@malloy-publisher/server 0.0.204 → 0.0.206

package/src/service/authorize_integration.spec.ts

@@ -7,8 +7,8 @@ import path from "path";
 import { AccessDeniedError } from "../errors";
 import { Model } from "./model";
 
-// Introspection (PR1), compile-time validation (PR2), and the runtime gate
-// (PR3) for #(authorize) / ##(authorize).
+// Introspection, compile-time validation, and the runtime gate for
+// #(authorize) / ##(authorize).
 
 const TEST_DIR = path.join(os.tmpdir(), "authorize-integration-tests");
 const TEST_DB_DIR = path.join(TEST_DIR, "db");
@@ -277,6 +277,11 @@ source: gated is duckdb.table('customers')
       // Names the source and surfaces the underlying Malloy reason.
       expect(err?.message).toContain("gated");
       expect(err?.message).toMatch(/NOPE|not declared/i);
+      // Redaction policy (pinned): the model-load 424 is author-facing, so it
+      // KEEPS the full expression text (needed to fix a malformed annotation).
+      // Only the runtime 403 redacts to the source name. If this assertion ever
+      // flips, the redaction split was changed — make it a conscious decision.
+      expect(err?.message).toContain("$NOPE = 'x'");
    });
 
    it("fails model load when an expression references a source field", async () => {
@@ -836,3 +841,159 @@ source: joiner is duckdb.table('customers') extend {
       expect(result.data).toBeDefined();
    });
 });
+
+// The /compile path gates via Model.assertAuthorizedForText (early,
+// surface-syntax) and Model.assertAuthorizedForRunnable (compiled-source
+// backstop). These are the enforcement primitives environment.compileSource
+// calls; exercise them directly here.
+describe("authorize compile-path gate", () => {
+   const CP_GATE = `##! experimental.givens
+
+given:
+  ROLE :: string
+
+#(authorize) "$ROLE = 'analyst'"
+source: gated is duckdb.table('customers') extend { measure: c is count() }
+
+source: open_src is duckdb.table('customers') extend { measure: c is count() }
+`;
+   const CP_FILE_LEVEL = `##! experimental.givens
+
+given:
+  ROLE :: string
+
+##(authorize) "$ROLE = 'admin'"
+
+source: declared is duckdb.table('customers') extend { measure: c is count() }
+`;
+
+   async function cpModel(file: string, src: string): Promise<Model> {
+      await writeModel(file, src);
+      return Model.create("test-pkg", TEST_PKG_DIR, file, getConnections());
+   }
+
+   it("assertAuthorizedForText denies/allows a gated named source by its given", async () => {
+      const model = await cpModel("cp_gate.malloy", CP_GATE);
+      await expect(
+         model.assertAuthorizedForText("run: gated -> { aggregate: c }", {}),
+      ).rejects.toBeInstanceOf(AccessDeniedError);
+      await expect(
+         model.assertAuthorizedForText("run: gated -> { aggregate: c }", {
+            ROLE: "analyst",
+         }),
+      ).resolves.toBeUndefined();
+   });
+
+   it("assertAuthorizedForText leaves an ungated source unrestricted", async () => {
+      const model = await cpModel("cp_gate.malloy", CP_GATE);
+      await expect(
+         model.assertAuthorizedForText("run: open_src -> { aggregate: c }", {}),
+      ).resolves.toBeUndefined();
+   });
+
+   it("assertAuthorizedForText applies the model-wide file-level gate to inline/unnamed text", async () => {
+      const model = await cpModel("cp_file.malloy", CP_FILE_LEVEL);
+      // No named source the regex recognizes -> undefined -> file-level gate.
+      await expect(
+         model.assertAuthorizedForText(
+            `run: duckdb.sql("SELECT 1 AS x") -> { aggregate: n is count() }`,
+            {},
+         ),
+      ).rejects.toBeInstanceOf(AccessDeniedError);
+      await expect(
+         model.assertAuthorizedForText(
+            `run: duckdb.sql("SELECT 1 AS x") -> { aggregate: n is count() }`,
+            { ROLE: "admin" },
+         ),
+      ).resolves.toBeUndefined();
+   });
+
+   it("assertAuthorizedForRunnable gates the compiled-source structRef (alias backstop)", async () => {
+      const model = await cpModel("cp_gate.malloy", CP_GATE);
+      // Stub a runnable whose compiled query reads `gated` (e.g. via an alias
+      // the surface-syntax gate would miss).
+      const gatedRunnable = {
+         getPreparedQuery: async () => ({ _query: { structRef: "gated" } }),
+      };
+      await expect(
+         model.assertAuthorizedForRunnable(gatedRunnable, {}),
+      ).rejects.toBeInstanceOf(AccessDeniedError);
+      await expect(
+         model.assertAuthorizedForRunnable(gatedRunnable, { ROLE: "analyst" }),
+      ).resolves.toBeUndefined();
+      // Ungated compiled source -> unrestricted.
+      const openRunnable = {
+         getPreparedQuery: async () => ({ _query: { structRef: "open_src" } }),
+      };
+      await expect(
+         model.assertAuthorizedForRunnable(openRunnable, {}),
+      ).resolves.toBeUndefined();
+   });
+});
+
+// A given can be both a runtime query parameter (substituted into a view's
+// `where`) AND the subject of an `#(authorize)` gate on the same source. These
+// two layers compose: the gate fires first (before any filtering), and once it
+// passes the parameterized filter applies to the result. This is the layered
+// case the end-to-end story rests on.
+describe("authorize composes with given parameters", () => {
+   // `ROLE` gates access; `REGION` is a runtime filter parameter on the view.
+   const COMPOSED = `##! experimental.givens
+
+given:
+  ROLE :: string
+  REGION :: string
+
+#(authorize) "$ROLE = 'analyst'"
+source: regional is duckdb.table('customers') extend {
+  measure: c is count()
+  view: in_region is {
+    where: region = $REGION
+    aggregate: c
+  }
+}
+`;
+
+   async function runComposed(givens: Record<string, GivenValue>) {
+      await writeModel("compose.malloy", COMPOSED);
+      const model = await Model.create(
+         "test-pkg",
+         TEST_PKG_DIR,
+         "compose.malloy",
+         getConnections(),
+      );
+      return model.getQueryResults(
+         undefined,
+         undefined,
+         "run: regional -> in_region",
+         undefined,
+         undefined,
+         givens,
+      );
+   }
+
+   function countOf(compactResult: unknown): number {
+      const rows = compactResult as Array<Record<string, unknown>>;
+      return Number(rows[0]?.c);
+   }
+
+   it("denies before filtering when the gate fails, even with the filter given supplied", async () => {
+      await expect(runComposed({ REGION: "us-west" })).rejects.toBeInstanceOf(
+         AccessDeniedError,
+      );
+   });
+
+   it("applies the parameterized filter once the gate passes", async () => {
+      // Seed: one 'us-west' customer, one 'us-east'.
+      const west = await runComposed({ ROLE: "analyst", REGION: "us-west" });
+      expect(countOf(west.compactResult)).toBe(1);
+
+      const east = await runComposed({ ROLE: "analyst", REGION: "us-east" });
+      expect(countOf(east.compactResult)).toBe(1);
+
+      // A region matching no rows proves the given genuinely filters (not a
+      // gate-only pass-through).
+      const none = await runComposed({ ROLE: "analyst", REGION: "nowhere" });
+      expect(countOf(none.compactResult)).toBe(0);
+   });
+});

package/src/service/compile_authorize.spec.ts

@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import { AccessDeniedError } from "../errors";
+import { Environment } from "./environment";
+
+// End-to-end gate on the /compile path. Exercises environment.compileSource
+// through a real installed package, not just the Model primitives — pins that
+// the early gate AND the compiled-source backstop fire, the latter REGARDLESS of
+// includeSql (a compile-time schema oracle is closed even with no SQL extraction).
+
+const PUBLISHER_JSON = JSON.stringify({
+   name: "pkg",
+   description: "compile-gate",
+});
+
+// `gated` is locked to $ROLE='analyst'; `open_src` is unrestricted.
+const MODEL = `##! experimental.givens
+
+given:
+  ROLE :: string
+
+#(authorize) "$ROLE = 'analyst'"
+source: gated is duckdb.sql("SELECT 1 as x") extend { measure: c is count() }
+
+source: open_src is duckdb.sql("SELECT 1 as x") extend { measure: c is count() }
+`;
+
+describe("compile-path authorize gate (compileSource)", () => {
+   let rootDir: string;
+   let env: Environment;
+
+   beforeEach(async () => {
+      rootDir = await fs.mkdtemp(path.join(os.tmpdir(), "publisher-compile-"));
+      const envPath = path.join(rootDir, "env");
+      await fs.mkdir(envPath, { recursive: true });
+      env = await Environment.create("testEnv", envPath, []);
+      await env.installPackage("pkg", async (stagingPath) => {
+         await fs.mkdir(stagingPath, { recursive: true });
+         await fs.writeFile(
+            path.join(stagingPath, "publisher.json"),
+            PUBLISHER_JSON,
+         );
+         await fs.writeFile(path.join(stagingPath, "model.malloy"), MODEL);
+      });
+   });
+
+   afterEach(async () => {
+      await fs.rm(rootDir, { recursive: true, force: true }).catch(() => {});
+   });
+
+   const compile = (source: string, givens?: Record<string, string>) =>
+      env.compileSource("pkg", "model.malloy", source, false, givens);
+
+   it("denies a direct gated source without the satisfying given (early gate)", async () => {
+      await expect(
+         compile("run: gated -> { aggregate: c }"),
+      ).rejects.toBeInstanceOf(AccessDeniedError);
+   });
+
+   it("denies a gated source reached via the LAST run: statement (backstop, includeSql=false)", async () => {
+      // Regression guard: the early gate only matches the first `run:` (ungated
+      // open_src here), so the gated source in the executed final statement is
+      // caught only by the compiled-source backstop — which must run even when
+      // no SQL is requested.
+      await expect(
+         compile(
+            "run: open_src -> { aggregate: c }\nrun: gated -> { aggregate: c }",
+         ),
+      ).rejects.toBeInstanceOf(AccessDeniedError);
+   });
+
+   it("allows the gated source when the given satisfies the gate", async () => {
+      const { problems } = await compile("run: gated -> { aggregate: c }", {
+         ROLE: "analyst",
+      });
+      expect(problems).toBeDefined();
+   });
+
+   it("leaves an ungated source compilable without any given", async () => {
+      const { problems } = await compile("run: open_src -> { aggregate: c }");
+      expect(problems).toBeDefined();
+   });
+});

package/src/service/environment.ts

@@ -5,9 +5,16 @@ import { Mutex } from "async-mutex";
 import crypto from "crypto";
 import * as fs from "fs";
 import * as path from "path";
+import { pathToFileURL } from "url";
 import { components } from "../api";
-import { API_PREFIX, README_NAME } from "../constants";
 import {
+   API_PREFIX,
+   normalizeModelPath,
+   NOTEBOOK_FILE_SUFFIX,
+   README_NAME,
+} from "../constants";
+import {
+   BadRequestError,
    ConnectionNotFoundError,
    EnvironmentNotFoundError,
    PackageNotFoundError,
@@ -28,6 +35,7 @@ import {
    EnvironmentMalloyConfig,
    InternalConnection,
 } from "./connection";
+import { fetchManifestEntries } from "./manifest_loader";
 import { ApiConnection } from "./model";
 import { Package } from "./package";
 import type { PackageMemoryGovernor } from "./package_memory_governor";
@@ -137,6 +145,11 @@ export class Environment {
    // governor as the single owner of the back-pressure boolean.
    private memoryGovernor: PackageMemoryGovernor | null = null;
 
+   /** Absolute path on disk where this environment's package files live. */
+   public getEnvironmentPath(): string {
+      return this.environmentPath;
+   }
+
    constructor(
       environmentName: string,
       environmentPath: string,
@@ -181,10 +194,6 @@ export class Environment {
          await this.writeEnvironmentReadme(payload.readme);
       }
 
-      if (payload.materializationStorage !== undefined) {
-         this.metadata.materializationStorage = payload.materializationStorage;
-      }
-
       // Handle connections update
       // TODO: Update environment connections should have its own API endpoint
       if (payload.connections) {
@@ -290,6 +299,17 @@ export class Environment {
    ): Promise<{ problems: LogMessage[]; sql?: string }> {
       assertSafePackageName(packageName);
       assertSafeRelativeModelPath(modelName);
+      // /compile appends the submitted source to the TARGET MODEL's content for
+      // namespace context. A notebook (.malloynb) is markdown + cells, not a
+      // model, so compiling against it only yields a confusing parse error —
+      // reject it up front with an actionable message. (Notebooks remain public
+      // for discovery/query; this is specific to the compile context.)
+      if (modelName.endsWith(NOTEBOOK_FILE_SUFFIX)) {
+         throw new BadRequestError(
+            `Cannot compile against a notebook ("${modelName}"). ` +
+               `/compile takes a .malloy model path for namespace context.`,
+         );
+      }
       // Hold the per-package mutex for the duration of every disk read —
       // both the explicit `fs.readFile(modelPath)` below and the implicit
       // import resolution that `runtime.loadModel` does through the URL
@@ -307,10 +327,18 @@ export class Environment {
             packageName,
             modelName,
          );
-         // Place the virtual file in the model's directory so relative imports resolve correctly.
+         // Place the virtual file in the model's directory so relative imports
+         // resolve correctly. Use `pathToFileURL` rather than hand-prefixing
+         // `file://`: on Windows the latter produces a malformed URL
+         // (`file://D:\Temp\…`) that round-trips differently than the URL the
+         // Malloy runtime synthesizes from the same path, breaking the
+         // intercepting reader's string comparison below and falling through
+         // to disk for a virtual file that doesn't exist.
          const modelDir = path.dirname(modelPath);
-         const virtualUri = `file://${path.join(modelDir, "__compile_check.malloy")}`;
-         const virtualUrl = new URL(virtualUri);
+         const virtualUrl = pathToFileURL(
+            path.join(modelDir, "__compile_check.malloy"),
+         );
+         const virtualUri = virtualUrl.toString();
 
          // Read the full model file so the submitted source inherits the model's
          // complete namespace — imports, source definitions, queries, etc.
@@ -339,6 +367,29 @@ export class Environment {
          // Use the locked variant — we already hold the per-package mutex.
          const pkg = await this._loadOrGetPackageLocked(packageName);
 
+         // Authorize gate: /compile is compile-only, but it can still act
+         // as a schema oracle (a denied caller learns a gated source's columns
+         // from compile errors) and, with includeSql, leak its SQL. Gate the
+         // named source the submitted text targets BEFORE compiling — mirrors
+         // the query path's early surface-syntax gate. Unnamed/inline source
+         // text resolves to undefined, so only the model-wide file-level gate
+         // applies. The gate runs against the package's cached Model (its
+         // `given:` block + authorize annotations), independent of the virtual
+         // compile below. If the model isn't loaded, there's nothing to enforce
+         // and compilation surfaces its own error.
+         const gateModel = pkg.getModel(modelName);
+         if (gateModel) {
+            // Query boundary first (the *what* axis): /compile compiles ad-hoc
+            // text against a model, so gate it like an ad-hoc query — a
+            // non-`explores` model file, or text whose surface-resolved target
+            // is a non-curated model source (under queryableSources:
+            // "declared"), is rejected with a generic 404 before compilation
+            // can leak schema/SQL. Text the early gate can't pin is settled by
+            // the compiled backstop below.
+            gateModel.assertQueryBoundaryEarly(undefined, undefined, source);
+            await gateModel.assertAuthorizedForText(source, givens ?? {});
+         }
+
          // Initialize Runtime with the package's active MalloyConfig so compile
          // checks see the same package-scoped duckdb as execution. This runtime
          // borrows the package config; the package/environment lifecycle owns release.
@@ -352,11 +403,57 @@ export class Environment {
             const modelMaterializer = runtime.loadModel(virtualUrl);
             const model = await modelMaterializer.getModel();
 
+            // Resolve the final query's materializer once (if there is one).
+            let queryMaterializer: ReturnType<
+               typeof modelMaterializer.loadFinalQuery
+            > | null = null;
+            try {
+               queryMaterializer = modelMaterializer.loadFinalQuery();
+            } catch {
+               // No runnable query (e.g. only source definitions) — nothing to
+               // gate or extract beyond the early text gate already applied.
+            }
+
+            // Compiled-source backstops — run REGARDLESS of includeSql. They
+            // gate the source the COMPILED final query actually reads, closing
+            // named-query / multi-statement indirection the early surface-syntax
+            // gate misses (e.g. `run: ungated\nrun: gated` — the early gate only
+            // matches the FIRST `run:`, but the LAST statement is what executes).
+            // Compiling a gated source even without SQL is a schema oracle
+            // (field-not-found errors leak its columns), so this must not be
+            // conditional on SQL extraction. (A `source: x is gated` alias makes
+            // a new ungated source — that's the documented "extend doesn't
+            // inherit authorize" footgun, the same as the query path.)
+
+            // Boundary backstop (the *what* axis, 404) before the authorize
+            // one (the *who* axis, 403). /compile text is always ad-hoc — the
+            // early gate can only positively deny, never fully clear — so the
+            // compiled final query's run target is the authority. Self-gates
+            // internally (no-ops when the boundary is inert: "all" / no
+            // explores), so it is deliberately NOT guarded by hasAuthorize().
+            // Text that compiles only source definitions (no final query) has
+            // no run target and nothing to gate.
+            if (queryMaterializer && gateModel) {
+               await gateModel.assertQueryBoundaryForRunnable(
+                  queryMaterializer,
+                  source,
+               );
+            }
+
+            // Authorize backstop (the *who* axis, 403). Only run when the model
+            // declares gates so ungated compiles don't pay for the extra
+            // final-query compile.
+            if (queryMaterializer && gateModel?.hasAuthorize()) {
+               await gateModel.assertAuthorizedForRunnable(
+                  queryMaterializer,
+                  givens ?? {},
+               );
+            }
+
             // If includeSql is requested and compilation succeeded, attempt to extract SQL
             let sql: string | undefined;
-            if (includeSql) {
+            if (includeSql && queryMaterializer) {
                try {
-                  const queryMaterializer = modelMaterializer.loadFinalQuery();
                   sql = await queryMaterializer.getSQL({ givens });
                } catch {
                   // Source may not contain a runnable query (e.g. only source definitions),
@@ -734,6 +831,7 @@ export class Environment {
             packagePath,
             () => this.malloyConfig.malloyConfig,
          );
+         await this.bindManifestIfConfigured(_package);
          if (existingPackage !== undefined && reload) {
             this.retireConnectionGeneration(`package ${packageName}`, () =>
                existingPackage.getMalloyConfig().shutdown("close"),
@@ -839,6 +937,7 @@ export class Environment {
    public async installPackage(
       packageName: string,
       downloader: (stagingPath: string) => Promise<void>,
+      validate?: (pkg: Package) => string | undefined,
    ): Promise<Package> {
       assertSafePackageName(packageName);
       const stagingPath = this.allocateStagingPath(packageName);
@@ -905,6 +1004,15 @@ export class Environment {
                canonicalPath,
                () => this.malloyConfig.malloyConfig,
             );
+            // Strict-reject hook (publish/update only — reload passes no
+            // validator and stays fail-safe). Throw INSIDE the try so the
+            // catch below rolls the swap back: the just-installed tree is
+            // wiped and the retired tree (if any) is restored, so a rejected
+            // publish/update never leaves the bad tree served on disk.
+            const validationMsg = validate?.(newPackage);
+            if (validationMsg) {
+               throw new BadRequestError(validationMsg);
+            }
             logger.debug("install.phase2.committed", {
                environmentName: this.environmentName,
                packageName,
@@ -950,6 +1058,11 @@ export class Environment {
             throw err;
          }
 
+         // Best-effort manifest bind happens after the swap commits, outside the
+         // rollback window: a manifest that can't be fetched must not undo an
+         // otherwise-successful install (the package serves live instead).
+         await this.bindManifestIfConfigured(newPackage);
+
          this.packages.set(packageName, newPackage);
          this.setPackageStatus(packageName, PackageStatus.SERVING);
 
@@ -1004,6 +1117,47 @@ export class Environment {
       });
    }
 
+   /**
+    * If the freshly-loaded package declares a `manifestLocation`, fetch the
+    * control-plane-computed build manifest and rebind its models so persist
+    * references resolve to the materialized tables. Best-effort: a fetch/bind
+    * failure logs a warning and leaves the package serving live (the models are
+    * already loaded without a manifest). Callers must hold the package lock —
+    * this rebinds `pkg` in place rather than re-entering {@link withPackageLock}.
+    */
+   private async bindManifestIfConfigured(pkg: Package): Promise<void> {
+      const manifestLocation = pkg.getPackageMetadata().manifestLocation;
+      if (!manifestLocation) {
+         return;
+      }
+      await this.bindManifest(pkg, manifestLocation);
+   }
+
+   /** Fetch + bind a specific manifest URI onto an already-loaded package. */
+   private async bindManifest(
+      pkg: Package,
+      manifestLocation: string,
+   ): Promise<void> {
+      const packageName = pkg.getPackageName();
+      try {
+         const entries = await fetchManifestEntries(manifestLocation);
+         await pkg.reloadAllModels(entries);
+         logger.info("Bound build manifest to package", {
+            environmentName: this.environmentName,
+            packageName,
+            manifestLocation,
+            entryCount: Object.keys(entries).length,
+         });
+      } catch (err) {
+         logger.warn("Failed to bind build manifest; serving live", {
+            environmentName: this.environmentName,
+            packageName,
+            manifestLocation,
+            error: err instanceof Error ? err.message : String(err),
+         });
+      }
+   }
+
    /**
     * Read a model's source text from disk, holding the per-package mutex
     * so the read is serialized against {@link installPackage} /
@@ -1028,7 +1182,13 @@ export class Environment {
 
    private async writePackageManifest(
       packageName: string,
-      metadata: { name: string; description?: string },
+      metadata: {
+         name: string;
+         description?: string;
+         explores?: string[];
+         queryableSources?: "declared" | "all";
+         manifestLocation?: string | null;
+      },
    ): Promise<void> {
       const packagePath = safeJoinUnderRoot(this.environmentPath, packageName);
       const manifestPath = safeJoinUnderRoot(packagePath, "publisher.json");
@@ -1043,11 +1203,23 @@ export class Environment {
             logger.warn(`Could not read manifest for ${packageName}`);
          }
 
-         // Update with new metadata
+         // Update with new metadata. `explores`/`queryableSources` are only
+         // overwritten when the caller explicitly provides them; otherwise the
+         // existing on-disk value is preserved via the spread (an undefined here
+         // must not erase it).
          const updatedManifest = {
             ...existingManifest,
             name: metadata.name,
             description: metadata.description,
+            ...(metadata.explores !== undefined
+               ? { explores: metadata.explores }
+               : {}),
+            ...(metadata.queryableSources !== undefined
+               ? { queryableSources: metadata.queryableSources }
+               : {}),
+            ...(metadata.manifestLocation !== undefined
+               ? { manifestLocation: metadata.manifestLocation }
+               : {}),
          };
 
          // Write back to file
@@ -1074,18 +1246,72 @@ export class Environment {
          if (body.name) {
             _package.setName(body.name);
          }
+         // Preserve `explores` across a metadata PATCH. `setPackageMetadata`
+         // replaces the whole object, so a name/description-only update must
+         // carry the existing discovery surface through — otherwise the
+         // in-memory `explores` is wiped and `listModels()` silently starts
+         // serving every model until the next reload. When the body explicitly
+         // carries `explores`, honor the new set instead.
+         const existing = _package.getPackageMetadata();
+         // Normalize API-body explores through the same helper the worker uses
+         // for on-disk explores, so `["./index.malloy"]` / backslash paths
+         // validate and persist identically regardless of input channel (no
+         // misleading publish-time 400, no publish-vs-reload divergence).
+         const normalizedExplores = body.explores?.map(normalizeModelPath);
+         const explores =
+            normalizedExplores !== undefined
+               ? normalizedExplores
+               : existing.explores;
+         const queryableSources =
+            body.queryableSources !== undefined
+               ? body.queryableSources
+               : existing.queryableSources;
+         // Preserve the existing manifestLocation unless the body explicitly
+         // sets it (including to null, which clears it and reverts to live).
+         const manifestLocation =
+            body.manifestLocation !== undefined
+               ? body.manifestLocation
+               : existing.manifestLocation;
          _package.setPackageMetadata({
             name: body.name,
             description: body.description,
             resource: body.resource,
             location: body.location,
+            explores,
+            queryableSources,
+            manifestLocation,
          });
 
+         // Strict-reject, symmetric with the publish path
+         // (package.controller.addPackage): validate the resulting explores
+         // against the live model set and restore the prior metadata before
+         // rejecting, so a bad update neither persists nor mutates the served
+         // surface.
+         const invalidMsg = _package.formatInvalidExplores();
+         if (invalidMsg) {
+            _package.setPackageMetadata(existing);
+            throw new BadRequestError(invalidMsg);
+         }
+
          await this.writePackageManifest(packageName, {
             name: packageName,
             description: body.description,
+            explores: normalizedExplores,
+            queryableSources: body.queryableSources,
+            manifestLocation: body.manifestLocation,
          });
 
+         // When the body changes manifestLocation, apply it now so the new
+         // binding takes effect without a separate reload: a URI rebinds models
+         // to the materialized tables; null/empty reverts the package to live.
+         if (body.manifestLocation !== undefined) {
+            if (body.manifestLocation) {
+               await this.bindManifest(_package, body.manifestLocation);
+            } else {
+               await _package.reloadAllModels({});
+            }
+         }
+
          return _package.getPackageMetadata();
       });
    }
@@ -1187,6 +1413,38 @@ export class Environment {
       });
    }
 
+   /**
+    * Evict a package from the in-memory caches WITHOUT touching its on-disk
+    * directory — the non-destructive counterpart to {@link deletePackage}.
+    *
+    * Used to roll back a no-location `addPackage` (which registers a
+    * *pre-existing*, user-owned directory) when post-load validation rejects
+    * it: deleting the tree there would destroy content the publisher never
+    * created. This still drains and closes the connections the just-created
+    * `Package` opened, so the duckdb handle isn't leaked.
+    */
+   public async unloadPackage(packageName: string): Promise<void> {
+      assertSafePackageName(packageName);
+      return this.withPackageLock(packageName, async () => {
+         const _package = this.packages.get(packageName);
+         if (!_package) {
+            return;
+         }
+         if (
+            this.packageStatuses.get(packageName)?.status ===
+            PackageStatus.SERVING
+         ) {
+            this.setPackageStatus(packageName, PackageStatus.UNLOADING);
+         }
+         // Same 30s connection drain as deletePackage — just no fs rename/rm.
+         this.retireConnectionGeneration(`package ${packageName}`, () =>
+            _package.getMalloyConfig().shutdown("close"),
+         );
+         this.packages.delete(packageName);
+         this.packageStatuses.delete(packageName);
+      });
+   }
+
    public updateConnections(
       malloyConfig: EnvironmentMalloyConfig,
       _apiConnections?: ApiConnection[],