@malloy-publisher/create-malloy-package 0.0.20 → 0.0.22

package/dist/index.js

@@ -675,7 +675,7 @@ var MCP_PORT = 4040;
 var ALT_PUBLISHER_PORT = PUBLISHER_PORT + 100;
 var ALT_MCP_PORT = MCP_PORT + 100;
 var BIND_HOST = "127.0.0.1";
-var SERVER_VERSION = "0.8.0";
+var SERVER_VERSION = "0.8.2";
 function startCommandFor(envName) {
   return `npx -y @malloy-publisher/server@${SERVER_VERSION} --server_root . ` + `--config ./publisher.config.json --host ${BIND_HOST} ` + `--watch-env ${envName}`;
 }
@@ -1414,7 +1414,7 @@ function packageSection(result, envPackages) {
   ];
   if (result.packageCreated) {
     const base = restBase(result.packageName);
-    lines.push(`\`${result.packageName}/${result.modelFile}\` defines a Malloy source named \`${result.sourceName}\` over local data. Read it for the real source, field, and view names and use them verbatim; never guess them.`, "", result.indexFile === result.modelFile ? `That file is also \`${result.indexFile}\`, this package's published surface: what it \`export\`s is what Publisher lists and what may be queried. Query through it.` : `\`${result.packageName}/${result.indexFile}\` is the package's published surface: it imports that model and \`export\`s \`${result.sourceName}\`. Publisher lists and accepts queries against the surface, so address queries to \`${result.indexFile}\`, not to \`${result.modelFile}\` -- a model off the surface is refused with a 404. Add a source to the \`export\` list to publish it.`, "", `One thing that surface cannot publish: a dashboard. A \`dashboards/*.malloy\` file is a file, not a source, so \`${result.indexFile}\` has no way to \`export\` it, and a dashboard added to this package is NOT served -- it is written, it compiles, and it is withheld with a load warning. To serve dashboards, declare an \`explores\` in \`publisher.json\` naming \`${result.indexFile}\` and every dashboard file; the explicit key overrides the convention. Decide that before building one, because the fix is a different curation shape rather than an extra line.`, "", `The package's REST base is:`, "", "```", base, "```", "", "Run one of its views from a script:", "", "```bash", `curl -s -X POST ${base}/models/${result.indexFile}/query \\`, "  -H 'content-type: application/json' \\", `  -d '{"query":"run: ${result.sourceName} -> overview"}'`, "```", "", `The VS Code / Cursor Malloy extension resolves the model's relative \`duckdb.table('data/…')\` paths against the EDITOR WORKSPACE root, while Publisher resolves them against the package directory. \`${result.packageName}/malloy-config.json\` (generated, machine-specific absolute path) bridges that for an editor opened at this workspace root; without it, open the editor at \`${result.packageName}/\` itself, or a model Publisher serves fine shows unresolved-table errors in the editor.`, "");
+    lines.push(`\`${result.packageName}/${result.modelFile}\` defines a Malloy source named \`${result.sourceName}\` over local data. Read it for the real source, field, and view names and use them verbatim; never guess them.`, "", result.indexFile === result.modelFile ? `That file is also \`${result.indexFile}\`, this package's published surface: what it \`export\`s is what Publisher lists and what may be queried. Query through it.` : `\`${result.packageName}/${result.indexFile}\` is the package's published surface: it imports that model and \`export\`s \`${result.sourceName}\`. Publisher lists and accepts queries against the surface, so address queries to \`${result.indexFile}\`, not to \`${result.modelFile}\` -- a model off the surface is refused with a 404. Add a source to the \`export\` list to publish it.`, "", `The package's REST base is:`, "", "```", base, "```", "", "Run one of its views from a script:", "", "```bash", `curl -s -X POST ${base}/models/${result.indexFile}/query \\`, "  -H 'content-type: application/json' \\", `  -d '{"query":"run: ${result.sourceName} -> overview"}'`, "```", "", `The VS Code / Cursor Malloy extension resolves the model's relative \`duckdb.table('data/…')\` paths against the EDITOR WORKSPACE root, while Publisher resolves them against the package directory. \`${result.packageName}/malloy-config.json\` (generated, machine-specific absolute path) bridges that for an editor opened at this workspace root; without it, open the editor at \`${result.packageName}/\` itself, or a model Publisher serves fine shows unresolved-table errors in the editor.`, "");
   }
   if (others.length > 0) {
     lines.push(otherPackagesParagraph(result, others, restBase), "");

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/create-malloy-package",
    "description": "Scaffold a Malloy Publisher package and a local agent workspace, so one command takes you from nothing to an agent that can query your data.",
-   "version": "0.0.20",
+   "version": "0.0.22",
    "license": "MIT",
    "type": "module",
    "engines": {
@@ -45,7 +45,7 @@
       "test:e2e": "bun test --timeout 180000 ./tests/e2e"
    },
    "dependencies": {
-      "@malloy-publisher/skills": "^0.1.24",
+      "@malloy-publisher/skills": "^0.1.28",
       "commander": "^12.1.0"
    },
    "devDependencies": {

package/templates/index.malloy

@@ -7,13 +7,17 @@
 // `export { ... }` is the curation, and it is a real boundary rather than
 // just a listing filter. A source named here is discoverable AND queryable.
 // A source left out still compiles, and other models can import, join and
-// extend it, but a direct query against it is refused with a 404 --
-// indistinguishable from a source that does not exist. Add a name here to
+// extend it, but a direct query against it is refused with a 404 that says
+// it is not on this surface. (Once a model carries an authorize or
+// access_filter gate, that 404 reads the same as for a source that does not
+// exist, so it cannot be used to find hidden names.) Add a name here to
 // publish it; leave one out to keep it as an internal building block.
 //
-// To curate listings WITHOUT refusing queries, keep an explicit "explores" in
-// publisher.json alongside "queryableSources": "all". That is the one thing
-// this file cannot express. See docs/discovery-and-access.md.
+// To curate listings WITHOUT refusing queries, add "queryableSources": "all"
+// to publisher.json: this file still decides what is listed, and every source
+// stays queryable by name. Its one use is an authorize-gated source kept out
+// of listings that authorized callers still query. See
+// docs/discovery-and-access.md.
 
 import "{{modelFile}}"