@malloy-publisher/server 0.9.0 → 0.9.1

package/dist/server.mjs

@@ -205143,9 +205143,54 @@ function logInternalFailure(summary, error2, level = "error") {
     }
   });
 }
-function internalErrorToHttpError(error2) {
+function filesystemAccessFailure(error2) {
+  let current = error2;
+  for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    const errno = current;
+    if (typeof errno.code === "string" && errno.code in FILESYSTEM_ACCESS_DESCRIPTIONS && typeof errno.syscall === "string") {
+      return errno;
+    }
+    current = errno.cause;
+  }
+  return;
+}
+function describeFilesystemAccessFailure(errno) {
+  const code = errno.code ?? "";
+  const target = errno.path ? ` '${errno.path}'` : "";
+  return `${code}: ${FILESYSTEM_ACCESS_DESCRIPTIONS[code] ?? code}, ${errno.syscall}${target}`;
+}
+function messageWithFilesystemCause(error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  const access = filesystemAccessFailure(error2);
+  if (!access || message.includes(access.code ?? ""))
+    return message;
+  return `${message}: ${describeFilesystemAccessFailure(access)}`;
+}
+function errnoWireFields(error2) {
+  const { code, syscall, path } = error2;
+  if (typeof code !== "string")
+    return;
+  return {
+    code,
+    ...typeof syscall === "string" ? { syscall } : {},
+    ...typeof path === "string" ? { path } : {}
+  };
+}
+function internalErrorToHttpError(error2, { log = true } = {}) {
+  const logInternal = (...args) => {
+    if (log)
+      logInternalFailure(...args);
+  };
+  const access = filesystemAccessFailure(error2);
+  if (access) {
+    logInternal("Filesystem access refused", error2, "warn");
+    return httpError(500, `The server cannot access a path it needs (${describeFilesystemAccessFailure(access)}). ` + `Give the user the server runs as access to it.`);
+  }
   if (error2 instanceof BadRequestError) {
     return httpError(400, error2.message);
+  } else if (error2 instanceof ServerConfigurationError) {
+    logInternal("Server configuration error", error2, "warn");
+    return httpError(500, error2.message);
   } else if (error2 instanceof FrozenConfigError) {
     return httpError(403, error2.message);
   } else if (error2 instanceof AccessDeniedError) {
@@ -205191,7 +205236,7 @@ function internalErrorToHttpError(error2) {
     if (error2.callerSafe) {
       return httpError(502, error2.message);
     }
-    logInternalFailure("Upstream connection error", error2, "warn");
+    logInternal("Upstream connection error", error2, "warn");
     return httpError(502, GENERIC_UPSTREAM_MESSAGE);
   } else if (error2 instanceof MaterializationNotFoundError) {
     return httpError(404, error2.message);
@@ -205202,7 +205247,7 @@ function internalErrorToHttpError(error2) {
   } else if (error2 instanceof WriteConflictError) {
     return httpError(409, error2.message);
   } else if (error2 instanceof WriteRolledBackError) {
-    logInternalFailure("Dashboard write rolled back", error2, "warn");
+    logInternal("Dashboard write rolled back", error2, "warn");
     return httpError(500, error2.message);
   } else if (error2 instanceof ServiceUnavailableError) {
     return httpError(503, error2.message);
@@ -205213,7 +205258,7 @@ function internalErrorToHttpError(error2) {
   } else if (error2 instanceof NotImplementedError) {
     return httpError(501, error2.message);
   } else {
-    logInternalFailure("Unhandled internal error", error2);
+    logInternal("Unhandled internal error", error2);
     return httpError(500, GENERIC_INTERNAL_MESSAGE);
   }
 }
@@ -205235,10 +205280,15 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, PublisherConfigError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
+  FILESYSTEM_ACCESS_DESCRIPTIONS = {
+    EACCES: "permission denied",
+    EPERM: "operation not permitted",
+    EROFS: "read-only file system"
+  };
   NotImplementedError = class NotImplementedError extends Error {
     constructor(message) {
       super(message);
@@ -205259,8 +205309,8 @@ var init_errors = __esm(() => {
     }
   };
   PackageNotFoundError = class PackageNotFoundError extends Error {
-    constructor(message) {
-      super(message);
+    constructor(message, options) {
+      super(message, options);
     }
   };
   ModelNotFoundError = class ModelNotFoundError extends Error {
@@ -205331,6 +205381,12 @@ var init_errors = __esm(() => {
       this.cause = cause;
     }
   };
+  ServerConfigurationError = class ServerConfigurationError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ServerConfigurationError";
+    }
+  };
   FrozenConfigError = class FrozenConfigError extends Error {
     constructor(message = `Publisher config can't be updated when ${PUBLISHER_CONFIG_NAME} has { "frozenConfig": true }`) {
       super(message);
@@ -205388,8 +205444,8 @@ var init_errors = __esm(() => {
     }
   };
   ServiceUnavailableError = class ServiceUnavailableError extends Error {
-    constructor(message) {
-      super(message);
+    constructor(message, options) {
+      super(message, options);
     }
   };
   PayloadTooLargeError = class PayloadTooLargeError extends Error {
@@ -293869,6 +293925,26 @@ var init_gcp_impersonation = __esm(() => {
   impersonatedClients = new Map;
 });
 
+// src/service/google_credentials.ts
+import * as fs4 from "fs";
+function assertGoogleCredentialsIsNotADirectory() {
+  const keyFile = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+  if (!keyFile)
+    return;
+  let isDirectory = false;
+  try {
+    isDirectory = fs4.statSync(keyFile).isDirectory();
+  } catch {
+    return;
+  }
+  if (isDirectory) {
+    throw new ServerConfigurationError(`GOOGLE_APPLICATION_CREDENTIALS names a directory, not a key file: '${keyFile}'. ` + `A bind mount whose source path does not exist creates a directory there; ` + `mount the key file itself.`);
+  }
+}
+var init_google_credentials = __esm(() => {
+  init_errors();
+});
+
 // src/service/quoting.ts
 function bareTableName(tableName) {
   const lastDot = tableName.lastIndexOf(".");
@@ -293923,7 +293999,7 @@ import {
 } from "@malloydata/malloy";
 import { createHash } from "crypto";
 import { mkdtempSync, readFileSync, writeFileSync } from "fs";
-import fs4 from "fs/promises";
+import fs5 from "fs/promises";
 import os2 from "os";
 import path4 from "path";
 import tls from "tls";
@@ -294762,8 +294838,8 @@ async function deleteDuckLakeConnectionFile(connectionName, environmentPath) {
   assertSafeEnvironmentPath(environmentPath);
   const ducklakePath = safeJoinUnderRoot(environmentPath, `${connectionName}_ducklake.duckdb`);
   try {
-    await fs4.access(ducklakePath);
-    await fs4.rm(ducklakePath);
+    await fs5.access(ducklakePath);
+    await fs5.rm(ducklakePath);
     logger.info(`Removed DuckLake connection file ${connectionName}_ducklake.duckdb from ${environmentPath}`);
   } catch (error2) {
     if (error2.code === "ENOENT") {
@@ -295154,7 +295230,10 @@ async function testConnectionConfig(connectionConfig) {
     if (connectionConfig.type === "duckdb" || connectionConfig.type === "ducklake") {
       assertSafePackageName(connectionConfig.name);
     }
-    testRoot = await fs4.mkdtemp(path4.join(os2.tmpdir(), "publisher-conn-test-"));
+    if (connectionConfig.type === "bigquery" && !connectionConfig.bigqueryConnection?.serviceAccountKeyJson) {
+      assertGoogleCredentialsIsNotADirectory();
+    }
+    testRoot = await fs5.mkdtemp(path4.join(os2.tmpdir(), "publisher-conn-test-"));
     environmentConfig = buildEnvironmentMalloyConfig([connectionConfig], testRoot);
     const connection = await environmentConfig.malloyConfig.connections.lookupConnection(connectionConfig.name);
     if (connectionConfig.type === "duckdb") {
@@ -295198,7 +295277,7 @@ async function testConnectionConfig(connectionConfig) {
     }
     if (testRoot) {
       try {
-        await fs4.rm(testRoot, { recursive: true, force: true });
+        await fs5.rm(testRoot, { recursive: true, force: true });
       } catch (cleanupError) {
         logger.warn("Error cleaning up connection test directory", {
           error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
@@ -295218,6 +295297,7 @@ var init_connection = __esm(() => {
   init_path_safety();
   init_connection_config();
   init_gcp_impersonation();
+  init_google_credentials();
   init_gcs_s3_utils();
   init_proxy();
   init_quoting();
@@ -302725,7 +302805,7 @@ var require_table = __commonJS((exports) => {
   var Big = require_big();
   var extend3 = require_extend();
   var events_1 = __require("events");
-  var fs5 = __require("fs");
+  var fs6 = __require("fs");
   var is = require_is();
   var path5 = __require("path");
   var streamEvents = require_stream_events();
@@ -303035,7 +303115,7 @@ var require_table = __commonJS((exports) => {
         if (!metadata.sourceFormat && detectedFormat) {
           metadata.sourceFormat = detectedFormat;
         }
-        const jobWritable = fs5.createReadStream(source).pipe(this.createWriteStream_(metadata));
+        const jobWritable = fs6.createReadStream(source).pipe(this.createWriteStream_(metadata));
         const [jobResponse] = await (0, events_1.once)(jobWritable, "job");
         return [jobResponse, jobResponse.metadata];
       }
@@ -316476,9 +316556,9 @@ var init_dashboard = __esm(() => {
 var require_pump = __commonJS((exports, module) => {
   var once = require_once2();
   var eos = require_end_of_stream4();
-  var fs5;
+  var fs6;
   try {
-    fs5 = __require("fs");
+    fs6 = __require("fs");
   } catch (e2) {}
   var noop3 = function() {};
   var ancient = typeof process === "undefined" ? false : /^v?\.0/.test(process.version);
@@ -316488,9 +316568,9 @@ var require_pump = __commonJS((exports, module) => {
   var isFS = function(stream4) {
     if (!ancient)
       return false;
-    if (!fs5)
+    if (!fs6)
       return false;
-    return (stream4 instanceof (fs5.ReadStream || noop3) || stream4 instanceof (fs5.WriteStream || noop3)) && isFn(stream4.close);
+    return (stream4 instanceof (fs6.ReadStream || noop3) || stream4 instanceof (fs6.WriteStream || noop3)) && isFn(stream4.close);
   };
   var isRequest3 = function(stream4) {
     return stream4.setHeader && isFn(stream4.abort);
@@ -316705,7 +316785,7 @@ var require_pend = __commonJS((exports, module) => {
 
 // ../../node_modules/fd-slicer/index.js
 var require_fd_slicer = __commonJS((exports) => {
-  var fs5 = __require("fs");
+  var fs6 = __require("fs");
   var util6 = __require("util");
   var stream4 = __require("stream");
   var Readable4 = stream4.Readable;
@@ -316730,7 +316810,7 @@ var require_fd_slicer = __commonJS((exports) => {
   FdSlicer.prototype.read = function(buffer, offset, length, position, callback) {
     var self2 = this;
     self2.pend.go(function(cb) {
-      fs5.read(self2.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
+      fs6.read(self2.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
         cb();
         callback(err, bytesRead, buffer2);
       });
@@ -316739,7 +316819,7 @@ var require_fd_slicer = __commonJS((exports) => {
   FdSlicer.prototype.write = function(buffer, offset, length, position, callback) {
     var self2 = this;
     self2.pend.go(function(cb) {
-      fs5.write(self2.fd, buffer, offset, length, position, function(err, written, buffer2) {
+      fs6.write(self2.fd, buffer, offset, length, position, function(err, written, buffer2) {
         cb();
         callback(err, written, buffer2);
       });
@@ -316762,7 +316842,7 @@ var require_fd_slicer = __commonJS((exports) => {
     if (self2.refCount < 0)
       throw new Error("invalid unref");
     if (self2.autoClose) {
-      fs5.close(self2.fd, onCloseDone);
+      fs6.close(self2.fd, onCloseDone);
     }
     function onCloseDone(err) {
       if (err) {
@@ -316801,7 +316881,7 @@ var require_fd_slicer = __commonJS((exports) => {
       if (self2.destroyed)
         return cb();
       var buffer = new Buffer(toRead);
-      fs5.read(self2.context.fd, buffer, 0, toRead, self2.pos, function(err, bytesRead) {
+      fs6.read(self2.context.fd, buffer, 0, toRead, self2.pos, function(err, bytesRead) {
         if (err) {
           self2.destroy(err);
         } else if (bytesRead === 0) {
@@ -316851,7 +316931,7 @@ var require_fd_slicer = __commonJS((exports) => {
     self2.context.pend.go(function(cb) {
       if (self2.destroyed)
         return cb();
-      fs5.write(self2.context.fd, buffer, 0, buffer.length, self2.pos, function(err2, bytes) {
+      fs6.write(self2.context.fd, buffer, 0, buffer.length, self2.pos, function(err2, bytes) {
         if (err2) {
           self2.destroy();
           cb();
@@ -317276,7 +317356,7 @@ var require_buffer_crc32 = __commonJS((exports, module) => {
 
 // ../../node_modules/yauzl/index.js
 var require_yauzl = __commonJS((exports) => {
-  var fs5 = __require("fs");
+  var fs6 = __require("fs");
   var zlib3 = __require("zlib");
   var fd_slicer = require_fd_slicer();
   var crc32 = require_buffer_crc32();
@@ -317313,12 +317393,12 @@ var require_yauzl = __commonJS((exports) => {
       options.strictFileNames = false;
     if (callback == null)
       callback = defaultCallback;
-    fs5.open(path7, "r", function(err, fd) {
+    fs6.open(path7, "r", function(err, fd) {
       if (err)
         return callback(err);
       fromFd(fd, options, function(err2, zipfile) {
         if (err2)
-          fs5.close(fd, defaultCallback);
+          fs6.close(fd, defaultCallback);
         callback(err2, zipfile);
       });
     });
@@ -317342,7 +317422,7 @@ var require_yauzl = __commonJS((exports) => {
       options.strictFileNames = false;
     if (callback == null)
       callback = defaultCallback;
-    fs5.fstat(fd, function(err, stats) {
+    fs6.fstat(fd, function(err, stats) {
       if (err)
         return callback(err);
       var reader = fd_slicer.createFromFd(fd, { autoClose: true });
@@ -317975,7 +318055,7 @@ var require_yauzl = __commonJS((exports) => {
 // ../../node_modules/extract-zip/index.js
 var require_extract_zip = __commonJS((exports, module) => {
   var debug = require_src5()("extract-zip");
-  var { createWriteStream, promises: fs5 } = __require("fs");
+  var { createWriteStream, promises: fs6 } = __require("fs");
   var getStream = require_get_stream();
   var path7 = __require("path");
   var { promisify: promisify2 } = __require("util");
@@ -318017,8 +318097,8 @@ var require_extract_zip = __commonJS((exports, module) => {
           }
           const destDir = path7.dirname(path7.join(this.opts.dir, entry.fileName));
           try {
-            await fs5.mkdir(destDir, { recursive: true });
-            const canonicalDestDir = await fs5.realpath(destDir);
+            await fs6.mkdir(destDir, { recursive: true });
+            const canonicalDestDir = await fs6.realpath(destDir);
             const relativeDestDir = path7.relative(this.opts.dir, canonicalDestDir);
             if (relativeDestDir.split(path7.sep).includes("..")) {
               throw new Error(`Out of bound path "${canonicalDestDir}" found while processing file ${entry.fileName}`);
@@ -318063,7 +318143,7 @@ var require_extract_zip = __commonJS((exports, module) => {
         mkdirOptions.mode = procMode;
       }
       debug("mkdir", { dir: destDir, ...mkdirOptions });
-      await fs5.mkdir(destDir, mkdirOptions);
+      await fs6.mkdir(destDir, mkdirOptions);
       if (isDir)
         return;
       debug("opening read stream", dest);
@@ -318071,7 +318151,7 @@ var require_extract_zip = __commonJS((exports, module) => {
       if (symlink) {
         const link = await getStream(readStream2);
         debug("creating symlink", link, dest);
-        await fs5.symlink(link, dest);
+        await fs6.symlink(link, dest);
       } else {
         await pipeline2(readStream2, createWriteStream(dest, { mode: procMode }));
       }
@@ -318103,8 +318183,8 @@ var require_extract_zip = __commonJS((exports, module) => {
     if (!path7.isAbsolute(opts.dir)) {
       throw new Error("Target directory is expected to be absolute");
     }
-    await fs5.mkdir(opts.dir, { recursive: true });
-    opts.dir = await fs5.realpath(opts.dir);
+    await fs6.mkdir(opts.dir, { recursive: true });
+    opts.dir = await fs6.realpath(opts.dir);
     return new Extractor(zipPath, opts).extract();
   };
 });
@@ -318200,9 +318280,80 @@ var require_dist17 = __commonJS((exports) => {
   exports.default = deferred;
 });
 
+// src/package_load/error_wire.ts
+import { MalloyError as MalloyError3 } from "@malloydata/malloy";
+function serializeError(error2) {
+  const serialized = serializeErrorShape(error2);
+  const errno = error2 instanceof Error ? errnoWireFields(error2) : undefined;
+  return errno ? { ...serialized, errno } : serialized;
+}
+function serializeErrorShape(error2) {
+  if (error2 instanceof MalloyError3) {
+    return {
+      name: error2.name,
+      message: error2.message,
+      stack: error2.stack,
+      malloyProblems: error2.problems,
+      isCompilationError: true
+    };
+  }
+  if (error2 instanceof ModelCompilationError) {
+    return {
+      name: error2.name,
+      message: error2.message,
+      stack: error2.stack,
+      isCompilationError: true
+    };
+  }
+  if (error2 instanceof PackageManifestError) {
+    return {
+      name: error2.name,
+      message: error2.message,
+      stack: error2.stack,
+      isManifestError: true
+    };
+  }
+  if (error2 instanceof Error) {
+    return {
+      name: error2.name,
+      message: error2.message,
+      stack: error2.stack
+    };
+  }
+  return { name: "Error", message: String(error2) };
+}
+function deserializeError(serialized) {
+  const err = new Error(serialized.message);
+  err.name = serialized.name;
+  if (serialized.stack)
+    err.stack = serialized.stack;
+  if (serialized.errno)
+    Object.assign(err, serialized.errno);
+  if (serialized.malloyProblems) {
+    err.problems = serialized.malloyProblems;
+  }
+  if (serialized.isCompilationError) {
+    const wrapped = new ModelCompilationError(err);
+    if (serialized.stack)
+      wrapped.stack = serialized.stack;
+    return wrapped;
+  }
+  if (serialized.isManifestError) {
+    const manifestError = new PackageManifestError(serialized.message);
+    if (serialized.stack)
+      manifestError.stack = serialized.stack;
+    return manifestError;
+  }
+  return err;
+}
+var init_error_wire = __esm(() => {
+  init_errors();
+});
+
 // src/package_load/package_load_pool.ts
 var exports_package_load_pool = {};
 __export(exports_package_load_pool, {
+  serializeError: () => serializeError,
   getPackageLoadWorkerCount: () => getPackageLoadWorkerCount,
   getPackageLoadPool: () => getPackageLoadPool,
   deserializeError: () => deserializeError,
@@ -318636,38 +318787,6 @@ function adaptResult(result) {
     timings: result.timings
   };
 }
-function serializeError(error2) {
-  if (error2 instanceof Error) {
-    return {
-      name: error2.name,
-      message: error2.message,
-      stack: error2.stack
-    };
-  }
-  return { name: "Error", message: String(error2) };
-}
-function deserializeError(serialized) {
-  const err = new Error(serialized.message);
-  err.name = serialized.name;
-  if (serialized.stack)
-    err.stack = serialized.stack;
-  if (serialized.malloyProblems) {
-    err.problems = serialized.malloyProblems;
-  }
-  if (serialized.isCompilationError) {
-    const wrapped = new ModelCompilationError(err);
-    if (serialized.stack)
-      wrapped.stack = serialized.stack;
-    return wrapped;
-  }
-  if (serialized.isManifestError) {
-    const manifestError = new PackageManifestError(serialized.message);
-    if (serialized.stack)
-      manifestError.stack = serialized.stack;
-    return manifestError;
-  }
-  return err;
-}
 function getPackageLoadPool() {
   if (singleton === null) {
     const n = getPackageLoadWorkerCount();
@@ -318684,8 +318803,9 @@ async function __setPackageLoadPoolForTests(pool) {
 }
 var PACKAGE_LOAD_JOB_TIMEOUT_MS, WORKER_SPAWN_TIMEOUT_MS = 30000, defaultUrlReader, singleton = null;
 var init_package_load_pool = __esm(() => {
-  init_errors();
   init_logger();
+  init_error_wire();
+  init_error_wire();
   PACKAGE_LOAD_JOB_TIMEOUT_MS = (() => {
     const raw = process.env.PACKAGE_LOAD_JOB_TIMEOUT_MS;
     if (raw === undefined)
@@ -318697,10 +318817,10 @@ var init_package_load_pool = __esm(() => {
   })();
   defaultUrlReader = {
     readURL: async (url2) => {
-      const { promises: fs5 } = await import("fs");
+      const { promises: fs6 } = await import("fs");
       const { fileURLToPath: fileURLToPath4 } = await import("url");
       const filePath = url2.protocol === "file:" ? fileURLToPath4(url2) : url2.toString();
-      return fs5.readFile(filePath, "utf8");
+      return fs6.readFile(filePath, "utf8");
     }
   };
 });
@@ -318873,7 +318993,7 @@ var init_materialization_metrics = __esm(() => {
 });
 
 // src/utils.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as path8 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function ignoreDotfiles(file) {
@@ -318890,7 +319010,7 @@ var init_utils4 = __esm(() => {
       if (url2.protocol == "file:") {
         path9 = fileURLToPath4(url2);
       }
-      return fs5.promises.readFile(path9, "utf8");
+      return fs6.promises.readFile(path9, "utf8");
     }
   };
 });
@@ -324019,7 +324139,7 @@ import {
   InMemoryURLReader as InMemoryURLReader2,
   isSourceDef as isSourceDef9,
   MalloyConfig as MalloyConfig2,
-  MalloyError as MalloyError4,
+  MalloyError as MalloyError5,
   Annotations as Annotations6,
   modelDefToModelInfo as modelDefToModelInfo2,
   Runtime as Runtime2
@@ -324028,7 +324148,7 @@ import {
   MalloySQLParser,
   MalloySQLStatementType
 } from "@malloydata/malloy-sql";
-import * as fs7 from "fs/promises";
+import * as fs8 from "fs/promises";
 import { readFileSync as readFileSync2 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import * as path10 from "path";
@@ -324086,7 +324206,7 @@ async function compileErrorOf(runnable) {
     await runnable.getPreparedQuery();
     return;
   } catch (error2) {
-    return error2 instanceof MalloyError4 ? error2 : undefined;
+    return error2 instanceof MalloyError5 ? error2 : undefined;
   }
 }
 function bindingsAllowDegradeToLive(bindings) {
@@ -325418,7 +325538,7 @@ var init_model = __esm(() => {
         if (error2 instanceof Error && error2.stack) {
           logger.error("Error stack", error2.stack);
         }
-        if (error2 instanceof MalloyError4) {
+        if (error2 instanceof MalloyError5) {
           const problems = error2.problems;
           for (const problem of problems) {
             logger.error("Problem", problem);
@@ -325704,7 +325824,7 @@ var init_model = __esm(() => {
         await runnable.getPreparedQuery();
         compiledSource = await this.resolveAuthorizeSourceFromRunnable(runnable);
       } catch (error2) {
-        if (error2 instanceof MalloyError4 || error2 instanceof ModelCompilationError) {
+        if (error2 instanceof MalloyError5 || error2 instanceof ModelCompilationError) {
           return;
         }
         throw error2;
@@ -326269,7 +326389,7 @@ var init_model = __esm(() => {
     async getQueryResults(sourceName, queryName, query, filterParams, bypassFilters, givens, abortSignal, queryMetadataInput, responseShape = "full", bypassAuthorize = false, includeHiddenFilesAndSources = false) {
       const startTime = performance.now();
       if (this.compilationError) {
-        if (this.compilationError instanceof MalloyError4 || this.compilationError instanceof ModelCompilationError) {
+        if (this.compilationError instanceof MalloyError5 || this.compilationError instanceof ModelCompilationError) {
           throw this.compilationError;
         }
         throw new BadRequestError(`Model compilation failed: ${this.compilationError.message}`);
@@ -326415,7 +326535,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
         if (error2 instanceof FilterValidationError) {
           throw new BadRequestError(error2.message);
         }
-        if (error2 instanceof MalloyError4) {
+        if (error2 instanceof MalloyError5) {
           throw error2;
         }
         const errorMessage = error2 instanceof Error ? error2.message : String(error2);
@@ -326523,7 +326643,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
             });
             throw new BadRequestError(err instanceof Error ? err.message : String(err));
           }
-          if (err instanceof MalloyError4) {
+          if (err instanceof MalloyError5) {
             throw err;
           }
           const errorMessage = err instanceof Error ? err.message : String(err);
@@ -326851,7 +326971,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
         recordNotebookCellExecution(this.notebookFormat(), kind, "ok", performance.now() - started);
         return result;
       } catch (error2) {
-        recordNotebookCellExecution(this.notebookFormat(), kind, error2 instanceof AccessDeniedError ? "denied" : error2 instanceof NotQueryableError ? "not_queryable" : error2 instanceof BadRequestError || error2 instanceof MalloyError4 ? "bad_request" : "error", performance.now() - started);
+        recordNotebookCellExecution(this.notebookFormat(), kind, error2 instanceof AccessDeniedError ? "denied" : error2 instanceof NotQueryableError ? "not_queryable" : error2 instanceof BadRequestError || error2 instanceof MalloyError5 ? "bad_request" : "error", performance.now() - started);
         throw error2;
       }
     }
@@ -326963,7 +327083,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
             });
             throw new BadRequestError(error2 instanceof Error ? error2.message : String(error2));
           }
-          if (error2 instanceof MalloyError4) {
+          if (error2 instanceof MalloyError5) {
             throw error2;
           }
           if (error2 instanceof PayloadTooLargeError) {
@@ -327007,7 +327127,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
         throw new ModelNotFoundError(`${modelPath} does not exist.`);
       }
       try {
-        if (!(await fs7.stat(fullModelPath)).isFile()) {
+        if (!(await fs8.stat(fullModelPath)).isFile()) {
           throw new ModelNotFoundError(`${modelPath} is not a file.`);
         }
       } catch {
@@ -327111,7 +327231,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
       let fileContents = undefined;
       let parse5 = undefined;
       try {
-        fileContents = await fs7.readFile(modelURL, "utf8");
+        fileContents = await fs8.readFile(modelURL, "utf8");
       } catch {
         throw new ModelNotFoundError("Model not found: " + modelPath);
       }
@@ -327205,7 +327325,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
     async getFileText(packagePath) {
       const fullPath = path10.join(packagePath, this.modelPath);
       try {
-        return await fs7.readFile(fullPath, "utf8");
+        return await fs8.readFile(fullPath, "utf8");
       } catch {
         throw new ModelNotFoundError(`Model file not found: ${this.modelPath}`);
       }
@@ -328192,7 +328312,7 @@ var require_minimatch = __commonJS((exports, module) => {
 
 // ../../node_modules/recursive-readdir/index.js
 var require_recursive_readdir = __commonJS((exports, module) => {
-  var fs8 = __require("fs");
+  var fs9 = __require("fs");
   var p2 = __require("path");
   var minimatch = require_minimatch();
   function patternMatcher(pattern) {
@@ -328226,7 +328346,7 @@ var require_recursive_readdir = __commonJS((exports, module) => {
     }
     ignores = ignores.map(toMatcherFunction);
     var list = [];
-    fs8.readdir(path11, function(err, files) {
+    fs9.readdir(path11, function(err, files) {
       if (err) {
         return callback(err);
       }
@@ -328236,7 +328356,7 @@ var require_recursive_readdir = __commonJS((exports, module) => {
       }
       files.forEach(function(file) {
         var filePath = p2.join(path11, file);
-        fs8.stat(filePath, function(_err, stats) {
+        fs9.stat(filePath, function(_err, stats) {
           if (_err) {
             return callback(_err);
           }
@@ -346985,12 +347105,12 @@ var require_dist19 = __commonJS((exports, module) => {
       throw new Error(`Unknown format "${name}"`);
     return f3;
   };
-  function addFormats(ajv, list, fs11, exportName) {
+  function addFormats(ajv, list, fs12, exportName) {
     var _a2;
     var _b;
     (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== undefined || (_b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`);
     for (const f3 of list)
-      ajv.addFormat(f3, fs11[f3]);
+      ajv.addFormat(f3, fs12[f3]);
   }
   module.exports = exports = formatsPlugin;
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -356704,6 +356824,7 @@ init_errors();
 init_logger();
 init_gcs_s3_utils();
 init_gcp_impersonation();
+init_google_credentials();
 init_introspection_sql();
 var import_bigquery = __toESM(require_src144(), 1);
 import { ClientSecretCredential } from "@azure/identity";
@@ -356767,6 +356888,7 @@ async function createBigQueryClient(connection) {
       throw new Error("BigQuery project ID is required. Either set the defaultProjectId in the connection configuration or the project_id in the service account key JSON.");
     }
   } else if (Object.keys(connection.bigqueryConnection).length === 0 && process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+    assertGoogleCredentialsIsNotADirectory();
     config2.keyFilename = process.env.GOOGLE_APPLICATION_CREDENTIALS || "";
   } else {
     throw new Error("BigQuery connection is required, either set the bigqueryConnection in the connection configuration or set the GOOGLE_APPLICATION_CREDENTIALS environment variable.");
@@ -364842,11 +364964,21 @@ class PackageController {
     const packageName = body.name;
     const environment = await this.environmentStore.getEnvironment(environmentName, false);
     let result;
-    if (body.location) {
-      const bodyLocation = body.location;
-      result = await environment.installPackage(packageName, (stagingPath) => this.downloadInto(environmentName, packageName, bodyLocation, stagingPath), (pkg) => formatPublishRejections(pkg));
-    } else {
-      result = await environment.addPackage(packageName);
+    try {
+      if (body.location) {
+        const bodyLocation = body.location;
+        result = await environment.installPackage(packageName, (stagingPath) => this.downloadInto(environmentName, packageName, bodyLocation, stagingPath), (pkg) => formatPublishRejections(pkg));
+      } else {
+        result = await environment.addPackage(packageName);
+      }
+    } catch (error2) {
+      const answered = internalErrorToHttpError(error2, {
+        log: false
+      });
+      if (answered.status >= 500) {
+        environment.recordPackageAddFailure(packageName, answered.json.message);
+      }
+      throw error2;
     }
     if (!result) {
       throw new Error(`Failed to create package ${packageName}`);
@@ -366556,7 +366688,7 @@ var import_client_s33 = __toESM(require_dist_cjs75(), 1);
 import { Storage as Storage2 } from "@google-cloud/storage";
 var import_extract_zip = __toESM(require_extract_zip(), 1);
 import crypto5 from "crypto";
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as os3 from "os";
 import * as path13 from "path";
 
@@ -372408,7 +372540,7 @@ class StorageManager {
 // src/service/environment.ts
 init_notebook();
 init_dashboard();
-import { MalloyError as MalloyError6, Runtime as Runtime3 } from "@malloydata/malloy";
+import { MalloyError as MalloyError7, Runtime as Runtime3 } from "@malloydata/malloy";
 
 // src/service/notebook_lint.ts
 init_dashboard();
@@ -372853,13 +372985,13 @@ init_errors();
 init_authorize();
 init_given();
 import crypto4 from "crypto";
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path12 from "path";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/service/compile_restriction.ts
 init_errors();
-import { Malloy, MalloyError as MalloyError3 } from "@malloydata/malloy";
+import { Malloy, MalloyError as MalloyError4 } from "@malloydata/malloy";
 var RESTRICTED_CONSTRUCT_CODE = "restricted-construct-forbidden";
 var SYNTAX_ERROR_CODE = "syntax-error";
 function isParseFailure(problem) {
@@ -372882,7 +373014,7 @@ async function assertNoRestrictedConstructs(runtime, model, source) {
     });
     problems = compiled.problems ?? [];
   } catch (error2) {
-    if (!(error2 instanceof MalloyError3))
+    if (!(error2 instanceof MalloyError4))
       throw error2;
     problems = error2.problems;
   }
@@ -372912,7 +373044,7 @@ init_connection_config();
 init_logger();
 var import_client_s32 = __toESM(require_dist_cjs75(), 1);
 import { Storage } from "@google-cloud/storage";
-import * as fs6 from "fs/promises";
+import * as fs7 from "fs/promises";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/storage/DatabaseInterface.ts
@@ -372948,9 +373080,9 @@ async function readManifestBytes(uri) {
     return res.Body.transformToString();
   }
   if (uri.startsWith("file://")) {
-    return fs6.readFile(fileURLToPath5(uri), "utf8");
+    return fs7.readFile(fileURLToPath5(uri), "utf8");
   }
-  return fs6.readFile(uri, "utf8");
+  return fs7.readFile(uri, "utf8");
 }
 async function fetchManifestEntries(uri) {
   const raw = await readManifestBytes(uri);
@@ -373009,7 +373141,7 @@ init_logger();
 init_notebook_metrics();
 init_materialization_metrics();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
-import * as fs8 from "fs/promises";
+import * as fs9 from "fs/promises";
 import * as path11 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import"@malloydata/db-duckdb/native";
@@ -373020,7 +373152,7 @@ import {
   EmptyURLReader,
   FixedConnectionMap as FixedConnectionMap2,
   MalloyConfig as MalloyConfig3,
-  MalloyError as MalloyError5
+  MalloyError as MalloyError6
 } from "@malloydata/malloy";
 
 // src/package_load_metrics.ts
@@ -373910,7 +374042,7 @@ function toTableNameManifest(entries) {
   return out;
 }
 function packageLoadFailureStatus(error2) {
-  if (error2 instanceof ModelCompilationError || error2 instanceof MalloyError5) {
+  if (error2 instanceof ModelCompilationError || error2 instanceof MalloyError6) {
     return "compilation_error";
   }
   if (error2 instanceof BadRequestError || error2 instanceof PackageManifestError) {
@@ -374100,11 +374232,11 @@ class Package {
         if (!cleanupDirectoryOnFailure) {
           logger.info(`Preserving existing package directory after failed load: ${packagePath}`);
         } else {
-          const stat7 = await fs8.lstat(packagePath).catch(() => null);
+          const stat7 = await fs9.lstat(packagePath).catch(() => null);
           if (stat7?.isSymbolicLink()) {
             logger.info(`Skipping cleanup of symlinked package path on failure: ${packagePath}`);
           } else {
-            await fs8.rm(packagePath, { recursive: true, force: true });
+            await fs9.rm(packagePath, { recursive: true, force: true });
             logger.info(`Cleaned up failed package directory: ${packagePath}`);
           }
         }
@@ -374126,10 +374258,10 @@ class Package {
       defaultConnectionName: "duckdb"
     }).catch((err) => {
       const realError = err instanceof Error ? err : new Error(`Package-load worker pool failure: ${String(err)}`);
-      if (realError instanceof MalloyError5 || realError instanceof ModelCompilationError || realError instanceof PackageManifestError) {
+      if (realError instanceof MalloyError6 || realError instanceof ModelCompilationError || realError instanceof PackageManifestError) {
         throw realError;
       }
-      throw new ServiceUnavailableError(`Package-load worker pool unavailable: ${realError.message}`);
+      throw new ServiceUnavailableError(`Package-load worker pool unavailable: ${realError.message}`, { cause: realError });
     });
     const [outcome, databases] = await Promise.all([
       workerOutcome,
@@ -374184,7 +374316,7 @@ class Package {
           });
         }
         if (sm.modelPath.endsWith(MODEL_FILE_SUFFIX)) {
-          const modelSource = await fs8.readFile(path11.join(packagePath, sm.modelPath), "utf-8");
+          const modelSource = await fs9.readFile(path11.join(packagePath, sm.modelPath), "utf-8");
           assertPersistNamesQuoted(modelSource, sm.modelPath);
         }
         models.set(sm.modelPath, model);
@@ -374804,10 +374936,10 @@ class Package {
       });
     } catch (err) {
       const realError = err instanceof Error ? err : new Error(`Package-load worker pool failure: ${String(err)}`);
-      if (realError instanceof MalloyError5 || realError instanceof ModelCompilationError || realError instanceof PackageManifestError) {
+      if (realError instanceof MalloyError6 || realError instanceof ModelCompilationError || realError instanceof PackageManifestError) {
         throw realError;
       }
-      throw new ServiceUnavailableError(`Package-load worker pool unavailable: ${realError.message}`);
+      throw new ServiceUnavailableError(`Package-load worker pool unavailable: ${realError.message}`, { cause: realError });
     }
     const nextModels = new Map;
     const renderTagWarnings = [];
@@ -374913,7 +375045,7 @@ class Package {
   }
   async claimsToBeADashboard(modelPath) {
     try {
-      const source = await fs8.readFile(safeJoinUnderRoot(this.packagePath, modelPath), "utf8");
+      const source = await fs9.readFile(safeJoinUnderRoot(this.packagePath, modelPath), "utf8");
       return hasArtifactLineOutsideBlocks(source, /^##?[ \t]*artifact\b/);
     } catch {
       return false;
@@ -374925,7 +375057,7 @@ class Package {
         return model.carriesNotebookArtifactNote();
       if (!model.getCompilationError())
         return false;
-      const source = await fs8.readFile(safeJoinUnderRoot(this.packagePath, modelPath), "utf8");
+      const source = await fs9.readFile(safeJoinUnderRoot(this.packagePath, modelPath), "utf8");
       return claimsToBeANotebook(source);
     } catch {
       return false;
@@ -375238,7 +375370,7 @@ class Package {
     const dir = safeJoinUnderRoot(this.packagePath, DASHBOARDS_DIR);
     let entries;
     try {
-      entries = await fs8.readdir(dir);
+      entries = await fs9.readdir(dir);
     } catch {
       return [];
     }
@@ -375344,8 +375476,11 @@ class Package {
   static async validatePackageManifestExistsOrThrowError(packagePath) {
     const packageConfigPath = safeJoinUnderRoot(packagePath, PACKAGE_MANIFEST_NAME);
     try {
-      await fs8.stat(packageConfigPath);
-    } catch {
+      await fs9.stat(packageConfigPath);
+    } catch (error2) {
+      const code = error2.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR")
+        throw error2;
       logger.error(`Can't find ${packageConfigPath}`);
       throw new PackageNotFoundError(`Package manifest for ${packagePath} does not exist.`);
     }
@@ -375477,6 +375612,7 @@ async function denyHiddenAsNotQueryable(convert, gate) {
     throw error2;
   }
 }
+var MAX_RECORDED_ADD_FAILURES = 100;
 
 class Environment {
   packages = new Map;
@@ -375484,6 +375620,7 @@ class Environment {
   packageStatuses = new Map;
   failedPackages = new Map;
   mountErrors = new Map;
+  recordedAddFailures = [];
   staleCompileErrors = new Map;
   malloyConfig;
   connectionMutex = new Mutex;
@@ -375523,11 +375660,11 @@ class Environment {
       return;
     const readmePath = path12.join(this.environmentPath, "README.md");
     try {
-      await fs9.promises.writeFile(readmePath, readme, "utf-8");
+      await fs10.promises.writeFile(readmePath, readme, "utf-8");
       logger.info(`Updated README.md for environment ${this.environmentName}`);
     } catch (err) {
       logger.error(`Failed to write README.md`, { error: err });
-      throw new Error(`Failed to update environment README`);
+      throw new Error(`Failed to update environment README`, { cause: err });
     }
   }
   async update(payload) {
@@ -375561,7 +375698,7 @@ class Environment {
   }
   static async create(environmentName, environmentPath, connections, storageDestinations = []) {
     assertSafeEnvironmentPath(environmentPath);
-    if (!(await fs9.promises.stat(environmentPath))?.isDirectory()) {
+    if (!(await fs10.promises.stat(environmentPath))?.isDirectory()) {
       throw new EnvironmentNotFoundError(`Environment path ${environmentPath} not found`);
     }
     logger.info(`Creating environment with connection configuration`);
@@ -375579,7 +375716,7 @@ class Environment {
   async reloadEnvironmentMetadata() {
     let readme = "";
     try {
-      readme = (await fs9.promises.readFile(safeJoinUnderRoot(this.environmentPath, README_NAME))).toString();
+      readme = (await fs10.promises.readFile(safeJoinUnderRoot(this.environmentPath, README_NAME))).toString();
     } catch {}
     this.metadata = {
       ...this.metadata,
@@ -375623,7 +375760,7 @@ class Environment {
       if (scope === "append") {
         let modelContent = "";
         try {
-          modelContent = await fs9.promises.readFile(modelPath, "utf8");
+          modelContent = await fs10.promises.readFile(modelPath, "utf8");
         } catch {}
         fullSource = modelContent ? `${modelContent}
 ${source}` : source ?? "";
@@ -375647,7 +375784,7 @@ ${source}` : source ?? "";
       const pkg = await this._loadOrGetPackageLocked(packageName);
       let { model: gateModel, exact: hasExactGateModel } = pkg.getCompileAuthorizationModel(modelName);
       if (!hasExactGateModel && source !== undefined) {
-        const diskTarget = await fs9.promises.stat(modelPath).catch(() => {
+        const diskTarget = await fs10.promises.stat(modelPath).catch(() => {
           return;
         });
         if (diskTarget?.isFile()) {
@@ -375701,7 +375838,7 @@ ${source}` : source ?? "";
               }, () => hasExactGateModel ? gateModel.assertAuthorizedForRunnable(finalQuery, givens ?? {}) : gateModel.assertAuthorizedFromCompiledRunnable(finalQuery, givens ?? {}));
             }
           } catch (error2) {
-            if (!(error2 instanceof MalloyError6))
+            if (!(error2 instanceof MalloyError7))
               throw error2;
           }
         }
@@ -375717,7 +375854,7 @@ ${source}` : source ?? "";
             replacement: source === undefined ? undefined : { modelPath: modelName, source }
           });
         } catch (error2) {
-          if (error2 instanceof MalloyError6 || error2 instanceof ModelCompilationError || error2 instanceof PackageManifestError) {
+          if (error2 instanceof MalloyError7 || error2 instanceof ModelCompilationError || error2 instanceof PackageManifestError) {
             throw error2;
           }
           throw new ServiceUnavailableError(`Package compile worker unavailable: ${error2 instanceof Error ? error2.message : String(error2)}`);
@@ -375756,7 +375893,7 @@ ${source}` : source ?? "";
               ], compiled.modelPath);
             }
           }
-          const lintText = !(isNotebookModelPath(compiled.modelPath) || isDashboardModelPath(compiled.modelPath)) ? undefined : compiled.modelSourceText ?? (compiled.modelPath === modelName && source !== undefined ? source : await fs9.promises.readFile(path12.join(packagePath, compiled.modelPath), "utf8").catch(() => {
+          const lintText = !(isNotebookModelPath(compiled.modelPath) || isDashboardModelPath(compiled.modelPath)) ? undefined : compiled.modelSourceText ?? (compiled.modelPath === modelName && source !== undefined ? source : await fs10.promises.readFile(path12.join(packagePath, compiled.modelPath), "utf8").catch(() => {
             return;
           }));
           if (lintText !== undefined) {
@@ -375786,7 +375923,7 @@ ${source}` : source ?? "";
             environment: this.environmentName,
             reason: "base_model_load_failed"
           });
-          if (error2 instanceof MalloyError6) {
+          if (error2 instanceof MalloyError7) {
             throw new CompileRefusedError(`Cannot validate the submitted source: the model ` + `"${modelName}" does not compile, so there is nothing ` + `to check the submitted source against. Problems: ` + error2.problems.map((p2) => p2.message).join("; "));
           }
           throw new CompileRefusedError(`Cannot validate the submitted source: the model ` + `"${modelName}" could not be loaded to check it against.`);
@@ -375829,7 +375966,7 @@ ${source}` : source ?? "";
             if (typeof givenCode === "string" && givenCode.startsWith("runtime-given-")) {
               throw new BadRequestError(error2 instanceof Error ? error2.message : String(error2));
             }
-            if (error2 instanceof MalloyError6) {
+            if (error2 instanceof MalloyError7) {
               throw error2;
             }
           }
@@ -375845,7 +375982,7 @@ ${source}` : source ?? "";
           sql
         };
       } catch (error2) {
-        if (error2 instanceof MalloyError6) {
+        if (error2 instanceof MalloyError7) {
           return {
             problems: tagProblems([
               ...error2.problems,
@@ -375898,7 +376035,7 @@ ${source}` : source ?? "";
     try {
       const destinationRoot = storageDestinationRoot(this.environmentPath);
       if (this.destinations.length > 0) {
-        fs9.mkdirSync(destinationRoot, { recursive: true });
+        fs10.mkdirSync(destinationRoot, { recursive: true });
       }
       this.destinationMalloyConfig = buildEnvironmentMalloyConfig(this.destinations, destinationRoot);
     } catch (error2) {
@@ -376019,7 +376156,7 @@ ${source}` : source ?? "";
   }
   async _readModelFileLocked(target) {
     try {
-      return await fs9.promises.readFile(target, "utf8");
+      return await fs10.promises.readFile(target, "utf8");
     } catch (error2) {
       if (error2.code !== "ENOENT")
         throw error2;
@@ -376027,10 +376164,10 @@ ${source}` : source ?? "";
     }
   }
   async _writeModelFileLocked(target, source) {
-    await fs9.promises.mkdir(path12.dirname(target), { recursive: true });
+    await fs10.promises.mkdir(path12.dirname(target), { recursive: true });
     const temporary = `${target}.${crypto4.randomUUID()}.tmp`;
-    await fs9.promises.writeFile(temporary, source, "utf8");
-    await fs9.promises.rename(temporary, target);
+    await fs10.promises.writeFile(temporary, source, "utf8");
+    await fs10.promises.rename(temporary, target);
   }
   async writeModelFileTransactional(packageName, modelPath, source, check2, verify) {
     assertSafePackageName(packageName);
@@ -376047,7 +376184,7 @@ ${source}` : source ?? "";
         if (previous !== undefined)
           await this._writeModelFileLocked(target, previous);
         else
-          await fs9.promises.rm(target, { force: true });
+          await fs10.promises.rm(target, { force: true });
         await this._loadOrGetPackageLocked(packageName, true).catch(() => {
           return;
         });
@@ -376075,7 +376212,7 @@ ${source}` : source ?? "";
       if (path12.basename(dir) !== dirName)
         continue;
       try {
-        await fs9.promises.rm(dir, { recursive: true, force: true });
+        await fs10.promises.rm(dir, { recursive: true, force: true });
       } catch (err) {
         logger.warn(`Failed to sweep stale ${dirName} dir at ${dir}`, {
           error: err
@@ -376181,7 +376318,7 @@ ${source}` : source ?? "";
   async addPackage(packageName, options = {}) {
     assertSafePackageName(packageName);
     const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
-    if (!await fs9.promises.access(packagePath).then(() => true).catch(() => false) || !(await fs9.promises.stat(packagePath))?.isDirectory()) {
+    if (!await fs10.promises.access(packagePath).then(() => true).catch(() => false) || !(await fs10.promises.stat(packagePath))?.isDirectory()) {
       throw new PackageNotFoundError(`Package ${packageName} not found`);
     }
     this.assertCanAdmitNewPackage(packageName, "add a new package", options.allowAdmission === true);
@@ -376213,7 +376350,7 @@ ${source}` : source ?? "";
   async installPackage(packageName, downloader, validate) {
     assertSafePackageName(packageName);
     const stagingPath = this.allocateStagingPath(packageName);
-    await fs9.promises.mkdir(path12.dirname(stagingPath), { recursive: true });
+    await fs10.promises.mkdir(path12.dirname(stagingPath), { recursive: true });
     logger.debug("install.phase1.download.started", {
       environmentName: this.environmentName,
       packageName,
@@ -376223,7 +376360,7 @@ ${source}` : source ?? "";
     try {
       await downloader(stagingPath);
     } catch (err) {
-      await fs9.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
+      await fs10.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
       throw err;
     }
     logger.debug("install.phase1.download.completed", {
@@ -376239,13 +376376,13 @@ ${source}` : source ?? "";
       const canonicalPath = safeJoinUnderRoot(this.environmentPath, packageName);
       let retiredPath;
       const oldPackage = this.packages.get(packageName);
-      const oldExistsOnDisk = await fs9.promises.access(canonicalPath).then(() => true).catch(() => false);
+      const oldExistsOnDisk = await fs10.promises.access(canonicalPath).then(() => true).catch(() => false);
       if (oldExistsOnDisk) {
         retiredPath = this.allocateRetiredPath(packageName);
-        await fs9.promises.mkdir(path12.dirname(retiredPath), {
+        await fs10.promises.mkdir(path12.dirname(retiredPath), {
           recursive: true
         });
-        await fs9.promises.rename(canonicalPath, retiredPath);
+        await fs10.promises.rename(canonicalPath, retiredPath);
         logger.debug("install.phase2.retired_old", {
           environmentName: this.environmentName,
           packageName,
@@ -376254,7 +376391,7 @@ ${source}` : source ?? "";
       }
       let newPackage;
       try {
-        await fs9.promises.rename(stagingPath, canonicalPath);
+        await fs10.promises.rename(stagingPath, canonicalPath);
         this.setPackageStatus(packageName, "loading" /* LOADING */);
         newPackage = await Package.create(this.environmentName, packageName, canonicalPath, () => this.malloyConfig.malloyConfig, true);
         this.attachDestinationServeConfig(newPackage);
@@ -376268,11 +376405,11 @@ ${source}` : source ?? "";
           canonicalPath
         });
       } catch (err) {
-        await fs9.promises.rm(canonicalPath, { recursive: true, force: true }).catch(() => {});
+        await fs10.promises.rm(canonicalPath, { recursive: true, force: true }).catch(() => {});
         let restored = false;
         if (retiredPath) {
           try {
-            await fs9.promises.rename(retiredPath, canonicalPath);
+            await fs10.promises.rename(retiredPath, canonicalPath);
             restored = true;
           } catch (restoreErr) {
             logger.error("Failed to restore retired package after install rollback", {
@@ -376282,7 +376419,7 @@ ${source}` : source ?? "";
             });
           }
         }
-        await fs9.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
+        await fs10.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
         if (oldPackage && restored) {
           this.setPackageStatus(packageName, "serving" /* SERVING */);
         } else {
@@ -376316,7 +376453,7 @@ ${source}` : source ?? "";
             packageName,
             retiredPath: pathToClean
           });
-          fs9.promises.rm(pathToClean, { recursive: true, force: true }).catch((err) => {
+          fs10.promises.rm(pathToClean, { recursive: true, force: true }).catch((err) => {
             logger.warn(`Failed to clean up retired package directory ${pathToClean}`, { error: err });
           });
         });
@@ -376449,7 +376586,7 @@ ${source}` : source ?? "";
     try {
       let existingManifest = {};
       try {
-        const content = await fs9.promises.readFile(manifestPath, "utf-8");
+        const content = await fs10.promises.readFile(manifestPath, "utf-8");
         existingManifest = JSON.parse(content);
       } catch (_err) {
         logger.warn(`Could not read manifest for ${packageName}`);
@@ -376477,11 +376614,11 @@ ${source}` : source ?? "";
           }
         } : {}
       };
-      await fs9.promises.writeFile(manifestPath, JSON.stringify(updatedManifest, null, 2), "utf-8");
+      await fs10.promises.writeFile(manifestPath, JSON.stringify(updatedManifest, null, 2), "utf-8");
       logger.info(`Updated publisher.json for ${packageName}`);
     } catch (error2) {
       logger.error(`Failed to update publisher.json`, { error: error2 });
-      throw new Error(`Failed to update package manifest`);
+      throw new Error(`Failed to update package manifest`, { cause: error2 });
     }
   }
   async updatePackage(packageName, body) {
@@ -376563,9 +376700,25 @@ ${source}` : source ?? "";
   setPackageMountError(packageName, message) {
     this.mountErrors.set(packageName, message);
   }
+  recordPackageAddFailure(packageName, message) {
+    if (this.packageStatuses.has(packageName))
+      return;
+    if (!this.mountErrors.has(packageName)) {
+      this.recordedAddFailures.push(packageName);
+      while (this.recordedAddFailures.length > MAX_RECORDED_ADD_FAILURES) {
+        const evicted = this.recordedAddFailures.shift();
+        if (evicted !== undefined)
+          this.mountErrors.delete(evicted);
+      }
+    }
+    this.mountErrors.set(packageName, message);
+  }
   clearPackageLoadFailure(packageName) {
     this.failedPackages.delete(packageName);
     this.mountErrors.delete(packageName);
+    const recorded = this.recordedAddFailures.indexOf(packageName);
+    if (recorded !== -1)
+      this.recordedAddFailures.splice(recorded, 1);
     this.staleCompileErrors.delete(packageName);
   }
   getFailedPackages() {
@@ -376610,10 +376763,10 @@ ${source}` : source ?? "";
       const retiredPath = this.allocateRetiredPath(packageName);
       let renamed = false;
       try {
-        await fs9.promises.mkdir(path12.dirname(retiredPath), {
+        await fs10.promises.mkdir(path12.dirname(retiredPath), {
           recursive: true
         });
-        await fs9.promises.rename(canonicalPath, retiredPath);
+        await fs10.promises.rename(canonicalPath, retiredPath);
         renamed = true;
       } catch (err) {
         logger.error("Error renaming package directory to retired during unload", {
@@ -376626,7 +376779,7 @@ ${source}` : source ?? "";
       this.packageStatuses.delete(packageName);
       if (renamed) {
         setImmediate(() => {
-          fs9.promises.rm(retiredPath, { recursive: true, force: true }).catch((err) => {
+          fs10.promises.rm(retiredPath, { recursive: true, force: true }).catch((err) => {
             logger.warn(`Failed to clean up retired package directory ${retiredPath}`, { error: err });
           });
         });
@@ -376712,7 +376865,7 @@ ${source}` : source ?? "";
   async deleteDuckDBConnection(connectionName) {
     const duckdbPath = path12.join(this.environmentPath, `${connectionName}.duckdb`);
     try {
-      await fs9.promises.rm(duckdbPath, { force: true });
+      await fs10.promises.rm(duckdbPath, { force: true });
       logger.info(`Removed DuckDB connection file ${connectionName} from environment ${this.environmentName}`);
     } catch (error2) {
       logger.error(`Failed to remove DuckDB connection file ${connectionName} from environment ${this.environmentName}`, { error: error2 });
@@ -376723,8 +376876,11 @@ ${source}` : source ?? "";
     logger.info(`Removed DuckLake connection ${connectionName} from environment ${this.environmentName}`);
   }
 }
+
+// src/service/environment_store.ts
+init_google_credentials();
 // package.json
-var version2 = "0.9.0";
+var version2 = "0.9.1";
 
 // src/version.ts
 var SERVER_VERSION = version2;
@@ -376778,11 +376934,11 @@ function validateEnvironmentAzureUrls(environment) {
 }
 async function clearMountTarget(targetPath) {
   try {
-    const stats = await fs10.promises.lstat(targetPath);
+    const stats = await fs11.promises.lstat(targetPath);
     if (stats.isDirectory() && !stats.isSymbolicLink()) {
-      await fs10.promises.rm(targetPath, { recursive: true, force: true });
+      await fs11.promises.rm(targetPath, { recursive: true, force: true });
     } else {
-      await fs10.promises.unlink(targetPath);
+      await fs11.promises.unlink(targetPath);
     }
   } catch {}
 }
@@ -376954,6 +377110,7 @@ class EnvironmentStore {
   environments = new Map;
   failedEnvironments = new Map;
   unconfiguredNotice = null;
+  initError = null;
   environmentMutexes = new Map;
   publisherConfigIsFrozen;
   finishedInitialization;
@@ -377037,7 +377194,7 @@ class EnvironmentStore {
         if (existingEnvironments.length > 0) {
           await Promise.all(existingEnvironments.map(async (dbEnvironment) => {
             try {
-              const environmentExists = await fs10.promises.access(dbEnvironment.path).then(() => true).catch(() => false);
+              const environmentExists = await fs11.promises.access(dbEnvironment.path).then(() => true).catch(() => false);
               const environmentConfig = environmentManifest.environments.find((p2) => p2.name === dbEnvironment.name);
               if (!environmentExists) {
                 if (environmentConfig) {
@@ -377113,6 +377270,7 @@ class EnvironmentStore {
       this.emitReadinessLine();
     } catch (error2) {
       markNotReady();
+      this.initError = redactPgSecrets(messageWithFilesystemCause(error2));
       const errorData = this.extractErrorDataFromError(error2);
       logger.error("Error initializing environment store", errorData);
       try {
@@ -377405,12 +377563,12 @@ class EnvironmentStore {
   }
   async cleanupAndCreatePublisherPath() {
     const reInit = process.env.INITIALIZE_STORAGE === "true";
-    await fs10.promises.mkdir(this.serverRootPath, { recursive: true });
+    await fs11.promises.mkdir(this.serverRootPath, { recursive: true });
     if (reInit) {
       const uploadDocsPath2 = path13.join(this.serverRootPath, PUBLISHER_DATA_DIR);
       logger.info(`Reinitialization mode: Cleaning up upload documents path ${uploadDocsPath2}`);
       try {
-        await fs10.promises.rm(uploadDocsPath2, {
+        await fs11.promises.rm(uploadDocsPath2, {
           recursive: true,
           force: true
         });
@@ -377425,7 +377583,7 @@ class EnvironmentStore {
       logger.info(`Using existing publisher path`);
     }
     const uploadDocsPath = path13.join(this.serverRootPath, PUBLISHER_DATA_DIR);
-    await fs10.promises.mkdir(uploadDocsPath, { recursive: true });
+    await fs11.promises.mkdir(uploadDocsPath, { recursive: true });
   }
   async listEnvironments(skipInitializationCheck = false) {
     if (!skipInitializationCheck) {
@@ -377503,6 +377661,9 @@ class EnvironmentStore {
     if (this.unconfiguredNotice && status.environments.length === 0) {
       status.emptyReason = this.unconfiguredNotice;
     }
+    if (this.initError) {
+      status.initError = this.initError;
+    }
     return status;
   }
   async getEnvironment(environmentName, reload = false) {
@@ -377575,9 +377736,6 @@ class EnvironmentStore {
       const loaded = await this.loadEnvironmentIntoDisk(environmentName, packagesToProcess);
       absoluteEnvironmentPath = loaded.path;
       mountErrors = loaded.mountErrors;
-      if (absoluteEnvironmentPath.endsWith(".zip")) {
-        absoluteEnvironmentPath = await this.unzipEnvironment(absoluteEnvironmentPath);
-      }
     } else {
       absoluteEnvironmentPath = await this.scaffoldEnvironment(environment);
     }
@@ -377604,41 +377762,44 @@ class EnvironmentStore {
   }
   async unzipEnvironment(absoluteEnvironmentPath) {
     assertSafeEnvironmentPath(absoluteEnvironmentPath);
-    const startedAt = Date.now();
-    logger.info(`Detected zip file at "${absoluteEnvironmentPath}". Unzipping...`);
     const archiveDir = path13.resolve(path13.dirname(absoluteEnvironmentPath));
     const unzippedEnvironmentPath = path13.resolve(archiveDir, path13.basename(absoluteEnvironmentPath, ".zip"));
     if (!unzippedEnvironmentPath.startsWith(archiveDir + path13.sep)) {
       throw new BadRequestError(`Refusing to unzip "${absoluteEnvironmentPath}": target escapes its directory`);
     }
-    await fs10.promises.rm(unzippedEnvironmentPath, {
+    await this.extractZipInto(absoluteEnvironmentPath, unzippedEnvironmentPath);
+    return unzippedEnvironmentPath;
+  }
+  async extractZipInto(archivePath, targetDir) {
+    const startedAt = Date.now();
+    logger.info(`Detected zip file at "${archivePath}". Unzipping...`);
+    await fs11.promises.rm(targetDir, {
       recursive: true,
       force: true
     });
-    await fs10.promises.mkdir(unzippedEnvironmentPath, { recursive: true });
+    await fs11.promises.mkdir(targetDir, { recursive: true });
     let entryCount = 0;
     let totalUncompressedBytes = 0;
     try {
-      await import_extract_zip.default(absoluteEnvironmentPath, {
-        dir: path13.resolve(unzippedEnvironmentPath),
+      await import_extract_zip.default(archivePath, {
+        dir: path13.resolve(targetDir),
         onEntry: (entry) => {
           if ((entry.externalFileAttributes >>> 16 & 61440) === 40960) {
-            throw new BadRequestError(`Refusing to unzip "${absoluteEnvironmentPath}": entry "${entry.fileName}" is a symbolic link`);
+            throw new BadRequestError(`Refusing to unzip "${archivePath}": entry "${entry.fileName}" is a symbolic link`);
           }
           entryCount += 1;
           totalUncompressedBytes += entry.uncompressedSize ?? 0;
         }
       });
     } catch (error2) {
-      await fs10.promises.rm(unzippedEnvironmentPath, {
+      await fs11.promises.rm(targetDir, {
         recursive: true,
         force: true
       });
       throw error2;
     }
     const mib = (totalUncompressedBytes / (1024 * 1024)).toFixed(1);
-    logger.info(`Unzipped "${absoluteEnvironmentPath}" -> "${unzippedEnvironmentPath}" ` + `(${entryCount} entries, ${mib} MiB uncompressed) in ` + `${formatDuration(Date.now() - startedAt)}`);
-    return unzippedEnvironmentPath;
+    logger.info(`Unzipped "${archivePath}" -> "${targetDir}" ` + `(${entryCount} entries, ${mib} MiB uncompressed) in ` + `${formatDuration(Date.now() - startedAt)}`);
   }
   async updateEnvironment(environment) {
     await this.finishedInitialization;
@@ -377676,7 +377837,7 @@ class EnvironmentStore {
     await this.deleteEnvironmentFromDatabase(environmentName);
     if (environmentPath) {
       try {
-        await fs10.promises.rm(environmentPath, {
+        await fs11.promises.rm(environmentPath, {
           recursive: true,
           force: true
         });
@@ -377697,7 +377858,7 @@ class EnvironmentStore {
         throw new PublisherConfigError(PUBLISHER_CONFIG_NAME, error2);
       } else {
         try {
-          const entries = await fs10.promises.readdir(serverRootPath, {
+          const entries = await fs11.promises.readdir(serverRootPath, {
             withFileTypes: true
           });
           const environments = [];
@@ -377730,9 +377891,9 @@ class EnvironmentStore {
     assertSafePackageName(environment.name);
     const environmentName = environment.name;
     const absoluteEnvironmentPath = safeJoinUnderRoot(this.serverRootPath, PUBLISHER_DATA_DIR, environmentName);
-    await fs10.promises.mkdir(absoluteEnvironmentPath, { recursive: true });
+    await fs11.promises.mkdir(absoluteEnvironmentPath, { recursive: true });
     if (environment.readme) {
-      await fs10.promises.writeFile(safeJoinUnderRoot(absoluteEnvironmentPath, "README.md"), environment.readme);
+      await fs11.promises.writeFile(safeJoinUnderRoot(absoluteEnvironmentPath, "README.md"), environment.readme);
     }
     return absoluteEnvironmentPath;
   }
@@ -377753,7 +377914,7 @@ class EnvironmentStore {
   }
   recordMountFailure(error2, location, packageNames, mountErrors) {
     logger.error(`Failed to download or mount location "${location}"`, this.extractErrorDataFromError(error2));
-    const message = redactPgSecrets(error2 instanceof Error ? error2.message : String(error2));
+    const message = redactPgSecrets(messageWithFilesystemCause(error2));
     for (const packageName of packageNames) {
       mountErrors.set(packageName, message);
     }
@@ -377762,7 +377923,7 @@ class EnvironmentStore {
     assertSafePackageName(environmentName);
     const absoluteTargetPath = safeJoinUnderRoot(this.serverRootPath, PUBLISHER_DATA_DIR, environmentName);
     const mountErrors = new Map;
-    await fs10.promises.mkdir(absoluteTargetPath, { recursive: true });
+    await fs11.promises.mkdir(absoluteTargetPath, { recursive: true });
     if (!packages || packages.length === 0) {
       throw new PackageNotFoundError(`No packages found for environment ${environmentName}`);
     }
@@ -377794,7 +377955,7 @@ class EnvironmentStore {
     for (const [groupedLocation, packagesForLocation] of locationGroups) {
       const locationHash = crypto5.createHash("sha256").update(groupedLocation).digest("hex").substring(0, 16);
       const tempDownloadPath = safeJoinUnderRoot(absoluteTargetPath, `.temp_${locationHash}`);
-      await fs10.promises.mkdir(tempDownloadPath, { recursive: true });
+      await fs11.promises.mkdir(tempDownloadPath, { recursive: true });
       logger.info(`Created temporary directory: ${tempDownloadPath}`);
       let downloaded = true;
       try {
@@ -377809,6 +377970,7 @@ class EnvironmentStore {
           const packageDir = _package.name;
           assertSafePackageName(packageDir);
           absolutePackagePath = safeJoinUnderRoot(absoluteTargetPath, packageDir);
+          const isLocalArchive = this.isLocalPath(_package.location) && _package.location.endsWith(".zip");
           let sourcePath;
           if (this.isGitHubURL(_package.location)) {
             const githubInfo = parseGitHubUrl(_package.location);
@@ -377823,30 +377985,32 @@ class EnvironmentStore {
               sourcePath = tempDownloadPath;
             }
           } else {
-            if (this.isLocalPath(_package.location)) {
+            if (isLocalArchive) {
+              sourcePath = tempDownloadPath;
+            } else if (this.isLocalPath(_package.location)) {
               sourcePath = this.resolveLocalPath(_package.location);
             } else {
               sourcePath = safeJoinUnderRoot(tempDownloadPath, groupedLocation);
             }
           }
-          const sourceExists = await fs10.promises.access(sourcePath).then(() => true).catch(() => false);
+          const sourceExists = await fs11.promises.access(sourcePath).then(() => true).catch(() => false);
           if (sourceExists) {
-            const isInPlace = this.inPlaceEnvs.has(environmentName) && this.isLocalPath(_package.location);
+            const isInPlace = this.inPlaceEnvs.has(environmentName) && this.isLocalPath(_package.location) && !isLocalArchive;
             if (isInPlace) {
               await clearMountTarget(absolutePackagePath);
               const absoluteSourcePath = path13.resolve(sourcePath);
               const linkType = process.platform === "win32" ? "junction" : "dir";
               try {
-                await fs10.promises.symlink(absoluteSourcePath, absolutePackagePath, linkType);
+                await fs11.promises.symlink(absoluteSourcePath, absolutePackagePath, linkType);
                 logger.info(`In-place mount (watch mode): linked package "${packageDir}" -> "${absoluteSourcePath}" (${++mountedCount}/${totalPackages})`);
               } catch (linkError) {
                 const code = linkError?.code ?? String(linkError);
                 logger.warn(`In-place mount failed for package "${packageDir}" (${code}); falling back to a copy. Source-edit live reload is disabled for this package.`);
                 await clearMountTarget(absolutePackagePath);
-                await fs10.promises.mkdir(absolutePackagePath, {
+                await fs11.promises.mkdir(absolutePackagePath, {
                   recursive: true
                 });
-                await fs10.promises.cp(sourcePath, absolutePackagePath, {
+                await fs11.promises.cp(sourcePath, absolutePackagePath, {
                   recursive: true
                 });
                 logger.info(`Copied package "${packageDir}" (${++mountedCount}/${totalPackages})`);
@@ -377854,22 +378018,24 @@ class EnvironmentStore {
             } else {
               if (this.inPlaceEnvs.has(environmentName) && !this.isLocalPath(_package.location)) {
                 logger.warn(`Watch mode: package "${packageDir}" has remote location "${_package.location}" — falling back to copy. Source-edit live reload won't work for this package; clone the source locally and use a local-dir location to enable it.`);
+              } else if (this.inPlaceEnvs.has(environmentName) && isLocalArchive) {
+                logger.warn(`Watch mode: package "${packageDir}" is an archive "${_package.location}" — extracted and copied. Source-edit live reload won't work for this package; use an unpacked local-dir location to enable it.`);
               }
               await clearMountTarget(absolutePackagePath);
-              await fs10.promises.mkdir(absolutePackagePath, {
+              await fs11.promises.mkdir(absolutePackagePath, {
                 recursive: true
               });
-              await fs10.promises.cp(sourcePath, absolutePackagePath, {
+              await fs11.promises.cp(sourcePath, absolutePackagePath, {
                 recursive: true
               });
               logger.info(`Extracted package "${packageDir}" from ${groupedLocation.startsWith("https://github.com/") && _package.location.includes("/tree/") ? "GitHub subdirectory" : "shared download"} (${++mountedCount}/${totalPackages})`);
             }
           } else {
             await clearMountTarget(absolutePackagePath);
-            await fs10.promises.mkdir(absolutePackagePath, {
+            await fs11.promises.mkdir(absolutePackagePath, {
               recursive: true
             });
-            await fs10.promises.cp(tempDownloadPath, absolutePackagePath, {
+            await fs11.promises.cp(tempDownloadPath, absolutePackagePath, {
               recursive: true
             });
             logger.info(`Copied entire download as package "${packageDir}" (${++mountedCount}/${totalPackages})`);
@@ -377882,7 +378048,7 @@ class EnvironmentStore {
         }
       }
       try {
-        await fs10.promises.rm(tempDownloadPath, {
+        await fs11.promises.rm(tempDownloadPath, {
           recursive: true,
           force: true
         });
@@ -377904,7 +378070,7 @@ class EnvironmentStore {
       } catch (error2) {
         const errorData = this.extractErrorDataFromError(error2);
         logger.error(`Failed to download GCS directory "${location}"`, errorData);
-        throw new PackageNotFoundError(`Failed to download GCS directory: ${location}`);
+        throw new PackageNotFoundError(`Failed to download GCS directory: ${location}`, { cause: error2 });
       }
     }
     if (this.isGitHubURL(location)) {
@@ -377918,7 +378084,7 @@ class EnvironmentStore {
       } catch (error2) {
         const errorData = this.extractErrorDataFromError(error2);
         logger.error(`Failed to clone GitHub repository "${location}"`, errorData);
-        throw new PackageNotFoundError(`Failed to clone GitHub repository: ${location}`);
+        throw new PackageNotFoundError(`Failed to clone GitHub repository: ${location}`, { cause: error2 });
       }
     }
     if (this.isS3URL(location)) {
@@ -377929,7 +378095,7 @@ class EnvironmentStore {
       } catch (error2) {
         const errorData = this.extractErrorDataFromError(error2);
         logger.error(`Failed to download S3 directory "${location}"`, errorData);
-        throw new PackageNotFoundError(`Failed to download S3 directory: ${location}`);
+        throw new PackageNotFoundError(`Failed to download S3 directory: ${location}`, { cause: error2 });
       }
     }
     if (this.isLocalPath(location)) {
@@ -377941,7 +378107,7 @@ class EnvironmentStore {
       } catch (error2) {
         const errorData = this.extractErrorDataFromError(error2);
         logger.error(`Failed to mount local directory "${packagePath}"`, errorData);
-        throw new PackageNotFoundError(`Failed to mount local directory: ${packagePath}`);
+        throw new PackageNotFoundError(`Failed to mount local directory: ${packagePath}`, { cause: error2 });
       }
     }
     const errorMsg = `Invalid package path: "${location}". Must be an absolute mounted path or a GCS/S3/GitHub URI.`;
@@ -377950,25 +378116,31 @@ class EnvironmentStore {
   }
   async mountLocalDirectory(environmentPath, absoluteTargetPath, environmentName, packageName) {
     assertSafeEnvironmentPath(absoluteTargetPath);
-    if (environmentPath.endsWith(".zip")) {
-      environmentPath = await this.unzipEnvironment(environmentPath);
-    }
-    const environmentDirExists = (await fs10.promises.stat(environmentPath))?.isDirectory() ?? false;
-    if (environmentDirExists) {
-      await fs10.promises.rm(absoluteTargetPath, {
+    const notFound = () => new PackageNotFoundError(`Package ${packageName} for environment ${environmentName} not found in "${environmentPath}"`);
+    const source = await fs11.promises.stat(environmentPath).catch((error2) => {
+      if (error2.code === "ENOENT") {
+        throw notFound();
+      }
+      throw error2;
+    });
+    if (environmentPath.endsWith(".zip") && source.isFile()) {
+      await this.extractZipInto(environmentPath, absoluteTargetPath);
+    } else if (source.isDirectory()) {
+      await fs11.promises.rm(absoluteTargetPath, {
         recursive: true,
         force: true
       });
-      await fs10.promises.mkdir(absoluteTargetPath, { recursive: true });
-      await fs10.promises.cp(environmentPath, absoluteTargetPath, {
+      await fs11.promises.mkdir(absoluteTargetPath, { recursive: true });
+      await fs11.promises.cp(environmentPath, absoluteTargetPath, {
         recursive: true
       });
     } else {
-      throw new PackageNotFoundError(`Package ${packageName} for environment ${environmentName} not found in "${environmentPath}"`);
+      throw notFound();
     }
   }
   async downloadGcsDirectory(gcsPath, environmentName, absoluteDirPath, isCompressedFile) {
     assertSafeEnvironmentPath(absoluteDirPath);
+    assertGoogleCredentialsIsNotADirectory();
     const trimmedPath = gcsPath.slice(5);
     const [bucketName, ...prefixParts] = trimmedPath.split("/");
     const prefix = prefixParts.join("/");
@@ -377979,11 +378151,11 @@ class EnvironmentStore {
       throw new EnvironmentNotFoundError(`Environment ${environmentName} not found in ${gcsPath}`);
     }
     if (!isCompressedFile) {
-      await fs10.promises.rm(absoluteDirPath, {
+      await fs11.promises.rm(absoluteDirPath, {
         recursive: true,
         force: true
       });
-      await fs10.promises.mkdir(absoluteDirPath, { recursive: true });
+      await fs11.promises.mkdir(absoluteDirPath, { recursive: true });
     } else {
       absoluteDirPath = `${absoluteDirPath}.zip`;
     }
@@ -377993,10 +378165,10 @@ class EnvironmentStore {
       if (file.name.endsWith("/")) {
         return;
       }
-      await fs10.promises.mkdir(path13.dirname(absoluteFilePath), {
+      await fs11.promises.mkdir(path13.dirname(absoluteFilePath), {
         recursive: true
       });
-      return fs10.promises.writeFile(absoluteFilePath, await file.download());
+      return fs11.promises.writeFile(absoluteFilePath, await file.download());
     }));
     if (isCompressedFile) {
       await this.unzipEnvironment(absoluteDirPath);
@@ -378010,7 +378182,7 @@ class EnvironmentStore {
     const prefix = prefixParts.join("/");
     if (isCompressedFile) {
       const zipFilePath = `${absoluteDirPath}.zip`;
-      await fs10.promises.mkdir(path13.dirname(zipFilePath), {
+      await fs11.promises.mkdir(path13.dirname(zipFilePath), {
         recursive: true
       });
       const command = new import_client_s33.GetObjectCommand({
@@ -378021,7 +378193,7 @@ class EnvironmentStore {
       if (!item.Body) {
         throw new EnvironmentNotFoundError(`Environment ${environmentName} not found in ${s3Path}`);
       }
-      const file = fs10.createWriteStream(zipFilePath);
+      const file = fs11.createWriteStream(zipFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
       await new Promise((resolve6, reject2) => {
         file.on("error", reject2);
@@ -378035,8 +378207,8 @@ class EnvironmentStore {
       Bucket: bucketName,
       Prefix: prefix
     });
-    await fs10.promises.rm(absoluteDirPath, { recursive: true, force: true });
-    await fs10.promises.mkdir(absoluteDirPath, { recursive: true });
+    await fs11.promises.rm(absoluteDirPath, { recursive: true, force: true });
+    await fs11.promises.mkdir(absoluteDirPath, { recursive: true });
     if (!objects.Contents || objects.Contents.length === 0) {
       throw new EnvironmentNotFoundError(`Environment ${environmentName} not found in ${s3Path}`);
     }
@@ -378050,7 +378222,7 @@ class EnvironmentStore {
         return;
       }
       const absoluteFilePath = safeJoinUnderRoot(absoluteDirPath, relativeFilePath);
-      await fs10.promises.mkdir(path13.dirname(absoluteFilePath), {
+      await fs11.promises.mkdir(path13.dirname(absoluteFilePath), {
         recursive: true
       });
       const command = new import_client_s33.GetObjectCommand({
@@ -378061,7 +378233,7 @@ class EnvironmentStore {
       if (!item.Body) {
         return;
       }
-      const file = fs10.createWriteStream(absoluteFilePath);
+      const file = fs11.createWriteStream(absoluteFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
       await new Promise((resolve6, reject2) => {
         file.on("error", reject2);
@@ -378078,11 +378250,11 @@ class EnvironmentStore {
     }
     const { owner, repoName, packagePath } = githubInfo;
     const cleanPackagePath = (packagePath?.replace("/tree/main", "") || "").replace(/^\/+/, "");
-    await fs10.promises.rm(absoluteDirPath, {
+    await fs11.promises.rm(absoluteDirPath, {
       recursive: true,
       force: true
     });
-    await fs10.promises.mkdir(absoluteDirPath, { recursive: true });
+    await fs11.promises.mkdir(absoluteDirPath, { recursive: true });
     const repoUrl = `https://github.com/${owner}/${repoName}`;
     const reporter = new CloneProgressReporter(cloneProgressLabel(`${owner}/${repoName}`, progressContext));
     await new Promise((resolve6, reject2) => {
@@ -378108,24 +378280,24 @@ class EnvironmentStore {
       return;
     }
     const packageFullPath = safeJoinUnderRoot(absoluteDirPath, cleanPackagePath);
-    const packageExists = await fs10.promises.access(packageFullPath).then(() => true).catch(() => false);
+    const packageExists = await fs11.promises.access(packageFullPath).then(() => true).catch(() => false);
     if (!packageExists) {
       throw new Error(`Package path "${cleanPackagePath}" does not exist in the cloned repository.`);
     }
-    const dirContents = await fs10.promises.readdir(absoluteDirPath);
+    const dirContents = await fs11.promises.readdir(absoluteDirPath);
     for (const entry of dirContents) {
       if (entry !== cleanPackagePath.replace(/^\/+/, "").split("/")[0]) {
-        await fs10.promises.rm(safeJoinUnderRoot(absoluteDirPath, entry), {
+        await fs11.promises.rm(safeJoinUnderRoot(absoluteDirPath, entry), {
           recursive: true,
           force: true
         });
       }
     }
-    const packageContents = await fs10.promises.readdir(packageFullPath);
+    const packageContents = await fs11.promises.readdir(packageFullPath);
     for (const entry of packageContents) {
-      await fs10.promises.rename(safeJoinUnderRoot(packageFullPath, entry), safeJoinUnderRoot(absoluteDirPath, entry));
+      await fs11.promises.rename(safeJoinUnderRoot(packageFullPath, entry), safeJoinUnderRoot(absoluteDirPath, entry));
     }
-    await fs10.promises.rm(packageFullPath, { recursive: true, force: true });
+    await fs11.promises.rm(packageFullPath, { recursive: true, force: true });
   }
   extractErrorDataFromError(error2) {
     const errorMessage = error2 instanceof Error ? error2.message : String(error2);
@@ -383337,7 +383509,8 @@ A JSON object with:
 - version: this server's release version.
 - environments: each environment's name with its loaded package names.
 - emptyReason (only present when the server found no config at startup, or the --config path was missing): why environments is empty, and the path it checked. The server still reports serving in that state.
-- loadErrors (only present when something failed): entries of {environment, package?, message, stale?, failedAt?}. An entry WITHOUT stale means the package (or whole environment, when package is absent) did not load and is missing from environments. An entry WITH stale: true means the package IS serving, but its most recent reload failed to compile, so the model answering queries is OLDER than the files on disk; the message says why. Fix the file and reload (reload_package) to clear it.
+- initError (only present when startup failed): why. The server stays at "initializing" and never serves; the cause is usually a config file it cannot read or parse, or a server root it cannot write (publisher.db). A package or environment that failed to load is under loadErrors instead.
+- loadErrors (only present when something failed): entries of {environment, package?, message, stale?, failedAt?}. An entry WITHOUT stale means the package (or whole environment, when package is absent) did not load and is missing from environments; that includes a package add that failed on the server's side. An entry WITH stale: true means the package IS serving, but its most recent reload failed to compile, so the model answering queries is OLDER than the files on disk; the message says why. Fix the file and reload (reload_package) to clear it.
 
 No loadErrors key means everything configured loaded and nothing is stale.`;
 function registerGetStatusTool(mcpServer, environmentStore) {
@@ -383356,6 +383529,9 @@ function registerGetStatusTool(mcpServer, environmentStore) {
         ...status.emptyReason !== undefined && {
           emptyReason: status.emptyReason
         },
+        ...status.initError !== undefined && {
+          initError: status.initError
+        },
         ...status.loadErrors !== undefined && {
           loadErrors: status.loadErrors
         }
@@ -395042,7 +395218,7 @@ function initializeMcpServer(environmentStore) {
 // src/mcp_config.ts
 init_config();
 init_logger();
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as os4 from "os";
 import * as path15 from "path";
 var MCP_CONFIG_FILENAME = ".mcp.json";
@@ -395070,7 +395246,7 @@ function mcpEndpoint(host, port) {
 function findGitWorkTreeRoot(dir) {
   let current = path15.resolve(dir);
   for (;; ) {
-    if (fs11.existsSync(path15.join(current, ".git")))
+    if (fs12.existsSync(path15.join(current, ".git")))
       return current;
     const parent = path15.dirname(current);
     if (parent === current)
@@ -395080,10 +395256,10 @@ function findGitWorkTreeRoot(dir) {
 }
 function conflictingMalloyUrl(file, endpoint) {
   try {
-    const stats = fs11.lstatSync(file);
+    const stats = fs12.lstatSync(file);
     if (!stats.isFile() || stats.size > 64 * 1024)
       return;
-    const parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
     const url2 = parsed?.mcpServers?.malloy?.url;
     return typeof url2 === "string" && url2 !== endpoint ? url2 : undefined;
   } catch {
@@ -395101,7 +395277,7 @@ function ensureMcpConfig(options) {
       try {
         return {
           path: file,
-          isSymlink: fs11.lstatSync(file).isSymbolicLink()
+          isSymlink: fs12.lstatSync(file).isSymbolicLink()
         };
       } catch {
         return;
@@ -395120,7 +395296,7 @@ function ensureMcpConfig(options) {
     }
     const realish = (p2) => {
       try {
-        return fs11.realpathSync(p2);
+        return fs12.realpathSync(p2);
       } catch {
         return path15.resolve(p2);
       }
@@ -395138,7 +395314,7 @@ function ensureMcpConfig(options) {
         action: "skipped-git",
         dir,
         gitRoot,
-        rootConfig: fs11.existsSync(rootCandidate) ? rootCandidate : undefined,
+        rootConfig: fs12.existsSync(rootCandidate) ? rootCandidate : undefined,
         endpoint,
         staleConfig
       };
@@ -395147,7 +395323,7 @@ function ensureMcpConfig(options) {
       return { action: "exists", file, endpoint };
     const body = JSON.stringify({ mcpServers: { malloy: malloyServer(endpoint) } }, null, 2) + `
 `;
-    fs11.writeFileSync(file, body, { encoding: "utf8", flag: "wx" });
+    fs12.writeFileSync(file, body, { encoding: "utf8", flag: "wx" });
     return { action: "created", file };
   } catch (error2) {
     const code = error2?.code;
@@ -399805,11 +399981,11 @@ function stripNonTagText(input) {
   return current;
 }
 async function listPackageDataApps(environmentName, packageName, publicRoot) {
-  const fs12 = await import("fs/promises");
+  const fs13 = await import("fs/promises");
   const out = [];
   let realPublicRoot;
   try {
-    realPublicRoot = await fs12.realpath(publicRoot);
+    realPublicRoot = await fs13.realpath(publicRoot);
   } catch {
     return out;
   }
@@ -399818,7 +399994,7 @@ async function listPackageDataApps(environmentName, packageName, publicRoot) {
       return;
     let entries;
     try {
-      entries = await fs12.readdir(dir, { withFileTypes: true });
+      entries = await fs13.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -399828,7 +400004,7 @@ async function listPackageDataApps(environmentName, packageName, publicRoot) {
       const full = path17.join(dir, entry.name);
       let realFull;
       try {
-        realFull = await fs12.realpath(full);
+        realFull = await fs13.realpath(full);
       } catch {
         continue;
       }
@@ -399842,7 +400018,7 @@ async function listPackageDataApps(environmentName, packageName, publicRoot) {
         let title = rel;
         let fit;
         try {
-          const fh = await fs12.open(full, "r");
+          const fh = await fs13.open(full, "r");
           try {
             const buf = Buffer.alloc(4096);
             const { bytesRead } = await fh.read(buf, 0, 4096, 0);