@malloy-publisher/server 0.0.249 → 0.0.250

package/dist/server.mjs

@@ -248415,6 +248415,9 @@ function recordSourceBuildDuration(durationMs, engine) {
 function recordDropTables(outcome, engine) {
   dropTablesCounter().add(1, { outcome, engine });
 }
+function recordStorageTableRetained(destination) {
+  storageTableRetainedCounter().add(1, { destination });
+}
 function recordStorageBuildFailure(destination, reason = "build_failed") {
   storageBuildFailureCounter().add(1, { destination, reason });
 }
@@ -248436,7 +248439,7 @@ function recordStorageServeRouting(outcome) {
 function recordChainedStorageBuild(outcome) {
   chainedStorageBuildCounter().add(1, { outcome });
 }
-var resetHooks2, runCounter, runDuration, sourcesCounter, incrementalStepCounter, buildPlanComputeDuration, autoLoadCounter, connectionDigestSkipCounter, manifestBindCounter, manifestBindDegradedCounter, sourceBuildDuration, dropTablesCounter, scheduledFireCounter, storageServeRoutingCounter, storageBuildFailureCounter, attributionSkippedCounter, eligibilityRefusedCounter, serveShapeTierDropCounter, serveShapeTypeFallbackCounter, chainedStorageBuildCounter;
+var resetHooks2, runCounter, runDuration, sourcesCounter, incrementalStepCounter, buildPlanComputeDuration, autoLoadCounter, connectionDigestSkipCounter, manifestBindCounter, manifestBindDegradedCounter, sourceBuildDuration, dropTablesCounter, scheduledFireCounter, storageServeRoutingCounter, storageTableRetainedCounter, storageBuildFailureCounter, attributionSkippedCounter, eligibilityRefusedCounter, serveShapeTierDropCounter, serveShapeTypeFallbackCounter, chainedStorageBuildCounter;
 var init_materialization_metrics = __esm(() => {
   init_telemetry();
   resetHooks2 = [];
@@ -248453,6 +248456,7 @@ var init_materialization_metrics = __esm(() => {
   dropTablesCounter = lazyCounter2("publisher_materialization_drop_tables_total", "Physical tables dropped on delete. Label: outcome ('success'|'failure').");
   scheduledFireCounter = lazyCounter2("publisher_materialization_scheduled_fires_total", "Standalone-scheduler attempts to fire a package's materialization.schedule. " + "Label: outcome ('fired'|'conflict'|'error').");
   storageServeRoutingCounter = lazyCounter2("publisher_storage_serve_routing_total", "storage= serve routing decisions. Label: outcome ('storage'|'live_fallback'|'runtime_live_fallback').");
+  storageTableRetainedCounter = lazyCounter2("publisher_storage_tables_retained_total", "Tables a FAILED run left in a storage= destination and deliberately did not " + "reclaim, because the source is refreshed incrementally and the name may be " + "the one it serves from. Label: destination. Not all of these are orphans — " + "a rebuild at a fresh generational name is, a seed on the live serving name " + "is not, and the manifest entry cannot separate them — so read this as an " + "upper bound on what is accumulating rather than a leak count. It is the " + "only accounting there is until reclaiming a destination exists, which is " + "why it is a counter and not just a log line: the question is a rate, not " + "whether it ever happened.");
   storageBuildFailureCounter = lazyCounter2("publisher_storage_build_failures_total", "storage= build failures (federation/passthrough/attach/CTAS), distinct from " + "in-warehouse build failures. Labels: destination (connection name), " + "reason ('build_failed'|'billed_read_not_captured'). The second is the " + "expensive one: the warehouse read ran and was charged, and the rows could " + "not be captured — so a re-drive pays for it again. Worth alerting on " + "separately from a failure that costs only a retry.");
   attributionSkippedCounter = lazyCounter2("publisher_storage_build_attribution_skipped_total", "storage= builds whose warehouse read went out UNATTRIBUTED while tagging was " + "on. Label: reason ('job_listing_unavailable'|'tag_failed'|" + "'read_row_not_found'|'read_row_ambiguous'|'cost_query_failed'). " + "The read still ran and the " + "build still succeeded — what was lost is the label in the customer's own " + "query history, and the cost on this side. Without this an operator who " + "turns tagging on and sees nothing has a single log line to go on.");
   eligibilityRefusedCounter = lazyCounter2("publisher_materialization_eligibility_refused_total", "storage= materialization-eligibility refusals. Label: reason " + "('free_parameter'|'given'|'authorize'|'not_duckdb_portable'|" + "'public_surface_unknown').");
@@ -250812,6 +250816,7 @@ var init_model = __esm(() => {
   init_gate_registry_walk();
   init_source_extraction();
   init_authorize_metrics();
+  init_path_safety();
   MALLOY_VERSION = createRequire2(import.meta.url)("@malloydata/malloy/package.json").version;
   Model = class Model {
     packageName;
@@ -252518,7 +252523,12 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
       };
     }
     static async getModelRuntime(packagePath, modelPath, malloyConfig, options) {
-      const fullModelPath = path8.join(packagePath, modelPath);
+      let fullModelPath;
+      try {
+        fullModelPath = safeJoinUnderRoot(packagePath, modelPath);
+      } catch {
+        throw new ModelNotFoundError(`${modelPath} does not exist.`);
+      }
       try {
         if (!(await fs6.stat(fullModelPath)).isFile()) {
           throw new ModelNotFoundError(`${modelPath} is not a file.`);
@@ -267987,6 +267997,1421 @@ var require_lunr = __commonJS((exports, module) => {
   })();
 });
 
+// ../../node_modules/ip-address/dist/address-error.js
+var require_address_error = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.AddressError = undefined;
+
+  class AddressError extends Error {
+    constructor(message, parseMessage) {
+      super(message);
+      this.name = "AddressError";
+      this.parseMessage = parseMessage;
+    }
+  }
+  exports.AddressError = AddressError;
+});
+
+// ../../node_modules/ip-address/dist/common.js
+var require_common8 = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.isInSubnet = isInSubnet;
+  exports.isHostInSubnet = isHostInSubnet;
+  exports.isCorrect = isCorrect;
+  exports.prefixLengthFromMask = prefixLengthFromMask;
+  exports.assertByteArray = assertByteArray;
+  exports.numberToPaddedHex = numberToPaddedHex;
+  exports.stringToPaddedHex = stringToPaddedHex;
+  exports.testBit = testBit;
+  var address_error_1 = require_address_error();
+  function isInSubnet(address) {
+    if (this.subnetMask < address.subnetMask) {
+      return false;
+    }
+    return isHostInSubnet.call(this, address);
+  }
+  function isHostInSubnet(address) {
+    return this.mask(address.subnetMask) === address.mask();
+  }
+  function isCorrect(defaultBits) {
+    return function isCorrectForm() {
+      if (this.addressMinusSuffix !== this.correctForm()) {
+        return false;
+      }
+      if (this.subnetMask === defaultBits && !this.parsedSubnet) {
+        return true;
+      }
+      return this.parsedSubnet === String(this.subnetMask);
+    };
+  }
+  function prefixLengthFromMask(value, totalBits) {
+    const binary = value.toString(2).padStart(totalBits, "0");
+    if (binary.length > totalBits) {
+      throw new address_error_1.AddressError("Invalid subnet mask.");
+    }
+    const firstZero = binary.indexOf("0");
+    if (firstZero === -1) {
+      return totalBits;
+    }
+    if (binary.slice(firstZero).includes("1")) {
+      throw new address_error_1.AddressError("Invalid subnet mask.");
+    }
+    return firstZero;
+  }
+  function assertByteArray(bytes, byteCount, family, minimum) {
+    if (bytes.length !== byteCount) {
+      throw new address_error_1.AddressError(`${family} addresses require exactly ${byteCount} bytes`);
+    }
+    for (let i = 0;i < bytes.length; i++) {
+      if (!Number.isInteger(bytes[i]) || bytes[i] < minimum || bytes[i] > 255) {
+        throw new address_error_1.AddressError(`All bytes must be integers between ${minimum} and 255`);
+      }
+    }
+  }
+  function numberToPaddedHex(number2) {
+    return number2.toString(16).padStart(2, "0");
+  }
+  function stringToPaddedHex(numberString) {
+    return numberToPaddedHex(parseInt(numberString, 10));
+  }
+  function testBit(binaryValue, position) {
+    const { length } = binaryValue;
+    if (position > length) {
+      return false;
+    }
+    const positionInString = length - position;
+    return binaryValue.substring(positionInString, positionInString + 1) === "1";
+  }
+});
+
+// ../../node_modules/ip-address/dist/v4/constants.js
+var require_constants25 = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = undefined;
+  exports.BITS = 32;
+  exports.GROUPS = 4;
+  exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
+  exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
+});
+
+// ../../node_modules/ip-address/dist/ipv4.js
+var require_ipv4 = __commonJS((exports) => {
+  var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() {
+        return m[k];
+      } };
+    }
+    Object.defineProperty(o, k2, desc);
+  } : function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    o[k2] = m[k];
+  });
+  var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+  } : function(o, v) {
+    o["default"] = v;
+  });
+  var __importStar = exports && exports.__importStar || function(mod2) {
+    if (mod2 && mod2.__esModule)
+      return mod2;
+    var result = {};
+    if (mod2 != null) {
+      for (var k in mod2)
+        if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
+          __createBinding(result, mod2, k);
+    }
+    __setModuleDefault(result, mod2);
+    return result;
+  };
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.Address4 = undefined;
+  var common = __importStar(require_common8());
+  var constants = __importStar(require_constants25());
+  var address_error_1 = require_address_error();
+  var isCorrect4 = common.isCorrect(constants.BITS);
+
+  class Address4 {
+    constructor(address) {
+      this.addressMinusSuffix = "";
+      this.groups = constants.GROUPS;
+      this.parsedAddress = [];
+      this.parsedSubnet = "";
+      this.subnet = "/32";
+      this.subnetMask = 32;
+      this.v4 = true;
+      this.isCorrect = isCorrect4;
+      this.isInSubnet = common.isInSubnet;
+      this.isHostInSubnet = common.isHostInSubnet;
+      this.address = address;
+      const subnet = constants.RE_SUBNET_STRING.exec(address);
+      if (subnet) {
+        this.parsedSubnet = subnet[0].replace("/", "");
+        this.subnetMask = parseInt(this.parsedSubnet, 10);
+        this.subnet = `/${this.subnetMask}`;
+        if (this.subnetMask < 0 || this.subnetMask > constants.BITS) {
+          throw new address_error_1.AddressError("Invalid subnet mask.");
+        }
+        address = address.replace(constants.RE_SUBNET_STRING, "");
+      }
+      this.addressMinusSuffix = address;
+      this.parsedAddress = this.parse(address);
+    }
+    static isValid(address) {
+      try {
+        new Address4(address);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    parse(address) {
+      const groups = address.split(".");
+      if (groups.some((group) => /^0\d/.test(group))) {
+        throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
+      }
+      if (!address.match(constants.RE_ADDRESS)) {
+        throw new address_error_1.AddressError("Invalid IPv4 address.");
+      }
+      return groups;
+    }
+    correctForm() {
+      return this.parsedAddress.map((part) => parseInt(part, 10)).join(".");
+    }
+    static fromAddressAndMask(address, mask) {
+      const bits = common.prefixLengthFromMask(new Address4(mask).bigInt(), constants.BITS);
+      return new Address4(`${address}/${bits}`);
+    }
+    static fromAddressAndWildcardMask(address, wildcardMask) {
+      const wildcard = new Address4(wildcardMask).bigInt();
+      const allOnes = (BigInt(1) << BigInt(constants.BITS)) - BigInt(1);
+      const mask = wildcard ^ allOnes;
+      const bits = common.prefixLengthFromMask(mask, constants.BITS);
+      return new Address4(`${address}/${bits}`);
+    }
+    static fromWildcard(input) {
+      const groups = input.split(".");
+      if (groups.length !== constants.GROUPS) {
+        throw new address_error_1.AddressError("Wildcard pattern must have 4 octets");
+      }
+      let firstWildcard = -1;
+      for (let i = 0;i < groups.length; i++) {
+        if (groups[i] === "*") {
+          if (firstWildcard === -1) {
+            firstWildcard = i;
+          }
+        } else if (firstWildcard !== -1) {
+          throw new address_error_1.AddressError("Wildcard `*` must only appear in trailing octets (e.g. `192.168.0.*`)");
+        }
+      }
+      const trailing = firstWildcard === -1 ? 0 : groups.length - firstWildcard;
+      const replaced = groups.map((g) => g === "*" ? "0" : g);
+      const subnetBits = constants.BITS - trailing * 8;
+      return new Address4(`${replaced.join(".")}/${subnetBits}`);
+    }
+    static fromHex(hex) {
+      const stripped = hex.replace(/:/g, "");
+      if (!/^[0-9a-fA-F]{8}$/.test(stripped)) {
+        throw new address_error_1.AddressError("IPv4 hex must be exactly 8 hex digits");
+      }
+      const groups = [];
+      for (let i = 0;i < 8; i += 2) {
+        groups.push(parseInt(stripped.slice(i, i + 2), 16));
+      }
+      return new Address4(groups.join("."));
+    }
+    static fromInteger(integer) {
+      if (!Number.isInteger(integer) || integer < 0 || integer > 4294967295) {
+        throw new address_error_1.AddressError("IPv4 integer must be in the range 0 to 2**32 - 1");
+      }
+      return Address4.fromHex(integer.toString(16).padStart(8, "0"));
+    }
+    static fromArpa(arpaFormAddress) {
+      const leader = arpaFormAddress.replace(/(\.in-addr\.arpa)?\.$/, "");
+      const address = leader.split(".").reverse().join(".");
+      return new Address4(address);
+    }
+    toHex() {
+      return this.parsedAddress.map((part) => common.stringToPaddedHex(part)).join(":");
+    }
+    toArray() {
+      return this.parsedAddress.map((part) => parseInt(part, 10));
+    }
+    toGroup6() {
+      const output = [];
+      let i;
+      for (i = 0;i < constants.GROUPS; i += 2) {
+        output.push(`${common.stringToPaddedHex(this.parsedAddress[i])}${common.stringToPaddedHex(this.parsedAddress[i + 1])}`);
+      }
+      return output.join(":");
+    }
+    bigInt() {
+      return BigInt(`0x${this.parsedAddress.map((n) => common.stringToPaddedHex(n)).join("")}`);
+    }
+    _startAddress() {
+      return BigInt(`0b${this.mask() + "0".repeat(constants.BITS - this.subnetMask)}`);
+    }
+    startAddress() {
+      return Address4.fromBigInt(this._startAddress());
+    }
+    startAddressExclusive() {
+      const adjust = BigInt("1");
+      return Address4.fromBigInt(this._startAddress() + adjust);
+    }
+    _endAddress() {
+      return BigInt(`0b${this.mask() + "1".repeat(constants.BITS - this.subnetMask)}`);
+    }
+    endAddress() {
+      return Address4.fromBigInt(this._endAddress());
+    }
+    endAddressExclusive() {
+      const adjust = BigInt("1");
+      return Address4.fromBigInt(this._endAddress() - adjust);
+    }
+    subnetMaskAddress() {
+      return Address4.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants.BITS - this.subnetMask)}`));
+    }
+    wildcardMask() {
+      return Address4.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants.BITS - this.subnetMask)}`));
+    }
+    networkForm() {
+      return `${this.startAddress().correctForm()}/${this.subnetMask}`;
+    }
+    static fromBigInt(bigInt) {
+      if (bigInt < BigInt(0) || bigInt > BigInt(4294967295)) {
+        throw new address_error_1.AddressError("IPv4 BigInt must be in the range 0 to 2**32 - 1");
+      }
+      return Address4.fromHex(bigInt.toString(16).padStart(8, "0"));
+    }
+    static fromByteArray(bytes) {
+      common.assertByteArray(bytes, 4, "IPv4", 0);
+      return this.fromUnsignedByteArray(bytes);
+    }
+    static fromUnsignedByteArray(bytes) {
+      if (bytes.length !== 4) {
+        throw new address_error_1.AddressError("IPv4 addresses require exactly 4 bytes");
+      }
+      const address = bytes.join(".");
+      return new Address4(address);
+    }
+    mask(mask) {
+      if (mask === undefined) {
+        mask = this.subnetMask;
+      }
+      return this.getBitsBase2(0, mask);
+    }
+    getBitsBase2(start, end) {
+      return this.binaryZeroPad().slice(start, end);
+    }
+    reverseForm(options) {
+      if (!options) {
+        options = {};
+      }
+      const reversed = this.correctForm().split(".").reverse().join(".");
+      if (options.omitSuffix) {
+        return reversed;
+      }
+      return `${reversed}.in-addr.arpa.`;
+    }
+    isMulticast() {
+      return this.isHostInSubnet(MULTICAST_V4);
+    }
+    isPrivate() {
+      return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
+    }
+    isLoopback() {
+      return this.isHostInSubnet(LOOPBACK_V4);
+    }
+    isLinkLocal() {
+      return this.isHostInSubnet(LINK_LOCAL_V4);
+    }
+    isUnspecified() {
+      return this.isHostInSubnet(UNSPECIFIED_V4);
+    }
+    isBroadcast() {
+      return this.isHostInSubnet(BROADCAST_V4);
+    }
+    isCGNAT() {
+      return this.isHostInSubnet(CGNAT_V4);
+    }
+    binaryZeroPad() {
+      if (this._binaryZeroPad === undefined) {
+        this._binaryZeroPad = this.bigInt().toString(2).padStart(constants.BITS, "0");
+      }
+      return this._binaryZeroPad;
+    }
+    groupForV6() {
+      const segments = this.parsedAddress;
+      return this.correctForm().replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${segments.slice(2, 4).join(".")}</span>`);
+    }
+  }
+  exports.Address4 = Address4;
+  var MULTICAST_V4 = new Address4("224.0.0.0/4");
+  var PRIVATE_V4 = [
+    new Address4("10.0.0.0/8"),
+    new Address4("172.16.0.0/12"),
+    new Address4("192.168.0.0/16")
+  ];
+  var LOOPBACK_V4 = new Address4("127.0.0.0/8");
+  var LINK_LOCAL_V4 = new Address4("169.254.0.0/16");
+  var UNSPECIFIED_V4 = new Address4("0.0.0.0/32");
+  var BROADCAST_V4 = new Address4("255.255.255.255/32");
+  var CGNAT_V4 = new Address4("100.64.0.0/10");
+});
+
+// ../../node_modules/ip-address/dist/v6/constants.js
+var require_constants26 = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.RE_URL_WITH_PORT = exports.RE_URL = exports.RE_ZONE_STRING = exports.RE_SUBNET_STRING = exports.RE_BAD_ADDRESS = exports.RE_BAD_CHARACTERS = exports.TYPES = exports.SCOPES = exports.GROUPS = exports.BITS = undefined;
+  exports.BITS = 128;
+  exports.GROUPS = 8;
+  exports.SCOPES = {
+    0: "Reserved",
+    1: "Interface local",
+    2: "Link local",
+    4: "Admin local",
+    5: "Site local",
+    8: "Organization local",
+    14: "Global",
+    15: "Reserved"
+  };
+  exports.TYPES = {
+    "ff01::1/128": "Multicast (All nodes on this interface)",
+    "ff01::2/128": "Multicast (All routers on this interface)",
+    "ff02::1/128": "Multicast (All nodes on this link)",
+    "ff02::2/128": "Multicast (All routers on this link)",
+    "ff05::2/128": "Multicast (All routers in this site)",
+    "ff02::5/128": "Multicast (OSPFv3 AllSPF routers)",
+    "ff02::6/128": "Multicast (OSPFv3 AllDR routers)",
+    "ff02::9/128": "Multicast (RIP routers)",
+    "ff02::a/128": "Multicast (EIGRP routers)",
+    "ff02::d/128": "Multicast (PIM routers)",
+    "ff02::16/128": "Multicast (MLDv2 reports)",
+    "ff01::fb/128": "Multicast (mDNSv6)",
+    "ff02::fb/128": "Multicast (mDNSv6)",
+    "ff05::fb/128": "Multicast (mDNSv6)",
+    "ff02::1:2/128": "Multicast (All DHCP servers and relay agents on this link)",
+    "ff05::1:2/128": "Multicast (All DHCP servers and relay agents in this site)",
+    "ff02::1:3/128": "Multicast (All DHCP servers on this link)",
+    "ff05::1:3/128": "Multicast (All DHCP servers in this site)",
+    "::/128": "Unspecified",
+    "::1/128": "Loopback",
+    "::ffff:0:0/96": "IPv4-mapped",
+    "ff00::/8": "Multicast",
+    "fe80::/10": "Link-local unicast",
+    "fc00::/7": "Unique local",
+    "2002::/16": "6to4",
+    "2001:db8::/32": "Documentation",
+    "64:ff9b::/96": "NAT64 (well-known)",
+    "64:ff9b:1::/48": "NAT64 (local-use)"
+  };
+  exports.RE_BAD_CHARACTERS = /([^0-9a-f:/%])/gi;
+  exports.RE_BAD_ADDRESS = /([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\/$)/gi;
+  exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
+  exports.RE_ZONE_STRING = /%.*$/;
+  exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+  exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
+});
+
+// ../../node_modules/ip-address/dist/v6/helpers.js
+var require_helpers2 = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.escapeHtml = escapeHtml;
+  exports.spanAllZeroes = spanAllZeroes;
+  exports.spanAll = spanAll;
+  exports.spanLeadingZeroes = spanLeadingZeroes;
+  exports.simpleGroup = simpleGroup;
+  function escapeHtml(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+  }
+  function spanAllZeroes(s) {
+    return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
+  }
+  function spanAll(s, offset = 0) {
+    const letters = s.split("");
+    return letters.map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
+  }
+  function spanLeadingZeroesSimple(group) {
+    return escapeHtml(group).replace(/^(0+)/, '<span class="zero">$1</span>');
+  }
+  function spanLeadingZeroes(address) {
+    const groups = address.split(":");
+    return groups.map((g) => spanLeadingZeroesSimple(g)).join(":");
+  }
+  function simpleGroup(addressString, offset = 0) {
+    const groups = addressString.split(":");
+    return groups.map((g, i) => {
+      if (/group-v4/.test(g)) {
+        return g;
+      }
+      return `<span class="hover-group group-${i + offset}">${spanLeadingZeroesSimple(g)}</span>`;
+    });
+  }
+});
+
+// ../../node_modules/ip-address/dist/v6/regular-expressions.js
+var require_regular_expressions = __commonJS((exports) => {
+  var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() {
+        return m[k];
+      } };
+    }
+    Object.defineProperty(o, k2, desc);
+  } : function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    o[k2] = m[k];
+  });
+  var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+  } : function(o, v) {
+    o["default"] = v;
+  });
+  var __importStar = exports && exports.__importStar || function(mod2) {
+    if (mod2 && mod2.__esModule)
+      return mod2;
+    var result = {};
+    if (mod2 != null) {
+      for (var k in mod2)
+        if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
+          __createBinding(result, mod2, k);
+    }
+    __setModuleDefault(result, mod2);
+    return result;
+  };
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.ADDRESS_BOUNDARY = undefined;
+  exports.groupPossibilities = groupPossibilities;
+  exports.padGroup = padGroup;
+  exports.simpleRegularExpression = simpleRegularExpression;
+  exports.possibleElisions = possibleElisions;
+  var v6 = __importStar(require_constants26());
+  function groupPossibilities(possibilities) {
+    return `(${possibilities.join("|")})`;
+  }
+  function padGroup(group) {
+    if (group.length < 4) {
+      return `0{0,${4 - group.length}}${group}`;
+    }
+    return group;
+  }
+  exports.ADDRESS_BOUNDARY = "[^A-Fa-f0-9:]";
+  function simpleRegularExpression(groups) {
+    const zeroIndexes = [];
+    groups.forEach((group, i) => {
+      const groupInteger = parseInt(group, 16);
+      if (groupInteger === 0) {
+        zeroIndexes.push(i);
+      }
+    });
+    const possibilities = zeroIndexes.map((zeroIndex) => groups.map((group, i) => {
+      if (i === zeroIndex) {
+        const elision = i === 0 || i === v6.GROUPS - 1 ? ":" : "";
+        return groupPossibilities([padGroup(group), elision]);
+      }
+      return padGroup(group);
+    }).join(":"));
+    possibilities.push(groups.map(padGroup).join(":"));
+    return groupPossibilities(possibilities);
+  }
+  function possibleElisions(elidedGroups, moreLeft, moreRight) {
+    const left = moreLeft ? "" : ":";
+    const right = moreRight ? "" : ":";
+    const possibilities = [];
+    if (!moreLeft && !moreRight) {
+      possibilities.push("::");
+    }
+    if (moreLeft && moreRight) {
+      possibilities.push("");
+    }
+    if (moreRight && !moreLeft || !moreRight && moreLeft) {
+      possibilities.push(":");
+    }
+    possibilities.push(`${left}(:0{1,4}){1,${elidedGroups - 1}}`);
+    possibilities.push(`(0{1,4}:){1,${elidedGroups - 1}}${right}`);
+    possibilities.push(`(0{1,4}:){${elidedGroups - 1}}0{1,4}`);
+    for (let groups = 1;groups < elidedGroups - 1; groups++) {
+      for (let position = 1;position < elidedGroups - groups; position++) {
+        possibilities.push(`(0{1,4}:){${position}}:(0{1,4}:){${elidedGroups - position - groups - 1}}0{1,4}`);
+      }
+    }
+    return groupPossibilities(possibilities);
+  }
+});
+
+// ../../node_modules/ip-address/dist/ipv6.js
+var require_ipv6 = __commonJS((exports) => {
+  var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() {
+        return m[k];
+      } };
+    }
+    Object.defineProperty(o, k2, desc);
+  } : function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    o[k2] = m[k];
+  });
+  var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+  } : function(o, v) {
+    o["default"] = v;
+  });
+  var __importStar = exports && exports.__importStar || function(mod2) {
+    if (mod2 && mod2.__esModule)
+      return mod2;
+    var result = {};
+    if (mod2 != null) {
+      for (var k in mod2)
+        if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
+          __createBinding(result, mod2, k);
+    }
+    __setModuleDefault(result, mod2);
+    return result;
+  };
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.Address6 = undefined;
+  var common = __importStar(require_common8());
+  var constants4 = __importStar(require_constants25());
+  var constants6 = __importStar(require_constants26());
+  var helpers = __importStar(require_helpers2());
+  var ipv4_1 = require_ipv4();
+  var regular_expressions_1 = require_regular_expressions();
+  var address_error_1 = require_address_error();
+  var common_1 = require_common8();
+  var isCorrect6 = common.isCorrect(constants6.BITS);
+  function assert(condition) {
+    if (!condition) {
+      throw new Error("Assertion failed.");
+    }
+  }
+  function addCommas(number2) {
+    const r = /(\d+)(\d{3})/;
+    while (r.test(number2)) {
+      number2 = number2.replace(r, "$1,$2");
+    }
+    return number2;
+  }
+  function spanLeadingZeroes4(n) {
+    n = n.replace(/^(0{1,})([1-9]+)$/, '<span class="parse-error">$1</span>$2');
+    n = n.replace(/^(0{1,})(0)$/, '<span class="parse-error">$1</span>$2');
+    return n;
+  }
+  function compact(address, slice) {
+    const s1 = [];
+    const s2 = [];
+    let i;
+    for (i = 0;i < address.length; i++) {
+      if (i < slice[0]) {
+        s1.push(address[i]);
+      } else if (i > slice[1]) {
+        s2.push(address[i]);
+      }
+    }
+    return s1.concat(["compact"]).concat(s2);
+  }
+  function paddedHex(octet) {
+    return parseInt(octet, 16).toString(16).padStart(4, "0");
+  }
+  function unsignByte(b) {
+    return b & 255;
+  }
+
+  class Address6 {
+    constructor(address, optionalGroups) {
+      this.addressMinusSuffix = "";
+      this.parsedSubnet = "";
+      this.subnet = "/128";
+      this.subnetMask = 128;
+      this.v4 = false;
+      this.zone = "";
+      this.isInSubnet = common.isInSubnet;
+      this.isHostInSubnet = common.isHostInSubnet;
+      this.isCorrect = isCorrect6;
+      if (optionalGroups === undefined) {
+        this.groups = constants6.GROUPS;
+      } else {
+        this.groups = optionalGroups;
+      }
+      this.address = address;
+      const subnet = constants6.RE_SUBNET_STRING.exec(address);
+      if (subnet) {
+        this.parsedSubnet = subnet[0].replace("/", "");
+        this.subnetMask = parseInt(this.parsedSubnet, 10);
+        this.subnet = `/${this.subnetMask}`;
+        if (Number.isNaN(this.subnetMask) || this.subnetMask < 0 || this.subnetMask > constants6.BITS) {
+          throw new address_error_1.AddressError("Invalid subnet mask.");
+        }
+        address = address.replace(constants6.RE_SUBNET_STRING, "");
+      }
+      if (/\//.test(address)) {
+        throw new address_error_1.AddressError("Invalid subnet mask.");
+      }
+      const zone = constants6.RE_ZONE_STRING.exec(address);
+      if (zone) {
+        this.zone = zone[0];
+        address = address.replace(constants6.RE_ZONE_STRING, "");
+      }
+      this.addressMinusSuffix = address;
+      this.parsedAddress = this.parse(this.addressMinusSuffix);
+    }
+    static isValid(address) {
+      try {
+        new Address6(address);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    static fromBigInt(bigInt) {
+      if (bigInt < BigInt(0) || bigInt > (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1)) {
+        throw new address_error_1.AddressError("IPv6 BigInt must be in the range 0 to 2**128 - 1");
+      }
+      const hex = bigInt.toString(16).padStart(32, "0");
+      const groups = [];
+      for (let i = 0;i < constants6.GROUPS; i++) {
+        groups.push(hex.slice(i * 4, (i + 1) * 4));
+      }
+      return new Address6(groups.join(":"));
+    }
+    static fromURL(url2) {
+      var _a2;
+      let host;
+      let port = null;
+      let result;
+      let error;
+      const stripped = url2.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+      if (stripped.indexOf("[") !== -1 && stripped.indexOf("]:") !== -1) {
+        error = "failed to parse address with port";
+        result = constants6.RE_URL_WITH_PORT.exec(stripped);
+        if (result === null) {
+          return { error, address: null, port: null };
+        }
+        host = result[1];
+        port = result[2];
+      } else {
+        error = "failed to parse address from URL";
+        result = constants6.RE_URL.exec(stripped);
+        if (result === null) {
+          return { error, address: null, port: null };
+        }
+        host = (_a2 = result[1]) !== null && _a2 !== undefined ? _a2 : result[2];
+      }
+      if (port) {
+        port = parseInt(port, 10);
+        if (port < 0 || port > 65535) {
+          port = null;
+        }
+      } else {
+        port = null;
+      }
+      let address;
+      try {
+        address = new Address6(host);
+      } catch {
+        return { error, address: null, port: null };
+      }
+      return { address, port };
+    }
+    static fromAddressAndMask(address, mask) {
+      const bits = common.prefixLengthFromMask(new Address6(mask).bigInt(), constants6.BITS);
+      return new Address6(`${address}/${bits}`);
+    }
+    static fromAddressAndWildcardMask(address, wildcardMask) {
+      const wildcard = new Address6(wildcardMask).bigInt();
+      const allOnes = (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1);
+      const mask = wildcard ^ allOnes;
+      const bits = common.prefixLengthFromMask(mask, constants6.BITS);
+      return new Address6(`${address}/${bits}`);
+    }
+    static fromWildcard(input) {
+      if (input.includes("%") || input.includes("/")) {
+        throw new address_error_1.AddressError("Wildcard pattern must not include a zone or CIDR suffix");
+      }
+      const halves = input.split("::");
+      if (halves.length > 2) {
+        throw new address_error_1.AddressError("Wildcard pattern cannot contain more than one '::'");
+      }
+      let groups;
+      if (halves.length === 2) {
+        const left = halves[0] === "" ? [] : halves[0].split(":");
+        const right = halves[1] === "" ? [] : halves[1].split(":");
+        const remaining = constants6.GROUPS - left.length - right.length;
+        if (remaining < 1) {
+          throw new address_error_1.AddressError("Wildcard pattern with '::' has too many groups");
+        }
+        groups = [...left, ...new Array(remaining).fill("0"), ...right];
+      } else {
+        groups = input.split(":");
+      }
+      if (groups.length !== constants6.GROUPS) {
+        throw new address_error_1.AddressError("Wildcard pattern must have 8 groups");
+      }
+      let firstWildcard = -1;
+      for (let i = 0;i < groups.length; i++) {
+        if (groups[i] === "*") {
+          if (firstWildcard === -1) {
+            firstWildcard = i;
+          }
+        } else if (firstWildcard !== -1) {
+          throw new address_error_1.AddressError("Wildcard `*` must only appear in trailing groups (e.g. `2001:db8:*:*:*:*:*:*`)");
+        }
+      }
+      const trailing = firstWildcard === -1 ? 0 : groups.length - firstWildcard;
+      const replaced = groups.map((g) => g === "*" ? "0" : g);
+      const subnetBits = constants6.BITS - trailing * 16;
+      return new Address6(`${replaced.join(":")}/${subnetBits}`);
+    }
+    static fromAddress4(address) {
+      const address4 = new ipv4_1.Address4(address);
+      const mask6 = constants6.BITS - (constants4.BITS - address4.subnetMask);
+      return new Address6(`::ffff:${address4.correctForm()}/${mask6}`);
+    }
+    static fromArpa(arpaFormAddress) {
+      let address = arpaFormAddress.replace(/(\.ip6\.arpa)?\.$/, "");
+      const semicolonAmount = 7;
+      if (address.length !== 63) {
+        throw new address_error_1.AddressError("Invalid 'ip6.arpa' form.");
+      }
+      const parts = address.split(".").reverse();
+      for (let i = semicolonAmount;i > 0; i--) {
+        const insertIndex = i * 4;
+        parts.splice(insertIndex, 0, ":");
+      }
+      address = parts.join("");
+      return new Address6(address);
+    }
+    microsoftTranscription() {
+      return `${this.correctForm().replace(/:/g, "-")}.ipv6-literal.net`;
+    }
+    mask(mask = this.subnetMask) {
+      return this.getBitsBase2(0, mask);
+    }
+    possibleSubnets(subnetSize = 128) {
+      const availableBits = constants6.BITS - this.subnetMask;
+      const subnetBits = Math.abs(subnetSize - constants6.BITS);
+      const subnetPowers = availableBits - subnetBits;
+      if (subnetPowers < 0) {
+        return "0";
+      }
+      return addCommas((BigInt("2") ** BigInt(subnetPowers)).toString(10));
+    }
+    _startAddress() {
+      return BigInt(`0b${this.mask() + "0".repeat(constants6.BITS - this.subnetMask)}`);
+    }
+    startAddress() {
+      return Address6.fromBigInt(this._startAddress());
+    }
+    startAddressExclusive() {
+      const adjust = BigInt("1");
+      return Address6.fromBigInt(this._startAddress() + adjust);
+    }
+    _endAddress() {
+      return BigInt(`0b${this.mask() + "1".repeat(constants6.BITS - this.subnetMask)}`);
+    }
+    endAddress() {
+      return Address6.fromBigInt(this._endAddress());
+    }
+    endAddressExclusive() {
+      const adjust = BigInt("1");
+      return Address6.fromBigInt(this._endAddress() - adjust);
+    }
+    subnetMaskAddress() {
+      return Address6.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants6.BITS - this.subnetMask)}`));
+    }
+    wildcardMask() {
+      return Address6.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants6.BITS - this.subnetMask)}`));
+    }
+    networkForm() {
+      return `${this.startAddress().correctForm()}/${this.subnetMask}`;
+    }
+    getScope() {
+      const type = this.getType();
+      if (type === "Multicast" || type.startsWith("Multicast ")) {
+        const scope = constants6.SCOPES[parseInt(this.getBits(12, 16).toString(10), 10)];
+        return scope || "Unknown";
+      }
+      if (type === "Link-local unicast" || type === "Loopback") {
+        return "Link local";
+      }
+      if (type === "Unspecified") {
+        return "Unknown";
+      }
+      return "Global";
+    }
+    getType() {
+      for (let i = 0;i < TYPE_SUBNETS.length; i++) {
+        const entry = TYPE_SUBNETS[i];
+        if (this.isHostInSubnet(entry[0])) {
+          return entry[1];
+        }
+      }
+      return "Global unicast";
+    }
+    getBits(start, end) {
+      return BigInt(`0b${this.getBitsBase2(start, end)}`);
+    }
+    getBitsBase2(start, end) {
+      return this.binaryZeroPad().slice(start, end);
+    }
+    getBitsBase16(start, end) {
+      const length = end - start;
+      if (length % 4 !== 0) {
+        throw new Error("Length of bits to retrieve must be divisible by four");
+      }
+      return this.getBits(start, end).toString(16).padStart(length / 4, "0");
+    }
+    getBitsPastSubnet() {
+      return this.getBitsBase2(this.subnetMask, constants6.BITS);
+    }
+    reverseForm(options) {
+      if (!options) {
+        options = {};
+      }
+      const characters = Math.floor(this.subnetMask / 4);
+      const reversed = this.canonicalForm().replace(/:/g, "").split("").slice(0, characters).reverse().join(".");
+      if (characters > 0) {
+        if (options.omitSuffix) {
+          return reversed;
+        }
+        return `${reversed}.ip6.arpa.`;
+      }
+      if (options.omitSuffix) {
+        return "";
+      }
+      return "ip6.arpa.";
+    }
+    correctForm() {
+      let i;
+      let groups = [];
+      let zeroCounter = 0;
+      const zeroes = [];
+      for (i = 0;i < this.parsedAddress.length; i++) {
+        const value = parseInt(this.parsedAddress[i], 16);
+        if (value === 0) {
+          zeroCounter++;
+        }
+        if (value !== 0 && zeroCounter > 0) {
+          if (zeroCounter > 1) {
+            zeroes.push([i - zeroCounter, i - 1]);
+          }
+          zeroCounter = 0;
+        }
+      }
+      if (zeroCounter > 1) {
+        zeroes.push([this.parsedAddress.length - zeroCounter, this.parsedAddress.length - 1]);
+      }
+      const zeroLengths = zeroes.map((n) => n[1] - n[0] + 1);
+      if (zeroes.length > 0) {
+        const index = zeroLengths.indexOf(Math.max(...zeroLengths));
+        groups = compact(this.parsedAddress, zeroes[index]);
+      } else {
+        groups = this.parsedAddress;
+      }
+      for (i = 0;i < groups.length; i++) {
+        if (groups[i] !== "compact") {
+          groups[i] = parseInt(groups[i], 16).toString(16);
+        }
+      }
+      let correct = groups.join(":");
+      correct = correct.replace(/^compact$/, "::");
+      correct = correct.replace(/(^compact)|(compact$)/, ":");
+      correct = correct.replace(/compact/, "");
+      return correct;
+    }
+    binaryZeroPad() {
+      if (this._binaryZeroPad === undefined) {
+        this._binaryZeroPad = this.bigInt().toString(2).padStart(constants6.BITS, "0");
+      }
+      return this._binaryZeroPad;
+    }
+    parse4in6(address) {
+      if (address.indexOf(".") === -1) {
+        return address;
+      }
+      const groups = address.split(":");
+      const lastGroup = groups.slice(-1)[0];
+      const v4Octets = lastGroup.split(".");
+      if (v4Octets.length === constants4.GROUPS && v4Octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+        if (v4Octets.some((octet) => /^0\d/.test(octet))) {
+          const highlighted = v4Octets.map(spanLeadingZeroes4).join(".");
+          const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(":");
+          const separator = groups.length > 1 ? ":" : "";
+          throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+        }
+      }
+      const address4 = lastGroup.match(constants4.RE_ADDRESS);
+      if (address4) {
+        this.parsedAddress4 = address4[0];
+        const v4Suffix = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : "";
+        this.address4 = new ipv4_1.Address4(`${this.parsedAddress4}${v4Suffix}`);
+        this.v4 = true;
+        groups[groups.length - 1] = this.address4.toGroup6();
+        address = groups.join(":");
+      }
+      return address;
+    }
+    parse(address) {
+      address = this.parse4in6(address);
+      const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);
+      if (badCharacters) {
+        throw new address_error_1.AddressError(`Bad character${badCharacters.length > 1 ? "s" : ""} detected in address: ${badCharacters.join("")}`, address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'));
+      }
+      const badAddress = address.match(constants6.RE_BAD_ADDRESS);
+      if (badAddress) {
+        throw new address_error_1.AddressError(`Address failed regex: ${badAddress.join("")}`, address.replace(constants6.RE_BAD_ADDRESS, '<span class="parse-error">$1</span>'));
+      }
+      let groups = [];
+      const halves = address.split("::");
+      if (halves.length === 2) {
+        let first2 = halves[0].split(":");
+        let last2 = halves[1].split(":");
+        if (first2.length === 1 && first2[0] === "") {
+          first2 = [];
+        }
+        if (last2.length === 1 && last2[0] === "") {
+          last2 = [];
+        }
+        const remaining = this.groups - (first2.length + last2.length);
+        if (!remaining) {
+          throw new address_error_1.AddressError("Error parsing groups");
+        }
+        this.elidedGroups = remaining;
+        this.elisionBegin = first2.length;
+        this.elisionEnd = first2.length + this.elidedGroups;
+        groups = groups.concat(first2);
+        for (let i = 0;i < remaining; i++) {
+          groups.push("0");
+        }
+        groups = groups.concat(last2);
+      } else if (halves.length === 1) {
+        groups = address.split(":");
+        this.elidedGroups = 0;
+      } else {
+        throw new address_error_1.AddressError("Too many :: groups found");
+      }
+      groups = groups.map((group) => parseInt(group, 16).toString(16));
+      if (groups.length !== this.groups) {
+        throw new address_error_1.AddressError("Incorrect number of groups found");
+      }
+      return groups;
+    }
+    canonicalForm() {
+      return this.parsedAddress.map(paddedHex).join(":");
+    }
+    decimal() {
+      return this.parsedAddress.map((n) => parseInt(n, 16).toString(10).padStart(5, "0")).join(":");
+    }
+    bigInt() {
+      return BigInt(`0x${this.parsedAddress.map(paddedHex).join("")}`);
+    }
+    to4() {
+      const binary = this.binaryZeroPad().split("");
+      const hex = BigInt(`0b${binary.slice(96, 128).join("")}`).toString(16).padStart(8, "0");
+      if (this.subnetMask >= 96) {
+        const v4Mask = this.subnetMask - 96;
+        const groups = [];
+        for (let i = 0;i < 8; i += 2) {
+          groups.push(parseInt(hex.slice(i, i + 2), 16));
+        }
+        return new ipv4_1.Address4(`${groups.join(".")}/${v4Mask}`);
+      }
+      return ipv4_1.Address4.fromHex(hex);
+    }
+    to4in6() {
+      const address4 = this.to4();
+      const address6 = new Address6(this.parsedAddress.slice(0, 6).join(":"), 6);
+      const correct = address6.correctForm();
+      let infix = "";
+      if (!/:$/.test(correct)) {
+        infix = ":";
+      }
+      return correct + infix + address4.correctForm();
+    }
+    inspectTeredo() {
+      const prefix = this.getBitsBase16(0, 32);
+      const bitsForUdpPort = this.getBits(80, 96);
+      const udpPort = (bitsForUdpPort ^ BigInt("0xffff")).toString();
+      const server4 = ipv4_1.Address4.fromHex(this.getBitsBase16(32, 64));
+      const bitsForClient4 = this.getBits(96, 128);
+      const client4 = ipv4_1.Address4.fromHex((bitsForClient4 ^ BigInt("0xffffffff")).toString(16).padStart(8, "0"));
+      const flagsBase2 = this.getBitsBase2(64, 80);
+      const coneNat = (0, common_1.testBit)(flagsBase2, 15);
+      const reserved = (0, common_1.testBit)(flagsBase2, 14);
+      const groupIndividual = (0, common_1.testBit)(flagsBase2, 8);
+      const universalLocal = (0, common_1.testBit)(flagsBase2, 9);
+      const nonce = BigInt(`0b${flagsBase2.slice(2, 6) + flagsBase2.slice(8, 16)}`).toString(10);
+      return {
+        prefix: `${prefix.slice(0, 4)}:${prefix.slice(4, 8)}`,
+        server4: server4.address,
+        client4: client4.address,
+        flags: flagsBase2,
+        coneNat,
+        microsoft: {
+          reserved,
+          universalLocal,
+          groupIndividual,
+          nonce
+        },
+        udpPort
+      };
+    }
+    inspect6to4() {
+      const prefix = this.getBitsBase16(0, 16);
+      const gateway = ipv4_1.Address4.fromHex(this.getBitsBase16(16, 48));
+      return {
+        prefix: prefix.slice(0, 4),
+        gateway: gateway.address
+      };
+    }
+    to6to4() {
+      if (!this.is4()) {
+        return null;
+      }
+      const addr6to4 = [
+        "2002",
+        this.getBitsBase16(96, 112),
+        this.getBitsBase16(112, 128),
+        "",
+        "/16"
+      ].join(":");
+      return new Address6(addr6to4);
+    }
+    static fromAddress4Nat64(address, prefix = "64:ff9b::/96") {
+      const v4 = new ipv4_1.Address4(address);
+      const prefix6 = new Address6(prefix);
+      const pl2 = prefix6.subnetMask;
+      if (pl2 !== 32 && pl2 !== 40 && pl2 !== 48 && pl2 !== 56 && pl2 !== 64 && pl2 !== 96) {
+        throw new address_error_1.AddressError("NAT64 prefix length must be 32, 40, 48, 56, 64, or 96");
+      }
+      const prefixBits = prefix6.binaryZeroPad();
+      const v4Bits = v4.binaryZeroPad();
+      let bits;
+      if (pl2 === 96) {
+        bits = prefixBits.slice(0, 96) + v4Bits;
+      } else {
+        const beforeU = 64 - pl2;
+        bits = [
+          prefixBits.slice(0, pl2),
+          v4Bits.slice(0, beforeU),
+          "00000000",
+          v4Bits.slice(beforeU),
+          "0".repeat(128 - 72 - (32 - beforeU))
+        ].join("");
+      }
+      const hex = BigInt(`0b${bits}`).toString(16).padStart(32, "0");
+      const groups = [];
+      for (let i = 0;i < 8; i++) {
+        groups.push(hex.slice(i * 4, (i + 1) * 4));
+      }
+      return new Address6(groups.join(":"));
+    }
+    toAddress4Nat64(prefix = "64:ff9b::/96") {
+      const prefix6 = new Address6(prefix);
+      const pl2 = prefix6.subnetMask;
+      if (pl2 !== 32 && pl2 !== 40 && pl2 !== 48 && pl2 !== 56 && pl2 !== 64 && pl2 !== 96) {
+        throw new address_error_1.AddressError("NAT64 prefix length must be 32, 40, 48, 56, 64, or 96");
+      }
+      if (!this.isHostInSubnet(prefix6)) {
+        return null;
+      }
+      const bits = this.binaryZeroPad();
+      let v4Bits;
+      if (pl2 === 96) {
+        v4Bits = bits.slice(96, 128);
+      } else {
+        const beforeU = 64 - pl2;
+        v4Bits = bits.slice(pl2, pl2 + beforeU) + bits.slice(72, 72 + (32 - beforeU));
+      }
+      const octets = [];
+      for (let i = 0;i < 4; i++) {
+        octets.push(parseInt(v4Bits.slice(i * 8, (i + 1) * 8), 2).toString());
+      }
+      return new ipv4_1.Address4(octets.join("."));
+    }
+    toByteArray() {
+      const value = this.bigInt().toString(16).padStart(constants6.BITS / 4, "0");
+      const bytes = [];
+      for (let i = 0, length = value.length;i < length; i += 2) {
+        bytes.push(parseInt(value.substring(i, i + 2), 16));
+      }
+      return bytes;
+    }
+    toUnsignedByteArray() {
+      return this.toByteArray().map(unsignByte);
+    }
+    static fromByteArray(bytes) {
+      common.assertByteArray(bytes, 16, "IPv6", -128);
+      return this.fromUnsignedByteArray(bytes.map(unsignByte));
+    }
+    static fromUnsignedByteArray(bytes) {
+      common.assertByteArray(bytes, 16, "IPv6", 0);
+      const BYTE_MAX = BigInt("256");
+      let result = BigInt("0");
+      let multiplier = BigInt("1");
+      for (let i = bytes.length - 1;i >= 0; i--) {
+        result += multiplier * BigInt(bytes[i].toString(10));
+        multiplier *= BYTE_MAX;
+      }
+      return Address6.fromBigInt(result);
+    }
+    isCanonical() {
+      return this.addressMinusSuffix === this.canonicalForm();
+    }
+    isLinkLocal() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isLinkLocal();
+      }
+      if (this.getBitsBase2(0, 64) === "1111111010000000000000000000000000000000000000000000000000000000") {
+        return true;
+      }
+      return false;
+    }
+    isMulticast() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isMulticast();
+      }
+      const type = this.getType();
+      return type === "Multicast" || type.startsWith("Multicast ");
+    }
+    is4() {
+      return this.v4;
+    }
+    isMapped4() {
+      return this.isHostInSubnet(IPV4_MAPPED_SUBNET);
+    }
+    embeddedIPv4() {
+      if (this.isMapped4() || this.isHostInSubnet(NAT64_WELL_KNOWN_SUBNET)) {
+        return this.to4();
+      }
+      return null;
+    }
+    isTeredo() {
+      return this.isHostInSubnet(TEREDO_SUBNET);
+    }
+    is6to4() {
+      return this.isHostInSubnet(SIX_TO_FOUR_SUBNET);
+    }
+    isLoopback() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isLoopback();
+      }
+      return this.getType() === "Loopback";
+    }
+    isULA() {
+      return this.isHostInSubnet(ULA_SUBNET);
+    }
+    isPrivate() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isPrivate();
+      }
+      return this.isULA();
+    }
+    isCGNAT() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isCGNAT();
+      }
+      return false;
+    }
+    isBroadcast() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isBroadcast();
+      }
+      return false;
+    }
+    isUnspecified() {
+      const embedded = this.embeddedIPv4();
+      if (embedded) {
+        return embedded.isUnspecified();
+      }
+      return this.getType() === "Unspecified";
+    }
+    isDocumentation() {
+      return this.isHostInSubnet(DOCUMENTATION_SUBNET);
+    }
+    href(optionalPort) {
+      if (optionalPort === undefined) {
+        optionalPort = "";
+      } else {
+        optionalPort = `:${optionalPort}`;
+      }
+      return `http://[${this.correctForm()}]${optionalPort}/`;
+    }
+    link(options) {
+      if (!options) {
+        options = {};
+      }
+      if (options.className === undefined) {
+        options.className = "";
+      }
+      if (options.prefix === undefined) {
+        options.prefix = "/#address=";
+      }
+      if (options.v4 === undefined) {
+        options.v4 = false;
+      }
+      let formFunction = this.correctForm;
+      if (options.v4) {
+        formFunction = this.to4in6;
+      }
+      const form = formFunction.call(this);
+      const safeHref = helpers.escapeHtml(`${options.prefix}${form}`);
+      const safeForm = helpers.escapeHtml(form);
+      if (options.className) {
+        const safeClass = helpers.escapeHtml(options.className);
+        return `<a href="${safeHref}" class="${safeClass}">${safeForm}</a>`;
+      }
+      return `<a href="${safeHref}">${safeForm}</a>`;
+    }
+    group() {
+      if (this.elidedGroups === 0) {
+        return helpers.simpleGroup(this.addressMinusSuffix).join(":");
+      }
+      assert(typeof this.elidedGroups === "number");
+      assert(typeof this.elisionBegin === "number");
+      const output = [];
+      const [left, right] = this.addressMinusSuffix.split("::");
+      if (left.length) {
+        output.push(...helpers.simpleGroup(left));
+      } else {
+        output.push("");
+      }
+      const classes = ["hover-group"];
+      for (let i = this.elisionBegin;i < this.elisionBegin + this.elidedGroups; i++) {
+        classes.push(`group-${i}`);
+      }
+      output.push(`<span class="${classes.join(" ")}"></span>`);
+      if (right.length) {
+        output.push(...helpers.simpleGroup(right, this.elisionEnd));
+      } else {
+        output.push("");
+      }
+      if (this.is4()) {
+        assert(this.address4 instanceof ipv4_1.Address4);
+        output.pop();
+        output.push(this.address4.groupForV6());
+      }
+      return output.join(":");
+    }
+    regularExpressionString(substringSearch = false) {
+      let output = [];
+      const address6 = new Address6(this.correctForm());
+      if (address6.elidedGroups === 0) {
+        output.push((0, regular_expressions_1.simpleRegularExpression)(address6.parsedAddress));
+      } else if (address6.elidedGroups === constants6.GROUPS) {
+        output.push((0, regular_expressions_1.possibleElisions)(constants6.GROUPS));
+      } else {
+        const halves = address6.address.split("::");
+        if (halves[0].length) {
+          output.push((0, regular_expressions_1.simpleRegularExpression)(halves[0].split(":")));
+        }
+        assert(typeof address6.elidedGroups === "number");
+        output.push((0, regular_expressions_1.possibleElisions)(address6.elidedGroups, halves[0].length !== 0, halves[1].length !== 0));
+        if (halves[1].length) {
+          output.push((0, regular_expressions_1.simpleRegularExpression)(halves[1].split(":")));
+        }
+        output = [output.join(":")];
+      }
+      if (!substringSearch) {
+        output = [
+          "(?=^|",
+          regular_expressions_1.ADDRESS_BOUNDARY,
+          "|[^\\w\\:])(",
+          ...output,
+          ")(?=[^\\w\\:]|",
+          regular_expressions_1.ADDRESS_BOUNDARY,
+          "|$)"
+        ];
+      }
+      return output.join("");
+    }
+    regularExpression(substringSearch = false) {
+      return new RegExp(this.regularExpressionString(substringSearch), "i");
+    }
+  }
+  exports.Address6 = Address6;
+  var TYPE_SUBNETS = Object.keys(constants6.TYPES).map((subnet) => [
+    new Address6(subnet),
+    constants6.TYPES[subnet]
+  ]);
+  var TEREDO_SUBNET = new Address6("2001::/32");
+  var SIX_TO_FOUR_SUBNET = new Address6("2002::/16");
+  var ULA_SUBNET = new Address6("fc00::/7");
+  var DOCUMENTATION_SUBNET = new Address6("2001:db8::/32");
+  var IPV4_MAPPED_SUBNET = new Address6("::ffff:0:0/96");
+  var NAT64_WELL_KNOWN_SUBNET = new Address6("64:ff9b::/96");
+});
+
+// ../../node_modules/ip-address/dist/ip-address.js
+var require_ip_address = __commonJS((exports) => {
+  var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() {
+        return m[k];
+      } };
+    }
+    Object.defineProperty(o, k2, desc);
+  } : function(o, m, k, k2) {
+    if (k2 === undefined)
+      k2 = k;
+    o[k2] = m[k];
+  });
+  var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+  } : function(o, v) {
+    o["default"] = v;
+  });
+  var __importStar = exports && exports.__importStar || function(mod2) {
+    if (mod2 && mod2.__esModule)
+      return mod2;
+    var result = {};
+    if (mod2 != null) {
+      for (var k in mod2)
+        if (k !== "default" && Object.prototype.hasOwnProperty.call(mod2, k))
+          __createBinding(result, mod2, k);
+    }
+    __setModuleDefault(result, mod2);
+    return result;
+  };
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.v6 = exports.AddressError = exports.Address6 = exports.Address4 = undefined;
+  var ipv4_1 = require_ipv4();
+  Object.defineProperty(exports, "Address4", { enumerable: true, get: function() {
+    return ipv4_1.Address4;
+  } });
+  var ipv6_1 = require_ipv6();
+  Object.defineProperty(exports, "Address6", { enumerable: true, get: function() {
+    return ipv6_1.Address6;
+  } });
+  var address_error_1 = require_address_error();
+  Object.defineProperty(exports, "AddressError", { enumerable: true, get: function() {
+    return address_error_1.AddressError;
+  } });
+  var helpers = __importStar(require_helpers2());
+  exports.v6 = { helpers };
+});
+
 // src/instrumentation.ts
 init_logger();
 init_telemetry();
@@ -282162,10 +283587,15 @@ class IncrementalLedgerRepository {
   constructor(db) {
     this.db = db;
   }
-  async get(environmentId, connectionName, physicalTableName) {
+  async get(environmentId, table) {
     const row = await this.db.get(`SELECT * FROM incremental_ledger
            WHERE environment_id = ? AND connection_name = ?
-             AND physical_table_name = ?`, [environmentId, connectionName, physicalTableName]);
+             AND storage_destination_name = ? AND physical_table_name = ?`, [
+      environmentId,
+      table.connectionName,
+      table.storageDestinationName ?? "",
+      table.physicalTableName
+    ]);
     return row ? mapRow(row) : null;
   }
   async upsert(entry) {
@@ -282174,10 +283604,11 @@ class IncrementalLedgerRepository {
              environment_id, package_name, source_entity_id,
              covered_through_value, covered_through_type,
              watermark_dimension, merge_key_dimensions, derived_strategy,
-             physical_table_name, connection_name,
+             physical_table_name, connection_name, storage_destination_name,
              advanced_by_materialization_id, advanced_at, created_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-          ON CONFLICT (environment_id, connection_name, physical_table_name)
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT (environment_id, connection_name,
+                       storage_destination_name, physical_table_name)
           DO UPDATE SET
              package_name = EXCLUDED.package_name,
              source_entity_id = EXCLUDED.source_entity_id,
@@ -282186,6 +283617,7 @@ class IncrementalLedgerRepository {
              watermark_dimension = EXCLUDED.watermark_dimension,
              merge_key_dimensions = EXCLUDED.merge_key_dimensions,
              derived_strategy = EXCLUDED.derived_strategy,
+             storage_destination_name = EXCLUDED.storage_destination_name,
              advanced_by_materialization_id = EXCLUDED.advanced_by_materialization_id,
              advanced_at = EXCLUDED.advanced_at
           RETURNING *`, [
@@ -282199,16 +283631,22 @@ class IncrementalLedgerRepository {
       entry.derivedStrategy,
       entry.physicalTableName,
       entry.connectionName,
+      entry.storageDestinationName ?? "",
       entry.advancedByMaterializationId,
       now,
       now
     ]);
     return mapRow(rows[0]);
   }
-  async deleteEntry(environmentId, connectionName, physicalTableName) {
+  async deleteEntry(environmentId, table) {
     await this.db.run(`DELETE FROM incremental_ledger
            WHERE environment_id = ? AND connection_name = ?
-             AND physical_table_name = ?`, [environmentId, connectionName, physicalTableName]);
+             AND storage_destination_name = ? AND physical_table_name = ?`, [
+      environmentId,
+      table.connectionName,
+      table.storageDestinationName ?? "",
+      table.physicalTableName
+    ]);
   }
   async deleteByEnvironmentId(environmentId) {
     await this.db.run("DELETE FROM incremental_ledger WHERE environment_id = ?", [environmentId]);
@@ -282229,6 +283667,7 @@ function mapRow(row) {
     derivedStrategy: row.derived_strategy,
     physicalTableName: row.physical_table_name,
     connectionName: row.connection_name,
+    storageDestinationName: typeof row.storage_destination_name === "string" && row.storage_destination_name.length > 0 ? row.storage_destination_name : undefined,
     advancedByMaterializationId: row.advanced_by_materialization_id != null ? row.advanced_by_materialization_id : null,
     advancedAt: new Date(row.advanced_at),
     createdAt: new Date(row.created_at)
@@ -282716,14 +284155,14 @@ class DuckDBRepository {
   async deleteMaterialization(id) {
     return this.materializationRepo.deleteById(id);
   }
-  async getIncrementalLedgerEntry(environmentId, connectionName, physicalTableName) {
-    return this.incrementalLedgerRepo.get(environmentId, connectionName, physicalTableName);
+  async getIncrementalLedgerEntry(environmentId, table) {
+    return this.incrementalLedgerRepo.get(environmentId, table);
   }
   async upsertIncrementalLedgerEntry(entry) {
     return this.incrementalLedgerRepo.upsert(entry);
   }
-  async deleteIncrementalLedgerEntry(environmentId, connectionName, physicalTableName) {
-    return this.incrementalLedgerRepo.deleteEntry(environmentId, connectionName, physicalTableName);
+  async deleteIncrementalLedgerEntry(environmentId, table) {
+    return this.incrementalLedgerRepo.deleteEntry(environmentId, table);
   }
 }
 
@@ -282739,6 +284178,7 @@ async function initializeSchema(db, force = false) {
     logger.info("Creating database schema for the first time...");
   }
   await dropPackageKeyedIncrementalLedger(db);
+  await dropStoreBlindIncrementalLedger(db);
   await createDeclaredTables(db);
   if (initialized) {
     await reconcileDeclaredColumns(db);
@@ -282826,10 +284266,34 @@ async function createDeclaredTables(db) {
       derived_strategy VARCHAR NOT NULL,
       physical_table_name VARCHAR NOT NULL,
       connection_name VARCHAR NOT NULL,
+      -- The storage destination the table lives in, or '' when it lives in
+      -- connection_name's own warehouse (the colocated default). Part of the
+      -- table's IDENTITY, not a description of it: a destination and a connection
+      -- are separate namespaces that may share a name, and a source's physical
+      -- name does not change when it moves between them, so without this a
+      -- boundary measured on a stored table is indistinguishable from one
+      -- measured on a colocated table of the same name.
+      --
+      -- In the KEY, because two such tables coexist legitimately. A source
+      -- persisted colocated and another persisted into a destination under the
+      -- same name are two different tables and neither is a misconfiguration —
+      -- the within-package collision check keys on the destination too, so it
+      -- correctly says nothing about the pair. Sharing one row between them makes
+      -- both seed forever: each read matches on the store, finds nothing, and
+      -- overwrites the other's row on the way out. Nothing reports that; it just
+      -- never advances.
+      --
+      -- '' rather than NULL, and that is what makes it keyable. A NULL in the key
+      -- defeats ON CONFLICT (NULL never equals NULL, so two colocated rows both
+      -- insert) and forces every read to compare with IS NOT DISTINCT FROM. The
+      -- sentinel keeps the key a plain equality on every path.
+      storage_destination_name VARCHAR NOT NULL DEFAULT '',
       advanced_by_materialization_id VARCHAR,
       advanced_at TIMESTAMP NOT NULL,
       created_at TIMESTAMP NOT NULL,
-      PRIMARY KEY (environment_id, connection_name, physical_table_name)
+      PRIMARY KEY (
+        environment_id, connection_name, storage_destination_name,
+        physical_table_name)
     )
   `);
   await db.run(`
@@ -282983,6 +284447,19 @@ async function dropPackageKeyedIncrementalLedger(db) {
   logger.info("Re-keying the incremental ledger onto (environment, connection, table); " + "recorded covered_through boundaries are discarded, so each incremental " + "source rebuilds in full once and then resumes advancing by delta");
   await db.run("DROP TABLE IF EXISTS incremental_ledger");
 }
+async function dropStoreBlindIncrementalLedger(db) {
+  const present = await db.all("SELECT name FROM sqlite_master WHERE type='table' AND name='incremental_ledger'");
+  if (!present || present.length === 0) {
+    return;
+  }
+  const columns = await db.all("PRAGMA table_info('incremental_ledger')");
+  const destinationInKey = columns.some((column) => column.name === "storage_destination_name" && Boolean(column.pk));
+  if (destinationInKey) {
+    return;
+  }
+  logger.info("Re-keying the incremental ledger onto (environment, connection, store, " + "table); recorded covered_through boundaries are discarded, so each " + "incremental source rebuilds in full once and then resumes advancing by " + "delta");
+  await db.run("DROP TABLE IF EXISTS incremental_ledger");
+}
 async function createEntityEmbeddingsTable(db) {
   await db.run(`
     CREATE TABLE IF NOT EXISTS entity_embeddings (
@@ -283301,15 +284778,22 @@ init_logger();
 init_utils4();
 init_quoting();
 import { decodeDottedTablePath } from "@malloydata/malloy";
-var INCREMENTAL_DIALECT_ALLOWLIST = new Set([
+var INCREMENTAL_SOURCE_RANGE_DIALECTS = new Set([
   "postgres",
   "snowflake",
   "standardsql"
 ]);
+var INCREMENTAL_TARGET_DML_DIALECTS = new Set([
+  "postgres",
+  "snowflake",
+  "standardsql",
+  "duckdb"
+]);
 var MERGE_CAPABLE_DIALECTS = new Set([
   "postgres",
   "snowflake",
-  "standardsql"
+  "standardsql",
+  "duckdb"
 ]);
 var DIALECT_DISPLAY_NAMES = {
   standardsql: "standardsql (BigQuery)"
@@ -283326,9 +284810,9 @@ function escapeSqlString(value, dialect) {
   return dialect === "snowflake" || dialect === "standardsql" ? quoted.replace(/\\/g, "\\\\") : quoted;
 }
 function secondsPrecision(value) {
-  const match = value.trim().match(/^(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2}:\d{2})/);
+  const match = value.trim().match(/^(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2}:\d{2})(?:\.\d+)?Z?$/);
   if (!match) {
-    throw new Error(`not an ISO-8601 timestamp: ${JSON.stringify(value)} (expected YYYY-MM-DDTHH:MM:SS)`);
+    throw new Error(`not a UTC ISO-8601 timestamp: ${JSON.stringify(value)} (expected YYYY-MM-DDTHH:MM:SS, with no zone offset)`);
   }
   return `${match[1]} ${match[2]}`;
 }
@@ -283407,6 +284891,11 @@ var TABLE_PATH_OPTIONS = {
     quoteChar: "`",
     escapeStyle: "doubled",
     bareIdentRegex: /^[A-Za-z_][A-Za-z0-9_-]*/
+  },
+  duckdb: {
+    quoteChar: '"',
+    escapeStyle: "doubled",
+    bareIdentRegex: /^[A-Za-z_][A-Za-z0-9_$-]*/
   }
 };
 function decodeTablePathSegments(dialect, tablePath) {
@@ -283445,7 +284934,17 @@ async function probeTargetColumns(runner, dialect, physicalTableName) {
     };
   }
   let sql;
-  if (dialect === "postgres" || dialect === "snowflake") {
+  if (dialect === "duckdb") {
+    const table = segments[segments.length - 1];
+    const schema = segments.length >= 3 ? segments[segments.length - 2] : "main";
+    const database = segments[0];
+    sql = `SELECT column_name AS ${probeAlias("column_name", dialect)}
+              FROM duckdb_columns()
+              WHERE database_name = '${escapeSqlString(database, dialect)}'
+                AND schema_name = '${escapeSqlString(schema, dialect)}'
+                AND table_name = '${escapeSqlString(table, dialect)}'
+              ORDER BY column_index`;
+  } else if (dialect === "postgres" || dialect === "snowflake") {
     const table = segments[segments.length - 1];
     const schema = segments.length >= 2 ? `'${escapeSqlString(segments[segments.length - 2], dialect)}'` : "current_schema()";
     const infoSchema = dialect === "snowflake" && segments.length >= 3 ? `${quoteIdentifier(segments[segments.length - 3], dialect)}.information_schema.columns` : "information_schema.columns";
@@ -283601,11 +285100,12 @@ function deltaScript(statements) {
   return statements.map((s) => `${s};`).join(`
 `);
 }
+var SELF_ROLLING_BACK_DIALECTS = new Set;
 async function applyDeltaScript(runner, dialect, statements) {
   try {
     await runner(deltaScript(statements));
   } catch (err) {
-    if (statements.length > 1) {
+    if (statements.length > 1 && !SELF_ROLLING_BACK_DIALECTS.has(dialect)) {
       try {
         await runner(transactionKeywords(dialect).rollback);
       } catch (rollbackErr) {
@@ -283622,6 +285122,12 @@ function ledgerLineageMismatch(entry, lineage) {
       reason: `the recorded boundary belongs to table ` + `"${entry.physicalTableName}", not "${lineage.physicalTableName}" — ` + `either this table was renamed between runs, or another source ` + `shares this source's content address and advanced the boundary ` + `against its own table`
     };
   }
+  if ((entry.storageDestinationName ?? undefined) !== (lineage.storageDestinationName ?? undefined)) {
+    return {
+      reasonCode: "table_renamed",
+      reason: `the recorded boundary belongs to a table in ` + `${entry.storageDestinationName ? `storage destination "${entry.storageDestinationName}"` : "the source warehouse"}` + `, while this refresh writes to ` + `${lineage.storageDestinationName ? `storage destination "${lineage.storageDestinationName}"` : "the source warehouse"}`
+    };
+  }
   const changed = (reason) => ({ reasonCode: "lineage_changed", reason });
   if (entry.sourceEntityId !== lineage.sourceEntityId) {
     return changed(`the source's content address is not the one the recorded boundary was ` + `measured under, so that boundary describes different SQL than this ` + `refresh would apply a delta to — either the model was edited, or ` + `this refresh is instructed through a different version of the ` + `package than the one that advanced the boundary`);
@@ -283644,15 +285150,33 @@ function ledgerLineageMismatch(entry, lineage) {
   }
   return;
 }
-async function resolveDeltaEnd(runner, dialect, lineage, sourceSQL, now) {
+async function resolveDeltaEnd(target, lineage, now) {
   const type = lineage.watermarkType;
   if (type === "date" || type === "timestamp") {
     return { bound: snapshotBound(type, now) };
   }
-  return probeMaxWatermark(runner, dialect, sourceSQL, lineage.watermarkName, type);
+  return target.probeSourceFrontier();
+}
+function warehouseDeltaTarget(params) {
+  const { dialect, runner, lineage, sourceSQL } = params;
+  return {
+    dialect,
+    runner,
+    quotedTablePath: params.quotedTablePath,
+    logicalTablePath: lineage.physicalTableName,
+    deltaRows: async (start, end) => deltaSelect({
+      dialect,
+      sourceSQL,
+      watermarkName: lineage.watermarkName,
+      start,
+      end
+    }),
+    probeSourceFrontier: () => probeMaxWatermark(runner, dialect, sourceSQL, lineage.watermarkName, lineage.watermarkType)
+  };
 }
 async function planIncrementalStep(inputs) {
-  const { runner, dialect, lineage, ledgerEntry } = inputs;
+  const { target, lineage, ledgerEntry } = inputs;
+  const { runner, dialect } = target;
   if (inputs.forceRefresh) {
     return {
       mode: "seed",
@@ -283678,7 +285202,7 @@ async function planIncrementalStep(inputs) {
       reason: `merge_key= needs MERGE, which this Postgres server ` + `(server_version_num ${inputs.postgresVersionNum ?? "unknown"}) ` + `does not have; MERGE requires Postgres 15`
     };
   }
-  const probe = await probeTargetColumns(runner, dialect, lineage.physicalTableName);
+  const probe = await probeTargetColumns(runner, dialect, target.logicalTablePath);
   if (probe.columns.length === 0) {
     return {
       mode: "seed",
@@ -283686,7 +285210,7 @@ async function planIncrementalStep(inputs) {
       reason: `the target table could not be described` + (probe.error ? ` (${probe.error})` : ", so it is treated as absent")
     };
   }
-  const rows = await probeTargetNonEmpty(runner, dialect, inputs.quotedTablePath);
+  const rows = await probeTargetNonEmpty(runner, dialect, target.quotedTablePath);
   if (!rows.nonEmpty) {
     return {
       mode: "seed",
@@ -283698,7 +285222,7 @@ async function planIncrementalStep(inputs) {
     malloyType: ledgerEntry.coveredThroughType,
     value: ledgerEntry.coveredThroughValue
   };
-  const end = await resolveDeltaEnd(runner, dialect, lineage, inputs.sourceSQL, inputs.now);
+  const end = await resolveDeltaEnd(target, lineage, inputs.now);
   if (!end.bound) {
     return {
       mode: "skip",
@@ -283725,14 +285249,8 @@ async function planIncrementalStep(inputs) {
   }
   const statements = deltaStatements({
     dialect,
-    quotedTablePath: inputs.quotedTablePath,
-    deltaSQL: deltaSelect({
-      dialect,
-      sourceSQL: inputs.sourceSQL,
-      watermarkName: lineage.watermarkName,
-      start,
-      end: end.bound
-    }),
+    quotedTablePath: target.quotedTablePath,
+    deltaSQL: await target.deltaRows(start, end.bound),
     columns: inputs.columns,
     mergeKeys: lineage.mergeKeys,
     watermarkName: lineage.watermarkName,
@@ -283814,14 +285332,11 @@ function rejectionsForSource(source) {
   if (!d.incremental)
     return out;
   const dialect = source.dialect ?? "";
-  if (!INCREMENTAL_DIALECT_ALLOWLIST.has(dialect)) {
-    out.push(`${where} declares ${MODE}, which is not supported on dialect ` + `"${dialect || "unknown"}". Incremental refresh applies its delta to ` + `the live serving table, so it is enabled only where the publisher ` + `has proven transactional DML: ` + `${describeDialects(INCREMENTAL_DIALECT_ALLOWLIST)}. Use ` + `refresh="full" here; the supported set widens in a later release.`);
+  if (!INCREMENTAL_SOURCE_RANGE_DIALECTS.has(dialect)) {
+    out.push(`${where} declares ${MODE}, which is not supported on dialect ` + `"${dialect || "unknown"}". Incremental refresh reads a bounded ` + `watermark range out of the source and applies it transactionally, ` + `so it is enabled only where the publisher has proven both: ` + `${describeDialects(INCREMENTAL_SOURCE_RANGE_DIALECTS)}. Use ` + `refresh="full" here; the supported set widens in a later release.`);
   } else if (d.declaredMergeKey && !MERGE_CAPABLE_DIALECTS.has(dialect)) {
     out.push(`${where} declares merge_key=, which needs a MERGE statement that ` + `dialect "${dialect}" does not have. Remove merge_key= to replace ` + `the watermark range instead of merging by row identity.`);
   }
-  if (source.storageDestination) {
-    out.push(`${where} declares ${MODE} together with ` + `storage="${source.storageDestination}". A stored source is ` + `materialized into the storage destination's own engine, while an ` + `incremental delta is applied on the source warehouse — so the two ` + `cannot be combined yet. Drop one: refresh="full" keeps the storage ` + `destination, removing storage= keeps the incremental refresh in the ` + `source warehouse.`);
-  }
   const dangling = unresolved([d.watermark, ...d.mergeKeys]);
   if (dangling.length > 0) {
     out.push(`${where} declares ${quoteList(dangling.map((n) => n.name))} which ` + `${dangling.length === 1 ? "is not" : "are not"} ` + `${dangling.length === 1 ? "a column" : "columns"} of the source's ` + `materialized output. Available: ${quoteList(d.outputColumns)}. Note ` + `that a derived dimension: on a table-backed source is queryable but ` + `NOT materialized, so it cannot be a watermark or merge key.`);
@@ -283892,9 +285407,10 @@ function incrementalPolicyAdvisories(sources) {
       });
     }
     if (d.incremental && d.watermark !== undefined && !d.declaredMergeKey) {
+      const rangeDeleteCost = source.storageDestination ? `(b) the range DELETE rewrites every stored file the range ` + `touches, so a wide range costs more than its row count suggests — ` + `a narrower refresh interval keeps each one small.` : `(b) if the destination table is not partitioned or clustered on ` + `"${d.watermark.name}", the range DELETE may re-read the whole ` + `table on every run.`;
       warnings.push({
         ...at,
-        message: `is ${MODE} with no merge_key=, so each refresh REPLACES the ` + `watermark range it just computed. Two consequences worth ` + `checking: (a) a row that is later restated with an ADVANCED ` + `watermark value appears twice rather than replacing its ` + `predecessor, since the older row sits below the new range — ` + `declare merge_key= with the row's identity dimensions if that ` + `happens; (b) if the destination table is not partitioned or ` + `clustered on "${d.watermark.name}", the range DELETE may re-read ` + `the whole table on every run.`
+        message: `is ${MODE} with no merge_key=, so each refresh REPLACES the ` + `watermark range it just computed. Two consequences worth ` + `checking: (a) a row that is later restated with an ADVANCED ` + `watermark value appears twice rather than replacing its ` + `predecessor, since the older row sits below the new range — ` + `declare merge_key= with the row's identity dimensions if that ` + `happens; ${rangeDeleteCost}`
       });
     }
   }
@@ -287302,7 +288818,11 @@ class EnvironmentStore {
     assertSafeEnvironmentPath(absoluteEnvironmentPath);
     const startedAt = Date.now();
     logger.info(`Detected zip file at "${absoluteEnvironmentPath}". Unzipping...`);
-    const unzippedEnvironmentPath = absoluteEnvironmentPath.replace(".zip", "");
+    const archiveDir = path11.resolve(path11.dirname(absoluteEnvironmentPath));
+    const unzippedEnvironmentPath = path11.resolve(archiveDir, path11.basename(absoluteEnvironmentPath, ".zip"));
+    if (!unzippedEnvironmentPath.startsWith(archiveDir + path11.sep)) {
+      throw new BadRequestError(`Refusing to unzip "${absoluteEnvironmentPath}": target escapes its directory`);
+    }
     await fs9.promises.rm(unzippedEnvironmentPath, {
       recursive: true,
       force: true
@@ -288288,6 +289808,9 @@ class MaterializationController {
     if (entry.mergeKeys !== undefined && (!Array.isArray(entry.mergeKeys) || entry.mergeKeys.some((k) => typeof k !== "string"))) {
       throw new BadRequestError("Ledger entry 'mergeKeys' must be an array of strings");
     }
+    if (entry.storageDestinationName !== undefined && (typeof entry.storageDestinationName !== "string" || entry.storageDestinationName === "")) {
+      throw new BadRequestError("Ledger entry 'storageDestinationName' must be a non-empty string when present");
+    }
     return {
       connectionName: entry.connectionName,
       physicalTableName: entry.physicalTableName,
@@ -288296,7 +289819,8 @@ class MaterializationController {
       watermark: entry.watermark,
       strategy: entry.strategy,
       sourceEntityId: entry.sourceEntityId,
-      ...Array.isArray(entry.mergeKeys) ? { mergeKeys: entry.mergeKeys } : {}
+      ...Array.isArray(entry.mergeKeys) ? { mergeKeys: entry.mergeKeys } : {},
+      ...typeof entry.storageDestinationName === "string" ? { storageDestinationName: entry.storageDestinationName } : {}
     };
   }
   async stopMaterialization(environmentName, packageName, materializationId) {
@@ -296967,13 +298491,21 @@ init_build_plan();
 init_logger();
 init_materialization_metrics();
 init_utils4();
-function ledgerTableKey(connectionName, physicalTableName) {
-  return `${connectionName}\x00${physicalTableName}`;
+function ledgerTableKey(table) {
+  return [
+    table.connectionName,
+    table.storageDestinationName ?? "",
+    table.physicalTableName
+  ].join("\x00");
 }
 function indexCallerLedger(entries) {
   const index = new Map;
   for (const entry of entries) {
-    index.set(ledgerTableKey(entry.connectionName, entry.physicalTableName), {
+    index.set(ledgerTableKey({
+      connectionName: entry.connectionName,
+      storageDestinationName: entry.storageDestinationName,
+      physicalTableName: entry.physicalTableName
+    }), {
       sourceEntityId: entry.sourceEntityId,
       coveredThroughValue: entry.coveredThrough,
       coveredThroughType: entry.coveredThroughType,
@@ -296981,7 +298513,8 @@ function indexCallerLedger(entries) {
       mergeKeyDimensions: entry.mergeKeys ?? [],
       derivedStrategy: entry.strategy,
       physicalTableName: entry.physicalTableName,
-      connectionName: entry.connectionName
+      connectionName: entry.connectionName,
+      storageDestinationName: entry.storageDestinationName
     });
   }
   return index;
@@ -296994,16 +298527,18 @@ function incrementalLineage(params) {
   if (watermark === undefined || watermark.kind !== "dimension" || !d.watermarkOrderable || !isRenderableWatermarkType(watermark.malloyType) || d.strategy === undefined) {
     return;
   }
-  if (!INCREMENTAL_DIALECT_ALLOWLIST.has(params.dialect))
+  if (!INCREMENTAL_SOURCE_RANGE_DIALECTS.has(params.dialect))
     return;
-  if (params.isStorageBuild)
+  if (!INCREMENTAL_TARGET_DML_DIALECTS.has(params.targetDialect)) {
     return;
+  }
   const mergeKeys = d.mergeKeys.filter((k) => k.kind === "dimension").map((k) => k.name);
   if (mergeKeys.length !== d.mergeKeys.length)
     return;
   return {
     physicalTableName: params.physicalTableName,
     connectionName: params.connectionName,
+    storageDestinationName: params.storageDestinationName,
     sourceEntityId: params.sourceEntityId,
     watermarkName: watermark.name,
     watermarkType: watermark.malloyType,
@@ -297012,15 +298547,14 @@ function incrementalLineage(params) {
   };
 }
 async function planSourceRefresh(params) {
-  const { context, lineage } = params;
+  const { context, lineage, target } = params;
   const forceRefresh = context.forceRefresh || params.reseed === true;
-  const dialect = params.persistSource.dialectName;
   let ledgerEntry = null;
   if (context.callerLedger) {
-    ledgerEntry = context.callerLedger.get(ledgerTableKey(lineage.connectionName, lineage.physicalTableName)) ?? null;
+    ledgerEntry = context.callerLedger.get(ledgerTableKey(lineage)) ?? null;
   } else {
     try {
-      ledgerEntry = await context.ledger.getIncrementalLedgerEntry(context.environmentId, lineage.connectionName, lineage.physicalTableName);
+      ledgerEntry = await context.ledger.getIncrementalLedgerEntry(context.environmentId, lineage);
     } catch (err) {
       return {
         mode: "seed",
@@ -297029,18 +298563,15 @@ async function planSourceRefresh(params) {
       };
     }
   }
-  const postgresVersionNum = lineage.strategy === "merge" && dialect === "postgres" && ledgerEntry !== null ? await probePostgresVersion(params.runner) : undefined;
+  const postgresVersionNum = lineage.strategy === "merge" && target.dialect === "postgres" && ledgerEntry !== null ? await probePostgresVersion(target.runner) : undefined;
   let step;
   try {
     step = await planIncrementalStep({
-      runner: params.runner,
-      dialect,
-      quotedTablePath: params.quotedTablePath,
+      target,
       lineage,
       ledgerEntry,
       forceRefresh,
       now: context.now,
-      sourceSQL: params.sourceSQL,
       columns: params.columns,
       postgresVersionNum
     });
@@ -297072,6 +298603,7 @@ async function advanceLedger(params) {
       derivedStrategy: lineage.strategy,
       physicalTableName: lineage.physicalTableName,
       connectionName: lineage.connectionName,
+      storageDestinationName: lineage.storageDestinationName,
       advancedByMaterializationId: context.materializationId
     });
   } catch (err) {
@@ -297087,7 +298619,7 @@ async function resetLedger(context, lineage) {
   if (context.callerLedger)
     return;
   try {
-    await context.ledger.deleteIncrementalLedgerEntry(context.environmentId, lineage.connectionName, lineage.physicalTableName);
+    await context.ledger.deleteIncrementalLedgerEntry(context.environmentId, lineage);
   } catch (err) {
     logger.warn("Failed to clear the covered_through boundary", {
       packageName: context.packageName,
@@ -297115,6 +298647,48 @@ async function advanceLedgerAfterSeed(params) {
   });
   return boundary.bound;
 }
+async function applyIncrementalStep(params) {
+  const { context, lineage, step, target } = params;
+  if (step.mode !== "delta") {
+    reportIncrementalStep({
+      step,
+      sourceName: params.sourceName,
+      packageName: context.packageName,
+      physicalTableName: lineage.physicalTableName
+    });
+  }
+  if (step.mode === "seed")
+    return { applied: false };
+  if (step.mode === "skip") {
+    return {
+      applied: true,
+      coveredThrough: step.coveredThrough,
+      refresh: "none"
+    };
+  }
+  const startTime = performance.now();
+  await applyDeltaScript(target.runner, target.dialect, step.statements);
+  await advanceLedger({
+    context,
+    lineage,
+    coveredThrough: step.coveredThrough
+  });
+  const durationMs = Math.round(performance.now() - startTime);
+  reportDeltaApplied({
+    packageName: context.packageName,
+    sourceName: params.sourceName,
+    physicalTableName: lineage.physicalTableName,
+    rangeStart: step.start.value,
+    rangeEnd: step.end.value,
+    durationMs
+  });
+  return {
+    applied: true,
+    durationMs,
+    coveredThrough: step.coveredThrough,
+    refresh: "delta"
+  };
+}
 function reportIncrementalStep(params) {
   const { step, sourceName, packageName, physicalTableName } = params;
   recordIncrementalStep(step.mode, step.reasonCode);
@@ -297286,6 +298860,7 @@ var PASSTHROUGH_SOURCE_TYPES = [
   "postgres"
 ];
 var STORAGE_DESTINATION_TYPES = ["ducklake", "duckdb"];
+var STORAGE_TARGET_DIALECT = "duckdb";
 function wrapPassthrough(sourceType, handle, innerSQL) {
   const sql = `'${escapeSQL(innerSQL)}'`;
   const h = `'${escapeSQL(handle)}'`;
@@ -297464,7 +299039,9 @@ function createIsolatedBuildSession(sessionName) {
   const workDir = mkdtempSync(path14.join(os4.tmpdir(), "malloy-build-"));
   let session;
   try {
-    session = new DuckDBConnection4(sessionName, ":memory:", workDir);
+    session = new DuckDBConnection4(sessionName, ":memory:", workDir, {
+      rowLimit: Number.MAX_SAFE_INTEGER
+    });
   } catch (err) {
     rmSync(workDir, { recursive: true, force: true });
     throw err;
@@ -297499,6 +299076,9 @@ function createIsolatedBuildSession(sessionName) {
   };
   return { session, dispose };
 }
+async function pinSessionToUTC(session) {
+  await session.runSQL("SET TimeZone='UTC'");
+}
 async function buildSourceIntoStorage(params) {
   const {
     destinationName,
@@ -297518,12 +299098,34 @@ async function buildSourceIntoStorage(params) {
     if (destinationConnection.type === "ducklake") {
       await session.runSQL("SET ducklake_default_data_inlining_row_limit=0");
     }
+    await pinSessionToUTC(session);
     const federated = await federateSourceForPassthrough(session, sourceType, sourceFederationConfig(sourceConnection));
     await tagSnowflakeSession(session, sourceType, federated.handle, queryMetadata);
-    const target = quoteManifestTablePath(`${destinationName}.${physicalTableName}`, "duckdb");
+    const target = quoteManifestTablePath(`${destinationName}.${physicalTableName}`, STORAGE_TARGET_DIALECT);
+    if (params.incremental) {
+      const refreshed = await params.incremental.plan({
+        session,
+        sourceType,
+        handle: federated.handle,
+        quotedTablePath: target
+      });
+      if (refreshed) {
+        return {
+          storageDestinationName: destinationName,
+          schema: await describeTable(session, target),
+          readCost: refreshed.readCost,
+          refresh: refreshed
+        };
+      }
+    }
     const read = await issuePassthroughRead(session, sourceType, federated.handle, buildSQL, queryMetadata);
     const schema = await createTableAndDescribe(session, target, read.selectSQL);
+    const seededThrough = await params.incremental?.afterSeed({
+      session,
+      quotedTablePath: target
+    });
     return {
+      seededThrough,
       storageDestinationName: destinationName,
       schema,
       readCost: read.cost ?? await snowflakeReadCostAfterBuild(session, sourceType, federated.handle, buildSQL, queryMetadata, sourceConnection.snowflakeConnection?.database)
@@ -297550,6 +299152,7 @@ async function buildDownstreamIntoStorage(params) {
     if (destinationConnection.type === "ducklake") {
       await session.runSQL("SET ducklake_default_data_inlining_row_limit=0");
     }
+    await pinSessionToUTC(session);
     const root = "file:///chained-build/";
     const url2 = `${root}m.malloy`;
     const runtime = new Runtime4({
@@ -297578,7 +299181,7 @@ async function buildDownstreamIntoStorage(params) {
       });
     }
     const sql = projectToPublicColumns(downstream, downstream.getSQL({ virtualMap }));
-    const target = quoteManifestTablePath(`${destinationName}.${physicalTableName}`, "duckdb");
+    const target = quoteManifestTablePath(`${destinationName}.${physicalTableName}`, STORAGE_TARGET_DIALECT);
     const schema = await createTableAndDescribe(session, target, sql);
     return {
       storageDestinationName: destinationName,
@@ -297602,7 +299205,7 @@ async function assertStorageServeShapeCompiles(params) {
   await assertServesInDuckDB(sourceName, binding, new FixedConnectionMap3(new Map([[destinationName, sharedGateSession]]), destinationName));
 }
 function dropStorageTableSql(destinationName, physicalTableName) {
-  return `DROP TABLE IF EXISTS ${quoteManifestTablePath(`${destinationName}.${physicalTableName}`, "duckdb")}`;
+  return `DROP TABLE IF EXISTS ${quoteManifestTablePath(`${destinationName}.${physicalTableName}`, STORAGE_TARGET_DIALECT)}`;
 }
 async function dropStorageTable(params) {
   const {
@@ -297632,7 +299235,7 @@ async function attachDestinationReadWrite(session, destinationName, destinationC
   const destinationRoot = storageDestinationRoot(environmentPath);
   mkdirSync2(destinationRoot, { recursive: true });
   const dbPath = path14.join(destinationRoot, `${destinationName}.duckdb`);
-  await session.runSQL(`ATTACH '${escapeSQL(dbPath)}' AS ${quoteIdentifier(destinationName, "duckdb")}`);
+  await session.runSQL(`ATTACH '${escapeSQL(dbPath)}' AS ${quoteIdentifier(destinationName, STORAGE_TARGET_DIALECT)}`);
 }
 function assertSupportedDestination(destinationName, destinationConnection) {
   const type = destinationConnection.type ?? "";
@@ -297678,6 +299281,65 @@ async function describeTable(session, quotedTablePath) {
   return columns;
 }
 
+// src/service/incremental_storage.ts
+init_build_plan();
+init_quoting();
+init_utils4();
+function storageDeltaTarget(params) {
+  const {
+    session,
+    sourceType,
+    handle,
+    destinationName,
+    lineage,
+    persistSource,
+    buildSQL,
+    queryMetadata,
+    quotedTablePath
+  } = params;
+  const sourceDialect = persistSource.dialectName;
+  const logicalTablePath = `${destinationName}.${params.physicalTableName}`;
+  let readCost = null;
+  return {
+    readCost: () => readCost,
+    target: {
+      dialect: STORAGE_TARGET_DIALECT,
+      runner: (sql) => session.runSQL(sql),
+      quotedTablePath,
+      logicalTablePath,
+      deltaRows: async (start, end) => {
+        const bounded = projectToPublicColumns(persistSource, deltaSelect({
+          dialect: sourceDialect,
+          sourceSQL: buildSQL,
+          watermarkName: lineage.watermarkName,
+          start,
+          end
+        }));
+        const read = await issuePassthroughRead(session, sourceType, handle, bounded, queryMetadata);
+        readCost = read.cost;
+        return read.selectSQL;
+      },
+      probeSourceFrontier: async () => {
+        const column = quoteIdentifier(lineage.watermarkName, sourceDialect);
+        const alias = quoteIdentifier("watermark_max", sourceDialect);
+        const inner = `SELECT MAX(${column}) AS ${alias} ` + `FROM (${buildSQL}) AS __w`;
+        try {
+          const result = await session.runSQL(wrapPassthrough(sourceType, handle, inner));
+          const rows = result?.rows ?? [];
+          const raw = rows[0]?.["watermark_max"];
+          if (raw === null || raw === undefined)
+            return {};
+          return {
+            bound: canonicalBoundValue(lineage.watermarkType, raw)
+          };
+        } catch (err) {
+          return { error: errMessage(err) };
+        }
+      }
+    }
+  };
+}
+
 // src/service/materialization_service.ts
 init_connection();
 init_materialization_serve_transform();
@@ -297706,6 +299368,7 @@ function ledgerFields(lineage, bound) {
     ledger: {
       connectionName: lineage.connectionName,
       physicalTableName: lineage.physicalTableName,
+      ...lineage.storageDestinationName ? { storageDestinationName: lineage.storageDestinationName } : {},
       coveredThrough: bound.value,
       coveredThroughType: bound.malloyType,
       watermark: lineage.watermarkName,
@@ -297804,6 +299467,28 @@ var VALID_TRANSITIONS = {
   FAILED: [],
   CANCELLED: []
 };
+function tableKeyOf(connectionName, storageDestinationName, physicalTableName) {
+  return [
+    connectionName,
+    storageDestinationName ?? "",
+    physicalTableName
+  ].join("\x00");
+}
+function reportRetainedStorageTables(retained, packageName) {
+  for (const entry of retained) {
+    recordStorageTableRetained(entry.storageDestinationName ?? "unknown");
+    logger.warn("A failed run left a table in a storage destination and did not reclaim " + "it: the source is refreshed incrementally, so this name may be the " + "one it serves from. Unreferenced if the run was building a fresh " + "generation, in which case reclaiming it needs the destination sweep.", {
+      packageName,
+      sourceName: entry.sourceName,
+      destinationName: entry.storageDestinationName,
+      physicalTableName: entry.physicalTableName,
+      refresh: entry.refresh
+    });
+  }
+}
+function isReclaimableStorageTable(entry) {
+  return !!entry.storageDestinationName && entry.refresh === undefined;
+}
 
 class MaterializationService {
   environmentStore;
@@ -298018,10 +299703,11 @@ class MaterializationService {
         const deltaEligible = incremental !== undefined && incrementalLineage({
           declaration: incremental.declarations[persistSource.sourceID],
           dialect: persistSource.dialectName,
+          targetDialect: destination !== undefined ? STORAGE_TARGET_DIALECT : persistSource.dialectName,
           physicalTableName: logicalName,
           connectionName: persistSource.connectionName,
-          sourceEntityId,
-          isStorageBuild: destination !== undefined
+          storageDestinationName: destination,
+          sourceEntityId
         }) !== undefined;
         const prior = priorEntries[sourceEntityId];
         if (!deltaEligible && prior && prior.physicalTableName && (prior.storageDestinationName ?? undefined) === destination) {
@@ -298174,27 +299860,35 @@ class MaterializationService {
     if (ledger === undefined || ledger.length === 0)
       return;
     const instructed = new Map;
+    const instructedIntoStorage = new Set;
     const byAddress = new Map(Object.values(plan.sources).map((s) => [s.sourceEntityId, s]));
     for (const instruction of instructions) {
       const planSource = (instruction.sourceID ? plan.sources[instruction.sourceID] : undefined) ?? byAddress.get(instruction.sourceEntityId);
       if (!planSource)
         continue;
-      instructed.set(`${planSource.connectionName}\x00${instruction.physicalTableName}`, {
+      instructed.set(tableKeyOf(planSource.connectionName, instruction.destination, instruction.physicalTableName), {
         sourceEntityId: planSource.sourceEntityId,
         refresh: planSource.refresh ?? null,
         reseed: runReseed || instruction.reseed === true
       });
+      if (instruction.destination) {
+        instructedIntoStorage.add(tableKeyOf(planSource.connectionName, undefined, instruction.physicalTableName));
+      }
     }
     const seen = new Set;
     for (const entry of ledger) {
-      const key = `${entry.connectionName}\x00${entry.physicalTableName}`;
-      const table = `'${entry.physicalTableName}' on connection '${entry.connectionName}'`;
+      const key = tableKeyOf(entry.connectionName, entry.storageDestinationName, entry.physicalTableName);
+      const table = `'${entry.physicalTableName}' ` + (entry.storageDestinationName ? `in storage destination '${entry.storageDestinationName}'` : `on connection '${entry.connectionName}'`);
       if (seen.has(key)) {
         throw new BadRequestError(`Ledger entry for table ${table} appears more than once`);
       }
       seen.add(key);
       const target = instructed.get(key);
       if (!target) {
+        const storedHere = instructedIntoStorage.has(tableKeyOf(entry.connectionName, undefined, entry.physicalTableName));
+        if (entry.storageDestinationName === undefined && storedHere) {
+          continue;
+        }
         throw new BadRequestError(`Ledger entry names table ${table}, which this run's ` + `instructions do not build`);
       }
       if (target.reseed)
@@ -298256,6 +299950,7 @@ class MaterializationService {
       entries[sourceEntityId] = entry;
     }
     const builtThisRun = [];
+    const retainedThisRun = [];
     const failures = {};
     const failedReasons = [];
     const builtSources = [];
@@ -298314,8 +300009,11 @@ class MaterializationService {
           }
           builtSources.push(persistSource.name);
           entries[sourceEntityId] = entry;
-          if (entry.storageDestinationName)
+          if (isReclaimableStorageTable(entry)) {
             builtThisRun.push(entry);
+          } else if (entry.storageDestinationName) {
+            retainedThisRun.push(entry);
+          }
         }
       }
       if (builtSources.length === 0 && failedReasons.length > 0) {
@@ -298323,6 +300021,7 @@ class MaterializationService {
       }
     } catch (err) {
       if (owner) {
+        reportRetainedStorageTables(retainedThisRun, owner.packageName);
         await this.reclaimStorageTablesFromFailedRun(builtThisRun, environment, owner);
       }
       throw err;
@@ -298442,17 +300141,29 @@ class MaterializationService {
         connectionDigests
       }) !== buildSQL;
       const publicBuildSQL = projectToPublicColumns(persistSource, buildSQL);
-      return this.buildOneSourceIntoStorage(persistSource, instruction, manifest, environment, publicBuildSQL, builtEntries, dependsOnStorageUpstream, runOptions.queryMetadata);
+      return this.buildOneSourceIntoStorage({
+        persistSource,
+        instruction,
+        manifest,
+        environment,
+        publicBuildSQL,
+        buildSQL,
+        builtEntries,
+        dependsOnStorageUpstream,
+        queryMetadata: runOptions.queryMetadata,
+        incremental,
+        contentSourceEntityId
+      });
     }
     const dialect = persistSource.dialectName;
     const quotedPhysicalPath = quoteTablePath(physicalTableName, dialect);
     const lineage = incremental && contentSourceEntityId ? incrementalLineage({
       declaration: incremental.declarations[persistSource.sourceID],
       dialect,
+      targetDialect: dialect,
       physicalTableName,
       connectionName: persistSource.connectionName,
-      sourceEntityId: contentSourceEntityId,
-      isStorageBuild
+      sourceEntityId: contentSourceEntityId
     }) : undefined;
     const incrementalRefresh = incremental && lineage && contentSourceEntityId ? {
       context: incremental,
@@ -298463,10 +300174,13 @@ class MaterializationService {
         ...incrementalRefresh,
         persistSource,
         instruction,
-        connection,
-        buildSQL,
-        quotedTablePath: quotedPhysicalPath,
-        runOptions,
+        target: warehouseDeltaTarget({
+          dialect,
+          runner: (sql) => connection.runSQL(sql, runOptions),
+          quotedTablePath: quotedPhysicalPath,
+          lineage: incrementalRefresh.lineage,
+          sourceSQL: buildSQL
+        }),
         manifest
       });
       if (applied)
@@ -298529,53 +300243,29 @@ class MaterializationService {
     };
   }
   async refreshOneSourceIncrementally(params) {
-    const { context, lineage, persistSource, instruction } = params;
+    const { context, lineage, persistSource, instruction, target } = params;
     const sourceEntityId = instruction.sourceEntityId;
-    const dialect = persistSource.dialectName;
-    const runner = (sql) => params.connection.runSQL(sql, params.runOptions);
     const step = await planSourceRefresh({
       context,
       lineage,
-      persistSource,
-      quotedTablePath: params.quotedTablePath,
-      sourceSQL: params.buildSQL,
+      target,
       columns: deriveColumns(persistSource).map((c) => String(c.name)),
-      reseed: instruction.reseed,
-      runner
+      reseed: instruction.reseed
     });
-    if (step.mode !== "delta") {
-      reportIncrementalStep({
-        step,
-        sourceName: persistSource.name,
-        packageName: context.packageName,
-        physicalTableName: lineage.physicalTableName
-      });
-    }
-    if (step.mode === "seed")
+    const outcome = await applyIncrementalStep({
+      context,
+      lineage,
+      step,
+      target,
+      sourceName: persistSource.name
+    });
+    if (!outcome.applied)
       return;
-    const startTime = performance.now();
-    let appliedDurationMs;
-    if (step.mode === "delta") {
-      await applyDeltaScript(runner, dialect, step.statements);
-      await advanceLedger({
-        context,
-        lineage,
-        coveredThrough: step.coveredThrough
-      });
-      const durationMs = Math.round(performance.now() - startTime);
-      appliedDurationMs = durationMs;
-      recordSourceBuildDuration(durationMs, "delta");
-      reportDeltaApplied({
-        packageName: context.packageName,
-        sourceName: persistSource.name,
-        physicalTableName: lineage.physicalTableName,
-        rangeStart: step.start.value,
-        rangeEnd: step.end.value,
-        durationMs
-      });
+    if (outcome.durationMs !== undefined) {
+      recordSourceBuildDuration(outcome.durationMs, "delta");
     }
     params.manifest.update(sourceEntityId, {
-      tableName: params.quotedTablePath
+      tableName: target.quotedTablePath
     });
     return {
       sourceEntityId,
@@ -298585,18 +300275,61 @@ class MaterializationService {
       connectionName: persistSource.connectionName,
       realization: instruction.realization,
       rowCount: null,
-      buildDurationMs: appliedDurationMs ?? null,
+      buildDurationMs: outcome.durationMs ?? null,
       queryCostBytes: null,
-      ...ledgerFields(lineage, step.coveredThrough),
-      ...refreshFields(step.mode === "delta" ? "delta" : "none")
+      ...ledgerFields(lineage, outcome.coveredThrough),
+      ...refreshFields(outcome.refresh)
     };
   }
-  async buildOneSourceIntoStorage(persistSource, instruction, manifest, environment, buildSQL, builtEntries, dependsOnStorageUpstream, queryMetadata) {
+  async buildOneSourceIntoStorage(params) {
+    const {
+      persistSource,
+      instruction,
+      manifest,
+      environment,
+      builtEntries,
+      dependsOnStorageUpstream,
+      queryMetadata,
+      incremental
+    } = params;
     const sourceEntityId = instruction.sourceEntityId;
     const physicalTableName = instruction.physicalTableName;
     const destinationName = instruction.destination;
     const sourceConnection = environment.getApiConnection(persistSource.connectionName);
     const destinationConnection = environment.getStorageDestination(destinationName);
+    const lineage = incremental && params.contentSourceEntityId ? incrementalLineage({
+      declaration: incremental.declarations[persistSource.sourceID],
+      dialect: persistSource.dialectName,
+      targetDialect: STORAGE_TARGET_DIALECT,
+      physicalTableName,
+      connectionName: persistSource.connectionName,
+      storageDestinationName: destinationName,
+      sourceEntityId: params.contentSourceEntityId
+    }) : undefined;
+    const chainedSeed = lineage !== undefined && dependsOnStorageUpstream;
+    if (chainedSeed && lineage) {
+      reportIncrementalStep({
+        step: {
+          mode: "seed",
+          reasonCode: "chained_storage",
+          reason: `the source reads a storage-materialized upstream, and a delta ` + `over a stored parent is not supported yet`
+        },
+        sourceName: persistSource.name,
+        packageName: incremental.packageName,
+        physicalTableName
+      });
+      await resetLedger(incremental, lineage);
+    }
+    const refresh = incremental && lineage && !chainedSeed ? this.storageRefreshFor({
+      context: incremental,
+      lineage,
+      persistSource,
+      instruction,
+      destinationName,
+      physicalTableName,
+      buildSQL: params.buildSQL,
+      queryMetadata
+    }) : undefined;
     const startTime = performance.now();
     let result;
     if (dependsOnStorageUpstream) {
@@ -298629,10 +300362,11 @@ class MaterializationService {
           destinationName,
           destinationConnection,
           sourceConnection,
-          buildSQL,
+          buildSQL: params.publicBuildSQL,
           physicalTableName,
           environmentPath: environment.getEnvironmentPath(),
-          queryMetadata
+          queryMetadata,
+          incremental: refresh
         });
       } catch (err) {
         const safeDetail = redactConnectionSecrets(errMessage(err), sourceConnection, destinationConnection);
@@ -298657,6 +300391,8 @@ class MaterializationService {
         schema: result.schema
       });
     } catch (gateErr) {
+      if (result.refresh)
+        throw gateErr;
       try {
         await dropStorageTable({
           destinationName,
@@ -298676,12 +300412,17 @@ class MaterializationService {
     }
     manifest.update(sourceEntityId, { tableName: physicalTableName });
     const durationMs = Math.round(performance.now() - startTime);
-    recordSourceBuildDuration(durationMs, "storage");
-    logger.info(`Built materialized source ${persistSource.name} into storage`, {
+    if (result.refresh?.refresh === "delta") {
+      recordSourceBuildDuration(durationMs, "delta_storage");
+    } else if (!result.refresh) {
+      recordSourceBuildDuration(durationMs, "storage");
+    }
+    logger.info(result.refresh ? `Refreshed materialized source ${persistSource.name} in storage` : `Built materialized source ${persistSource.name} into storage`, {
       physicalTableName,
       storageDestinationName: result.storageDestinationName,
       columns: result.schema.length,
       durationMs,
+      refresh: result.refresh?.refresh,
       readCost: result.readCost
     });
     return {
@@ -298694,10 +300435,62 @@ class MaterializationService {
       schema: result.schema,
       realization: instruction.realization,
       rowCount: null,
-      buildDurationMs: durationMs,
+      buildDurationMs: result.refresh ? result.refresh.durationMs ?? null : durationMs,
+      ...ledgerFields(lineage, result.refresh?.coveredThrough ?? result.seededThrough),
+      ...refreshFields(result.refresh?.refresh ?? (lineage ? "full" : undefined)),
       queryCostBytes: result.readCost?.bytesScanned ?? null
     };
   }
+  storageRefreshFor(params) {
+    const { context, lineage, persistSource, instruction } = params;
+    return {
+      plan: async ({ session, sourceType, handle, quotedTablePath }) => {
+        const { target, readCost } = storageDeltaTarget({
+          session,
+          sourceType,
+          handle,
+          destinationName: params.destinationName,
+          physicalTableName: params.physicalTableName,
+          quotedTablePath,
+          lineage,
+          persistSource,
+          buildSQL: params.buildSQL,
+          queryMetadata: params.queryMetadata
+        });
+        const step = await planSourceRefresh({
+          context,
+          lineage,
+          target,
+          columns: deriveColumns(persistSource).map((c) => String(c.name)),
+          reseed: instruction.reseed
+        });
+        const outcome = await applyIncrementalStep({
+          context,
+          lineage,
+          step,
+          target,
+          sourceName: persistSource.name
+        });
+        if (!outcome.applied) {
+          await resetLedger(context, lineage);
+          return;
+        }
+        return {
+          durationMs: outcome.durationMs,
+          coveredThrough: outcome.coveredThrough,
+          refresh: outcome.refresh ?? "none",
+          readCost: readCost()
+        };
+      },
+      afterSeed: ({ session, quotedTablePath }) => advanceLedgerAfterSeed({
+        context,
+        lineage,
+        quotedTablePath,
+        dialect: STORAGE_TARGET_DIALECT,
+        runner: (sql) => session.runSQL(sql)
+      })
+    };
+  }
   async buildDownstreamViaParents(persistSource, destinationName, destinationConnection, builtEntries, environment, physicalTableName) {
     const upstreams = deriveServeBindings(builtEntries).filter((b) => b.destinationName === destinationName);
     if (upstreams.length === 0) {
@@ -299236,6 +301029,724 @@ function classifySpaFallback(requestPath, apiPrefix) {
   };
 }
 
+// ../../node_modules/express-rate-limit/dist/index.mjs
+var import_ip_address = __toESM(require_ip_address(), 1);
+var import_debug2 = __toESM(require_src5(), 1);
+import { isIPv6 } from "node:net";
+import { isIPv6 as isIPv62 } from "node:net";
+import { Buffer as Buffer3 } from "node:buffer";
+import { createHash as createHash4 } from "node:crypto";
+import { isIP } from "node:net";
+var ipv4CompatibleSubnet = new import_ip_address.Address6("::/96");
+function ipKeyGenerator(ip, ipv6Subnet = 56) {
+  if (isIPv6(ip)) {
+    const address = new import_ip_address.Address6(ip);
+    if (address.isMapped4() || address.is4() && address.isInSubnet(ipv4CompatibleSubnet))
+      return address.to4().correctForm();
+    if (ipv6Subnet) {
+      const subnet = new import_ip_address.Address6(`${ip}/${ipv6Subnet}`);
+      return subnet.networkForm();
+    }
+  }
+  return ip;
+}
+var MemoryStore = class {
+  constructor(validations2) {
+    this.validations = validations2;
+    this.previous = /* @__PURE__ */ new Map;
+    this.current = /* @__PURE__ */ new Map;
+    this.localKeys = true;
+  }
+  init(options) {
+    this.windowMs = options.windowMs;
+    this.validations?.windowMs(this.windowMs);
+    if (this.interval)
+      clearInterval(this.interval);
+    this.interval = setInterval(() => {
+      this.clearExpired();
+    }, this.windowMs);
+    this.interval.unref?.();
+  }
+  async get(key) {
+    return this.current.get(key) ?? this.previous.get(key);
+  }
+  async increment(key) {
+    const client = this.getClient(key);
+    const now = Date.now();
+    if (client.resetTime.getTime() <= now) {
+      this.resetClient(client, now);
+    }
+    client.totalHits++;
+    return client;
+  }
+  async decrement(key) {
+    const client = this.getClient(key);
+    if (client.totalHits > 0)
+      client.totalHits--;
+  }
+  async resetKey(key) {
+    this.current.delete(key);
+    this.previous.delete(key);
+  }
+  async resetAll() {
+    this.current.clear();
+    this.previous.clear();
+  }
+  shutdown() {
+    clearInterval(this.interval);
+    this.resetAll();
+  }
+  resetClient(client, now = Date.now()) {
+    client.totalHits = 0;
+    client.resetTime.setTime(now + this.windowMs);
+    return client;
+  }
+  getClient(key) {
+    if (this.current.has(key))
+      return this.current.get(key);
+    let client;
+    if (this.previous.has(key)) {
+      client = this.previous.get(key);
+      this.previous.delete(key);
+    } else {
+      client = { totalHits: 0, resetTime: /* @__PURE__ */ new Date };
+      this.resetClient(client);
+    }
+    this.current.set(key, client);
+    return client;
+  }
+  clearExpired() {
+    this.previous = this.current;
+    this.current = /* @__PURE__ */ new Map;
+  }
+};
+var ConsoleLogger = {
+  warn(...args) {
+    console.warn(...args.reverse());
+  },
+  error(...args) {
+    console.error(...args.reverse());
+  }
+};
+var SUPPORTED_DRAFT_VERSIONS = [
+  "draft-6",
+  "draft-7",
+  "draft-8"
+];
+var getResetSeconds = (windowMs, resetTime) => {
+  let resetSeconds;
+  if (resetTime) {
+    const deltaSeconds = Math.ceil((resetTime.getTime() - Date.now()) / 1000);
+    resetSeconds = Math.max(0, deltaSeconds);
+  } else {
+    resetSeconds = Math.ceil(windowMs / 1000);
+  }
+  return resetSeconds;
+};
+var getPartitionKey = (key) => {
+  const hash = createHash4("sha256");
+  hash.update(key);
+  const partitionKey = hash.digest("hex").slice(0, 12);
+  return Buffer3.from(partitionKey).toString("base64");
+};
+var setLegacyHeaders = (response, info) => {
+  if (response.headersSent)
+    return;
+  response.setHeader("X-RateLimit-Limit", info.limit.toString());
+  response.setHeader("X-RateLimit-Remaining", info.remaining.toString());
+  if (info.resetTime instanceof Date) {
+    response.setHeader("Date", (/* @__PURE__ */ new Date()).toUTCString());
+    response.setHeader("X-RateLimit-Reset", Math.ceil(info.resetTime.getTime() / 1000).toString());
+  }
+};
+var setDraft6Headers = (response, info, windowMs) => {
+  if (response.headersSent)
+    return;
+  const windowSeconds = Math.ceil(windowMs / 1000);
+  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  response.setHeader("RateLimit-Policy", `${info.limit};w=${windowSeconds}`);
+  response.setHeader("RateLimit-Limit", info.limit.toString());
+  response.setHeader("RateLimit-Remaining", info.remaining.toString());
+  if (typeof resetSeconds === "number")
+    response.setHeader("RateLimit-Reset", resetSeconds.toString());
+};
+var setDraft7Headers = (response, info, windowMs) => {
+  if (response.headersSent)
+    return;
+  const windowSeconds = Math.ceil(windowMs / 1000);
+  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  response.setHeader("RateLimit-Policy", `${info.limit};w=${windowSeconds}`);
+  response.setHeader("RateLimit", `limit=${info.limit}, remaining=${info.remaining}, reset=${resetSeconds}`);
+};
+var setDraft8Headers = (response, info, windowMs, name, key) => {
+  if (response.headersSent)
+    return;
+  const windowSeconds = Math.ceil(windowMs / 1000);
+  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const partitionKey = getPartitionKey(key);
+  const header = `r=${info.remaining}; t=${resetSeconds}`;
+  const policy = `q=${info.limit}; w=${windowSeconds}; pk=:${partitionKey}:`;
+  response.append("RateLimit", `"${name}"; ${header}`);
+  response.append("RateLimit-Policy", `"${name}"; ${policy}`);
+};
+var setRetryAfterHeader = (response, info, windowMs) => {
+  if (response.headersSent)
+    return;
+  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  response.setHeader("Retry-After", resetSeconds.toString());
+};
+var omitUndefinedProperties = (passedOptions) => {
+  const omittedOptions = {};
+  for (const k of Object.keys(passedOptions)) {
+    const key = k;
+    if (passedOptions[key] !== undefined) {
+      omittedOptions[key] = passedOptions[key];
+    }
+  }
+  return omittedOptions;
+};
+var ValidationError = class extends Error {
+  constructor(code, message) {
+    const url2 = `https://express-rate-limit.github.io/${code}/`;
+    super(`${message} See ${url2} for more information.`);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.help = url2;
+  }
+};
+var ChangeWarning = class extends ValidationError {
+};
+var usedStores = /* @__PURE__ */ new Set;
+var singleCountKeys = /* @__PURE__ */ new WeakMap;
+var validations = {
+  enabled: {
+    default: true
+  },
+  disable() {
+    for (const k of Object.keys(this.enabled))
+      this.enabled[k] = false;
+  },
+  ip(ip) {
+    if (ip === undefined) {
+      throw new ValidationError("ERR_ERL_UNDEFINED_IP_ADDRESS", `An undefined 'request.ip' was detected. This might indicate a misconfiguration or the connection being destroyed prematurely.`);
+    }
+    if (!isIP(ip)) {
+      throw new ValidationError("ERR_ERL_INVALID_IP_ADDRESS", `An invalid 'request.ip' (${ip}) was detected. Consider passing a custom 'keyGenerator' function to the rate limiter.`);
+    }
+  },
+  trustProxy(request) {
+    if (request.app.get("trust proxy") === true) {
+      throw new ValidationError("ERR_ERL_PERMISSIVE_TRUST_PROXY", `The Express 'trust proxy' setting is true, which allows anyone to trivially bypass IP-based rate limiting.`);
+    }
+  },
+  xForwardedForHeader(request) {
+    if (request.headers["x-forwarded-for"] && request.app.get("trust proxy") === false) {
+      throw new ValidationError("ERR_ERL_UNEXPECTED_X_FORWARDED_FOR", `The 'X-Forwarded-For' header is set but the Express 'trust proxy' setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users.`);
+    }
+  },
+  forwardedHeader(request) {
+    if (request.headers.forwarded && request.ip === request.socket?.remoteAddress) {
+      throw new ValidationError("ERR_ERL_FORWARDED_HEADER", `The 'Forwarded' header (standardized X-Forwarded-For) is set but currently being ignored. Add a custom keyGenerator to use a value from this header.`);
+    }
+  },
+  positiveHits(hits) {
+    if (typeof hits !== "number" || hits < 1 || hits !== Math.round(hits)) {
+      throw new ValidationError("ERR_ERL_INVALID_HITS", `The totalHits value returned from the store must be a positive integer, got ${hits}`);
+    }
+  },
+  unsharedStore(store) {
+    if (usedStores.has(store)) {
+      const maybeUniquePrefix = store?.localKeys ? "" : " (with a unique prefix)";
+      throw new ValidationError("ERR_ERL_STORE_REUSE", `A Store instance must not be shared across multiple rate limiters. Create a new instance of ${store.constructor.name}${maybeUniquePrefix} for each limiter instead.`);
+    }
+    usedStores.add(store);
+  },
+  singleCount(request, store, key) {
+    let storeKeys = singleCountKeys.get(request);
+    if (!storeKeys) {
+      storeKeys = /* @__PURE__ */ new Map;
+      singleCountKeys.set(request, storeKeys);
+    }
+    const storeKey = store.localKeys ? store : store.constructor.name;
+    let keys = storeKeys.get(storeKey);
+    if (!keys) {
+      keys = [];
+      storeKeys.set(storeKey, keys);
+    }
+    const prefixedKey = `${store.prefix ?? ""}${key}`;
+    if (keys.includes(prefixedKey)) {
+      throw new ValidationError("ERR_ERL_DOUBLE_COUNT", `The hit count for ${key} was incremented more than once for a single request.`);
+    }
+    keys.push(prefixedKey);
+  },
+  limit(limit) {
+    if (limit === 0) {
+      throw new ChangeWarning("WRN_ERL_MAX_ZERO", "Setting limit or max to 0 disables rate limiting in express-rate-limit v6 and older, but will cause all requests to be blocked in v7");
+    }
+  },
+  draftPolliHeaders(draft_polli_ratelimit_headers) {
+    if (draft_polli_ratelimit_headers) {
+      throw new ChangeWarning("WRN_ERL_DEPRECATED_DRAFT_POLLI_HEADERS", `The draft_polli_ratelimit_headers configuration option is deprecated and has been removed in express-rate-limit v7, please set standardHeaders: 'draft-6' instead.`);
+    }
+  },
+  onLimitReached(onLimitReached) {
+    if (onLimitReached) {
+      throw new ChangeWarning("WRN_ERL_DEPRECATED_ON_LIMIT_REACHED", "The onLimitReached configuration option is deprecated and has been removed in express-rate-limit v7.");
+    }
+  },
+  headersDraftVersion(version) {
+    if (typeof version !== "string" || !SUPPORTED_DRAFT_VERSIONS.includes(version)) {
+      const versionString = SUPPORTED_DRAFT_VERSIONS.join(", ");
+      throw new ValidationError("ERR_ERL_HEADERS_UNSUPPORTED_DRAFT_VERSION", `standardHeaders: only the following versions of the IETF draft specification are supported: ${versionString}.`);
+    }
+  },
+  headersResetTime(resetTime) {
+    if (!resetTime) {
+      throw new ValidationError("ERR_ERL_HEADERS_NO_RESET", `standardHeaders:  'draft-7' requires a 'resetTime', but the store did not provide one. The 'windowMs' value will be used instead, which may cause clients to wait longer than necessary.`);
+    }
+  },
+  knownOptions(passedOptions) {
+    if (!passedOptions)
+      return;
+    const optionsMap = {
+      windowMs: true,
+      limit: true,
+      message: true,
+      statusCode: true,
+      legacyHeaders: true,
+      standardHeaders: true,
+      identifier: true,
+      requestPropertyName: true,
+      skipFailedRequests: true,
+      skipSuccessfulRequests: true,
+      keyGenerator: true,
+      ipv6Subnet: true,
+      handler: true,
+      skip: true,
+      requestWasSuccessful: true,
+      store: true,
+      validate: true,
+      headers: true,
+      max: true,
+      passOnStoreError: true,
+      logger: true
+    };
+    const validOptions = Object.keys(optionsMap).concat("draft_polli_ratelimit_headers", "delayAfter", "delayMs", "maxDelayMs");
+    for (const key of Object.keys(passedOptions)) {
+      if (!validOptions.includes(key)) {
+        throw new ValidationError("ERR_ERL_UNKNOWN_OPTION", `Unexpected configuration option: ${key}`);
+      }
+    }
+  },
+  validationsConfig() {
+    const supportedValidations = Object.keys(this).filter((k) => !["enabled", "disable"].includes(k));
+    supportedValidations.push("default");
+    for (const key of Object.keys(this.enabled)) {
+      if (!supportedValidations.includes(key)) {
+        throw new ValidationError("ERR_ERL_UNKNOWN_VALIDATION", `options.validate.${key} is not recognized. Supported validate options are: ${supportedValidations.join(", ")}.`);
+      }
+    }
+  },
+  creationStack(store) {
+    const { stack } = new Error("express-rate-limit validation check (set options.validate.creationStack=false to disable)");
+    if (stack?.includes("Layer.handle [as handle_request]") || stack?.includes("Layer.handleRequest")) {
+      if (!store.localKeys) {
+        throw new ValidationError("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should *usually* be created at app initialization, not when responding to a request.");
+      }
+      throw new ValidationError("ERR_ERL_CREATED_IN_REQUEST_HANDLER", "express-rate-limit instance should be created at app initialization, not when responding to a request.");
+    }
+  },
+  ipv6Subnet(ipv6Subnet) {
+    if (ipv6Subnet === false) {
+      return;
+    }
+    if (!Number.isInteger(ipv6Subnet) || ipv6Subnet < 32 || ipv6Subnet > 64) {
+      throw new ValidationError("ERR_ERL_IPV6_SUBNET", `Unexpected ipv6Subnet value: ${ipv6Subnet}. Expected an integer between 32 and 64 (usually 48-64).`);
+    }
+  },
+  ipv6SubnetOrKeyGenerator(options) {
+    if (options.ipv6Subnet !== undefined && options.keyGenerator) {
+      throw new ValidationError("ERR_ERL_IPV6SUBNET_OR_KEYGENERATOR", `Incompatible options: the 'ipv6Subnet' option is ignored when a custom 'keyGenerator' function is also set.`);
+    }
+  },
+  keyGeneratorIpFallback(keyGenerator) {
+    if (!keyGenerator) {
+      return;
+    }
+    const src = keyGenerator.toString();
+    if ((src.includes("req.ip") || src.includes("request.ip")) && !src.includes("ipKeyGenerator")) {
+      throw new ValidationError("ERR_ERL_KEY_GEN_IPV6", "Custom keyGenerator appears to use request IP without calling the ipKeyGenerator helper function for IPv6 addresses. This could allow IPv6 users to bypass limits.");
+    }
+  },
+  windowMs(windowMs) {
+    const SET_TIMEOUT_MAX = 2 ** 31 - 1;
+    if (typeof windowMs !== "number" || Number.isNaN(windowMs) || windowMs < 1 || windowMs > SET_TIMEOUT_MAX) {
+      throw new ValidationError("ERR_ERL_WINDOW_MS", `Invalid windowMs value: ${windowMs}${typeof windowMs !== "number" ? ` (${typeof windowMs})` : ""}, must be a number between 1 and ${SET_TIMEOUT_MAX} when using the default MemoryStore`);
+    }
+  }
+};
+function validateLogger(logger2) {
+  if (typeof logger2 !== "object" || typeof logger2.error !== "function" || typeof logger2.warn !== "function") {
+    throw new TypeError("Provided logger does not implement the Logger interface");
+  }
+}
+var getValidations = (_enabled, logger2) => {
+  validateLogger(logger2);
+  let enabled;
+  if (typeof _enabled === "boolean") {
+    enabled = {
+      default: _enabled
+    };
+  } else {
+    enabled = {
+      default: true,
+      ..._enabled
+    };
+  }
+  const wrappedValidations = { enabled };
+  for (const [name, validation] of Object.entries(validations)) {
+    if (typeof validation === "function")
+      wrappedValidations[name] = (...args) => {
+        if (!(enabled[name] ?? enabled.default)) {
+          return;
+        }
+        enabled[name] = false;
+        try {
+          validation.apply(wrappedValidations, args);
+        } catch (error) {
+          if (error instanceof ChangeWarning)
+            logger2.warn(error);
+          else
+            logger2.error(error);
+        }
+      };
+  }
+  const inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+  if (inspect)
+    wrappedValidations[inspect] = () => wrappedValidations.enabled;
+  return wrappedValidations;
+};
+var isLegacyStore = (store) => typeof store.incr === "function" && typeof store.increment !== "function";
+var promisifyStore = (passedStore) => {
+  if (!isLegacyStore(passedStore)) {
+    return passedStore;
+  }
+  const legacyStore = passedStore;
+
+  class PromisifiedStore {
+    async increment(key) {
+      return new Promise((resolve6, reject) => {
+        legacyStore.incr(key, (error, totalHits, resetTime) => {
+          if (error)
+            reject(error);
+          resolve6({ totalHits, resetTime });
+        });
+      });
+    }
+    async decrement(key) {
+      return legacyStore.decrement(key);
+    }
+    async resetKey(key) {
+      return legacyStore.resetKey(key);
+    }
+    async resetAll() {
+      if (typeof legacyStore.resetAll === "function")
+        return legacyStore.resetAll();
+    }
+  }
+  return new PromisifiedStore;
+};
+var getOptionsFromConfig = (config) => {
+  const { validations: validations2, ...directlyPassableEntries } = config;
+  return {
+    ...directlyPassableEntries,
+    validate: validations2.enabled
+  };
+};
+var parseOptions = (passedOptions) => {
+  const notUndefinedOptions = omitUndefinedProperties(passedOptions);
+  const logger2 = passedOptions.logger ?? ConsoleLogger;
+  const validations2 = getValidations(notUndefinedOptions?.validate ?? true, logger2);
+  validations2.validationsConfig();
+  validations2.knownOptions(passedOptions);
+  validations2.draftPolliHeaders(notUndefinedOptions.draft_polli_ratelimit_headers);
+  validations2.onLimitReached(notUndefinedOptions.onLimitReached);
+  if (notUndefinedOptions.ipv6Subnet !== undefined && typeof notUndefinedOptions.ipv6Subnet !== "function") {
+    validations2.ipv6Subnet(notUndefinedOptions.ipv6Subnet);
+  }
+  validations2.keyGeneratorIpFallback(notUndefinedOptions.keyGenerator);
+  validations2.ipv6SubnetOrKeyGenerator(notUndefinedOptions);
+  let standardHeaders = notUndefinedOptions.standardHeaders ?? false;
+  if (standardHeaders === true)
+    standardHeaders = "draft-6";
+  const config = {
+    windowMs: 60 * 1000,
+    limit: passedOptions.max ?? 5,
+    message: "Too many requests, please try again later.",
+    statusCode: 429,
+    legacyHeaders: passedOptions.headers ?? true,
+    identifier(request, _response) {
+      let duration = "";
+      const property = config.requestPropertyName;
+      const { limit } = request[property];
+      const seconds = config.windowMs / 1000;
+      const minutes = config.windowMs / (1000 * 60);
+      const hours = config.windowMs / (1000 * 60 * 60);
+      const days = config.windowMs / (1000 * 60 * 60 * 24);
+      if (seconds < 60)
+        duration = `${seconds}sec`;
+      else if (minutes < 60)
+        duration = `${minutes}min`;
+      else if (hours < 24)
+        duration = `${hours}hr${hours > 1 ? "s" : ""}`;
+      else
+        duration = `${days}day${days > 1 ? "s" : ""}`;
+      return `${limit}-in-${duration}`;
+    },
+    requestPropertyName: "rateLimit",
+    skipFailedRequests: false,
+    skipSuccessfulRequests: false,
+    requestWasSuccessful: (_request, response) => response.statusCode < 400,
+    skip: (_request, _response) => false,
+    async keyGenerator(request, response) {
+      validations2.ip(request.ip);
+      validations2.trustProxy(request);
+      validations2.xForwardedForHeader(request);
+      validations2.forwardedHeader(request);
+      const ip = request.ip;
+      let subnet = 56;
+      if (isIPv62(ip)) {
+        subnet = typeof config.ipv6Subnet === "function" ? await config.ipv6Subnet(request, response) : config.ipv6Subnet;
+        if (typeof config.ipv6Subnet === "function")
+          validations2.ipv6Subnet(subnet);
+      }
+      return ipKeyGenerator(ip, subnet);
+    },
+    ipv6Subnet: 56,
+    async handler(request, response, _next, _optionsUsed) {
+      response.status(config.statusCode);
+      const message = typeof config.message === "function" ? await config.message(request, response) : config.message;
+      if (!response.writableEnded)
+        response.send(message);
+    },
+    passOnStoreError: false,
+    ...notUndefinedOptions,
+    standardHeaders,
+    store: promisifyStore(notUndefinedOptions.store ?? new MemoryStore(validations2)),
+    validations: validations2,
+    logger: logger2
+  };
+  if (typeof config.store.increment !== "function" || typeof config.store.decrement !== "function" || typeof config.store.resetKey !== "function" || config.store.resetAll !== undefined && typeof config.store.resetAll !== "function" || config.store.init !== undefined && typeof config.store.init !== "function") {
+    throw new TypeError("An invalid store was passed. Please ensure that the store is a class that implements the `Store` interface.");
+  }
+  return config;
+};
+var handleAsyncErrors = (fn) => async (request, response, next) => {
+  try {
+    await Promise.resolve(fn(request, response, next)).catch(next);
+  } catch (error) {
+    next(error);
+  }
+};
+var rateLimit = (passedOptions) => {
+  const config = parseOptions(passedOptions ?? {});
+  const options = getOptionsFromConfig(config);
+  const debug2 = import_debug2.default("express-rate-limit");
+  debug2("creating new rate limiter with %o", config.store.constructor.name);
+  for (const [key, val] of Object.entries(config))
+    debug2("set %s to %o", key, val);
+  config.validations.creationStack(config.store);
+  config.validations.unsharedStore(config.store);
+  if (typeof config.store.init === "function") {
+    debug2("executing init for store");
+    try {
+      const storeInit = config.store.init(options);
+      if (storeInit instanceof Promise) {
+        storeInit.catch((error) => config.logger.error(error, "express-rate-limit: async error during store initialization."));
+      }
+    } catch (error) {
+      config.logger.error(error, "express-rate-limit: error during store initialization.");
+    }
+  }
+  const middleware = handleAsyncErrors(async (request, response, next) => {
+    const closePromise = config.skipFailedRequests && new Promise((resolve6) => response.once("close", resolve6));
+    const finishPromise = (config.skipFailedRequests || config.skipSuccessfulRequests) && new Promise((resolve6) => response.once("finish", resolve6));
+    const errorPromise = config.skipFailedRequests && new Promise((resolve6) => response.once("error", resolve6));
+    debug2("requested %o", request.originalUrl);
+    debug2("request from ip %o", request.ip);
+    const skip = await config.skip(request, response);
+    if (skip) {
+      debug2("skipping request");
+      next();
+      return;
+    }
+    const augmentedRequest = request;
+    const key = await config.keyGenerator(request, response);
+    debug2("computed key %o", key);
+    debug2("incrementing count");
+    let totalHits = 0;
+    let resetTime;
+    try {
+      const incrementResult = await config.store.increment(key);
+      totalHits = incrementResult.totalHits;
+      resetTime = incrementResult.resetTime;
+    } catch (error) {
+      if (config.passOnStoreError) {
+        config.logger.error(error, "express-rate-limit: error from store, allowing request without rate-limiting.");
+        next();
+        return;
+      }
+      throw error;
+    }
+    config.validations.positiveHits(totalHits);
+    config.validations.singleCount(request, config.store, key);
+    const retrieveLimit = typeof config.limit === "function" ? config.limit(request, response) : config.limit;
+    const limit = await retrieveLimit;
+    config.validations.limit(limit);
+    const info = {
+      limit,
+      used: totalHits,
+      remaining: Math.max(limit - totalHits, 0),
+      resetTime,
+      key
+    };
+    for (const [key2, val] of Object.entries(info))
+      debug2("set request.%s.%s to be %o", config.requestPropertyName, key2, val);
+    Object.defineProperty(info, "current", {
+      configurable: false,
+      enumerable: false,
+      value: totalHits
+    });
+    augmentedRequest[config.requestPropertyName] = info;
+    if (config.legacyHeaders && !response.headersSent) {
+      debug2("set legacy headers");
+      setLegacyHeaders(response, info);
+    }
+    if (config.standardHeaders && !response.headersSent) {
+      switch (config.standardHeaders) {
+        case "draft-6": {
+          debug2("set ietf draft 6 headers");
+          setDraft6Headers(response, info, config.windowMs);
+          break;
+        }
+        case "draft-7": {
+          debug2("set ietf draft 7 headers");
+          config.validations.headersResetTime(info.resetTime);
+          setDraft7Headers(response, info, config.windowMs);
+          break;
+        }
+        case "draft-8": {
+          const retrieveName = typeof config.identifier === "function" ? config.identifier(request, response) : config.identifier;
+          const name = await retrieveName;
+          debug2("set ietf draft 8 headers");
+          debug2("set name to %o", name);
+          config.validations.headersResetTime(info.resetTime);
+          setDraft8Headers(response, info, config.windowMs, name, key);
+          break;
+        }
+        default: {
+          config.validations.headersDraftVersion(config.standardHeaders);
+          break;
+        }
+      }
+    }
+    if (config.skipFailedRequests || config.skipSuccessfulRequests) {
+      let decremented = false;
+      const decrementKey = async () => {
+        if (!decremented) {
+          if (resetTime && Date.now() >= resetTime.getTime()) {
+            return;
+          }
+          debug2("decrementing count");
+          await config.store.decrement(key);
+          decremented = true;
+        }
+      };
+      if (config.skipFailedRequests) {
+        if (finishPromise) {
+          finishPromise.then(async () => {
+            const success = await config.requestWasSuccessful(request, response);
+            debug2("computed requestWasSuccessful as %o", success);
+            if (!success)
+              await decrementKey();
+          });
+        }
+        if (closePromise) {
+          closePromise.then(async () => {
+            if (!response.writableEnded)
+              await decrementKey();
+          });
+        }
+        if (errorPromise) {
+          errorPromise.then(async () => {
+            await decrementKey();
+          });
+        }
+      }
+      if (config.skipSuccessfulRequests) {
+        if (finishPromise) {
+          finishPromise.then(async () => {
+            const success = await config.requestWasSuccessful(request, response);
+            debug2("computed requestWasSuccessful as %o", success);
+            if (success)
+              await decrementKey();
+          });
+        }
+      }
+    }
+    if (totalHits > limit) {
+      debug2("limit exceeded");
+      if (config.legacyHeaders || config.standardHeaders) {
+        debug2("set retry-after header");
+        setRetryAfterHeader(response, info, config.windowMs);
+      }
+      config.handler(request, response, next, options);
+      return;
+    }
+    next();
+  });
+  const getThrowFn = () => {
+    throw new Error("The current store does not support the get/getKey method");
+  };
+  middleware.resetKey = config.store.resetKey.bind(config.store);
+  middleware.getKey = typeof config.store.get === "function" ? config.store.get.bind(config.store) : getThrowFn;
+  return middleware;
+};
+var rate_limit_default = rateLimit;
+var SECOND = 1000;
+var MINUTE = 60 * SECOND;
+var HOUR = 60 * MINUTE;
+var DAY = 24 * HOUR;
+
+// src/rate_limit.ts
+var RATE_LIMIT_ENV = "PUBLISHER_RATE_LIMIT";
+function parseRateLimit(raw) {
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    throw new Error(`${RATE_LIMIT_ENV} must be a non-negative integer (requests per minute per client); got "${raw}"`);
+  }
+  return n === 0 ? undefined : n;
+}
+function isOperationalPath(req) {
+  return req.path === "/metrics" || req.path.startsWith("/health");
+}
+function rateLimitMiddleware(perMinute) {
+  const enabled = perMinute !== undefined;
+  return rate_limit_default({
+    windowMs: 60000,
+    limit: perMinute ?? Number.MAX_SAFE_INTEGER,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    skip: (req) => !enabled || isOperationalPath(req),
+    message: {
+      code: 429,
+      message: `Too many requests: this client exceeded ${perMinute} requests per minute.`
+    }
+  });
+}
+
 // src/server.ts
 assertSupportedNodeVersion();
 function parseArgs() {
@@ -299322,6 +301833,7 @@ var isDevelopment = process.env["NODE_ENV"] === "development";
 var app = import_express.default();
 app.use(loggerMiddleware);
 app.use(httpMetricsMiddleware);
+app.use(rateLimitMiddleware(parseRateLimit(process.env[RATE_LIMIT_ENV])));
 checkHeapConfiguration();
 var environmentStore = new EnvironmentStore(SERVER_ROOT);
 var watchModeController = new WatchModeController(environmentStore);