@malloy-publisher/server 0.0.228 → 0.0.230

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.228",
+   "version": "0.0.230",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"
@@ -36,17 +36,17 @@
       "@azure/storage-blob": "^12.26.0",
       "@duckdb/node-api": "1.5.3-r.2",
       "@google-cloud/storage": "^7.16.0",
-      "@malloydata/db-bigquery": "^0.0.422",
-      "@malloydata/db-databricks": "^0.0.422",
-      "@malloydata/db-duckdb": "^0.0.422",
-      "@malloydata/db-mysql": "^0.0.422",
-      "@malloydata/db-postgres": "^0.0.422",
-      "@malloydata/db-publisher": "^0.0.422",
-      "@malloydata/db-snowflake": "^0.0.422",
-      "@malloydata/db-trino": "^0.0.422",
-      "@malloydata/malloy": "^0.0.422",
-      "@malloydata/malloy-sql": "^0.0.422",
-      "@malloydata/render-validator": "^0.0.422",
+      "@malloydata/db-bigquery": "^0.0.423",
+      "@malloydata/db-databricks": "^0.0.423",
+      "@malloydata/db-duckdb": "^0.0.423",
+      "@malloydata/db-mysql": "^0.0.423",
+      "@malloydata/db-postgres": "^0.0.423",
+      "@malloydata/db-publisher": "^0.0.423",
+      "@malloydata/db-snowflake": "^0.0.423",
+      "@malloydata/db-trino": "^0.0.423",
+      "@malloydata/malloy": "^0.0.423",
+      "@malloydata/malloy-sql": "^0.0.423",
+      "@malloydata/render-validator": "^0.0.423",
       "@modelcontextprotocol/sdk": "^1.13.2",
       "@opentelemetry/api": "^1.9.0",
       "@opentelemetry/auto-instrumentations-node": "^0.57.0",
@@ -59,6 +59,7 @@
       "body-parser": "^1.20.2",
       "chokidar": "^4.0.3",
       "cors": "^2.8.5",
+      "cron-parser": "^5.6.2",
       "express": "^4.21.0",
       "extract-zip": "^2.0.1",
       "globals": "^15.9.0",
@@ -69,7 +70,8 @@
       "node-cron": "^3.0.3",
       "recursive-readdir": "^2.2.3",
       "simple-git": "^3.28.0",
-      "uuid": "^11.0.3"
+      "uuid": "^11.0.3",
+      "winston": "^3.17.0"
    },
    "devDependencies": {
       "@eslint/compat": "^1.2.7",

package/scripts/bake-duckdb-extensions.js

@@ -27,8 +27,11 @@ import { DuckDBInstance } from "@duckdb/node-api";
 // sandbox, federated-database attach, and the materialization catalog. Keep this
 // in sync with the install sites in those files.
 //
-// `community: true` mirrors the runtime's `FORCE INSTALL '<name>' FROM community`
-// (bigquery, snowflake); the rest are core extensions installed by name.
+// `community: true` marks the community-repo extensions (bigquery, snowflake);
+// the rest are core extensions installed by name. The bake deliberately uses
+// `FORCE INSTALL ... FROM community` to (re)populate the build cache from the
+// CDN at build time; the *runtime* install (connection.ts) uses a plain,
+// local-first `INSTALL` that no-ops against this baked cache.
 // `registered` is the name the extension reports in duckdb_extensions() when it
 // differs from the INSTALL name (only postgres -> postgres_scanner).
 const EXTENSIONS = [

package/src/config.spec.ts

@@ -1,7 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 import fs from "fs";
 import path from "path";
-import { getPublisherConfig, type PublisherConfig } from "./config";
+import {
+   getPublisherConfig,
+   getPublisherConfigDir,
+   type PublisherConfig,
+} from "./config";
 import { PUBLISHER_CONFIG_NAME } from "./constants";
 
 describe("Config Environment Variable Substitution", () => {
@@ -1408,3 +1412,85 @@ describe("getMaxConcurrentQueries", () => {
       expect(() => getMaxConcurrentQueries()).toThrow();
    });
 });
+
+describe("getPublisherConfigDir", () => {
+   const testRoot = path.join(process.cwd(), "test-temp-config-dir");
+   const elsewhere = path.join(testRoot, "elsewhere");
+   const savedConfigPath = process.env.PUBLISHER_CONFIG_PATH;
+
+   beforeEach(() => {
+      fs.mkdirSync(elsewhere, { recursive: true });
+      // Both knobs feed resolvePublisherConfigPath, and every spec file shares
+      // one process, so clear both rather than inherit whatever ran before.
+      delete process.env.PUBLISHER_CONFIG_PATH;
+      delete process.env.PUBLISHER_USE_BUNDLED_DEFAULT;
+   });
+
+   afterEach(() => {
+      fs.rmSync(testRoot, { recursive: true, force: true });
+      // Clear both, not just the one this describe saves: every spec file shares
+      // one process, so a knob left set here follows whatever runs next.
+      delete process.env.PUBLISHER_USE_BUNDLED_DEFAULT;
+      if (savedConfigPath === undefined) {
+         delete process.env.PUBLISHER_CONFIG_PATH;
+      } else {
+         process.env.PUBLISHER_CONFIG_PATH = savedConfigPath;
+      }
+   });
+
+   it("returns the server root when the config sits there", () => {
+      fs.writeFileSync(
+         path.join(testRoot, PUBLISHER_CONFIG_NAME),
+         JSON.stringify({ environments: [] }),
+      );
+      expect(getPublisherConfigDir(testRoot)).toBe(testRoot);
+   });
+
+   it("follows PUBLISHER_CONFIG_PATH to a config outside the server root", () => {
+      // The --config case: a relative package location must anchor next to
+      // the config that declares it, not at whatever cwd the server booted in.
+      const configPath = path.join(elsewhere, PUBLISHER_CONFIG_NAME);
+      fs.writeFileSync(configPath, JSON.stringify({ environments: [] }));
+      process.env.PUBLISHER_CONFIG_PATH = configPath;
+      expect(getPublisherConfigDir(testRoot)).toBe(elsewhere);
+   });
+
+   it("returns null when no config resolves, so callers fall back to the server root", () => {
+      expect(getPublisherConfigDir(testRoot)).toBeNull();
+   });
+
+   it("returns an absolute anchor even when --config is relative", () => {
+      // An anchor that is itself relative would re-resolve against the cwd of
+      // whoever reads it, which is the bug this whole change is fixing.
+      const rel = path.relative(
+         process.cwd(),
+         path.join(elsewhere, PUBLISHER_CONFIG_NAME),
+      );
+      fs.writeFileSync(
+         path.join(elsewhere, PUBLISHER_CONFIG_NAME),
+         JSON.stringify({ environments: [] }),
+      );
+      process.env.PUBLISHER_CONFIG_PATH = rel;
+      const anchor = getPublisherConfigDir(testRoot);
+      expect(anchor).not.toBeNull();
+      expect(path.isAbsolute(anchor as string)).toBe(true);
+      expect(anchor).toBe(elsewhere);
+   });
+
+   it("returns null when --config names a directory instead of a file", () => {
+      // existsSync is true for a directory, so without a file check the anchor
+      // would silently become that directory's PARENT, for a config that never
+      // loads (getPublisherConfig catches the read error and returns empty).
+      process.env.PUBLISHER_CONFIG_PATH = elsewhere;
+      expect(getPublisherConfigDir(testRoot)).toBeNull();
+   });
+
+   it("returns null for the bundled default rather than anchoring inside the install", () => {
+      // Zero-arg `npx @malloy-publisher/server` resolves the config that ships
+      // inside the package. Anchoring a user's relative location under
+      // node_modules would be meaningless, so the caller falls back to the
+      // server root, which is what this did before the anchor moved.
+      process.env.PUBLISHER_USE_BUNDLED_DEFAULT = "true";
+      expect(getPublisherConfigDir(testRoot)).toBeNull();
+   });
+});

package/src/config.ts

@@ -71,7 +71,13 @@ function resolvePublisherConfigPath(serverRoot: string): {
    return null;
 }
 
-type FilesystemPath = `./${string}` | `../${string}` | `/${string}`;
+// Home paths are POSIX form only: `~/` expands, while bare `~`, `~user/…`,
+// and Windows-style `~\` are not local paths and are rejected downstream.
+type FilesystemPath =
+   | `./${string}`
+   | `../${string}`
+   | `/${string}`
+   | `~/${string}`;
 type GcsPath = `gs://${string}`;
 type ApiConnection = components["schemas"]["Connection"];
 export type Theme = components["schemas"]["Theme"];
@@ -256,6 +262,72 @@ export const getMemoryGovernorConfig = (): MemoryGovernorConfig | null => {
    };
 };
 
+/**
+ * Tunables for the standalone {@link MaterializationScheduler}. Sourced from
+ * environment variables at startup; see {@link getMaterializationSchedulerConfig}.
+ *
+ * The scheduler fires a package's `materialization.schedule` cron in **standalone**
+ * deployments (no control plane). It is **disabled by default** — an orchestrated
+ * deployment, whose control plane already drives materialization, never sets the
+ * enable flag, so the scheduler is never constructed there.
+ */
+export interface MaterializationSchedulerConfig {
+   /** Cadence of the due-schedule sweep, in milliseconds. */
+   tickIntervalMs: number;
+   /** Max packages fired per tick — a stampede guard for large deployments. */
+   maxFiresPerTick: number;
+}
+
+const DEFAULT_SCHEDULER_INTERVAL_MS = 60_000;
+const MIN_SCHEDULER_INTERVAL_MS = 1_000;
+const DEFAULT_SCHEDULER_MAX_FIRES_PER_TICK = 10;
+
+/**
+ * Parse standalone-scheduler settings and return a validated config, or `null`
+ * when the feature is disabled. Disabled iff
+ * `PUBLISHER_LOCAL_MATERIALIZATION_SCHEDULER` is unset/false — the default — so
+ * the scheduler never runs in an orchestrated deployment (where the control
+ * plane drives materialization itself).
+ *
+ * **Never set `PUBLISHER_LOCAL_MATERIALIZATION_SCHEDULER` on an orchestrated
+ * worker.** It is the primary safety guard: a control-plane-loaded package that
+ * is serving live has `manifestLocation === null`, so the scheduler's
+ * per-package `manifestLocation` skip does not cover it — only this flag being
+ * off keeps the standalone scheduler from double-driving the control plane.
+ *
+ * Throws at startup on malformed input so a typo surfaces loudly rather than
+ * silently disabling scheduling.
+ */
+export const getMaterializationSchedulerConfig =
+   (): MaterializationSchedulerConfig | null => {
+      const enabled =
+         parseBoolEnv("PUBLISHER_LOCAL_MATERIALIZATION_SCHEDULER") ?? false;
+      if (!enabled) {
+         return null;
+      }
+
+      const tickIntervalMs =
+         parseIntEnv("PUBLISHER_MATERIALIZATION_SCHEDULER_INTERVAL_MS") ??
+         DEFAULT_SCHEDULER_INTERVAL_MS;
+      const maxFiresPerTick =
+         parseIntEnv(
+            "PUBLISHER_MATERIALIZATION_SCHEDULER_MAX_FIRES_PER_TICK",
+         ) ?? DEFAULT_SCHEDULER_MAX_FIRES_PER_TICK;
+
+      if (tickIntervalMs < MIN_SCHEDULER_INTERVAL_MS) {
+         throw new Error(
+            `PUBLISHER_MATERIALIZATION_SCHEDULER_INTERVAL_MS must be >= ${MIN_SCHEDULER_INTERVAL_MS} (got ${tickIntervalMs})`,
+         );
+      }
+      if (maxFiresPerTick <= 0) {
+         throw new Error(
+            `PUBLISHER_MATERIALIZATION_SCHEDULER_MAX_FIRES_PER_TICK must be a positive integer (got ${maxFiresPerTick})`,
+         );
+      }
+
+      return { tickIntervalMs, maxFiresPerTick };
+   };
+
 /**
  * Resolve the row cap applied to ad-hoc connection SQL queries.
  * Reads `PUBLISHER_MAX_QUERY_ROWS`; falls back to
@@ -368,6 +440,46 @@ export const getMaxConcurrentQueries = (): number => {
    return raw;
 };
 
+/**
+ * DuckDB extension-fetch policy. Governs whether Publisher's explicit extension
+ * INSTALL step (see `installAndLoadExtension` in service/connection.ts) may
+ * reach the DuckDB extension network.
+ */
+export type ExtensionFetchPolicy = "on-demand" | "local-only";
+
+/**
+ * Resolve the DuckDB extension-fetch policy from `EXTENSION_FETCH_POLICY`;
+ * falls back to `on-demand` when unset or empty.
+ *
+ * - `on-demand` (default): preserves prior behaviour. Publisher runs `INSTALL`
+ *   for a missing extension on first use, which fetches it from the DuckDB
+ *   extension network when it is not already present on disk (baked into the
+ *   image). Extensions already baked are used as-is.
+ * - `local-only`: Publisher never runs `INSTALL`, and turns DuckDB's own
+ *   implicit auto-install off on its build/serve sessions
+ *   (`autoinstall_known_extensions=false`), so no code path reaches the
+ *   network. Auto-LOAD stays on, so an extension already present on disk still
+ *   lazy-loads; a genuinely missing extension surfaces as a loud, actionable
+ *   error instead of a silent fetch. For air-gapped / pinned-image deployments.
+ *
+ * Throws on an unrecognised value. Validated at server startup (server.ts calls
+ * this during boot) so a typo in a k8s manifest fails the boot loudly rather
+ * than surfacing on the first query that resolves a DuckDB connection — which,
+ * for a DuckLake-only deployment, could be well after `serving`. Also read on
+ * each connection resolve, so the value is honoured without a restart.
+ */
+export const getExtensionFetchPolicy = (): ExtensionFetchPolicy => {
+   const raw = process.env.EXTENSION_FETCH_POLICY;
+   if (raw === undefined || raw.trim() === "") return "on-demand";
+   const normalised = raw.trim().toLowerCase();
+   if (normalised === "on-demand" || normalised === "local-only") {
+      return normalised;
+   }
+   throw new Error(
+      `Invalid value for EXTENSION_FETCH_POLICY: expected "on-demand" or "local-only", got "${raw}"`,
+   );
+};
+
 function substituteEnvVars(value: string): string {
    const envVarPattern = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 
@@ -404,6 +516,35 @@ function processConfigValue(value: unknown): unknown {
    return value;
 }
 
+/**
+ * Absolute directory that a relative package `location` is resolved against:
+ * the one holding the active config file.
+ *
+ * Null when there is nothing sensible to anchor to, leaving the caller to pick
+ * a base. That covers three cases: no config at all; the bundled default, which
+ * lives inside the installed package, where anchoring a user's relative path
+ * somewhere under node_modules would be meaningless (and which declares only
+ * remote locations of its own); and a `--config` that names a directory rather
+ * than a file, which cannot be read as a config, so its parent is not an anchor
+ * anyone asked for.
+ */
+export const getPublisherConfigDir = (serverRoot: string): string | null => {
+   const resolved = resolvePublisherConfigPath(serverRoot);
+   if (!resolved || resolved.isBundledDefault) {
+      return null;
+   }
+   try {
+      if (!fs.statSync(resolved.path).isFile()) {
+         return null;
+      }
+   } catch {
+      return null;
+   }
+   // Resolve: `--config` may be relative, and an anchor that is itself relative
+   // would re-resolve against the cwd of whoever reads it.
+   return path.resolve(path.dirname(resolved.path));
+};
+
 export const getPublisherConfig = (serverRoot: string): PublisherConfig => {
    const resolved = resolvePublisherConfigPath(serverRoot);
    if (!resolved) {

package/src/controller/materialization.controller.spec.ts

@@ -36,6 +36,15 @@ describe("MaterializationController.createMaterialization validation", () => {
       ).toEqual({ forceRefresh: true, sourceNames: ["a", "b"] });
    });
 
+   it("never forwards a client-supplied trigger (SCHEDULER cannot be forged)", async () => {
+      // trigger is service-level-only: the controller must strip it so an API
+      // caller cannot mint a run that reads as scheduler-driven. The service
+      // then defaults it to ON_DEMAND.
+      const parsed = await parse({ forceRefresh: true, trigger: "SCHEDULER" });
+      expect(parsed).toEqual({ forceRefresh: true });
+      expect("trigger" in (parsed as object)).toBe(false);
+   });
+
    it("rejects a non-boolean forceRefresh", async () => {
       const { controller } = build();
       await expect(

package/src/controller/materialization.controller.ts

@@ -20,6 +20,11 @@ export class MaterializationController {
       );
    }
 
+   // Whitelist: only these fields are read off the client body. `trigger` is
+   // deliberately NOT accepted here — it is service-level-only, defaulted to
+   // `ON_DEMAND` and set to `SCHEDULER` solely by the in-process scheduler
+   // (which calls the service directly, not this HTTP path). Do not add
+   // `trigger` to this parser, or an API caller could forge a scheduled run.
    private validateCreateBody(body: Record<string, unknown>): {
       forceRefresh?: boolean;
       sourceNames?: string[];
@@ -201,6 +206,16 @@ export class MaterializationController {
       );
    }
 
+   async listEnvironmentMaterializations(
+      environmentName: string,
+      options?: { limit?: number; offset?: number },
+   ) {
+      return this.materializationService.listEnvironmentMaterializations(
+         environmentName,
+         options,
+      );
+   }
+
    async getMaterialization(
       environmentName: string,
       packageName: string,

package/src/ducklake_version.spec.ts

@@ -0,0 +1,163 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import {
+   catalogFormatRangeForEngine,
+   compareCatalogFormat,
+   ENGINE_MAX_FORMAT,
+   isCatalogFormatInRange,
+   isCatalogFormatSupportedByEngine,
+   MIN_CATALOG_FORMAT,
+   parseCatalogFormat,
+   parseEngineMajorMinor,
+} from "./ducklake_version";
+
+/**
+ * Resolve the pinned `@duckdb/node-api` engine version from bun.lock, the same
+ * source `scripts/duckdb-version.js` reads (mirrored here rather than imported
+ * because the server tsconfig has `allowJs: false`). Prefers the version nested
+ * under `@malloydata/db-duckdb` — the engine Malloy actually runs on — and
+ * falls back to the deduped top-level entry.
+ */
+function resolvePinnedDuckDBVersion(): string {
+   const lock = readFileSync(
+      fileURLToPath(new URL("../../../bun.lock", import.meta.url)),
+      "utf8",
+   );
+   const nested = lock.match(
+      /"@malloydata\/db-duckdb\/@duckdb\/node-api":\s*\["@duckdb\/node-api@(\d+\.\d+\.\d+[^"]*)"/,
+   );
+   const plain = lock.match(
+      /"@duckdb\/node-api":\s*\["@duckdb\/node-api@(\d+\.\d+\.\d+[^"]*)"/,
+   );
+   const match = nested ?? plain;
+   if (!match) throw new Error("@duckdb/node-api not found in bun.lock");
+   return match[1];
+}
+
+describe("ducklake_version", () => {
+   describe("parseCatalogFormat", () => {
+      it("parses two-part and pre-release formats", () => {
+         expect(parseCatalogFormat("1.0")).toEqual({ major: 1, minor: 0 });
+         expect(parseCatalogFormat("0.3-dev1")).toEqual({
+            major: 0,
+            minor: 3,
+            prerelease: "dev1",
+         });
+      });
+
+      it("rejects malformed input without throwing", () => {
+         // Three-part strings are malformed for a catalog format, not a newer
+         // version -- they must not parse as a bigger number.
+         expect(parseCatalogFormat("1.0.0")).toBeNull();
+         expect(parseCatalogFormat("1.1.0")).toBeNull();
+         expect(parseCatalogFormat("")).toBeNull();
+         expect(parseCatalogFormat("not a version")).toBeNull();
+         expect(parseCatalogFormat("0.3 ")).toBeNull();
+      });
+   });
+
+   describe("compareCatalogFormat", () => {
+      const p = (s: string) => parseCatalogFormat(s)!;
+      it("orders by major, then minor", () => {
+         expect(compareCatalogFormat(p("0.3"), p("1.0"))).toBe(-1);
+         expect(compareCatalogFormat(p("1.1"), p("1.0"))).toBe(1);
+         expect(compareCatalogFormat(p("1.0"), p("1.0"))).toBe(0);
+      });
+      it("sorts a release above its own pre-releases", () => {
+         expect(compareCatalogFormat(p("1.0"), p("1.0-dev1"))).toBe(1);
+         expect(compareCatalogFormat(p("0.3-dev1"), p("0.3"))).toBe(-1);
+      });
+   });
+
+   describe("parseEngineMajorMinor", () => {
+      it("extracts the minor line from assorted engine spec forms", () => {
+         expect(parseEngineMajorMinor("1.5.3")).toEqual({ major: 1, minor: 5 });
+         expect(parseEngineMajorMinor("1.5.3-r.2")).toEqual({
+            major: 1,
+            minor: 5,
+         });
+         expect(parseEngineMajorMinor("v1.5.3")).toEqual({
+            major: 1,
+            minor: 5,
+         });
+      });
+      it("returns null when no version is present", () => {
+         expect(parseEngineMajorMinor("nope")).toBeNull();
+      });
+   });
+
+   describe("catalogFormatRangeForEngine", () => {
+      it("derives [1.0, maxFormat] for a covered engine (all patch levels)", () => {
+         expect(catalogFormatRangeForEngine("1.5.3")).toEqual({
+            min: "1.0",
+            max: "1.0",
+            engineVersion: "1.5",
+         });
+         // Any patch of a known minor line resolves to the same range.
+         expect(catalogFormatRangeForEngine("1.5.9")).toEqual({
+            min: "1.0",
+            max: "1.0",
+            engineVersion: "1.5",
+         });
+      });
+      it("returns null (drift signal) for an engine with no matrix row", () => {
+         expect(catalogFormatRangeForEngine("1.6.0")).toBeNull();
+         expect(catalogFormatRangeForEngine("2.0.0")).toBeNull();
+         expect(catalogFormatRangeForEngine("garbage")).toBeNull();
+      });
+   });
+
+   // These reproduce the accept/reject set the prior enumerated-list work
+   // asserted, now expressed as a RANGE derived from the 1.5.x engine.
+   describe("isCatalogFormatSupportedByEngine (engine 1.5.x)", () => {
+      const engine = "1.5.3";
+      it("accepts the 1.0 catalog format produced by the 1.5.x engine", () => {
+         expect(isCatalogFormatSupportedByEngine("1.0", engine)).toBe(true);
+      });
+      it("rejects the 0.3-line formats (attach only via migration)", () => {
+         for (const v of ["0.1", "0.2", "0.3-dev1", "0.3"]) {
+            expect(isCatalogFormatSupportedByEngine(v, engine)).toBe(false);
+         }
+      });
+      it("rejects formats newer than the supported max", () => {
+         for (const v of ["1.1", "2.0", "0.4", "0.3-dev2"]) {
+            expect(isCatalogFormatSupportedByEngine(v, engine)).toBe(false);
+         }
+      });
+      it("rejects malformed / three-part input without throwing", () => {
+         for (const v of ["1.0.0", "1.1.0", "", "not a version", "0.3 "]) {
+            expect(isCatalogFormatSupportedByEngine(v, engine)).toBe(false);
+         }
+      });
+      it("rejects everything when the engine is unknown (no matrix row)", () => {
+         expect(isCatalogFormatSupportedByEngine("1.0", "1.6.0")).toBe(false);
+      });
+   });
+
+   describe("isCatalogFormatInRange", () => {
+      const range = catalogFormatRangeForEngine("1.5.3")!;
+      it("is inclusive at both ends", () => {
+         expect(isCatalogFormatInRange("1.0", range)).toBe(true);
+      });
+      it("rejects below min and above max", () => {
+         expect(isCatalogFormatInRange("0.9", range)).toBe(false);
+         expect(isCatalogFormatInRange("1.1", range)).toBe(false);
+      });
+   });
+
+   // The version-contract: the ENGINE_MAX_FORMAT matrix MUST cover the DuckDB
+   // engine this repo is pinned to. This is the same drift guard the CI script
+   // enforces (scripts/validate-ducklake-catalog-range.ts); asserting it here
+   // fails `bun test` the moment a Malloy bump moves the engine past the matrix.
+   describe("pinned-engine drift contract", () => {
+      it("has a matrix row covering the pinned @duckdb/node-api engine", () => {
+         const engineVersion = resolvePinnedDuckDBVersion();
+         const range = catalogFormatRangeForEngine(engineVersion);
+         expect(range).not.toBeNull();
+         expect(range!.min).toBe(MIN_CATALOG_FORMAT);
+         // The matrix must not be empty and its rows must be well-formed.
+         expect(ENGINE_MAX_FORMAT.length).toBeGreaterThan(0);
+      });
+   });
+});