@malloy-publisher/server 0.0.232 → 0.0.233

package/src/service/connection.ts

@@ -477,33 +477,72 @@ function runSQLRows(result: unknown): Record<string, unknown>[] {
  * the fixed name (which would make every later preflight for this connection
  * fail its ATTACH with "already exists" and silently skip), and so two
  * concurrent first-touch lookups can't cross-DETACH each other.
+ *
+ * {@link metadataSchema} must be the catalog's configured
+ * `catalog.metadataSchema`, because `ducklake_metadata` lives in that schema
+ * rather than the catalog connection's default one. Getting this wrong is not
+ * loud: the read would simply miss, the catch below would log and return, and the
+ * range check would stop protecting precisely the catalogs that set the option.
  */
 let ducklakePreflightSeq = 0;
 async function preflightDuckLakeCatalogFormat(
    connection: DuckDBConnection,
    dbName: string,
    pgConnString: string,
+   metadataSchema?: string,
 ): Promise<void> {
    const tempDb = `${dbName}_fmt_preflight_${++ducklakePreflightSeq}`;
+   // Identifier position, not a string literal, so the schema is double-quoted.
+   // Measured: with today's validator this is belt-and-braces rather than a fix —
+   // every name the regex admits resolves correctly unquoted, including reserved
+   // words (DuckDB parses them fine here) and mixed case (matching is
+   // case-insensitive). It is quoted anyway because this preflight fails SOFT: a
+   // read that misses logs and returns, silently disabling format range-checking
+   // for that connection, so the cost of ever getting this wrong is invisible.
+   // Quoting makes correctness local to this line instead of contingent on the
+   // validator's accept-set, so widening that regex later cannot break it. Safe
+   // by construction: the regex admits no quote character to break out with.
+   const metadataRef = metadataSchema
+      ? `${tempDb}."${metadataSchema}".ducklake_metadata`
+      : `${tempDb}.ducklake_metadata`;
    let catalogFormat: string | undefined;
    try {
       await connection.runSQL(
          `ATTACH '${escapeSQL(pgConnString)}' AS ${tempDb} (TYPE postgres, READ_ONLY);`,
       );
       const result = await connection.runSQL(
-         `SELECT value FROM ${tempDb}.ducklake_metadata WHERE key = 'version' LIMIT 1;`,
+         `SELECT value FROM ${metadataRef} WHERE key = 'version' LIMIT 1;`,
       );
       const value = runSQLRows(result)[0]?.value;
       catalogFormat = typeof value === "string" ? value : undefined;
    } catch (error) {
+      const message = redactPgSecrets(
+         error instanceof Error ? error.message : String(error),
+      );
+      // A named metadata schema holding no catalog has two very different causes,
+      // and the preflight cannot tell them apart: it is the NORMAL state before the
+      // first read-write attach creates the catalog, and it is also what a typo (or
+      // adding `metadataSchema` to a catalog whose metadata lives elsewhere) looks
+      // like. Neither is loud on its own — a read-write attach CREATES an empty
+      // catalog there and materializes into it, and a read-only attach fails with an
+      // error that says nothing about the schema — so name the schema and say both,
+      // rather than implying a mistake on a path that is expected to hit this once
+      // per catalog. The message also has to hedge on the cause: `does not exist`
+      // matches a missing database or role too, not only a missing table.
+      if (metadataSchema !== undefined && /does not exist/i.test(message)) {
+         logger.warn(
+            "No DuckLake catalog found in the configured metadata schema. This is " +
+               "expected the first time a catalog is created there: a read-write " +
+               "attach will create it, and a read-only attach will fail until it " +
+               "exists. Otherwise check the schema name, and the catalog database " +
+               "and role, against the error.",
+            { dbName, metadataSchema, error: message },
+         );
+         return;
+      }
       logger.warn(
          "DuckLake catalog-format preflight read failed; falling back to ATTACH",
-         {
-            dbName,
-            error: redactPgSecrets(
-               error instanceof Error ? error.message : String(error),
-            ),
-         },
+         { dbName, error: message },
       );
       return;
    } finally {
@@ -633,21 +672,45 @@ async function attachDuckLakeWithMode(
    const mode = options.readOnly ? "READ_ONLY" : "READ_WRITE";
    // READ_ONLY: the client manages metadata, we only read the catalog.
    // READ_WRITE (build only): a build-scoped session materializes into it.
-   logger.info(`pgConnString: ${redactPgSecrets(pgConnString)}`);
+   // Debug, not info. These three lines — this one, the escaped form below, and the
+   // assembled ATTACH — are per-attach diagnostics that between them print the catalog
+   // host and database twice and the storage path once. `redactPgSecrets` removes the
+   // password and any URI userinfo, but a DATA_PATH is not a secret it knows about, so
+   // logging the assembled command at info discloses the bucket and whatever the prefix
+   // encodes to every reader of the logs. What an operator watching a healthy fleet
+   // needs is the mode and the outcome, which stay at info below.
+   logger.debug(`pgConnString: ${redactPgSecrets(pgConnString)}`);
    const escapedPgConnString = escapeSQL(pgConnString);
-   logger.info(
+   logger.debug(
       `Final escaped connection string: ${redactPgSecrets(escapedPgConnString)}`,
    );
    const escapedBucketUrl = escapeSQL(ducklakeConfig.storage.bucketUrl);
-   logger.info(`escapedBucketUrl: ${escapedBucketUrl}`);
+   // Optional metadata schema: which schema in the catalog database holds this
+   // DuckLake's `ducklake_*` tables. Absent keeps DuckLake's default (the catalog
+   // connection's default schema), so the emitted command is unchanged for every
+   // existing config. Validated to a plain identifier at config load, because it
+   // reaches a quoted literal here and an identifier position in the preflight.
+   const metadataSchema = ducklakeConfig.catalog.metadataSchema;
    // Range-preflight the catalog's recorded format version so an unsupported
-   // catalog fails as a clean, actionable 422 rather than a deep DuckDB 500.
-   await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString);
+   // catalog fails as a clean, actionable 422 rather than a deep DuckDB 500. The
+   // schema must be threaded through: the preflight reads `ducklake_metadata`, so
+   // when the metadata does not live in the catalog's default schema an unqualified
+   // read misses it — and the preflight fails SOFT (logs and returns), so the range
+   // check would silently stop protecting exactly the catalogs using this option.
+   await preflightDuckLakeCatalogFormat(
+      connection,
+      dbName,
+      pgConnString,
+      metadataSchema,
+   );
    // READ_ONLY is stated explicitly; read-write omits the flag (DuckLake's
    // default is writable). AUTOMATIC_MIGRATION is never set in either mode.
    const readOnlyClause = options.readOnly ? ", READ_ONLY true" : "";
-   const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true${readOnlyClause});`;
-   logger.info(
+   const metadataSchemaClause = metadataSchema
+      ? `, METADATA_SCHEMA '${escapeSQL(metadataSchema)}'`
+      : "";
+   const attachCommand = `ATTACH OR REPLACE 'ducklake:postgres:${escapedPgConnString}' AS ${dbName} (DATA_PATH '${escapedBucketUrl}', OVERRIDE_DATA_PATH true${readOnlyClause}${metadataSchemaClause});`;
+   logger.debug(
       `Attaching DuckLake database using command: ${redactPgSecrets(attachCommand)}`,
    );
    try {

package/src/service/connection_config.spec.ts

@@ -671,4 +671,64 @@ describe("ducklake shape validation", () => {
          /Storage bucketUrl is required for DuckLake/i,
       );
    });
+
+   // metadataSchema reaches TWO grammars: a quoted string literal in the ATTACH,
+   // and a quoted identifier in the catalog-format preflight's table reference.
+   // Restricting it to a plain identifier at load is what keeps one value valid in
+   // both, so these pin the accept/reject boundary rather than trusting escaping.
+   const withSchema = (metadataSchema: unknown): ApiConnection =>
+      ({
+         ...valid,
+         ducklakeConnection: {
+            ...valid.ducklakeConnection,
+            catalog: {
+               ...valid.ducklakeConnection!.catalog,
+               metadataSchema,
+            },
+         },
+      }) as ApiConnection;
+
+   it("accepts an absent metadataSchema", () => {
+      // Optional: absence keeps DuckLake's default schema, the prior behavior.
+      expect(() =>
+         assembleEnvironmentConnections([valid], "/tmp/env"),
+      ).not.toThrow();
+   });
+
+   it("accepts a plain identifier metadataSchema", () => {
+      for (const ok of ["org_a", "_private", "Lake1", "a"]) {
+         expect(() =>
+            assembleEnvironmentConnections([withSchema(ok)], "/tmp/env"),
+         ).not.toThrow();
+      }
+   });
+
+   it("rejects a metadataSchema that is not a plain identifier", () => {
+      for (const bad of [
+         "foo'; DROP TABLE x; --",
+         "has space",
+         "dotted.name",
+         "1leading_digit",
+         "",
+         '"quoted"',
+      ]) {
+         expect(() =>
+            assembleEnvironmentConnections([withSchema(bad)], "/tmp/env"),
+         ).toThrow(/metadataSchema must be a plain identifier/i);
+      }
+   });
+
+   it("rejects a non-string metadataSchema rather than coercing it", () => {
+      // The value comes from untyped JSON and RegExp.test() coerces, so `true` and
+      // `null` match the identifier pattern as "true"/"null" and would pass a
+      // pattern-only check — then reach escapeSQL's String.replace as a non-string
+      // and throw TypeError at the connection's first attach. That runtime failure is
+      // the thing this load-time check exists to prevent, so the type is part of the
+      // contract, not a formality.
+      for (const bad of [true, false, 0, 1, null, {}, [], ["org_a"]]) {
+         expect(() =>
+            assembleEnvironmentConnections([withSchema(bad)], "/tmp/env"),
+         ).toThrow(/metadataSchema must be a plain identifier/i);
+      }
+   });
 });

package/src/service/connection_config.ts

@@ -444,6 +444,32 @@ function validateConnectionShape(connection: ApiConnection): void {
                `Storage bucketUrl is required for DuckLake: ${connection.name}`,
             );
          }
+         // metadataSchema is optional, but when present it reaches the ATTACH as a
+         // quoted string literal AND the catalog-format preflight as a quoted
+         // identifier. Rather than escape one value for two grammars, restrict it
+         // to a plain identifier here — a deterministic config error, caught at
+         // load instead of at the connection's first attach.
+         //
+         // The typeof check is load-bearing, not defensive: the value arrives from
+         // untyped JSON, and RegExp.test() coerces its argument, so `true` and `null`
+         // both satisfy the pattern as "true"/"null" and would reach escapeSQL's
+         // String.replace as a non-string — a TypeError at the first attach, which is
+         // exactly the failure this check exists to turn into a config error.
+         if (
+            connection.ducklakeConnection.catalog.metadataSchema !== undefined
+         ) {
+            const schema = connection.ducklakeConnection.catalog.metadataSchema;
+            if (
+               typeof schema !== "string" ||
+               !/^[A-Za-z_][A-Za-z0-9_]*$/.test(schema)
+            ) {
+               throw new Error(
+                  `DuckLake catalog metadataSchema must be a plain identifier ` +
+                     `([A-Za-z_][A-Za-z0-9_]*), got '${schema}' for connection: ` +
+                     `${connection.name}`,
+               );
+            }
+         }
          break;
       case "trino":
          if (!connection.trinoConnection) {

package/src/service/duckdb_instance_isolation.spec.ts

@@ -0,0 +1,137 @@
+import { DuckDBConnection } from "@malloydata/db-duckdb";
+import { afterEach, describe, expect, it } from "bun:test";
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+
+/**
+ * Pins the DuckDB instance-isolation contract that same-named connections depend
+ * on for multi-tenant safety.
+ *
+ * `@malloydata/db-duckdb` pools DuckDB instances in a process-global cache keyed
+ * by a share key that deliberately EXCLUDES the connection name, and it caches a
+ * `:memory:` primary like any other. Meanwhile the DuckLake attach aliases by
+ * connection name (`ATTACH OR REPLACE … AS <name>`). Put those together and two
+ * same-named connections that land on ONE pooled instance clobber each other's
+ * attach: one ends up reading the other's database.
+ *
+ * `createIsolatedBuildSession` prevents that by giving every build session a
+ * unique `workingDirectory`, relying on it participating in the share key. That
+ * is an upstream implementation detail, so nothing here asserted it — and the
+ * failure mode is silent: no error, just the wrong data. This spec asserts the
+ * behaviour instead of the mechanism, so it holds however upstream achieves it.
+ *
+ * Deliberately NOT asserted: the converse (same name AND same working directory
+ * DO share an instance). That is the pooling artifact, not a property we want; if
+ * upstream ever made pooling connection-aware, asserting it would fail on an
+ * improvement.
+ *
+ * Each connection creates and populates its OWN attached store rather than
+ * reopening a pre-seeded file. Handing a file from one connection to another
+ * requires the first to have released its OS lock, and `close()` is refcount-only
+ * — which fails outright under Windows' mandatory locking. Attaching a store the
+ * connection itself owns avoids the handoff, and matches how a DuckLake
+ * destination is actually used.
+ */
+describe("DuckDB instance isolation", () => {
+   const tempDirs: string[] = [];
+   const openConnections: DuckDBConnection[] = [];
+
+   const tempDir = async (label: string): Promise<string> => {
+      const dir = await fs.mkdtemp(
+         path.join(os.tmpdir(), `duckdb-iso-${label}-`),
+      );
+      tempDirs.push(dir);
+      return dir;
+   };
+
+   afterEach(async () => {
+      for (const connection of openConnections) {
+         await connection.close().catch(() => undefined);
+      }
+      openConnections.length = 0;
+      for (const dir of tempDirs) {
+         // Best-effort: a still-locked file must not fail the test.
+         await fs
+            .rm(dir, { recursive: true, force: true })
+            .catch(() => undefined);
+      }
+      tempDirs.length = 0;
+   });
+
+   /**
+    * A connection with the given name and its own working directory, which
+    * attaches its own private store under `alias` and writes one distinguishing
+    * value into it.
+    */
+   const connectionWithOwnStore = async (
+      name: string,
+      label: string,
+      alias: string,
+      value: number,
+   ): Promise<DuckDBConnection> => {
+      const sessionDir = await tempDir(`session-${label}`);
+      const connection = new DuckDBConnection(name, ":memory:", sessionDir);
+      openConnections.push(connection);
+      const storeDir = await tempDir(`store-${label}`);
+      const storeFile = path.join(storeDir, `${label}.duckdb`);
+      // OR REPLACE mirrors the DuckLake attach: on a shared instance the second
+      // caller silently replaces the first caller's alias.
+      await connection.runSQL(`ATTACH OR REPLACE '${storeFile}' AS ${alias};`);
+      await connection.runSQL(
+         `CREATE OR REPLACE TABLE ${alias}.t AS SELECT ${value} AS x;`,
+      );
+      return connection;
+   };
+
+   const readValue = async (
+      connection: DuckDBConnection,
+      alias: string,
+   ): Promise<number> => {
+      const result = await connection.runSQL(`SELECT x FROM ${alias}.t;`);
+      return Number(Object.values(result.rows[0])[0]);
+   };
+
+   it("keeps same-named connections apart when their working directories differ", async () => {
+      // Identical connection NAME and identical `:memory:` primary — only the
+      // working directory differs. That is exactly the shape a build session
+      // uses, and the only thing standing between it and a shared instance.
+      //
+      // ORDERING IS LOAD-BEARING FOR THIS TEST. The instance cache is consulted
+      // inside an async `init()`, so constructing both connections before either
+      // is used lets both race past the cache miss and each create a private
+      // instance — isolation for the wrong reason, and a test that could never
+      // fail. Each helper call fully initializes its connection (the ATTACH
+      // forces it) before the next is built, so a shared share key really would
+      // hand back the cached instance. Verified: with identical working
+      // directories this ordering yields 2 for both connections — the clobber.
+      const a = await connectionWithOwnStore("store", "a", "lake", 1);
+      const b = await connectionWithOwnStore("store", "b", "lake", 2);
+
+      expect(await readValue(a, "lake")).toBe(1);
+      expect(await readValue(b, "lake")).toBe(2);
+   });
+
+   it("keeps a build-session-shaped connection apart from a long-lived one", async () => {
+      // The pairing the build-session comment calls out specifically: a transient
+      // build session overlapping a long-lived serve connection. Same name, same
+      // alias, both `:memory:` — distinct only by working directory.
+      const serve = await connectionWithOwnStore(
+         "credible",
+         "serve",
+         "lake",
+         10,
+      );
+      const build = await connectionWithOwnStore(
+         "credible",
+         "build",
+         "lake",
+         20,
+      );
+
+      // The serve connection must still see its own store after the build
+      // session attaches a different one under the same alias.
+      expect(await readValue(serve, "lake")).toBe(10);
+      expect(await readValue(build, "lake")).toBe(20);
+   });
+});

package/src/service/model.ts

@@ -92,6 +92,8 @@ import {
 import { malloyGivenToApi, type MalloyGiven } from "./given";
 import {
    assertWithinModelResponseLimits,
+   type QueryRowLimitSource,
+   queryRowLimitSource,
    resolveModelQueryRowLimit,
 } from "./model_limits";
 import { buildSourceAliasMap, extractRunTargetSourceName } from "./query_text";
@@ -2059,6 +2061,10 @@ export class Model {
       compactResult: QueryData;
       modelInfo: Malloy.ModelInfo;
       dataStyles: DataStyles;
+      /** Row cap pushed into the SQL: the query's own LIMIT, else the default. */
+      rowLimit: number;
+      /** Which of those two the cap came from. */
+      rowLimitSource: QueryRowLimitSource;
    }> {
       const startTime = performance.now();
       if (this.compilationError) {
@@ -2318,6 +2324,7 @@ export class Model {
       // a 500. `executionTime` is still captured after prepare and before run,
       // preserving the pre-existing timing recorded by the success histogram.
       let rowLimit = 0;
+      let rowLimitSource: QueryRowLimitSource = "server_default";
       let executionTime = 0;
       let queryResults;
       // Givens supplied only so a joined source's authorize gate could see
@@ -2332,16 +2339,18 @@ export class Model {
       // shape can read them; the authorize gate above already saw the full set.
       const effectiveGivens = serveVirtualMap ? undefined : querySurfaceGivens;
       try {
-         rowLimit = resolveModelQueryRowLimit(
-            (
-               await runnable.getPreparedResult({
-                  givens: effectiveGivens,
-                  buildManifest: effectiveBuildManifest,
-                  virtualMap: serveVirtualMap,
-               })
-            ).resultExplore.limit,
-            { defaultLimit: getDefaultQueryRowLimit(), maxRows },
-         );
+         const preparedLimit = (
+            await runnable.getPreparedResult({
+               givens: effectiveGivens,
+               buildManifest: effectiveBuildManifest,
+               virtualMap: serveVirtualMap,
+            })
+         ).resultExplore.limit;
+         rowLimitSource = queryRowLimitSource(preparedLimit);
+         rowLimit = resolveModelQueryRowLimit(preparedLimit, {
+            defaultLimit: getDefaultQueryRowLimit(),
+            maxRows,
+         });
          executionTime = performance.now() - startTime;
 
          queryResults = await runnable.run({
@@ -2471,15 +2480,17 @@ export class Model {
             // the connector reads as a hard cap and stops before the first row: a
             // successful, EMPTY answer. Asking the live shape is also the honest
             // limit, since the live shape is what runs.
-            rowLimit = resolveModelQueryRowLimit(
-               (
-                  await liveRunnable!.getPreparedResult({
-                     givens: querySurfaceGivens,
-                     buildManifest,
-                  })
-               ).resultExplore.limit,
-               { defaultLimit: getDefaultQueryRowLimit(), maxRows },
-            );
+            const livePreparedLimit = (
+               await liveRunnable!.getPreparedResult({
+                  givens: querySurfaceGivens,
+                  buildManifest,
+               })
+            ).resultExplore.limit;
+            rowLimitSource = queryRowLimitSource(livePreparedLimit);
+            rowLimit = resolveModelQueryRowLimit(livePreparedLimit, {
+               defaultLimit: getDefaultQueryRowLimit(),
+               maxRows,
+            });
             queryResults = await liveRunnable!.run({
                rowLimit,
                givens: querySurfaceGivens,
@@ -2536,6 +2547,17 @@ export class Model {
          compactResult: queryResults.data.value,
          modelInfo: this.modelInfo,
          dataStyles: this.dataStyles,
+         // The cap actually pushed into the SQL. A caller cannot otherwise tell
+         // a complete result from one the row limit cut off: with no LIMIT of
+         // its own a query silently gets DEFAULT_QUERY_ROW_LIMIT rows, and that
+         // is under maxRows, so assertWithinModelResponseLimits raises nothing.
+         // Returning the number lets a caller compare it against the row count
+         // and say so, with no extra query.
+         rowLimit,
+         // Whether that cap was the author's own limit:/top: or the silent
+         // default. Only the second means rows were probably left behind; a
+         // deliberate `top: 10` returning 10 rows is a complete answer.
+         rowLimitSource,
       };
    }
 

package/src/service/model_limits.spec.ts

@@ -3,6 +3,7 @@ import { describe, expect, it } from "bun:test";
 import { PayloadTooLargeError } from "../errors";
 import {
    assertWithinModelResponseLimits,
+   queryRowLimitSource,
    resolveModelQueryRowLimit,
 } from "./model_limits";
 
@@ -179,3 +180,30 @@ describe("assertWithinModelResponseLimits", () => {
       ).not.toThrow();
    });
 });
+
+describe("queryRowLimitSource", () => {
+   /**
+    * Must mirror resolveModelQueryRowLimit's own `requested` condition: if the
+    * two ever disagree, the reported source describes a different limit than
+    * the one actually pushed into the SQL.
+    */
+   it("reports the query when it carried its own positive limit", () => {
+      expect(queryRowLimitSource(10)).toBe("query");
+      expect(queryRowLimitSource(1)).toBe("query");
+   });
+
+   it("reports the server default when the query carried none", () => {
+      expect(queryRowLimitSource(undefined)).toBe("server_default");
+      expect(queryRowLimitSource(0)).toBe("server_default");
+      expect(queryRowLimitSource(-1)).toBe("server_default");
+   });
+
+   it("agrees with which limit resolveModelQueryRowLimit actually used", () => {
+      const config = { defaultLimit: 1000, maxRows: 0 };
+      for (const userLimit of [undefined, 0, -1, 1, 10, 5000]) {
+         const used = resolveModelQueryRowLimit(userLimit, config);
+         const cameFromQuery = queryRowLimitSource(userLimit) === "query";
+         expect(cameFromQuery).toBe(used !== config.defaultLimit);
+      }
+   });
+});

package/src/service/model_limits.ts

@@ -67,6 +67,27 @@ export function resolveModelQueryRowLimit(
    return Math.min(requested, maxRows + 1);
 }
 
+/** Whether the cap came from the query itself or from the server default. */
+export type QueryRowLimitSource = "query" | "server_default";
+
+/**
+ * Which of the two the cap in {@link resolveModelQueryRowLimit} came from.
+ *
+ * The distinction is the whole difference between "the database cut this off
+ * and you were not told" and "you asked for exactly this many". A `limit:` or
+ * `top:` the author wrote is deliberate and complete for what it asked; only the
+ * silently-applied default means rows were probably left behind.
+ *
+ * The condition deliberately mirrors `requested` above and must stay in step
+ * with it, so a change to which limit wins cannot leave the reported source
+ * describing the other one.
+ */
+export function queryRowLimitSource(
+   userLimit: number | undefined,
+): QueryRowLimitSource {
+   return userLimit && userLimit > 0 ? "query" : "server_default";
+}
+
 export interface ModelResponseLimitsConfig {
    /** Result of {@link getMaxQueryRows}. `0` disables the row cap. */
    maxRows: number;

package/tests/integration/mcp/mcp_execute_query_tool.integration.spec.ts

@@ -71,7 +71,7 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
             for (const block of content) {
                expect(block.type).toBe("resource");
                expect(block.resource).toBeDefined();
-               expect(block.resource.type).toBe("application/json");
+               expect(block.resource.mimeType).toBe("application/json");
                expect(block.resource.text).toBeDefined();
                expect(typeof block.resource.text).toBe("string");
             }
@@ -80,12 +80,24 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
 
             const queryResultBlock = content[0].resource;
             expect(queryResultBlock.uri).toContain("#result");
-            const queryResultData = JSON.parse(queryResultBlock.text);
-            expect(queryResultData).toBeDefined();
-            // Check properties directly on the parsed Result object
-            expect(queryResultData.data).toBeDefined();
-            expect(Array.isArray(queryResultData.data.array_value)).toBe(true);
-            // Could add more specific checks on data if needed
+            const envelope = JSON.parse(queryResultBlock.text);
+
+            // Flat rows keyed by column name: the same shape an in-package data
+            // app receives, not the type-tagged Malloy cell envelope.
+            expect(Array.isArray(envelope.rows)).toBe(true);
+            expect(envelope.rows.length).toBeGreaterThan(0);
+            expect(typeof envelope.rows[0]).toBe("object");
+            expect(envelope.rows[0].data).toBeUndefined();
+
+            // Credible's field names, so an agent sees one shape whether the
+            // app is authored locally against Publisher or served in production.
+            expect(typeof envelope._query_row_limit).toBe("number");
+            expect(typeof envelope._limit_hit).toBe("boolean");
+            // Absent rather than false when nothing was dropped.
+            expect("_rows_truncated" in envelope).toBe(false);
+            // The metadata flat rows drop.
+            expect(envelope._meta.schema).toBeDefined();
+            expect(typeof envelope._meta.connection_name).toBe("string");
          },
          { timeout: 30000 },
       );
@@ -120,7 +132,7 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
             const queryResultBlock = result.content![0];
             expect(queryResultBlock.type).toBe("resource");
             expect(queryResultBlock.resource).toBeDefined();
-            expect(queryResultBlock.resource.type).toBe("application/json");
+            expect(queryResultBlock.resource.mimeType).toBe("application/json");
             expect(queryResultBlock.resource.uri).toMatch(/result/); // Check URI contains queryResult
             expect(queryResultBlock.resource.text).toBeDefined();
 
@@ -159,7 +171,7 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
             const errorBlockSyntax = result.content![0];
             expect(errorBlockSyntax.type).toBe("resource");
             expect(errorBlockSyntax.resource).toBeDefined();
-            expect(errorBlockSyntax.resource.type).toBe("application/json");
+            expect(errorBlockSyntax.resource.mimeType).toBe("application/json");
 
             // Check for Malloy compilation error message from getMalloyErrorDetails
             const errorJsonTextSyntax = errorBlockSyntax.resource
@@ -169,6 +181,17 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
                /syntax error|no viable alternative/i,
             );
             expect(Array.isArray(errorPayloadSyntax.suggestions)).toBe(true);
+
+            // The resource block is invisible to a client that renders only
+            // text on an isError result, which is how a real diagnostic gets
+            // reported as a bare "Unknown error". Pinned here, over the real
+            // HTTP transport, because the unit spec calls the handler directly
+            // and so cannot catch the block being dropped in serialization.
+            const textBlockSyntax = result.content!.find(
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               (b: any) => b.type === "text",
+            );
+            expect(textBlockSyntax?.text).toContain(errorPayloadSyntax.error);
          },
          { timeout: 30000 },
       );
@@ -277,7 +300,9 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
          const errorBlockPkgNotFound = result.content![0];
          expect(errorBlockPkgNotFound.type).toBe("resource");
          expect(errorBlockPkgNotFound.resource).toBeDefined();
-         expect(errorBlockPkgNotFound.resource.type).toBe("application/json");
+         expect(errorBlockPkgNotFound.resource.mimeType).toBe(
+            "application/json",
+         );
 
          // Parse the JSON string from the resource text content
          const errorJsonTextPkgNotFound = errorBlockPkgNotFound.resource
@@ -321,7 +346,7 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
          const errorBlockModel = result.content![0];
          expect(errorBlockModel.type).toBe("resource");
          expect(errorBlockModel.resource).toBeDefined();
-         expect(errorBlockModel.resource.type).toBe("application/json");
+         expect(errorBlockModel.resource.mimeType).toBe("application/json");
 
          // Parse the JSON string from the resource text content
          const errorJsonTextModel = errorBlockModel.resource.text as string;
@@ -398,7 +423,7 @@ describe.serial("MCP Tool Handlers (E2E Integration)", () => {
          const errorBlock = result.content![0];
          expect(errorBlock.type).toBe("resource");
          expect(errorBlock.resource).toBeDefined();
-         expect(errorBlock.resource.type).toBe("application/json");
+         expect(errorBlock.resource.mimeType).toBe("application/json");
 
          // Check for Malloy error indicating the query/view wasn't found at the top level
          const errorJsonText = errorBlock.resource.text as string;