@malloy-publisher/server 0.9.5 → 0.9.6

package/dist/app/api-doc.yaml

@@ -5676,8 +5676,9 @@ components:
           type: string
           enum: [disable, no-verify, verify-ca, verify-full]
           description:
-            TLS mode for a connection reached through a `proxy` (SSH bastion).
-            Because the driver connects to a local tunnel endpoint, the cert
+            TLS mode for the connection. On a connection reached through a
+            `proxy` (SSH bastion), the driver connects to a local tunnel
+            endpoint, so the cert
             hostname can't be checked from the tunnel address alone; use
             `verify-full` to check it against the real host. `verify-ca`
             validates the server cert chain against the trusted CA bundle (e.g.
@@ -5694,9 +5695,20 @@ components:
             superset; it adds the hostname check without narrowing CA trust.
             The server defaults it to
             `no-verify` when a proxy is set (so a force-SSL target isn't rejected
-            for plaintext) — a server-applied default, not a schema default. Only
-            valid on a proxied connection — a direct connection uses the
-            deployment PGSSLMODE and rejects this field.
+            for plaintext) — a server-applied default, not a schema default. On
+            a direct connection the same modes apply against the configured
+            host; when omitted, the deployment PGSSLMODE applies. Ignored when
+            connectionString is set, which carries its own sslmode. Not applied
+            to a DuckLake catalog connection.
+        statementTimeoutMilliseconds:
+          type: integer
+          minimum: 1
+          maximum: 2147483647
+          description:
+            Maximum run time of each statement on the database, in
+            milliseconds. The database cancels a statement that exceeds it.
+            When omitted, the database's own statement_timeout applies. Not
+            applied to a DuckLake catalog connection.
 
     MysqlConnection:
       type: object

package/dist/package_load_worker.mjs

@@ -1115,7 +1115,7 @@ function installRecordPath(environmentPath, packageName) {
 function normalizeModelPath(p) {
   return p.replace(/\\/g, "/").replace(/^\.\//, "");
 }
-var API_PREFIX = "/api/v0", README_NAME = "README.md", PUBLISHER_CONFIG_NAME = "publisher.config.json", PACKAGE_MANIFEST_NAME = "publisher.json", PACKAGE_INSTALL_RECORDS_DIR = ".install-records", MODEL_FILE_SUFFIX = ".malloy", NOTEBOOK_FILE_SUFFIX = ".malloynb", INDEX_MODEL_NAME = "index.malloy", DEFAULT_QUERY_ROW_LIMIT = 1000, DEFAULT_MAX_QUERY_ROWS = 1e5, DEFAULT_MAX_RESPONSE_BYTES = 50000000, DEFAULT_QUERY_TIMEOUT_MS = 300000, DEFAULT_MAX_CONCURRENT_QUERIES = 32, TEMP_DIR_PATH, PUBLISHER_DATA_DIR = "publisher_data";
+var API_PREFIX = "/api/v0", README_NAME = "README.md", PUBLISHER_CONFIG_NAME = "publisher.config.json", PACKAGE_MANIFEST_NAME = "publisher.json", PACKAGE_INSTALL_RECORDS_DIR = ".install-records", MODEL_FILE_SUFFIX = ".malloy", NOTEBOOK_FILE_SUFFIX = ".malloynb", INDEX_MODEL_NAME = "index.malloy", DEFAULT_QUERY_ROW_LIMIT = 1000, DEFAULT_MAX_QUERY_ROWS = 1e5, DEFAULT_MAX_RESPONSE_BYTES = 50000000, DEFAULT_QUERY_TIMEOUT_MS = 300000, DEFAULT_MAX_CONCURRENT_QUERIES = 32, DEFAULT_POSTGRES_POOL_MAX = 5, TEMP_DIR_PATH, PUBLISHER_DATA_DIR = "publisher_data";
 var init_constants = __esm(() => {
   TEMP_DIR_PATH = os.tmpdir();
 });
@@ -13199,7 +13199,7 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
@@ -13268,6 +13268,12 @@ var init_errors = __esm(() => {
       this.callerSafe = options?.callerSafe ?? false;
     }
   };
+  ConnectionPoolExhaustedError = class ConnectionPoolExhaustedError extends ConnectionError {
+    constructor(message) {
+      super(message, { callerSafe: true });
+      this.name = "ConnectionPoolExhaustedError";
+    }
+  };
   DestinationNotFoundError = class DestinationNotFoundError extends Error {
     constructor(message) {
       super(message);

package/dist/server.mjs

@@ -205143,7 +205143,7 @@ function installRecordPath(environmentPath, packageName) {
 function normalizeModelPath(p) {
   return p.replace(/\\/g, "/").replace(/^\.\//, "");
 }
-var API_PREFIX = "/api/v0", README_NAME = "README.md", PUBLISHER_CONFIG_NAME = "publisher.config.json", PACKAGE_MANIFEST_NAME = "publisher.json", PACKAGE_INSTALL_RECORDS_DIR = ".install-records", MODEL_FILE_SUFFIX = ".malloy", NOTEBOOK_FILE_SUFFIX = ".malloynb", INDEX_MODEL_NAME = "index.malloy", DEFAULT_QUERY_ROW_LIMIT = 1000, DEFAULT_MAX_QUERY_ROWS = 1e5, DEFAULT_MAX_RESPONSE_BYTES = 50000000, DEFAULT_QUERY_TIMEOUT_MS = 300000, DEFAULT_MAX_CONCURRENT_QUERIES = 32, TEMP_DIR_PATH, PUBLISHER_DATA_DIR = "publisher_data";
+var API_PREFIX = "/api/v0", README_NAME = "README.md", PUBLISHER_CONFIG_NAME = "publisher.config.json", PACKAGE_MANIFEST_NAME = "publisher.json", PACKAGE_INSTALL_RECORDS_DIR = ".install-records", MODEL_FILE_SUFFIX = ".malloy", NOTEBOOK_FILE_SUFFIX = ".malloynb", INDEX_MODEL_NAME = "index.malloy", DEFAULT_QUERY_ROW_LIMIT = 1000, DEFAULT_MAX_QUERY_ROWS = 1e5, DEFAULT_MAX_RESPONSE_BYTES = 50000000, DEFAULT_QUERY_TIMEOUT_MS = 300000, DEFAULT_MAX_CONCURRENT_QUERIES = 32, DEFAULT_POSTGRES_POOL_MAX = 5, TEMP_DIR_PATH, PUBLISHER_DATA_DIR = "publisher_data";
 var init_constants = __esm(() => {
   TEMP_DIR_PATH = os.tmpdir();
 });
@@ -205300,7 +205300,7 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
@@ -205369,6 +205369,12 @@ var init_errors = __esm(() => {
       this.callerSafe = options?.callerSafe ?? false;
     }
   };
+  ConnectionPoolExhaustedError = class ConnectionPoolExhaustedError extends ConnectionError {
+    constructor(message) {
+      super(message, { callerSafe: true });
+      this.name = "ConnectionPoolExhaustedError";
+    }
+  };
   DestinationNotFoundError = class DestinationNotFoundError extends Error {
     constructor(message) {
       super(message);
@@ -206423,6 +206429,14 @@ var BUNDLED_DEFAULT_CONFIG_PATH, PER_MODE_COLOR_KEYS, DEFAULT_HIGH_WATER_FRACTIO
     throw new Error(`PUBLISHER_MAX_CONCURRENT_QUERIES must be a non-negative integer (got ${raw})`);
   }
   return raw;
+}, getPostgresPoolMax = () => {
+  const raw = parseIntEnv("PUBLISHER_POSTGRES_POOL_MAX");
+  if (raw === undefined)
+    return DEFAULT_POSTGRES_POOL_MAX;
+  if (raw < 1) {
+    throw new Error(`PUBLISHER_POSTGRES_POOL_MAX must be a positive integer (got ${raw})`);
+  }
+  return raw;
 }, getExtensionFetchPolicy = () => {
   const raw = process.env.EXTENSION_FETCH_POLICY;
   if (raw === undefined || raw.trim() === "")
@@ -283563,6 +283577,26 @@ var init_query_metadata = __esm(() => {
 import { createPrivateKey } from "crypto";
 import { existsSync } from "fs";
 import path4 from "path";
+function validatePostgresSslmode(subject, sslmode) {
+  if (!PROXIED_SSLMODES.includes(sslmode)) {
+    throw new Error(`${subject} has unsupported sslmode '${sslmode}' ` + `(expected ${PROXIED_SSLMODES.join(" | ")}).`);
+  }
+  if (sslmode === "verify-ca") {
+    const caBundle = process.env.NODE_EXTRA_CA_CERTS;
+    if (!caBundle || !existsSync(caBundle)) {
+      throw new Error(`${subject} uses sslmode 'verify-ca' but no readable ` + `CA bundle is available (NODE_EXTRA_CA_CERTS is unset or points at a missing file). ` + `Add the CA bundle to the image or use sslmode 'no-verify'.`);
+    }
+  }
+}
+function postgresStatementTimeoutMs(name, pg) {
+  const value = pg.statementTimeoutMilliseconds;
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > POSTGRES_MAX_STATEMENT_TIMEOUT_MS) {
+    throw new Error(`Connection '${name}' has an invalid statementTimeoutMilliseconds ` + `${JSON.stringify(value)} (expected an integer from 1 to ${POSTGRES_MAX_STATEMENT_TIMEOUT_MS}).`);
+  }
+  return value;
+}
 function nullToUndefined(value) {
   return value ?? undefined;
 }
@@ -283657,7 +283691,7 @@ function getStaticConnectionAttributes(type) {
     case "postgres":
       return {
         dialectName: "postgres",
-        isPool: false,
+        isPool: true,
         canPersist: true,
         canStream: true
       };
@@ -283724,12 +283758,34 @@ function parseServiceAccountKey(json2) {
   }
   return keyData;
 }
-function buildPostgresConnectionString(config2) {
-  if (config2.connectionString || !process.env.PGSSLMODE) {
+function directSslParams(sslmode) {
+  switch (sslmode) {
+    case "disable":
+    case "no-verify":
+    case "verify-full":
+      return { sslmode };
+    case "verify-ca":
+      return {
+        uselibpqcompat: "true",
+        sslmode: "verify-ca",
+        sslrootcert: process.env.NODE_EXTRA_CA_CERTS ?? ""
+      };
+  }
+}
+function buildPostgresConnectionString(config2, { applySslmode }) {
+  if (config2.connectionString) {
     return config2.connectionString;
   }
   const params = new URLSearchParams;
-  params.set("sslmode", process.env.PGSSLMODE);
+  if (applySslmode && config2.sslmode != null) {
+    for (const [key, value] of Object.entries(directSslParams(config2.sslmode))) {
+      params.set(key, value);
+    }
+  } else if (process.env.PGSSLMODE) {
+    params.set("sslmode", process.env.PGSSLMODE);
+  } else {
+    return;
+  }
   const auth = config2.userName && config2.password ? `${encodeURIComponent(config2.userName)}:${encodeURIComponent(config2.password)}@` : config2.userName ? `${encodeURIComponent(config2.userName)}@` : "";
   const host = config2.host ?? "localhost";
   const port = config2.port ? `:${config2.port}` : "";
@@ -283800,23 +283856,21 @@ function validateConnectionShape(connection) {
     }
     const sslmode = connection.postgresConnection?.sslmode;
     if (sslmode != null) {
-      if (!PROXIED_SSLMODES.includes(sslmode)) {
-        throw new Error(`Connection proxy on '${connection.name}' has unsupported sslmode '${sslmode}' ` + `(expected ${PROXIED_SSLMODES.join(" | ")}).`);
-      }
-      if (sslmode === "verify-ca") {
-        const caBundle = process.env.NODE_EXTRA_CA_CERTS;
-        if (!caBundle || !existsSync(caBundle)) {
-          throw new Error(`Connection proxy on '${connection.name}' uses sslmode 'verify-ca' but no readable ` + `CA bundle is available (NODE_EXTRA_CA_CERTS is unset or points at a missing file). ` + `Add the CA bundle to the image or use sslmode 'no-verify'.`);
-        }
-      }
+      validatePostgresSslmode(`Connection proxy on '${connection.name}'`, sslmode);
     }
     const dbName = connection.postgresConnection?.databaseName;
     if (dbName && decodeURI(encodeURIComponent(dbName)) !== dbName) {
       throw new Error(`Connection proxy on '${connection.name}' has a database name with characters that can't ` + `be carried over a proxied connection (${JSON.stringify(dbName)}). Use a database name ` + `without URI-reserved characters (; , / ? : @ & = + $ #).`);
     }
   }
-  if (!connection.proxy && connection.postgresConnection?.sslmode) {
-    throw new Error(`Connection '${connection.name}' sets postgresConnection.sslmode but has no proxy; sslmode is ` + `only supported for proxied connections (direct connections use the deployment PGSSLMODE).`);
+  if (!connection.proxy && connection.postgresConnection?.sslmode != null) {
+    validatePostgresSslmode(`Connection '${connection.name}'`, connection.postgresConnection.sslmode);
+    if (connection.postgresConnection.connectionString) {
+      logger.warn(`Connection '${connection.name}' sets both postgresConnection.sslmode and ` + `connectionString; sslmode is ignored and the connectionString's own sslmode applies.`);
+    }
+  }
+  if (connection.postgresConnection) {
+    postgresStatementTimeoutMs(connection.name ?? "", connection.postgresConnection);
   }
   switch (connection.type) {
     case "postgres":
@@ -284113,7 +284167,9 @@ function assembleEnvironmentConnections(connections = [], environmentPath = "")
           username: postgresConnection?.userName,
           password: postgresConnection?.password,
           databaseName: postgresConnection?.databaseName,
-          connectionString: postgresConnection ? buildPostgresConnectionString(postgresConnection) : undefined
+          connectionString: postgresConnection ? buildPostgresConnectionString(postgresConnection, {
+            applySslmode: !connection.proxy
+          }) : undefined
         };
         break;
       }
@@ -284252,7 +284308,7 @@ function validateAndBuildTrinoCoreConfig(trinoConfig) {
   }
   throw new Error(`Invalid Trino connection: expected "http://server:port" or "https://server:port".`);
 }
-var PROXIED_SSLMODES, PUBLISHER_DUCKDB_API_FIELDS, DECLARABLE_STORAGE_DESTINATION_TYPES, STORAGE_DESTINATIONS_DIR = ".storage-destinations";
+var PROXIED_SSLMODES, POSTGRES_MAX_STATEMENT_TIMEOUT_MS = 2147483647, PUBLISHER_DUCKDB_API_FIELDS, DECLARABLE_STORAGE_DESTINATION_TYPES, STORAGE_DESTINATIONS_DIR = ".storage-destinations";
 var init_connection_config = __esm(() => {
   init_config();
   init_errors();
@@ -294890,9 +294946,117 @@ async function attachSnowflake(connection, attachedDb) {
   await connection.runSQL(attachCommand);
   logger.info(`Successfully attached Snowflake database: ${attachedDb.name}`);
 }
-function buildPgConnectionString(pg) {
+function mergeStatementTimeoutOption(existing, ms) {
+  const tokens = existing.split(/(?<!\\)\s+/).filter((t2) => t2 !== "");
+  const kept = [];
+  let replaced = false;
+  for (let i2 = 0;i2 < tokens.length; i2++) {
+    if (tokens[i2] === "-c" && /^statement[_-]timeout=/i.test(tokens[i2 + 1] ?? "")) {
+      i2++;
+      replaced = true;
+    } else if (STATEMENT_TIMEOUT_SWITCH.test(tokens[i2])) {
+      replaced = true;
+    } else {
+      kept.push(tokens[i2]);
+    }
+  }
+  kept.push("-c", `statement_timeout=${ms}`);
+  return { value: kept.join(" "), replaced };
+}
+function conninfoPairs(conninfo) {
+  const pairs = [];
+  const isSpace = (c) => c !== undefined && /\s/.test(c);
+  let i2 = 0;
+  while (i2 < conninfo.length) {
+    while (isSpace(conninfo[i2]))
+      i2++;
+    if (i2 >= conninfo.length)
+      break;
+    const start = i2;
+    let key = "";
+    while (i2 < conninfo.length && conninfo[i2] !== "=" && !isSpace(conninfo[i2])) {
+      key += conninfo[i2++];
+    }
+    while (isSpace(conninfo[i2]))
+      i2++;
+    if (conninfo[i2] !== "=")
+      break;
+    i2++;
+    while (isSpace(conninfo[i2]))
+      i2++;
+    let value = "";
+    if (conninfo[i2] === "'") {
+      i2++;
+      while (i2 < conninfo.length && conninfo[i2] !== "'") {
+        if (conninfo[i2] === "\\" && i2 + 1 < conninfo.length)
+          i2++;
+        value += conninfo[i2++];
+      }
+      i2++;
+    } else {
+      while (i2 < conninfo.length && !isSpace(conninfo[i2])) {
+        if (conninfo[i2] === "\\" && i2 + 1 < conninfo.length)
+          i2++;
+        value += conninfo[i2++];
+      }
+    }
+    pairs.push({ key, value, start, end: Math.min(i2, conninfo.length) });
+  }
+  return pairs;
+}
+function decodeUriComponentOrRaw(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function withLibpqStatementTimeout(name, connectionString, pg) {
+  const ms = postgresStatementTimeoutMs(name, pg);
+  if (ms === undefined)
+    return connectionString;
+  const merged = (existing2) => {
+    if (existing2 === undefined)
+      return `-c statement_timeout=${ms}`;
+    const { value, replaced } = mergeStatementTimeoutOption(existing2, ms);
+    if (replaced) {
+      logger.warn(`Connection '${name}' sets statementTimeoutMilliseconds and its connectionString's ` + `options also set statement_timeout; statementTimeoutMilliseconds applies.`);
+    }
+    return value;
+  };
+  if (/^postgres(ql)?:\/\//i.test(connectionString)) {
+    const queryStart = connectionString.indexOf("?");
+    if (queryStart === -1) {
+      return `${connectionString}?options=${encodeURIComponent(merged(undefined))}`;
+    }
+    const params = connectionString.slice(queryStart + 1).split("&");
+    const isOptions = (param) => decodeUriComponentOrRaw(param.split("=", 1)[0]) === "options";
+    const last = params.map(isOptions).lastIndexOf(true);
+    if (last === -1) {
+      params.push(`options=${encodeURIComponent(merged(undefined))}`);
+    } else {
+      const raw = params[last].slice(params[last].indexOf("=") + 1);
+      params[last] = `options=${encodeURIComponent(merged(decodeUriComponentOrRaw(raw)))}`;
+    }
+    return `${connectionString.slice(0, queryStart)}?${params.join("&")}`;
+  }
+  const existing = conninfoPairs(connectionString).filter((pair) => pair.key === "options").pop();
+  if (!existing) {
+    return `${connectionString} ${pgConninfoPair("options", merged(undefined))}`;
+  }
+  return connectionString.slice(0, existing.start) + pgConninfoPair("options", merged(existing.value)) + connectionString.slice(existing.end);
+}
+function buildPgConnectionString(pg, {
+  name,
+  applyConnectionOptions
+}) {
   if (pg.connectionString) {
-    return pg.connectionString;
+    if (!applyConnectionOptions)
+      return pg.connectionString;
+    if (pg.sslmode != null) {
+      logger.warn(`Connection '${name}' sets both postgresConnection.sslmode and ` + `connectionString; sslmode is ignored and the connectionString's own sslmode applies.`);
+    }
+    return withLibpqStatementTimeout(name, pg.connectionString, pg);
   }
   const parts = [];
   if (pg.host)
@@ -294905,6 +295069,13 @@ function buildPgConnectionString(pg) {
     parts.push(`user=${pg.userName}`);
   if (pg.password)
     parts.push(`password=${pg.password}`);
+  if (applyConnectionOptions) {
+    parts.push(...libpqStatementTimeoutParts(name, pg));
+    if (pg.sslmode != null) {
+      parts.push(...libpqSslmodeParts(`Connection '${name}'`, pg.sslmode, defaultProxiedAttachTrust()));
+      return parts.join(" ");
+    }
+  }
   const pgSSLMode = process.env.PGSSLMODE;
   if (pgSSLMode) {
     const mapping = {
@@ -294931,7 +295102,10 @@ async function attachPostgres(connection, attachedDb) {
   }
   await installAndLoadExtension(connection, "postgres");
   const config2 = attachedDb.postgresConnection;
-  const attachString = buildPgConnectionString(config2);
+  const attachString = buildPgConnectionString(config2, {
+    name: attachedDb.name,
+    applyConnectionOptions: true
+  });
   const attachCommand = `ATTACH '${escapeSQL(attachString)}' AS ${quoteIdentifier(attachedDb.name, "duckdb")} (TYPE postgres, READ_ONLY);`;
   await connection.runSQL(attachCommand);
   logger.info(`Successfully attached PostgreSQL database: ${attachedDb.name}`);
@@ -295026,7 +295200,10 @@ async function attachDuckLakeWithMode(connection, dbName, ducklakeConfig, option
     });
   }
   const pg = ducklakeConfig.catalog.postgresConnection;
-  const pgConnString = buildPgConnectionString(pg);
+  const pgConnString = buildPgConnectionString(pg, {
+    name: dbName,
+    applyConnectionOptions: false
+  });
   const mode = options.readOnly ? "READ_ONLY" : "READ_WRITE";
   logger.debug(`pgConnString: ${redactPgSecrets(pgConnString)}`);
   const escapedPgConnString = escapeSQL(pgConnString);
@@ -295193,7 +295370,10 @@ async function federatePostgres(connection, config2, deps = {}) {
       });
       attachString = buildProxiedPgAttachString(config2.name, pg, endpoint);
     } else {
-      attachString = buildPgConnectionString(pg);
+      attachString = buildPgConnectionString(pg, {
+        name: config2.name,
+        applyConnectionOptions: true
+      });
     }
     logger.info(`Federating Postgres source for passthrough as alias '${alias}'${endpoint ? " through its SSH proxy" : ""}: ${redactPgSecrets(attachString)}`);
     await connection.runSQL(`ATTACH OR REPLACE '${escapeSQL(attachString)}' AS ${quoteIdentifier(alias, "duckdb")} (TYPE postgres, READ_ONLY);`);
@@ -295256,30 +295436,39 @@ function buildProxiedPgAttachString(name, pg, endpoint, trust = defaultProxiedAt
     parts.push(pgConninfoPair("user", pg.userName));
   if (pg.password)
     parts.push(pgConninfoPair("password", pg.password));
-  const mode = pg.sslmode ?? "no-verify";
+  parts.push(...libpqSslmodeParts(`Connection proxy on '${name}'`, pg.sslmode ?? "no-verify", trust));
+  parts.push(...libpqStatementTimeoutParts(name, pg));
+  return parts.join(" ");
+}
+function libpqSslmodeParts(subject, mode, trust) {
   switch (mode) {
     case "disable":
-      parts.push("sslmode=disable");
-      break;
+      return ["sslmode=disable"];
     case "no-verify":
-      parts.push("sslmode=require");
-      break;
+      return ["sslmode=require"];
     case "verify-ca": {
       if (!trust.caBundle) {
-        throw new Error(`Connection proxy on '${name}' uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset).`);
+        throw new Error(`${subject} uses sslmode 'verify-ca' but no trusted CA bundle is available (NODE_EXTRA_CA_CERTS is unset).`);
       }
-      parts.push("sslmode=verify-ca", pgConninfoPair("sslrootcert", trust.caBundle));
-      break;
+      return [
+        "sslmode=verify-ca",
+        pgConninfoPair("sslrootcert", trust.caBundle)
+      ];
     }
     case "verify-full":
-      parts.push("sslmode=verify-full", pgConninfoPair("sslrootcert", trust.ambientBundle()));
-      break;
+      return [
+        "sslmode=verify-full",
+        pgConninfoPair("sslrootcert", trust.ambientBundle())
+      ];
     default: {
       const unhandled = mode;
-      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${String(unhandled)}' (expected ${PROXIED_SSLMODES.join(" | ")}).`);
+      throw new Error(`${subject} has unsupported sslmode '${String(unhandled)}' (expected ${PROXIED_SSLMODES.join(" | ")}).`);
     }
   }
-  return parts.join(" ");
+}
+function libpqStatementTimeoutParts(name, pg) {
+  const ms = postgresStatementTimeoutMs(name, pg);
+  return ms === undefined ? [] : [pgConninfoPair("options", `-c statement_timeout=${ms}`)];
 }
 function shouldRenewStorageSecret(opts) {
   return opts.hasRenewer && !opts.alreadyRenewing && isExpiredCredentialError(opts.error);
@@ -295601,14 +295790,40 @@ function buildProxiedPostgresConnection(metadata, endpoint) {
   const db = pg.databaseName ? `/${enc(pg.databaseName)}` : "";
   const { query, ssl } = resolveProxiedTls(name, pg.host, pg.sslmode);
   const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${query}`;
+  const setupSQL = statementTimeoutSetupSQL(name, pg);
   return new PooledPostgresConnection({
     name,
     connectionString,
     ...ssl ? { ssl } : {},
+    ...setupSQL ? { setupSQL } : {},
     poolMin: 1,
     poolMax: 20
   });
 }
+function buildEnvironmentPostgresConnection(metadata) {
+  const name = metadata.apiConnection.name;
+  const pg = metadata.apiConnection.postgresConnection;
+  if (!pg) {
+    throw new Error(`Connection '${name}' has type 'postgres' but no postgresConnection config.`);
+  }
+  const setupSQL = statementTimeoutSetupSQL(name, pg);
+  return new EnvironmentPooledPostgresConnection({
+    name,
+    connectionString: buildPostgresConnectionString(pg, {
+      applySslmode: true
+    }),
+    host: pg.host,
+    port: pg.port,
+    username: pg.userName,
+    password: pg.password,
+    databaseName: pg.databaseName,
+    ...setupSQL ? { setupSQL } : {}
+  });
+}
+function statementTimeoutSetupSQL(name, pg) {
+  const ms = postgresStatementTimeoutMs(name, pg);
+  return ms === undefined ? undefined : `SET statement_timeout = ${ms}`;
+}
 function buildDuckLakeConnection(metadata, entry) {
   return new DuckLakeConnection(entryToDuckDBOptions(metadata.apiConnection.name, entry, metadata.workingDirectory));
 }
@@ -295634,6 +295849,7 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
   const snowflakeJwtCache = new Map;
   const azureDuckDBCache = new Map;
   const proxyConnectionCache = new Map;
+  const postgresConnectionCache = new Map;
   const proxyEndpoints = new Map;
   const attachPromises = new WeakMap;
   const malloyConfig = new MalloyConfig(assembled.pojo, {
@@ -295724,6 +295940,21 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
         await attachOnce(connection2, metadata);
         return connection2;
       }
+      if (metadata?.apiConnection.type === "postgres") {
+        let connectionPromise = postgresConnectionCache.get(name);
+        if (!connectionPromise) {
+          connectionPromise = Promise.resolve(buildEnvironmentPostgresConnection(metadata));
+          postgresConnectionCache.set(name, connectionPromise);
+          connectionPromise.catch(() => {
+            if (postgresConnectionCache.get(name) === connectionPromise) {
+              postgresConnectionCache.delete(name);
+            }
+          });
+        }
+        const connection2 = await connectionPromise;
+        await attachOnce(connection2, metadata);
+        return connection2;
+      }
       const connection = await base.lookupConnection(name);
       if (metadata) {
         await attachOnce(connection, metadata);
@@ -295749,7 +295980,8 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
         ...duckLakeCache.values(),
         ...snowflakeJwtCache.values(),
         ...azureDuckDBCache.values(),
-        ...proxyConnectionCache.values()
+        ...proxyConnectionCache.values(),
+        ...postgresConnectionCache.values()
       ];
       const closeResults = await Promise.allSettled([
         malloyConfig.shutdown("close"),
@@ -295763,6 +295995,7 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
       snowflakeJwtCache.clear();
       azureDuckDBCache.clear();
       proxyConnectionCache.clear();
+      postgresConnectionCache.clear();
       proxyEndpoints.clear();
       const failures = [...closeResults, ...endpointResults].filter((result) => result.status === "rejected");
       for (const failure of failures) {
@@ -295945,7 +296178,7 @@ async function testConnectionConfig(connectionConfig) {
     }
   }
 }
-var import_db_publisher, extensionSessionPinned, sessionLimitsApplied, ducklakePreflightSeq = 0, ambientTrustBundles, ambientTrustDir, AzureDuckDBConnection, DuckLakeConnection, CONFIG_SECRET_KEY;
+var import_db_publisher, extensionSessionPinned, sessionLimitsApplied, STATEMENT_TIMEOUT_SWITCH, ducklakePreflightSeq = 0, ambientTrustBundles, ambientTrustDir, AzureDuckDBConnection, DuckLakeConnection, POSTGRES_POOL_MAX_USES = 1, PG_POOL_WAIT_TIMEOUT_MESSAGE = "timeout exceeded when trying to connect", EnvironmentPooledPostgresConnection, CONFIG_SECRET_KEY;
 var init_connection = __esm(() => {
   init_axios2();
   init_config();
@@ -295963,6 +296196,7 @@ var init_connection = __esm(() => {
   import_db_publisher = __toESM(require_dist6(), 1);
   extensionSessionPinned = new WeakSet;
   sessionLimitsApplied = new WeakMap;
+  STATEMENT_TIMEOUT_SWITCH = /^(?:-c|--)statement[_-]timeout=/i;
   ambientTrustBundles = new Map;
   AzureDuckDBConnection = class AzureDuckDBConnection extends DuckDBConnection {
     azureDatabases;
@@ -296054,6 +296288,38 @@ var init_connection = __esm(() => {
       return result;
     }
   };
+  EnvironmentPooledPostgresConnection = class EnvironmentPooledPostgresConnection extends PooledPostgresConnection {
+    poolLimits() {
+      return { max: getPostgresPoolMax(), connectionTimeoutMillis: 30000 };
+    }
+    buildClientConfig(cfg) {
+      const base = super.buildClientConfig(cfg);
+      return {
+        ...base,
+        ...this.poolLimits(),
+        maxUses: POSTGRES_POOL_MAX_USES,
+        application_name: "malloy-publisher"
+      };
+    }
+    async withTlsHint(op) {
+      try {
+        return await super.withTlsHint(op);
+      } catch (err) {
+        if (err instanceof Error && err.message === PG_POOL_WAIT_TIMEOUT_MESSAGE) {
+          const { max, connectionTimeoutMillis } = this.poolLimits();
+          const waitSeconds = connectionTimeoutMillis / 1000;
+          logger.warn("Postgres connection pool exhausted", {
+            connection: this.name,
+            poolMax: max,
+            waitSeconds,
+            remedy: "fewer concurrent queries on this connection, or raise PUBLISHER_POSTGRES_POOL_MAX"
+          });
+          throw new ConnectionPoolExhaustedError(`Connection '${this.name}' has no free database session: this server opens at most ${max} at a time for it, and none came free within ${waitSeconds} s. Retry once fewer queries are running on this connection.`);
+        }
+        throw err;
+      }
+    }
+  };
   CONFIG_SECRET_KEY = /pass(word)?|secret|private_?key|service_?account|access_?key|token|peaka_?key/i;
 });
 
@@ -328412,6 +328678,9 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
             });
             throw new BadRequestError(err instanceof Error ? err.message : String(err));
           }
+          if (err instanceof ConnectionError) {
+            throw err;
+          }
           if (err instanceof MalloyError7) {
             throw err;
           }
@@ -358133,7 +358402,8 @@ var POSTGRES = {
   port: "scalar",
   databaseName: "scalar",
   userName: "scalar",
-  sslmode: "scalar"
+  sslmode: "scalar",
+  statementTimeoutMilliseconds: "scalar"
 };
 var BIGQUERY = {
   defaultProjectId: "scalar",
@@ -359919,7 +360189,7 @@ class ConnectionController {
         try {
           return await streamSqlWithBudget(malloyConnection, sqlStatement, optionsWithSignal, { maxRows, maxBytes });
         } catch (error2) {
-          if (error2 instanceof PayloadTooLargeError)
+          if (error2 instanceof PayloadTooLargeError || error2 instanceof ConnectionError)
             throw error2;
           throw new ConnectionError(error2.message);
         }
@@ -359934,6 +360204,8 @@ class ConnectionController {
       try {
         return await malloyConnection.runSQL(sqlStatement, optionsWithSignal);
       } catch (error2) {
+        if (error2 instanceof ConnectionError)
+          throw error2;
         throw new ConnectionError(error2.message);
       }
     }, getQueryTimeoutMs());
@@ -359966,6 +360238,8 @@ class ConnectionController {
       } catch (error2) {
         if (signal.aborted)
           throw error2;
+        if (error2 instanceof ConnectionError)
+          throw error2;
         throw new ConnectionError(error2.message);
       }
     }, getQueryTimeoutMs());
@@ -365238,6 +365512,15 @@ function classifyToolError(operation, identifier, error2) {
       suggestions: [...BACK_PRESSURE_SUGGESTIONS]
     };
   }
+  if (error2 instanceof ConnectionPoolExhaustedError) {
+    return {
+      message: error2.message,
+      suggestions: [
+        "Retry shortly; this clears as other queries on the connection finish.",
+        "If it persists, run fewer queries at once on this connection, or ask the operator to raise PUBLISHER_POSTGRES_POOL_MAX."
+      ]
+    };
+  }
   if (error2 instanceof ResponseUnserializableError) {
     return {
       message: error2.message,
@@ -381636,7 +381919,7 @@ ${query}`);
 // src/service/environment_store.ts
 init_google_credentials();
 // package.json
-var version2 = "0.9.5";
+var version2 = "0.9.6";
 
 // src/version.ts
 var SERVER_VERSION = version2;

package/package.json

@@ -19,7 +19,7 @@
       "snowflake"
    ],
    "homepage": "https://docs.malloydata.dev/documentation/user_guides/publishing/mcp_agents",
-   "version": "0.9.5",
+   "version": "0.9.6",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"