@malloy-publisher/server 0.0.228 → 0.0.229

package/src/service/materialization_service.ts

@@ -14,13 +14,13 @@ import {
    MaterializationMode,
    recordAutoLoadOutcome,
    recordDropTables,
+   recordManifestBindDegraded,
    recordMaterializationRun,
    recordSourceBuildDuration,
    recordSourcesOutcome,
 } from "../materialization_metrics";
 import {
    BuildInstruction,
-   BuildManifest,
    BuildManifestResult,
    BuildPlan,
    FreshnessManifest,
@@ -41,7 +41,12 @@ import {
    iterGraphSources,
 } from "./build_plan";
 import { EnvironmentStore } from "./environment_store";
-import { bareTableName, quoteIdentifier, quoteTablePath } from "./quoting";
+import {
+   bareTableName,
+   quoteIdentifier,
+   quoteManifestTablePath,
+   quoteTablePath,
+} from "./quoting";
 import { resolveEnvironmentId } from "./resolve_environment";
 
 /**
@@ -177,6 +182,38 @@ export class MaterializationService {
       );
    }
 
+   /**
+    * Every materialization across all packages in an environment, newest first.
+    * Each record carries its `packageName`, so an env-scoped view can group or
+    * label by package without a per-package fan-out.
+    */
+   async listEnvironmentMaterializations(
+      environmentName: string,
+      options?: { limit?: number; offset?: number },
+   ): Promise<Materialization[]> {
+      const environmentId = await this.resolveEnvironmentId(environmentName);
+      return this.repository.listMaterializationsByEnvironment(
+         environmentId,
+         options,
+      );
+   }
+
+   /**
+    * `created_at` of the newest scheduler-fired materialization for a package,
+    * or null if none. The standalone scheduler uses this on its first arm to
+    * recover a fire missed during downtime (see MaterializationScheduler.arm).
+    */
+   async getLatestScheduledFireAt(
+      environmentName: string,
+      packageName: string,
+   ): Promise<Date | null> {
+      const environmentId = await this.resolveEnvironmentId(environmentName);
+      return this.repository.getLatestScheduledFireAt(
+         environmentId,
+         packageName,
+      );
+   }
+
    async getMaterialization(
       environmentName: string,
       packageName: string,
@@ -219,6 +256,13 @@ export class MaterializationService {
          buildInstructions?: BuildInstruction[];
          referenceManifest?: ManifestReference[];
          strictUpstreams?: boolean;
+         /**
+          * What initiated this run. `ON_DEMAND` (default) = a manual/API create;
+          * `SCHEDULER` = the standalone materialization scheduler firing a
+          * package's `materialization.schedule` cron. Recorded on the run
+          * metadata so a scheduled rebuild is distinguishable from a manual one.
+          */
+         trigger?: "ON_DEMAND" | "SCHEDULER";
       } = {},
    ): Promise<Materialization> {
       const environmentId = await this.resolveEnvironmentId(environmentName);
@@ -244,10 +288,12 @@ export class MaterializationService {
       }
 
       const forceRefresh = options.forceRefresh ?? false;
+      const trigger = options.trigger ?? "ON_DEMAND";
       const metadata = {
          forceRefresh,
          sourceNames: options.sourceNames ?? null,
          mode: orchestrated ? "orchestrated" : "auto",
+         trigger,
       };
 
       let created: Materialization;
@@ -280,6 +326,7 @@ export class MaterializationService {
                buildInstructions,
                referenceManifest: options.referenceManifest,
                strictUpstreams: options.strictUpstreams,
+               trigger,
             },
             signal,
          ),
@@ -306,6 +353,7 @@ export class MaterializationService {
          buildInstructions: BuildInstruction[] | undefined;
          referenceManifest: ManifestReference[] | undefined;
          strictUpstreams: boolean | undefined;
+         trigger: "ON_DEMAND" | "SCHEDULER";
       },
       signal: AbortSignal,
    ): Promise<void> {
@@ -379,6 +427,7 @@ export class MaterializationService {
             forceRefresh: opts.forceRefresh,
             sourceNames: opts.sourceNames ?? null,
             mode,
+            trigger: opts.trigger,
             sourcesBuilt,
             sourcesReused,
             durationMs,
@@ -466,9 +515,13 @@ export class MaterializationService {
    /**
     * Project the caller-supplied upstream reference manifest into the seed
     * entry map `executeInstructedBuild` consumes. Each reference is keyed by the
-    * compiler's manifest-lookup sourceEntityId and carries only the physical
-    * table name — enough for the build Manifest to resolve a downstream persist
-    * reference to the existing table without rebuilding the upstream.
+    * compiler's manifest-lookup sourceEntityId and carries the physical table
+    * name plus the connection it lives on — enough for the build Manifest to
+    * resolve a downstream persist reference to the existing table, and to quote
+    * that reference for the connection's dialect so it resolves on a
+    * case-folding engine (see {@link quoteSeedTablePath}). `connectionName` is
+    * optional on the wire: an older control plane that omits it seeds unquoted,
+    * exactly as before.
     */
    private referenceManifestToEntries(
       referenceManifest: ManifestReference[] | undefined,
@@ -478,6 +531,7 @@ export class MaterializationService {
          entries[ref.sourceEntityId] = {
             sourceEntityId: ref.sourceEntityId,
             physicalTableName: ref.physicalTableName,
+            connectionName: ref.connectionName,
          };
       }
       return entries;
@@ -524,11 +578,17 @@ export class MaterializationService {
       // stamps freshness (dataAsOf/window/fallback) on the wire manifest it
       // distributes, not on this in-memory post-build load, so these sources are
       // bound un-gated (always serve the freshly-built table).
-      const manifestEntries: BuildManifest["entries"] = {};
+      const manifestEntries: FreshnessManifest = {};
       for (const [sourceEntityId, entry] of Object.entries(entries)) {
          if (entry.physicalTableName) {
             manifestEntries[sourceEntityId] = {
                tableName: entry.physicalTableName,
+               // Carried so the bind step can quote the physical path for the
+               // connection's dialect (Package.quoteBoundTableNames) — the
+               // build CREATEd it quoted, so an unquoted read would miss on a
+               // case-folding engine in the window before the control plane's
+               // wire-manifest rebind.
+               connectionName: entry.connectionName,
             };
          }
       }
@@ -586,6 +646,43 @@ export class MaterializationService {
       }
    }
 
+   /**
+    * Quote a seeded upstream's physical path for the in-memory build Manifest,
+    * mirroring the CREATE side ({@link quoteManifestTablePath}) so a downstream
+    * persist source resolves the reference on a case-folding engine. The seed's
+    * own connection (carried on the entry) supplies the dialect. If it can't be
+    * resolved — an older control plane omitted `connectionName`, or the named
+    * connection isn't part of this build — the path binds unquoted: the build
+    * then fails loudly at the downstream CREATE on a case-folding engine (a
+    * self-signaling miss, unlike the serve path), and is unaffected elsewhere.
+    */
+   private quoteSeedTablePath(
+      sourceEntityId: string,
+      physicalTableName: string,
+      connectionName: string | undefined,
+      connections: Map<string, MalloyConnection>,
+   ): string {
+      const connection = connectionName
+         ? connections.get(connectionName)
+         : undefined;
+      if (!connection) {
+         // A named-but-absent connection is a real gap (the seed can't be
+         // quoted); a missing name is the benign older-CP default. Only the
+         // former is worth a signal.
+         if (connectionName) {
+            recordManifestBindDegraded();
+            logger.warn(
+               "Seeded upstream names a connection not present in this build; " +
+                  "leaving its manifest path unquoted (a downstream build will " +
+                  "fail on a case-folding engine)",
+               { sourceEntityId, connectionName },
+            );
+         }
+         return physicalTableName;
+      }
+      return quoteManifestTablePath(physicalTableName, connection.dialectName);
+   }
+
    /**
     * Shared build loop for both auto-run and orchestrated builds. Seeds the
     * manifest with carried-forward (reused) upstream entries so downstream
@@ -630,8 +727,19 @@ export class MaterializationService {
       const entries: Record<string, ManifestEntry> = {};
       for (const [sourceEntityId, entry] of Object.entries(seedEntries)) {
          if (entry.physicalTableName) {
+            // The build Manifest feeds a downstream persist's `FROM` verbatim,
+            // so a seeded upstream must carry the SAME quoting the builder
+            // CREATEd it with — else the downstream CREATE misses the
+            // case-preserved table on a case-folding engine. The seed keeps its
+            // logical (unquoted) name in `entries` (the committed manifest, in
+            // logical-name space); only the in-memory build Manifest is quoted.
             manifest.update(sourceEntityId, {
-               tableName: entry.physicalTableName,
+               tableName: this.quoteSeedTablePath(
+                  sourceEntityId,
+                  entry.physicalTableName,
+                  entry.connectionName,
+                  connections,
+               ),
             });
          }
          entries[sourceEntityId] = entry;
@@ -733,7 +841,12 @@ export class MaterializationService {
       }
 
       // Make this table visible to downstream sources built later in this run.
-      manifest.update(sourceEntityId, { tableName: physicalTableName });
+      // Record the SAME quoted path the CREATE used (not the logical name): the
+      // build Manifest is pasted into a downstream `FROM` verbatim, so on a
+      // case-folding engine an unquoted name would miss the case-preserved table
+      // just written. The returned entry (below) keeps the logical name for the
+      // committed manifest; only this in-memory build Manifest is quoted.
+      manifest.update(sourceEntityId, { tableName: quotedPhysical });
 
       const durationMs = Math.round(performance.now() - startTime);
       recordSourceBuildDuration(durationMs);

package/src/service/materialization_test_fixtures.ts

@@ -120,6 +120,12 @@ export function fakeSource(opts: {
    freshnessSchedule?: FakeFreshnessSchedule;
    /** Model-file-level (`##`) freshness default. */
    modelFreshnessSchedule?: FakeFreshnessSchedule;
+   /**
+    * Spy on the args Malloy's SQL generation is handed — chiefly the
+    * `buildManifest` that resolves upstream persist references — so a test can
+    * assert what physical name a downstream build sees for its upstream.
+    */
+   onGetSQL?: (sqlOpts: unknown) => void;
 }): PersistSource {
    const fields = opts.annotationFields;
    return {
@@ -128,7 +134,10 @@ export function fakeSource(opts: {
       connectionName: opts.connectionName ?? "duckdb",
       dialectName: opts.dialectName ?? "duckdb",
       makeBuildId: () => opts.sourceEntityId,
-      getSQL: () => opts.sql ?? "SELECT 1",
+      getSQL: (sqlOpts?: unknown) => {
+         opts.onGetSQL?.(sqlOpts);
+         return opts.sql ?? "SELECT 1";
+      },
       annotations: {
          parseAsTag: () => ({
             tag: fakeTag(fields, opts.freshnessSchedule),

package/src/service/package.ts

@@ -28,7 +28,10 @@ import {
    ServiceUnavailableError,
 } from "../errors";
 import { formatDuration, logger } from "../logger";
-import { recordBuildPlanComputeDuration } from "../materialization_metrics";
+import {
+   recordBuildPlanComputeDuration,
+   recordManifestBindDegraded,
+} from "../materialization_metrics";
 import {
    LOAD_DURATION_BUCKETS_MS,
    recordPackageLoadPhases,
@@ -42,7 +45,9 @@ import {
 } from "../storage/DatabaseInterface";
 import { errMessage, ignoreDotfiles } from "../utils";
 import { computePackageBuildPlan } from "./build_plan";
+import { CronEvaluator } from "./cron_evaluator";
 import { filterFreshManifest } from "./freshness";
+import { isQuotedIdentifierPath, quoteManifestTablePath } from "./quoting";
 import { Model } from "./model";
 import { assertPersistNamesQuoted } from "./persist_annotation_validation";
 
@@ -865,6 +870,20 @@ export class Package {
          }
       }
 
+      // Rule 4: the cron must be a valid 5-field UNIX expression (no L/W/#/?
+      // extensions — see CronEvaluator). Enforced here so publish (strict),
+      // PATCH (strict), package load (warn), and the standalone scheduler all
+      // apply the identical rule — a garbage cron can no longer pass publish
+      // and then silently never arm.
+      if (packageSchedule && !new CronEvaluator().isValid(packageSchedule)) {
+         warnings.push(
+            `materialization.schedule in ${PACKAGE_MANIFEST_NAME} is not a valid ` +
+               `5-field UNIX cron: ${JSON.stringify(packageSchedule)}. Use ` +
+               `"minute hour day-of-month month day-of-week" (no L/W/#/? ` +
+               `extensions).`,
+         );
+      }
+
       return warnings;
    }
 
@@ -928,6 +947,71 @@ export class Package {
       return this.malloyConfig.connections.lookupConnection(connectionName);
    }
 
+   /**
+    * Quote each manifest entry's physical table path for its connection's
+    * dialect, mirroring the build side: the builder CREATEs the table with
+    * {@link quoteTablePath} (per-segment, case-preserved), so on a case-folding
+    * engine (Snowflake uppercases unquoted identifiers) the stored name is only
+    * reachable through the same quoting. Malloy pastes a manifest `tableName`
+    * into `FROM` verbatim by contract (a bare name means "let the engine
+    * fold"), so the case-preserving producer — us — must hand it the quoted
+    * form. Same module quotes CREATE and read: the two sides cannot drift.
+    *
+    * A name already carrying a quote character is passed through verbatim (it
+    * is already canonical SQL; control-plane-assigned names are sanitized to
+    * `[A-Za-z0-9_\-.]` and can never contain one).
+    *
+    * Two cases bind verbatim, and they are NOT the same signal:
+    * - No `connectionName`: a bare/engine-folding producer that never recorded
+    *   a connection (simple_builder / malloy-cli). Expected and benign — the
+    *   pre-change behavior, bound silently, nothing regresses.
+    * - `connectionName` present but unresolvable: a genuine misconfiguration
+    *   (the connection was renamed/removed, or the manifest is out of sync with
+    *   this package's config). This one entry is degraded — but the source
+    *   would not serve regardless of quoting, since Malloy needs the connection
+    *   to run any query against it, so we degrade just this entry rather than
+    *   fail the whole package bind, and log at ERROR with a fix.
+    */
+   private async quoteBoundTableNames(
+      entries: FreshnessManifest,
+   ): Promise<FreshnessManifest> {
+      const out: FreshnessManifest = {};
+      for (const [sourceEntityId, entry] of Object.entries(entries)) {
+         let tableName = entry.tableName;
+         if (entry.connectionName && !isQuotedIdentifierPath(tableName)) {
+            try {
+               const connection = await this.getMalloyConnection(
+                  entry.connectionName,
+               );
+               tableName = quoteManifestTablePath(
+                  tableName,
+                  connection.dialectName,
+               );
+            } catch (err) {
+               recordManifestBindDegraded();
+               logger.error(
+                  `Manifest entry '${sourceEntityId}' names connection ` +
+                     `'${entry.connectionName}', which this package cannot ` +
+                     `resolve: binding its table path unquoted, so this source ` +
+                     `will not serve on a case-folding engine (and queries ` +
+                     `against it fail regardless, since Malloy needs the ` +
+                     `connection to run them). Fix: ensure a connection named ` +
+                     `'${entry.connectionName}' exists in this package's ` +
+                     `config, or rebuild the manifest against the current config.`,
+                  {
+                     packageName: this.packageName,
+                     sourceEntityId,
+                     connectionName: entry.connectionName,
+                     error: err instanceof Error ? err.message : String(err),
+                  },
+               );
+            }
+         }
+         out[sourceEntityId] = { ...entry, tableName };
+      }
+      return out;
+   }
+
    public getMalloyConfig(): MalloyConfig {
       return this.malloyConfig;
    }
@@ -956,6 +1040,11 @@ export class Package {
     * — the caller (manifest service) decides how to retry.
     */
    public async reloadAllModels(entries: FreshnessManifest): Promise<void> {
+      // Quote each bound physical name for its connection's dialect BEFORE any
+      // projection: everything downstream (model hydration, the per-query
+      // freshness gate, /compile, /status) reads the entries recorded here, so
+      // this is the one place the write side's quoting is mirrored onto reads.
+      entries = await this.quoteBoundTableNames(entries);
       // Models are hydrated against the tableName-only projection; the freshness
       // fields gate the serve path per query (via getFreshBuildManifest), not
       // model hydration.

package/src/service/package_quote_bound_tables.spec.ts

@@ -0,0 +1,171 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import sinon from "sinon";
+import type { Connection } from "@malloydata/malloy";
+import { logger } from "../logger";
+import type { FreshnessManifest } from "../storage/DatabaseInterface";
+import { Model } from "./model";
+import { Package } from "./package";
+
+// Unit coverage for Package.quoteBoundTableNames — the bind-time step that
+// mirrors the CREATE side's quoting onto manifest table paths (PR #904). The
+// integration test proves quote chars appear in real DuckDB SQL, but DuckDB is
+// not case-folding and never exhibited the bug; these tests pin the actual
+// quoted contract per dialect and exercise every branch (dialect selection,
+// no-connection passthrough, already-quoted passthrough, and the
+// unresolvable-connection fallback) without needing a live warehouse. The
+// quoting itself runs through the real `quoteTablePath`, so this is not a
+// re-implementation of the oracle — it drives the shipping code.
+describe("service/package quoteBoundTableNames", () => {
+   afterEach(() => sinon.restore());
+
+   function makePackage(): Package {
+      return new Package(
+         "testEnv",
+         "testPackage",
+         "/tmp/does-not-matter",
+         { name: "testPackage", description: "Test package" },
+         [],
+         new Map<string, Model>(),
+      );
+   }
+
+   // Reach the private method the same way package.spec.ts reaches private
+   // statics — this is the smallest seam that drives the real branch logic.
+   function quote(
+      pkg: Package,
+      entries: FreshnessManifest,
+   ): Promise<FreshnessManifest> {
+      // @ts-expect-error Accessing private method for testing
+      return pkg.quoteBoundTableNames(entries);
+   }
+
+   function stubDialect(pkg: Package, dialectName: string): void {
+      sinon
+         .stub(pkg, "getMalloyConnection")
+         .resolves({ dialectName } as Connection);
+   }
+
+   it("double-quotes each path segment for a case-folding dialect (Snowflake)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "snowflake");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.order_summary__g0", connectionName: "sf" },
+      });
+
+      expect(out.s1.tableName).toBe('"schema"."order_summary__g0"');
+      // connectionName and any other fields survive the rewrite.
+      expect(out.s1.connectionName).toBe("sf");
+   });
+
+   it("double-quotes for other double-quote dialects (Postgres)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "postgres");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "public.daily", connectionName: "pg" },
+      });
+
+      expect(out.s1.tableName).toBe('"public"."daily"');
+   });
+
+   it("backticks each segment for a backtick dialect (BigQuery)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "standardsql");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "my-proj.ds.events", connectionName: "bq" },
+      });
+
+      expect(out.s1.tableName).toBe("`my-proj`.`ds`.`events`");
+   });
+
+   it("binds verbatim when the producer recorded no connectionName", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.bare_builder_table" },
+      });
+
+      expect(out.s1.tableName).toBe("schema.bare_builder_table");
+      // No connection lookup attempted — this is the benign default path.
+      expect(spy.called).toBe(false);
+   });
+
+   it("passes an already-quoted name through without double-quoting", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: {
+            tableName: '"schema"."already_canonical"',
+            connectionName: "sf",
+         },
+      });
+
+      expect(out.s1.tableName).toBe('"schema"."already_canonical"');
+      expect(spy.called).toBe(false);
+   });
+
+   it("passes an already-backticked name through without re-quoting", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "`ds`.`events`", connectionName: "bq" },
+      });
+
+      expect(out.s1.tableName).toBe("`ds`.`events`");
+      expect(spy.called).toBe(false);
+   });
+
+   it("degrades one entry (unquoted) and logs an actionable error when its connection is unresolvable", async () => {
+      const pkg = makePackage();
+      sinon
+         .stub(pkg, "getMalloyConnection")
+         .rejects(new Error("no connection named 'gone'"));
+      const errSpy = sinon.stub(logger, "error");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.orphaned", connectionName: "gone" },
+      });
+
+      // The one entry degrades to the unquoted name rather than throwing out
+      // of the loop and failing the whole package bind.
+      expect(out.s1.tableName).toBe("schema.orphaned");
+      // ...but the misconfiguration is a distinct, loud, actionable signal —
+      // not folded silently into the benign no-connection default.
+      expect(errSpy.calledOnce).toBe(true);
+      // winston's error() is overloaded, so widen the recorded args to assert
+      // the (message, context) contract this branch emits.
+      const [message, ctx] = errSpy.firstCall.args as unknown as [
+         string,
+         Record<string, unknown>,
+      ];
+      expect(message).toContain("gone");
+      expect(message).toContain("Fix:");
+      expect(ctx).toMatchObject({
+         sourceEntityId: "s1",
+         connectionName: "gone",
+      });
+   });
+
+   it("quotes resolvable entries and degrades an unresolvable one in the same bind", async () => {
+      const pkg = makePackage();
+      const lookup = sinon.stub(pkg, "getMalloyConnection");
+      lookup
+         .withArgs("sf")
+         .resolves({ dialectName: "snowflake" } as Connection);
+      lookup.withArgs("gone").rejects(new Error("missing"));
+      sinon.stub(logger, "error");
+
+      const out = await quote(pkg, {
+         good: { tableName: "schema.kept", connectionName: "sf" },
+         bad: { tableName: "schema.orphaned", connectionName: "gone" },
+      });
+
+      expect(out.good.tableName).toBe('"schema"."kept"');
+      expect(out.bad.tableName).toBe("schema.orphaned");
+   });
+});

package/src/service/persistence_policy.spec.ts

@@ -209,6 +209,37 @@ source: f is duckdb.sql("SELECT 1 as x")
       { timeout: 30000 },
    );
 
+   // ── Rule 4: the cron must be a valid 5-field UNIX expression ──────────
+
+   it(
+      "rejects an unparseable schedule cron",
+      async () => {
+         const pkg = await loadPackage(PLAIN_MODEL, {
+            scope: "version",
+            materialization: { schedule: "not a cron" },
+         });
+         const joined = pkg.formatInvalidPersistencePolicy();
+         expect(joined).toContain("valid");
+         expect(joined).toContain("UNIX cron");
+      },
+      { timeout: 30000 },
+   );
+
+   it(
+      "rejects a cron-parser extension the UNIX grammar lacks (L)",
+      async () => {
+         // Guards config-parity: cron-parser accepts `0 6 L * *` but the control
+         // plane's UNIX parser does not, so publish must reject it too rather
+         // than let it silently never arm in production.
+         const pkg = await loadPackage(PLAIN_MODEL, {
+            scope: "version",
+            materialization: { schedule: "0 6 L * *" },
+         });
+         expect(pkg.formatInvalidPersistencePolicy()).toContain("UNIX cron");
+      },
+      { timeout: 30000 },
+   );
+
    // ── inert when nothing is declared ────────────────────────────────────
 
    it(

package/src/service/quoting.spec.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from "bun:test";
-import { bareTableName, quoteIdentifier, quoteTablePath } from "./quoting";
+import {
+   bareTableName,
+   isQuotedIdentifierPath,
+   quoteIdentifier,
+   quoteManifestTablePath,
+   quoteTablePath,
+} from "./quoting";
 
 describe("bareTableName", () => {
    it("returns the segment after the last dot for a qualified name", () => {
@@ -77,3 +83,53 @@ describe("quoteTablePath", () => {
       expect(quoteTablePath("t_ab12_v0", "postgres")).toBe('"t_ab12_v0"');
    });
 });
+
+describe("isQuotedIdentifierPath", () => {
+   it("is false for a logical, unquoted path (the control-plane form)", () => {
+      expect(isQuotedIdentifierPath("schema.order_summary__g0")).toBe(false);
+      expect(isQuotedIdentifierPath("order_summary")).toBe(false);
+   });
+
+   it("is true once any segment carries a dialect quote char", () => {
+      expect(isQuotedIdentifierPath('"schema"."order_summary"')).toBe(true);
+      expect(isQuotedIdentifierPath("`ds`.`events`")).toBe(true);
+   });
+});
+
+// quoteManifestTablePath is the single quoting authority both the serve-side
+// bind and the build-side manifest route through. It runs the real
+// quoteTablePath (not a re-implementation), so this pins the exact per-dialect
+// contract that keeps read (a Malloy FROM) byte-identical to write (the CREATE
+// DDL, which also quotes via quoteTablePath) on every dialect — case-folding or
+// not.
+describe("quoteManifestTablePath", () => {
+   it("double-quotes each segment on a case-folding double-quote dialect (Snowflake)", () => {
+      expect(
+         quoteManifestTablePath("schema.order_summary__g0", "snowflake"),
+      ).toBe('"schema"."order_summary__g0"');
+   });
+
+   it("double-quotes on Postgres and DuckDB (unchanged for lowercase names, correct for mixed case)", () => {
+      expect(quoteManifestTablePath("public.daily", "postgres")).toBe(
+         '"public"."daily"',
+      );
+      expect(quoteManifestTablePath("main.orders_mz", "duckdb")).toBe(
+         '"main"."orders_mz"',
+      );
+   });
+
+   it("backticks each segment on BigQuery (standardsql) — required for hyphenated ids", () => {
+      expect(quoteManifestTablePath("my-proj.ds.events", "standardsql")).toBe(
+         "`my-proj`.`ds`.`events`",
+      );
+   });
+
+   it("passes an already-quoted name through unchanged (any dialect)", () => {
+      expect(quoteManifestTablePath('"schema"."already"', "snowflake")).toBe(
+         '"schema"."already"',
+      );
+      expect(quoteManifestTablePath("`ds`.`events`", "standardsql")).toBe(
+         "`ds`.`events`",
+      );
+   });
+});