@malloy-publisher/server 0.0.204 → 0.0.205

package/dist/server.mjs

@@ -200925,8 +200925,8 @@ var require_uri_all = __commonJS((exports, module) => {
           wsComponents.secure = undefined;
         }
         if (wsComponents.resourceName) {
-          var _wsComponents$resourc = wsComponents.resourceName.split("?"), _wsComponents$resourc2 = slicedToArray(_wsComponents$resourc, 2), path10 = _wsComponents$resourc2[0], query = _wsComponents$resourc2[1];
-          wsComponents.path = path10 && path10 !== "/" ? path10 : undefined;
+          var _wsComponents$resourc = wsComponents.resourceName.split("?"), _wsComponents$resourc2 = slicedToArray(_wsComponents$resourc, 2), path11 = _wsComponents$resourc2[0], query = _wsComponents$resourc2[1];
+          wsComponents.path = path11 && path11 !== "/" ? path11 : undefined;
           wsComponents.query = query;
           wsComponents.resourceName = undefined;
         }
@@ -201319,12 +201319,12 @@ var require_util12 = __commonJS((exports, module) => {
     return "'" + escapeQuotes(str) + "'";
   }
   function getPathExpr(currentPath, expr, jsonPointers, isNumber2) {
-    var path10 = jsonPointers ? "'/' + " + expr + (isNumber2 ? "" : ".replace(/~/g, '~0').replace(/\\//g, '~1')") : isNumber2 ? "'[' + " + expr + " + ']'" : "'[\\'' + " + expr + " + '\\']'";
-    return joinPaths(currentPath, path10);
+    var path11 = jsonPointers ? "'/' + " + expr + (isNumber2 ? "" : ".replace(/~/g, '~0').replace(/\\//g, '~1')") : isNumber2 ? "'[' + " + expr + " + ']'" : "'[\\'' + " + expr + " + '\\']'";
+    return joinPaths(currentPath, path11);
   }
   function getPath(currentPath, prop, jsonPointers) {
-    var path10 = jsonPointers ? toQuotedString("/" + escapeJsonPointer(prop)) : toQuotedString(getProperty(prop));
-    return joinPaths(currentPath, path10);
+    var path11 = jsonPointers ? toQuotedString("/" + escapeJsonPointer(prop)) : toQuotedString(getProperty(prop));
+    return joinPaths(currentPath, path11);
   }
   var JSON_POINTER = /^\/(?:[^~]|~0|~1)*$/;
   var RELATIVE_JSON_POINTER = /^([0-9]+)(#|\/(?:[^~]|~0|~1)*)?$/;
@@ -207378,11 +207378,11 @@ var require_ast = __commonJS((exports, module) => {
       helperExpression: function helperExpression(node) {
         return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
       },
-      scopedId: function scopedId(path10) {
-        return /^\.|this\b/.test(path10.original);
+      scopedId: function scopedId(path11) {
+        return /^\.|this\b/.test(path11.original);
       },
-      simpleId: function simpleId(path10) {
-        return path10.parts.length === 1 && !AST.helpers.scopedId(path10) && !path10.depth;
+      simpleId: function simpleId(path11) {
+        return path11.parts.length === 1 && !AST.helpers.scopedId(path11) && !path11.depth;
       }
     }
   };
@@ -208442,12 +208442,12 @@ var require_helpers3 = __commonJS((exports) => {
       loc
     };
   }
-  function prepareMustache(path10, params, hash, open2, strip, locInfo) {
+  function prepareMustache(path11, params, hash, open2, strip, locInfo) {
     var escapeFlag = open2.charAt(3) || open2.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
     var decorator = /\*/.test(open2);
     return {
       type: decorator ? "Decorator" : "MustacheStatement",
-      path: path10,
+      path: path11,
       params,
       hash,
       escaped,
@@ -208711,9 +208711,9 @@ var require_compiler = __commonJS((exports) => {
     },
     DecoratorBlock: function DecoratorBlock(decorator) {
       var program = decorator.program && this.compileProgram(decorator.program);
-      var params = this.setupFullMustacheParams(decorator, program, undefined), path10 = decorator.path;
+      var params = this.setupFullMustacheParams(decorator, program, undefined), path11 = decorator.path;
       this.useDecorators = true;
-      this.opcode("registerDecorator", params.length, path10.original);
+      this.opcode("registerDecorator", params.length, path11.original);
     },
     PartialStatement: function PartialStatement(partial) {
       this.usePartial = true;
@@ -208776,46 +208776,46 @@ var require_compiler = __commonJS((exports) => {
       }
     },
     ambiguousSexpr: function ambiguousSexpr(sexpr, program, inverse) {
-      var path10 = sexpr.path, name = path10.parts[0], isBlock = program != null || inverse != null;
-      this.opcode("getContext", path10.depth);
+      var path11 = sexpr.path, name = path11.parts[0], isBlock = program != null || inverse != null;
+      this.opcode("getContext", path11.depth);
       this.opcode("pushProgram", program);
       this.opcode("pushProgram", inverse);
-      path10.strict = true;
-      this.accept(path10);
+      path11.strict = true;
+      this.accept(path11);
       this.opcode("invokeAmbiguous", name, isBlock);
     },
     simpleSexpr: function simpleSexpr(sexpr) {
-      var path10 = sexpr.path;
-      path10.strict = true;
-      this.accept(path10);
+      var path11 = sexpr.path;
+      path11.strict = true;
+      this.accept(path11);
       this.opcode("resolvePossibleLambda");
     },
     helperSexpr: function helperSexpr(sexpr, program, inverse) {
-      var params = this.setupFullMustacheParams(sexpr, program, inverse), path10 = sexpr.path, name = path10.parts[0];
+      var params = this.setupFullMustacheParams(sexpr, program, inverse), path11 = sexpr.path, name = path11.parts[0];
       if (this.options.knownHelpers[name]) {
         this.opcode("invokeKnownHelper", params.length, name);
       } else if (this.options.knownHelpersOnly) {
         throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
       } else {
-        path10.strict = true;
-        path10.falsy = true;
-        this.accept(path10);
-        this.opcode("invokeHelper", params.length, path10.original, _ast2["default"].helpers.simpleId(path10));
+        path11.strict = true;
+        path11.falsy = true;
+        this.accept(path11);
+        this.opcode("invokeHelper", params.length, path11.original, _ast2["default"].helpers.simpleId(path11));
       }
     },
-    PathExpression: function PathExpression(path10) {
-      this.addDepth(path10.depth);
-      this.opcode("getContext", path10.depth);
-      var name = path10.parts[0], scoped = _ast2["default"].helpers.scopedId(path10), blockParamId = !path10.depth && !scoped && this.blockParamIndex(name);
+    PathExpression: function PathExpression(path11) {
+      this.addDepth(path11.depth);
+      this.opcode("getContext", path11.depth);
+      var name = path11.parts[0], scoped = _ast2["default"].helpers.scopedId(path11), blockParamId = !path11.depth && !scoped && this.blockParamIndex(name);
       if (blockParamId) {
-        this.opcode("lookupBlockParam", blockParamId, path10.parts);
+        this.opcode("lookupBlockParam", blockParamId, path11.parts);
       } else if (!name) {
         this.opcode("pushContext");
-      } else if (path10.data) {
+      } else if (path11.data) {
         this.options.data = true;
-        this.opcode("lookupData", path10.depth, path10.parts, path10.strict);
+        this.opcode("lookupData", path11.depth, path11.parts, path11.strict);
       } else {
-        this.opcode("lookupOnContext", path10.parts, path10.falsy, path10.strict, scoped);
+        this.opcode("lookupOnContext", path11.parts, path11.falsy, path11.strict, scoped);
       }
     },
     StringLiteral: function StringLiteral(string2) {
@@ -209159,16 +209159,16 @@ var require_util13 = __commonJS((exports) => {
   }
   exports.urlGenerate = urlGenerate;
   function normalize2(aPath) {
-    var path10 = aPath;
+    var path11 = aPath;
     var url2 = urlParse(aPath);
     if (url2) {
       if (!url2.path) {
         return aPath;
       }
-      path10 = url2.path;
+      path11 = url2.path;
     }
-    var isAbsolute4 = exports.isAbsolute(path10);
-    var parts = path10.split(/\/+/);
+    var isAbsolute4 = exports.isAbsolute(path11);
+    var parts = path11.split(/\/+/);
     for (var part, up = 0, i = parts.length - 1;i >= 0; i--) {
       part = parts[i];
       if (part === ".") {
@@ -209185,15 +209185,15 @@ var require_util13 = __commonJS((exports) => {
         }
       }
     }
-    path10 = parts.join("/");
-    if (path10 === "") {
-      path10 = isAbsolute4 ? "/" : ".";
+    path11 = parts.join("/");
+    if (path11 === "") {
+      path11 = isAbsolute4 ? "/" : ".";
     }
     if (url2) {
-      url2.path = path10;
+      url2.path = path11;
       return urlGenerate(url2);
     }
-    return path10;
+    return path11;
   }
   exports.normalize = normalize2;
   function join9(aRoot, aPath) {
@@ -211750,8 +211750,8 @@ var require_printer = __commonJS((exports) => {
     return this.accept(sexpr.path) + " " + params + hash;
   };
   PrintVisitor.prototype.PathExpression = function(id) {
-    var path10 = id.parts.join("/");
-    return (id.data ? "@" : "") + "PATH:" + path10;
+    var path11 = id.parts.join("/");
+    return (id.data ? "@" : "") + "PATH:" + path11;
   };
   PrintVisitor.prototype.StringLiteral = function(string2) {
     return '"' + string2.value + '"';
@@ -216953,7 +216953,7 @@ var import_cors = __toESM(require_lib7(), 1);
 var import_express = __toESM(require_express(), 1);
 var import_http_proxy_middleware = __toESM(require_dist4(), 1);
 import * as http2 from "http";
-import * as path10 from "path";
+import * as path11 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/controller/compile.controller.ts
@@ -225341,6 +225341,8 @@ var esm_default = { watch, FSWatcher };
 // src/controller/watch-mode.controller.ts
 init_errors();
 init_logger();
+import { EventEmitter as EventEmitter4 } from "events";
+import path10 from "path";
 
 // src/service/environment_store.ts
 var import_client_s32 = __toESM(require_dist_cjs75(), 1);
@@ -229670,11 +229672,13 @@ init_errors();
 init_logger();
 
 // src/storage/duckdb/DuckDBConnection.ts
-import duckdb from "duckdb";
+import {
+  DuckDBInstance
+} from "@duckdb/node-api";
 import * as path4 from "path";
 
 class DuckDBConnection2 {
-  db = null;
+  instance = null;
   connection = null;
   dbPath;
   mutex = new Mutex;
@@ -229682,68 +229686,42 @@ class DuckDBConnection2 {
     this.dbPath = dbPath || path4.join(process.cwd(), "publisher.db");
   }
   async initialize() {
-    return new Promise((resolve4, reject) => {
-      this.db = new duckdb.Database(this.dbPath, {}, (err) => {
-        if (err) {
-          console.error("Failed to create DuckDB database:", err);
-          reject(new Error(`Failed to initialize DuckDB: ${err.message}`));
-          return;
-        }
-        this.connection = this.db.connect();
-        if (!this.connection) {
-          reject(new Error("Failed to create connection object"));
-          return;
-        }
-        this.connection.all("SELECT 42 as answer", (testErr, _rows) => {
-          if (testErr) {
-            console.error("Connection test failed:", testErr);
-            reject(new Error(`Failed to verify DuckDB connection: ${testErr.message}`));
-            return;
-          }
-          resolve4();
-        });
-      });
-    });
+    try {
+      this.instance = await DuckDBInstance.create(this.dbPath);
+      this.connection = await this.instance.connect();
+      await this.connection.run("SELECT 42 as answer");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error("Failed to create DuckDB database:", err);
+      throw new Error(`Failed to initialize DuckDB: ${message}`);
+    }
   }
   async close() {
-    return new Promise((resolve4, reject) => {
+    try {
       if (this.connection) {
-        this.connection.close((err) => {
-          if (err) {
-            reject(new Error(`Failed to close DuckDB connection: ${err.message}`));
-            return;
-          }
-          if (this.db) {
-            this.db.close((dbErr) => {
-              if (dbErr) {
-                reject(new Error(`Failed to close DuckDB: ${dbErr.message}`));
-                return;
-              }
-              console.log("DuckDB connection closed");
-              resolve4();
-            });
-          } else {
-            resolve4();
-          }
-        });
-      } else {
-        resolve4();
+        this.connection.closeSync();
+        this.connection = null;
       }
-    });
+      if (this.instance) {
+        this.instance.closeSync();
+        this.instance = null;
+      }
+      console.log("DuckDB connection closed");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new Error(`Failed to close DuckDB connection: ${message}`);
+    }
   }
   async isInitialized() {
     if (!this.connection)
       return false;
     return this.mutex.runExclusive(async () => {
-      return new Promise((resolve4) => {
-        this.connection.all("SELECT name FROM sqlite_master WHERE type='table' AND name='environments'", (err, rows) => {
-          if (err) {
-            resolve4(false);
-            return;
-          }
-          resolve4(rows && rows.length > 0);
-        });
-      });
+      try {
+        const reader = await this.connection.runAndReadAll("SELECT name FROM sqlite_master WHERE type='table' AND name='environments'");
+        return reader.getRowObjectsJS().length > 0;
+      } catch {
+        return false;
+      }
     });
   }
   async run(query, params) {
@@ -229751,21 +229729,13 @@ class DuckDBConnection2 {
       throw new Error("Database not initialized");
     }
     return this.mutex.runExclusive(async () => {
-      return new Promise((resolve4, reject) => {
-        const callback = (err) => {
-          if (err) {
-            reject(new Error(`Query execution failed: ${err.message}
-Query: ${query}`));
-            return;
-          }
-          resolve4();
-        };
-        if (params && params.length > 0) {
-          this.connection.run(query, ...params, callback);
-        } else {
-          this.connection.run(query, callback);
-        }
-      });
+      try {
+        await this.connection.run(query, params);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Query execution failed: ${message}
+Query: ${query}`);
+      }
     });
   }
   async all(query, params) {
@@ -229773,33 +229743,20 @@ Query: ${query}`));
       throw new Error("Database not initialized");
     }
     return this.mutex.runExclusive(async () => {
-      return new Promise((resolve4, reject) => {
-        const callback = (err, rows) => {
-          if (err) {
-            reject(new Error(`Query execution failed: ${err.message}
-Query: ${query}`));
-            return;
-          }
-          resolve4(rows || []);
-        };
-        if (params && params.length > 0) {
-          this.connection.all(query, ...params, callback);
-        } else {
-          this.connection.all(query, callback);
-        }
-      });
+      try {
+        const reader = await this.connection.runAndReadAll(query, params);
+        return reader.getRowObjectsJS();
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Query execution failed: ${message}
+Query: ${query}`);
+      }
     });
   }
   async get(query, params) {
     const rows = await this.all(query, params);
     return rows.length > 0 ? rows[0] : null;
   }
-  getConnection() {
-    if (!this.connection) {
-      throw new Error("Database not initialized");
-    }
-    return this.connection;
-  }
 }
 
 // src/storage/duckdb/DuckDBManifestStore.ts
@@ -230869,6 +230826,7 @@ init_logger();
 import crypto4 from "crypto";
 import * as fs6 from "fs";
 import * as path8 from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/utils.ts
 import * as fs3 from "fs";
@@ -231480,6 +231438,9 @@ class Model {
   getAuthorize(sourceName) {
     return this.sources?.find((source) => source.name === sourceName)?.authorize ?? [];
   }
+  hasAuthorize() {
+    return this.fileLevelAuthorize.length > 0 || (this.sources?.some((s) => (s.authorize?.length ?? 0) > 0) ?? false);
+  }
   effectiveAuthorizeFor(sourceName) {
     if (sourceName && this.sources?.some((s) => s.name === sourceName)) {
       return this.getAuthorize(sourceName);
@@ -231510,6 +231471,12 @@ class Model {
     if (!passed)
       deny();
   }
+  async assertAuthorizedForText(text, givens) {
+    await this.assertAuthorized(this.extractSourceName(text), givens);
+  }
+  async assertAuthorizedForRunnable(runnable, givens) {
+    await this.assertAuthorized(await this.resolveAuthorizeSourceFromRunnable(runnable), givens);
+  }
   async resolveAuthorizeSourceFromRunnable(runnable) {
     try {
       const prepared = await runnable.getPreparedQuery();
@@ -232196,11 +232163,13 @@ class Package {
         status
       });
       try {
-        await fs5.rm(packagePath, {
-          recursive: true,
-          force: true
-        });
-        logger.info(`Cleaned up failed package directory: ${packagePath}`);
+        const stat6 = await fs5.lstat(packagePath).catch(() => null);
+        if (stat6?.isSymbolicLink()) {
+          logger.info(`Skipping cleanup of symlinked package path on failure: ${packagePath}`);
+        } else {
+          await fs5.rm(packagePath, { recursive: true, force: true });
+          logger.info(`Cleaned up failed package directory: ${packagePath}`);
+        }
       } catch (cleanupError) {
         logger.warn(`Failed to clean up package directory ${packagePath}`, {
           error: cleanupError
@@ -232495,6 +232464,9 @@ class Environment {
   environmentName;
   metadata;
   memoryGovernor = null;
+  getEnvironmentPath() {
+    return this.environmentPath;
+  }
   constructor(environmentName, environmentPath, malloyConfig, apiConnections) {
     assertSafeEnvironmentPath(environmentPath);
     this.environmentName = environmentName;
@@ -232579,8 +232551,8 @@ class Environment {
     return this.withPackageLock(packageName, async () => {
       const modelPath = safeJoinUnderRoot(this.environmentPath, packageName, modelName);
       const modelDir = path8.dirname(modelPath);
-      const virtualUri = `file://${path8.join(modelDir, "__compile_check.malloy")}`;
-      const virtualUrl = new URL(virtualUri);
+      const virtualUrl = pathToFileURL2(path8.join(modelDir, "__compile_check.malloy"));
+      const virtualUri = virtualUrl.toString();
       let modelContent = "";
       try {
         modelContent = await fs6.promises.readFile(modelPath, "utf8");
@@ -232596,6 +232568,10 @@ ${source}` : source;
         }
       };
       const pkg = await this._loadOrGetPackageLocked(packageName);
+      const gateModel = pkg.getModel(modelName);
+      if (gateModel) {
+        await gateModel.assertAuthorizedForText(source, givens ?? {});
+      }
       const runtime = new Runtime2({
         urlReader: interceptingReader,
         config: pkg.getMalloyConfig()
@@ -232603,10 +232579,16 @@ ${source}` : source;
       try {
         const modelMaterializer = runtime.loadModel(virtualUrl);
         const model = await modelMaterializer.getModel();
+        let queryMaterializer = null;
+        try {
+          queryMaterializer = modelMaterializer.loadFinalQuery();
+        } catch {}
+        if (queryMaterializer && gateModel?.hasAuthorize()) {
+          await gateModel.assertAuthorizedForRunnable(queryMaterializer, givens ?? {});
+        }
         let sql;
-        if (includeSql) {
+        if (includeSql && queryMaterializer) {
           try {
-            const queryMaterializer = modelMaterializer.loadFinalQuery();
             sql = await queryMaterializer.getSQL({ givens });
           } catch {}
         }
@@ -233147,6 +233129,16 @@ function validateEnvironmentAzureUrls(environment) {
     }
   }
 }
+async function clearMountTarget(targetPath) {
+  try {
+    const stats = await fs7.promises.lstat(targetPath);
+    if (stats.isDirectory() && !stats.isSymbolicLink()) {
+      await fs7.promises.rm(targetPath, { recursive: true, force: true });
+    } else {
+      await fs7.promises.unlink(targetPath);
+    }
+  } catch {}
+}
 
 class EnvironmentStore {
   serverRootPath;
@@ -233161,9 +233153,13 @@ class EnvironmentStore {
   });
   gcsClient;
   memoryGovernor = null;
+  inPlaceEnvs = new Set;
   constructor(serverRootPath) {
     this.serverRootPath = serverRootPath;
     this.gcsClient = new Storage;
+    const watchEnvList = (process.env.PUBLISHER_WATCH || "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    for (const envName of watchEnvList)
+      this.inPlaceEnvs.add(envName);
     const storageConfig = {
       type: "duckdb",
       duckdb: {
@@ -233173,6 +233169,12 @@ class EnvironmentStore {
     this.storageManager = new StorageManager(storageConfig);
     this.finishedInitialization = this.initialize();
   }
+  isInPlace(environmentName) {
+    return this.inPlaceEnvs.has(environmentName);
+  }
+  markInPlace(environmentName) {
+    this.inPlaceEnvs.add(environmentName);
+  }
   setMemoryGovernor(governor) {
     this.memoryGovernor = governor;
     for (const env of this.environments.values()) {
@@ -233798,21 +233800,47 @@ class EnvironmentStore {
             }
           } else {
             if (this.isLocalPath(_package.location)) {
-              sourcePath = _package.location;
+              sourcePath = path9.isAbsolute(_package.location) ? _package.location : path9.join(this.serverRootPath, _package.location);
             } else {
               sourcePath = safeJoinUnderRoot(tempDownloadPath, groupedLocation);
             }
           }
           const sourceExists = await fs7.promises.access(sourcePath).then(() => true).catch(() => false);
           if (sourceExists) {
-            await fs7.promises.mkdir(absolutePackagePath, {
-              recursive: true
-            });
-            await fs7.promises.cp(sourcePath, absolutePackagePath, {
-              recursive: true
-            });
-            logger.info(`Extracted package "${packageDir}" from ${groupedLocation.startsWith("https://github.com/") && _package.location.includes("/tree/") ? "GitHub subdirectory" : "shared download"}`);
+            const isInPlace = this.inPlaceEnvs.has(environmentName) && this.isLocalPath(_package.location);
+            if (isInPlace) {
+              await clearMountTarget(absolutePackagePath);
+              const absoluteSourcePath = path9.resolve(sourcePath);
+              const linkType = process.platform === "win32" ? "junction" : "dir";
+              try {
+                await fs7.promises.symlink(absoluteSourcePath, absolutePackagePath, linkType);
+                logger.info(`In-place mount (watch mode): linked package "${packageDir}" -> "${absoluteSourcePath}"`);
+              } catch (linkError) {
+                const code = linkError?.code ?? String(linkError);
+                logger.warn(`In-place mount failed for package "${packageDir}" (${code}); falling back to a copy. Source-edit live reload is disabled for this package.`);
+                await clearMountTarget(absolutePackagePath);
+                await fs7.promises.mkdir(absolutePackagePath, {
+                  recursive: true
+                });
+                await fs7.promises.cp(sourcePath, absolutePackagePath, {
+                  recursive: true
+                });
+              }
+            } else {
+              if (this.inPlaceEnvs.has(environmentName) && !this.isLocalPath(_package.location)) {
+                logger.warn(`Watch mode: package "${packageDir}" has remote location "${_package.location}" — falling back to copy. Source-edit live reload won't work for this package; clone the source locally and use a local-dir location to enable it.`);
+              }
+              await clearMountTarget(absolutePackagePath);
+              await fs7.promises.mkdir(absolutePackagePath, {
+                recursive: true
+              });
+              await fs7.promises.cp(sourcePath, absolutePackagePath, {
+                recursive: true
+              });
+              logger.info(`Extracted package "${packageDir}" from ${groupedLocation.startsWith("https://github.com/") && _package.location.includes("/tree/") ? "GitHub subdirectory" : "shared download"}`);
+            }
           } else {
+            await clearMountTarget(absolutePackagePath);
             await fs7.promises.mkdir(absolutePackagePath, {
               recursive: true
             });
@@ -234092,15 +234120,104 @@ class EnvironmentStore {
 }
 
 // src/controller/watch-mode.controller.ts
+var ASSET_EXTS = new Set([
+  ".html",
+  ".htm",
+  ".css",
+  ".js",
+  ".mjs",
+  ".json",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".svg",
+  ".webp",
+  ".ico",
+  ".woff",
+  ".woff2"
+]);
+var MODEL_EXTS = new Set([".malloy", ".malloynb", ".md"]);
+
 class WatchModeController {
   environmentStore;
   watchingPath;
   watchingEnvironmentName;
-  watcher;
+  watcher = null;
+  setupChain = null;
+  events = new EventEmitter4;
   constructor(environmentStore) {
     this.environmentStore = environmentStore;
     this.watchingPath = null;
     this.watchingEnvironmentName = null;
+    this.events.setMaxListeners(100);
+  }
+  async ensureWatching(environmentName) {
+    if (this.watchingEnvironmentName === environmentName && this.watcher) {
+      return;
+    }
+    const run = (this.setupChain ?? Promise.resolve()).catch(() => {}).then(async () => {
+      if (this.watchingEnvironmentName === environmentName && this.watcher) {
+        return;
+      }
+      const env = await this.environmentStore.getEnvironment(environmentName, false);
+      const watchPath = env.getEnvironmentPath();
+      if (this.watcher) {
+        await this.watcher.close();
+        this.watcher = null;
+      }
+      this.startWatcher(environmentName, watchPath);
+    });
+    this.setupChain = run;
+    await run;
+  }
+  isWatching(environmentName) {
+    return !!this.watcher && this.watchingEnvironmentName === environmentName;
+  }
+  startWatcher(watchName, watchPath) {
+    this.watchingEnvironmentName = watchName;
+    this.watchingPath = watchPath;
+    this.watcher = esm_default.watch(this.watchingPath, {
+      ignored: (filePath, stats) => {
+        if (!stats?.isFile())
+          return false;
+        const ext = path10.extname(filePath).toLowerCase();
+        return !MODEL_EXTS.has(ext) && !ASSET_EXTS.has(ext);
+      },
+      ignoreInitial: true
+    });
+    const reloadPackage = async (pkgName) => {
+      try {
+        const environment = await this.environmentStore.getEnvironment(watchName, false);
+        await environment.getPackage(pkgName, true);
+        logger.info(`Watch: recompiled package "${pkgName}" in environment "${watchName}"`);
+        return true;
+      } catch (error) {
+        logger.error(`Watch: failed to recompile package "${pkgName}" in environment "${watchName}"`, { error });
+        return false;
+      }
+    };
+    const onEvent = (kind) => async (filePath) => {
+      logger.info(`Watch ${kind}: ${filePath}; environment=${watchName}`);
+      const rel = path10.relative(this.watchingPath ?? "", filePath);
+      const segments = rel.split(path10.sep);
+      const pkgName = segments.length > 1 && segments[0] && !segments[0].startsWith("..") ? segments[0] : null;
+      if (!pkgName)
+        return;
+      const ext = path10.extname(filePath).toLowerCase();
+      if (MODEL_EXTS.has(ext)) {
+        const recompiled = await reloadPackage(pkgName);
+        if (!recompiled)
+          return;
+      }
+      this.events.emit(`${watchName}/${pkgName}`, {
+        path: filePath,
+        kind
+      });
+    };
+    this.watcher.on("add", onEvent("add"));
+    this.watcher.on("change", onEvent("change"));
+    this.watcher.on("unlink", onEvent("unlink"));
   }
   getWatchStatus = async (_req, res) => {
     return res.json({
@@ -234120,7 +234237,6 @@ class WatchModeController {
       return;
     }
     const environmentManifest = await EnvironmentStore.reloadEnvironmentManifest(this.environmentStore.serverRootPath);
-    this.watchingEnvironmentName = watchName || null;
     const environment = environmentManifest.environments.find((e) => e.name === watchName);
     if (!environment || !environment.packages || environment.packages.length === 0) {
       res.status(404).json({
@@ -234128,32 +234244,21 @@ class WatchModeController {
       });
       return;
     }
-    this.watchingPath = safeJoinUnderRoot(this.environmentStore.serverRootPath, watchName);
-    this.watcher = esm_default.watch(this.watchingPath, {
-      ignored: (path10, stats) => !!stats?.isFile() && !path10.endsWith(".malloy") && !path10.endsWith(".md"),
-      ignoreInitial: true
-    });
-    const reloadEnvironment = async () => {
-      const environment2 = await this.environmentStore.getEnvironment(watchName, true);
-      await this.environmentStore.addEnvironment(environment2.metadata);
-      logger.info(`Reloaded environment ${watchName}`);
-    };
-    this.watcher.on("add", async (path10) => {
-      logger.info(`Detected new file ${path10}, reloading environment ${watchName}`);
-      await reloadEnvironment();
-    });
-    this.watcher.on("unlink", async (path10) => {
-      logger.info(`Detected deletion of ${path10}, reloading environment ${watchName}`);
-      await reloadEnvironment();
-    });
-    this.watcher.on("change", async (path10) => {
-      logger.info(`Detected change on ${path10}, reloading environment ${watchName}`);
-      await reloadEnvironment();
-    });
+    try {
+      await this.ensureWatching(watchName);
+    } catch (error) {
+      logger.error(error);
+      const { status } = internalErrorToHttpError(error);
+      res.status(status).json({ error: error.message });
+      return;
+    }
     res.json();
   };
   stopWatchMode = async (_req, res) => {
-    this.watcher.close();
+    if (this.watcher) {
+      await this.watcher.close();
+      this.watcher = null;
+    }
     this.watchingPath = null;
     this.watchingEnvironmentName = null;
     res.json();
@@ -237259,7 +237364,14 @@ function getMalloyErrorDetails(operation, modelIdentifier, error) {
     const connectionErrorMatch = error.message.match(/Cannot connect to database/i);
     const fieldNotFoundMatch = error.message.match(/Field '([^']+)' not found in (source|query|view) '([^']+)'/i);
     const invalidRequestMatch = error.message.match(/Invalid query request\\. Query OR queryName must be defined/i);
-    if (viewNotFoundMatch) {
+    const accessDeniedMatch = error.message.match(/Access denied for source "([^"]+)"/i);
+    if (accessDeniedMatch) {
+      refined = true;
+      const [, sourceName] = accessDeniedMatch;
+      suggestions = [
+        `Suggestion: Access to source '${sourceName}' is restricted by an #(authorize) gate. Supply the givens its authorize expression requires (e.g. a role/region given) and retry. This is an authorization denial, not a syntax error.`
+      ];
+    } else if (viewNotFoundMatch) {
       refined = true;
       const [, viewName, sourceName] = viewNotFoundMatch;
       suggestions.unshift(`Suggestion: View '${viewName}' was not found in source '${sourceName}'. Check the view name spelling or try requesting the resource details for the source URI (e.g., 'malloy://.../sources/${sourceName}') to see the list of available views. Views are defined within sources like 'source: ${sourceName} is ... extend { view: ${viewName} is { ... } }'.`);
@@ -237377,6 +237489,8 @@ async function getModelForQuery(environmentStore, environmentName, packageName,
       errorDetails = getNotFoundError(`model '${modelPath}' in package '${packageName}' for environment '${environmentName}'`);
     } else if (error instanceof ModelCompilationError) {
       errorDetails = getMalloyErrorDetails("executeQuery (load model)", `${environmentName}/${packageName}/${modelPath}`, error);
+    } else if (error instanceof AccessDeniedError) {
+      errorDetails = getMalloyErrorDetails("executeQuery (load model)", `${environmentName}/${packageName}/${modelPath}`, error);
     } else if (error instanceof ServiceUnavailableError) {
       errorDetails = {
         message: error.message,
@@ -237393,25 +237507,25 @@ async function getModelForQuery(environmentStore, environmentName, packageName,
   }
 }
 function buildMalloyUri(components, fragment) {
-  let path10 = "/environment/";
+  let path11 = "/environment/";
   if (components.environment) {
-    path10 += encodeURIComponent(components.environment);
+    path11 += encodeURIComponent(components.environment);
   } else {
-    path10 += "home";
+    path11 += "home";
   }
   if (components.package) {
-    path10 += "/package/" + encodeURIComponent(components.package);
+    path11 += "/package/" + encodeURIComponent(components.package);
   }
   if (components.resourceType) {
-    path10 += "/" + components.resourceType;
+    path11 += "/" + components.resourceType;
     if (components.resourceName) {
-      path10 += "/" + encodeURIComponent(components.resourceName);
+      path11 += "/" + encodeURIComponent(components.resourceName);
       if (components.subResourceType && components.subResourceName) {
-        path10 += "/" + components.subResourceType + "/" + encodeURIComponent(components.subResourceName);
+        path11 += "/" + components.subResourceType + "/" + encodeURIComponent(components.subResourceName);
       }
     }
   }
-  let uriString = "malloy:/" + path10;
+  let uriString = "malloy:/" + path11;
   if (fragment) {
     uriString += "#" + fragment;
   }
@@ -239654,6 +239768,10 @@ function parseArgs() {
       i++;
     } else if (arg === "--init") {
       process.env.INITIALIZE_STORAGE = "true";
+    } else if (arg === "--watch-env" && args[i + 1]) {
+      const existing = process.env.PUBLISHER_WATCH || "";
+      process.env.PUBLISHER_WATCH = existing ? `${existing},${args[i + 1]}` : args[i + 1];
+      i++;
     } else if (arg === "--help" || arg === "-h") {
       console.log("Malloy Publisher Server");
       console.log("");
@@ -239668,6 +239786,11 @@ function parseArgs() {
       console.log("  --shutdown_drain_duration_seconds <number>  Time in seconds to keep service in draining state before closing servers (default: 0)");
       console.log("  --shutdown_graceful_close_timeout_seconds <number>  Time in seconds to wait after closing servers before exit (default: 0)");
       console.log("  --init                 Initialize the storage (default: false)");
+      console.log("  --watch-env <name>     Enable dev-mode watch for the named environment.");
+      console.log("                         Mounts local-dir packages in-place (symlink, not");
+      console.log("                         copy) so source-edit live reload works. A comma-");
+      console.log("                         separated PUBLISHER_WATCH mounts all listed envs in");
+      console.log("                         place, but only the first one auto-reloads.");
       console.log("  --help, -h             Show this help message");
       process.exit(0);
     }
@@ -239684,8 +239807,8 @@ var MCP_ENDPOINT = "/mcp";
 var SHUTDOWN_DRAIN_DURATION_SECONDS = Number(process.env.SHUTDOWN_DRAIN_DURATION_SECONDS || 0);
 var SHUTDOWN_GRACEFUL_CLOSE_TIMEOUT_SECONDS = Number(process.env.SHUTDOWN_GRACEFUL_CLOSE_TIMEOUT_SECONDS || 0);
 var __filename_esm = fileURLToPath4(import.meta.url);
-var ROOT = path10.join(path10.dirname(__filename_esm), "app");
-var SERVER_ROOT = path10.resolve(process.cwd(), process.env.SERVER_ROOT || ".");
+var ROOT = path11.join(path11.dirname(__filename_esm), "app");
+var SERVER_ROOT = path11.resolve(process.cwd(), process.env.SERVER_ROOT || ".");
 var API_PREFIX2 = "/api/v0";
 var isDevelopment = process.env["NODE_ENV"] === "development";
 var app = import_express.default();
@@ -239769,16 +239892,164 @@ mcpApp.all(MCP_ENDPOINT, async (req, res) => {
     }
   }
 });
+var PUBLISHER_RUNTIME_PATH = path11.join(path11.dirname(__filename_esm), "runtime", "publisher.js");
+app.get("/sdk/publisher.js", (_req, res) => {
+  res.type("application/javascript");
+  res.setHeader("cache-control", "public, max-age=60");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.sendFile(PUBLISHER_RUNTIME_PATH, (err) => {
+    if (err) {
+      logger.error("Failed to send publisher.js runtime", { error: err });
+      if (!res.headersSent)
+        res.status(500).end();
+    }
+  });
+});
+async function serveFromPackage(req, res) {
+  const subPathRaw = req.params["0"] ?? "";
+  try {
+    const environment = await environmentStore.getEnvironment(req.params.environmentName, false);
+    const pkg = await environment.getPackage(req.params.packageName, false);
+    const publicRoot = path11.join(pkg.getPackagePath(), "public");
+    let subPath = subPathRaw;
+    if (subPath === "" || subPath.endsWith("/")) {
+      subPath = subPath + "index.html";
+    }
+    const fullPath = safeJoinUnderRoot(publicRoot, subPath);
+    const fsp = await import("fs/promises");
+    let realPublicRoot;
+    let realFullPath;
+    try {
+      realPublicRoot = await fsp.realpath(publicRoot);
+      realFullPath = await fsp.realpath(fullPath);
+    } catch {
+      if (!res.headersSent) {
+        res.status(404).end();
+      }
+      return;
+    }
+    const rel = path11.relative(realPublicRoot, realFullPath);
+    if (rel.startsWith("..") || path11.isAbsolute(rel)) {
+      res.status(403).end();
+      return;
+    }
+    const ext = path11.extname(realFullPath).toLowerCase();
+    if (ext === ".html" || ext === ".htm") {
+      const frameAncestors = process.env.PUBLISHER_FRAME_ANCESTORS || "*";
+      res.setHeader("Content-Security-Policy", `frame-ancestors ${frameAncestors}`);
+      res.removeHeader("X-Frame-Options");
+    }
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.sendFile(realFullPath, (err) => {
+      if (err) {
+        if (!res.headersSent) {
+          res.status(404).end();
+        }
+      }
+    });
+  } catch (e) {
+    if (!res.headersSent) {
+      const { json, status } = internalErrorToHttpError(e);
+      res.status(status).json(json);
+    }
+  }
+}
+app.get("/environments/:environmentName/packages/:packageName", (req, res, next) => {
+  if (req.path.endsWith("/"))
+    return next();
+  const canonical = `/environments/${encodeURIComponent(req.params.environmentName)}/packages/${encodeURIComponent(req.params.packageName)}/`;
+  const query = new URLSearchParams;
+  for (const [key, value] of Object.entries(req.query)) {
+    if (Array.isArray(value)) {
+      for (const v of value)
+        query.append(key, String(v));
+    } else if (value !== undefined) {
+      query.append(key, String(value));
+    }
+  }
+  const qs = query.toString();
+  res.redirect(308, qs ? `${canonical}?${qs}` : canonical);
+});
+app.get("/environments/:environmentName/packages/:packageName/*", serveFromPackage);
+var PAGES_DEPTH_CAP = 3;
+async function listPackagePages(environmentName, packageName, publicRoot) {
+  const fs8 = await import("fs/promises");
+  const out = [];
+  let realPublicRoot;
+  try {
+    realPublicRoot = await fs8.realpath(publicRoot);
+  } catch {
+    return out;
+  }
+  async function walk(dir, depth) {
+    if (depth > PAGES_DEPTH_CAP)
+      return;
+    let entries;
+    try {
+      entries = await fs8.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") || entry.name === "node_modules")
+        continue;
+      const full = path11.join(dir, entry.name);
+      let realFull;
+      try {
+        realFull = await fs8.realpath(full);
+      } catch {
+        continue;
+      }
+      const contained = path11.relative(realPublicRoot, realFull);
+      if (contained.startsWith("..") || path11.isAbsolute(contained))
+        continue;
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && (entry.name.endsWith(".html") || entry.name.endsWith(".htm"))) {
+        const rel = path11.relative(publicRoot, full).replace(/\\/g, "/");
+        let title = rel;
+        try {
+          const fh = await fs8.open(full, "r");
+          try {
+            const buf = Buffer.alloc(4096);
+            const { bytesRead } = await fh.read(buf, 0, 4096, 0);
+            const head = buf.slice(0, bytesRead).toString("utf8");
+            const m = head.match(/<title[^>]*>([^<]+)<\/title>/i);
+            if (m)
+              title = m[1].trim();
+          } finally {
+            await fh.close();
+          }
+        } catch {}
+        out.push({
+          resource: `/environments/${environmentName}/packages/${packageName}/${rel}`,
+          packageName,
+          path: rel,
+          title
+        });
+      }
+    }
+  }
+  await walk(publicRoot, 0);
+  out.sort((a, b) => {
+    if (a.path === "index.html")
+      return -1;
+    if (b.path === "index.html")
+      return 1;
+    return a.path.localeCompare(b.path);
+  });
+  return out;
+}
 if (!isDevelopment) {
   app.use("/", import_express.default.static(ROOT));
-  app.use("/api-doc.html", import_express.default.static(path10.join(ROOT, "api-doc.html")));
+  app.use("/api-doc.html", import_express.default.static(path11.join(ROOT, "api-doc.html")));
 } else {
   app.use(`${API_PREFIX2}`, loggerMiddleware);
   app.use(import_http_proxy_middleware.createProxyMiddleware({
     target: "http://localhost:5173",
     changeOrigin: true,
     ws: true,
-    pathFilter: (path11) => !path11.startsWith("/api/") && !path11.startsWith("/metrics") && !path11.startsWith("/health")
+    pathFilter: (path12) => !path12.startsWith("/api/") && !path12.startsWith("/metrics") && !path12.startsWith("/health")
   }));
 }
 var setVersionIdError2 = (res) => {
@@ -239799,6 +240070,18 @@ try {
   logger.warn("Failed to register Prometheus metrics endpoint", { error });
 }
 app.use(drainingGuard);
+app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/pages`, async (req, res) => {
+  try {
+    const environment = await environmentStore.getEnvironment(req.params.environmentName, false);
+    const pkg = await environment.getPackage(req.params.packageName, false);
+    const pages = await listPackagePages(req.params.environmentName, req.params.packageName, path11.join(pkg.getPackagePath(), "public"));
+    res.json(pages);
+  } catch (error) {
+    logger.error("Failed to list package pages", { error });
+    const { json, status } = internalErrorToHttpError(error);
+    res.status(status).json(json);
+  }
+});
 app.get(`${API_PREFIX2}/status`, async (_req, res) => {
   try {
     const status = await environmentStore.getStatus();
@@ -239812,6 +240095,65 @@ app.get(`${API_PREFIX2}/status`, async (_req, res) => {
 app.get(`${API_PREFIX2}/watch-mode/status`, watchModeController.getWatchStatus);
 app.post(`${API_PREFIX2}/watch-mode/start`, watchModeController.startWatching);
 app.post(`${API_PREFIX2}/watch-mode/stop`, watchModeController.stopWatchMode);
+var MAX_SSE_CONNECTIONS = 1000;
+var sseConnectionCount = 0;
+app.get(`${API_PREFIX2}/environments/:environmentName/packages/:packageName/events`, async (req, res) => {
+  const env = req.params.environmentName;
+  const pkg = req.params.packageName;
+  try {
+    assertSafePackageName(env);
+    assertSafePackageName(pkg);
+    const environment = await environmentStore.getEnvironment(env, false);
+    await environment.getPackage(pkg, false);
+  } catch (error) {
+    const { json, status } = internalErrorToHttpError(error);
+    res.status(status).json(json);
+    return;
+  }
+  if (sseConnectionCount >= MAX_SSE_CONNECTIONS) {
+    res.status(503).json({
+      code: 503,
+      message: "Too many live-reload connections; try again shortly."
+    });
+    return;
+  }
+  sseConnectionCount++;
+  res.set({
+    "content-type": "text/event-stream",
+    "cache-control": "no-cache",
+    connection: "keep-alive",
+    "x-accel-buffering": "no"
+  });
+  res.flushHeaders();
+  const watching = watchModeController.isWatching(env);
+  res.write(`event: hello
+data: connected
+
+`);
+  res.write(`event: mode
+data: ${watching ? "enabled" : "disabled"}
+
+`);
+  const key = `${env}/${pkg}`;
+  const send = () => {
+    res.write(`event: changed
+data: changed
+
+`);
+  };
+  watchModeController.events.on(key, send);
+  const heartbeat = setInterval(() => {
+    res.write(`: heartbeat
+
+`);
+  }, 25000);
+  const cleanup = () => {
+    clearInterval(heartbeat);
+    watchModeController.events.off(key, send);
+    sseConnectionCount--;
+  };
+  req.on("close", cleanup);
+});
 app.get(`${API_PREFIX2}/environments`, async (_req, res) => {
   try {
     res.status(200).json(await environmentStore.listEnvironments());
@@ -240381,7 +240723,24 @@ registerLegacyRoutes(app, {
   manifestController
 });
 if (!isDevelopment) {
-  app.get("*", (_req, res) => res.sendFile(path10.resolve(ROOT, "index.html")));
+  const SPA_INDEX = path11.resolve(ROOT, "index.html");
+  app.get("*", (req, res) => {
+    res.sendFile(SPA_INDEX, (err) => {
+      if (!err)
+        return;
+      if (res.headersSent)
+        return;
+      res.status(404).type("text/html").send(`<!doctype html><meta charset="utf-8">
+<title>Publisher</title>
+<style>body{font:14px/1.4 -apple-system,system-ui,sans-serif;margin:40px;max-width:720px;color:#222}</style>
+<h1>Publisher is running, but the SPA bundle isn't built.</h1>
+<p>You requested <code>${req.path.replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c] ?? c)}</code>.
+The Publisher API is available at <a href="/api/v0/environments">/api/v0/environments</a>.</p>
+<p>To get the Publisher web UI, run <code>cd packages/app &amp;&amp; bunx vite build</code>
+or start the server with <code>NODE_ENV=development</code> after launching Vite on <code>:5173</code>.</p>
+<p>For in-package HTML data apps, browse to <code>/environments/&lt;env&gt;/packages/&lt;pkg&gt;/&lt;file&gt;</code> directly.</p>`);
+    });
+  });
 }
 app.use((err, _req, res, _next) => {
   logger.error("Unhandled error:", err);
@@ -240396,12 +240755,26 @@ var mainServer = http2.createServer({ maxHeaderSize: 262144 }, app);
 mainServer.timeout = 600000;
 mainServer.keepAliveTimeout = 600000;
 mainServer.headersTimeout = 600000;
-mainServer.listen(PUBLISHER_PORT, PUBLISHER_HOST, () => {
+mainServer.listen(PUBLISHER_PORT, PUBLISHER_HOST, async () => {
   const address = mainServer.address();
   logger.info(`Publisher server listening at http://${address.address}:${address.port}`);
   if (isDevelopment) {
     logger.info("Running in development mode - proxying to React dev server at http://localhost:5173");
   }
+  const watchEnvList = (process.env.PUBLISHER_WATCH || "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  if (watchEnvList.length > 0) {
+    if (watchEnvList.length > 1) {
+      logger.warn(`Multiple watch environments requested (${watchEnvList.join(", ")}); watch mode auto-reloads one at a time. Watching "${watchEnvList[0]}". The others are mounted in place (their source is live) but will not auto-reload. Pass a single --watch-env (or one PUBLISHER_WATCH value) to silence this.`);
+    }
+    const envName = watchEnvList[0];
+    try {
+      await environmentStore.finishedInitialization;
+      await watchModeController.ensureWatching(envName);
+      logger.info(`Watch mode active for environment "${envName}" (in-place mount, source-edit live reload).`);
+    } catch (error) {
+      logger.error(`Failed to start watch mode for environment "${envName}"`, { error });
+    }
+  }
 });
 var mcpServer = mcpApp.listen(MCP_PORT, PUBLISHER_HOST, () => {
   logger.info(`MCP server listening at http://${PUBLISHER_HOST}:${MCP_PORT}`);