@malloy-publisher/server 0.0.196-dev → 0.0.197-dev

package/src/service/connection.ts

@@ -1,18 +1,18 @@
-import type { BigQueryConnection } from "@malloydata/db-bigquery";
 import "@malloydata/db-bigquery";
+import type { BigQueryConnection } from "@malloydata/db-bigquery";
+import "@malloydata/db-databricks";
 import { DuckDBConnection } from "@malloydata/db-duckdb";
 import "@malloydata/db-duckdb/native";
-import type { MySQLConnection } from "@malloydata/db-mysql";
 import "@malloydata/db-mysql";
-import type { PostgresConnection } from "@malloydata/db-postgres";
+import type { MySQLConnection } from "@malloydata/db-mysql";
 import "@malloydata/db-postgres";
+import type { PostgresConnection } from "@malloydata/db-postgres";
 import {
    buildPoolOptions,
    SnowflakeConnection,
 } from "@malloydata/db-snowflake";
-import type { TrinoConnection } from "@malloydata/db-trino";
 import "@malloydata/db-trino";
-import "@malloydata/db-databricks";
+import type { TrinoConnection } from "@malloydata/db-trino";
 import {
    Connection,
    contextOverlay,
@@ -26,10 +26,10 @@ import path from "path";
 import { components } from "../api";
 import { logAxiosError, logger } from "../logger";
 import {
-   assembleProjectConnections,
+   assembleEnvironmentConnections,
    CoreConnectionEntry,
+   EnvironmentConnectionMetadata,
    normalizeSnowflakePrivateKey,
-   ProjectConnectionMetadata,
 } from "./connection_config";
 import { CloudStorageCredentials } from "./gcs_s3_utils";
 
@@ -807,17 +807,17 @@ class DuckLakeConnection extends DuckDBConnection {
 
 export async function deleteDuckLakeConnectionFile(
    connectionName: string,
-   projectPath: string,
+   environmentPath: string,
 ): Promise<void> {
    const ducklakePath = path.join(
-      projectPath,
+      environmentPath,
       `${connectionName}_ducklake.duckdb`,
    );
    try {
       await fs.access(ducklakePath);
       await fs.rm(ducklakePath);
       logger.info(
-         `Removed DuckLake connection file ${connectionName}_ducklake.duckdb from ${projectPath}`,
+         `Removed DuckLake connection file ${connectionName}_ducklake.duckdb from ${environmentPath}`,
       );
    } catch (error) {
       if ((error as NodeJS.ErrnoException).code === "ENOENT") {
@@ -826,14 +826,14 @@ export async function deleteDuckLakeConnectionFile(
          );
       } else {
          logger.error(
-            `Failed to remove DuckLake connection file ${connectionName}_ducklake.duckdb from ${projectPath}`,
+            `Failed to remove DuckLake connection file ${connectionName}_ducklake.duckdb from ${environmentPath}`,
             { error },
          );
       }
    }
 }
 
-export type ProjectMalloyConfig = {
+export type EnvironmentMalloyConfig = {
    malloyConfig: MalloyConfig;
    apiConnections: InternalConnection[];
    // Releases both core-managed connections and Publisher wrapper-managed
@@ -863,7 +863,7 @@ function removeUndefined<T extends object>(value: T): Partial<T> {
 }
 
 function buildSnowflakePrivateKeyConnection(
-   metadata: ProjectConnectionMetadata,
+   metadata: EnvironmentConnectionMetadata,
 ): SnowflakeConnection {
    const name = metadata.apiConnection.name!;
    const snowflake = metadata.apiConnection.snowflakeConnection;
@@ -905,7 +905,7 @@ function buildSnowflakePrivateKeyConnection(
 }
 
 function buildDuckLakeConnection(
-   metadata: ProjectConnectionMetadata,
+   metadata: EnvironmentConnectionMetadata,
    entry: CoreConnectionEntry,
 ): DuckLakeConnection {
    return new DuckLakeConnection(
@@ -918,7 +918,7 @@ function buildDuckLakeConnection(
 }
 
 function buildAzureDuckDBConnection(
-   metadata: ProjectConnectionMetadata,
+   metadata: EnvironmentConnectionMetadata,
    entry: CoreConnectionEntry,
 ): AzureDuckDBConnection {
    return new AzureDuckDBConnection(
@@ -932,9 +932,9 @@ function buildAzureDuckDBConnection(
 }
 
 function getMetadataForLookup(
-   metadata: Map<string, ProjectConnectionMetadata>,
+   metadata: Map<string, EnvironmentConnectionMetadata>,
    name?: string,
-): ProjectConnectionMetadata | undefined {
+): EnvironmentConnectionMetadata | undefined {
    return name ? metadata.get(name) : undefined;
 }
 
@@ -951,15 +951,18 @@ function isDuckDBConnection(
  *   to a connection-config change, so the new generation rebinds against the
  *   updated DuckLake settings (catalog DSN, storage secrets) rather than
  *   trusting whatever attach state the prior generation left behind. On a
- *   fresh project the existing-attach check fails anyway, so the flag is a
+ *   fresh environment the existing-attach check fails anyway, so the flag is a
  *   no-op there. Only the DuckLake branch consults it today.
  */
-export function buildProjectMalloyConfig(
+export function buildEnvironmentMalloyConfig(
    connections: ApiConnection[] = [],
-   projectPath: string = "",
+   environmentPath: string = "",
    isUpdateConnectionRequest: boolean = false,
-): ProjectMalloyConfig {
-   const assembled = assembleProjectConnections(connections, projectPath);
+): EnvironmentMalloyConfig {
+   const assembled = assembleEnvironmentConnections(
+      connections,
+      environmentPath,
+   );
    // Cache the build Promise rather than the resolved Connection so two
    // concurrent lookupConnection() calls for the same name share one build
    // and we never leak a losing-instance pool/handle. Per-branch caches
@@ -970,12 +973,12 @@ export function buildProjectMalloyConfig(
    const attachPromises = new WeakMap<Connection, Promise<void>>();
 
    const malloyConfig = new MalloyConfig(assembled.pojo, {
-      config: contextOverlay({ rootDirectory: projectPath }),
+      config: contextOverlay({ rootDirectory: environmentPath }),
    });
 
    async function attachOnce(
       connection: Connection,
-      metadata: ProjectConnectionMetadata,
+      metadata: EnvironmentConnectionMetadata,
    ): Promise<void> {
       if (
          metadata.attachedDatabases.length === 0 ||
@@ -1086,23 +1089,23 @@ export function buildProjectMalloyConfig(
          // already let every branch run, and a single AggregateError otherwise
          // hides per-branch detail from callers that just log the error.
          for (const failure of failures) {
-            logger.error("Failed to release project connection", {
+            logger.error("Failed to release environment connection", {
                error: failure.reason,
             });
          }
          if (failures.length > 0) {
             throw new AggregateError(
                failures.map((failure) => failure.reason),
-               "Failed to release one or more project connections",
+               "Failed to release one or more environment connections",
             );
          }
       },
    };
 }
 
-export async function createProjectConnections(
+export async function createEnvironmentConnections(
    connections: ApiConnection[] = [],
-   projectPath: string = "",
+   environmentPath: string = "",
    isUpdateConnectionRequest: boolean = false,
 ): Promise<{
    malloyConnections: Map<string, Connection>;
@@ -1110,17 +1113,17 @@ export async function createProjectConnections(
    releaseConnections: () => Promise<void>;
 }> {
    const connectionMap = new Map<string, Connection>();
-   const projectConfig = buildProjectMalloyConfig(
+   const environmentConfig = buildEnvironmentMalloyConfig(
       connections,
-      projectPath,
+      environmentPath,
       isUpdateConnectionRequest,
    );
 
-   for (const connection of projectConfig.apiConnections) {
+   for (const connection of environmentConfig.apiConnections) {
       if (!connection.name) continue;
       logger.info(`Adding connection ${connection.name}`, { connection });
       const malloyConnection =
-         await projectConfig.malloyConfig.connections.lookupConnection(
+         await environmentConfig.malloyConfig.connections.lookupConnection(
             connection.name,
          );
       connection.attributes = getConnectionAttributes(malloyConnection);
@@ -1129,8 +1132,8 @@ export async function createProjectConnections(
 
    return {
       malloyConnections: connectionMap,
-      apiConnections: projectConfig.apiConnections,
-      releaseConnections: projectConfig.releaseConnections,
+      apiConnections: environmentConfig.apiConnections,
+      releaseConnections: environmentConfig.releaseConnections,
    };
 }
 
@@ -1280,16 +1283,16 @@ async function testDuckDBConnection(
 export async function testConnectionConfig(
    connectionConfig: ApiConnection,
 ): Promise<ApiConnectionStatus> {
-   let projectConfig: ProjectMalloyConfig | null = null;
+   let environmentConfig: EnvironmentMalloyConfig | null = null;
    try {
       // Validate that connection name is provided
       if (!connectionConfig.name) {
          throw new Error("Connection name is required");
       }
 
-      projectConfig = buildProjectMalloyConfig([connectionConfig]);
+      environmentConfig = buildEnvironmentMalloyConfig([connectionConfig]);
       const connection =
-         await projectConfig.malloyConfig.connections.lookupConnection(
+         await environmentConfig.malloyConfig.connections.lookupConnection(
             connectionConfig.name,
          );
 
@@ -1346,9 +1349,9 @@ export async function testConnectionConfig(
          errorMessage: (error as Error).message,
       };
    } finally {
-      if (projectConfig) {
+      if (environmentConfig) {
          try {
-            await projectConfig.releaseConnections();
+            await environmentConfig.releaseConnections();
          } catch (closeError) {
             logger.warn("Error releasing temporary connection test config", {
                error: closeError,

package/src/service/connection_config.spec.ts

@@ -1,14 +1,14 @@
-import { generateKeyPairSync } from "crypto";
 import { describe, expect, it } from "bun:test";
+import { generateKeyPairSync } from "crypto";
+import { components } from "../api";
 import {
-   assembleProjectConnections,
+   assembleEnvironmentConnections,
    normalizeSnowflakePrivateKey,
 } from "./connection_config";
-import { components } from "../api";
 
 type ApiConnection = components["schemas"]["Connection"];
 
-describe("assembleProjectConnections — databricks", () => {
+describe("assembleEnvironmentConnections — databricks", () => {
    const validBase: ApiConnection = {
       name: "dbx",
       type: "databricks",
@@ -22,7 +22,9 @@ describe("assembleProjectConnections — databricks", () => {
    };
 
    it("emits a databricks core entry with all known fields preserved", () => {
-      const { pojo, apiConnections } = assembleProjectConnections([validBase]);
+      const { pojo, apiConnections } = assembleEnvironmentConnections([
+         validBase,
+      ]);
 
       const entry = pojo.connections["dbx"];
       expect(entry.is).toBe("databricks");
@@ -48,7 +50,7 @@ describe("assembleProjectConnections — databricks", () => {
             defaultCatalog: "main",
          },
       };
-      const { pojo } = assembleProjectConnections([conn]);
+      const { pojo } = assembleEnvironmentConnections([conn]);
       const entry = pojo.connections["dbx-oauth"];
       expect(entry.is).toBe("databricks");
       expect(entry.oauthClientId).toBe("client-id");
@@ -61,7 +63,7 @@ describe("assembleProjectConnections — databricks", () => {
          name: "dbx",
          type: "databricks",
       };
-      expect(() => assembleProjectConnections([conn])).toThrow(
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
          "Databricks connection configuration is missing.",
       );
    });
@@ -74,7 +76,7 @@ describe("assembleProjectConnections — databricks", () => {
             host: undefined,
          },
       };
-      expect(() => assembleProjectConnections([conn])).toThrow(
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
          "Databricks host is required",
       );
    });
@@ -87,7 +89,7 @@ describe("assembleProjectConnections — databricks", () => {
             path: undefined,
          },
       };
-      expect(() => assembleProjectConnections([conn])).toThrow(
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
          "Databricks SQL warehouse HTTP path is required",
       );
    });
@@ -103,7 +105,7 @@ describe("assembleProjectConnections — databricks", () => {
             // defaultCatalog deliberately omitted
          },
       };
-      expect(() => assembleProjectConnections([conn])).toThrow(
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
          "Databricks default catalog is required",
       );
    });
@@ -120,7 +122,7 @@ describe("assembleProjectConnections — databricks", () => {
             defaultCatalog: "main",
          },
       };
-      expect(() => assembleProjectConnections([conn])).toThrow(
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
          "Databricks requires",
       );
    });

package/src/service/connection_config.ts

@@ -14,7 +14,7 @@ export type CoreConnectionsPojo = {
    connections: Record<string, CoreConnectionEntry>;
 };
 
-export type ProjectConnectionMetadata = {
+export type EnvironmentConnectionMetadata = {
    apiConnection: ApiConnection;
    attachedDatabases: AttachedDatabase[];
    hasAzureAttachment: boolean;
@@ -24,9 +24,9 @@ export type ProjectConnectionMetadata = {
    workingDirectory: string;
 };
 
-export type AssembledProjectConnections = {
+export type AssembledEnvironmentConnections = {
    pojo: CoreConnectionsPojo;
-   metadata: Map<string, ProjectConnectionMetadata>;
+   metadata: Map<string, EnvironmentConnectionMetadata>;
    apiConnections: ApiConnection[];
 };
 
@@ -105,10 +105,10 @@ export function normalizeSnowflakePrivateKey(privateKey: string): string {
    return privateKeyContent;
 }
 
-// NOTE: This narrows the project-author API surface (it rejects securityPolicy,
+// NOTE: This narrows the environment-author API surface (it rejects securityPolicy,
 // allowedDirectories, setupSQL, etc.). It is NOT a filesystem isolation
 // boundary: attachedDatabases[].path is not normalized or constrained to stay
-// under the project root, and DuckDB's local-file access is unchanged.
+// under the environment root, and DuckDB's local-file access is unchanged.
 // Adversarial filesystem isolation is explicit non-goal of the MalloyConfig
 // adoption — see PR #682 release notes ("DuckDB hardening knobs are not
 // exposed", "no adversarial DuckDB filesystem isolation"). Future work owns
@@ -127,7 +127,7 @@ export function validateDuckdbApiSurface(connection: ApiConnection): void {
       throw new Error(
          `Unsupported DuckDB connection field(s): ${unsupportedFields.join(
             ", ",
-         )}. Publisher only supports attachedDatabases for project-authored DuckDB connections.`,
+         )}. Publisher only supports attachedDatabases for environment-authored DuckDB connections.`,
       );
    }
 }
@@ -198,7 +198,7 @@ function getStaticConnectionAttributes(
 
 type ServiceAccountKey = {
    type?: string;
-   project_id?: string;
+   environment_id?: string;
    private_key?: string;
    client_email?: string;
    [key: string]: unknown;
@@ -248,12 +248,12 @@ function buildPostgresConnectionString(
 
 function buildDuckdbEntry(
    name: string,
-   projectPath: string,
+   environmentPath: string,
    databaseFilename = `${name}.duckdb`,
 ): CoreConnectionEntry {
    return {
       is: "duckdb",
-      databasePath: path.join(projectPath, databaseFilename),
+      databasePath: path.join(environmentPath, databaseFilename),
    };
 }
 
@@ -267,6 +267,15 @@ function validateConnectionShape(connection: ApiConnection): void {
          if (!connection.duckdbConnection) {
             throw new Error("DuckDB connection configuration is missing.");
          }
+         {
+            const attached =
+               connection.duckdbConnection.attachedDatabases ?? [];
+            if (attached.length === 0) {
+               throw new Error(
+                  "DuckDB connection must have at least one attached database",
+               );
+            }
+         }
          break;
       case "motherduck":
          if (!connection.motherduckConnection) {
@@ -330,12 +339,12 @@ function validateConnectionShape(connection: ApiConnection): void {
    }
 }
 
-export function assembleProjectConnections(
+export function assembleEnvironmentConnections(
    connections: ApiConnection[] = [],
-   projectPath = "",
-): AssembledProjectConnections {
+   environmentPath = "",
+): AssembledEnvironmentConnections {
    const pojo: CoreConnectionsPojo = { connections: {} };
-   const metadata = new Map<string, ProjectConnectionMetadata>();
+   const metadata = new Map<string, EnvironmentConnectionMetadata>();
    const apiConnections: ApiConnection[] = [];
    const processedConnections = new Set<string>();
 
@@ -365,9 +374,9 @@ export function assembleProjectConnections(
       const isDuckLake = connection.type === "ducklake";
       const isDuckdb = connection.type === "duckdb";
       const databasePath = isDuckLake
-         ? path.join(projectPath, `${connection.name}_ducklake.duckdb`)
+         ? path.join(environmentPath, `${connection.name}_ducklake.duckdb`)
          : isDuckdb
-           ? path.join(projectPath, `${connection.name}.duckdb`)
+           ? path.join(environmentPath, `${connection.name}.duckdb`)
            : undefined;
 
       metadata.set(connection.name, {
@@ -381,7 +390,7 @@ export function assembleProjectConnections(
             !!connection.snowflakeConnection?.privateKey,
          isDuckLake,
          databasePath,
-         workingDirectory: projectPath,
+         workingDirectory: environmentPath,
       });
 
       switch (connection.type) {
@@ -423,7 +432,7 @@ export function assembleProjectConnections(
                is: "bigquery",
                projectId:
                   connection.bigqueryConnection?.defaultProjectId ??
-                  serviceAccountKey?.project_id,
+                  serviceAccountKey?.environment_id,
                serviceAccountKey,
                location: connection.bigqueryConnection?.location,
                maximumBytesBilled:
@@ -499,7 +508,7 @@ export function assembleProjectConnections(
             }
             pojo.connections[connection.name] = buildDuckdbEntry(
                connection.name,
-               projectPath,
+               environmentPath,
                `${connection.name}.duckdb`,
             );
             break;
@@ -531,7 +540,7 @@ export function assembleProjectConnections(
             }
             pojo.connections[connection.name] = buildDuckdbEntry(
                connection.name,
-               projectPath,
+               environmentPath,
                `${connection.name}_ducklake.duckdb`,
             );
             break;