@malloy-publisher/server 0.0.228 → 0.0.230

package/src/service/package.spec.ts

@@ -95,6 +95,44 @@ describe("service/package", () => {
       expect(pkg).toBeInstanceOf(Package);
    });
 
+   describe("per-package sandbox extension pinning", () => {
+      const originalPolicy = process.env.EXTENSION_FETCH_POLICY;
+      afterEach(() => {
+         if (originalPolicy === undefined) {
+            delete process.env.EXTENSION_FETCH_POLICY;
+         } else {
+            process.env.EXTENSION_FETCH_POLICY = originalPolicy;
+         }
+      });
+
+      it(
+         "pins autoinstall off on the :memory: sandbox under local-only",
+         async () => {
+            // Regression guard for the sandbox bypass: the per-package sandbox
+            // has no attached databases, so the environment attach paths never
+            // touch it. Under local-only its session must still be pinned
+            // against DuckDB's implicit auto-install, or a sandbox query
+            // referencing an unbaked extension could silently fetch from the
+            // CDN. Uses a spy (not a stub) so real DuckDB runs the pragma.
+            process.env.EXTENSION_FETCH_POLICY = "local-only";
+            const spy = sinon.spy(DuckDBConnection.prototype, "runSQL");
+            await Package.create(
+               "testProject",
+               "testPackage",
+               testPackageDirectory,
+               new Map(),
+            );
+            const issued = spy.getCalls().map((c) => String(c.args[0]));
+            expect(
+               issued.some((s) =>
+                  /autoinstall_known_extensions\s*=\s*false/i.test(s),
+               ),
+            ).toBe(true);
+         },
+         { timeout: 30000 },
+      );
+   });
+
    describe("instance methods", () => {
       describe("create", () => {
          it("should throw PackageNotFoundError if the package manifest does not exist", async () => {

package/src/service/package.ts

@@ -2,6 +2,7 @@ import * as fs from "fs/promises";
 import * as path from "path";
 
 import "@malloydata/db-duckdb/native";
+import { DuckDBConnection } from "@malloydata/db-duckdb";
 import {
    Connection,
    ConnectionRuntime,
@@ -27,8 +28,12 @@ import {
    PackageNotFoundError,
    ServiceUnavailableError,
 } from "../errors";
+import { applyExtensionSessionSettings } from "./connection";
 import { formatDuration, logger } from "../logger";
-import { recordBuildPlanComputeDuration } from "../materialization_metrics";
+import {
+   recordBuildPlanComputeDuration,
+   recordManifestBindDegraded,
+} from "../materialization_metrics";
 import {
    LOAD_DURATION_BUCKETS_MS,
    recordPackageLoadPhases,
@@ -42,7 +47,9 @@ import {
 } from "../storage/DatabaseInterface";
 import { errMessage, ignoreDotfiles } from "../utils";
 import { computePackageBuildPlan } from "./build_plan";
+import { CronEvaluator } from "./cron_evaluator";
 import { filterFreshManifest } from "./freshness";
+import { isQuotedIdentifierPath, quoteManifestTablePath } from "./quoting";
 import { Model } from "./model";
 import { assertPersistNamesQuoted } from "./persist_annotation_validation";
 
@@ -865,6 +872,20 @@ export class Package {
          }
       }
 
+      // Rule 4: the cron must be a valid 5-field UNIX expression (no L/W/#/?
+      // extensions — see CronEvaluator). Enforced here so publish (strict),
+      // PATCH (strict), package load (warn), and the standalone scheduler all
+      // apply the identical rule — a garbage cron can no longer pass publish
+      // and then silently never arm.
+      if (packageSchedule && !new CronEvaluator().isValid(packageSchedule)) {
+         warnings.push(
+            `materialization.schedule in ${PACKAGE_MANIFEST_NAME} is not a valid ` +
+               `5-field UNIX cron: ${JSON.stringify(packageSchedule)}. Use ` +
+               `"minute hour day-of-month month day-of-week" (no L/W/#/? ` +
+               `extensions).`,
+         );
+      }
+
       return warnings;
    }
 
@@ -928,6 +949,71 @@ export class Package {
       return this.malloyConfig.connections.lookupConnection(connectionName);
    }
 
+   /**
+    * Quote each manifest entry's physical table path for its connection's
+    * dialect, mirroring the build side: the builder CREATEs the table with
+    * {@link quoteTablePath} (per-segment, case-preserved), so on a case-folding
+    * engine (Snowflake uppercases unquoted identifiers) the stored name is only
+    * reachable through the same quoting. Malloy pastes a manifest `tableName`
+    * into `FROM` verbatim by contract (a bare name means "let the engine
+    * fold"), so the case-preserving producer — us — must hand it the quoted
+    * form. Same module quotes CREATE and read: the two sides cannot drift.
+    *
+    * A name already carrying a quote character is passed through verbatim (it
+    * is already canonical SQL; control-plane-assigned names are sanitized to
+    * `[A-Za-z0-9_\-.]` and can never contain one).
+    *
+    * Two cases bind verbatim, and they are NOT the same signal:
+    * - No `connectionName`: a bare/engine-folding producer that never recorded
+    *   a connection (simple_builder / malloy-cli). Expected and benign — the
+    *   pre-change behavior, bound silently, nothing regresses.
+    * - `connectionName` present but unresolvable: a genuine misconfiguration
+    *   (the connection was renamed/removed, or the manifest is out of sync with
+    *   this package's config). This one entry is degraded — but the source
+    *   would not serve regardless of quoting, since Malloy needs the connection
+    *   to run any query against it, so we degrade just this entry rather than
+    *   fail the whole package bind, and log at ERROR with a fix.
+    */
+   private async quoteBoundTableNames(
+      entries: FreshnessManifest,
+   ): Promise<FreshnessManifest> {
+      const out: FreshnessManifest = {};
+      for (const [sourceEntityId, entry] of Object.entries(entries)) {
+         let tableName = entry.tableName;
+         if (entry.connectionName && !isQuotedIdentifierPath(tableName)) {
+            try {
+               const connection = await this.getMalloyConnection(
+                  entry.connectionName,
+               );
+               tableName = quoteManifestTablePath(
+                  tableName,
+                  connection.dialectName,
+               );
+            } catch (err) {
+               recordManifestBindDegraded();
+               logger.error(
+                  `Manifest entry '${sourceEntityId}' names connection ` +
+                     `'${entry.connectionName}', which this package cannot ` +
+                     `resolve: binding its table path unquoted, so this source ` +
+                     `will not serve on a case-folding engine (and queries ` +
+                     `against it fail regardless, since Malloy needs the ` +
+                     `connection to run them). Fix: ensure a connection named ` +
+                     `'${entry.connectionName}' exists in this package's ` +
+                     `config, or rebuild the manifest against the current config.`,
+                  {
+                     packageName: this.packageName,
+                     sourceEntityId,
+                     connectionName: entry.connectionName,
+                     error: err instanceof Error ? err.message : String(err),
+                  },
+               );
+            }
+         }
+         out[sourceEntityId] = { ...entry, tableName };
+      }
+      return out;
+   }
+
    public getMalloyConfig(): MalloyConfig {
       return this.malloyConfig;
    }
@@ -956,6 +1042,11 @@ export class Package {
     * — the caller (manifest service) decides how to retry.
     */
    public async reloadAllModels(entries: FreshnessManifest): Promise<void> {
+      // Quote each bound physical name for its connection's dialect BEFORE any
+      // projection: everything downstream (model hydration, the per-query
+      // freshness gate, /compile, /status) reads the entries recorded here, so
+      // this is the one place the write side's quoting is mirrored onto reads.
+      entries = await this.quoteBoundTableNames(entries);
       // Models are hydrated against the tableName-only projection; the freshness
       // fields gate the serve path per query (via getFreshBuildManifest), not
       // model hydration.
@@ -1167,7 +1258,16 @@ export class Package {
       malloyConfig.wrapConnections((base) => ({
          lookupConnection: async (name?: string) => {
             if (!name || name === "duckdb") {
-               return base.lookupConnection(name);
+               const connection = await base.lookupConnection(name);
+               // The per-package :memory: sandbox is a Publisher-owned DuckDB
+               // session too. Pin it against implicit auto-install so
+               // EXTENSION_FETCH_POLICY covers it — otherwise local-only's
+               // no-network guarantee had a hole here (the sandbox has no
+               // attached databases, so the env attach paths never touch it).
+               if (connection instanceof DuckDBConnection) {
+                  await applyExtensionSessionSettings(connection);
+               }
+               return connection;
             }
             // Resolve against the *current* environment MalloyConfig so a
             // connection-generation swap on Environment propagates without a

package/src/service/package_quote_bound_tables.spec.ts

@@ -0,0 +1,171 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import sinon from "sinon";
+import type { Connection } from "@malloydata/malloy";
+import { logger } from "../logger";
+import type { FreshnessManifest } from "../storage/DatabaseInterface";
+import { Model } from "./model";
+import { Package } from "./package";
+
+// Unit coverage for Package.quoteBoundTableNames — the bind-time step that
+// mirrors the CREATE side's quoting onto manifest table paths (PR #904). The
+// integration test proves quote chars appear in real DuckDB SQL, but DuckDB is
+// not case-folding and never exhibited the bug; these tests pin the actual
+// quoted contract per dialect and exercise every branch (dialect selection,
+// no-connection passthrough, already-quoted passthrough, and the
+// unresolvable-connection fallback) without needing a live warehouse. The
+// quoting itself runs through the real `quoteTablePath`, so this is not a
+// re-implementation of the oracle — it drives the shipping code.
+describe("service/package quoteBoundTableNames", () => {
+   afterEach(() => sinon.restore());
+
+   function makePackage(): Package {
+      return new Package(
+         "testEnv",
+         "testPackage",
+         "/tmp/does-not-matter",
+         { name: "testPackage", description: "Test package" },
+         [],
+         new Map<string, Model>(),
+      );
+   }
+
+   // Reach the private method the same way package.spec.ts reaches private
+   // statics — this is the smallest seam that drives the real branch logic.
+   function quote(
+      pkg: Package,
+      entries: FreshnessManifest,
+   ): Promise<FreshnessManifest> {
+      // @ts-expect-error Accessing private method for testing
+      return pkg.quoteBoundTableNames(entries);
+   }
+
+   function stubDialect(pkg: Package, dialectName: string): void {
+      sinon
+         .stub(pkg, "getMalloyConnection")
+         .resolves({ dialectName } as Connection);
+   }
+
+   it("double-quotes each path segment for a case-folding dialect (Snowflake)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "snowflake");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.order_summary__g0", connectionName: "sf" },
+      });
+
+      expect(out.s1.tableName).toBe('"schema"."order_summary__g0"');
+      // connectionName and any other fields survive the rewrite.
+      expect(out.s1.connectionName).toBe("sf");
+   });
+
+   it("double-quotes for other double-quote dialects (Postgres)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "postgres");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "public.daily", connectionName: "pg" },
+      });
+
+      expect(out.s1.tableName).toBe('"public"."daily"');
+   });
+
+   it("backticks each segment for a backtick dialect (BigQuery)", async () => {
+      const pkg = makePackage();
+      stubDialect(pkg, "standardsql");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "my-proj.ds.events", connectionName: "bq" },
+      });
+
+      expect(out.s1.tableName).toBe("`my-proj`.`ds`.`events`");
+   });
+
+   it("binds verbatim when the producer recorded no connectionName", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.bare_builder_table" },
+      });
+
+      expect(out.s1.tableName).toBe("schema.bare_builder_table");
+      // No connection lookup attempted — this is the benign default path.
+      expect(spy.called).toBe(false);
+   });
+
+   it("passes an already-quoted name through without double-quoting", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: {
+            tableName: '"schema"."already_canonical"',
+            connectionName: "sf",
+         },
+      });
+
+      expect(out.s1.tableName).toBe('"schema"."already_canonical"');
+      expect(spy.called).toBe(false);
+   });
+
+   it("passes an already-backticked name through without re-quoting", async () => {
+      const pkg = makePackage();
+      const spy = sinon.stub(pkg, "getMalloyConnection");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "`ds`.`events`", connectionName: "bq" },
+      });
+
+      expect(out.s1.tableName).toBe("`ds`.`events`");
+      expect(spy.called).toBe(false);
+   });
+
+   it("degrades one entry (unquoted) and logs an actionable error when its connection is unresolvable", async () => {
+      const pkg = makePackage();
+      sinon
+         .stub(pkg, "getMalloyConnection")
+         .rejects(new Error("no connection named 'gone'"));
+      const errSpy = sinon.stub(logger, "error");
+
+      const out = await quote(pkg, {
+         s1: { tableName: "schema.orphaned", connectionName: "gone" },
+      });
+
+      // The one entry degrades to the unquoted name rather than throwing out
+      // of the loop and failing the whole package bind.
+      expect(out.s1.tableName).toBe("schema.orphaned");
+      // ...but the misconfiguration is a distinct, loud, actionable signal —
+      // not folded silently into the benign no-connection default.
+      expect(errSpy.calledOnce).toBe(true);
+      // winston's error() is overloaded, so widen the recorded args to assert
+      // the (message, context) contract this branch emits.
+      const [message, ctx] = errSpy.firstCall.args as unknown as [
+         string,
+         Record<string, unknown>,
+      ];
+      expect(message).toContain("gone");
+      expect(message).toContain("Fix:");
+      expect(ctx).toMatchObject({
+         sourceEntityId: "s1",
+         connectionName: "gone",
+      });
+   });
+
+   it("quotes resolvable entries and degrades an unresolvable one in the same bind", async () => {
+      const pkg = makePackage();
+      const lookup = sinon.stub(pkg, "getMalloyConnection");
+      lookup
+         .withArgs("sf")
+         .resolves({ dialectName: "snowflake" } as Connection);
+      lookup.withArgs("gone").rejects(new Error("missing"));
+      sinon.stub(logger, "error");
+
+      const out = await quote(pkg, {
+         good: { tableName: "schema.kept", connectionName: "sf" },
+         bad: { tableName: "schema.orphaned", connectionName: "gone" },
+      });
+
+      expect(out.good.tableName).toBe('"schema"."kept"');
+      expect(out.bad.tableName).toBe("schema.orphaned");
+   });
+});

package/src/service/persistence_policy.spec.ts

@@ -209,6 +209,37 @@ source: f is duckdb.sql("SELECT 1 as x")
       { timeout: 30000 },
    );
 
+   // ── Rule 4: the cron must be a valid 5-field UNIX expression ──────────
+
+   it(
+      "rejects an unparseable schedule cron",
+      async () => {
+         const pkg = await loadPackage(PLAIN_MODEL, {
+            scope: "version",
+            materialization: { schedule: "not a cron" },
+         });
+         const joined = pkg.formatInvalidPersistencePolicy();
+         expect(joined).toContain("valid");
+         expect(joined).toContain("UNIX cron");
+      },
+      { timeout: 30000 },
+   );
+
+   it(
+      "rejects a cron-parser extension the UNIX grammar lacks (L)",
+      async () => {
+         // Guards config-parity: cron-parser accepts `0 6 L * *` but the control
+         // plane's UNIX parser does not, so publish must reject it too rather
+         // than let it silently never arm in production.
+         const pkg = await loadPackage(PLAIN_MODEL, {
+            scope: "version",
+            materialization: { schedule: "0 6 L * *" },
+         });
+         expect(pkg.formatInvalidPersistencePolicy()).toContain("UNIX cron");
+      },
+      { timeout: 30000 },
+   );
+
    // ── inert when nothing is declared ────────────────────────────────────
 
    it(

package/src/service/quoting.spec.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from "bun:test";
-import { bareTableName, quoteIdentifier, quoteTablePath } from "./quoting";
+import {
+   bareTableName,
+   isQuotedIdentifierPath,
+   quoteIdentifier,
+   quoteManifestTablePath,
+   quoteTablePath,
+} from "./quoting";
 
 describe("bareTableName", () => {
    it("returns the segment after the last dot for a qualified name", () => {
@@ -77,3 +83,53 @@ describe("quoteTablePath", () => {
       expect(quoteTablePath("t_ab12_v0", "postgres")).toBe('"t_ab12_v0"');
    });
 });
+
+describe("isQuotedIdentifierPath", () => {
+   it("is false for a logical, unquoted path (the control-plane form)", () => {
+      expect(isQuotedIdentifierPath("schema.order_summary__g0")).toBe(false);
+      expect(isQuotedIdentifierPath("order_summary")).toBe(false);
+   });
+
+   it("is true once any segment carries a dialect quote char", () => {
+      expect(isQuotedIdentifierPath('"schema"."order_summary"')).toBe(true);
+      expect(isQuotedIdentifierPath("`ds`.`events`")).toBe(true);
+   });
+});
+
+// quoteManifestTablePath is the single quoting authority both the serve-side
+// bind and the build-side manifest route through. It runs the real
+// quoteTablePath (not a re-implementation), so this pins the exact per-dialect
+// contract that keeps read (a Malloy FROM) byte-identical to write (the CREATE
+// DDL, which also quotes via quoteTablePath) on every dialect — case-folding or
+// not.
+describe("quoteManifestTablePath", () => {
+   it("double-quotes each segment on a case-folding double-quote dialect (Snowflake)", () => {
+      expect(
+         quoteManifestTablePath("schema.order_summary__g0", "snowflake"),
+      ).toBe('"schema"."order_summary__g0"');
+   });
+
+   it("double-quotes on Postgres and DuckDB (unchanged for lowercase names, correct for mixed case)", () => {
+      expect(quoteManifestTablePath("public.daily", "postgres")).toBe(
+         '"public"."daily"',
+      );
+      expect(quoteManifestTablePath("main.orders_mz", "duckdb")).toBe(
+         '"main"."orders_mz"',
+      );
+   });
+
+   it("backticks each segment on BigQuery (standardsql) — required for hyphenated ids", () => {
+      expect(quoteManifestTablePath("my-proj.ds.events", "standardsql")).toBe(
+         "`my-proj`.`ds`.`events`",
+      );
+   });
+
+   it("passes an already-quoted name through unchanged (any dialect)", () => {
+      expect(quoteManifestTablePath('"schema"."already"', "snowflake")).toBe(
+         '"schema"."already"',
+      );
+      expect(quoteManifestTablePath("`ds`.`events`", "standardsql")).toBe(
+         "`ds`.`events`",
+      );
+   });
+});

package/src/service/quoting.ts

@@ -43,3 +43,36 @@ export function quoteTablePath(tableName: string, dialect: string): string {
       .map((segment) => quoteIdentifier(segment, dialect))
       .join(".");
 }
+
+/**
+ * Whether a table path already carries a dialect quote character, in which case
+ * it is treated as canonical SQL that must not be re-quoted. The single
+ * definition of "already quoted" shared by every bind site.
+ */
+export function isQuotedIdentifierPath(tableName: string): boolean {
+   return tableName.includes('"') || tableName.includes("`");
+}
+
+/**
+ * Quote a physical table path for a manifest entry so a Malloy `FROM` resolves
+ * it correctly, unless it is already canonical SQL (passed through unchanged).
+ * This is the single quoting authority for the two places a physical name is
+ * bound into a `FROM`: the serve-side bind ({@link Package.quoteBoundTableNames})
+ * and the build-side manifest that stitches chained persist sources together
+ * (materialization_service). Both must mirror the CREATE side's
+ * {@link quoteTablePath} so a case-folding engine (Snowflake uppercases
+ * unquoted identifiers) can resolve the case-preserved table the builder wrote.
+ *
+ * Passing an already-quoted name through is safe for the names this handles:
+ * control-plane physical names are logical/unquoted (never contain a quote),
+ * and a self-assigned `#@ persist name=` value is the author's own canonical
+ * SQL (they own quoting it for the dialect).
+ */
+export function quoteManifestTablePath(
+   tableName: string,
+   dialect: string,
+): string {
+   return isQuotedIdentifierPath(tableName)
+      ? tableName
+      : quoteTablePath(tableName, dialect);
+}

package/src/storage/DatabaseInterface.ts

@@ -59,6 +59,14 @@ export interface ResourceRepository {
       packageName: string,
       options?: { limit?: number; offset?: number },
    ): Promise<Materialization[]>;
+   listMaterializationsByEnvironment(
+      environmentId: string,
+      options?: { limit?: number; offset?: number },
+   ): Promise<Materialization[]>;
+   getLatestScheduledFireAt(
+      environmentId: string,
+      packageName: string,
+   ): Promise<Date | null>;
    getMaterializationById(id: string): Promise<Materialization | null>;
    getActiveMaterialization(
       environmentId: string,
@@ -174,6 +182,13 @@ export interface BuildManifest {
  */
 export interface FreshnessAwareManifestEntry {
    tableName: string;
+   /**
+    * The connection the physical table lives on, carried from the wire
+    * manifest so the bind step can quote `tableName` for that connection's
+    * dialect (see Package.quoteBoundTableNames). Absent on entries whose
+    * producer didn't record it; those bind verbatim.
+    */
+   connectionName?: string;
    dataAsOf?: string;
    freshnessWindowSeconds?: number;
    freshnessFallback?: "live" | "stale_ok" | "fail";

package/src/storage/duckdb/DuckDBRepository.ts

@@ -153,6 +153,23 @@ export class DuckDBRepository implements ResourceRepository {
       return this.materializationRepo.list(environmentId, packageName, options);
    }
 
+   async listMaterializationsByEnvironment(
+      environmentId: string,
+      options?: { limit?: number; offset?: number },
+   ): Promise<Materialization[]> {
+      return this.materializationRepo.listByEnvironment(environmentId, options);
+   }
+
+   async getLatestScheduledFireAt(
+      environmentId: string,
+      packageName: string,
+   ): Promise<Date | null> {
+      return this.materializationRepo.getLatestScheduledFireAt(
+         environmentId,
+         packageName,
+      );
+   }
+
    async getMaterializationById(id: string): Promise<Materialization | null> {
       return this.materializationRepo.getById(id);
    }