fidelity loss). Label: kind ('array'|'unrecognized').");
-  chainedStorageBuildCounter = lazyCounter2("publisher_storage_chained_build_total", "Chained storage= source builds (a source reading a storage-materialized " + "upstream). Label: outcome ('parent_reuse'|'inline_fallback'|" + "'strict_refused'). The parent_reuse share is the headline signal for how " + "far the stack-on-the-parent path gets us vs recompute-from-raw.");
-  colocatedBindDroppedCounter = lazyCounter2("publisher_materialization_colocated_bind_dropped_total", "Colocated serve-manifest entries dropped by bindColocatedServeManifest. " + "Label: reason ('build_plan_unavailable' when the package's build plan " + "failed to compute, so no source was examined at all; 'refused' when the " + "source itself was examined and found ineligible). 'build_plan_unavailable' " + "is a whole-package regression -- colocated is the default tier and is NOT " + "gated by PERSIST_STORAGE_MODE, so every colocated binding for the package " + "reverts to live recompute until a load succeeds.");
+  resetHooks3 = [];
+  runCounter = lazyCounter3("publisher_materialization_runs_total", "Materialization builds completed. Labels: mode ('auto'|'orchestrated'), outcome ('success'|'partial'|'failed'|'cancelled').");
+  runDuration = lazyHistogram2("publisher_materialization_run_duration_ms", "Wall-clock duration of a materialization build. Label: mode ('auto'|'orchestrated').", "ms");
+  sourcesCounter = lazyCounter3("publisher_materialization_sources_total", "Persist sources processed by a materialization run. Label: outcome ('built'|'reused'|'failed').");
+  incrementalStepCounter = lazyCounter3("publisher_materialization_incremental_step_total", 'Refreshes of a source declared refresh="incremental". Labels: step ' + "('delta'|'seed'|'skip'), and for seed/skip a bounded reason code " + "(IncrementalStepReasonCode). A 'seed' is a full rebuild the delta path " + "declined, so a rising seed rate means the feature is not engaging — and " + "the reason label says why without a log dive.");
+  buildPlanComputeDuration = lazyHistogram2("publisher_materialization_build_plan_compute_duration_ms", "Wall-clock duration of compiling a package's build plan (Package.buildPlan).", "ms");
+  buildPlanComputeFailedCounter = lazyCounter3("publisher_materialization_build_plan_compute_failed_total", "Package loads whose build plan failed to compute. The ROOT-CAUSE signal for " + "colocated_bind_dropped{reason='build_plan_unavailable'}, which fires only " + "per dropped entry per load -- a package that loads once and is never " + "reloaded ticks that counter once and then sits with its colocated tier " + "off and a flat total, indistinguishable from healthy.");
+  autoLoadCounter = lazyCounter3("publisher_materialization_auto_load_total", "Auto-run manifest auto-load attempts. Label: outcome ('success'|'failure').");
+  connectionDigestSkipCounter = lazyCounter3("publisher_materialization_connection_digest_skipped_total", "Connection digests skipped during build-plan compile because the connection did not resolve.");
+  manifestBindCounter = lazyCounter3("publisher_materialization_manifest_bind_total", "Manifest bind attempts. Label: outcome ('success'|'failure'|'timeout').");
+  manifestBindDegradedCounter = lazyCounter3("publisher_materialization_manifest_bind_degraded_total", "Manifest entries bound with an UNQUOTED table path because their connection " + "could not be resolved (serve-side bind) or is absent from the build " + "(build-side seed). A misconfiguration that breaks the source on a " + "case-folding engine (Snowflake); alertable.");
+  duplicateTargetSkipCounter = lazyCounter3("publisher_materialization_duplicate_target_skipped_total", "Sources skipped because the physical table they name was already built in " + "this run. Ordinary for a package that extends a persisted source; a " + "rising count against a package with no extension means the plan is " + "enumerating one table under more names than expected.");
+  sharedAddressInstructionCounter = lazyCounter3("publisher_materialization_shared_address_instructions_total", "Content addresses that arrived with more than one instruction naming a " + "DIFFERENT physical table. The host minted a table per source where " + "several sources share one artifact. With a sourceID on each instruction " + "every table is built and only one is recorded, so the rest are orphaned; " + "without one the last instruction wins and the earlier names are never " + "built. Wasteful, not wrong — the table's CONTENT is the same either way.");
+  tableCollisionCounter = lazyCounter3("publisher_materialization_table_collision_total", "Two definitions with DIFFERENT content addresses materializing into ONE " + "physical table. Each build overwrites the other's rows while both " + "addresses resolve to the table at serve time, so a query is answered " + "from another source's data. A wrong answer, not wasted work — page on " + "this one. Refused instead of counted-and-continued when " + "PERSIST_COLLISION_ENFORCE is set, so a non-zero rate here is also the " + "measure of what flipping that flag would start refusing.");
+  sourceBuildDuration = lazyHistogram2("publisher_materialization_source_build_duration_ms", "Wall-clock duration of building a single persist source.", "ms");
+  dropTablesCounter = lazyCounter3("publisher_materialization_drop_tables_total", "Physical tables dropped on delete. Label: outcome ('success'|'failure').");
+  scheduledFireCounter = lazyCounter3("publisher_materialization_scheduled_fires_total", "Standalone-scheduler attempts to fire a package's materialization.schedule. " + "Label: outcome ('fired'|'conflict'|'error').");
+  storageServeRoutingCounter = lazyCounter3("publisher_storage_serve_routing_total", "storage= serve routing decisions. Label: outcome ('storage'|'live_fallback'|" + "'runtime_live_fallback'|'blocked_by_row_level_gate'). Covers the storage= " + "tier only; a colocated #@ persist hit is in neither the numerator nor the " + "denominator. NOTE 'live_fallback' here means the transform was INELIGIBLE, " + "which QueryResult.servedFrom reports as null - that field's " + "'live_fallback' is this counter's 'runtime_live_fallback'.");
+  storageTableRetainedCounter = lazyCounter3("publisher_storage_tables_retained_total", "Tables a FAILED run left in a storage= destination and deliberately did not " + "reclaim, because the source is refreshed incrementally and the name may be " + "the one it serves from. Label: destination. Not all of these are orphans — " + "a rebuild at a fresh generational name is, a seed on the live serving name " + "is not, and the manifest entry cannot separate them — so read this as an " + "upper bound on what is accumulating rather than a leak count. It is the " + "only accounting there is until reclaiming a destination exists, which is " + "why it is a counter and not just a log line: the question is a rate, not " + "whether it ever happened.");
+  storageBuildFailureCounter = lazyCounter3("publisher_storage_build_failures_total", "storage= build failures (federation/passthrough/attach/CTAS), distinct from " + "in-warehouse build failures. Labels: destination (connection name), " + "reason ('build_failed'|'billed_read_not_captured'). The second is the " + "expensive one: the warehouse read ran and was charged, and the rows could " + "not be captured — so a re-drive pays for it again. Worth alerting on " + "separately from a failure that costs only a retry.");
+  attributionSkippedCounter = lazyCounter3("publisher_storage_build_attribution_skipped_total", "storage= builds whose warehouse read went out UNATTRIBUTED while tagging was " + "on. Label: reason ('job_listing_unavailable'|'tag_failed'|" + "'read_row_not_found'|'read_row_ambiguous'|'cost_query_failed'). " + "The read still ran and the " + "build still succeeded — what was lost is the label in the customer's own " + "query history, and the cost on this side. Without this an operator who " + "turns tagging on and sees nothing has a single log line to go on.");
+  eligibilityRefusedCounter = lazyCounter3("publisher_materialization_eligibility_refused_total", "storage= materialization-eligibility refusals. Label: reason " + "('free_parameter'|'given'|'authorize'|'not_duckdb_portable'|" + "'public_surface_unknown').");
+  serveShapeTierDropCounter = lazyCounter3("publisher_storage_serve_shape_tier_drop_total", "storage serve-shape compile escalations: a refinement tier failed to " + "compile and the riskiest category was dropped. Label: tier (the failed " + "tier index, 0=full).");
+  serveShapeTypeFallbackCounter = lazyCounter3("publisher_storage_serve_shape_type_fallback_total", "Captured DuckDB column types mapped to json in the serve shape (type " + "fidelity loss). Label: kind ('array'|'unrecognized').");
+  chainedStorageBuildCounter = lazyCounter3("publisher_storage_chained_build_total", "Chained storage= source builds (a source reading a storage-materialized " + "upstream). Label: outcome ('parent_reuse'|'inline_fallback'|" + "'strict_refused'). The parent_reuse share is the headline signal for how " + "far the stack-on-the-parent path gets us vs recompute-from-raw.");
+  colocatedBindDroppedCounter = lazyCounter3("publisher_materialization_colocated_bind_dropped_total", "Colocated serve-manifest entries dropped by bindColocatedServeManifest. " + "Label: reason ('build_plan_unavailable' when the package's build plan " + "failed to compute, so no source was examined at all; 'refused' when the " + "source itself was examined and found ineligible). 'build_plan_unavailable' " + "is a whole-package regression -- colocated is the default tier and is NOT " + "gated by PERSIST_STORAGE_MODE, so every colocated binding for the package " + "reverts to live recompute until a load succeeds.");
 });
 
 // src/utils.ts
 import * as fs4 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function ignoreDotfiles(file) {
-  return path6.basename(file).startsWith(".");
+  return path7.basename(file).startsWith(".");
 }
 function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -270630,11 +270772,11 @@ var URL_READER;
 var init_utils4 = __esm(() => {
   URL_READER = {
     readURL: (url2) => {
-      let path7 = url2.toString();
+      let path8 = url2.toString();
       if (url2.protocol == "file:") {
-        path7 = fileURLToPath3(url2);
+        path8 = fileURLToPath3(url2);
       }
-      return fs4.promises.readFile(path7, "utf8");
+      return fs4.promises.readFile(path8, "utf8");
     }
   };
 });
@@ -270906,9 +271048,9 @@ var init_preaggregation_classifier = __esm(() => {
 
 // src/service/preaggregation_synthesis.ts
 import { Annotations as Annotations3 } from "@malloydata/malloy";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function grainDigest(grainDimensions) {
-  return createHash2("sha256").update(grainDimensions.join("\x00")).digest("hex").slice(0, 8);
+  return createHash4("sha256").update(grainDimensions.join("\x00")).digest("hex").slice(0, 8);
 }
 function rollupSourceName(baseSourceName, grainDimensions) {
   const slug = grainDimensions.join("_").replace(/\./g, "_").slice(0, NAME_SLUG_LIMIT);
@@ -271265,6 +271407,10 @@ function serveShapeFragment(binding) {
       lines.push(`   ${r.kind}: ${r.name} is ${r.code}`);
     }
   }
+  for (const r of refinements) {
+    if (r.kind === "filter")
+      lines.push(`   where: ${r.code}`);
+  }
   for (const r of refinements) {
     if (r.kind === "view")
       lines.push(`   view: ${r.text}`);
@@ -271303,6 +271449,22 @@ ${fragments}
 `
   };
 }
+function buildServeShapeTiers(rollupGroups) {
+  const always = [...NEVER_THINNED];
+  const keepKinds = [
+    new Set([...always, "join", "dimension", "measure", "view"]),
+    new Set([...always, "join", "dimension", "measure"]),
+    new Set([...always, "dimension", "measure"]),
+    new Set(always)
+  ];
+  const hasGroups = rollupGroups.length > 0;
+  return [
+    { keep: keepKinds[0], groups: rollupGroups },
+    ...hasGroups ? [{ keep: keepKinds[0], groups: [] }] : [],
+    ...keepKinds.slice(1).map((keep) => ({ keep, groups: rollupGroups })),
+    ...hasGroups ? [{ keep: new Set(always), groups: [] }] : []
+  ];
+}
 function rollupServeShapeFragment(group) {
   const members = group.members.map(serveShapeFragment).join(`
 `);
@@ -271405,6 +271567,17 @@ function narrowSchemaToPublic(schema, fields) {
   }
   return out;
 }
+function extractSourceFilters(filterList) {
+  const out = [];
+  for (const entry of filterList ?? []) {
+    const code = entry?.code;
+    out.push({
+      kind: "filter",
+      code: typeof code === "string" ? code : UNREPRODUCIBLE_FILTER
+    });
+  }
+  return out;
+}
 function extractRefinements(fields) {
   const out = [];
   for (const field of fields ?? []) {
@@ -271517,13 +271690,14 @@ async function assertServesInDuckDB(sourceName, binding, connections) {
     });
   }
 }
-var BARE_IDENTIFIER;
+var BARE_IDENTIFIER, NEVER_THINNED, UNREPRODUCIBLE_FILTER = "__unreproducible_filter__";
 var init_materialization_serve_transform = __esm(() => {
   init_errors();
   init_logger();
   init_materialization_metrics();
   init_quoting();
   BARE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  NEVER_THINNED = ["filter"];
 });
 
 // src/service/freshness.ts
@@ -271571,16 +271745,16 @@ import {
   isJoined,
   isSourceDef as isSourceDef3
 } from "@malloydata/malloy";
-function resolveFieldUsagePath(struct, path7) {
+function resolveFieldUsagePath(struct, path8) {
   let current = struct;
-  for (let i = 0;i < path7.length - 1; i++) {
-    const seg = path7[i];
+  for (let i = 0;i < path8.length - 1; i++) {
+    const seg = path8[i];
     const joinField = (current.fields ?? []).find((f) => (f.as || f.name) === seg && isJoined(f) && (isSourceDef3(f) || f.type === "record" || f.type === "array"));
     if (!joinField)
       return;
     current = joinField;
   }
-  const leaf = path7[path7.length - 1];
+  const leaf = path8[path8.length - 1];
   const field = (current.fields ?? []).find((f) => (f.as || f.name) === leaf);
   return field ? { struct: current, field } : undefined;
 }
@@ -272677,15 +272851,15 @@ __export(exports_preaggregation_compile, {
   synthesizedModelURL: () => synthesizedModelURL,
   compileSynthesizedPreaggregation: () => compileSynthesizedPreaggregation
 });
-import * as path7 from "path";
+import * as path8 from "path";
 function synthesizedModelURL(packagePath, modelPath) {
-  return new URL(`file://${path7.join(packagePath, modelPath)}${SYNTHESIZED_SUFFIX}`);
+  return new URL(`file://${path8.join(packagePath, modelPath)}${SYNTHESIZED_SUFFIX}`);
 }
 async function compileSynthesizedPreaggregation(args) {
   const plans = planModelPreaggregation(args.contents);
   if (plans.length === 0)
     return;
-  const text = synthesizePreaggregationModel(plans, path7.basename(args.modelPath));
+  const text = synthesizePreaggregationModel(plans, path8.basename(args.modelPath));
   if (!text)
     return;
   const synthesizedURL = synthesizedModelURL(args.packagePath, args.modelPath);
@@ -274020,9 +274194,9 @@ import {
   MalloySQLStatementType
 } from "@malloydata/malloy-sql";
 import * as fs6 from "fs/promises";
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import * as path8 from "path";
+import * as path9 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function quoteMalloyIdentifier2(name) {
   return "`" + (name ?? "").replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
@@ -275293,22 +275467,11 @@ var init_model = __esm(() => {
       const rollupPaths = [
         ...buildVirtualMap(groups.flatMap((g) => g.members))
       ].flatMap(([, byHandle]) => [...byHandle.values()]);
-      const origin2 = rollupPaths.some((path9) => probeSQL.includes(path9)) ? "preaggregate" : "persist";
+      const origin2 = rollupPaths.some((path10) => probeSQL.includes(path10)) ? "preaggregate" : "persist";
       return { runnable, virtualMap, bindings: freshBindings, origin: origin2 };
     }
-    async compileServeShape(enriched, rollupGroups = []) {
-      const keepKinds = [
-        new Set(["join", "dimension", "measure", "view"]),
-        new Set(["join", "dimension", "measure"]),
-        new Set(["dimension", "measure"]),
-        new Set
-      ];
-      const tiers = [
-        { keep: keepKinds[0], groups: rollupGroups },
-        ...rollupGroups.length > 0 ? [{ keep: keepKinds[0], groups: [] }] : [],
-        ...keepKinds.slice(1).map((keep) => ({ keep, groups: rollupGroups })),
-        ...rollupGroups.length > 0 ? [{ keep: new Set, groups: [] }] : []
-      ];
+    async compileServeShape(enriched, rollupGroups = [], isRetry = false) {
+      const tiers = buildServeShapeTiers(rollupGroups);
       const nothingToEscalate = rollupGroups.length === 0 && !enriched.some((b) => (b.refinements ?? []).length > 0);
       const lastTier = tiers.length - 1;
       for (let tier = 0;tier <= lastTier; tier++) {
@@ -275318,7 +275481,32 @@ var init_model = __esm(() => {
           refinements: b.refinements.filter((r) => keep.has(r.kind))
         } : b);
         const materializer = this.buildServeShapeMaterializer(shaped, groups);
-        if (tier === lastTier || tier === 0 && nothingToEscalate) {
+        if (tier === lastTier) {
+          try {
+            await materializer.getModel();
+            return materializer;
+          } catch (err) {
+            if (isRetry)
+              return materializer;
+            const servable = await this.bindingsWhoseFiltersCompile(enriched, keep);
+            const withheld = enriched.filter((b) => !servable.includes(b)).map((b) => b.sourceName);
+            if (servable.length === 0 || withheld.length === 0) {
+              logger.warn("Storage serve shape failed at its floor and no binding could be isolated; serving live", {
+                model: this.modelPath,
+                error: err instanceof Error ? err.message : String(err)
+              });
+              return materializer;
+            }
+            logger.warn("Withheld storage serve bindings whose filters cannot be reproduced; those sources serve live", {
+              model: this.modelPath,
+              withheld,
+              stillServed: servable.map((b) => b.sourceName),
+              error: err instanceof Error ? err.message : String(err)
+            });
+            return await this.compileServeShape(servable, rollupGroups, true);
+          }
+        }
+        if (tier === 0 && nothingToEscalate) {
           return materializer;
         }
         try {
@@ -275333,7 +275521,25 @@ var init_model = __esm(() => {
           });
         }
       }
-      return this.buildServeShapeMaterializer(enriched.map((b) => ({ ...b, refinements: [] })), []);
+      const floor = tiers[tiers.length - 1].keep;
+      return this.buildServeShapeMaterializer(enriched.map((b) => ({
+        ...b,
+        refinements: (b.refinements ?? []).filter((r) => floor.has(r.kind))
+      })), []);
+    }
+    async bindingsWhoseFiltersCompile(enriched, floorKeep) {
+      const servable = [];
+      for (const binding of enriched) {
+        const floored = {
+          ...binding,
+          refinements: (binding.refinements ?? []).filter((r) => floorKeep.has(r.kind))
+        };
+        try {
+          await this.buildServeShapeMaterializer([floored], []).getModel();
+          servable.push(binding);
+        } catch {}
+      }
+      return servable;
     }
     buildServeShapeMaterializer(bindings, rollupGroups = []) {
       const { modelText } = buildServeShapeModelForBindings(bindings, rollupGroups);
@@ -275365,7 +275571,7 @@ var init_model = __esm(() => {
           return;
         if (!fileCache.has(location.url)) {
           try {
-            fileCache.set(location.url, readFileSync(fileURLToPath5(location.url), "utf8"));
+            fileCache.set(location.url, readFileSync2(fileURLToPath5(location.url), "utf8"));
           } catch {
             fileCache.set(location.url, null);
           }
@@ -275383,6 +275589,7 @@ var init_model = __esm(() => {
             liftText
           }),
           ...extractRefinements(fields),
+          ...extractSourceFilters(contents?.[b.sourceName]?.filterList),
           ...extractViews(fields, liftText)
         ];
         return { ...b, schema, refinements };
@@ -276107,7 +276314,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
       return this.modelType;
     }
     async getFileText(packagePath) {
-      const fullPath = path8.join(packagePath, this.modelPath);
+      const fullPath = path9.join(packagePath, this.modelPath);
       try {
         return await fs6.readFile(fullPath, "utf8");
       } catch {
@@ -276339,14 +276546,14 @@ var require_brace_expansion = __commonJS((exports, module) => {
 var require_minimatch = __commonJS((exports, module) => {
   module.exports = minimatch;
   minimatch.Minimatch = Minimatch;
-  var path9 = function() {
+  var path10 = function() {
     try {
       return __require("path");
     } catch (e) {}
   }() || {
     sep: "/"
   };
-  minimatch.sep = path9.sep;
+  minimatch.sep = path10.sep;
   var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {};
   var expand = require_brace_expansion();
   var plTypes = {
@@ -276437,8 +276644,8 @@ var require_minimatch = __commonJS((exports, module) => {
     if (!options)
       options = {};
     pattern = pattern.trim();
-    if (!options.allowWindowsEscape && path9.sep !== "/") {
-      pattern = pattern.split(path9.sep).join("/");
+    if (!options.allowWindowsEscape && path10.sep !== "/") {
+      pattern = pattern.split(path10.sep).join("/");
     }
     this.options = options;
     this.set = [];
@@ -276815,8 +277022,8 @@ var require_minimatch = __commonJS((exports, module) => {
     if (f === "/" && partial)
       return true;
     var options = this.options;
-    if (path9.sep !== "/") {
-      f = f.split(path9.sep).join("/");
+    if (path10.sep !== "/") {
+      f = f.split(path10.sep).join("/");
     }
     f = f.split(slashSplit);
     this.debug(this.pattern, "split", f);
@@ -276927,9 +277134,9 @@ var require_recursive_readdir = __commonJS((exports, module) => {
   var p = __require("path");
   var minimatch = require_minimatch();
   function patternMatcher(pattern) {
-    return function(path9, stats) {
+    return function(path10, stats) {
       var minimatcher = new minimatch.Minimatch(pattern, { matchBase: true });
-      return (!minimatcher.negate || stats.isFile()) && minimatcher.match(path9);
+      return (!minimatcher.negate || stats.isFile()) && minimatcher.match(path10);
     };
   }
   function toMatcherFunction(ignoreEntry) {
@@ -276939,14 +277146,14 @@ var require_recursive_readdir = __commonJS((exports, module) => {
       return patternMatcher(ignoreEntry);
     }
   }
-  function readdir3(path9, ignores, callback) {
+  function readdir3(path10, ignores, callback) {
     if (typeof ignores == "function") {
       callback = ignores;
       ignores = [];
     }
     if (!callback) {
       return new Promise(function(resolve4, reject2) {
-        readdir3(path9, ignores || [], function(err, data) {
+        readdir3(path10, ignores || [], function(err, data) {
           if (err) {
             reject2(err);
           } else {
@@ -276957,7 +277164,7 @@ var require_recursive_readdir = __commonJS((exports, module) => {
     }
     ignores = ignores.map(toMatcherFunction);
     var list = [];
-    fs7.readdir(path9, function(err, files) {
+    fs7.readdir(path10, function(err, files) {
       if (err) {
         return callback(err);
       }
@@ -276966,7 +277173,7 @@ var require_recursive_readdir = __commonJS((exports, module) => {
         return callback(null, list);
       }
       files.forEach(function(file) {
-        var filePath = p.join(path9, file);
+        var filePath = p.join(path10, file);
         fs7.stat(filePath, function(_err, stats) {
           if (_err) {
             return callback(_err);
@@ -283385,8 +283592,8 @@ var require_CronFileParser = __commonJS((exports) => {
       return CronFileParser.#parseContent(data);
     }
     static parseFileSync(filePath) {
-      const { readFileSync: readFileSync2 } = __require("fs");
-      const data = readFileSync2(filePath, "utf8");
+      const { readFileSync: readFileSync3 } = __require("fs");
+      const data = readFileSync3(filePath, "utf8");
       return CronFileParser.#parseContent(data);
     }
     static #parseContent(data) {
@@ -284284,8 +284491,8 @@ var require_uri_all = __commonJS((exports, module) => {
           wsComponents.secure = undefined;
         }
         if (wsComponents.resourceName) {
-          var _wsComponents$resourc = wsComponents.resourceName.split("?"), _wsComponents$resourc2 = slicedToArray(_wsComponents$resourc, 2), path13 = _wsComponents$resourc2[0], query = _wsComponents$resourc2[1];
-          wsComponents.path = path13 && path13 !== "/" ? path13 : undefined;
+          var _wsComponents$resourc = wsComponents.resourceName.split("?"), _wsComponents$resourc2 = slicedToArray(_wsComponents$resourc, 2), path14 = _wsComponents$resourc2[0], query = _wsComponents$resourc2[1];
+          wsComponents.path = path14 && path14 !== "/" ? path14 : undefined;
           wsComponents.query = query;
           wsComponents.resourceName = undefined;
         }
@@ -284678,12 +284885,12 @@ var require_util12 = __commonJS((exports, module) => {
     return "'" + escapeQuotes(str) + "'";
   }
   function getPathExpr(currentPath, expr, jsonPointers, isNumber2) {
-    var path13 = jsonPointers ? "'/' + " + expr + (isNumber2 ? "" : ".replace(/~/g, '~0').replace(/\\//g, '~1')") : isNumber2 ? "'[' + " + expr + " + ']'" : "'[\\'' + " + expr + " + '\\']'";
-    return joinPaths(currentPath, path13);
+    var path14 = jsonPointers ? "'/' + " + expr + (isNumber2 ? "" : ".replace(/~/g, '~0').replace(/\\//g, '~1')") : isNumber2 ? "'[' + " + expr + " + ']'" : "'[\\'' + " + expr + " + '\\']'";
+    return joinPaths(currentPath, path14);
   }
   function getPath(currentPath, prop, jsonPointers) {
-    var path13 = jsonPointers ? toQuotedString("/" + escapeJsonPointer(prop)) : toQuotedString(getProperty(prop));
-    return joinPaths(currentPath, path13);
+    var path14 = jsonPointers ? toQuotedString("/" + escapeJsonPointer(prop)) : toQuotedString(getProperty(prop));
+    return joinPaths(currentPath, path14);
   }
   var JSON_POINTER = /^\/(?:[^~]|~0|~1)*$/;
   var RELATIVE_JSON_POINTER = /^([0-9]+)(#|\/(?:[^~]|~0|~1)*)?$/;
@@ -296286,7 +296493,7 @@ var import_cors = __toESM(require_lib6(), 1);
 var import_express = __toESM(require_express(), 1);
 var import_http_proxy_middleware = __toESM(require_dist4(), 1);
 import * as http2 from "http";
-import * as path15 from "path";
+import * as path16 from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 
 // src/controller/compile.controller.ts
@@ -296312,6 +296519,7 @@ init_config();
 init_errors();
 init_query_cap_metrics();
 init_logger();
+init_path_safety();
 
 // src/query_timeout.ts
 init_telemetry();
@@ -296571,19 +296779,19 @@ function withoutWithheldFields(value) {
 }
 function flattenWithheld(hidden, prefix, out) {
   for (const [key, value] of Object.entries(hidden)) {
-    const path4 = prefix ? `${prefix}.${key}` : key;
+    const path5 = prefix ? `${prefix}.${key}` : key;
     if (Array.isArray(value)) {
       for (const item of value) {
         if (!isPlainObject2(item))
           continue;
         const { name, ...rest } = item;
-        const label = typeof name === "string" ? `${path4}.${name}` : path4;
+        const label = typeof name === "string" ? `${path5}.${name}` : path5;
         flattenWithheld(rest, label, out);
       }
     } else if (isPlainObject2(value)) {
-      flattenWithheld(value, path4, out);
+      flattenWithheld(value, path5, out);
     } else if (value !== undefined && value !== null && value !== "") {
-      out.push(path4);
+      out.push(path5);
     }
   }
 }
@@ -296684,22 +296892,22 @@ function isSupplied(value) {
     return Object.keys(value).length > 0;
   return true;
 }
-function suppliedAt(patch, path4) {
-  const dot = path4.indexOf(".");
+function suppliedAt(patch, path5) {
+  const dot = path5.indexOf(".");
   if (dot === -1) {
-    return Object.hasOwn(patch, path4) && isSupplied(patch[path4]);
+    return Object.hasOwn(patch, path5) && isSupplied(patch[path5]);
   }
-  const parent = patch[path4.slice(0, dot)];
+  const parent = patch[path5.slice(0, dot)];
   if (!isPlainObject2(parent))
     return false;
-  const leaf = path4.slice(dot + 1);
+  const leaf = path5.slice(dot + 1);
   return Object.hasOwn(parent, leaf) && isSupplied(parent[leaf]);
 }
 function exclusionsFor(patch) {
   const skip = new Set;
   for (const slots of EXCLUSIVE_SLOTS) {
     const declared = slots.filter((slot) => slot.fields.some((field) => isPlainObject2(patch[field])));
-    const selected = declared.length === 1 ? declared : slots.filter((slot) => slot.selects.some((path4) => suppliedAt(patch, path4)));
+    const selected = declared.length === 1 ? declared : slots.filter((slot) => slot.selects.some((path5) => suppliedAt(patch, path5)));
     if (selected.length !== 1)
       continue;
     for (const slot of slots) {
@@ -298227,12 +298435,15 @@ class ConnectionController {
     if (!connectionConfig.type || typeof connectionConfig.type !== "string") {
       throw new BadRequestError("Connection type is required and must be a string");
     }
+    if ((connectionConfig.type === "duckdb" || connectionConfig.type === "ducklake") && connectionConfig.name) {
+      assertSafePackageName(connectionConfig.name);
+    }
     try {
       return await testConnectionConfig(connectionConfig);
     } catch (error) {
       return {
         status: "failed",
-        errorMessage: `Connection test failed: ${error.message}`
+        errorMessage: redactPgSecrets(`Connection test failed: ${error instanceof Error ? error.message : String(error)}`)
       };
     }
   }
@@ -298277,6 +298488,48 @@ class ConnectionController {
 
 // src/controller/dashboard.controller.ts
 init_errors();
+import { createHash as createHash2 } from "node:crypto";
+
+// src/dashboard_write_metrics.ts
+init_telemetry();
+var resetHooks2 = [];
+function lazyCounter2(name, description) {
+  let instrument2 = null;
+  resetHooks2.push(() => instrument2 = null);
+  return () => instrument2 ??= publisherMeter().createCounter(name, { description });
+}
+function lazyHistogram(name, description, unit) {
+  let instrument2 = null;
+  resetHooks2.push(() => instrument2 = null);
+  return () => instrument2 ??= publisherMeter().createHistogram(name, {
+    description,
+    unit
+  });
+}
+var writeCounter = lazyCounter2("publisher_dashboard_writes_total", "Dashboard write attempts. Label: outcome ('created'|'replaced'|'conflict'|'compile_failed'|'refused'|'rolled_back').");
+var writeDuration = lazyHistogram("publisher_dashboard_write_duration_ms", "Wall-clock duration of a dashboard write, compile and package reload included. Label: outcome.", "ms");
+function recordDashboardWrite(outcome, durationMs) {
+  writeCounter().add(1, { outcome });
+  writeDuration().record(durationMs, { outcome });
+}
+
+// src/controller/dashboard.controller.ts
+init_path_safety();
+function outcomeOf(error) {
+  if (error instanceof WriteConflictError)
+    return "conflict";
+  if (error instanceof CompileRefusedError)
+    return "compile_failed";
+  if (error instanceof WriteRolledBackError)
+    return "rolled_back";
+  return "refused";
+}
+var DASHBOARD_FILE = /^dashboards\/[^/]+\.malloy$/;
+var describeProblem = (problem) => {
+  const start = problem.at?.range?.start;
+  return start?.line === undefined ? problem.message : `line ${start.line + 1}:${(start.character ?? 0) + 1} ${problem.message}`;
+};
+var contentHashOf = (text) => createHash2("sha256").update(text, "utf8").digest("hex");
 
 class DashboardController {
   environmentStore;
@@ -298297,6 +298550,57 @@ class DashboardController {
     }
     return dashboard;
   }
+  async putDashboardSource(environmentName, packageName, modelPath, body) {
+    const startedAt = Date.now();
+    try {
+      const result = await this.writeDashboardSource(environmentName, packageName, modelPath, body);
+      recordDashboardWrite(result.created ? "created" : "replaced", Date.now() - startedAt);
+      return result;
+    } catch (error) {
+      recordDashboardWrite(outcomeOf(error), Date.now() - startedAt);
+      throw error;
+    }
+  }
+  async writeDashboardSource(environmentName, packageName, modelPath, body) {
+    if (this.environmentStore.publisherConfigIsFrozen) {
+      throw new FrozenConfigError('Cannot write a dashboard: publisher.config.json has "frozenConfig": true.');
+    }
+    assertSafeRelativeModelPath(modelPath);
+    if (!DASHBOARD_FILE.test(modelPath)) {
+      throw new BadRequestError(`Only a dashboard file can be written here: \`dashboards/<slug>.malloy\`, ` + `not \`${modelPath}\`.`);
+    }
+    if (typeof body?.source !== "string") {
+      throw new BadRequestError("The request body needs a `source`: the whole file's Malloy text.");
+    }
+    const environment = await this.environmentStore.getEnvironment(environmentName, false);
+    await environment.getPackage(packageName, false);
+    const { problems } = await environment.compileSource(packageName, modelPath, body.source, false, undefined, "file");
+    const errors2 = problems.filter((problem) => problem.severity === "error");
+    if (errors2.length > 0) {
+      throw new CompileRefusedError(`The dashboard does not compile, so it was not written: ` + errors2.map(describeProblem).join("; "));
+    }
+    const { previous } = await environment.writeModelFileTransactional(packageName, modelPath, body.source, (current) => {
+      if (body.expectedHash === undefined) {
+        if (current !== undefined)
+          throw new WriteConflictError(`\`${modelPath}\` already exists in the package. Send the ` + `\`expectedHash\` of the text you opened to replace it.`);
+        return;
+      }
+      const currentHash = current === undefined ? undefined : contentHashOf(current);
+      if (currentHash !== body.expectedHash)
+        throw new WriteConflictError(current === undefined ? `\`${modelPath}\` no longer exists in the package, so the text you ` + `opened cannot be updated. Re-open it before saving.` : `\`${modelPath}\` changed in the package since you opened it. ` + `Re-open it and reapply your change; nothing was written.`);
+    }, async (reloaded) => {
+      const written = reloaded.getModel(modelPath);
+      if (!written)
+        throw new Error(`\`${modelPath}\` is not in the reloaded package`);
+      await written.getModel();
+    });
+    return {
+      resource: `/api/v0/environments/${environmentName}/packages/${packageName}/models/${modelPath}`,
+      path: modelPath,
+      contentHash: contentHashOf(body.source),
+      created: previous === undefined
+    };
+  }
 }
 
 // src/controller/database.controller.ts
@@ -298408,7 +298712,7 @@ class ModelController {
 init_constants();
 init_errors();
 init_logger();
-import * as path4 from "path";
+import * as path5 from "path";
 
 // src/mcp/tools/get_context_tool.ts
 var import_lunr = __toESM(require_lunr(), 1);
@@ -298743,22 +299047,22 @@ async function getModelForQuery(environmentStore, environmentName, packageName,
   }
 }
 function buildMalloyUri(components, fragment) {
-  let path4 = "/environment/";
+  let path5 = "/environment/";
   if (components.environment) {
-    path4 += encodeURIComponent(components.environment);
+    path5 += encodeURIComponent(components.environment);
   } else {
-    path4 += "home";
+    path5 += "home";
   }
   if (components.package) {
-    path4 += "/package/" + encodeURIComponent(components.package);
+    path5 += "/package/" + encodeURIComponent(components.package);
   }
   if (components.resourceType) {
-    path4 += "/" + components.resourceType;
+    path5 += "/" + components.resourceType;
     if (components.resourceName) {
-      path4 += "/" + encodeURIComponent(components.resourceName);
+      path5 += "/" + encodeURIComponent(components.resourceName);
     }
   }
-  let uriString = "malloy:/" + path4;
+  let uriString = "malloy:/" + path5;
   if (fragment) {
     uriString += "#" + fragment;
   }
@@ -298809,7 +299113,7 @@ function jsonToolError(uri, details, extraPayload) {
 init_logger();
 
 // src/mcp/tools/embedding_index.ts
-import { createHash } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // ../../node_modules/async-mutex/index.mjs
 var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
@@ -299216,7 +299520,7 @@ function splitToFit(text, max) {
   return pieces;
 }
 function contentHash(text) {
-  return createHash("sha256").update(text).digest("hex");
+  return createHash3("sha256").update(text).digest("hex");
 }
 function sourceColumn(source) {
   return source ?? "";
@@ -300800,7 +301104,7 @@ class PackageController {
     } else if (packageLocation.startsWith("s3://")) {
       await this.environmentStore.downloadS3Directory(packageLocation, environmentName, targetPath, isCompressedFile);
     }
-    if (packageLocation.startsWith("/") || path4.isAbsolute(packageLocation)) {
+    if (packageLocation.startsWith("/") || path5.isAbsolute(packageLocation)) {
       await this.environmentStore.mountLocalDirectory(packageLocation, targetPath, environmentName, packageName);
     }
   }
@@ -300958,7 +301262,7 @@ class ReaddirpStream extends Readable2 {
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
     const statMethod = opts.lstat ? lstat : stat;
     if (wantBigintFsStats) {
-      this._stat = (path5) => statMethod(path5, { bigint: true });
+      this._stat = (path6) => statMethod(path6, { bigint: true });
     } else {
       this._stat = statMethod;
     }
@@ -300983,8 +301287,8 @@ class ReaddirpStream extends Readable2 {
         const par = this.parent;
         const fil = par && par.files;
         if (fil && fil.length > 0) {
-          const { path: path5, depth } = par;
-          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path5));
+          const { path: path6, depth } = par;
+          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path6));
           const awaited = await Promise.all(slice);
           for (const entry of awaited) {
             if (!entry)
@@ -301024,20 +301328,20 @@ class ReaddirpStream extends Readable2 {
       this.reading = false;
     }
   }
-  async _exploreDir(path5, depth) {
+  async _exploreDir(path6, depth) {
     let files;
     try {
-      files = await readdir(path5, this._rdOptions);
+      files = await readdir(path6, this._rdOptions);
     } catch (error) {
       this._onError(error);
     }
-    return { files, depth, path: path5 };
+    return { files, depth, path: path6 };
   }
-  async _formatEntry(dirent, path5) {
+  async _formatEntry(dirent, path6) {
     let entry;
     const basename = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path5, basename));
+      const fullPath = presolve(pjoin(path6, basename));
       entry = { path: prelative(this._root, fullPath), fullPath, basename };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
@@ -301436,16 +301740,16 @@ var delFromSet = (main, prop, item) => {
 };
 var isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
 var FsWatchInstances = new Map;
-function createFsWatchInstance(path5, options, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path6, options, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path5);
-    emitRaw(rawEvent, evPath, { watchedPath: path5 });
-    if (evPath && path5 !== evPath) {
-      fsWatchBroadcast(sysPath.resolve(path5, evPath), KEY_LISTENERS, sysPath.join(path5, evPath));
+    listener(path6);
+    emitRaw(rawEvent, evPath, { watchedPath: path6 });
+    if (evPath && path6 !== evPath) {
+      fsWatchBroadcast(sysPath.resolve(path6, evPath), KEY_LISTENERS, sysPath.join(path6, evPath));
     }
   };
   try {
-    return fs_watch(path5, {
+    return fs_watch(path6, {
       persistent: options.persistent
     }, handleEvent);
   } catch (error) {
@@ -301461,12 +301765,12 @@ var fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
     listener(val1, val2, val3);
   });
 };
-var setFsWatchListener = (path5, fullPath, options, handlers) => {
+var setFsWatchListener = (path6, fullPath, options, handlers) => {
   const { listener, errHandler, rawEmitter } = handlers;
   let cont = FsWatchInstances.get(fullPath);
   let watcher;
   if (!options.persistent) {
-    watcher = createFsWatchInstance(path5, options, listener, errHandler, rawEmitter);
+    watcher = createFsWatchInstance(path6, options, listener, errHandler, rawEmitter);
     if (!watcher)
       return;
     return watcher.close.bind(watcher);
@@ -301476,7 +301780,7 @@ var setFsWatchListener = (path5, fullPath, options, handlers) => {
     addAndConvert(cont, KEY_ERR, errHandler);
     addAndConvert(cont, KEY_RAW, rawEmitter);
   } else {
-    watcher = createFsWatchInstance(path5, options, fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS), errHandler, fsWatchBroadcast.bind(null, fullPath, KEY_RAW));
+    watcher = createFsWatchInstance(path6, options, fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS), errHandler, fsWatchBroadcast.bind(null, fullPath, KEY_RAW));
     if (!watcher)
       return;
     watcher.on(EV.ERROR, async (error) => {
@@ -301485,7 +301789,7 @@ var setFsWatchListener = (path5, fullPath, options, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows && error.code === "EPERM") {
         try {
-          const fd = await open(path5, "r");
+          const fd = await open(path6, "r");
           await fd.close();
           broadcastErr(error);
         } catch (err) {}
@@ -301515,7 +301819,7 @@ var setFsWatchListener = (path5, fullPath, options, handlers) => {
   };
 };
 var FsWatchFileInstances = new Map;
-var setFsWatchFileListener = (path5, fullPath, options, handlers) => {
+var setFsWatchFileListener = (path6, fullPath, options, handlers) => {
   const { listener, rawEmitter } = handlers;
   let cont = FsWatchFileInstances.get(fullPath);
   const copts = cont && cont.options;
@@ -301537,7 +301841,7 @@ var setFsWatchFileListener = (path5, fullPath, options, handlers) => {
         });
         const currmtime = curr.mtimeMs;
         if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-          foreach(cont.listeners, (listener2) => listener2(path5, curr));
+          foreach(cont.listeners, (listener2) => listener2(path6, curr));
         }
       })
     };
@@ -301560,13 +301864,13 @@ class NodeFsHandler {
     this.fsw = fsW;
     this._boundHandleError = (error) => fsW._handleError(error);
   }
-  _watchWithNodeFs(path5, listener) {
+  _watchWithNodeFs(path6, listener) {
     const opts = this.fsw.options;
-    const directory = sysPath.dirname(path5);
-    const basename2 = sysPath.basename(path5);
+    const directory = sysPath.dirname(path6);
+    const basename2 = sysPath.basename(path6);
     const parent = this.fsw._getWatchedDir(directory);
     parent.add(basename2);
-    const absolutePath = sysPath.resolve(path5);
+    const absolutePath = sysPath.resolve(path6);
     const options = {
       persistent: opts.persistent
     };
@@ -301576,12 +301880,12 @@ class NodeFsHandler {
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
       options.interval = enableBin && isBinaryPath(basename2) ? opts.binaryInterval : opts.interval;
-      closer = setFsWatchFileListener(path5, absolutePath, options, {
+      closer = setFsWatchFileListener(path6, absolutePath, options, {
         listener,
         rawEmitter: this.fsw._emitRaw
       });
     } else {
-      closer = setFsWatchListener(path5, absolutePath, options, {
+      closer = setFsWatchListener(path6, absolutePath, options, {
         listener,
         errHandler: this._boundHandleError,
         rawEmitter: this.fsw._emitRaw
@@ -301599,7 +301903,7 @@ class NodeFsHandler {
     let prevStats = stats;
     if (parent.has(basename2))
       return;
-    const listener = async (path5, newStats) => {
+    const listener = async (path6, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
         return;
       if (!newStats || newStats.mtimeMs === 0) {
@@ -301613,11 +301917,11 @@ class NodeFsHandler {
             this.fsw._emit(EV.CHANGE, file, newStats2);
           }
           if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-            this.fsw._closeFile(path5);
+            this.fsw._closeFile(path6);
             prevStats = newStats2;
             const closer2 = this._watchWithNodeFs(file, listener);
             if (closer2)
-              this.fsw._addPathCloser(path5, closer2);
+              this.fsw._addPathCloser(path6, closer2);
           } else {
             prevStats = newStats2;
           }
@@ -301641,7 +301945,7 @@ class NodeFsHandler {
     }
     return closer;
   }
-  async _handleSymlink(entry, directory, path5, item) {
+  async _handleSymlink(entry, directory, path6, item) {
     if (this.fsw.closed) {
       return;
     }
@@ -301651,7 +301955,7 @@ class NodeFsHandler {
       this.fsw._incrReadyCount();
       let linkPath;
       try {
-        linkPath = await fsrealpath(path5);
+        linkPath = await fsrealpath(path6);
       } catch (e) {
         this.fsw._emitReady();
         return true;
@@ -301661,12 +301965,12 @@ class NodeFsHandler {
       if (dir.has(item)) {
         if (this.fsw._symlinkPaths.get(full) !== linkPath) {
           this.fsw._symlinkPaths.set(full, linkPath);
-          this.fsw._emit(EV.CHANGE, path5, entry.stats);
+          this.fsw._emit(EV.CHANGE, path6, entry.stats);
         }
       } else {
         dir.add(item);
         this.fsw._symlinkPaths.set(full, linkPath);
-        this.fsw._emit(EV.ADD, path5, entry.stats);
+        this.fsw._emit(EV.ADD, path6, entry.stats);
       }
       this.fsw._emitReady();
       return true;
@@ -301695,9 +301999,9 @@ class NodeFsHandler {
         return;
       }
       const item = entry.path;
-      let path5 = sysPath.join(directory, item);
+      let path6 = sysPath.join(directory, item);
       current.add(item);
-      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path5, item)) {
+      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path6, item)) {
         return;
       }
       if (this.fsw.closed) {
@@ -301706,8 +302010,8 @@ class NodeFsHandler {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path5 = sysPath.join(dir, sysPath.relative(dir, path5));
-        this._addToNodeFs(path5, initialAdd, wh, depth + 1);
+        path6 = sysPath.join(dir, sysPath.relative(dir, path6));
+        this._addToNodeFs(path6, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
     return new Promise((resolve3, reject) => {
@@ -301756,13 +302060,13 @@ class NodeFsHandler {
     }
     return closer;
   }
-  async _addToNodeFs(path5, initialAdd, priorWh, depth, target) {
+  async _addToNodeFs(path6, initialAdd, priorWh, depth, target) {
     const ready = this.fsw._emitReady;
-    if (this.fsw._isIgnored(path5) || this.fsw.closed) {
+    if (this.fsw._isIgnored(path6) || this.fsw.closed) {
       ready();
       return false;
     }
-    const wh = this.fsw._getWatchHelpers(path5);
+    const wh = this.fsw._getWatchHelpers(path6);
     if (priorWh) {
       wh.filterPath = (entry) => priorWh.filterPath(entry);
       wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -301778,8 +302082,8 @@ class NodeFsHandler {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sysPath.resolve(path5);
-        const targetPath = follow ? await fsrealpath(path5) : path5;
+        const absPath = sysPath.resolve(path6);
+        const targetPath = follow ? await fsrealpath(path6) : path6;
         if (this.fsw.closed)
           return;
         closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -301789,29 +302093,29 @@ class NodeFsHandler {
           this.fsw._symlinkPaths.set(absPath, targetPath);
         }
       } else if (stats.isSymbolicLink()) {
-        const targetPath = follow ? await fsrealpath(path5) : path5;
+        const targetPath = follow ? await fsrealpath(path6) : path6;
         if (this.fsw.closed)
           return;
         const parent = sysPath.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
-        closer = await this._handleDir(parent, stats, initialAdd, depth, path5, wh, targetPath);
+        closer = await this._handleDir(parent, stats, initialAdd, depth, path6, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== undefined) {
-          this.fsw._symlinkPaths.set(sysPath.resolve(path5), targetPath);
+          this.fsw._symlinkPaths.set(sysPath.resolve(path6), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
       }
       ready();
       if (closer)
-        this.fsw._addPathCloser(path5, closer);
+        this.fsw._addPathCloser(path6, closer);
       return false;
     } catch (error) {
       if (this.fsw._handleError(error)) {
         ready();
-        return path5;
+        return path6;
       }
     }
   }
@@ -301855,26 +302159,26 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path5) {
-  if (typeof path5 !== "string")
+function normalizePath(path6) {
+  if (typeof path6 !== "string")
     throw new Error("string expected");
-  path5 = sysPath2.normalize(path5);
-  path5 = path5.replace(/\\/g, "/");
+  path6 = sysPath2.normalize(path6);
+  path6 = path6.replace(/\\/g, "/");
   let prepend = false;
-  if (path5.startsWith("//"))
+  if (path6.startsWith("//"))
     prepend = true;
   const DOUBLE_SLASH_RE2 = /\/\//;
-  while (path5.match(DOUBLE_SLASH_RE2))
-    path5 = path5.replace(DOUBLE_SLASH_RE2, "/");
+  while (path6.match(DOUBLE_SLASH_RE2))
+    path6 = path6.replace(DOUBLE_SLASH_RE2, "/");
   if (prepend)
-    path5 = "/" + path5;
-  return path5;
+    path6 = "/" + path6;
+  return path6;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path5 = normalizePath(testString);
+  const path6 = normalizePath(testString);
   for (let index = 0;index < patterns.length; index++) {
     const pattern = patterns[index];
-    if (pattern(path5, stats)) {
+    if (pattern(path6, stats)) {
       return true;
     }
   }
@@ -301914,19 +302218,19 @@ var toUnix = (string) => {
   }
   return str;
 };
-var normalizePathToUnix = (path5) => toUnix(sysPath2.normalize(toUnix(path5)));
-var normalizeIgnored = (cwd = "") => (path5) => {
-  if (typeof path5 === "string") {
-    return normalizePathToUnix(sysPath2.isAbsolute(path5) ? path5 : sysPath2.join(cwd, path5));
+var normalizePathToUnix = (path6) => toUnix(sysPath2.normalize(toUnix(path6)));
+var normalizeIgnored = (cwd = "") => (path6) => {
+  if (typeof path6 === "string") {
+    return normalizePathToUnix(sysPath2.isAbsolute(path6) ? path6 : sysPath2.join(cwd, path6));
   } else {
-    return path5;
+    return path6;
   }
 };
-var getAbsolutePath = (path5, cwd) => {
-  if (sysPath2.isAbsolute(path5)) {
-    return path5;
+var getAbsolutePath = (path6, cwd) => {
+  if (sysPath2.isAbsolute(path6)) {
+    return path6;
   }
-  return sysPath2.join(cwd, path5);
+  return sysPath2.join(cwd, path6);
 };
 var EMPTY_SET = Object.freeze(new Set);
 
@@ -301983,10 +302287,10 @@ var STAT_METHOD_F = "stat";
 var STAT_METHOD_L = "lstat";
 
 class WatchHelper {
-  constructor(path5, follow, fsw) {
+  constructor(path6, follow, fsw) {
     this.fsw = fsw;
-    const watchPath = path5;
-    this.path = path5 = path5.replace(REPLACER_RE, "");
+    const watchPath = path6;
+    this.path = path6 = path6.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
     this.fullWatchPath = sysPath2.resolve(watchPath);
     this.dirParts = [];
@@ -302099,20 +302403,20 @@ class FSWatcher extends EventEmitter2 {
     this._closePromise = undefined;
     let paths = unifyPaths(paths_);
     if (cwd) {
-      paths = paths.map((path5) => {
-        const absPath = getAbsolutePath(path5, cwd);
+      paths = paths.map((path6) => {
+        const absPath = getAbsolutePath(path6, cwd);
         return absPath;
       });
     }
-    paths.forEach((path5) => {
-      this._removeIgnoredPath(path5);
+    paths.forEach((path6) => {
+      this._removeIgnoredPath(path6);
     });
     this._userIgnored = undefined;
     if (!this._readyCount)
       this._readyCount = 0;
     this._readyCount += paths.length;
-    Promise.all(paths.map(async (path5) => {
-      const res = await this._nodeFsHandler._addToNodeFs(path5, !_internal, undefined, 0, _origAdd);
+    Promise.all(paths.map(async (path6) => {
+      const res = await this._nodeFsHandler._addToNodeFs(path6, !_internal, undefined, 0, _origAdd);
       if (res)
         this._emitReady();
       return res;
@@ -302131,17 +302435,17 @@ class FSWatcher extends EventEmitter2 {
       return this;
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
-    paths.forEach((path5) => {
-      if (!sysPath2.isAbsolute(path5) && !this._closers.has(path5)) {
+    paths.forEach((path6) => {
+      if (!sysPath2.isAbsolute(path6) && !this._closers.has(path6)) {
         if (cwd)
-          path5 = sysPath2.join(cwd, path5);
-        path5 = sysPath2.resolve(path5);
+          path6 = sysPath2.join(cwd, path6);
+        path6 = sysPath2.resolve(path6);
       }
-      this._closePath(path5);
-      this._addIgnoredPath(path5);
-      if (this._watched.has(path5)) {
+      this._closePath(path6);
+      this._addIgnoredPath(path6);
+      if (this._watched.has(path6)) {
         this._addIgnoredPath({
-          path: path5,
+          path: path6,
           recursive: true
         });
       }
@@ -302190,38 +302494,38 @@ class FSWatcher extends EventEmitter2 {
     if (event !== EVENTS.ERROR)
       this.emit(EVENTS.ALL, event, ...args);
   }
-  async _emit(event, path5, stats) {
+  async _emit(event, path6, stats) {
     if (this.closed)
       return;
     const opts = this.options;
     if (isWindows)
-      path5 = sysPath2.normalize(path5);
+      path6 = sysPath2.normalize(path6);
     if (opts.cwd)
-      path5 = sysPath2.relative(opts.cwd, path5);
-    const args = [path5];
+      path6 = sysPath2.relative(opts.cwd, path6);
+    const args = [path6];
     if (stats != null)
       args.push(stats);
     const awf = opts.awaitWriteFinish;
     let pw;
-    if (awf && (pw = this._pendingWrites.get(path5))) {
+    if (awf && (pw = this._pendingWrites.get(path6))) {
       pw.lastChange = new Date;
       return this;
     }
     if (opts.atomic) {
       if (event === EVENTS.UNLINK) {
-        this._pendingUnlinks.set(path5, [event, ...args]);
+        this._pendingUnlinks.set(path6, [event, ...args]);
         setTimeout(() => {
-          this._pendingUnlinks.forEach((entry, path6) => {
+          this._pendingUnlinks.forEach((entry, path7) => {
             this.emit(...entry);
             this.emit(EVENTS.ALL, ...entry);
-            this._pendingUnlinks.delete(path6);
+            this._pendingUnlinks.delete(path7);
           });
         }, typeof opts.atomic === "number" ? opts.atomic : 100);
         return this;
       }
-      if (event === EVENTS.ADD && this._pendingUnlinks.has(path5)) {
+      if (event === EVENTS.ADD && this._pendingUnlinks.has(path6)) {
         event = EVENTS.CHANGE;
-        this._pendingUnlinks.delete(path5);
+        this._pendingUnlinks.delete(path6);
       }
     }
     if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -302239,16 +302543,16 @@ class FSWatcher extends EventEmitter2 {
           this.emitWithAll(event, args);
         }
       };
-      this._awaitWriteFinish(path5, awf.stabilityThreshold, event, awfEmit);
+      this._awaitWriteFinish(path6, awf.stabilityThreshold, event, awfEmit);
       return this;
     }
     if (event === EVENTS.CHANGE) {
-      const isThrottled = !this._throttle(EVENTS.CHANGE, path5, 50);
+      const isThrottled = !this._throttle(EVENTS.CHANGE, path6, 50);
       if (isThrottled)
         return this;
     }
     if (opts.alwaysStat && stats === undefined && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path5) : path5;
+      const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path6) : path6;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -302267,23 +302571,23 @@ class FSWatcher extends EventEmitter2 {
     }
     return error || this.closed;
   }
-  _throttle(actionType, path5, timeout) {
+  _throttle(actionType, path6, timeout) {
     if (!this._throttled.has(actionType)) {
       this._throttled.set(actionType, new Map);
     }
     const action = this._throttled.get(actionType);
     if (!action)
       throw new Error("invalid throttle");
-    const actionPath = action.get(path5);
+    const actionPath = action.get(path6);
     if (actionPath) {
       actionPath.count++;
       return false;
     }
     let timeoutObject;
     const clear = () => {
-      const item = action.get(path5);
+      const item = action.get(path6);
       const count = item ? item.count : 0;
-      action.delete(path5);
+      action.delete(path6);
       clearTimeout(timeoutObject);
       if (item)
         clearTimeout(item.timeoutObject);
@@ -302291,50 +302595,50 @@ class FSWatcher extends EventEmitter2 {
     };
     timeoutObject = setTimeout(clear, timeout);
     const thr = { timeoutObject, clear, count: 0 };
-    action.set(path5, thr);
+    action.set(path6, thr);
     return thr;
   }
   _incrReadyCount() {
     return this._readyCount++;
   }
-  _awaitWriteFinish(path5, threshold, event, awfEmit) {
+  _awaitWriteFinish(path6, threshold, event, awfEmit) {
     const awf = this.options.awaitWriteFinish;
     if (typeof awf !== "object")
       return;
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
-    let fullPath = path5;
-    if (this.options.cwd && !sysPath2.isAbsolute(path5)) {
-      fullPath = sysPath2.join(this.options.cwd, path5);
+    let fullPath = path6;
+    if (this.options.cwd && !sysPath2.isAbsolute(path6)) {
+      fullPath = sysPath2.join(this.options.cwd, path6);
     }
     const now = new Date;
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
       statcb(fullPath, (err, curStat) => {
-        if (err || !writes.has(path5)) {
+        if (err || !writes.has(path6)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
           return;
         }
         const now2 = Number(new Date);
         if (prevStat && curStat.size !== prevStat.size) {
-          writes.get(path5).lastChange = now2;
+          writes.get(path6).lastChange = now2;
         }
-        const pw = writes.get(path5);
+        const pw = writes.get(path6);
         const df = now2 - pw.lastChange;
         if (df >= threshold) {
-          writes.delete(path5);
+          writes.delete(path6);
           awfEmit(undefined, curStat);
         } else {
           timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
         }
       });
     }
-    if (!writes.has(path5)) {
-      writes.set(path5, {
+    if (!writes.has(path6)) {
+      writes.set(path6, {
         lastChange: now,
         cancelWait: () => {
-          writes.delete(path5);
+          writes.delete(path6);
           clearTimeout(timeoutHandler);
           return event;
         }
@@ -302342,8 +302646,8 @@ class FSWatcher extends EventEmitter2 {
       timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval);
     }
   }
-  _isIgnored(path5, stats) {
-    if (this.options.atomic && DOT_RE.test(path5))
+  _isIgnored(path6, stats) {
+    if (this.options.atomic && DOT_RE.test(path6))
       return true;
     if (!this._userIgnored) {
       const { cwd } = this.options;
@@ -302353,13 +302657,13 @@ class FSWatcher extends EventEmitter2 {
       const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
       this._userIgnored = anymatch(list, undefined);
     }
-    return this._userIgnored(path5, stats);
+    return this._userIgnored(path6, stats);
   }
-  _isntIgnored(path5, stat4) {
-    return !this._isIgnored(path5, stat4);
+  _isntIgnored(path6, stat4) {
+    return !this._isIgnored(path6, stat4);
   }
-  _getWatchHelpers(path5) {
-    return new WatchHelper(path5, this.options.followSymlinks, this);
+  _getWatchHelpers(path6) {
+    return new WatchHelper(path6, this.options.followSymlinks, this);
   }
   _getWatchedDir(directory) {
     const dir = sysPath2.resolve(directory);
@@ -302373,57 +302677,57 @@ class FSWatcher extends EventEmitter2 {
     return Boolean(Number(stats.mode) & 256);
   }
   _remove(directory, item, isDirectory) {
-    const path5 = sysPath2.join(directory, item);
-    const fullPath = sysPath2.resolve(path5);
-    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path5) || this._watched.has(fullPath);
-    if (!this._throttle("remove", path5, 100))
+    const path6 = sysPath2.join(directory, item);
+    const fullPath = sysPath2.resolve(path6);
+    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path6) || this._watched.has(fullPath);
+    if (!this._throttle("remove", path6, 100))
       return;
     if (!isDirectory && this._watched.size === 1) {
       this.add(directory, item, true);
     }
-    const wp = this._getWatchedDir(path5);
+    const wp = this._getWatchedDir(path6);
     const nestedDirectoryChildren = wp.getChildren();
-    nestedDirectoryChildren.forEach((nested) => this._remove(path5, nested));
+    nestedDirectoryChildren.forEach((nested) => this._remove(path6, nested));
     const parent = this._getWatchedDir(directory);
     const wasTracked = parent.has(item);
     parent.remove(item);
     if (this._symlinkPaths.has(fullPath)) {
       this._symlinkPaths.delete(fullPath);
     }
-    let relPath = path5;
+    let relPath = path6;
     if (this.options.cwd)
-      relPath = sysPath2.relative(this.options.cwd, path5);
+      relPath = sysPath2.relative(this.options.cwd, path6);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
         return;
     }
-    this._watched.delete(path5);
+    this._watched.delete(path6);
     this._watched.delete(fullPath);
     const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-    if (wasTracked && !this._isIgnored(path5))
-      this._emit(eventName, path5);
-    this._closePath(path5);
+    if (wasTracked && !this._isIgnored(path6))
+      this._emit(eventName, path6);
+    this._closePath(path6);
   }
-  _closePath(path5) {
-    this._closeFile(path5);
-    const dir = sysPath2.dirname(path5);
-    this._getWatchedDir(dir).remove(sysPath2.basename(path5));
+  _closePath(path6) {
+    this._closeFile(path6);
+    const dir = sysPath2.dirname(path6);
+    this._getWatchedDir(dir).remove(sysPath2.basename(path6));
   }
-  _closeFile(path5) {
-    const closers = this._closers.get(path5);
+  _closeFile(path6) {
+    const closers = this._closers.get(path6);
     if (!closers)
       return;
     closers.forEach((closer) => closer());
-    this._closers.delete(path5);
+    this._closers.delete(path6);
   }
-  _addPathCloser(path5, closer) {
+  _addPathCloser(path6, closer) {
     if (!closer)
       return;
-    let list = this._closers.get(path5);
+    let list = this._closers.get(path6);
     if (!list) {
       list = [];
-      this._closers.set(path5, list);
+      this._closers.set(path6, list);
     }
     list.push(closer);
   }
@@ -302457,7 +302761,7 @@ init_errors();
 init_logger();
 init_path_safety();
 import { EventEmitter as EventEmitter4 } from "events";
-import path12 from "path";
+import path13 from "path";
 
 // src/service/environment_store.ts
 var import_client_s33 = __toESM(require_dist_cjs75(), 1);
@@ -302465,8 +302769,8 @@ import { Storage as Storage2 } from "@google-cloud/storage";
 var import_extract_zip = __toESM(require_extract_zip(), 1);
 import crypto5 from "crypto";
 import * as fs9 from "fs";
-import * as os2 from "os";
-import * as path11 from "path";
+import * as os3 from "os";
+import * as path12 from "path";
 
 // ../../node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist12(), 1);
@@ -302504,8 +302808,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path5) {
-  return path5 instanceof String && cache.has(path5);
+function isPathSpec(path6) {
+  return path6 instanceof String && cache.has(path6);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -302591,8 +302895,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = `
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path5) {
-  return import_file_exists.exists(path5, import_file_exists.FOLDER);
+function folderExists(path6) {
+  return import_file_exists.exists(path6, import_file_exists.FOLDER);
 }
 function append2(target, item) {
   if (Array.isArray(target)) {
@@ -302973,8 +303277,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path5) {
-      return /^\.(git)?$/.test(path5.trim());
+    parser(path6) {
+      return /^\.(git)?$/.test(path6.trim());
     }
   };
 }
@@ -303385,11 +303689,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set;
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path5, line, preview] = input.split(NULL);
-    paths.add(path5);
-    (results[path5] = results[path5] || []).push({
+    const [path6, line, preview] = input.split(NULL);
+    paths.add(path6);
+    (results[path6] = results[path6] || []).push({
       line: asNumber(line),
-      path: path5,
+      path: path6,
       preview
     });
   });
@@ -304051,14 +304355,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path5, text) {
+function parseInit(bare, path6, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path5, false, result[1]);
+    return new InitSummary(bare, path6, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path5, true, result[1]);
+    return new InitSummary(bare, path6, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -304069,7 +304373,7 @@ function parseInit(bare, path5, text) {
       break;
     }
   }
-  return new InitSummary(bare, path5, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path6, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -304077,9 +304381,9 @@ var reInitResponseRegex;
 var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     InitSummary = class {
-      constructor(bare, path5, existing, gitDir) {
+      constructor(bare, path6, existing, gitDir) {
         this.bare = bare;
-        this.path = path5;
+        this.path = path6;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -304091,7 +304395,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path5, customArgs) {
+function initTask(bare = false, path6, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -304100,7 +304404,7 @@ function initTask(bare = false, path5, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path5, text);
+      return parseInit(commands.includes("--bare"), path6, text);
     }
   };
 }
@@ -304815,12 +305119,12 @@ var init_FileStatusSummary = __esm2({
   "src/lib/responses/FileStatusSummary.ts"() {
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path5, index, working_dir) {
-        this.path = path5;
+      constructor(path6, index, working_dir) {
+        this.path = path6;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path5) || [null, path5, path5];
+          const detail = fromPathRegex.exec(path6) || [null, path6, path6];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -304851,14 +305155,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path5) {
+  function data(index, workingDir, path6) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path5);
+      handler(result, path6);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path5, index, workingDir));
+      result.files.push(new FileStatusSummary(path6, index, workingDir));
     }
   }
 }
@@ -305089,8 +305393,8 @@ var init_simple_git_api = __esm2({
         }
         return this._runTask(configurationErrorTask("Git.cwd: workingDirectory must be supplied as a string"), next);
       }
-      hashObject(path5, write) {
-        return this._runTask(hashObjectTask(path5, write === true), trailingFunctionArgument(arguments));
+      hashObject(path6, write) {
+        return this._runTask(hashObjectTask(path6, write === true), trailingFunctionArgument(arguments));
       }
       init(bare) {
         return this._runTask(initTask(bare === true, this._executor.cwd, getTrailingOptions(arguments)), trailingFunctionArgument(arguments));
@@ -305667,8 +305971,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path5) {
-  return subModuleTask(["add", repo, path5]);
+function addSubModuleTask(repo, path6) {
+  return subModuleTask(["add", repo, path6]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -305936,8 +306240,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path5, then) {
-      return this._runTask(addSubModuleTask2(repo, path5), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path6, then) {
+      return this._runTask(addSubModuleTask2(repo, path6), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(updateSubModuleTask2(getTrailingOptions2(arguments, true)), trailingFunctionArgument2(arguments));
@@ -306570,7 +306874,7 @@ init_config();
 import {
   DuckDBInstance
 } from "@duckdb/node-api";
-import * as path5 from "path";
+import * as path6 from "path";
 function duckDBInstanceResourceOptions() {
   const options = {};
   const memoryLimit = getDuckDBMemoryLimit();
@@ -306590,7 +306894,7 @@ class DuckDBConnection2 {
   dbPath;
   mutex = new Mutex;
   constructor(dbPath) {
-    this.dbPath = dbPath || path5.join(process.cwd(), "publisher.db");
+    this.dbPath = dbPath || path6.join(process.cwd(), "publisher.db");
   }
   async initialize() {
     try {
@@ -307051,7 +307355,6 @@ var ACTIVE_STATUSES = [
 function activeKeyFor(environmentId, packageName) {
   return `${environmentId}|${packageName}`;
 }
-var DEFAULT_ENVIRONMENT_LIST_LIMIT = 500;
 
 class DuplicateActiveMaterializationError extends Error {
   constructor(environmentId, packageName) {
@@ -307084,18 +307387,6 @@ class MaterializationRepository {
     const rows = await this.db.all(sql, params);
     return rows.map(this.mapRow);
   }
-  async listByEnvironment(environmentId, options) {
-    let sql = "SELECT * FROM materializations WHERE environment_id = ? ORDER BY created_at DESC";
-    const params = [environmentId];
-    sql += " LIMIT ?";
-    params.push(options?.limit ?? DEFAULT_ENVIRONMENT_LIST_LIMIT);
-    if (options?.offset !== undefined) {
-      sql += " OFFSET ?";
-      params.push(options.offset);
-    }
-    const rows = await this.db.all(sql, params);
-    return rows.map(this.mapRow);
-  }
   async getLatestScheduledFireAt(environmentId, packageName) {
     const row = await this.db.get(`SELECT created_at FROM materializations
            WHERE environment_id = ? AND package_name = ?
@@ -307426,9 +307717,6 @@ class DuckDBRepository {
   async listMaterializations(environmentId, packageName, options) {
     return this.materializationRepo.list(environmentId, packageName, options);
   }
-  async listMaterializationsByEnvironment(environmentId, options) {
-    return this.materializationRepo.listByEnvironment(environmentId, options);
-  }
   async getLatestScheduledFireAt(environmentId, packageName) {
     return this.materializationRepo.getLatestScheduledFireAt(environmentId, packageName);
   }
@@ -307899,7 +308187,7 @@ init_config();
 init_logger();
 import crypto4 from "crypto";
 import * as fs8 from "fs";
-import * as path10 from "path";
+import * as path11 from "path";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL2 } from "url";
 init_materialization_metrics();
 init_path_safety();
@@ -308009,7 +308297,7 @@ init_logger();
 init_materialization_metrics();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
 import * as fs7 from "fs/promises";
-import * as path9 from "path";
+import * as path10 from "path";
 import"@malloydata/db-duckdb/native";
 import { DuckDBConnection as DuckDBConnection3 } from "@malloydata/db-duckdb";
 import {
@@ -309123,7 +309411,7 @@ class Package {
           });
         }
         if (sm.modelPath.endsWith(MODEL_FILE_SUFFIX)) {
-          const modelSource = await fs7.readFile(path9.join(packagePath, sm.modelPath), "utf-8");
+          const modelSource = await fs7.readFile(path10.join(packagePath, sm.modelPath), "utf-8");
           assertPersistNamesQuoted(modelSource, sm.modelPath);
         }
         models.set(sm.modelPath, model);
@@ -310128,16 +310416,16 @@ class Package {
   static async getDatabasePaths(packagePath) {
     const files = await import_recursive_readdir.default(packagePath, [ignoreDotfiles]);
     return files.map((fullPath) => {
-      return path9.relative(packagePath, fullPath).replace(/\\/g, "/");
+      return path10.relative(packagePath, fullPath).replace(/\\/g, "/");
     }).filter((modelPath) => {
-      if (path9.basename(modelPath).startsWith("~$")) {
+      if (path10.basename(modelPath).startsWith("~$")) {
         return false;
       }
       return modelPath.endsWith(".parquet") || modelPath.endsWith(".csv") || modelPath.endsWith(".xlsx");
     });
   }
   static async getDatabaseInfo(packagePath, databasePath, conn) {
-    const fullPath = path9.join(packagePath, databasePath);
+    const fullPath = path10.join(packagePath, databasePath);
     const runtime = new ConnectionRuntime({
       urlReader: new EmptyURLReader,
       connections: [conn]
@@ -310251,7 +310539,7 @@ class Environment {
   async writeEnvironmentReadme(readme) {
     if (readme === undefined)
       return;
-    const readmePath = path10.join(this.environmentPath, "README.md");
+    const readmePath = path11.join(this.environmentPath, "README.md");
     try {
       await fs8.promises.writeFile(readmePath, readme, "utf-8");
       logger.info(`Updated README.md for environment ${this.environmentName}`);
@@ -310345,8 +310633,8 @@ class Environment {
     return this.withPackageLock(packageName, async () => {
       const modelPath = safeJoinUnderRoot(this.environmentPath, packageName, modelName);
       const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
-      const modelDir = path10.dirname(modelPath);
-      const virtualUrl = scope === "append" ? pathToFileURL2(path10.join(modelDir, "__compile_check.malloy")) : pathToFileURL2(modelPath);
+      const modelDir = path11.dirname(modelPath);
+      const virtualUrl = scope === "append" ? pathToFileURL2(path11.join(modelDir, "__compile_check.malloy")) : pathToFileURL2(modelPath);
       const virtualUri = virtualUrl.toString();
       let fullSource = source ?? "";
       if (scope === "append") {
@@ -310395,8 +310683,8 @@ ${source}` : source ?? "";
         let model;
         if (url2 && url2.startsWith("file:")) {
           try {
-            const rel = path10.relative(packagePath, fileURLToPath6(url2));
-            if (!rel.startsWith("..") && !path10.isAbsolute(rel)) {
+            const rel = path11.relative(packagePath, fileURLToPath6(url2));
+            if (!rel.startsWith("..") && !path11.isAbsolute(rel)) {
               model = rel;
             }
           } catch {}
@@ -310683,6 +310971,49 @@ ${source}` : source ?? "";
     assertSafePackageName(packageName);
     return this.getOrCreatePackageMutex(packageName).runExclusive(fn);
   }
+  async _readModelFileLocked(target) {
+    try {
+      return await fs8.promises.readFile(target, "utf8");
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+      return;
+    }
+  }
+  async _writeModelFileLocked(target, source) {
+    await fs8.promises.mkdir(path11.dirname(target), { recursive: true });
+    const temporary = `${target}.${crypto4.randomUUID()}.tmp`;
+    await fs8.promises.writeFile(temporary, source, "utf8");
+    await fs8.promises.rename(temporary, target);
+  }
+  async writeModelFileTransactional(packageName, modelPath, source, check, verify) {
+    assertSafePackageName(packageName);
+    assertSafeRelativeModelPath(modelPath);
+    return this.withPackageLock(packageName, async () => {
+      const target = safeJoinUnderRoot(this.environmentPath, packageName, modelPath);
+      const previous = await this._readModelFileLocked(target);
+      check(previous);
+      await this._writeModelFileLocked(target, source);
+      try {
+        const reloaded = await this._loadOrGetPackageLocked(packageName, true);
+        return { previous, verified: await verify(reloaded) };
+      } catch (error) {
+        if (previous !== undefined)
+          await this._writeModelFileLocked(target, previous);
+        else
+          await fs8.promises.rm(target, { force: true });
+        await this._loadOrGetPackageLocked(packageName, true).catch(() => {
+          return;
+        });
+        logger.warn("Dashboard write rolled back", {
+          packageName,
+          modelPath,
+          error
+        });
+        throw new WriteRolledBackError(`The package did not reload with the new \`${modelPath}\`, so ` + `the previous text was put back and nothing changed.`);
+      }
+    });
+  }
   allocateStagingPath(packageName) {
     return safeJoinUnderRoot(this.environmentPath, STAGING_DIR_NAME, `${packageName}-${crypto4.randomUUID()}`);
   }
@@ -310695,7 +311026,7 @@ ${source}` : source ?? "";
       const dir = safeJoinUnderRoot(environmentPath, dirName);
       if (dir.indexOf("..") !== -1)
         continue;
-      if (path10.basename(dir) !== dirName)
+      if (path11.basename(dir) !== dirName)
         continue;
       try {
         await fs8.promises.rm(dir, { recursive: true, force: true });
@@ -310835,7 +311166,7 @@ ${source}` : source ?? "";
   async installPackage(packageName, downloader, validate) {
     assertSafePackageName(packageName);
     const stagingPath = this.allocateStagingPath(packageName);
-    await fs8.promises.mkdir(path10.dirname(stagingPath), { recursive: true });
+    await fs8.promises.mkdir(path11.dirname(stagingPath), { recursive: true });
     logger.debug("install.phase1.download.started", {
       environmentName: this.environmentName,
       packageName,
@@ -310864,7 +311195,7 @@ ${source}` : source ?? "";
       const oldExistsOnDisk = await fs8.promises.access(canonicalPath).then(() => true).catch(() => false);
       if (oldExistsOnDisk) {
         retiredPath = this.allocateRetiredPath(packageName);
-        await fs8.promises.mkdir(path10.dirname(retiredPath), {
+        await fs8.promises.mkdir(path11.dirname(retiredPath), {
           recursive: true
         });
         await fs8.promises.rename(canonicalPath, retiredPath);
@@ -311229,7 +311560,7 @@ ${source}` : source ?? "";
       const retiredPath = this.allocateRetiredPath(packageName);
       let renamed = false;
       try {
-        await fs8.promises.mkdir(path10.dirname(retiredPath), {
+        await fs8.promises.mkdir(path11.dirname(retiredPath), {
           recursive: true
         });
         await fs8.promises.rename(canonicalPath, retiredPath);
@@ -311329,7 +311660,7 @@ ${source}` : source ?? "";
     };
   }
   async deleteDuckDBConnection(connectionName) {
-    const duckdbPath = path10.join(this.environmentPath, `${connectionName}.duckdb`);
+    const duckdbPath = path11.join(this.environmentPath, `${connectionName}.duckdb`);
     try {
       await fs8.promises.rm(duckdbPath, { force: true });
       logger.info(`Removed DuckDB connection file ${connectionName} from environment ${this.environmentName}`);
@@ -311403,13 +311734,13 @@ async function clearMountTarget(targetPath) {
 function resolvePackageLocation(location, anchorDir, homeDir) {
   let expanded = location;
   if (location.startsWith("~/")) {
-    const home = homeDir ?? os2.homedir();
+    const home = homeDir ?? os3.homedir();
     if (!home) {
       throw new Error(`Cannot expand "~" in location "${location}": home directory is not set`);
     }
-    expanded = path11.join(home, location.slice(2));
+    expanded = path12.join(home, location.slice(2));
   }
-  return path11.isAbsolute(expanded) ? expanded : path11.join(anchorDir, expanded);
+  return path12.isAbsolute(expanded) ? expanded : path12.join(anchorDir, expanded);
 }
 var GIT_CLONE_OPTIONS = {
   "--depth": 1,
@@ -311587,7 +311918,7 @@ class EnvironmentStore {
     const storageConfig = {
       type: "duckdb",
       duckdb: {
-        path: path11.join(serverRootPath, "publisher.db")
+        path: path12.join(serverRootPath, "publisher.db")
       }
     };
     this.storageManager = new StorageManager(storageConfig);
@@ -312002,7 +312333,7 @@ class EnvironmentStore {
     const reInit = process.env.INITIALIZE_STORAGE === "true";
     await fs9.promises.mkdir(this.serverRootPath, { recursive: true });
     if (reInit) {
-      const uploadDocsPath2 = path11.join(this.serverRootPath, PUBLISHER_DATA_DIR);
+      const uploadDocsPath2 = path12.join(this.serverRootPath, PUBLISHER_DATA_DIR);
       logger.info(`Reinitialization mode: Cleaning up upload documents path ${uploadDocsPath2}`);
       try {
         await fs9.promises.rm(uploadDocsPath2, {
@@ -312019,7 +312350,7 @@ class EnvironmentStore {
     } else {
       logger.info(`Using existing publisher path`);
     }
-    const uploadDocsPath = path11.join(this.serverRootPath, PUBLISHER_DATA_DIR);
+    const uploadDocsPath = path12.join(this.serverRootPath, PUBLISHER_DATA_DIR);
     await fs9.promises.mkdir(uploadDocsPath, { recursive: true });
   }
   async listEnvironments(skipInitializationCheck = false) {
@@ -312197,9 +312528,9 @@ class EnvironmentStore {
     assertSafeEnvironmentPath(absoluteEnvironmentPath);
     const startedAt = Date.now();
     logger.info(`Detected zip file at "${absoluteEnvironmentPath}". Unzipping...`);
-    const archiveDir = path11.resolve(path11.dirname(absoluteEnvironmentPath));
-    const unzippedEnvironmentPath = path11.resolve(archiveDir, path11.basename(absoluteEnvironmentPath, ".zip"));
-    if (!unzippedEnvironmentPath.startsWith(archiveDir + path11.sep)) {
+    const archiveDir = path12.resolve(path12.dirname(absoluteEnvironmentPath));
+    const unzippedEnvironmentPath = path12.resolve(archiveDir, path12.basename(absoluteEnvironmentPath, ".zip"));
+    if (!unzippedEnvironmentPath.startsWith(archiveDir + path12.sep)) {
       throw new BadRequestError(`Refusing to unzip "${absoluteEnvironmentPath}": target escapes its directory`);
     }
     await fs9.promises.rm(unzippedEnvironmentPath, {
@@ -312210,7 +312541,7 @@ class EnvironmentStore {
     let entryCount = 0;
     let totalUncompressedBytes = 0;
     await import_extract_zip.default(absoluteEnvironmentPath, {
-      dir: path11.resolve(unzippedEnvironmentPath),
+      dir: path12.resolve(unzippedEnvironmentPath),
       onEntry: (entry) => {
         entryCount += 1;
         totalUncompressedBytes += entry.uncompressedSize ?? 0;
@@ -312317,7 +312648,7 @@ class EnvironmentStore {
     return absoluteEnvironmentPath;
   }
   isLocalPath(location) {
-    return location.startsWith("./") || location.startsWith("../") || location.startsWith("~/") || location.startsWith("/") || path11.isAbsolute(location);
+    return location.startsWith("./") || location.startsWith("../") || location.startsWith("~/") || location.startsWith("/") || path12.isAbsolute(location);
   }
   resolveLocalPath(location) {
     return resolvePackageLocation(location, getPublisherConfigDir(this.serverRootPath) ?? this.serverRootPath);
@@ -312414,7 +312745,7 @@ class EnvironmentStore {
             const isInPlace = this.inPlaceEnvs.has(environmentName) && this.isLocalPath(_package.location);
             if (isInPlace) {
               await clearMountTarget(absolutePackagePath);
-              const absoluteSourcePath = path11.resolve(sourcePath);
+              const absoluteSourcePath = path12.resolve(sourcePath);
               const linkType = process.platform === "win32" ? "junction" : "dir";
               try {
                 await fs9.promises.symlink(absoluteSourcePath, absolutePackagePath, linkType);
@@ -312573,7 +312904,7 @@ class EnvironmentStore {
       if (file.name.endsWith("/")) {
         return;
       }
-      await fs9.promises.mkdir(path11.dirname(absoluteFilePath), {
+      await fs9.promises.mkdir(path12.dirname(absoluteFilePath), {
         recursive: true
       });
       return fs9.promises.writeFile(absoluteFilePath, await file.download());
@@ -312590,7 +312921,7 @@ class EnvironmentStore {
     const prefix = prefixParts.join("/");
     if (isCompressedFile) {
       const zipFilePath = `${absoluteDirPath}.zip`;
-      await fs9.promises.mkdir(path11.dirname(zipFilePath), {
+      await fs9.promises.mkdir(path12.dirname(zipFilePath), {
         recursive: true
       });
       const command = new import_client_s33.GetObjectCommand({
@@ -312630,7 +312961,7 @@ class EnvironmentStore {
         return;
       }
       const absoluteFilePath = safeJoinUnderRoot(absoluteDirPath, relativeFilePath);
-      await fs9.promises.mkdir(path11.dirname(absoluteFilePath), {
+      await fs9.promises.mkdir(path12.dirname(absoluteFilePath), {
         recursive: true
       });
       const command = new import_client_s33.GetObjectCommand({
@@ -312784,7 +313115,7 @@ class WatchModeController {
       ignored: (filePath, stats) => {
         if (!stats?.isFile())
           return false;
-        const ext = path12.extname(filePath).toLowerCase();
+        const ext = path13.extname(filePath).toLowerCase();
         return !MODEL_EXTS.has(ext) && !ASSET_EXTS.has(ext);
       },
       ignoreInitial: true
@@ -312802,12 +313133,12 @@ class WatchModeController {
     };
     const onEvent = (kind) => async (filePath) => {
       logger.info(`Watch ${kind}: ${filePath}; environment=${watchName}`);
-      const rel = path12.relative(this.watchingPath ?? "", filePath);
-      const segments = rel.split(path12.sep);
+      const rel = path13.relative(this.watchingPath ?? "", filePath);
+      const segments = rel.split(path13.sep);
       const pkgName = segments.length > 1 && segments[0] && !segments[0].startsWith("..") ? segments[0] : null;
       if (!pkgName)
         return;
-      const ext = path12.extname(filePath).toLowerCase();
+      const ext = path13.extname(filePath).toLowerCase();
       if (MODEL_EXTS.has(ext)) {
         const recompiled = await reloadPackage(pkgName);
         if (!recompiled)
@@ -313207,9 +313538,6 @@ class MaterializationController {
   async listMaterializations(environmentName, packageName, options) {
     return this.materializationService.listMaterializations(environmentName, packageName, options);
   }
-  async listEnvironmentMaterializations(environmentName, options) {
-    return this.materializationService.listEnvironmentMaterializations(environmentName, options);
-  }
   async getMaterialization(environmentName, packageName, materializationId) {
     return this.materializationService.getMaterialization(environmentName, packageName, materializationId);
   }
@@ -316104,7 +316432,7 @@ init_logger();
 // src/mcp/tools/schema_index.ts
 init_logger();
 var import_lunr3 = __toESM(require_lunr(), 1);
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var MAX_INDEXED_TABLES = 5000;
 var MAX_COLUMNS_IN_INDEX_TEXT = 60;
 var MAX_CACHED_SCHEMAS = 8;
@@ -316119,7 +316447,7 @@ function tableIndexText(entity) {
 }
 function schemaFingerprint(tables) {
   const canonical = tables.map((t) => `${t.resource}\x00${t.columns.map((c) => `${c.name}:${c.type ?? ""}`).join(",")}`).sort().join("\x01");
-  return createHash3("sha256").update(canonical).digest("hex");
+  return createHash5("sha256").update(canonical).digest("hex");
 }
 function sanitizeQuery(query) {
   return query.replace(/[~^:*+\-"]/g, " ").trim();
@@ -320380,14 +320708,18 @@ Scanned at a glance is a dashboard; read top to bottom is a notebook.
 2. **PICK THE VIEWS TO SHOW.** A dashboard is \`## artifact { tiles=[…] }\` naming existing views, so
    this is the design step: which views, how wide each sits, what each is called. There is one form,
    so there is no form to choose.
-3. **DECLARE THE GIVENS** the dashboard will filter by, in the model (usually \`givens.malloy\`), with
-   their control tags: see "Filter controls" below for the syntax and what each tag renders as. Skip
-   if they already exist, since a given is a model concern and dashboards share them.
+3. **DECLARE THE GIVENS** the dashboard will filter by, in the dashboard file itself, with their
+   control tags: see "Filter controls" below for the syntax and what each tag renders as. That is
+   the convention because the dashboard builder edits the dashboard file and nothing else, so a
+   filter it can add, change or remove is a declaration in that file. Bind them on the tiles (step
+   4). Reuse the package's \`givens.malloy\` only for a control several surfaces genuinely share, and
+   then import it whole, knowing the builder can bind those givens but not edit them.
 4. **COMPOSE THE FILE** for \`dashboards/\`, following the template below, but do not save it yet.
-   Import the package's givens file **whole**: \`import '../givens.malloy'\`, not a named list.
-   Only the givens the tiles reference become controls, so a whole-file import brings nothing
-   extra, and a named list is one more thing to forget; forgetting one costs you a missing control
-   rather than an error. Sources are the other way round: name the few you need. Then import every
+   Name the sources you need: \`import { order_items, products } from '../storefront.malloy'\`.
+   Each tile binds its controls with a refinement, \`view: t is v + { where: category ~ $CATEGORY }\`,
+   one clause per given it answers to; a \`filter<...>\` binds with \`~\`, a plain \`date\` or \`number\`
+   given is a value and binds with \`>=\`, \`<=\` or \`=\`. Only the givens some tile references become
+   controls, so a declaration nothing binds shows nothing. Then import every
    source or query any referenced given names in a \`suggest\`. Both are per-file, and getting the
    suggest wrong does not error: the control still looks like a picker but has no options, and says
    so underneath, "Could not load the options for this control". The package warnings name it too. **A \`suggest\` naming a \`query=\` needs that
@@ -320422,33 +320754,31 @@ out by Publisher into the grid \`# dashboard { columns=N }\` names.
 \`\`\`malloy
 ##! experimental.givens
 ## artifact { title="Storefront overview" tiles=["overview -> kpis", "overview -> revenue_trend", "overview -> revenue_by_state"] } dashboard { columns=12 }
-import { scoped_sales } from './_shared.malloy'
-import { products } from '../storefront.malloy'
-import '../givens.malloy'
+import { order_items, products } from '../storefront.malloy'
+
+// The controls, declared here: the tags are each one's control contract.
+# label="Category" control=select suggest { source=products dimension=category }
+given: CATEGORY :: filter<string> is f''
+# label="Ordered since"
+given: SINCE :: date is @2023-01-01
 
 // Layout goes on the VIEW, and a thin re-declaration is the place to put it: the
-// modelled view keeps its chart tag, and this decides how wide it sits here.
-source: overview is scoped_sales extend {
+// modelled view keeps its chart tag, this decides how wide it sits here, and the
+// \`+ { where: ... }\` says which controls the tile answers to.
+source: overview is order_items extend {
   # colspan=12
   # label="Key figures"
   # big_value
-  view: kpis is {
-    aggregate:
-      # label="Revenue"
-      # currency
-      total_sales
-      # label="Orders"
-      order_count
-  }
+  view: kpis is key_figures + { where: category ~ $CATEGORY, where: created_at >= $SINCE }
 
   # colspan=8
   # break
   # label="Revenue by month"
-  view: revenue_trend is sales_by_month
+  view: revenue_trend is sales_by_month + { where: category ~ $CATEGORY, where: created_at >= $SINCE }
 
   # colspan=4
   # label="Revenue by state"
-  view: revenue_by_state is sales_by_state
+  view: revenue_by_state is sales_by_state + { where: category ~ $CATEGORY, where: created_at >= $SINCE }
 }
 \`\`\`
 
@@ -320461,8 +320791,8 @@ Three things the form costs, so you are not surprised by them:
 - **A tile expression is a string in an annotation, so the compiler never checks it.** Rename a view
   and the file still compiles; the tile fails at package load. Read the lint (step 6).
 - **No per-parent-row grouping.** There is no parent query to repeat a grid over.
-- **Filtering lives in what the tiles name**, not on the page. That is the shared include's job,
-  below.
+- **Filtering lives on the tiles**, not on the page: each view's \`+ { where: ... }\` names the
+  controls it answers to. Below is why, and the one thing that does not work.
 
 ### Also served: \`# artifact\` on a \`query:\`
 
@@ -320522,23 +320852,24 @@ object", so a dashboard has no description as a result.
 
 ### Where the filtering goes
 
-A dashboard has no query, so the filtering it applies must live in what it composes: a source that
-already has the givens applied. Put it in an untagged \`dashboards/_shared.malloy\`, which discovery
-treats as a shared include rather than a dashboard. **It has to apply every given the dashboard
-imports**: a given the dashboard imports but nothing references gets no control, silently, at reload
-200 with no warning. Note \`SINCE\` is a \`date\` rather than a \`filter<>\`, so it compares with \`>=\`
-rather than \`~\`. Save the include before you compile the dashboard that imports it, since an importer
-compiled against a sibling that is not on disk fails with an \`import-error\`.
-
-\`\`\`malloy
-##! experimental.givens
-import { order_items } from '../storefront.malloy'
-import '../givens.malloy'
-
-source: scoped_sales is order_items extend {
-  where: products.category ~ $CATEGORY and created_at >= $SINCE
-}
-\`\`\`
+A dashboard has no query, so its filtering lives on the views it names: a \`+ { where: field ~ $GIVEN }\`
+refinement on each tile, one clause per control the tile answers to. A tile without the clause does
+not move when the control does, which is how a page keeps one tile fixed while the rest filter. The
+givens those clauses read are declared in the same file (step 3).
+
+**Binding is per declaration, not per name.** Measured: a dashboard declaring its own \`CATEGORY\`
+over a source whose model-level \`where:\` reads the model's \`CATEGORY\` compiles, shows the control,
+and filters nothing when it moves, because the two declarations only share a name. So do not mix
+the two designs on one given. The other design still works on its own: a source with the givens
+already applied in an untagged \`dashboards/_shared.malloy\`, reading \`import '../givens.malloy'\`,
+which discovery treats as a shared include rather than a dashboard. Then the dashboard imports both
+and the controls render for the givens its tiles reach. A given the dashboard imports but nothing
+references gets no control, silently, at reload 200 with no warning. Save the include before you
+compile the dashboard that imports it, since an importer compiled against a sibling that is not on
+disk fails with an \`import-error\`. The builder can bind such a control but not add, change or
+remove it, since it never edits imports or model files.
+
+Note \`SINCE\` is a \`date\` rather than a \`filter<>\`, so it compares with \`>=\` rather than \`~\`.
 
 **\`# dashboard { columns=N }\` is the one spelling of the grid width**, on both forms, beside the
 artifact tag. Anything else inside the artifact tag is a package warning naming it, which is what you
@@ -320620,9 +320951,10 @@ rows.
 - **The filename is the dashboard's name:** its URL slug, its listing name, and its \`# drill\`
   target. The query inside can be called anything, and sometimes must be (a query named \`regions\`
   collides with an imported \`regions\` source).
-- **Importing a given is what makes it bindable.** Malloy's given namespace is per-file. A given the
-  dashboard file does not import gets no control and cannot be sent to it, even when the \`where:\`
-  that references it lives up an import chain. A dashboard must import the givens its tiles use.
+- **A given has to be in the dashboard file's scope to be bindable**: declared there (the
+  convention) or imported. Malloy's given namespace is per-file. A given the file cannot see gets
+  no control and cannot be sent to it, even when a \`where:\` that references it lives up an import
+  chain. And a given declared here does not drive a \`where:\` in the model: bind on the tiles.
 - **A suggest's source or query has to resolve in the dashboard file too.** \`suggest { source=products … }\`
   means the dashboard imports \`products\`.
 - **A model-level \`##\` tag must be on one line.** Wrapping one always breaks it, but how you find
@@ -320641,9 +320973,10 @@ choosing them.
 
 ## Filter controls
 
-Controls come from the \`given:\` declarations the query references, and the tags on the declaration
-are the control contract, declared once and identical on every dashboard and in every notebook that
-uses them:
+Controls come from the \`given:\` declarations the tiles reference. Declare them in the dashboard
+file, which is what the builder edits; a package \`givens.malloy\` is for controls the data app and
+notebooks share, and a dashboard importing it whole gets the same controls but cannot edit them.
+The tags on the declaration are the control contract:
 
 \`\`\`malloy
 ##! experimental.givens
@@ -322177,7 +322510,7 @@ Present coverage in this order:
     {
       name: "malloy-materialization-tuning",
       description: "Optimize a package's Malloy Persistence materializations for cost and performance using the malloy-pub CLI and the materialization history. Recommend what to persist, what to stop persisting, and how to schedule/scope it. Use when the user asks to make a package cheaper or faster, tune persistence, decide what to materialize, or review persist/schedule choices.",
-      body: "# Tuning materializations for cost and performance\n\nThis skill turns the signals the open-source Publisher already records (the materialization history, per-run timings, and which sources were built vs reused) into concrete, **recommendations-only** advice: which sources to persist, which to stop persisting, and how to schedule and scope them. It is the local counterpart to the platform's usage-driven optimization: the Publisher has the raw signals, and you read them with the `malloy-pub` CLI.\n\n> **Recommendations only. Never change a model, schedule, or scope without the user's explicit go-ahead.** Present the findings and the proposed edits, then apply them only when asked. Persisting the wrong source wastes storage and rebuild time; unpersisting a hot one makes queries slow. Let the user decide.\n\nAssumes the `malloy-pub` CLI is on PATH and points at the server (`--url` or `MALLOY_PUBLISHER_URL`, default `http://localhost:4000`). Substitute the real environment and package for `<env>` / `<pkg>`.\n\n## Step 1: Take inventory\n\nEstablish what the package persists today and how it is governed.\n\n- **Persist sources:** the sources annotated `#@ persist name=\"…\"` in the package's `.malloy` files. Read the models (or `get_context` the package) to list them.\n- **Schedule + scope:**\n\n  ```bash\n  malloy-pub schedule view --environment <env> --package <pkg>\n  ```\n\n  This prints the cron (or `none`, meaning publish / on-demand only), the persist **scope** (`package` = artifacts reused across versions; `version` = per published version), and whether a freshness policy is set. A control-plane-managed package (manifestLocation set) is refreshed by the control plane, not the standalone scheduler, so leave its cadence alone.\n\n## Step 2: Read the materialization history\n\nThe history is where cost lives. Each run records its trigger, timing, and how many sources were built vs reused.\n\n- **Across the whole environment** (all packages, newest first; the rows are interleaved and labeled by package, not grouped into contiguous per-package blocks):\n\n  ```bash\n  malloy-pub list materialization --environment <env>\n  ```\n\n  Columns: Package, ID, Status, **Trigger** (`SCHEDULER` vs `ON_DEMAND`), Started, Completed, Error.\n\n- **For one package:**\n\n  ```bash\n  malloy-pub list materialization --environment <env> --package <pkg>\n  ```\n\n- **A single run's detail** (the cost signals):\n\n  ```bash\n  malloy-pub get materialization <id> --environment <env> --package <pkg>\n  ```\n\n  In the JSON, read:\n  - `metadata.durationMs`: how long the build took.\n  - `metadata.sourcesBuilt` vs `metadata.sourcesReused`: how much work each run actually did. A run that is nearly all _reused_ is cheap; one that is nearly all _built_ every time is where cost accumulates.\n  - `metadata.trigger`: `SCHEDULER` (a cron fired it) or `ON_DEMAND`.\n  - `manifest.entries[*]`: the persisted sources: `sourceName`, `physicalTableName`, `realization`.\n\nLook across several runs, not one: the pattern over the recent history (how often it rebuilds, how much it reuses, how long it takes) is the signal.\n\n## Step 3: Analyze and recommend\n\nWeigh rebuild cost against query benefit. Common findings:\n\n- **Persist candidate:** an expensive, frequently-queried source that is _not_ persisted (recomputed on every query). Recommend adding `#@ persist name=\"…\"`. Strongest when the source is a heavy aggregate/join reused by many queries and its inputs change slowly. If the source carries an `#(authorize)` gate, check which case it is first. A gate reached only through a `join_*`, or inherited from a base it cannot be attributed to, makes the colocated persist **refuse with a 422** - so do not recommend persisting it at all. Where the gate is provably the source's own row filter the persist is admitted, and then only recommend it alongside a freshness window (`freshness.fallback=\"live\"`): the gating column freezes at build time, so without one a revoked row can be served under its old access decision indefinitely (see `skill:malloy-materialization`, which also covers where that window does and does not bind).\n- **Removal candidate:** a persisted source that is cheap to compute, rarely queried, or rebuilt far more often than it is read. Recommend dropping the `#@ persist` annotation (and its table): the storage + rebuild cost is not buying anything.\n- **Cadence mismatch:** a `SCHEDULER` cadence out of step with how fast the data changes or how long a build takes. If most scheduled runs are all-reused (nothing changed), the cron is too frequent, so loosen it. If queries routinely read stale data, tighten it. If the build's `durationMs` approaches the interval, the cadence is too aggressive.\n- **Scope mismatch:** `scope: version` re-materializes per published version (right when versions must be isolated, e.g. a schedule); `scope: package` reuses one lineage across versions (cheaper when versions can share). A schedule _requires_ `version`. If a package carries a schedule it does not need, clearing the schedule frees it to use the cheaper package scope.\n\nFrame each recommendation with the evidence from Step 2 (the run IDs, timings, built/reused counts) so the user can judge it.\n\n## Step 4: Apply (only once approved)\n\n- **Add a persist source:** add the `#@ persist` annotation in the `.malloy` file (use the modeling workflow to validate and reload), then rebuild so it is materialized:\n\n  ```bash\n  malloy-pub materialize --environment <env> --package <pkg> --wait\n  ```\n\n- **Remove a persist source:** delete the `#@ persist` annotation, then drop the old run's tables **before** rebuilding what remains:\n\n  ```bash\n  malloy-pub delete materialization <id> --environment <env> --package <pkg> --drop-tables\n  malloy-pub materialize --environment <env> --package <pkg> --wait\n  ```\n\n  > `--drop-tables` drops **every** physical table in that run's manifest, not just the removed source's: auto-run assigns stable table names and carries unchanged sources forward, so an old run's manifest names tables a newer manifest still serves. Do the drop **first, then rebuild**: `materialize --wait` re-creates every source that is still persisted, ending in the desired state. Dropping a run whose tables the current serving manifest depends on, without an immediate rebuild, breaks queries (`Table ... does not exist`).\n\n- **Change the schedule / cadence:**\n\n  ```bash\n  malloy-pub schedule set \"0 6 * * *\" --environment <env> --package <pkg>   # 5-field UTC cron\n  malloy-pub schedule clear --environment <env> --package <pkg>\n  ```\n\n  `set` also sets `scope: version` (a schedule requires it); the server rejects an invalid cron or an illegal scope/freshness combination, so a rejection means the change was unsafe.\n\n- **Change the scope:** `scope` is declared in the package's `publisher.json` under `materialization` (`\"scope\": \"package\"` or `\"version\"`; the root-level form is deprecated but still read). Edit it there, then reload/republish the package. Remember a schedule pins scope to `version`, so clear the schedule first if moving to `package`.\n\nAfter applying, re-run Step 2 on the next few builds to confirm the change did what you predicted (more reuse, shorter builds, or a table that is actually read).\n\n## What this skill does not do\n\n- It does not decide for the user or apply changes silently; every edit needs an explicit go-ahead.\n- It cannot see per-query read counts (the open-source Publisher records build history, not query-level table usage), so \"rarely queried\" is a judgment from the model and the user's knowledge, not a measured metric. Say so when it matters."
+      body: "# Tuning materializations for cost and performance\n\nThis skill turns the signals the open-source Publisher already records (the materialization history, per-run timings, and which sources were built vs reused) into concrete, **recommendations-only** advice: which sources to persist, which to stop persisting, and how to schedule and scope them. It is the local counterpart to the platform's usage-driven optimization: the Publisher has the raw signals, and you read them with the `malloy-pub` CLI.\n\n> **Recommendations only. Never change a model, schedule, or scope without the user's explicit go-ahead.** Present the findings and the proposed edits, then apply them only when asked. Persisting the wrong source wastes storage and rebuild time; unpersisting a hot one makes queries slow. Let the user decide.\n\nAssumes the `malloy-pub` CLI is on PATH and points at the server (`--url` or `MALLOY_PUBLISHER_URL`, default `http://localhost:4000`). Substitute the real environment and package for `<env>` / `<pkg>`.\n\n## Step 1: Take inventory\n\nEstablish what the package persists today and how it is governed.\n\n- **Persist sources:** the sources annotated `#@ persist name=\"…\"` in the package's `.malloy` files. Read the models (or `get_context` the package) to list them.\n- **Schedule + scope:**\n\n  ```bash\n  malloy-pub schedule view --environment <env> --package <pkg>\n  ```\n\n  This prints the cron (or `none`, meaning publish / on-demand only), the persist **scope** (`package` = artifacts reused across versions; `version` = per published version), and whether a freshness policy is set. A control-plane-managed package (manifestLocation set) is refreshed by the control plane, not the standalone scheduler, so leave its cadence alone.\n\n## Step 2: Read the materialization history\n\nThe history is where cost lives. Each run records its trigger, timing, and how many sources were built vs reused.\n\n- **For one package** (newest first). A materialization is a run of one package's persist sources, so this is the listing; to review a whole environment, read each package in turn (`malloy-pub list package --environment <env>` names them):\n\n  ```bash\n  malloy-pub list materialization --environment <env> --package <pkg>\n  ```\n\n  Columns: ID, Status, **Trigger** (`SCHEDULER` vs `ON_DEMAND`), Started, Completed, Error.\n\n- **A single run's detail** (the cost signals):\n\n  ```bash\n  malloy-pub get materialization <id> --environment <env> --package <pkg>\n  ```\n\n  In the JSON, read:\n  - `metadata.durationMs`: how long the build took.\n  - `metadata.sourcesBuilt` vs `metadata.sourcesReused`: how much work each run actually did. A run that is nearly all _reused_ is cheap; one that is nearly all _built_ every time is where cost accumulates.\n  - `metadata.trigger`: `SCHEDULER` (a cron fired it) or `ON_DEMAND`.\n  - `manifest.entries[*]`: the persisted sources: `sourceName`, `physicalTableName`, `realization`.\n\nLook across several runs, not one: the pattern over the recent history (how often it rebuilds, how much it reuses, how long it takes) is the signal.\n\n## Step 3: Analyze and recommend\n\nWeigh rebuild cost against query benefit. Common findings:\n\n- **Persist candidate:** an expensive, frequently-queried source that is _not_ persisted (recomputed on every query). Recommend adding `#@ persist name=\"…\"`. Strongest when the source is a heavy aggregate/join reused by many queries and its inputs change slowly. If the source carries an `#(authorize)` gate, check which case it is first. A gate reached only through a `join_*`, or inherited from a base it cannot be attributed to, makes the colocated persist **refuse with a 422** - so do not recommend persisting it at all. Where the gate is provably the source's own row filter the persist is admitted, and then only recommend it alongside a freshness window (`freshness.fallback=\"live\"`): the gating column freezes at build time, so without one a revoked row can be served under its old access decision indefinitely (see `skill:malloy-materialization`, which also covers where that window does and does not bind).\n- **Removal candidate:** a persisted source that is cheap to compute, rarely queried, or rebuilt far more often than it is read. Recommend dropping the `#@ persist` annotation (and its table): the storage + rebuild cost is not buying anything.\n- **Cadence mismatch:** a `SCHEDULER` cadence out of step with how fast the data changes or how long a build takes. If most scheduled runs are all-reused (nothing changed), the cron is too frequent, so loosen it. If queries routinely read stale data, tighten it. If the build's `durationMs` approaches the interval, the cadence is too aggressive.\n- **Scope mismatch:** `scope: version` re-materializes per published version (right when versions must be isolated, e.g. a schedule); `scope: package` reuses one lineage across versions (cheaper when versions can share). A schedule _requires_ `version`. If a package carries a schedule it does not need, clearing the schedule frees it to use the cheaper package scope.\n\nFrame each recommendation with the evidence from Step 2 (the run IDs, timings, built/reused counts) so the user can judge it.\n\n## Step 4: Apply (only once approved)\n\n- **Add a persist source:** add the `#@ persist` annotation in the `.malloy` file (use the modeling workflow to validate and reload), then rebuild so it is materialized:\n\n  ```bash\n  malloy-pub materialize --environment <env> --package <pkg> --wait\n  ```\n\n- **Remove a persist source:** delete the `#@ persist` annotation, then drop the old run's tables **before** rebuilding what remains:\n\n  ```bash\n  malloy-pub delete materialization <id> --environment <env> --package <pkg> --drop-tables\n  malloy-pub materialize --environment <env> --package <pkg> --wait\n  ```\n\n  > `--drop-tables` drops **every** physical table in that run's manifest, not just the removed source's: auto-run assigns stable table names and carries unchanged sources forward, so an old run's manifest names tables a newer manifest still serves. Do the drop **first, then rebuild**: `materialize --wait` re-creates every source that is still persisted, ending in the desired state. Dropping a run whose tables the current serving manifest depends on, without an immediate rebuild, breaks queries (`Table ... does not exist`).\n\n- **Change the schedule / cadence:**\n\n  ```bash\n  malloy-pub schedule set \"0 6 * * *\" --environment <env> --package <pkg>   # 5-field UTC cron\n  malloy-pub schedule clear --environment <env> --package <pkg>\n  ```\n\n  `set` also sets `scope: version` (a schedule requires it); the server rejects an invalid cron or an illegal scope/freshness combination, so a rejection means the change was unsafe.\n\n- **Change the scope:** `scope` is declared in the package's `publisher.json` under `materialization` (`\"scope\": \"package\"` or `\"version\"`; the root-level form is deprecated but still read). Edit it there, then reload/republish the package. Remember a schedule pins scope to `version`, so clear the schedule first if moving to `package`.\n\nAfter applying, re-run Step 2 on the next few builds to confirm the change did what you predicted (more reuse, shorter builds, or a table that is actually read).\n\n## What this skill does not do\n\n- It does not decide for the user or apply changes silently; every edit needs an explicit go-ahead.\n- It cannot see per-query read counts (the open-source Publisher records build history, not query-level table usage), so \"rarely queried\" is a judgment from the model and the user's knowledge, not a measured metric. Say so when it matters."
     },
     {
       name: "malloy-model",
@@ -324296,8 +324629,8 @@ function initializeMcpServer(environmentStore) {
 init_config();
 init_logger();
 import * as fs10 from "fs";
-import * as os3 from "os";
-import * as path13 from "path";
+import * as os4 from "os";
+import * as path14 from "path";
 var MCP_CONFIG_FILENAME = ".mcp.json";
 function malloyServer(endpoint) {
   return { type: "http", url: endpoint };
@@ -324321,11 +324654,11 @@ function mcpEndpoint(host, port) {
   return `http://${host}:${port}/mcp`;
 }
 function findGitWorkTreeRoot(dir) {
-  let current = path13.resolve(dir);
+  let current = path14.resolve(dir);
   for (;; ) {
-    if (fs10.existsSync(path13.join(current, ".git")))
+    if (fs10.existsSync(path14.join(current, ".git")))
       return current;
-    const parent = path13.dirname(current);
+    const parent = path14.dirname(current);
     if (parent === current)
       return;
     current = parent;
@@ -324348,7 +324681,7 @@ function mcpConfigEnabled() {
 }
 function ensureMcpConfig(options) {
   const { dir, endpoint, requestedPort, boundPort, homeDir } = options;
-  const file = path13.join(dir, MCP_CONFIG_FILENAME);
+  const file = path14.join(dir, MCP_CONFIG_FILENAME);
   try {
     const existing = (() => {
       try {
@@ -324375,18 +324708,18 @@ function ensureMcpConfig(options) {
       try {
         return fs10.realpathSync(p);
       } catch {
-        return path13.resolve(p);
+        return path14.resolve(p);
       }
     };
-    if (realish(dir) === realish(homeDir ?? os3.homedir())) {
+    if (realish(dir) === realish(homeDir ?? os4.homedir())) {
       return { action: "skipped-home", dir, endpoint, staleConfig };
     }
-    if (path13.resolve(dir) === path13.parse(path13.resolve(dir)).root) {
+    if (path14.resolve(dir) === path14.parse(path14.resolve(dir)).root) {
       return { action: "skipped-root", dir, endpoint, staleConfig };
     }
     const gitRoot = findGitWorkTreeRoot(dir);
     if (gitRoot !== undefined) {
-      const rootCandidate = path13.join(gitRoot, MCP_CONFIG_FILENAME);
+      const rootCandidate = path14.join(gitRoot, MCP_CONFIG_FILENAME);
       return {
         action: "skipped-git",
         dir,
@@ -325427,9 +325760,9 @@ import {
   InMemoryURLReader as InMemoryURLReader3,
   Runtime as Runtime4
 } from "@malloydata/malloy";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "node:fs";
-import os4 from "node:os";
-import path14 from "node:path";
+import { mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, rmSync } from "node:fs";
+import os5 from "node:os";
+import path15 from "node:path";
 
 // src/service/build_query_tag.ts
 var MAX_QUERY_TAG_LENGTH = 2000;
@@ -325671,14 +326004,14 @@ ${buildSQL};`;
     }
     return row;
   }, parentJobId);
-  const path15 = [
+  const path16 = [
     str2(located.project) ?? handle,
     str2(located.dataset),
     str2(located.table)
   ].join(".");
   const jobId = str2(located.job_id);
   return {
-    selectSQL: `SELECT * FROM bigquery_scan('${escapeSQL(path15)}')`,
+    selectSQL: `SELECT * FROM bigquery_scan('${escapeSQL(path16)}')`,
     jobId,
     cost: bigQueryReadCost(located, jobId, parentJobId)
   };
@@ -325741,7 +326074,7 @@ function passthroughSourceType(sourceConnection) {
   throw new BadRequestError(`Cannot materialize a '${type}' source into a storage destination: the ` + `native query-passthrough build supports source connections of type ` + `${PASSTHROUGH_SOURCE_TYPES.join(", ")} only.`);
 }
 function createIsolatedBuildSession(sessionName) {
-  const workDir = mkdtempSync(path14.join(os4.tmpdir(), "malloy-build-"));
+  const workDir = mkdtempSync2(path15.join(os5.tmpdir(), "malloy-build-"));
   let session;
   try {
     session = new DuckDBConnection4(sessionName, ":memory:", workDir, {
@@ -325794,10 +326127,13 @@ async function buildSourceIntoStorage(params) {
     environmentPath,
     queryMetadata
   } = params;
+  const federate = params.deps?.federate ?? federateSourceForPassthrough;
+  const read = params.deps?.read ?? issuePassthroughRead;
   assertSupportedDestination(destinationName, destinationConnection);
   const sourceType = passthroughSourceType(sourceConnection);
   const { session, dispose, workDir } = createIsolatedBuildSession(`build_${destinationName}`);
   let federatedHandle;
+  let federatedClose;
   try {
     await applySessionResourceLimits(session, { tempDirectory: workDir });
     await attachDestinationReadWrite(session, destinationName, destinationConnection, environmentPath);
@@ -325805,7 +326141,8 @@ async function buildSourceIntoStorage(params) {
       await session.runSQL("SET ducklake_default_data_inlining_row_limit=0");
     }
     await pinSessionToUTC(session);
-    const federated = await federateSourceForPassthrough(session, sourceType, sourceFederationConfig(sourceConnection));
+    const federated = await federate(session, sourceType, sourceFederationConfig(sourceConnection));
+    federatedClose = federated.close;
     await tagSnowflakeSession(session, sourceType, federated.handle, queryMetadata);
     const target = quoteManifestTablePath(`${destinationName}.${physicalTableName}`, STORAGE_TARGET_DIALECT);
     if (params.incremental) {
@@ -325824,8 +326161,8 @@ async function buildSourceIntoStorage(params) {
         };
       }
     }
-    const read = await issuePassthroughRead(session, sourceType, federated.handle, buildSQL, queryMetadata);
-    const schema = await createTableAndDescribe(session, target, read.selectSQL);
+    const passthrough = await read(session, sourceType, federated.handle, buildSQL, queryMetadata);
+    const schema = await createTableAndDescribe(session, target, passthrough.selectSQL);
     const seededThrough = await params.incremental?.afterSeed({
       session,
       quotedTablePath: target
@@ -325834,11 +326171,14 @@ async function buildSourceIntoStorage(params) {
       seededThrough,
       storageDestinationName: destinationName,
       schema,
-      readCost: read.cost ?? await snowflakeReadCostAfterBuild(session, sourceType, federated.handle, buildSQL, queryMetadata, sourceConnection.snowflakeConnection?.database)
+      readCost: passthrough.cost ?? await snowflakeReadCostAfterBuild(session, sourceType, federated.handle, buildSQL, queryMetadata, sourceConnection.snowflakeConnection?.database)
     };
   } finally {
     await clearSnowflakeSessionTag(session, sourceType, federatedHandle);
     await dispose();
+    if (federatedClose) {
+      await federatedClose().catch((e) => logger.warn(`Failed to close the SSH proxy a storage build federated through: ${String(e)}`));
+    }
   }
 }
 async function buildDownstreamIntoStorage(params) {
@@ -325943,7 +326283,7 @@ async function attachDestinationReadWrite(session, destinationName, destinationC
   }
   const destinationRoot = storageDestinationRoot(environmentPath);
   mkdirSync3(destinationRoot, { recursive: true });
-  const dbPath = path14.join(destinationRoot, `${destinationName}.duckdb`);
+  const dbPath = path15.join(destinationRoot, `${destinationName}.duckdb`);
   await session.runSQL(`ATTACH '${escapeSQL(dbPath)}' AS ${quoteIdentifier(destinationName, STORAGE_TARGET_DIALECT)}`);
 }
 function assertSupportedDestination(destinationName, destinationConnection) {
@@ -325957,7 +326297,8 @@ function sourceFederationConfig(sourceConnection) {
     name: sourceConnection.name ?? "src",
     bigqueryConnection: sourceConnection.bigqueryConnection,
     snowflakeConnection: sourceConnection.snowflakeConnection,
-    postgresConnection: sourceConnection.postgresConnection
+    postgresConnection: sourceConnection.postgresConnection,
+    proxy: sourceConnection.proxy
   };
 }
 async function createTableAndDescribe(session, quotedTablePath, selectSQL) {
@@ -326053,7 +326394,7 @@ function storageDeltaTarget(params) {
 init_connection();
 init_materialization_serve_transform();
 init_quoting();
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/service/resolve_environment.ts
@@ -326246,10 +326587,6 @@ class MaterializationService {
     const environmentId = await this.resolveEnvironmentId(environmentName);
     return this.repository.listMaterializations(environmentId, packageName, options);
   }
-  async listEnvironmentMaterializations(environmentName, options) {
-    const environmentId = await this.resolveEnvironmentId(environmentName);
-    return this.repository.listMaterializationsByEnvironment(environmentId, options);
-  }
   async getLatestScheduledFireAt(environmentName, packageName) {
     const environmentId = await this.resolveEnvironmentId(environmentName);
     return this.repository.getLatestScheduledFireAt(environmentId, packageName);
@@ -327352,7 +327689,7 @@ class MaterializationService {
       return;
     let text;
     try {
-      text = readFileSync3(fileURLToPath7(location.url), "utf8");
+      text = readFileSync4(fileURLToPath7(location.url), "utf8");
     } catch {
       return;
     }
@@ -327869,7 +328206,7 @@ var import_debug2 = __toESM(require_src5(), 1);
 import { isIPv6 } from "node:net";
 import { isIPv6 as isIPv62 } from "node:net";
 import { Buffer as Buffer3 } from "node:buffer";
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { isIP } from "node:net";
 var ipv4CompatibleSubnet = new import_ip_address.Address6("::/96");
 function ipKeyGenerator(ip, ipv6Subnet = 56) {
@@ -327978,7 +328315,7 @@ var getResetSeconds = (windowMs, resetTime) => {
   return resetSeconds;
 };
 var getPartitionKey = (key) => {
-  const hash = createHash4("sha256");
+  const hash = createHash6("sha256");
   hash.update(key);
   const partitionKey = hash.digest("hex").slice(0, 12);
   return Buffer3.from(partitionKey).toString("base64");
@@ -328660,8 +328997,8 @@ var MCP_ENDPOINT = "/mcp";
 var SHUTDOWN_DRAIN_DURATION_SECONDS = Number(process.env.SHUTDOWN_DRAIN_DURATION_SECONDS || 0);
 var SHUTDOWN_GRACEFUL_CLOSE_TIMEOUT_SECONDS = Number(process.env.SHUTDOWN_GRACEFUL_CLOSE_TIMEOUT_SECONDS || 0);
 var __filename_esm = fileURLToPath8(import.meta.url);
-var ROOT = path15.join(path15.dirname(__filename_esm), "app");
-var SERVER_ROOT = path15.resolve(process.cwd(), process.env.SERVER_ROOT || ".");
+var ROOT = path16.join(path16.dirname(__filename_esm), "app");
+var SERVER_ROOT = path16.resolve(process.cwd(), process.env.SERVER_ROOT || ".");
 var API_PREFIX2 = "/api/v0";
 var isDevelopment = process.env["NODE_ENV"] === "development";
 var app = import_express.default();
@@ -328768,7 +329105,7 @@ mcpApp.all(MCP_ENDPOINT, async (req, res) => {
     }
   }
 });
-var PUBLISHER_RUNTIME_PATH = path15.join(path15.dirname(__filename_esm), "runtime", "publisher.js");
+var PUBLISHER_RUNTIME_PATH = path16.join(path16.dirname(__filename_esm), "runtime", "publisher.js");
 app.get("/sdk/publisher.js", (_req, res) => {
   res.type("application/javascript");
   res.setHeader("cache-control", "public, max-age=60");
@@ -328797,7 +329134,7 @@ async function serveFromPackage(req, res) {
   try {
     const environment = await environmentStore.getEnvironment(req.params.environmentName, false);
     const pkg = await environment.getPackage(req.params.packageName, false);
-    const publicRoot = path15.join(pkg.getPackagePath(), "public");
+    const publicRoot = path16.join(pkg.getPackagePath(), "public");
     let subPath = subPathRaw;
     if (subPath === "" || subPath.endsWith("/")) {
       subPath = subPath + "index.html";
@@ -328815,12 +329152,12 @@ async function serveFromPackage(req, res) {
       }
       return;
     }
-    const rel = path15.relative(realPublicRoot, realFullPath);
-    if (rel.startsWith("..") || path15.isAbsolute(rel)) {
+    const rel = path16.relative(realPublicRoot, realFullPath);
+    if (rel.startsWith("..") || path16.isAbsolute(rel)) {
       res.status(403).end();
       return;
     }
-    const ext = path15.extname(realFullPath).toLowerCase();
+    const ext = path16.extname(realFullPath).toLowerCase();
     if (ext === ".html" || ext === ".htm") {
       const frameAncestors = process.env.PUBLISHER_FRAME_ANCESTORS || "*";
       res.setHeader("Content-Security-Policy", `frame-ancestors ${frameAncestors}`);
@@ -328886,20 +329223,20 @@ async function listPackageDataApps(environmentName, packageName, publicRoot) {
     for (const entry of entries) {
       if (entry.name.startsWith(".") || entry.name === "node_modules")
         continue;
-      const full = path15.join(dir, entry.name);
+      const full = path16.join(dir, entry.name);
       let realFull;
       try {
         realFull = await fs11.realpath(full);
       } catch {
         continue;
       }
-      const contained = path15.relative(realPublicRoot, realFull);
-      if (contained.startsWith("..") || path15.isAbsolute(contained))
+      const contained = path16.relative(realPublicRoot, realFull);
+      if (contained.startsWith("..") || path16.isAbsolute(contained))
         continue;
       if (entry.isDirectory()) {
         await walk2(full, depth + 1);
       } else if (entry.isFile() && (entry.name.endsWith(".html") || entry.name.endsWith(".htm"))) {
-        const rel = path15.relative(publicRoot, full).replace(/\\/g, "/");
+        const rel = path16.relative(publicRoot, full).replace(/\\/g, "/");
         let title = rel;
         let fit;
         try {
@@ -328944,14 +329281,14 @@ async function listPackageDataApps(environmentName, packageName, publicRoot) {
 }
 if (!isDevelopment) {
   app.use("/", import_express.default.static(ROOT));
-  app.use("/api-doc.html", import_express.default.static(path15.join(ROOT, "api-doc.html")));
+  app.use("/api-doc.html", import_express.default.static(path16.join(ROOT, "api-doc.html")));
 } else {
   app.use(`${API_PREFIX2}`, loggerMiddleware);
   app.use(import_http_proxy_middleware.createProxyMiddleware({
     target: "http://localhost:5173",
     changeOrigin: true,
     ws: true,
-    pathFilter: (path16) => !path16.startsWith("/api/") && !path16.startsWith("/metrics") && !path16.startsWith("/health")
+    pathFilter: (path17) => !path17.startsWith("/api/") && !path17.startsWith("/metrics") && !path17.startsWith("/health")
   }));
 }
 var setVersionIdError2 = (res) => {
@@ -328976,7 +329313,7 @@ app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/data
   try {
     const environment = await environmentStore.getEnvironment(req.params.environmentName, false);
     const pkg = await environment.getPackage(req.params.packageName, false);
-    const dataApps = await listPackageDataApps(req.params.environmentName, req.params.packageName, path15.join(pkg.getPackagePath(), "public"));
+    const dataApps = await listPackageDataApps(req.params.environmentName, req.params.packageName, path16.join(pkg.getPackagePath(), "public"));
     res.json(dataApps);
   } catch (error) {
     logger.error("Failed to list package data apps", { error });
@@ -329349,17 +329686,6 @@ app.post(`${API_PREFIX2}/environments/:environmentName/packages`, async (req, re
     res.status(status).json(json);
   }
 });
-app.get(`${API_PREFIX2}/environments/:environmentName/packages/materializations`, async (req, res) => {
-  try {
-    const limit = parseNonNegativeIntParam(req.query.limit);
-    const offset = parseNonNegativeIntParam(req.query.offset);
-    const builds = await materializationController.listEnvironmentMaterializations(req.params.environmentName, { limit, offset });
-    res.status(200).json(builds);
-  } catch (error) {
-    const { json, status } = internalErrorToHttpError(error);
-    res.status(status).json(json);
-  }
-});
 app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName`, async (req, res) => {
   if (req.query.versionId) {
     setVersionIdError2(res);
@@ -329422,6 +329748,30 @@ app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/mode
     res.status(status).json(json);
   }
 });
+app.put(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/models/*?`, async (req, res) => {
+  if (req.query.versionId) {
+    setVersionIdError2(res);
+    return;
+  }
+  try {
+    const result = await dashboardController.putDashboardSource(req.params.environmentName, req.params.packageName, req.params["0"], req.body);
+    res.status(result.created ? 201 : 200).json(result);
+  } catch (error) {
+    const { json, status } = internalErrorToHttpError(error);
+    const detail = {
+      environmentName: req.params.environmentName,
+      packageName: req.params.packageName,
+      modelPath: req.params["0"],
+      status,
+      error
+    };
+    if (status >= 500)
+      logger.error("Dashboard write failed", detail);
+    else
+      logger.warn("Dashboard write refused", detail);
+    res.status(status).json(json);
+  }
+});
 app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/dashboards`, async (req, res) => {
   if (req.query.versionId) {
     setVersionIdError2(res);
@@ -329641,7 +329991,7 @@ registerLegacyRoutes(app, {
   materializationController
 });
 if (!isDevelopment) {
-  const SPA_INDEX = path15.resolve(ROOT, "index.html");
+  const SPA_INDEX = path16.resolve(ROOT, "index.html");
   const escapeHtml = (value) => value.replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c] ?? c);
   const decodeSegment = (segment) => {
     if (segment === undefined)