@malloy-publisher/server 0.0.229 → 0.0.230

package/dist/server.mjs

@@ -147403,6 +147403,8 @@ function internalErrorToHttpError(error) {
     return httpError(404, error.message);
   } else if (error instanceof ConnectionAuthError) {
     return httpError(422, error.message);
+  } else if (error instanceof UnsupportedCatalogFormatError) {
+    return httpError(422, error.message);
   } else if (error instanceof ModelCompilationError) {
     return httpError(424, error.message);
   } else if (error instanceof ConnectionError) {
@@ -147432,7 +147434,7 @@ function httpError(code, message) {
     }
   };
 }
-var NotImplementedError, BadRequestError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, ConnectionNotFoundError, ConnectionError, ConnectionAuthError, ModelCompilationError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, QueryTimeoutError;
+var NotImplementedError, BadRequestError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, ConnectionNotFoundError, ConnectionError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   NotImplementedError = class NotImplementedError extends Error {
@@ -147475,6 +147477,11 @@ var init_errors = __esm(() => {
       super(message);
     }
   };
+  UnsupportedCatalogFormatError = class UnsupportedCatalogFormatError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
   ModelCompilationError = class ModelCompilationError extends Error {
     constructor(error) {
       super(error.message);
@@ -244084,6 +244091,16 @@ var getMaxConcurrentQueries = () => {
   }
   return raw;
 };
+var getExtensionFetchPolicy = () => {
+  const raw = process.env.EXTENSION_FETCH_POLICY;
+  if (raw === undefined || raw.trim() === "")
+    return "on-demand";
+  const normalised = raw.trim().toLowerCase();
+  if (normalised === "on-demand" || normalised === "local-only") {
+    return normalised;
+  }
+  throw new Error(`Invalid value for EXTENSION_FETCH_POLICY: expected "on-demand" or "local-only", got "${raw}"`);
+};
 function substituteEnvVars(value) {
   const envVarPattern = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
   return value.replace(envVarPattern, (_match, varName) => {
@@ -247757,9 +247774,68 @@ var {
 } = axios_default;
 
 // src/service/connection.ts
-init_logger();
 import fs2 from "fs/promises";
 
+// src/ducklake_version.ts
+var MIN_CATALOG_FORMAT = "1.0";
+var ENGINE_MAX_FORMAT = [{ engine: { major: 1, minor: 5 }, maxFormat: "1.0" }];
+var CATALOG_FORMAT_RE = /^(\d+)\.(\d+)(?:-([0-9A-Za-z.]+))?$/;
+function parseCatalogFormat(raw) {
+  if (typeof raw !== "string")
+    return null;
+  const m = CATALOG_FORMAT_RE.exec(raw);
+  if (!m)
+    return null;
+  const format = { major: Number(m[1]), minor: Number(m[2]) };
+  if (m[3] !== undefined)
+    format.prerelease = m[3];
+  return format;
+}
+function compareCatalogFormat(a, b) {
+  if (a.major !== b.major)
+    return a.major < b.major ? -1 : 1;
+  if (a.minor !== b.minor)
+    return a.minor < b.minor ? -1 : 1;
+  if (a.prerelease === b.prerelease)
+    return 0;
+  if (a.prerelease === undefined)
+    return 1;
+  if (b.prerelease === undefined)
+    return -1;
+  return a.prerelease < b.prerelease ? -1 : 1;
+}
+function parseEngineMajorMinor(raw) {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(String(raw));
+  if (!m)
+    return null;
+  return { major: Number(m[1]), minor: Number(m[2]) };
+}
+function catalogFormatRangeForEngine(engineVersion) {
+  const e = parseEngineMajorMinor(engineVersion);
+  if (!e)
+    return null;
+  const entry = ENGINE_MAX_FORMAT.find((r) => r.engine.major === e.major && r.engine.minor === e.minor);
+  if (!entry)
+    return null;
+  return {
+    min: MIN_CATALOG_FORMAT,
+    max: entry.maxFormat,
+    engineVersion: `${e.major}.${e.minor}`
+  };
+}
+function isCatalogFormatInRange(format, range) {
+  const f = parseCatalogFormat(format);
+  const min = parseCatalogFormat(range.min);
+  const max = parseCatalogFormat(range.max);
+  if (!f || !min || !max)
+    return false;
+  return compareCatalogFormat(f, min) >= 0 && compareCatalogFormat(f, max) <= 0;
+}
+
+// src/service/connection.ts
+init_errors();
+init_logger();
+
 // src/pg_helpers.ts
 function redactPgSecrets(s) {
   return s.replace(/password=('[^']*'|"[^"]*"|\S+)/gi, "password=***");
@@ -247951,7 +248027,12 @@ function openSshProxy(ssh, target) {
 }
 
 // src/service/connection_config.ts
-var PROXIED_SSLMODES = ["disable", "no-verify", "verify-ca"];
+var PROXIED_SSLMODES = [
+  "disable",
+  "no-verify",
+  "verify-ca",
+  "verify-full"
+];
 var PUBLISHER_DUCKDB_API_FIELDS = new Set(["attachedDatabases"]);
 function normalizeSnowflakePrivateKey(privateKey) {
   let privateKeyContent = privateKey.trim();
@@ -248436,16 +248517,55 @@ function validateAndBuildTrinoCoreConfig(trinoConfig) {
 }
 
 // src/service/connection.ts
+var extensionSessionPinned = new WeakSet;
+async function applyExtensionSessionSettings(connection, {
+  alwaysDisableAutoinstall = false
+} = {}) {
+  const policy = getExtensionFetchPolicy();
+  const disableAutoinstall = alwaysDisableAutoinstall || policy === "local-only";
+  if (!disableAutoinstall || extensionSessionPinned.has(connection)) {
+    return;
+  }
+  try {
+    await connection.runSQL("SET autoinstall_known_extensions=false;");
+    await connection.runSQL("SET autoload_known_extensions=true;");
+    extensionSessionPinned.add(connection);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    if (policy === "local-only") {
+      throw new Error(`Failed to disable DuckDB implicit extension auto-install under ` + `EXTENSION_FETCH_POLICY=local-only; refusing to open a session that ` + `could still fetch from the network. Underlying error: ${detail}`);
+    }
+    logger.warn("Failed to pin DuckDB extension session settings", {
+      error: detail
+    });
+  }
+}
 async function installAndLoadExtension(connection, extensionName, fromCommunity = false) {
+  const policy = getExtensionFetchPolicy();
+  if (policy === "on-demand") {
+    try {
+      const installCommand = fromCommunity ? `INSTALL ${extensionName} FROM community;` : `INSTALL ${extensionName};`;
+      await connection.runSQL(installCommand);
+      logger.info(`${extensionName} extension installed`);
+    } catch (error) {
+      logger.info(`${extensionName} extension already installed or install skipped`, { error });
+    }
+  }
   try {
-    const installCommand = fromCommunity ? `FORCE INSTALL '${extensionName}' FROM community;` : `INSTALL ${extensionName};`;
-    await connection.runSQL(installCommand);
-    logger.info(`${extensionName} extension installed`);
+    await connection.runSQL(`LOAD ${extensionName};`);
+    logger.info(`${extensionName} extension loaded`);
   } catch (error) {
-    logger.info(`${extensionName} extension already installed or install skipped`, { error });
+    if (policy === "local-only") {
+      const detail = error instanceof Error ? error.message : String(error);
+      logger.warn("DuckDB extension unavailable under local-only policy", {
+        extension: extensionName,
+        policy,
+        error: detail
+      });
+      throw new Error(`DuckDB extension '${extensionName}' is not available locally and ` + `EXTENSION_FETCH_POLICY=local-only forbids fetching it. Bake the ` + `'${extensionName}' extension into the image (or a pre-populated ` + `~/.duckdb/extensions directory), or set ` + `EXTENSION_FETCH_POLICY=on-demand to allow fetching missing ` + `extensions on first use. Underlying LOAD error: ${detail}`);
+    }
+    throw error;
   }
-  await connection.runSQL(`LOAD ${extensionName};`);
-  logger.info(`${extensionName} extension loaded`);
 }
 async function isDatabaseAttached(connection, dbName) {
   try {
@@ -248617,7 +248737,67 @@ async function attachPostgres(connection, attachedDb) {
   await connection.runSQL(attachCommand);
   logger.info(`Successfully attached PostgreSQL database: ${attachedDb.name}`);
 }
+function runSQLRows(result) {
+  if (Array.isArray(result))
+    return result;
+  const rows = result.rows;
+  return Array.isArray(rows) ? rows : [];
+}
+var ducklakePreflightSeq = 0;
+async function preflightDuckLakeCatalogFormat(connection, dbName, pgConnString) {
+  const tempDb = `${dbName}_fmt_preflight_${++ducklakePreflightSeq}`;
+  let catalogFormat;
+  try {
+    await connection.runSQL(`ATTACH '${escapeSQL(pgConnString)}' AS ${tempDb} (TYPE postgres, READ_ONLY);`);
+    const result = await connection.runSQL(`SELECT value FROM ${tempDb}.ducklake_metadata WHERE key = 'version' LIMIT 1;`);
+    const value = runSQLRows(result)[0]?.value;
+    catalogFormat = typeof value === "string" ? value : undefined;
+  } catch (error) {
+    logger.warn("DuckLake catalog-format preflight read failed; falling back to ATTACH", {
+      dbName,
+      error: redactPgSecrets(error instanceof Error ? error.message : String(error))
+    });
+    return;
+  } finally {
+    try {
+      await connection.runSQL(`DETACH ${tempDb};`);
+    } catch {}
+  }
+  if (!catalogFormat) {
+    return;
+  }
+  let engineVersion = "";
+  try {
+    const versionResult = await connection.runSQL("SELECT version() AS v;");
+    engineVersion = String(runSQLRows(versionResult)[0]?.v ?? "");
+  } catch (error) {
+    logger.warn("DuckLake catalog-format preflight: could not read engine version; skipping", {
+      dbName,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return;
+  }
+  const range = catalogFormatRangeForEngine(engineVersion);
+  if (!range) {
+    logger.warn("DuckLake catalog-format preflight: engine not covered by the format matrix; skipping", { dbName, engineVersion });
+    return;
+  }
+  if (!isCatalogFormatInRange(catalogFormat, range)) {
+    logger.warn("DuckLake catalog format outside supported range; rejecting", {
+      dbName,
+      catalogFormat,
+      supportedMin: range.min,
+      supportedMax: range.max,
+      engineVersion: range.engineVersion
+    });
+    throw new UnsupportedCatalogFormatError(`DuckLake catalog '${dbName}' has format version ${catalogFormat}, ` + `which is outside the range this Publisher supports ` + `(${range.min} ≤ format ≤ ${range.max}). The DuckLake ` + `extension bundled with DuckDB v${range.engineVersion} attaches only ` + `catalogs in that range without migration. Migrate the catalog to a ` + `supported format (see the DuckLake catalog-migration docs at ` + `https://ducklake.select/docs), or run a Publisher built against a ` + `DuckDB engine whose supported range includes ${catalogFormat}.`);
+  }
+  logger.info(`DuckLake catalog '${dbName}' format ${catalogFormat} is within supported range ` + `${range.min}..${range.max} (engine v${range.engineVersion})`);
+}
 async function attachDuckLake(connection, dbName, ducklakeConfig) {
+  await applyExtensionSessionSettings(connection, {
+    alwaysDisableAutoinstall: true
+  });
   await installAndLoadExtension(connection, "ducklake");
   await installAndLoadExtension(connection, "postgres");
   await installAndLoadExtension(connection, "aws");
@@ -248650,6 +248830,7 @@ async function attachDuckLake(connection, dbName, ducklakeConfig) {
   logger.info(`Final escaped connection string: ${redactPgSecrets(escapedPgConnString)}`);
   const escapedBucketUrl = escapeSQL(ducklakeConfig.storage.bucketUrl);
   logger.info(`escapedBucketUrl: ${escapedBucketUrl}`);
+  await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString);
   const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true, READ_ONLY true);`;
   logger.info(`Attaching DuckLake database using command: ${redactPgSecrets(attachCommand)}`);
   try {
@@ -248815,6 +248996,7 @@ async function attachDatabasesToDuckDB(duckdbConnection, attachedDatabases) {
     s3: attachCloudStorage,
     azure: attachAzureStorage
   };
+  await applyExtensionSessionSettings(duckdbConnection);
   const hasAzure = attachedDatabases.some((db) => db.type === "azure");
   if (hasAzure) {
     await installAndLoadExtension(duckdbConnection, "azure");
@@ -249001,8 +249183,17 @@ function buildProxiedSslQuery(name, sslmode) {
       }
       return `?uselibpqcompat=true&sslmode=verify-ca&sslrootcert=${encodeURIComponent(caBundle)}`;
     default:
-      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${mode}' (expected disable | no-verify | verify-ca).`);
+      throw new Error(`Connection proxy on '${name}' has unsupported sslmode '${mode}' (expected disable | no-verify | verify-ca; verify-full is applied via the ssl object in resolveProxiedTls, not this query).`);
+  }
+}
+function resolveProxiedTls(name, host, sslmode) {
+  if (sslmode === "verify-full") {
+    if (!host) {
+      throw new Error(`Connection proxy on '${name}' uses sslmode 'verify-full' but has no host to verify against.`);
+    }
+    return { query: "", ssl: { servername: host, rejectUnauthorized: true } };
   }
+  return { query: buildProxiedSslQuery(name, sslmode) };
 }
 function buildProxiedPostgresConnection(metadata, endpoint) {
   const name = metadata.apiConnection.name;
@@ -249013,11 +249204,12 @@ function buildProxiedPostgresConnection(metadata, endpoint) {
   const enc = encodeURIComponent;
   const auth = pg.userName ? `${enc(pg.userName)}${pg.password ? `:${enc(pg.password)}` : ""}@` : "";
   const db = pg.databaseName ? `/${enc(pg.databaseName)}` : "";
-  const ssl = buildProxiedSslQuery(name, pg.sslmode);
-  const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${ssl}`;
+  const { query, ssl } = resolveProxiedTls(name, pg.host, pg.sslmode);
+  const connectionString = `postgresql://${auth}${endpoint.host}:${endpoint.port}${db}${query}`;
   return new PooledPostgresConnection({
     name,
     connectionString,
+    ...ssl ? { ssl } : {},
     poolMin: 1,
     poolMax: 20
   });
@@ -249140,7 +249332,11 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
     return {
       lookupConnection: async (name) => {
         const metadata = getMetadataForLookup(assembled.metadata, name);
-        return applyConnectionFingerprint(await resolveConnection(name, metadata), metadata);
+        const connection = await resolveConnection(name, metadata);
+        if (isDuckDBConnection(connection)) {
+          await applyExtensionSessionSettings(connection);
+        }
+        return applyConnectionFingerprint(connection, metadata);
       }
     };
   });
@@ -258062,6 +258258,7 @@ async function fetchManifestEntries(uri) {
 import * as fs6 from "fs/promises";
 import * as path7 from "path";
 import"@malloydata/db-duckdb/native";
+import { DuckDBConnection as DuckDBConnection3 } from "@malloydata/db-duckdb";
 import {
   ConnectionRuntime,
   contextOverlay as contextOverlay2,
@@ -258073,8 +258270,8 @@ import {
 init_package_load_pool();
 init_constants();
 init_errors();
-init_logger();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
+init_logger();
 
 // src/package_load_metrics.ts
 var LOAD_DURATION_BUCKETS_MS = [
@@ -258135,6 +258332,10 @@ import {
   Annotations as Annotations2,
   API,
   FixedConnectionMap,
+  isBasicArray,
+  isJoined,
+  isRepeatedRecord,
+  isSourceDef as isSourceDef2,
   MalloyConfig as MalloyConfig2,
   MalloyError as MalloyError2,
   modelDefToModelInfo,
@@ -258245,24 +258446,95 @@ function annotationTexts(annote) {
 init_errors();
 var SOURCE_PREFIX = "#(authorize)";
 var FILE_PREFIX = "##(authorize)";
-function buildAuthorizeProbe(exprs) {
+function buildAuthorizeProbe(exprs, givenDecls = []) {
   const selects = exprs.map((expr, i) => `__auth_${i} is (${expr})`).join(`
       `);
-  return `run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
+  const givenBlock = givenDecls.length > 0 ? `given:
+${givenDecls.map((g) => `  ${g.name} :: ${g.type}`).join(`
+`)}
+
+` : "";
+  return `${givenBlock}run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
     select:
       ${selects}
     limit: 1
   }`;
 }
+var GIVEN_REF_PATTERN = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
+var STRING_LITERAL_PATTERN = /'(?:\\.|[^'\\])*'/g;
+function referencedGivenNames(expr) {
+  const scanned = expr.replace(STRING_LITERAL_PATTERN, "''");
+  const names = [];
+  const seen = new Set;
+  for (const match of scanned.matchAll(GIVEN_REF_PATTERN)) {
+    const name = match[1];
+    if (!seen.has(name)) {
+      seen.add(name);
+      names.push(name);
+    }
+  }
+  return names;
+}
+function inferGivenType(value) {
+  if (typeof value === "string")
+    return "string";
+  if (typeof value === "number" || typeof value === "bigint")
+    return "number";
+  if (typeof value === "boolean")
+    return "boolean";
+  if (value instanceof Date)
+    return "timestamp";
+  if (Array.isArray(value)) {
+    if (value.length === 0)
+      return null;
+    const elementType = inferGivenType(value[0]);
+    return elementType ? `${elementType}[]` : null;
+  }
+  return null;
+}
+function bindProbeGivens(expr, givens, declaredTypes) {
+  const decls = [];
+  const bound = {};
+  for (const name of referencedGivenNames(expr)) {
+    if (!(name in givens))
+      continue;
+    const value = givens[name];
+    const type = declaredTypes?.get(name) ?? inferGivenType(value);
+    if (!type)
+      continue;
+    decls.push({ name, type });
+    bound[name] = value;
+  }
+  return { decls, bound };
+}
 function isProbeTrue(cell) {
   return cell === true || cell === 1 || cell === "true";
 }
-async function evaluateAuthorize(executor, exprs, givens) {
+async function runProbe(executor, probeText, givens) {
+  const result = await executor.loadQuery(probeText).run({ rowLimit: 1, givens });
+  const row = result?.data?.value?.[0];
+  return !!(row && isProbeTrue(row.__auth_0));
+}
+async function evaluateAuthorize(executor, exprs, givens, declaredTypes, options) {
+  const selfContainedFirst = options?.selfContainedFirst ?? false;
   for (const expr of exprs) {
+    if (selfContainedFirst) {
+      if (await evaluateSelfContainedFirst(executor, expr, givens, declaredTypes)) {
+        return true;
+      }
+      continue;
+    }
+    try {
+      if (await runProbe(executor, buildAuthorizeProbe([expr]), givens)) {
+        return true;
+      }
+      continue;
+    } catch {}
     try {
-      const result = await executor.loadQuery(buildAuthorizeProbe([expr])).run({ rowLimit: 1, givens });
-      const row = result?.data?.value?.[0];
-      if (row && isProbeTrue(row.__auth_0)) {
+      const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
+      if (decls.length === 0)
+        continue;
+      if (await runProbe(executor, buildAuthorizeProbe([expr], decls), bound)) {
         return true;
       }
     } catch {
@@ -258271,6 +258543,29 @@ async function evaluateAuthorize(executor, exprs, givens) {
   }
   return false;
 }
+async function evaluateSelfContainedFirst(executor, expr, givens, declaredTypes) {
+  const referenced = referencedGivenNames(expr);
+  if (referenced.length === 0) {
+    try {
+      return await runProbe(executor, buildAuthorizeProbe([expr]), {});
+    } catch {
+      return false;
+    }
+  }
+  const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
+  if (decls.length !== referenced.length) {
+    return false;
+  }
+  try {
+    return await runProbe(executor, buildAuthorizeProbe([expr], decls), bound);
+  } catch {
+    try {
+      return await runProbe(executor, buildAuthorizeProbe([expr]), givens);
+    } catch {
+      return false;
+    }
+  }
+}
 async function validateAuthorizeProbes(compiler, sources) {
   for (const source of sources) {
     const exprs = source.authorize;
@@ -258665,6 +258960,9 @@ function extractQueriesFromModelDef(modelDef) {
 
 // src/service/model.ts
 var MALLOY_VERSION = createRequire2(import.meta.url)("@malloydata/malloy/package.json").version;
+function isRecordOrArrayField(field) {
+  return field.type === "record" || isBasicArray(field) || isRepeatedRecord(field);
+}
 function quoteMalloyIdentifier(name) {
   return "`" + (name ?? "").replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
 }
@@ -258685,6 +258983,7 @@ class Model {
   filterMap;
   givens;
   fileLevelAuthorize = [];
+  authorizeReferencedGivenNames = new Set;
   discoveryCurationEnabled = false;
   queryBoundary = { mode: "all", exploresDeclared: false, isQueryEntryPoint: true };
   freshnessResolver;
@@ -258712,6 +259011,11 @@ class Model {
     } catch {
       this.fileLevelAuthorize = [];
     }
+    try {
+      this.authorizeReferencedGivenNames = this.computeAuthorizeReferencedGivenNames();
+    } catch {
+      this.authorizeReferencedGivenNames = new Set;
+    }
     this.modelInfo = modelInfo ?? (this.modelDef ? modelDefToModelInfo(this.modelDef) : undefined);
     if (this.filterMap.size > 0) {
       logger.warn(`Model "${packageName}/${modelPath}" uses deprecated #(filter) annotations. Migrate to given: — see https://github.com/malloydata/publisher/blob/main/docs/givens.md`, {
@@ -258724,9 +259028,45 @@ class Model {
   getFilters(sourceName) {
     return this.filterMap.get(sourceName) ?? [];
   }
+  givenDeclaredTypes() {
+    return new Map((this.givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
+  }
   getAuthorize(sourceName) {
     return this.sources?.find((source) => source.name === sourceName)?.authorize ?? [];
   }
+  filterGivensToModelSurface(givens) {
+    if (!givens)
+      return givens;
+    const surfaceNames = new Set((this.givens ?? []).map((g) => g.name));
+    const filtered = {};
+    for (const [name, value] of Object.entries(givens)) {
+      const authorizeOnly = !surfaceNames.has(name) && this.authorizeReferencedGivenNames.has(name);
+      if (!authorizeOnly)
+        filtered[name] = value;
+    }
+    return filtered;
+  }
+  computeAuthorizeReferencedGivenNames() {
+    const names = new Set;
+    const addExprs = (exprs) => {
+      for (const expr of exprs) {
+        for (const name of referencedGivenNames(expr))
+          names.add(name);
+      }
+    };
+    addExprs(this.fileLevelAuthorize);
+    const modelDef = this.modelDef;
+    if (!modelDef)
+      return names;
+    for (const entry of Object.values(modelDef.contents)) {
+      if (!isSourceDef2(entry))
+        continue;
+      for (const { exprs } of this.collectAllReachableGates(entry, modelDef, new Set)) {
+        addExprs(exprs);
+      }
+    }
+    return names;
+  }
   hasAuthorize() {
     return this.fileLevelAuthorize.length > 0 || (this.sources?.some((s) => (s.authorize?.length ?? 0) > 0) ?? false);
   }
@@ -258737,10 +259077,11 @@ class Model {
     return this.fileLevelAuthorize;
   }
   async assertAuthorized(sourceName, givens) {
-    const exprs = this.effectiveAuthorizeFor(sourceName);
+    await this.assertAuthorizedExprs(sourceName ?? "(query)", this.effectiveAuthorizeFor(sourceName), givens);
+  }
+  async assertAuthorizedExprs(label, exprs, givens, selfContainedFirst = false) {
     if (exprs.length === 0)
       return;
-    const label = sourceName ?? "(query)";
     const deny = () => {
       throw new AccessDeniedError(`Access denied for source "${label}".`);
     };
@@ -258748,7 +259089,7 @@ class Model {
       deny();
     let passed = false;
     try {
-      passed = await evaluateAuthorize(this.modelMaterializer, exprs, givens);
+      passed = await evaluateAuthorize(this.modelMaterializer, exprs, givens, this.givenDeclaredTypes(), { selfContainedFirst });
     } catch (err) {
       logger.debug("Authorize probe failed; denying", {
         sourceName: label,
@@ -258760,11 +259101,155 @@ class Model {
     if (!passed)
       deny();
   }
+  async assertAuthorizedForAllSources(runnable, givens) {
+    const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
+    await this.assertAuthorized(ownSourceName, givens);
+    const { struct, modelDef, compositeResolvedSourceDef, extendSources } = await this.resolveRunTargetStruct(runnable);
+    const seen = new Set;
+    const joinedGates = this.collectAllReachableGates(struct, modelDef, seen, true);
+    if (modelDef) {
+      const runTargetLabel = ownSourceName ?? "(run target)";
+      for (const field of extendSources) {
+        const { resolved, denyGate } = this.classifyJoinedField(field, runTargetLabel);
+        if (denyGate) {
+          joinedGates.push(denyGate);
+          continue;
+        }
+        if (!resolved)
+          continue;
+        joinedGates.push(...this.collectAllReachableGates(resolved, modelDef, seen));
+      }
+    }
+    if (compositeResolvedSourceDef && modelDef) {
+      joinedGates.push(...this.collectAllReachableGates(compositeResolvedSourceDef, modelDef, seen, true));
+    }
+    for (const { label, exprs, selfContained } of joinedGates) {
+      await this.assertAuthorizedExprs(label, exprs, givens, selfContained);
+    }
+  }
+  async resolveRunTargetStruct(runnable) {
+    try {
+      const prepared = await runnable.getPreparedQuery();
+      const modelDef = prepared._modelDef ?? this.modelDef;
+      if (!modelDef)
+        return {
+          struct: undefined,
+          modelDef: undefined,
+          compositeResolvedSourceDef: undefined,
+          extendSources: []
+        };
+      const structRef = prepared._query?.structRef;
+      const struct = typeof structRef === "string" ? modelDef.contents[structRef] : structRef;
+      const extendSources = (prepared._query?.pipeline ?? []).flatMap((segment) => segment.extendSource ?? []);
+      return {
+        struct: struct && typeof struct === "object" ? struct : undefined,
+        modelDef,
+        compositeResolvedSourceDef: prepared._query?.compositeResolvedSourceDef,
+        extendSources
+      };
+    } catch {
+      return {
+        struct: undefined,
+        modelDef: undefined,
+        compositeResolvedSourceDef: undefined,
+        extendSources: []
+      };
+    }
+  }
+  gateExprsForOwnAnnotations(struct) {
+    const ownNotes = (struct.annotations?.blockNotes ?? []).map((note) => note.text);
+    try {
+      return [
+        ...this.fileLevelAuthorize,
+        ...collectAuthorizeExprs(ownNotes)
+      ];
+    } catch {
+      return ["false"];
+    }
+  }
+  classifyJoinedField(field, parentLabel) {
+    if (!isJoined(field))
+      return {};
+    if (isRecordOrArrayField(field))
+      return {};
+    if (!isSourceDef2(field)) {
+      logger.error("authorize: joined field failed to resolve to a walkable SourceDef; denying rather than silently skipping its gate (possible Malloy struct-shape drift)", {
+        modelPath: this.modelPath,
+        parentSource: parentLabel,
+        fieldName: field.name,
+        fieldType: field.type
+      });
+      return {
+        denyGate: {
+          label: `${parentLabel} (unresolvable joined source)`,
+          exprs: ["false"],
+          selfContained: false
+        }
+      };
+    }
+    return { resolved: field };
+  }
+  collectAllReachableGates(struct, modelDef, seen = new Set, treatAsOwnGate = false) {
+    if (!struct || !modelDef || seen.has(struct))
+      return [];
+    seen.add(struct);
+    const results = [];
+    const label = struct.as ?? struct.name;
+    const ownExprs = this.gateExprsForOwnAnnotations(struct);
+    if (ownExprs.length > 0) {
+      results.push({
+        label,
+        exprs: ownExprs,
+        selfContained: !treatAsOwnGate
+      });
+    }
+    for (const field of struct.fields) {
+      const { resolved, denyGate } = this.classifyJoinedField(field, label);
+      if (denyGate) {
+        results.push(denyGate);
+        continue;
+      }
+      if (!resolved)
+        continue;
+      const joinedSource = resolved;
+      results.push(...this.collectAllReachableGates(joinedSource, modelDef, seen));
+      if (joinedSource.type === "composite") {
+        const members = joinedSource.sources;
+        for (const member of members) {
+          results.push(...this.collectAllReachableGates(member, modelDef, seen));
+        }
+      }
+    }
+    const duck = struct;
+    if (duck.type === "query_source") {
+      const ref = duck.query?.structRef;
+      const base = typeof ref === "string" ? modelDef.contents[ref] : ref;
+      if (base && isSourceDef2(base)) {
+        results.push(...this.collectAllReachableGates(base, modelDef, seen));
+      }
+      const resolved = duck.query?.compositeResolvedSourceDef;
+      if (resolved) {
+        results.push(...this.collectAllReachableGates(resolved, modelDef, seen));
+      }
+      const innerJoins = (duck.query?.pipeline ?? []).flatMap((segment) => segment.extendSource ?? []);
+      for (const field of innerJoins) {
+        const { resolved: innerJoinSource, denyGate: innerJoinDenyGate } = this.classifyJoinedField(field, label);
+        if (innerJoinDenyGate) {
+          results.push(innerJoinDenyGate);
+          continue;
+        }
+        if (!innerJoinSource)
+          continue;
+        results.push(...this.collectAllReachableGates(innerJoinSource, modelDef, seen));
+      }
+    }
+    return results;
+  }
   async assertAuthorizedForText(text, givens) {
     await this.assertAuthorized(extractRunTargetSourceName(text), givens);
   }
   async assertAuthorizedForRunnable(runnable, givens) {
-    await this.assertAuthorized(await this.resolveAuthorizeSourceFromRunnable(runnable), givens);
+    await this.assertAuthorizedForAllSources(runnable, givens);
   }
   async resolveAuthorizeSourceFromRunnable(runnable) {
     try {
@@ -259146,21 +259631,23 @@ run: ${sourceName ? sourceName + "->" : ""}${queryName}`;
     if (boundary === "deferred") {
       this.assertQueryBoundaryCompiled(compiledSource, query);
     }
-    if (!(compiledSource && compiledSource === earlySource)) {
-      await this.assertAuthorized(compiledSource, givens ?? {});
-    }
+    await this.assertAuthorizedForAllSources(runnable, givens ?? {});
     const maxRows = getMaxQueryRows();
     const maxBytes = getMaxResponseBytes();
     const buildManifest = this.resolveFreshBuildManifest();
     let rowLimit = 0;
     let executionTime = 0;
     let queryResults;
+    const querySurfaceGivens = this.filterGivensToModelSurface(givens);
     try {
-      rowLimit = resolveModelQueryRowLimit((await runnable.getPreparedResult({ givens, buildManifest })).resultExplore.limit, { defaultLimit: getDefaultQueryRowLimit(), maxRows });
+      rowLimit = resolveModelQueryRowLimit((await runnable.getPreparedResult({
+        givens: querySurfaceGivens,
+        buildManifest
+      })).resultExplore.limit, { defaultLimit: getDefaultQueryRowLimit(), maxRows });
       executionTime = performance.now() - startTime;
       queryResults = await runnable.run({
         rowLimit,
-        givens,
+        givens: querySurfaceGivens,
         abortSignal,
         buildManifest
       });
@@ -259276,8 +259763,7 @@ run: ${sourceName ? sourceName + "->" : ""}${queryName}`;
       };
     }
     if (cell.runnable) {
-      const authorizeSource = await this.resolveAuthorizeSourceFromRunnable(cell.runnable);
-      await this.assertAuthorized(authorizeSource, givens ?? {});
+      await this.assertAuthorizedForAllSources(cell.runnable, givens ?? {});
     }
     let queryName = undefined;
     let queryResult = undefined;
@@ -259300,8 +259786,9 @@ run: ${sourceName ? sourceName + "->" : ""}${queryName}`;
         const cellMaxRows = getMaxQueryRows();
         const cellMaxBytes = getMaxResponseBytes();
         const buildManifest = this.resolveFreshBuildManifest();
+        const cellSurfaceGivens = this.filterGivensToModelSurface(givens);
         const rowLimit = resolveModelQueryRowLimit((await runnableToExecute.getPreparedResult({
-          givens,
+          givens: cellSurfaceGivens,
           buildManifest
         })).resultExplore.limit, {
           defaultLimit: getDefaultQueryRowLimit(),
@@ -259309,7 +259796,7 @@ run: ${sourceName ? sourceName + "->" : ""}${queryName}`;
         });
         const result = await runnableToExecute.run({
           rowLimit,
-          givens,
+          givens: cellSurfaceGivens,
           abortSignal,
           buildManifest
         });
@@ -260491,7 +260978,11 @@ class Package {
     malloyConfig.wrapConnections((base) => ({
       lookupConnection: async (name) => {
         if (!name || name === "duckdb") {
-          return base.lookupConnection(name);
+          const connection = await base.lookupConnection(name);
+          if (connection instanceof DuckDBConnection3) {
+            await applyExtensionSessionSettings(connection);
+          }
+          return connection;
         }
         return getEnvironmentMalloyConfig().connections.lookupConnection(name);
       }
@@ -260593,6 +261084,7 @@ class Environment {
   packageMutexes = new Map;
   packageStatuses = new Map;
   failedPackages = new Map;
+  mountErrors = new Map;
   malloyConfig;
   connectionMutex = new Mutex;
   retiredConnectionGenerations = new Set;
@@ -260729,7 +261221,7 @@ ${source}` : source;
         if (queryMaterializer && gateModel) {
           await gateModel.assertQueryBoundaryForRunnable(queryMaterializer, source);
         }
-        if (queryMaterializer && gateModel?.hasAuthorize()) {
+        if (queryMaterializer && gateModel) {
           await gateModel.assertAuthorizedForRunnable(queryMaterializer, givens ?? {});
         }
         let sql;
@@ -260915,7 +261407,7 @@ ${source}` : source;
       }
       this.packages.set(packageName, _package);
       this.setPackageStatus(packageName, "serving" /* SERVING */);
-      this.failedPackages.delete(packageName);
+      this.clearPackageLoadFailure(packageName);
       logger.debug(`Successfully loaded package ${packageName}`);
       return _package;
     } catch (error) {
@@ -260956,7 +261448,7 @@ ${source}` : source;
       throw error;
     }
     this.setPackageStatus(packageName, "serving" /* SERVING */);
-    this.failedPackages.delete(packageName);
+    this.clearPackageLoadFailure(packageName);
     return this.packages.get(packageName);
   }
   async installPackage(packageName, downloader, validate) {
@@ -261051,7 +261543,7 @@ ${source}` : source;
       await this.bindManifestIfConfigured(newPackage);
       this.packages.set(packageName, newPackage);
       this.setPackageStatus(packageName, "serving" /* SERVING */);
-      this.failedPackages.delete(packageName);
+      this.clearPackageLoadFailure(packageName);
       if (oldPackage) {
         this.retireConnectionGeneration(`package ${packageName}`, () => oldPackage.getMalloyConfig().shutdown("close"));
       }
@@ -261229,8 +261721,17 @@ ${source}` : source;
   getPackageStatus(packageName) {
     return this.packageStatuses.get(packageName);
   }
+  setPackageMountError(packageName, message) {
+    this.mountErrors.set(packageName, message);
+  }
+  clearPackageLoadFailure(packageName) {
+    this.failedPackages.delete(packageName);
+    this.mountErrors.delete(packageName);
+  }
   getFailedPackages() {
-    return this.failedPackages;
+    if (this.mountErrors.size === 0)
+      return this.failedPackages;
+    return new Map([...this.failedPackages, ...this.mountErrors]);
   }
   setPackageStatus(packageName, status) {
     const currentStatus = this.packageStatuses.get(packageName);
@@ -261246,7 +261747,7 @@ ${source}` : source;
   async deletePackage(packageName) {
     assertSafePackageName(packageName);
     return this.withPackageLock(packageName, async () => {
-      this.failedPackages.delete(packageName);
+      this.clearPackageLoadFailure(packageName);
       const _package = this.packages.get(packageName);
       if (!_package) {
         return;
@@ -261900,9 +262401,12 @@ class EnvironmentStore {
     const environmentConfig = environmentManifest.environments.find((e) => e.name === environmentName);
     const hasPackages = environment?.packages && environment.packages.length > 0 || environmentConfig?.packages && environmentConfig.packages.length > 0;
     let absoluteEnvironmentPath;
+    let mountErrors = new Map;
     if (hasPackages) {
       const packagesToProcess = environment?.packages || environmentConfig?.packages || [];
-      absoluteEnvironmentPath = await this.loadEnvironmentIntoDisk(environmentName, packagesToProcess);
+      const loaded = await this.loadEnvironmentIntoDisk(environmentName, packagesToProcess);
+      absoluteEnvironmentPath = loaded.path;
+      mountErrors = loaded.mountErrors;
       if (absoluteEnvironmentPath.endsWith(".zip")) {
         absoluteEnvironmentPath = await this.unzipEnvironment(absoluteEnvironmentPath);
       }
@@ -261914,6 +262418,9 @@ class EnvironmentStore {
     if (!newEnvironment.metadata)
       newEnvironment.metadata = {};
     newEnvironment.metadata.location = absoluteEnvironmentPath;
+    for (const [packageName, message] of mountErrors) {
+      newEnvironment.setPackageMountError(packageName, message);
+    }
     this.environments.set(environmentName, newEnvironment);
     this.failedEnvironments.delete(environmentName);
     environment?.packages?.forEach((_package) => {
@@ -262058,9 +262565,17 @@ class EnvironmentStore {
   isS3URL(location) {
     return location.startsWith("s3://");
   }
+  recordMountFailure(error, location, packageNames, mountErrors) {
+    logger.error(`Failed to download or mount location "${location}"`, this.extractErrorDataFromError(error));
+    const message = redactPgSecrets(error instanceof Error ? error.message : String(error));
+    for (const packageName of packageNames) {
+      mountErrors.set(packageName, message);
+    }
+  }
   async loadEnvironmentIntoDisk(environmentName, packages) {
     assertSafePackageName(environmentName);
     const absoluteTargetPath = safeJoinUnderRoot(this.serverRootPath, PUBLISHER_DATA_DIR, environmentName);
+    const mountErrors = new Map;
     await fs8.promises.mkdir(absoluteTargetPath, { recursive: true });
     if (!packages || packages.length === 0) {
       throw new PackageNotFoundError(`No packages found for environment ${environmentName}`);
@@ -262093,12 +262608,19 @@ class EnvironmentStore {
       const tempDownloadPath = safeJoinUnderRoot(absoluteTargetPath, `.temp_${locationHash}`);
       await fs8.promises.mkdir(tempDownloadPath, { recursive: true });
       logger.info(`Created temporary directory: ${tempDownloadPath}`);
+      let downloaded = true;
       try {
         await this.downloadOrMountLocation(groupedLocation, tempDownloadPath, environmentName, "shared");
-        for (const _package of packagesForLocation) {
+      } catch (error) {
+        downloaded = false;
+        this.recordMountFailure(error, groupedLocation, packagesForLocation.map((p) => p.name), mountErrors);
+      }
+      for (const _package of downloaded ? packagesForLocation : []) {
+        let absolutePackagePath;
+        try {
           const packageDir = _package.name;
           assertSafePackageName(packageDir);
-          const absolutePackagePath = safeJoinUnderRoot(absoluteTargetPath, packageDir);
+          absolutePackagePath = safeJoinUnderRoot(absoluteTargetPath, packageDir);
           let sourcePath;
           if (this.isGitHubURL(_package.location)) {
             const githubInfo = this.parseGitHubUrl(_package.location);
@@ -262163,11 +262685,12 @@ class EnvironmentStore {
             });
             logger.info(`Copied entire download as package "${packageDir}"`);
           }
+        } catch (error) {
+          this.recordMountFailure(error, groupedLocation, [_package.name], mountErrors);
+          if (absolutePackagePath) {
+            await clearMountTarget(absolutePackagePath);
+          }
         }
-      } catch (error) {
-        const errorData = this.extractErrorDataFromError(error);
-        logger.error(`Failed to download or mount location "${groupedLocation}"`, errorData);
-        throw new PackageNotFoundError(`Failed to download or mount location: ${groupedLocation}`);
       }
       try {
         await fs8.promises.rm(tempDownloadPath, {
@@ -262180,7 +262703,7 @@ class EnvironmentStore {
         });
       }
     }
-    return absoluteTargetPath;
+    return { path: absoluteTargetPath, mountErrors };
   }
   async downloadOrMountLocation(location, targetPath, environmentName, packageName) {
     const isCompressedFile = location.endsWith(".zip");
@@ -266948,6 +267471,8 @@ my-package/
   public/               # ONLY this directory is web-served
     index.html
     app.js
+    vendor/             # chart library, vendored rather than loaded from a CDN
+      chart.umd.js
 \`\`\`
 
 Only \`public/\` is reachable over the web, at \`/environments/<env>/packages/<pkg>/<file>\`. Models, data, and \`publisher.json\` are private and reached only through the query API, which still applies the model's filters, access modifiers, and authorize rules. There is no flag to set: a \`public/\` directory is what makes a package an app.
@@ -266959,7 +267484,7 @@ The agent orchestrates these. Each query and chart step hands off to a focused s
 1. READ THE MODEL FIRST. Get the model's real source and view names, through your environment's context tool if it has one, or by opening the \`.malloy\` file directly. Never guess field or view names.
 2. SCAFFOLD the package (template below).
 3. WRITE THE QUERIES with \`skill:malloy-html-data-app-runtime\`. Validate each before pasting it into the page, using whatever query tool your environment provides or a running Publisher (see \`skill:malloy-html-data-app-runtime\`). Malloy syntax questions go to \`skill:malloy-queries\`.
-4. CHOOSE CHARTS with \`skill:malloy-charts\` when rendering through \`<malloy-render>\`; otherwise it is your own chart library drawing the returned rows. Vendor any chart library into \`public/\` and load it locally, not from a CDN, because embedded author JavaScript runs with the viewing user's data authority. (The shipped example loads its chart library from a CDN for brevity; a published or embedded app should vendor it.)
+4. CHOOSE CHARTS with \`skill:malloy-charts\` when rendering through \`<malloy-render>\`; otherwise it is your own chart library drawing the returned rows. Vendor any chart library into \`public/\` and load it locally, not from a CDN. Two reasons: embedded author JavaScript runs with the viewing user's data authority, and a blocked CDN (agent sandboxes and many corporate networks block them) is easy to miss, because the script never runs and the charts come up empty. The \`html-data-app\` and \`storefront\` examples both ship their chart library in \`public/vendor/\` and load it from \`public/index.html\` as \`./vendor/chart.umd.js\`. Copy that, but resolve the path against the page's own directory: a page in a subdirectory (\`public/reports/index.html\`) needs \`../vendor/chart.umd.js\`. A wrong relative path 404s and leaves the charts blank, which is the failure you are trying to avoid.
 5. EMBED (optional) with \`skill:malloy-html-data-app-embedding\`.
 6. PREVIEW with the local authoring loop (below).
 7. VERIFY before you call it done (see "What 'done' means" below). This step is not optional.
@@ -269451,6 +269976,7 @@ var environmentStore = new EnvironmentStore(SERVER_ROOT);
 var watchModeController = new WatchModeController(environmentStore);
 var connectionController = new ConnectionController(environmentStore);
 var modelController = new ModelController(environmentStore);
+logger.info(`DuckDB extension-fetch policy: ${getExtensionFetchPolicy()}`);
 var memoryGovernorConfig = getMemoryGovernorConfig();
 var memoryGovernor = memoryGovernorConfig ? new PackageMemoryGovernor(memoryGovernorConfig) : null;
 memoryGovernor?.start();