@malloy-publisher/server 0.0.197 → 0.0.198

package/dist/server.mjs

@@ -196989,26 +196989,26 @@ var require_utils74 = __commonJS((exports, module) => {
     }
     mkdirSync(folder);
   };
-  Utils.prototype.writeFileTo = function(path4, content, overwrite, attr) {
+  Utils.prototype.writeFileTo = function(path3, content, overwrite, attr) {
     const self2 = this;
-    if (self2.fs.existsSync(path4)) {
+    if (self2.fs.existsSync(path3)) {
       if (!overwrite)
         return false;
-      var stat4 = self2.fs.statSync(path4);
+      var stat4 = self2.fs.statSync(path3);
       if (stat4.isDirectory()) {
         return false;
       }
     }
-    var folder = pth.dirname(path4);
+    var folder = pth.dirname(path3);
     if (!self2.fs.existsSync(folder)) {
       self2.makeDir(folder);
     }
     var fd;
     try {
-      fd = self2.fs.openSync(path4, "w", 438);
+      fd = self2.fs.openSync(path3, "w", 438);
     } catch (e) {
-      self2.fs.chmodSync(path4, 438);
-      fd = self2.fs.openSync(path4, "w", 438);
+      self2.fs.chmodSync(path3, 438);
+      fd = self2.fs.openSync(path3, "w", 438);
     }
     if (fd) {
       try {
@@ -197017,33 +197017,33 @@ var require_utils74 = __commonJS((exports, module) => {
         self2.fs.closeSync(fd);
       }
     }
-    self2.fs.chmodSync(path4, attr || 438);
+    self2.fs.chmodSync(path3, attr || 438);
     return true;
   };
-  Utils.prototype.writeFileToAsync = function(path4, content, overwrite, attr, callback) {
+  Utils.prototype.writeFileToAsync = function(path3, content, overwrite, attr, callback) {
     if (typeof attr === "function") {
       callback = attr;
       attr = undefined;
     }
     const self2 = this;
-    self2.fs.exists(path4, function(exist) {
+    self2.fs.exists(path3, function(exist) {
       if (exist && !overwrite)
         return callback(false);
-      self2.fs.stat(path4, function(err, stat4) {
+      self2.fs.stat(path3, function(err, stat4) {
         if (exist && stat4.isDirectory()) {
           return callback(false);
         }
-        var folder = pth.dirname(path4);
+        var folder = pth.dirname(path3);
         self2.fs.exists(folder, function(exists) {
           if (!exists)
             self2.makeDir(folder);
-          self2.fs.open(path4, "w", 438, function(err2, fd) {
+          self2.fs.open(path3, "w", 438, function(err2, fd) {
             if (err2) {
-              self2.fs.chmod(path4, 438, function() {
-                self2.fs.open(path4, "w", 438, function(err3, fd2) {
+              self2.fs.chmod(path3, 438, function() {
+                self2.fs.open(path3, "w", 438, function(err3, fd2) {
                   self2.fs.write(fd2, content, 0, content.length, 0, function() {
                     self2.fs.close(fd2, function() {
-                      self2.fs.chmod(path4, attr || 438, function() {
+                      self2.fs.chmod(path3, attr || 438, function() {
                         callback(true);
                       });
                     });
@@ -197053,13 +197053,13 @@ var require_utils74 = __commonJS((exports, module) => {
             } else if (fd) {
               self2.fs.write(fd, content, 0, content.length, 0, function() {
                 self2.fs.close(fd, function() {
-                  self2.fs.chmod(path4, attr || 438, function() {
+                  self2.fs.chmod(path3, attr || 438, function() {
                     callback(true);
                   });
                 });
               });
             } else {
-              self2.fs.chmod(path4, attr || 438, function() {
+              self2.fs.chmod(path3, attr || 438, function() {
                 callback(true);
               });
             }
@@ -197068,7 +197068,7 @@ var require_utils74 = __commonJS((exports, module) => {
       });
     });
   };
-  Utils.prototype.findFiles = function(path4) {
+  Utils.prototype.findFiles = function(path3) {
     const self2 = this;
     function findSync(dir, pattern, recursive) {
       if (typeof pattern === "boolean") {
@@ -197077,17 +197077,17 @@ var require_utils74 = __commonJS((exports, module) => {
       }
       let files = [];
       self2.fs.readdirSync(dir).forEach(function(file) {
-        const path5 = pth.join(dir, file);
-        const stat4 = self2.fs.statSync(path5);
-        if (!pattern || pattern.test(path5)) {
-          files.push(pth.normalize(path5) + (stat4.isDirectory() ? self2.sep : ""));
+        const path4 = pth.join(dir, file);
+        const stat4 = self2.fs.statSync(path4);
+        if (!pattern || pattern.test(path4)) {
+          files.push(pth.normalize(path4) + (stat4.isDirectory() ? self2.sep : ""));
         }
         if (stat4.isDirectory() && recursive)
-          files = files.concat(findSync(path5, pattern, recursive));
+          files = files.concat(findSync(path4, pattern, recursive));
       });
       return files;
     }
-    return findSync(path4, undefined, true);
+    return findSync(path3, undefined, true);
   };
   Utils.prototype.findFilesAsync = function(dir, cb) {
     const self2 = this;
@@ -197147,16 +197147,16 @@ var require_utils74 = __commonJS((exports, module) => {
         return "UNSUPPORTED (" + method + ")";
     }
   };
-  Utils.canonical = function(path4) {
-    if (!path4)
+  Utils.canonical = function(path3) {
+    if (!path3)
       return "";
-    const safeSuffix = pth.posix.normalize("/" + path4.split("\\").join("/"));
+    const safeSuffix = pth.posix.normalize("/" + path3.split("\\").join("/"));
     return pth.join(".", safeSuffix);
   };
-  Utils.zipnamefix = function(path4) {
-    if (!path4)
+  Utils.zipnamefix = function(path3) {
+    if (!path3)
       return "";
-    const safeSuffix = pth.posix.normalize("/" + path4.split("\\").join("/"));
+    const safeSuffix = pth.posix.normalize("/" + path3.split("\\").join("/"));
     return pth.posix.join(".", safeSuffix);
   };
   Utils.findLast = function(arr, callback) {
@@ -197174,9 +197174,9 @@ var require_utils74 = __commonJS((exports, module) => {
     prefix = pth.resolve(pth.normalize(prefix));
     var parts = name.split("/");
     for (var i = 0, l = parts.length;i < l; i++) {
-      var path4 = pth.normalize(pth.join(prefix, parts.slice(i, l).join(pth.sep)));
-      if (path4.indexOf(prefix) === 0) {
-        return path4;
+      var path3 = pth.normalize(pth.join(prefix, parts.slice(i, l).join(pth.sep)));
+      if (path3.indexOf(prefix) === 0) {
+        return path3;
       }
     }
     return pth.normalize(pth.join(prefix, pth.basename(name)));
@@ -197214,8 +197214,8 @@ var require_utils74 = __commonJS((exports, module) => {
 // ../../node_modules/adm-zip/util/fattr.js
 var require_fattr = __commonJS((exports, module) => {
   var pth = __require("path");
-  module.exports = function(path4, { fs: fs2 }) {
-    var _path = path4 || "", _obj = newAttr(), _stat = null;
+  module.exports = function(path3, { fs: fs2 }) {
+    var _path = path3 || "", _obj = newAttr(), _stat = null;
     function newAttr() {
       return {
         directory: false,
@@ -198545,8 +198545,8 @@ var require_adm_zip = __commonJS((exports, module) => {
       return null;
     }
     function fixPath(zipPath) {
-      const { join: join4, normalize: normalize2, sep } = pth.posix;
-      return join4(".", normalize2(sep + zipPath.split("\\").join(sep) + sep));
+      const { join: join3, normalize: normalize2, sep } = pth.posix;
+      return join3(".", normalize2(sep + zipPath.split("\\").join(sep) + sep));
     }
     function filenameFilter(filterfn) {
       if (filterfn instanceof RegExp) {
@@ -199074,10 +199074,10 @@ var require_src122 = __commonJS((exports) => {
   var fs_1 = __require("fs");
   var debug_1 = __importDefault(require_src5());
   var log = debug_1.default("@kwsites/file-exists");
-  function check(path4, isFile2, isDirectory) {
-    log(`checking %s`, path4);
+  function check(path3, isFile2, isDirectory) {
+    log(`checking %s`, path3);
     try {
-      const stat4 = fs_1.statSync(path4);
+      const stat4 = fs_1.statSync(path3);
       if (stat4.isFile() && isFile2) {
         log(`[OK] path represents a file`);
         return true;
@@ -199097,8 +199097,8 @@ var require_src122 = __commonJS((exports) => {
       throw e;
     }
   }
-  function exists(path4, type = exports.READABLE) {
-    return check(path4, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+  function exists(path3, type = exports.READABLE) {
+    return check(path3, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
   }
   exports.exists = exists;
   exports.FILE = 1;
@@ -199984,12 +199984,12 @@ var require_recursive_readdir = __commonJS((exports, module) => {
       ignores = [];
     }
     if (!callback) {
-      return new Promise(function(resolve3, reject) {
+      return new Promise(function(resolve4, reject) {
         readdir3(path7, ignores || [], function(err, data) {
           if (err) {
             reject(err);
           } else {
-            resolve3(data);
+            resolve4(data);
           }
         });
       });
@@ -200771,7 +200771,7 @@ var require_uri_all = __commonJS((exports, module) => {
       target.fragment = relative4.fragment;
       return target;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       var schemelessOptions = assign({ scheme: "null" }, options);
       return serialize(resolveComponents(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true), schemelessOptions);
     }
@@ -201039,7 +201039,7 @@ var require_uri_all = __commonJS((exports, module) => {
     exports2.removeDotSegments = removeDotSegments;
     exports2.serialize = serialize;
     exports2.resolveComponents = resolveComponents;
-    exports2.resolve = resolve3;
+    exports2.resolve = resolve4;
     exports2.normalize = normalize2;
     exports2.equal = equal;
     exports2.escapeComponent = escapeComponent;
@@ -201405,20 +201405,20 @@ var require_resolve2 = __commonJS((exports, module) => {
   var util5 = require_util13();
   var SchemaObject = require_schema_obj();
   var traverse = require_json_schema_traverse();
-  module.exports = resolve3;
-  resolve3.normalizeId = normalizeId;
-  resolve3.fullPath = getFullPath;
-  resolve3.url = resolveUrl;
-  resolve3.ids = resolveIds;
-  resolve3.inlineRef = inlineRef;
-  resolve3.schema = resolveSchema;
-  function resolve3(compile, root, ref) {
+  module.exports = resolve4;
+  resolve4.normalizeId = normalizeId;
+  resolve4.fullPath = getFullPath;
+  resolve4.url = resolveUrl;
+  resolve4.ids = resolveIds;
+  resolve4.inlineRef = inlineRef;
+  resolve4.schema = resolveSchema;
+  function resolve4(compile, root, ref) {
     var refVal = this._refs[ref];
     if (typeof refVal == "string") {
       if (this._refs[refVal])
         refVal = this._refs[refVal];
       else
-        return resolve3.call(this, compile, root, refVal);
+        return resolve4.call(this, compile, root, refVal);
     }
     refVal = refVal || this._schemas[ref];
     if (refVal instanceof SchemaObject) {
@@ -201641,7 +201641,7 @@ var require_resolve2 = __commonJS((exports, module) => {
 
 // ../../node_modules/@modelcontextprotocol/sdk/node_modules/ajv/lib/compile/error_classes.js
 var require_error_classes = __commonJS((exports, module) => {
-  var resolve3 = require_resolve2();
+  var resolve4 = require_resolve2();
   module.exports = {
     Validation: errorSubclass(ValidationError),
     MissingRef: errorSubclass(MissingRefError)
@@ -201656,8 +201656,8 @@ var require_error_classes = __commonJS((exports, module) => {
   };
   function MissingRefError(baseId, ref, message) {
     this.message = message || MissingRefError.message(baseId, ref);
-    this.missingRef = resolve3.url(baseId, ref);
-    this.missingSchema = resolve3.normalizeId(resolve3.fullPath(this.missingRef));
+    this.missingRef = resolve4.url(baseId, ref);
+    this.missingSchema = resolve4.normalizeId(resolve4.fullPath(this.missingRef));
   }
   function errorSubclass(Subclass) {
     Subclass.prototype = Object.create(Error.prototype);
@@ -202199,7 +202199,7 @@ var require_validate4 = __commonJS((exports, module) => {
 
 // ../../node_modules/@modelcontextprotocol/sdk/node_modules/ajv/lib/compile/index.js
 var require_compile2 = __commonJS((exports, module) => {
-  var resolve3 = require_resolve2();
+  var resolve4 = require_resolve2();
   var util5 = require_util13();
   var errorClasses = require_error_classes();
   var stableStringify = require_fast_json_stable_stringify();
@@ -202259,7 +202259,7 @@ var require_compile2 = __commonJS((exports, module) => {
         RULES,
         validate: validateGenerator,
         util: util5,
-        resolve: resolve3,
+        resolve: resolve4,
         resolveRef,
         usePattern,
         useDefault,
@@ -202298,7 +202298,7 @@ var require_compile2 = __commonJS((exports, module) => {
       return validate;
     }
     function resolveRef(baseId2, ref, isRoot) {
-      ref = resolve3.url(baseId2, ref);
+      ref = resolve4.url(baseId2, ref);
       var refIndex = refs[ref];
       var _refVal, refCode;
       if (refIndex !== undefined) {
@@ -202315,11 +202315,11 @@ var require_compile2 = __commonJS((exports, module) => {
         }
       }
       refCode = addLocalRef(ref);
-      var v2 = resolve3.call(self2, localCompile, root, ref);
+      var v2 = resolve4.call(self2, localCompile, root, ref);
       if (v2 === undefined) {
         var localSchema = localRefs && localRefs[ref];
         if (localSchema) {
-          v2 = resolve3.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
+          v2 = resolve4.inlineRef(localSchema, opts.inlineRefs) ? localSchema : compile.call(self2, localSchema, root, localRefs, baseId2);
         }
       }
       if (v2 === undefined) {
@@ -205836,7 +205836,7 @@ var require_data2 = __commonJS((exports, module) => {
 // ../../node_modules/@modelcontextprotocol/sdk/node_modules/ajv/lib/ajv.js
 var require_ajv = __commonJS((exports, module) => {
   var compileSchema = require_compile2();
-  var resolve3 = require_resolve2();
+  var resolve4 = require_resolve2();
   var Cache = require_cache();
   var SchemaObject = require_schema_obj();
   var stableStringify = require_fast_json_stable_stringify();
@@ -205928,7 +205928,7 @@ var require_ajv = __commonJS((exports, module) => {
     var id = this._getId(schema);
     if (id !== undefined && typeof id != "string")
       throw new Error("schema id must be string");
-    key = resolve3.normalizeId(key || id);
+    key = resolve4.normalizeId(key || id);
     checkUnique(this, key);
     this._schemas[key] = this._addSchema(schema, _skipValidation, _meta, true);
     return this;
@@ -205974,7 +205974,7 @@ var require_ajv = __commonJS((exports, module) => {
     }
   }
   function _getSchemaFragment(self2, ref) {
-    var res = resolve3.schema.call(self2, { schema: {} }, ref);
+    var res = resolve4.schema.call(self2, { schema: {} }, ref);
     if (res) {
       var { schema, root, baseId } = res;
       var v = compileSchema.call(self2, schema, root, undefined, baseId);
@@ -205990,7 +205990,7 @@ var require_ajv = __commonJS((exports, module) => {
     }
   }
   function _getSchemaObj(self2, keyRef) {
-    keyRef = resolve3.normalizeId(keyRef);
+    keyRef = resolve4.normalizeId(keyRef);
     return self2._schemas[keyRef] || self2._refs[keyRef] || self2._fragments[keyRef];
   }
   function removeSchema(schemaKeyRef) {
@@ -206018,7 +206018,7 @@ var require_ajv = __commonJS((exports, module) => {
         this._cache.del(cacheKey);
         var id = this._getId(schemaKeyRef);
         if (id) {
-          id = resolve3.normalizeId(id);
+          id = resolve4.normalizeId(id);
           delete this._schemas[id];
           delete this._refs[id];
         }
@@ -206043,14 +206043,14 @@ var require_ajv = __commonJS((exports, module) => {
     if (cached)
       return cached;
     shouldAddSchema = shouldAddSchema || this._opts.addUsedSchema !== false;
-    var id = resolve3.normalizeId(this._getId(schema));
+    var id = resolve4.normalizeId(this._getId(schema));
     if (id && shouldAddSchema)
       checkUnique(this, id);
     var willValidate = this._opts.validateSchema !== false && !skipValidation;
     var recursiveMeta;
-    if (willValidate && !(recursiveMeta = id && id == resolve3.normalizeId(schema.$schema)))
+    if (willValidate && !(recursiveMeta = id && id == resolve4.normalizeId(schema.$schema)))
       this.validateSchema(schema, true);
-    var localRefs = resolve3.ids.call(this, schema);
+    var localRefs = resolve4.ids.call(this, schema);
     var schemaObj = new SchemaObject({
       id,
       schema,
@@ -209093,7 +209093,7 @@ var require_util14 = __commonJS((exports) => {
       }
       path12 = url2.path;
     }
-    var isAbsolute3 = exports.isAbsolute(path12);
+    var isAbsolute4 = exports.isAbsolute(path12);
     var parts = path12.split(/\/+/);
     for (var part, up = 0, i = parts.length - 1;i >= 0; i--) {
       part = parts[i];
@@ -209113,7 +209113,7 @@ var require_util14 = __commonJS((exports) => {
     }
     path12 = parts.join("/");
     if (path12 === "") {
-      path12 = isAbsolute3 ? "/" : ".";
+      path12 = isAbsolute4 ? "/" : ".";
     }
     if (url2) {
       url2.path = path12;
@@ -209122,7 +209122,7 @@ var require_util14 = __commonJS((exports) => {
     return path12;
   }
   exports.normalize = normalize2;
-  function join9(aRoot, aPath) {
+  function join8(aRoot, aPath) {
     if (aRoot === "") {
       aRoot = ".";
     }
@@ -209154,7 +209154,7 @@ var require_util14 = __commonJS((exports) => {
     }
     return joined;
   }
-  exports.join = join9;
+  exports.join = join8;
   exports.isAbsolute = function(aPath) {
     return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
   };
@@ -209327,7 +209327,7 @@ var require_util14 = __commonJS((exports) => {
           parsed.path = parsed.path.substring(0, index + 1);
         }
       }
-      sourceURL = join9(urlGenerate(parsed), sourceURL);
+      sourceURL = join8(urlGenerate(parsed), sourceURL);
     }
     return normalize2(sourceURL);
   }
@@ -217008,6 +217008,8 @@ function internalErrorToHttpError(error) {
     return httpError(409, error.message);
   } else if (error instanceof InvalidStateTransitionError) {
     return httpError(409, error.message);
+  } else if (error instanceof ServiceUnavailableError) {
+    return httpError(503, error.message);
   } else {
     return httpError(500, error.message);
   }
@@ -217100,6 +217102,12 @@ class InvalidStateTransitionError extends Error {
   }
 }
 
+class ServiceUnavailableError extends Error {
+  constructor(message) {
+    super(message);
+  }
+}
+
 // src/service/connection.ts
 import"@malloydata/db-bigquery";
 import"@malloydata/db-databricks";
@@ -223161,7 +223169,6 @@ class ModelController {
 }
 
 // src/controller/package.controller.ts
-import * as path3 from "path";
 class PackageController {
   environmentStore;
   manifestService;
@@ -223175,11 +223182,20 @@ class PackageController {
   }
   async getPackage(environmentName, packageName, reload) {
     const environment = await this.environmentStore.getEnvironment(environmentName, false);
-    const _package = await environment.getPackage(packageName, reload);
-    const packageLocation = _package.getPackageMetadata().location;
-    if (reload && packageLocation) {
-      await this.downloadPackage(environmentName, packageName, packageLocation);
+    if (reload) {
+      let location;
+      try {
+        const cached = await environment.getPackage(packageName, false);
+        location = cached.getPackageMetadata().location;
+      } catch {}
+      if (location) {
+        const reinstalled = await environment.installPackage(packageName, (stagingPath) => this.downloadInto(environmentName, packageName, location, stagingPath));
+        return reinstalled.getPackageMetadata();
+      }
+      const _package2 = await environment.getPackage(packageName, true);
+      return _package2.getPackageMetadata();
     }
+    const _package = await environment.getPackage(packageName, false);
     return _package.getPackageMetadata();
   }
   async addPackage(environmentName, body, options) {
@@ -223189,14 +223205,18 @@ class PackageController {
     if (!body.name) {
       throw new BadRequestError("Package name is required");
     }
+    const packageName = body.name;
     const environment = await this.environmentStore.getEnvironment(environmentName, false);
+    let result;
     if (body.location) {
-      await this.downloadPackage(environmentName, body.name, body.location);
+      const bodyLocation = body.location;
+      result = await environment.installPackage(packageName, (stagingPath) => this.downloadInto(environmentName, packageName, bodyLocation, stagingPath));
+    } else {
+      result = await environment.addPackage(packageName);
     }
-    const result = await environment.addPackage(body.name);
-    await this.environmentStore.addPackageToDatabase(environmentName, body.name);
+    await this.environmentStore.addPackageToDatabase(environmentName, packageName);
     if (options?.autoLoadManifest === true) {
-      await this.tryLoadExistingManifest(environmentName, body.name);
+      await this.tryLoadExistingManifest(environmentName, packageName);
     }
     return result;
   }
@@ -223238,24 +223258,24 @@ class PackageController {
     }
     const environment = await this.environmentStore.getEnvironment(environmentName, false);
     if (body.location) {
-      await this.downloadPackage(environmentName, packageName, body.location);
+      const bodyLocation = body.location;
+      await environment.installPackage(packageName, (stagingPath) => this.downloadInto(environmentName, packageName, bodyLocation, stagingPath));
     }
     const result = await environment.updatePackage(packageName, body);
     await this.environmentStore.addPackageToDatabase(environmentName, packageName);
     return result;
   }
-  async downloadPackage(environmentName, packageName, packageLocation) {
-    const absoluteTargetPath = path3.join(this.environmentStore.serverRootPath, PUBLISHER_DATA_DIR, environmentName, packageName);
+  async downloadInto(environmentName, packageName, packageLocation, targetPath) {
     const isCompressedFile = packageLocation.endsWith(".zip");
     if (packageLocation.startsWith("https://") || packageLocation.startsWith("git@")) {
-      await this.environmentStore.downloadGitHubDirectory(packageLocation, absoluteTargetPath);
+      await this.environmentStore.downloadGitHubDirectory(packageLocation, targetPath);
     } else if (packageLocation.startsWith("gs://")) {
-      await this.environmentStore.downloadGcsDirectory(packageLocation, environmentName, absoluteTargetPath, isCompressedFile);
+      await this.environmentStore.downloadGcsDirectory(packageLocation, environmentName, targetPath, isCompressedFile);
     } else if (packageLocation.startsWith("s3://")) {
-      await this.environmentStore.downloadS3Directory(packageLocation, environmentName, absoluteTargetPath, isCompressedFile);
+      await this.environmentStore.downloadS3Directory(packageLocation, environmentName, targetPath, isCompressedFile);
     }
     if (packageLocation.startsWith("/")) {
-      await this.environmentStore.mountLocalDirectory(packageLocation, absoluteTargetPath, environmentName, packageName);
+      await this.environmentStore.mountLocalDirectory(packageLocation, targetPath, environmentName, packageName);
     }
   }
 }
@@ -223369,7 +223389,7 @@ class ReaddirpStream extends Readable2 {
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
     const statMethod = opts.lstat ? lstat : stat;
     if (wantBigintFsStats) {
-      this._stat = (path4) => statMethod(path4, { bigint: true });
+      this._stat = (path3) => statMethod(path3, { bigint: true });
     } else {
       this._stat = statMethod;
     }
@@ -223394,8 +223414,8 @@ class ReaddirpStream extends Readable2 {
         const par = this.parent;
         const fil = par && par.files;
         if (fil && fil.length > 0) {
-          const { path: path4, depth } = par;
-          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path4));
+          const { path: path3, depth } = par;
+          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path3));
           const awaited = await Promise.all(slice);
           for (const entry of awaited) {
             if (!entry)
@@ -223435,20 +223455,20 @@ class ReaddirpStream extends Readable2 {
       this.reading = false;
     }
   }
-  async _exploreDir(path4, depth) {
+  async _exploreDir(path3, depth) {
     let files;
     try {
-      files = await readdir(path4, this._rdOptions);
+      files = await readdir(path3, this._rdOptions);
     } catch (error) {
       this._onError(error);
     }
-    return { files, depth, path: path4 };
+    return { files, depth, path: path3 };
   }
-  async _formatEntry(dirent, path4) {
+  async _formatEntry(dirent, path3) {
     let entry;
     const basename = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path4, basename));
+      const fullPath = presolve(pjoin(path3, basename));
       entry = { path: prelative(this._root, fullPath), fullPath, basename };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
@@ -223847,16 +223867,16 @@ var delFromSet = (main, prop, item) => {
 };
 var isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
 var FsWatchInstances = new Map;
-function createFsWatchInstance(path4, options, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path3, options, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path4);
-    emitRaw(rawEvent, evPath, { watchedPath: path4 });
-    if (evPath && path4 !== evPath) {
-      fsWatchBroadcast(sysPath.resolve(path4, evPath), KEY_LISTENERS, sysPath.join(path4, evPath));
+    listener(path3);
+    emitRaw(rawEvent, evPath, { watchedPath: path3 });
+    if (evPath && path3 !== evPath) {
+      fsWatchBroadcast(sysPath.resolve(path3, evPath), KEY_LISTENERS, sysPath.join(path3, evPath));
     }
   };
   try {
-    return fs_watch(path4, {
+    return fs_watch(path3, {
       persistent: options.persistent
     }, handleEvent);
   } catch (error) {
@@ -223872,12 +223892,12 @@ var fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
     listener(val1, val2, val3);
   });
 };
-var setFsWatchListener = (path4, fullPath, options, handlers) => {
+var setFsWatchListener = (path3, fullPath, options, handlers) => {
   const { listener, errHandler, rawEmitter } = handlers;
   let cont = FsWatchInstances.get(fullPath);
   let watcher;
   if (!options.persistent) {
-    watcher = createFsWatchInstance(path4, options, listener, errHandler, rawEmitter);
+    watcher = createFsWatchInstance(path3, options, listener, errHandler, rawEmitter);
     if (!watcher)
       return;
     return watcher.close.bind(watcher);
@@ -223887,7 +223907,7 @@ var setFsWatchListener = (path4, fullPath, options, handlers) => {
     addAndConvert(cont, KEY_ERR, errHandler);
     addAndConvert(cont, KEY_RAW, rawEmitter);
   } else {
-    watcher = createFsWatchInstance(path4, options, fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS), errHandler, fsWatchBroadcast.bind(null, fullPath, KEY_RAW));
+    watcher = createFsWatchInstance(path3, options, fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS), errHandler, fsWatchBroadcast.bind(null, fullPath, KEY_RAW));
     if (!watcher)
       return;
     watcher.on(EV.ERROR, async (error) => {
@@ -223896,7 +223916,7 @@ var setFsWatchListener = (path4, fullPath, options, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows && error.code === "EPERM") {
         try {
-          const fd = await open(path4, "r");
+          const fd = await open(path3, "r");
           await fd.close();
           broadcastErr(error);
         } catch (err) {}
@@ -223926,7 +223946,7 @@ var setFsWatchListener = (path4, fullPath, options, handlers) => {
   };
 };
 var FsWatchFileInstances = new Map;
-var setFsWatchFileListener = (path4, fullPath, options, handlers) => {
+var setFsWatchFileListener = (path3, fullPath, options, handlers) => {
   const { listener, rawEmitter } = handlers;
   let cont = FsWatchFileInstances.get(fullPath);
   const copts = cont && cont.options;
@@ -223948,7 +223968,7 @@ var setFsWatchFileListener = (path4, fullPath, options, handlers) => {
         });
         const currmtime = curr.mtimeMs;
         if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-          foreach(cont.listeners, (listener2) => listener2(path4, curr));
+          foreach(cont.listeners, (listener2) => listener2(path3, curr));
         }
       })
     };
@@ -223971,13 +223991,13 @@ class NodeFsHandler {
     this.fsw = fsW;
     this._boundHandleError = (error) => fsW._handleError(error);
   }
-  _watchWithNodeFs(path4, listener) {
+  _watchWithNodeFs(path3, listener) {
     const opts = this.fsw.options;
-    const directory = sysPath.dirname(path4);
-    const basename2 = sysPath.basename(path4);
+    const directory = sysPath.dirname(path3);
+    const basename2 = sysPath.basename(path3);
     const parent = this.fsw._getWatchedDir(directory);
     parent.add(basename2);
-    const absolutePath = sysPath.resolve(path4);
+    const absolutePath = sysPath.resolve(path3);
     const options = {
       persistent: opts.persistent
     };
@@ -223987,12 +224007,12 @@ class NodeFsHandler {
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
       options.interval = enableBin && isBinaryPath(basename2) ? opts.binaryInterval : opts.interval;
-      closer = setFsWatchFileListener(path4, absolutePath, options, {
+      closer = setFsWatchFileListener(path3, absolutePath, options, {
         listener,
         rawEmitter: this.fsw._emitRaw
       });
     } else {
-      closer = setFsWatchListener(path4, absolutePath, options, {
+      closer = setFsWatchListener(path3, absolutePath, options, {
         listener,
         errHandler: this._boundHandleError,
         rawEmitter: this.fsw._emitRaw
@@ -224010,7 +224030,7 @@ class NodeFsHandler {
     let prevStats = stats;
     if (parent.has(basename2))
       return;
-    const listener = async (path4, newStats) => {
+    const listener = async (path3, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
         return;
       if (!newStats || newStats.mtimeMs === 0) {
@@ -224024,11 +224044,11 @@ class NodeFsHandler {
             this.fsw._emit(EV.CHANGE, file, newStats2);
           }
           if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-            this.fsw._closeFile(path4);
+            this.fsw._closeFile(path3);
             prevStats = newStats2;
             const closer2 = this._watchWithNodeFs(file, listener);
             if (closer2)
-              this.fsw._addPathCloser(path4, closer2);
+              this.fsw._addPathCloser(path3, closer2);
           } else {
             prevStats = newStats2;
           }
@@ -224052,7 +224072,7 @@ class NodeFsHandler {
     }
     return closer;
   }
-  async _handleSymlink(entry, directory, path4, item) {
+  async _handleSymlink(entry, directory, path3, item) {
     if (this.fsw.closed) {
       return;
     }
@@ -224062,7 +224082,7 @@ class NodeFsHandler {
       this.fsw._incrReadyCount();
       let linkPath;
       try {
-        linkPath = await fsrealpath(path4);
+        linkPath = await fsrealpath(path3);
       } catch (e) {
         this.fsw._emitReady();
         return true;
@@ -224072,12 +224092,12 @@ class NodeFsHandler {
       if (dir.has(item)) {
         if (this.fsw._symlinkPaths.get(full) !== linkPath) {
           this.fsw._symlinkPaths.set(full, linkPath);
-          this.fsw._emit(EV.CHANGE, path4, entry.stats);
+          this.fsw._emit(EV.CHANGE, path3, entry.stats);
         }
       } else {
         dir.add(item);
         this.fsw._symlinkPaths.set(full, linkPath);
-        this.fsw._emit(EV.ADD, path4, entry.stats);
+        this.fsw._emit(EV.ADD, path3, entry.stats);
       }
       this.fsw._emitReady();
       return true;
@@ -224106,9 +224126,9 @@ class NodeFsHandler {
         return;
       }
       const item = entry.path;
-      let path4 = sysPath.join(directory, item);
+      let path3 = sysPath.join(directory, item);
       current.add(item);
-      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path4, item)) {
+      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path3, item)) {
         return;
       }
       if (this.fsw.closed) {
@@ -224117,8 +224137,8 @@ class NodeFsHandler {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path4 = sysPath.join(dir, sysPath.relative(dir, path4));
-        this._addToNodeFs(path4, initialAdd, wh, depth + 1);
+        path3 = sysPath.join(dir, sysPath.relative(dir, path3));
+        this._addToNodeFs(path3, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
     return new Promise((resolve2, reject) => {
@@ -224167,13 +224187,13 @@ class NodeFsHandler {
     }
     return closer;
   }
-  async _addToNodeFs(path4, initialAdd, priorWh, depth, target) {
+  async _addToNodeFs(path3, initialAdd, priorWh, depth, target) {
     const ready = this.fsw._emitReady;
-    if (this.fsw._isIgnored(path4) || this.fsw.closed) {
+    if (this.fsw._isIgnored(path3) || this.fsw.closed) {
       ready();
       return false;
     }
-    const wh = this.fsw._getWatchHelpers(path4);
+    const wh = this.fsw._getWatchHelpers(path3);
     if (priorWh) {
       wh.filterPath = (entry) => priorWh.filterPath(entry);
       wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -224189,8 +224209,8 @@ class NodeFsHandler {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sysPath.resolve(path4);
-        const targetPath = follow ? await fsrealpath(path4) : path4;
+        const absPath = sysPath.resolve(path3);
+        const targetPath = follow ? await fsrealpath(path3) : path3;
         if (this.fsw.closed)
           return;
         closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -224200,29 +224220,29 @@ class NodeFsHandler {
           this.fsw._symlinkPaths.set(absPath, targetPath);
         }
       } else if (stats.isSymbolicLink()) {
-        const targetPath = follow ? await fsrealpath(path4) : path4;
+        const targetPath = follow ? await fsrealpath(path3) : path3;
         if (this.fsw.closed)
           return;
         const parent = sysPath.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
-        closer = await this._handleDir(parent, stats, initialAdd, depth, path4, wh, targetPath);
+        closer = await this._handleDir(parent, stats, initialAdd, depth, path3, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== undefined) {
-          this.fsw._symlinkPaths.set(sysPath.resolve(path4), targetPath);
+          this.fsw._symlinkPaths.set(sysPath.resolve(path3), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
       }
       ready();
       if (closer)
-        this.fsw._addPathCloser(path4, closer);
+        this.fsw._addPathCloser(path3, closer);
       return false;
     } catch (error) {
       if (this.fsw._handleError(error)) {
         ready();
-        return path4;
+        return path3;
       }
     }
   }
@@ -224266,26 +224286,26 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path4) {
-  if (typeof path4 !== "string")
+function normalizePath(path3) {
+  if (typeof path3 !== "string")
     throw new Error("string expected");
-  path4 = sysPath2.normalize(path4);
-  path4 = path4.replace(/\\/g, "/");
+  path3 = sysPath2.normalize(path3);
+  path3 = path3.replace(/\\/g, "/");
   let prepend = false;
-  if (path4.startsWith("//"))
+  if (path3.startsWith("//"))
     prepend = true;
   const DOUBLE_SLASH_RE2 = /\/\//;
-  while (path4.match(DOUBLE_SLASH_RE2))
-    path4 = path4.replace(DOUBLE_SLASH_RE2, "/");
+  while (path3.match(DOUBLE_SLASH_RE2))
+    path3 = path3.replace(DOUBLE_SLASH_RE2, "/");
   if (prepend)
-    path4 = "/" + path4;
-  return path4;
+    path3 = "/" + path3;
+  return path3;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path4 = normalizePath(testString);
+  const path3 = normalizePath(testString);
   for (let index = 0;index < patterns.length; index++) {
     const pattern = patterns[index];
-    if (pattern(path4, stats)) {
+    if (pattern(path3, stats)) {
       return true;
     }
   }
@@ -224325,19 +224345,19 @@ var toUnix = (string) => {
   }
   return str;
 };
-var normalizePathToUnix = (path4) => toUnix(sysPath2.normalize(toUnix(path4)));
-var normalizeIgnored = (cwd = "") => (path4) => {
-  if (typeof path4 === "string") {
-    return normalizePathToUnix(sysPath2.isAbsolute(path4) ? path4 : sysPath2.join(cwd, path4));
+var normalizePathToUnix = (path3) => toUnix(sysPath2.normalize(toUnix(path3)));
+var normalizeIgnored = (cwd = "") => (path3) => {
+  if (typeof path3 === "string") {
+    return normalizePathToUnix(sysPath2.isAbsolute(path3) ? path3 : sysPath2.join(cwd, path3));
   } else {
-    return path4;
+    return path3;
   }
 };
-var getAbsolutePath = (path4, cwd) => {
-  if (sysPath2.isAbsolute(path4)) {
-    return path4;
+var getAbsolutePath = (path3, cwd) => {
+  if (sysPath2.isAbsolute(path3)) {
+    return path3;
   }
-  return sysPath2.join(cwd, path4);
+  return sysPath2.join(cwd, path3);
 };
 var EMPTY_SET = Object.freeze(new Set);
 
@@ -224394,10 +224414,10 @@ var STAT_METHOD_F = "stat";
 var STAT_METHOD_L = "lstat";
 
 class WatchHelper {
-  constructor(path4, follow, fsw) {
+  constructor(path3, follow, fsw) {
     this.fsw = fsw;
-    const watchPath = path4;
-    this.path = path4 = path4.replace(REPLACER_RE, "");
+    const watchPath = path3;
+    this.path = path3 = path3.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
     this.fullWatchPath = sysPath2.resolve(watchPath);
     this.dirParts = [];
@@ -224510,20 +224530,20 @@ class FSWatcher extends EventEmitter2 {
     this._closePromise = undefined;
     let paths = unifyPaths(paths_);
     if (cwd) {
-      paths = paths.map((path4) => {
-        const absPath = getAbsolutePath(path4, cwd);
+      paths = paths.map((path3) => {
+        const absPath = getAbsolutePath(path3, cwd);
         return absPath;
       });
     }
-    paths.forEach((path4) => {
-      this._removeIgnoredPath(path4);
+    paths.forEach((path3) => {
+      this._removeIgnoredPath(path3);
     });
     this._userIgnored = undefined;
     if (!this._readyCount)
       this._readyCount = 0;
     this._readyCount += paths.length;
-    Promise.all(paths.map(async (path4) => {
-      const res = await this._nodeFsHandler._addToNodeFs(path4, !_internal, undefined, 0, _origAdd);
+    Promise.all(paths.map(async (path3) => {
+      const res = await this._nodeFsHandler._addToNodeFs(path3, !_internal, undefined, 0, _origAdd);
       if (res)
         this._emitReady();
       return res;
@@ -224542,17 +224562,17 @@ class FSWatcher extends EventEmitter2 {
       return this;
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
-    paths.forEach((path4) => {
-      if (!sysPath2.isAbsolute(path4) && !this._closers.has(path4)) {
+    paths.forEach((path3) => {
+      if (!sysPath2.isAbsolute(path3) && !this._closers.has(path3)) {
         if (cwd)
-          path4 = sysPath2.join(cwd, path4);
-        path4 = sysPath2.resolve(path4);
+          path3 = sysPath2.join(cwd, path3);
+        path3 = sysPath2.resolve(path3);
       }
-      this._closePath(path4);
-      this._addIgnoredPath(path4);
-      if (this._watched.has(path4)) {
+      this._closePath(path3);
+      this._addIgnoredPath(path3);
+      if (this._watched.has(path3)) {
         this._addIgnoredPath({
-          path: path4,
+          path: path3,
           recursive: true
         });
       }
@@ -224601,38 +224621,38 @@ class FSWatcher extends EventEmitter2 {
     if (event !== EVENTS.ERROR)
       this.emit(EVENTS.ALL, event, ...args);
   }
-  async _emit(event, path4, stats) {
+  async _emit(event, path3, stats) {
     if (this.closed)
       return;
     const opts = this.options;
     if (isWindows)
-      path4 = sysPath2.normalize(path4);
+      path3 = sysPath2.normalize(path3);
     if (opts.cwd)
-      path4 = sysPath2.relative(opts.cwd, path4);
-    const args = [path4];
+      path3 = sysPath2.relative(opts.cwd, path3);
+    const args = [path3];
     if (stats != null)
       args.push(stats);
     const awf = opts.awaitWriteFinish;
     let pw;
-    if (awf && (pw = this._pendingWrites.get(path4))) {
+    if (awf && (pw = this._pendingWrites.get(path3))) {
       pw.lastChange = new Date;
       return this;
     }
     if (opts.atomic) {
       if (event === EVENTS.UNLINK) {
-        this._pendingUnlinks.set(path4, [event, ...args]);
+        this._pendingUnlinks.set(path3, [event, ...args]);
         setTimeout(() => {
-          this._pendingUnlinks.forEach((entry, path5) => {
+          this._pendingUnlinks.forEach((entry, path4) => {
             this.emit(...entry);
             this.emit(EVENTS.ALL, ...entry);
-            this._pendingUnlinks.delete(path5);
+            this._pendingUnlinks.delete(path4);
           });
         }, typeof opts.atomic === "number" ? opts.atomic : 100);
         return this;
       }
-      if (event === EVENTS.ADD && this._pendingUnlinks.has(path4)) {
+      if (event === EVENTS.ADD && this._pendingUnlinks.has(path3)) {
         event = EVENTS.CHANGE;
-        this._pendingUnlinks.delete(path4);
+        this._pendingUnlinks.delete(path3);
       }
     }
     if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -224650,16 +224670,16 @@ class FSWatcher extends EventEmitter2 {
           this.emitWithAll(event, args);
         }
       };
-      this._awaitWriteFinish(path4, awf.stabilityThreshold, event, awfEmit);
+      this._awaitWriteFinish(path3, awf.stabilityThreshold, event, awfEmit);
       return this;
     }
     if (event === EVENTS.CHANGE) {
-      const isThrottled = !this._throttle(EVENTS.CHANGE, path4, 50);
+      const isThrottled = !this._throttle(EVENTS.CHANGE, path3, 50);
       if (isThrottled)
         return this;
     }
     if (opts.alwaysStat && stats === undefined && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path4) : path4;
+      const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path3) : path3;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -224678,23 +224698,23 @@ class FSWatcher extends EventEmitter2 {
     }
     return error || this.closed;
   }
-  _throttle(actionType, path4, timeout) {
+  _throttle(actionType, path3, timeout) {
     if (!this._throttled.has(actionType)) {
       this._throttled.set(actionType, new Map);
     }
     const action = this._throttled.get(actionType);
     if (!action)
       throw new Error("invalid throttle");
-    const actionPath = action.get(path4);
+    const actionPath = action.get(path3);
     if (actionPath) {
       actionPath.count++;
       return false;
     }
     let timeoutObject;
     const clear = () => {
-      const item = action.get(path4);
+      const item = action.get(path3);
       const count = item ? item.count : 0;
-      action.delete(path4);
+      action.delete(path3);
       clearTimeout(timeoutObject);
       if (item)
         clearTimeout(item.timeoutObject);
@@ -224702,50 +224722,50 @@ class FSWatcher extends EventEmitter2 {
     };
     timeoutObject = setTimeout(clear, timeout);
     const thr = { timeoutObject, clear, count: 0 };
-    action.set(path4, thr);
+    action.set(path3, thr);
     return thr;
   }
   _incrReadyCount() {
     return this._readyCount++;
   }
-  _awaitWriteFinish(path4, threshold, event, awfEmit) {
+  _awaitWriteFinish(path3, threshold, event, awfEmit) {
     const awf = this.options.awaitWriteFinish;
     if (typeof awf !== "object")
       return;
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
-    let fullPath = path4;
-    if (this.options.cwd && !sysPath2.isAbsolute(path4)) {
-      fullPath = sysPath2.join(this.options.cwd, path4);
+    let fullPath = path3;
+    if (this.options.cwd && !sysPath2.isAbsolute(path3)) {
+      fullPath = sysPath2.join(this.options.cwd, path3);
     }
     const now = new Date;
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
       statcb(fullPath, (err, curStat) => {
-        if (err || !writes.has(path4)) {
+        if (err || !writes.has(path3)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
           return;
         }
         const now2 = Number(new Date);
         if (prevStat && curStat.size !== prevStat.size) {
-          writes.get(path4).lastChange = now2;
+          writes.get(path3).lastChange = now2;
         }
-        const pw = writes.get(path4);
+        const pw = writes.get(path3);
         const df = now2 - pw.lastChange;
         if (df >= threshold) {
-          writes.delete(path4);
+          writes.delete(path3);
           awfEmit(undefined, curStat);
         } else {
           timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
         }
       });
     }
-    if (!writes.has(path4)) {
-      writes.set(path4, {
+    if (!writes.has(path3)) {
+      writes.set(path3, {
         lastChange: now,
         cancelWait: () => {
-          writes.delete(path4);
+          writes.delete(path3);
           clearTimeout(timeoutHandler);
           return event;
         }
@@ -224753,8 +224773,8 @@ class FSWatcher extends EventEmitter2 {
       timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval);
     }
   }
-  _isIgnored(path4, stats) {
-    if (this.options.atomic && DOT_RE.test(path4))
+  _isIgnored(path3, stats) {
+    if (this.options.atomic && DOT_RE.test(path3))
       return true;
     if (!this._userIgnored) {
       const { cwd } = this.options;
@@ -224764,13 +224784,13 @@ class FSWatcher extends EventEmitter2 {
       const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
       this._userIgnored = anymatch(list, undefined);
     }
-    return this._userIgnored(path4, stats);
+    return this._userIgnored(path3, stats);
   }
-  _isntIgnored(path4, stat4) {
-    return !this._isIgnored(path4, stat4);
+  _isntIgnored(path3, stat4) {
+    return !this._isIgnored(path3, stat4);
   }
-  _getWatchHelpers(path4) {
-    return new WatchHelper(path4, this.options.followSymlinks, this);
+  _getWatchHelpers(path3) {
+    return new WatchHelper(path3, this.options.followSymlinks, this);
   }
   _getWatchedDir(directory) {
     const dir = sysPath2.resolve(directory);
@@ -224784,57 +224804,57 @@ class FSWatcher extends EventEmitter2 {
     return Boolean(Number(stats.mode) & 256);
   }
   _remove(directory, item, isDirectory) {
-    const path4 = sysPath2.join(directory, item);
-    const fullPath = sysPath2.resolve(path4);
-    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path4) || this._watched.has(fullPath);
-    if (!this._throttle("remove", path4, 100))
+    const path3 = sysPath2.join(directory, item);
+    const fullPath = sysPath2.resolve(path3);
+    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path3) || this._watched.has(fullPath);
+    if (!this._throttle("remove", path3, 100))
       return;
     if (!isDirectory && this._watched.size === 1) {
       this.add(directory, item, true);
     }
-    const wp = this._getWatchedDir(path4);
+    const wp = this._getWatchedDir(path3);
     const nestedDirectoryChildren = wp.getChildren();
-    nestedDirectoryChildren.forEach((nested) => this._remove(path4, nested));
+    nestedDirectoryChildren.forEach((nested) => this._remove(path3, nested));
     const parent = this._getWatchedDir(directory);
     const wasTracked = parent.has(item);
     parent.remove(item);
     if (this._symlinkPaths.has(fullPath)) {
       this._symlinkPaths.delete(fullPath);
     }
-    let relPath = path4;
+    let relPath = path3;
     if (this.options.cwd)
-      relPath = sysPath2.relative(this.options.cwd, path4);
+      relPath = sysPath2.relative(this.options.cwd, path3);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
         return;
     }
-    this._watched.delete(path4);
+    this._watched.delete(path3);
     this._watched.delete(fullPath);
     const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-    if (wasTracked && !this._isIgnored(path4))
-      this._emit(eventName, path4);
-    this._closePath(path4);
+    if (wasTracked && !this._isIgnored(path3))
+      this._emit(eventName, path3);
+    this._closePath(path3);
   }
-  _closePath(path4) {
-    this._closeFile(path4);
-    const dir = sysPath2.dirname(path4);
-    this._getWatchedDir(dir).remove(sysPath2.basename(path4));
+  _closePath(path3) {
+    this._closeFile(path3);
+    const dir = sysPath2.dirname(path3);
+    this._getWatchedDir(dir).remove(sysPath2.basename(path3));
   }
-  _closeFile(path4) {
-    const closers = this._closers.get(path4);
+  _closeFile(path3) {
+    const closers = this._closers.get(path3);
     if (!closers)
       return;
     closers.forEach((closer) => closer());
-    this._closers.delete(path4);
+    this._closers.delete(path3);
   }
-  _addPathCloser(path4, closer) {
+  _addPathCloser(path3, closer) {
     if (!closer)
       return;
-    let list = this._closers.get(path4);
+    let list = this._closers.get(path3);
     if (!list) {
       list = [];
-      this._closers.set(path4, list);
+      this._closers.set(path3, list);
     }
     list.push(closer);
   }
@@ -225080,7 +225100,7 @@ class Mutex {
 }
 
 // src/service/environment_store.ts
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 import * as fs7 from "fs";
 import * as path10 from "path";
 
@@ -225120,8 +225140,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path4) {
-  return path4 instanceof String && cache.has(path4);
+function isPathSpec(path3) {
+  return path3 instanceof String && cache.has(path3);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -225207,8 +225227,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = `
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path4) {
-  return import_file_exists.exists(path4, import_file_exists.FOLDER);
+function folderExists(path3) {
+  return import_file_exists.exists(path3, import_file_exists.FOLDER);
 }
 function append2(target, item) {
   if (Array.isArray(target)) {
@@ -225589,8 +225609,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path4) {
-      return /^\.(git)?$/.test(path4.trim());
+    parser(path3) {
+      return /^\.(git)?$/.test(path3.trim());
     }
   };
 }
@@ -226001,11 +226021,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set;
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path4, line, preview] = input.split(NULL);
-    paths.add(path4);
-    (results[path4] = results[path4] || []).push({
+    const [path3, line, preview] = input.split(NULL);
+    paths.add(path3);
+    (results[path3] = results[path3] || []).push({
       line: asNumber(line),
-      path: path4,
+      path: path3,
       preview
     });
   });
@@ -226667,14 +226687,14 @@ var init_hash_object = __esm({
     init_task();
   }
 });
-function parseInit(bare, path4, text) {
+function parseInit(bare, path3, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path4, false, result[1]);
+    return new InitSummary(bare, path3, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path4, true, result[1]);
+    return new InitSummary(bare, path3, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -226685,7 +226705,7 @@ function parseInit(bare, path4, text) {
       break;
     }
   }
-  return new InitSummary(bare, path4, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path3, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -226693,9 +226713,9 @@ var reInitResponseRegex;
 var init_InitSummary = __esm({
   "src/lib/responses/InitSummary.ts"() {
     InitSummary = class {
-      constructor(bare, path4, existing, gitDir) {
+      constructor(bare, path3, existing, gitDir) {
         this.bare = bare;
-        this.path = path4;
+        this.path = path3;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -226707,7 +226727,7 @@ var init_InitSummary = __esm({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path4, customArgs) {
+function initTask(bare = false, path3, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -226716,7 +226736,7 @@ function initTask(bare = false, path4, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path4, text);
+      return parseInit(commands.includes("--bare"), path3, text);
     }
   };
 }
@@ -227431,12 +227451,12 @@ var init_FileStatusSummary = __esm({
   "src/lib/responses/FileStatusSummary.ts"() {
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path4, index, working_dir) {
-        this.path = path4;
+      constructor(path3, index, working_dir) {
+        this.path = path3;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path4) || [null, path4, path4];
+          const detail = fromPathRegex.exec(path3) || [null, path3, path3];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -227467,14 +227487,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path4) {
+  function data(index, workingDir, path3) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path4);
+      handler(result, path3);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path4, index, workingDir));
+      result.files.push(new FileStatusSummary(path3, index, workingDir));
     }
   }
 }
@@ -227705,8 +227725,8 @@ var init_simple_git_api = __esm({
         }
         return this._runTask(configurationErrorTask("Git.cwd: workingDirectory must be supplied as a string"), next);
       }
-      hashObject(path4, write) {
-        return this._runTask(hashObjectTask(path4, write === true), trailingFunctionArgument(arguments));
+      hashObject(path3, write) {
+        return this._runTask(hashObjectTask(path3, write === true), trailingFunctionArgument(arguments));
       }
       init(bare) {
         return this._runTask(initTask(bare === true, this._executor.cwd, getTrailingOptions(arguments)), trailingFunctionArgument(arguments));
@@ -228283,8 +228303,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path4) {
-  return subModuleTask(["add", repo, path4]);
+function addSubModuleTask(repo, path3) {
+  return subModuleTask(["add", repo, path3]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -228552,8 +228572,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path4, then) {
-      return this._runTask(addSubModuleTask2(repo, path4), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path3, then) {
+      return this._runTask(addSubModuleTask2(repo, path3), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(updateSubModuleTask2(getTrailingOptions2(arguments, true)), trailingFunctionArgument2(arguments));
@@ -229069,9 +229089,9 @@ import { Writable } from "stream";
 
 // src/config.ts
 import fs2 from "fs";
-import path4 from "path";
+import path3 from "path";
 import { fileURLToPath } from "url";
-var BUNDLED_DEFAULT_CONFIG_PATH = path4.join(path4.dirname(fileURLToPath(import.meta.url)), "default-publisher.config.json");
+var BUNDLED_DEFAULT_CONFIG_PATH = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "default-publisher.config.json");
 function resolvePublisherConfigPath(serverRoot) {
   const explicitPath = process.env.PUBLISHER_CONFIG_PATH;
   if (explicitPath && explicitPath.length > 0) {
@@ -229080,7 +229100,7 @@ function resolvePublisherConfigPath(serverRoot) {
     }
     return { path: explicitPath, isBundledDefault: false };
   }
-  const serverRootPath = path4.join(serverRoot, PUBLISHER_CONFIG_NAME);
+  const serverRootPath = path3.join(serverRoot, PUBLISHER_CONFIG_NAME);
   if (fs2.existsSync(serverRootPath)) {
     return { path: serverRootPath, isBundledDefault: false };
   }
@@ -229089,6 +229109,73 @@ function resolvePublisherConfigPath(serverRoot) {
   }
   return null;
 }
+var DEFAULT_HIGH_WATER_FRACTION = 0.8;
+var DEFAULT_LOW_WATER_FRACTION = 0.7;
+var DEFAULT_CHECK_INTERVAL_MS = 5000;
+var MIN_CHECK_INTERVAL_MS = 100;
+function parseIntEnv(name) {
+  const raw = process.env[name];
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || String(value) !== raw.trim()) {
+    throw new Error(`Invalid value for ${name}: expected a base-10 integer, got "${raw}"`);
+  }
+  return value;
+}
+function parseFloatEnv(name) {
+  const raw = process.env[name];
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const value = Number.parseFloat(raw);
+  if (!Number.isFinite(value)) {
+    throw new Error(`Invalid value for ${name}: expected a finite number, got "${raw}"`);
+  }
+  return value;
+}
+function parseBoolEnv(name) {
+  const raw = process.env[name];
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const normalised = raw.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalised))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalised))
+    return false;
+  throw new Error(`Invalid value for ${name}: expected a boolean (true/false), got "${raw}"`);
+}
+var getMemoryGovernorConfig = () => {
+  const maxMemoryBytes = parseIntEnv("PUBLISHER_MAX_MEMORY_BYTES");
+  if (maxMemoryBytes === undefined || maxMemoryBytes === 0) {
+    return null;
+  }
+  if (maxMemoryBytes < 0) {
+    throw new Error(`PUBLISHER_MAX_MEMORY_BYTES must be a positive integer (got ${maxMemoryBytes})`);
+  }
+  const highWaterFraction = parseFloatEnv("PUBLISHER_MEMORY_HIGH_WATER_FRACTION") ?? DEFAULT_HIGH_WATER_FRACTION;
+  const lowWaterFraction = parseFloatEnv("PUBLISHER_MEMORY_LOW_WATER_FRACTION") ?? DEFAULT_LOW_WATER_FRACTION;
+  const checkIntervalMs = parseIntEnv("PUBLISHER_MEMORY_CHECK_INTERVAL_MS") ?? DEFAULT_CHECK_INTERVAL_MS;
+  const backpressureEnabled = parseBoolEnv("PUBLISHER_MEMORY_BACKPRESSURE") ?? true;
+  if (highWaterFraction <= 0 || highWaterFraction >= 1) {
+    throw new Error(`PUBLISHER_MEMORY_HIGH_WATER_FRACTION must be in (0, 1) (got ${highWaterFraction})`);
+  }
+  if (lowWaterFraction <= 0 || lowWaterFraction >= 1) {
+    throw new Error(`PUBLISHER_MEMORY_LOW_WATER_FRACTION must be in (0, 1) (got ${lowWaterFraction})`);
+  }
+  if (lowWaterFraction >= highWaterFraction) {
+    throw new Error(`PUBLISHER_MEMORY_LOW_WATER_FRACTION (${lowWaterFraction}) must be strictly less than PUBLISHER_MEMORY_HIGH_WATER_FRACTION (${highWaterFraction})`);
+  }
+  if (checkIntervalMs < MIN_CHECK_INTERVAL_MS) {
+    throw new Error(`PUBLISHER_MEMORY_CHECK_INTERVAL_MS must be >= ${MIN_CHECK_INTERVAL_MS} (got ${checkIntervalMs})`);
+  }
+  return {
+    maxMemoryBytes,
+    highWaterFraction,
+    lowWaterFraction,
+    checkIntervalMs,
+    backpressureEnabled
+  };
+};
 function substituteEnvVars(value) {
   const envVarPattern = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
   return value.replace(envVarPattern, (_match, varName) => {
@@ -229128,7 +229215,7 @@ var getPublisherConfig = (serverRoot) => {
   }
   const publisherConfigPath = resolved.path;
   if (resolved.isBundledDefault) {
-    logger.info(`No publisher.config.json found at ${path4.join(serverRoot, PUBLISHER_CONFIG_NAME)}; falling back to bundled DuckDB-only default. Pass --config <path> or place a config in the server root to override.`);
+    logger.info(`No publisher.config.json found at ${path3.join(serverRoot, PUBLISHER_CONFIG_NAME)}; falling back to bundled DuckDB-only default. Pass --config <path> or place a config in the server root to override.`);
   }
   let rawConfig;
   try {
@@ -229274,15 +229361,6 @@ function markReady() {
     logger.error("Service is already draining - cannot mark as ready");
   }
 }
-function markDegraded() {
-  if (operationalState !== "draining") {
-    operationalState = "degraded";
-    ready = false;
-    logger.warn("Service marked as degraded; one or more environments failed to initialize. Readiness probe will fail until the config is fixed and the process restarts.");
-  } else {
-    logger.error("Service is already draining - cannot mark as degraded");
-  }
-}
 function markNotReady() {
   ready = false;
   logger.info("Service marked as not ready - readiness probe will fail");
@@ -229366,7 +229444,7 @@ import * as crypto3 from "crypto";
 
 // src/storage/duckdb/DuckDBConnection.ts
 import duckdb from "duckdb";
-import * as path5 from "path";
+import * as path4 from "path";
 
 class DuckDBConnection2 {
   db = null;
@@ -229374,7 +229452,7 @@ class DuckDBConnection2 {
   dbPath;
   mutex = new Mutex;
   constructor(dbPath) {
-    this.dbPath = dbPath || path5.join(process.cwd(), "publisher.db");
+    this.dbPath = dbPath || path4.join(process.cwd(), "publisher.db");
   }
   async initialize() {
     return new Promise((resolve3, reject) => {
@@ -230523,9 +230601,62 @@ class StorageManager {
 
 // src/service/environment.ts
 import { MalloyError as MalloyError3, Runtime as Runtime2 } from "@malloydata/malloy";
+import crypto4 from "crypto";
 import * as fs6 from "fs";
 import * as path9 from "path";
 
+// src/path_safety.ts
+import * as path5 from "path";
+var SAFE_NAME_RE = /^(?!\.\.?$)(?!\.)[A-Za-z0-9._-]{1,255}$/;
+var MAX_MODEL_PATH_LEN = 1024;
+var SAFE_ENVIRONMENT_PATH_RE = /^(?:\/|[A-Za-z]:[\\/])[\x20-\x7E]*$/;
+var MAX_ENVIRONMENT_PATH_LEN = 4096;
+function assertSafePackageName(packageName) {
+  if (typeof packageName !== "string" || !SAFE_NAME_RE.test(packageName)) {
+    throw new BadRequestError(`Invalid package name: must be 1-255 characters of letters, digits, "-", "_", or "." and must not start with "."`);
+  }
+}
+function assertSafeRelativeModelPath(modelPath) {
+  if (typeof modelPath !== "string" || modelPath.length === 0 || modelPath.length > MAX_MODEL_PATH_LEN || modelPath.includes("\x00") || modelPath.includes("\\") || path5.isAbsolute(modelPath) || modelPath.startsWith("/")) {
+    throw new BadRequestError(`Invalid model path`);
+  }
+  const segments = modelPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") {
+      throw new BadRequestError(`Invalid model path`);
+    }
+    if (segment.startsWith(".")) {
+      throw new BadRequestError(`Invalid model path`);
+    }
+  }
+}
+function assertSafeEnvironmentPath(environmentPath) {
+  if (typeof environmentPath !== "string") {
+    throw new BadRequestError(`Invalid environment path: must be a string`);
+  }
+  if (environmentPath.length === 0 || environmentPath.length > MAX_ENVIRONMENT_PATH_LEN) {
+    throw new BadRequestError(`Invalid environment path: bad length`);
+  }
+  if (environmentPath.indexOf("\x00") !== -1) {
+    throw new BadRequestError(`Invalid environment path: contains NUL byte`);
+  }
+  if (environmentPath.indexOf("..") !== -1) {
+    throw new BadRequestError(`Invalid environment path: contains ".." traversal segment`);
+  }
+  if (!SAFE_ENVIRONMENT_PATH_RE.test(environmentPath)) {
+    throw new BadRequestError(`Invalid environment path: must be an absolute path of printable ASCII characters`);
+  }
+}
+function safeJoinUnderRoot(root, ...segments) {
+  const resolvedRoot = path5.resolve(root);
+  const joined = path5.resolve(resolvedRoot, ...segments);
+  const rootWithSep = resolvedRoot.endsWith(path5.sep) ? resolvedRoot : resolvedRoot + path5.sep;
+  if (joined !== resolvedRoot && !joined.startsWith(rootWithSep)) {
+    throw new BadRequestError(`Resolved path is outside of root`);
+  }
+  return joined;
+}
+
 // src/utils.ts
 import * as fs3 from "fs";
 import * as path6 from "path";
@@ -231707,6 +231838,8 @@ class Package {
 }
 
 // src/service/environment.ts
+var STAGING_DIR_NAME = ".staging";
+var RETIRED_DIR_NAME = ".retired";
 var RETIRED_CONNECTION_DRAIN_MS = 30000;
 
 class Environment {
@@ -231720,7 +231853,9 @@ class Environment {
   environmentPath;
   environmentName;
   metadata;
+  memoryGovernor = null;
   constructor(environmentName, environmentPath, malloyConfig, apiConnections) {
+    assertSafeEnvironmentPath(environmentPath);
     this.environmentName = environmentName;
     this.environmentPath = environmentPath;
     this.malloyConfig = malloyConfig;
@@ -231777,6 +231912,7 @@ class Environment {
       apiConnections: malloyConfig.apiConnections
     });
     const environment = new Environment(environmentName, environmentPath, malloyConfig, malloyConfig.apiConnections);
+    await Environment.sweepStaleInstallDirs(environmentPath);
     return environment;
   }
   async reloadEnvironmentMetadata() {
@@ -231793,46 +231929,50 @@ class Environment {
     return this.metadata;
   }
   async compileSource(packageName, modelName, source, includeSql = false) {
-    const modelDir = path9.dirname(path9.join(this.environmentPath, packageName, modelName));
-    const virtualUri = `file://${path9.join(modelDir, "__compile_check.malloy")}`;
-    const virtualUrl = new URL(virtualUri);
-    const modelPath = path9.join(this.environmentPath, packageName, modelName);
-    let modelContent = "";
-    try {
-      modelContent = await fs6.promises.readFile(modelPath, "utf8");
-    } catch {}
-    const fullSource = modelContent ? `${modelContent}
+    assertSafePackageName(packageName);
+    assertSafeRelativeModelPath(modelName);
+    return this.withPackageLock(packageName, async () => {
+      const modelPath = safeJoinUnderRoot(this.environmentPath, packageName, modelName);
+      const modelDir = path9.dirname(modelPath);
+      const virtualUri = `file://${path9.join(modelDir, "__compile_check.malloy")}`;
+      const virtualUrl = new URL(virtualUri);
+      let modelContent = "";
+      try {
+        modelContent = await fs6.promises.readFile(modelPath, "utf8");
+      } catch {}
+      const fullSource = modelContent ? `${modelContent}
 ${source}` : source;
-    const interceptingReader = {
-      readURL: async (url2) => {
-        if (url2.toString() === virtualUri) {
-          return fullSource;
+      const interceptingReader = {
+        readURL: async (url2) => {
+          if (url2.toString() === virtualUri) {
+            return fullSource;
+          }
+          return URL_READER.readURL(url2);
+        }
+      };
+      const pkg = await this._loadOrGetPackageLocked(packageName);
+      const runtime = new Runtime2({
+        urlReader: interceptingReader,
+        config: pkg.getMalloyConfig()
+      });
+      try {
+        const modelMaterializer = runtime.loadModel(virtualUrl);
+        const model = await modelMaterializer.getModel();
+        let sql;
+        if (includeSql) {
+          try {
+            const queryMaterializer = modelMaterializer.loadFinalQuery();
+            sql = await queryMaterializer.getSQL();
+          } catch {}
         }
-        return URL_READER.readURL(url2);
+        return { problems: model.problems, sql };
+      } catch (error) {
+        if (error instanceof MalloyError3) {
+          return { problems: error.problems };
+        }
+        throw error;
       }
-    };
-    const pkg = await this.getPackage(packageName);
-    const runtime = new Runtime2({
-      urlReader: interceptingReader,
-      config: pkg.getMalloyConfig()
     });
-    try {
-      const modelMaterializer = runtime.loadModel(virtualUrl);
-      const model = await modelMaterializer.getModel();
-      let sql;
-      if (includeSql) {
-        try {
-          const queryMaterializer = modelMaterializer.loadFinalQuery();
-          sql = await queryMaterializer.getSQL();
-        } catch {}
-      }
-      return { problems: model.problems, sql };
-    } catch (error) {
-      if (error instanceof MalloyError3) {
-        return { problems: error.problems };
-      }
-      throw error;
-    }
   }
   listApiConnections() {
     return this.apiConnections;
@@ -231916,85 +232056,190 @@ ${source}` : source;
     }
     return packageMutex;
   }
-  async getPackage(packageName, reload = false) {
+  async withPackageLock(packageName, fn) {
+    assertSafePackageName(packageName);
+    return this.getOrCreatePackageMutex(packageName).runExclusive(fn);
+  }
+  allocateStagingPath(packageName) {
+    return safeJoinUnderRoot(this.environmentPath, STAGING_DIR_NAME, `${packageName}-${crypto4.randomUUID()}`);
+  }
+  allocateRetiredPath(packageName) {
+    return safeJoinUnderRoot(this.environmentPath, RETIRED_DIR_NAME, `${packageName}-${crypto4.randomUUID()}`);
+  }
+  static async sweepStaleInstallDirs(environmentPath) {
+    assertSafeEnvironmentPath(environmentPath);
+    for (const dirName of [STAGING_DIR_NAME, RETIRED_DIR_NAME]) {
+      const dir = safeJoinUnderRoot(environmentPath, dirName);
+      if (dir.indexOf("..") !== -1)
+        continue;
+      if (path9.basename(dir) !== dirName)
+        continue;
+      try {
+        await fs6.promises.rm(dir, { recursive: true, force: true });
+      } catch (err) {
+        logger.warn(`Failed to sweep stale ${dirName} dir at ${dir}`, {
+          error: err
+        });
+      }
+    }
+  }
+  setMemoryGovernor(governor) {
+    this.memoryGovernor = governor;
+  }
+  assertCanAdmitNewPackage(packageName, reason, allowAdmission) {
+    if (allowAdmission)
+      return;
+    if (!this.memoryGovernor?.isBackpressured())
+      return;
+    throw new ServiceUnavailableError(`Publisher is under memory pressure and cannot ${reason} (package "${packageName}", environment "${this.environmentName}"). Retry after the server's memory usage drops below the configured low-water mark.`);
+  }
+  async getPackage(packageName, reload = false, options = {}) {
+    assertSafePackageName(packageName);
     const _package = this.packages.get(packageName);
     if (_package !== undefined && !reload) {
       return _package;
     }
-    const packageMutex = this.getOrCreatePackageMutex(packageName);
-    if (packageMutex.isLocked()) {
-      logger.debug(`Package ${packageName} is being loaded, waiting for unlock...`);
-      await packageMutex.waitForUnlock();
-      logger.debug(`Package ${packageName} unlocked`);
-      const existingPackage = this.packages.get(packageName);
-      if (existingPackage !== undefined && !reload) {
-        logger.debug(`Package ${packageName} loaded by another request`);
-        return existingPackage;
-      }
+    this.assertCanAdmitNewPackage(packageName, reload ? "reload a package" : "load a package", options.allowAdmission === true);
+    return this.withPackageLock(packageName, () => this._loadOrGetPackageLocked(packageName, reload));
+  }
+  async _loadOrGetPackageLocked(packageName, reload = false) {
+    const existingPackage = this.packages.get(packageName);
+    if (existingPackage !== undefined && !reload) {
+      return existingPackage;
     }
-    return packageMutex.runExclusive(async () => {
-      const existingPackage = this.packages.get(packageName);
-      if (existingPackage !== undefined && !reload) {
-        return existingPackage;
-      }
-      this.setPackageStatus(packageName, "loading" /* LOADING */);
-      try {
-        logger.debug(`Loading package ${packageName}...`);
-        const packagePath = path9.join(this.environmentPath, packageName);
-        const _package2 = await Package.create(this.environmentName, packageName, packagePath, () => this.malloyConfig.malloyConfig);
-        if (existingPackage !== undefined && reload) {
-          this.retireConnectionGeneration(`package ${packageName}`, () => existingPackage.getMalloyConfig().releaseConnections());
-        }
-        this.packages.set(packageName, _package2);
-        this.setPackageStatus(packageName, "serving" /* SERVING */);
-        logger.debug(`Successfully loaded package ${packageName}`);
-        return _package2;
-      } catch (error) {
-        logger.error(`Failed to load package ${packageName}`, { error });
-        this.packages.delete(packageName);
-        this.packageStatuses.delete(packageName);
-        throw error;
+    this.setPackageStatus(packageName, "loading" /* LOADING */);
+    try {
+      logger.debug(`Loading package ${packageName}...`);
+      const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
+      const _package = await Package.create(this.environmentName, packageName, packagePath, () => this.malloyConfig.malloyConfig);
+      if (existingPackage !== undefined && reload) {
+        this.retireConnectionGeneration(`package ${packageName}`, () => existingPackage.getMalloyConfig().releaseConnections());
       }
-    });
+      this.packages.set(packageName, _package);
+      this.setPackageStatus(packageName, "serving" /* SERVING */);
+      logger.debug(`Successfully loaded package ${packageName}`);
+      return _package;
+    } catch (error) {
+      logger.error(`Failed to load package ${packageName}`, { error });
+      this.packages.delete(packageName);
+      this.packageStatuses.delete(packageName);
+      throw error;
+    }
   }
-  async addPackage(packageName) {
-    const packagePath = path9.join(this.environmentPath, packageName);
+  async addPackage(packageName, options = {}) {
+    assertSafePackageName(packageName);
+    const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
     if (!await fs6.promises.access(packagePath).then(() => true).catch(() => false) || !(await fs6.promises.stat(packagePath))?.isDirectory()) {
       throw new PackageNotFoundError(`Package ${packageName} not found`);
     }
+    this.assertCanAdmitNewPackage(packageName, "add a new package", options.allowAdmission === true);
     logger.info(`Adding package ${packageName} to environment ${this.environmentName}`, {
       packagePath,
       malloyConfig: this.malloyConfig.malloyConfig
     });
-    const packageMutex = this.getOrCreatePackageMutex(packageName);
-    if (packageMutex.isLocked()) {
-      logger.debug(`Package ${packageName} is being loaded, waiting before addPackage...`);
-      await packageMutex.waitForUnlock();
-      const alreadyLoaded = this.packages.get(packageName);
-      if (alreadyLoaded !== undefined) {
-        return alreadyLoaded;
-      }
+    return this.withPackageLock(packageName, () => this._addPackageLocked(packageName));
+  }
+  async _addPackageLocked(packageName) {
+    const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
+    const existingPackage = this.packages.get(packageName);
+    if (existingPackage !== undefined) {
+      return existingPackage;
+    }
+    this.setPackageStatus(packageName, "loading" /* LOADING */);
+    try {
+      this.packages.set(packageName, await Package.create(this.environmentName, packageName, packagePath, () => this.malloyConfig.malloyConfig));
+    } catch (error) {
+      logger.error("Error adding package", { error });
+      this.deletePackageStatus(packageName);
+      throw error;
     }
-    return packageMutex.runExclusive(async () => {
-      const existingPackage = this.packages.get(packageName);
-      if (existingPackage !== undefined) {
-        return existingPackage;
+    this.setPackageStatus(packageName, "serving" /* SERVING */);
+    return this.packages.get(packageName);
+  }
+  async installPackage(packageName, downloader) {
+    assertSafePackageName(packageName);
+    const stagingPath = this.allocateStagingPath(packageName);
+    await fs6.promises.mkdir(path9.dirname(stagingPath), { recursive: true });
+    try {
+      await downloader(stagingPath);
+    } catch (err) {
+      await fs6.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
+      throw err;
+    }
+    return this.withPackageLock(packageName, async () => {
+      const canonicalPath = safeJoinUnderRoot(this.environmentPath, packageName);
+      let retiredPath;
+      const oldPackage = this.packages.get(packageName);
+      const oldExistsOnDisk = await fs6.promises.access(canonicalPath).then(() => true).catch(() => false);
+      if (oldExistsOnDisk) {
+        retiredPath = this.allocateRetiredPath(packageName);
+        await fs6.promises.mkdir(path9.dirname(retiredPath), {
+          recursive: true
+        });
+        await fs6.promises.rename(canonicalPath, retiredPath);
       }
-      this.setPackageStatus(packageName, "loading" /* LOADING */);
+      let newPackage;
       try {
-        this.packages.set(packageName, await Package.create(this.environmentName, packageName, packagePath, () => this.malloyConfig.malloyConfig));
-      } catch (error) {
-        logger.error("Error adding package", { error });
+        await fs6.promises.rename(stagingPath, canonicalPath);
+        this.setPackageStatus(packageName, "loading" /* LOADING */);
+        newPackage = await Package.create(this.environmentName, packageName, canonicalPath, () => this.malloyConfig.malloyConfig);
+      } catch (err) {
+        await fs6.promises.rm(canonicalPath, { recursive: true, force: true }).catch(() => {});
+        if (retiredPath) {
+          try {
+            await fs6.promises.rename(retiredPath, canonicalPath);
+          } catch (restoreErr) {
+            logger.error("Failed to restore retired package after install rollback", {
+              error: restoreErr,
+              retiredPath,
+              canonicalPath
+            });
+          }
+        }
+        await fs6.promises.rm(stagingPath, { recursive: true, force: true }).catch(() => {});
         this.deletePackageStatus(packageName);
-        throw error;
+        throw err;
       }
+      this.packages.set(packageName, newPackage);
       this.setPackageStatus(packageName, "serving" /* SERVING */);
-      return this.packages.get(packageName);
+      if (oldPackage) {
+        this.retireConnectionGeneration(`package ${packageName}`, () => oldPackage.getMalloyConfig().releaseConnections());
+      }
+      if (retiredPath) {
+        const pathToClean = retiredPath;
+        setImmediate(() => {
+          fs6.promises.rm(pathToClean, { recursive: true, force: true }).catch((err) => {
+            logger.warn(`Failed to clean up retired package directory ${pathToClean}`, { error: err });
+          });
+        });
+      }
+      return newPackage;
+    });
+  }
+  async reloadAllModelsForPackage(packageName, manifest) {
+    assertSafePackageName(packageName);
+    return this.withPackageLock(packageName, async () => {
+      const pkg = this.packages.get(packageName);
+      if (!pkg) {
+        throw new PackageNotFoundError(`Package ${packageName} is not loaded`);
+      }
+      await pkg.reloadAllModels(manifest);
+    });
+  }
+  async getModelFileText(packageName, modelPath) {
+    assertSafePackageName(packageName);
+    assertSafeRelativeModelPath(modelPath);
+    return this.withPackageLock(packageName, async () => {
+      const pkg = this.packages.get(packageName);
+      if (!pkg) {
+        throw new PackageNotFoundError(`Package ${packageName} is not loaded`);
+      }
+      return pkg.getModelFileText(modelPath);
     });
   }
   async writePackageManifest(packageName, metadata) {
-    const packagePath = path9.join(this.environmentPath, packageName);
-    const manifestPath = path9.join(packagePath, "publisher.json");
+    const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
+    const manifestPath = safeJoinUnderRoot(packagePath, "publisher.json");
     try {
       let existingManifest = {};
       try {
@@ -232016,24 +232261,27 @@ ${source}` : source;
     }
   }
   async updatePackage(packageName, body) {
-    const _package = this.packages.get(packageName);
-    if (!_package) {
-      throw new PackageNotFoundError(`Package ${packageName} not found`);
-    }
-    if (body.name) {
-      _package.setName(body.name);
-    }
-    _package.setPackageMetadata({
-      name: body.name,
-      description: body.description,
-      resource: body.resource,
-      location: body.location
-    });
-    await this.writePackageManifest(packageName, {
-      name: packageName,
-      description: body.description
+    assertSafePackageName(packageName);
+    return this.withPackageLock(packageName, async () => {
+      const _package = this.packages.get(packageName);
+      if (!_package) {
+        throw new PackageNotFoundError(`Package ${packageName} not found`);
+      }
+      if (body.name) {
+        _package.setName(body.name);
+      }
+      _package.setPackageMetadata({
+        name: body.name,
+        description: body.description,
+        resource: body.resource,
+        location: body.location
+      });
+      await this.writePackageManifest(packageName, {
+        name: packageName,
+        description: body.description
+      });
+      return _package.getPackageMetadata();
     });
-    return _package.getPackageMetadata();
   }
   getPackageStatus(packageName) {
     return this.packageStatuses.get(packageName);
@@ -232050,35 +232298,49 @@ ${source}` : source;
     this.packageStatuses.delete(packageName);
   }
   async deletePackage(packageName) {
-    const _package = this.packages.get(packageName);
-    if (!_package) {
-      return;
-    }
-    const packageStatus = this.packageStatuses.get(packageName);
-    if (packageStatus?.status === "loading" /* LOADING */) {
-      logger.error("Package loading. Can't unload.", {
-        environmentName: this.environmentName,
-        packageName
-      });
-      throw new Error("Package loading. Can't unload. " + this.environmentName + " " + packageName);
-    } else if (packageStatus?.status === "serving" /* SERVING */) {
-      this.setPackageStatus(packageName, "unloading" /* UNLOADING */);
-    }
-    await _package.getMalloyConfig().releaseConnections();
-    try {
-      await fs6.promises.rm(path9.join(this.environmentPath, packageName), {
-        recursive: true,
-        force: true
-      });
-    } catch (err) {
-      logger.error("Error removing package directory while unloading package", {
-        error: err,
-        environmentName: this.environmentName,
-        packageName
-      });
-    }
-    this.packages.delete(packageName);
-    this.packageStatuses.delete(packageName);
+    assertSafePackageName(packageName);
+    return this.withPackageLock(packageName, async () => {
+      const _package = this.packages.get(packageName);
+      if (!_package) {
+        return;
+      }
+      const packageStatus = this.packageStatuses.get(packageName);
+      if (packageStatus?.status === "loading" /* LOADING */) {
+        logger.error("Package loading. Can't unload.", {
+          environmentName: this.environmentName,
+          packageName
+        });
+        throw new Error("Package loading. Can't unload. " + this.environmentName + " " + packageName);
+      } else if (packageStatus?.status === "serving" /* SERVING */) {
+        this.setPackageStatus(packageName, "unloading" /* UNLOADING */);
+      }
+      this.retireConnectionGeneration(`package ${packageName}`, () => _package.getMalloyConfig().releaseConnections());
+      const canonicalPath = safeJoinUnderRoot(this.environmentPath, packageName);
+      const retiredPath = this.allocateRetiredPath(packageName);
+      let renamed = false;
+      try {
+        await fs6.promises.mkdir(path9.dirname(retiredPath), {
+          recursive: true
+        });
+        await fs6.promises.rename(canonicalPath, retiredPath);
+        renamed = true;
+      } catch (err) {
+        logger.error("Error renaming package directory to retired during unload", {
+          error: err,
+          environmentName: this.environmentName,
+          packageName
+        });
+      }
+      this.packages.delete(packageName);
+      this.packageStatuses.delete(packageName);
+      if (renamed) {
+        setImmediate(() => {
+          fs6.promises.rm(retiredPath, { recursive: true, force: true }).catch((err) => {
+            logger.warn(`Failed to clean up retired package directory ${retiredPath}`, { error: err });
+          });
+        });
+      }
+    });
   }
   updateConnections(malloyConfig, _apiConnections, afterPreviousRelease) {
     const previousMalloyConfig = this.malloyConfig;
@@ -232199,12 +232461,12 @@ class EnvironmentStore {
   publisherConfigIsFrozen;
   finishedInitialization;
   isInitialized = false;
-  failedEnvironments = [];
   storageManager;
   s3Client = new import_client_s32.S3({
     followRegionRedirects: true
   });
   gcsClient;
+  memoryGovernor = null;
   constructor(serverRootPath) {
     this.serverRootPath = serverRootPath;
     this.gcsClient = new Storage;
@@ -232217,6 +232479,12 @@ class EnvironmentStore {
     this.storageManager = new StorageManager(storageConfig);
     this.finishedInitialization = this.initialize();
   }
+  setMemoryGovernor(governor) {
+    this.memoryGovernor = governor;
+    for (const env of this.environments.values()) {
+      env.setMemoryGovernor(governor);
+    }
+  }
   async addConfiguredEnvironment(environment) {
     try {
       await this.addEnvironment({
@@ -232232,10 +232500,6 @@ class EnvironmentStore {
   logEnvironmentInitializationError(environmentName, error) {
     const label = environmentName ? ` "${environmentName}"` : "";
     logger.error(`Error initializing environment${label}; skipping environment`, this.extractErrorDataFromError(error));
-    this.failedEnvironments.push({
-      name: environmentName ?? "<unknown>",
-      error: error instanceof Error ? error.message : String(error)
-    });
   }
   async initialize() {
     const reInit = process.env.INITIALIZE_STORAGE === "true";
@@ -232281,6 +232545,7 @@ class EnvironmentStore {
                 resource: `${API_PREFIX}/connections/${conn.name}`,
                 ...conn.config
               })));
+              environmentInstance.setMemoryGovernor(this.memoryGovernor);
               const packages = await repository.listPackages(dbEnvironment.id);
               packages.forEach((pkg) => {
                 environmentInstance.setPackageStatus(pkg.name, "serving" /* SERVING */);
@@ -232298,11 +232563,7 @@ class EnvironmentStore {
         }
       }
       this.isInitialized = true;
-      if (this.failedEnvironments.length > 0) {
-        markDegraded();
-      } else {
-        markReady();
-      }
+      markReady();
       const initializationDuration = performance.now() - initialTime;
       logger.info(`Environment store successfully initialized in ${formatDuration(initializationDuration)}`);
     } catch (error) {
@@ -232538,12 +232799,7 @@ class EnvironmentStore {
       environments: [],
       initialized: this.isInitialized,
       frozenConfig: isPublisherConfigFrozen(this.serverRootPath),
-      operationalState: getOperationalState(),
-      ...this.failedEnvironments.length > 0 && {
-        failedEnvironments: [
-          ...this.failedEnvironments
-        ]
-      }
+      operationalState: getOperationalState()
     };
     const environments = await this.listEnvironments(true);
     await Promise.all(environments.map(async (environment) => {
@@ -232641,6 +232897,7 @@ class EnvironmentStore {
       absoluteEnvironmentPath = await this.scaffoldEnvironment(environment);
     }
     const newEnvironment = await Environment.create(environmentName, absoluteEnvironmentPath, environment.connections || []);
+    newEnvironment.setMemoryGovernor(this.memoryGovernor);
     if (!newEnvironment.metadata)
       newEnvironment.metadata = {};
     newEnvironment.metadata.location = absoluteEnvironmentPath;
@@ -232806,7 +233063,7 @@ class EnvironmentStore {
       });
     }
     for (const [groupedLocation, packagesForLocation] of locationGroups) {
-      const locationHash = crypto4.createHash("sha256").update(groupedLocation).digest("hex").substring(0, 16);
+      const locationHash = crypto5.createHash("sha256").update(groupedLocation).digest("hex").substring(0, 16);
       const tempDownloadPath = `${absoluteTargetPath}/.temp_${locationHash}`;
       await fs7.promises.mkdir(tempDownloadPath, { recursive: true });
       logger.info(`Created temporary directory: ${tempDownloadPath}`);
@@ -232995,9 +233252,9 @@ class EnvironmentStore {
       }
       const file = fs7.createWriteStream(zipFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve4, reject) => {
         file.on("error", reject);
-        file.on("finish", resolve3);
+        file.on("finish", resolve4);
       });
       await this.unzipEnvironment(zipFilePath);
       logger.info(`Downloaded S3 zip file ${s3Path} to ${absoluteDirPath}`);
@@ -233035,9 +233292,9 @@ class EnvironmentStore {
       }
       const file = fs7.createWriteStream(absoluteFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve4, reject) => {
         file.on("error", reject);
-        file.on("finish", resolve3);
+        file.on("finish", resolve4);
       });
     }));
     logger.info(`Downloaded S3 directory ${s3Path} to ${absoluteDirPath}`);
@@ -233070,14 +233327,14 @@ class EnvironmentStore {
     });
     await fs7.promises.mkdir(absoluteDirPath, { recursive: true });
     const repoUrl = `https://github.com/${owner}/${repoName}`;
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       esm_default2().clone(repoUrl, absoluteDirPath, {}, (err) => {
         if (err) {
           const errorData = this.extractErrorDataFromError(err);
           logger.error(`Failed to clone GitHub repository "${repoUrl}"`, errorData);
           reject(err);
         }
-        resolve3();
+        resolve4();
       });
     });
     if (!cleanPackagePath) {
@@ -233473,7 +233730,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken } = options !== null && options !== undefined ? options : {};
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       var _a2, _b, _c, _d, _e, _f;
       if (!this._transport) {
         reject(new Error("Not connected"));
@@ -233524,7 +233781,7 @@ class Protocol {
         }
         try {
           const result = resultSchema.parse(response.result);
-          resolve3(result);
+          resolve4(result);
         } catch (error) {
           reject(error);
         }
@@ -236926,7 +237183,7 @@ function registerTools(mcpServer, environmentStore) {
         console.log("model not found", modelPath, "in ", pkg.listModels());
         throw new Error(`Model not found: ${modelPath}`);
       }
-      const fileText = await pkg.getModelFileText(modelPath);
+      const fileText = await environment.getModelFileText(packageName, modelPath);
       console.log(`[MCP LOG] Successfully retrieved model text for ${modelPath}`);
       return {
         content: [
@@ -237766,8 +238023,8 @@ class ManifestService {
   async reloadManifest(environmentId, packageName, environmentName) {
     const manifest = await this.getManifest(environmentId, packageName);
     const environment = await this.environmentStore.getEnvironment(environmentName, false);
-    const pkg = await environment.getPackage(packageName, false);
-    await pkg.reloadAllModels(manifest.entries);
+    await environment.getPackage(packageName, false);
+    await environment.reloadAllModelsForPackage(packageName, manifest.entries);
     logger.info("Reloaded manifest and recompiled models", {
       environmentId,
       packageName,
@@ -238088,8 +238345,8 @@ class MaterializationService {
       if (metadata.autoLoadManifest) {
         const updatedManifest = await this.manifestService.getManifest(environmentId, packageName);
         const environment = await this.environmentStore.getEnvironment(environmentName, false);
-        const pkg = await environment.getPackage(packageName, false);
-        await pkg.reloadAllModels(updatedManifest.entries);
+        await environment.getPackage(packageName, false);
+        await environment.reloadAllModelsForPackage(packageName, updatedManifest.entries);
       }
       await this.transitionExecution(executionId, "SUCCESS", {
         completedAt: new Date,
@@ -238179,7 +238436,7 @@ class MaterializationService {
     manifest.loadText(JSON.stringify(existingManifest));
     const existingEntries = await this.manifestService.listEntries(environmentId, packageName);
     const knownMaterializedTables = new Set(existingEntries.map((e) => manifestTableKey(e.connectionName, e.tableName)));
-    const { graphs, sources, connectionDigests, connections } = await this.compilePackageBuildPlan(pkg, signal);
+    const { graphs, sources, connectionDigests, connections } = await environment.withPackageLock(packageName, () => this.compilePackageBuildPlan(pkg, signal));
     if (graphs.length === 0) {
       logger.info("No persist sources to build");
       return { sourcesBuilt: 0, sourcesSkipped: 0 };
@@ -238384,6 +238641,107 @@ class MaterializationService {
   }
 }
 
+// src/service/package_memory_governor.ts
+var import_api4 = __toESM(require_src(), 1);
+var DEFAULT_RSS_SAMPLER = () => process.memoryUsage().rss;
+
+class PackageMemoryGovernor {
+  config;
+  rssSampler;
+  highWaterBytes;
+  lowWaterBytes;
+  timer = null;
+  backpressured = false;
+  lastSampledRss = 0;
+  lastSampledAt = null;
+  backpressureActivationsCounter;
+  constructor(config, rssSampler) {
+    this.config = config;
+    this.rssSampler = rssSampler ?? DEFAULT_RSS_SAMPLER;
+    this.highWaterBytes = Math.floor(config.maxMemoryBytes * config.highWaterFraction);
+    this.lowWaterBytes = Math.floor(config.maxMemoryBytes * config.lowWaterFraction);
+    const meter2 = import_api4.metrics.getMeter("publisher");
+    meter2.createObservableGauge("publisher_process_rss_bytes", {
+      description: "Current resident set size of the publisher process in bytes",
+      unit: "By"
+    }).addCallback((observation) => {
+      observation.observe(this.rssSampler());
+    });
+    meter2.createObservableGauge("publisher_memory_backpressure_active", {
+      description: "1 when the publisher is rejecting new package loads to stay under PUBLISHER_MAX_MEMORY_BYTES; 0 otherwise"
+    }).addCallback((observation) => {
+      observation.observe(this.backpressured ? 1 : 0);
+    });
+    this.backpressureActivationsCounter = meter2.createCounter("publisher_memory_backpressure_activations_total", {
+      description: "Number of times the memory governor has activated back-pressure"
+    });
+    meter2.createObservableGauge("publisher_memory_max_bytes", {
+      description: "Configured PUBLISHER_MAX_MEMORY_BYTES",
+      unit: "By"
+    }).addCallback((observation) => observation.observe(this.config.maxMemoryBytes));
+    meter2.createObservableGauge("publisher_memory_high_water_bytes", {
+      description: "RSS threshold at which back-pressure activates",
+      unit: "By"
+    }).addCallback((observation) => observation.observe(this.highWaterBytes));
+    meter2.createObservableGauge("publisher_memory_low_water_bytes", {
+      description: "RSS threshold at which back-pressure clears",
+      unit: "By"
+    }).addCallback((observation) => observation.observe(this.lowWaterBytes));
+  }
+  start() {
+    if (this.timer !== null)
+      return;
+    this.tick();
+    this.timer = setInterval(() => this.tick(), this.config.checkIntervalMs);
+    this.timer.unref?.();
+    logger.info(`PackageMemoryGovernor started (max=${this.config.maxMemoryBytes}B, high=${this.highWaterBytes}B, low=${this.lowWaterBytes}B, interval=${this.config.checkIntervalMs}ms, backpressure=${this.config.backpressureEnabled})`);
+  }
+  stop() {
+    if (this.timer !== null) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    this.backpressured = false;
+  }
+  tick() {
+    let rss;
+    try {
+      rss = this.rssSampler();
+    } catch (err) {
+      logger.error("PackageMemoryGovernor: RSS sample failed", {
+        error: err
+      });
+      return;
+    }
+    this.lastSampledRss = rss;
+    this.lastSampledAt = Date.now();
+    if (!this.config.backpressureEnabled) {
+      return;
+    }
+    if (rss >= this.highWaterBytes && !this.backpressured) {
+      this.backpressured = true;
+      this.backpressureActivationsCounter.add(1);
+      logger.warn(`PackageMemoryGovernor: activating back-pressure (rss=${rss}B >= high=${this.highWaterBytes}B). New package loads will be rejected with HTTP 503 until rss <= ${this.lowWaterBytes}B.`);
+    } else if (rss <= this.lowWaterBytes && this.backpressured) {
+      this.backpressured = false;
+      logger.info(`PackageMemoryGovernor: clearing back-pressure (rss=${rss}B <= low=${this.lowWaterBytes}B).`);
+    }
+  }
+  isBackpressured() {
+    return this.backpressured;
+  }
+  getStatus() {
+    return {
+      rssBytes: this.lastSampledRss,
+      maxMemoryBytes: this.config.maxMemoryBytes,
+      highWaterBytes: this.highWaterBytes,
+      lowWaterBytes: this.lowWaterBytes,
+      backpressured: this.backpressured,
+      lastSampledAt: this.lastSampledAt
+    };
+  }
+}
+
 // src/server.ts
 function normalizeQueryArray(value) {
   if (value === undefined || value === null)
@@ -238465,6 +238823,10 @@ var manifestService = new ManifestService(environmentStore);
 var watchModeController = new WatchModeController(environmentStore);
 var connectionController = new ConnectionController(environmentStore);
 var modelController = new ModelController(environmentStore);
+var memoryGovernorConfig = getMemoryGovernorConfig();
+var memoryGovernor = memoryGovernorConfig ? new PackageMemoryGovernor(memoryGovernorConfig) : null;
+memoryGovernor?.start();
+environmentStore.setMemoryGovernor(memoryGovernor);
 var packageController = new PackageController(environmentStore, manifestService);
 var databaseController = new DatabaseController(environmentStore);
 var queryController = new QueryController(environmentStore);