@malloy-publisher/server 0.0.196-dev → 0.0.196

package/src/storage/duckdb/PackageRepository.ts

@@ -12,10 +12,10 @@ export class PackageRepository {
       return new Date();
    }
 
-   async listPackages(projectId: string): Promise<Package[]> {
+   async listPackages(environmentId: string): Promise<Package[]> {
       const rows = await this.db.all<Record<string, unknown>>(
-         "SELECT * FROM packages WHERE project_id = ? ORDER BY name",
-         [projectId],
+         "SELECT * FROM packages WHERE environment_id = ? ORDER BY name",
+         [environmentId],
       );
       return rows.map(this.mapToPackage);
    }
@@ -29,12 +29,12 @@ export class PackageRepository {
    }
 
    async getPackageByName(
-      projectId: string,
+      environmentId: string,
       name: string,
    ): Promise<Package | null> {
       const row = await this.db.get<Record<string, unknown>>(
-         "SELECT * FROM packages WHERE project_id = ? AND name = ?",
-         [projectId, name],
+         "SELECT * FROM packages WHERE environment_id = ? AND name = ?",
+         [environmentId, name],
       );
       return row ? this.mapToPackage(row) : null;
    }
@@ -46,11 +46,11 @@ export class PackageRepository {
       const now = this.now();
 
       await this.db.run(
-         `INSERT INTO packages (id, project_id, name, description, manifest_path, metadata, created_at, updated_at)
+         `INSERT INTO packages (id, environment_id, name, description, manifest_path, metadata, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
          [
             id,
-            pkg.projectId,
+            pkg.environmentId,
             pkg.name,
             pkg.description || null,
             pkg.manifestPath,
@@ -114,14 +114,14 @@ export class PackageRepository {
       await this.db.run("DELETE FROM packages WHERE id = ?", [id]);
    }
 
-   async deletePackagesByProjectId(id: string): Promise<void> {
-      await this.db.run("DELETE FROM packages WHERE project_id = ?", [id]);
+   async deletePackagesByEnvironmentId(id: string): Promise<void> {
+      await this.db.run("DELETE FROM packages WHERE environment_id = ?", [id]);
    }
 
    private mapToPackage(row: Record<string, unknown>): Package {
       return {
          id: row.id as string,
-         projectId: row.project_id as string,
+         environmentId: row.environment_id as string,
          name: row.name as string,
          description: row.description as string | undefined,
          manifestPath: row.manifest_path as string,

package/src/storage/duckdb/manifest_store.spec.ts

@@ -6,7 +6,7 @@ import { DuckDBManifestStore } from "./DuckDBManifestStore";
 function makeEntry(overrides: Partial<ManifestEntry> = {}): ManifestEntry {
    return {
       id: "entry-1",
-      projectId: "proj-1",
+      environmentId: "proj-1",
       packageName: "pkg",
       buildId: "build-abc",
       tableName: "my_table",
@@ -83,7 +83,7 @@ describe("DuckDBManifestStore", () => {
          expect(ctx.repository.upsertManifestEntry.calledOnce).toBe(true);
          const arg = ctx.repository.upsertManifestEntry.firstCall.args[0];
          expect(arg).toEqual({
-            projectId: "proj-1",
+            environmentId: "proj-1",
             packageName: "pkg",
             buildId: "build-abc",
             tableName: "tbl",

package/src/storage/duckdb/schema.ts

@@ -17,12 +17,21 @@ export async function initializeSchema(
       );
       await dropAllTables(db);
    } else {
+      // TODO: Remove this during projects cleanup
+      // If a pre-rename `projects` schema is on disk, the new
+      // CREATE TABLE IF NOT EXISTS pass below would silently leave child
+      // tables on the old `project_id` column and the first query against
+      // `environment_id` would crash. Drop the legacy tables (with a loud
+      // warning) so the fresh schema can be created cleanly. This is
+      // destructive — operators upgrading should re-create their environments
+      // and packages via the API after the upgrade.
+      await dropLegacyProjectSchema(db);
       logger.info("Creating database schema for the first time...");
    }
 
-   // Projects table
+   // Environments table
    await db.run(`
-    CREATE TABLE IF NOT EXISTS projects (
+    CREATE TABLE IF NOT EXISTS environments (
       id VARCHAR PRIMARY KEY,
       name VARCHAR NOT NULL UNIQUE,
       path VARCHAR NOT NULL,
@@ -37,15 +46,15 @@ export async function initializeSchema(
    await db.run(`
     CREATE TABLE IF NOT EXISTS packages (
       id VARCHAR PRIMARY KEY,
-      project_id VARCHAR NOT NULL,
+      environment_id VARCHAR NOT NULL,
       name VARCHAR NOT NULL,
       description VARCHAR,
       manifest_path VARCHAR NOT NULL,
       metadata JSON,
       created_at TIMESTAMP NOT NULL,
       updated_at TIMESTAMP NOT NULL,
-      FOREIGN KEY (project_id) REFERENCES projects(id),
-      UNIQUE (project_id, name)
+      FOREIGN KEY (environment_id) REFERENCES environments(id),
+      UNIQUE (environment_id, name)
     )
   `);
 
@@ -53,22 +62,22 @@ export async function initializeSchema(
    await db.run(`
     CREATE TABLE IF NOT EXISTS connections (
       id VARCHAR PRIMARY KEY,
-      project_id VARCHAR NOT NULL,
+      environment_id VARCHAR NOT NULL,
       name VARCHAR NOT NULL,
       type VARCHAR NOT NULL,
       config JSON NOT NULL,
       created_at TIMESTAMP NOT NULL,
       updated_at TIMESTAMP NOT NULL,
-      FOREIGN KEY (project_id) REFERENCES projects(id),
-      UNIQUE (project_id, name)
+      FOREIGN KEY (environment_id) REFERENCES environments(id),
+      UNIQUE (environment_id, name)
     )
   `);
 
    // Materializations table.
    //
    // `active_key` enforces at-most-one active (PENDING or RUNNING)
-   // materialization per (project, package) at the DB layer. It is set to
-   // `{project_id}|{package_name}` while the row is active and cleared
+   // materialization per (environment, package) at the DB layer. It is set to
+   // `{environment_id}|{package_name}` while the row is active and cleared
    // to NULL on transition to any terminal state. A unique index on
    // `active_key` (see below) makes the insert-then-check race impossible —
    // a second concurrent create fails with a constraint violation, which the
@@ -76,7 +85,7 @@ export async function initializeSchema(
    await db.run(`
     CREATE TABLE IF NOT EXISTS materializations (
       id VARCHAR PRIMARY KEY,
-      project_id VARCHAR NOT NULL,
+      environment_id VARCHAR NOT NULL,
       package_name VARCHAR NOT NULL,
       status VARCHAR NOT NULL,
       active_key VARCHAR,
@@ -86,7 +95,7 @@ export async function initializeSchema(
       metadata JSON,
       created_at TIMESTAMP NOT NULL,
       updated_at TIMESTAMP NOT NULL,
-      FOREIGN KEY (project_id) REFERENCES projects(id)
+      FOREIGN KEY (environment_id) REFERENCES environments(id)
     )
   `);
 
@@ -94,7 +103,7 @@ export async function initializeSchema(
    await db.run(`
     CREATE TABLE IF NOT EXISTS build_manifests (
       id VARCHAR PRIMARY KEY,
-      project_id VARCHAR NOT NULL,
+      environment_id VARCHAR NOT NULL,
       package_name VARCHAR NOT NULL,
       build_id VARCHAR NOT NULL,
       table_name VARCHAR NOT NULL,
@@ -102,36 +111,68 @@ export async function initializeSchema(
       connection_name VARCHAR NOT NULL,
       created_at TIMESTAMP NOT NULL,
       updated_at TIMESTAMP NOT NULL,
-      FOREIGN KEY (project_id) REFERENCES projects(id),
-      UNIQUE (project_id, package_name, build_id)
+      FOREIGN KEY (environment_id) REFERENCES environments(id),
+      UNIQUE (environment_id, package_name, build_id)
     )
   `);
 
    // Create indexes for better query performance
    await db.run(
-      "CREATE INDEX IF NOT EXISTS idx_packages_project_id ON packages(project_id)",
+      "CREATE INDEX IF NOT EXISTS idx_packages_environment_id ON packages(environment_id)",
    );
    await db.run(
-      "CREATE INDEX IF NOT EXISTS idx_connections_project_id ON connections(project_id)",
+      "CREATE INDEX IF NOT EXISTS idx_connections_environment_id ON connections(environment_id)",
    );
    await db.run(
-      "CREATE INDEX IF NOT EXISTS idx_materializations_project_package ON materializations(project_id, package_name)",
+      "CREATE INDEX IF NOT EXISTS idx_materializations_environment_package ON materializations(environment_id, package_name)",
    );
    await db.run(
       "CREATE UNIQUE INDEX IF NOT EXISTS idx_materializations_active_key ON materializations(active_key)",
    );
    await db.run(
-      "CREATE INDEX IF NOT EXISTS idx_build_manifests_project_package ON build_manifests(project_id, package_name)",
+      "CREATE INDEX IF NOT EXISTS idx_build_manifests_environment_package ON build_manifests(environment_id, package_name)",
    );
 }
 
+// TODO: Remove this during projects cleanup
+// Tables in the pre-rename schema, listed children-first so DROP order
+// satisfies foreign-key dependencies on the legacy `projects` table.
+const LEGACY_TABLES_DROP_ORDER = [
+   "build_manifests",
+   "materializations",
+   "packages",
+   "connections",
+   "projects",
+] as const;
+
+async function dropLegacyProjectSchema(db: DuckDBConnection): Promise<void> {
+   const legacy = await db.all<{ name: string }>(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name='projects'",
+   );
+   if (!legacy || legacy.length === 0) {
+      return;
+   }
+
+   logger.warn(
+      "Detected legacy 'projects' schema. Dropping legacy tables; existing environments/packages/connections/materializations data will be lost. Re-create them via the API after upgrade.",
+   );
+
+   for (const table of LEGACY_TABLES_DROP_ORDER) {
+      try {
+         await db.run(`DROP TABLE IF EXISTS ${table}`);
+      } catch (err) {
+         logger.warn(`Failed to drop legacy table ${table}:`, err);
+      }
+   }
+}
+
 async function dropAllTables(db: DuckDBConnection): Promise<void> {
    const tables = [
       "build_manifests",
       "materializations",
       "packages",
       "connections",
-      "projects",
+      "environments",
    ];
 
    logger.info("Dropping tables:", tables.join(", "));

package/src/storage/ducklake/DuckLakeManifestStore.ts

@@ -31,15 +31,15 @@ import { DuckDBConnection } from "../duckdb/DuckDBConnection";
  */
 export class DuckLakeManifestStore implements ManifestStore {
    private readonly table: string;
-   private readonly projectName: string;
+   private readonly environmentName: string;
 
    constructor(
       private db: DuckDBConnection,
       catalogName: string,
-      projectName: string,
+      environmentName: string,
    ) {
       this.table = `${catalogName}.build_manifests`;
-      this.projectName = projectName;
+      this.environmentName = environmentName;
    }
 
    /**
@@ -56,7 +56,7 @@ export class DuckLakeManifestStore implements ManifestStore {
       await this.db.run(`
          CREATE TABLE IF NOT EXISTS ${this.table} (
             id VARCHAR,
-            project_name VARCHAR NOT NULL,
+            environment_name VARCHAR NOT NULL,
             package_name VARCHAR NOT NULL,
             build_id VARCHAR NOT NULL,
             table_name VARCHAR NOT NULL,
@@ -70,12 +70,12 @@ export class DuckLakeManifestStore implements ManifestStore {
    }
 
    async getManifest(
-      _projectId: string,
+      _environmentId: string,
       packageName: string,
    ): Promise<BuildManifest> {
       const rows = await this.db.all<Record<string, unknown>>(
-         `SELECT * FROM ${this.table} WHERE project_name = ? AND package_name = ? ORDER BY created_at DESC`,
-         [this.projectName, packageName],
+         `SELECT * FROM ${this.table} WHERE environment_name = ? AND package_name = ? ORDER BY created_at DESC`,
+         [this.environmentName, packageName],
       );
       const manifest: BuildManifest = { entries: {}, strict: false };
       for (const row of rows) {
@@ -97,7 +97,7 @@ export class DuckLakeManifestStore implements ManifestStore {
     * {@link getManifest} deduplicates by build_id keeping the newest row.
     */
    async writeEntry(
-      _projectId: string,
+      _environmentId: string,
       packageName: string,
       buildId: string,
       tableName: string,
@@ -108,11 +108,11 @@ export class DuckLakeManifestStore implements ManifestStore {
       const id = `${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
 
       await this.db.run(
-         `INSERT INTO ${this.table} (id, project_name, package_name, build_id, table_name, source_name, connection_name, created_at, updated_at)
+         `INSERT INTO ${this.table} (id, environment_name, package_name, build_id, table_name, source_name, connection_name, created_at, updated_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
          [
             id,
-            this.projectName,
+            this.environmentName,
             packageName,
             buildId,
             tableName,
@@ -129,12 +129,12 @@ export class DuckLakeManifestStore implements ManifestStore {
    }
 
    async listEntries(
-      _projectId: string,
+      _environmentId: string,
       packageName: string,
    ): Promise<ManifestEntry[]> {
       const rows = await this.db.all<Record<string, unknown>>(
-         `SELECT * FROM ${this.table} WHERE project_name = ? AND package_name = ? ORDER BY created_at DESC`,
-         [this.projectName, packageName],
+         `SELECT * FROM ${this.table} WHERE environment_name = ? AND package_name = ? ORDER BY created_at DESC`,
+         [this.environmentName, packageName],
       );
       return rows.map(this.mapToEntry);
    }
@@ -142,7 +142,7 @@ export class DuckLakeManifestStore implements ManifestStore {
    private mapToEntry(row: Record<string, unknown>): ManifestEntry {
       return {
          id: row.id as string,
-         projectId: row.project_name as string,
+         environmentId: row.environment_name as string,
          packageName: row.package_name as string,
          buildId: row.build_id as string,
          tableName: row.table_name as string,

package/tests/fixtures/publisher.config.json

@@ -1,6 +1,6 @@
 {
   "frozenConfig": false,
-  "projects": [
+  "environments": [
     {
       "name": "test-project",
       "packages": [

package/tests/harness/e2e.ts

@@ -28,7 +28,7 @@ let originalServerRoot: string | undefined;
  */
 export async function startE2E(): Promise<E2EEnv & { stop(): Promise<void> }> {
    //--------------------------------------------------------------------------
-   // 1.  Set SERVER_ROOT so ProjectStore loader finds publisher.config.json
+   // 1.  Set SERVER_ROOT so EnvironmentStore loader finds publisher.config.json
    //--------------------------------------------------------------------------
    originalServerRoot = process.env.SERVER_ROOT;
    // Use import.meta.url for cross-platform compatibility (works on Windows)

package/tests/harness/mcp_test_setup.ts

@@ -47,7 +47,7 @@ export async function setupE2ETestEnvironment(): Promise<McpE2ETestEnvironment>
 
 async function setupE2ETestEnvironmentInternal(): Promise<McpE2ETestEnvironment> {
    // --- Store and Set SERVER_ROOT Env Var ---
-   // The ProjectStore relies on SERVER_ROOT to find publisher.config.json.
+   // The EnvironmentStore relies on SERVER_ROOT to find publisher.config.json.
    const originalServerRoot = process.env.SERVER_ROOT; // Store original value
    // Resolve the path to 'packages/server' based on the location of this file
    // Use import.meta.url for cross-platform compatibility (works on Windows)

package/tests/harness/mocks.ts

@@ -1,12 +1,14 @@
 import sinon from "sinon";
-import { ProjectStore } from "../../src/service/project_store";
+import { EnvironmentStore } from "../../src/service/environment_store";
 
-/** Return a stubbed ProjectStore where every lookup throws or returns minimal objects. */
-export function fakeProjectStore(): sinon.SinonStubbedInstance<ProjectStore> {
-   const ps = sinon.createStubInstance(ProjectStore);
-   // For now just have getProject reject; suites can stub more.
-   ps.getProject.rejects(new Error("fakeProjectStore: getProject not stubbed"));
-   return ps;
+/** Return a stubbed EnvironmentStore where every lookup throws or returns minimal objects. */
+export function fakeEnvironmentStore(): sinon.SinonStubbedInstance<EnvironmentStore> {
+   const es = sinon.createStubInstance(EnvironmentStore);
+   // For now just have getEnvironment reject; suites can stub more.
+   es.getEnvironment.rejects(
+      new Error("fakeEnvironmentStore: getEnvironment not stubbed"),
+   );
+   return es;
 }
 
 // The runtime implementation of `McpServer` lives in the MCP SDK package, which
@@ -27,7 +29,7 @@ export type McpServer = DummyMcpServer;
 /** Convenience helper mimicking the old mocks used in integration specs. */
 export function createMalloyServiceMocks() {
    return {
-      projectStore: fakeProjectStore(),
+      environmentStore: fakeEnvironmentStore(),
    } as const;
 }
 

package/tests/harness/rest_e2e.ts

@@ -12,8 +12,8 @@ export interface RestE2EEnv {
  * reuses the cached Express app and binds on an OS-assigned port
  * to avoid collisions.
  *
- * Callers are responsible for creating any test-specific projects
- * via the REST API (POST /api/v0/projects) and cleaning them up.
+ * Callers are responsible for creating any test-specific environments
+ * via the REST API (POST /api/v0/environments) and cleaning them up.
  */
 export async function startRestE2E(): Promise<
    RestE2EEnv & { stop(): Promise<void> }

package/tests/integration/legacy_routes/legacy_routes.integration.spec.ts

@@ -0,0 +1,259 @@
+/// <reference types="bun-types" />
+
+// TODO: Remove this during projects cleanup
+/**
+ * Smoke tests for the legacy `/api/v0/projects/...` REST surface registered
+ * by `server-old.ts`. These routes exist purely to keep pre-rename SDK
+ * clients (e.g. `@malloydata/db-publisher`) working after the
+ * projects→environments rename.
+ *
+ * One test per route group: projects CRUD, packages, connections, models,
+ * notebooks, databases, queries, materializations, manifest. The
+ * materialization test additionally asserts the response field rename
+ * (`projectId` not `environmentId`). `/status` is no longer in the legacy
+ * surface — both old and new clients hit the single `/api/v0/status`
+ * handler in server.ts, which returns `environments`.
+ *
+ * This file is intentionally separate from the regular integration suite so
+ * it can be deleted in one motion when legacy support is dropped.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import path from "path";
+import { fileURLToPath } from "url";
+import { RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Use a distinct project name so this suite doesn't collide with the
+// materialization integration suite (which also uses "test-project") if
+// they ever run in the same DB instance.
+const PROJECT_NAME = "legacy-routes-test-project";
+const PACKAGE_NAME = "persist-test";
+
+describe("Legacy /api/v0/projects/* REST routes (E2E)", () => {
+   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
+   let baseUrl: string;
+
+   beforeAll(async () => {
+      env = await startRestE2E();
+      baseUrl = env.baseUrl;
+
+      // Create the test environment via the LEGACY route — proves POST
+      // /projects works end-to-end.
+      const fixtureDir = path.resolve(__dirname, "../../fixtures/persist-test");
+      const createRes = await fetch(`${baseUrl}/api/v0/projects`, {
+         method: "POST",
+         headers: { "Content-Type": "application/json" },
+         body: JSON.stringify({
+            name: PROJECT_NAME,
+            packages: [{ name: PACKAGE_NAME, location: fixtureDir }],
+            connections: [],
+         }),
+      });
+      if (!createRes.ok) {
+         const body = await createRes.text();
+         throw new Error(
+            `Failed to create test project via legacy route (${createRes.status}): ${body}`,
+         );
+      }
+
+      // Wait for the package to finish loading via the legacy GET path.
+      const deadline = Date.now() + 30_000;
+      let pkgReady = false;
+      while (!pkgReady && Date.now() < deadline) {
+         try {
+            const res = await fetch(
+               `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}`,
+            );
+            if (res.ok) {
+               pkgReady = true;
+               break;
+            }
+         } catch {
+            // not ready yet
+         }
+         await new Promise((r) => setTimeout(r, 500));
+      }
+      if (!pkgReady) {
+         throw new Error("Test package did not become available in time");
+      }
+   });
+
+   afterAll(async () => {
+      if (baseUrl) {
+         try {
+            // Clean up via the legacy DELETE route.
+            await fetch(`${baseUrl}/api/v0/projects/${PROJECT_NAME}`, {
+               method: "DELETE",
+            });
+         } catch {
+            // best-effort cleanup
+         }
+      }
+      await env?.stop();
+      env = null;
+   });
+
+   describe("projects CRUD", () => {
+      it("GET /projects lists environments under the legacy URL", async () => {
+         const res = await fetch(`${baseUrl}/api/v0/projects`);
+         expect(res.status).toBe(200);
+         const body = (await res.json()) as Array<{ name?: string }>;
+         expect(Array.isArray(body)).toBe(true);
+         expect(body.some((e) => e.name === PROJECT_NAME)).toBe(true);
+      });
+
+      it("GET /projects/:projectName returns the project", async () => {
+         const res = await fetch(`${baseUrl}/api/v0/projects/${PROJECT_NAME}`);
+         expect(res.status).toBe(200);
+         const body = (await res.json()) as { name?: string };
+         expect(body.name).toBe(PROJECT_NAME);
+      });
+   });
+
+   describe("packages", () => {
+      it("GET /projects/:projectName/packages returns the package list", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages`,
+         );
+         expect(res.status).toBe(200);
+         const body = (await res.json()) as Array<{ name?: string }>;
+         expect(Array.isArray(body)).toBe(true);
+         expect(body.some((p) => p.name === PACKAGE_NAME)).toBe(true);
+      });
+
+      it("GET /projects/:projectName/packages/:packageName returns the package", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}`,
+         );
+         expect(res.status).toBe(200);
+         const body = (await res.json()) as { name?: string };
+         expect(body.name).toBe(PACKAGE_NAME);
+      });
+   });
+
+   describe("connections", () => {
+      it("GET /projects/:projectName/connections returns 200 (may be empty)", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/connections`,
+         );
+         expect(res.status).toBe(200);
+         const body = await res.json();
+         expect(Array.isArray(body)).toBe(true);
+      });
+   });
+
+   describe("models", () => {
+      it("GET /projects/:projectName/packages/:packageName/models returns the model list", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/models`,
+         );
+         expect(res.status).toBe(200);
+         const body = await res.json();
+         expect(Array.isArray(body)).toBe(true);
+      });
+   });
+
+   describe("notebooks", () => {
+      it("GET /projects/:projectName/packages/:packageName/notebooks returns 200", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/notebooks`,
+         );
+         expect(res.status).toBe(200);
+         const body = await res.json();
+         expect(Array.isArray(body)).toBe(true);
+      });
+   });
+
+   describe("databases", () => {
+      it("GET /projects/:projectName/packages/:packageName/databases returns 200", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/databases`,
+         );
+         expect(res.status).toBe(200);
+         const body = await res.json();
+         expect(Array.isArray(body)).toBe(true);
+      });
+   });
+
+   describe("queries", () => {
+      it("POST /projects/:projectName/packages/:packageName/models/.../query reaches the handler", async () => {
+         // Hit the route with a bogus model name. We only need to prove the
+         // legacy URL is wired up to the controller — a structured JSON
+         // error (not Express's HTML fall-through 404) is sufficient signal.
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/models/does-not-exist.malloy/query`,
+            {
+               method: "POST",
+               headers: { "Content-Type": "application/json" },
+               body: JSON.stringify({ query: "run: nothing" }),
+            },
+         );
+         expect(res.status).toBeGreaterThanOrEqual(400);
+         expect(res.status).toBeLessThan(600);
+         // Controller errors come back as JSON with a `message` field.
+         // An unhandled Express 404 returns HTML — that would fail here.
+         const body = (await res.json()) as Record<string, unknown>;
+         expect(typeof body.message).toBe("string");
+      });
+   });
+
+   describe("materializations", () => {
+      it("GET list and POST create return 'projectId' (not 'environmentId') under the legacy URL", async () => {
+         const listRes = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/materializations`,
+         );
+         expect(listRes.status).toBe(200);
+         const list = (await listRes.json()) as unknown;
+         expect(Array.isArray(list)).toBe(true);
+
+         // Create one so we can assert the field rename on a populated payload.
+         const createRes = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/materializations`,
+            {
+               method: "POST",
+               headers: { "Content-Type": "application/json" },
+               body: JSON.stringify({ autoLoadManifest: true }),
+            },
+         );
+         expect(createRes.status).toBe(201);
+         const created = (await createRes.json()) as Record<string, unknown>;
+
+         // Legacy contract: materialization payloads expose `projectId`, not
+         // `environmentId`. This is the response remapper in server-old.ts.
+         expect(created).toHaveProperty("projectId");
+         expect(created).not.toHaveProperty("environmentId");
+
+         const id = created.id as string;
+         // Best-effort cleanup so we don't leak a PENDING materialization
+         // into other tests. We don't poll-to-terminal; the suite teardown
+         // of the project will mop up.
+         try {
+            await fetch(
+               `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/materializations/${id}?action=stop`,
+               { method: "POST" },
+            );
+            await fetch(
+               `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/materializations/${id}`,
+               { method: "DELETE" },
+            );
+         } catch {
+            // ignore
+         }
+      });
+   });
+
+   describe("manifest", () => {
+      it("GET /projects/:projectName/packages/:packageName/manifest returns 200 or a structured 4xx", async () => {
+         const res = await fetch(
+            `${baseUrl}/api/v0/projects/${PROJECT_NAME}/packages/${PACKAGE_NAME}/manifest`,
+         );
+         // Without a built materialization the manifest may be empty/404 —
+         // we only assert the legacy URL reaches the handler, not 404 from
+         // Express's catch-all.
+         expect([200, 400, 404]).toContain(res.status);
+      });
+   });
+});