@malloy-publisher/server 0.0.247 → 0.0.248

package/dist/server.mjs

@@ -246982,11 +246982,67 @@ var init_package_load_pool = __esm(() => {
 });
 
 // src/service/authorize.ts
+import { payloadOf, routeOf } from "@malloydata/malloy";
+function noteRoute(text) {
+  return routeOf({ value: text.trimStart() });
+}
+function notePayload(text) {
+  return payloadOf({ value: text.trimStart() }) ?? "";
+}
+function authorizeNoteContent(text) {
+  return noteRoute(text) === AUTHORIZE_ROUTE ? notePayload(text) : undefined;
+}
 function assertNoCallerAuthorizeAnnotation(callerText) {
   if (!AUTHORIZE_ANNOTATION_ANYWHERE.test(callerText))
     return;
   throw new BadRequestError("An `authorize` annotation is not permitted in caller-submitted Malloy " + "text. Access gates are declared by the model author on the source; a " + "request cannot introduce, replace, or relax one. To validate a gate " + "you are authoring, save it to the package's model file and reload the " + "package — model load validates every `#(authorize)` annotation it " + "declares.");
 }
+function containsAuthorizeAnnotationTag(texts) {
+  return texts.some((text) => authorizeNoteContent(text) !== undefined);
+}
+function collectAuthorizeNearMisses(texts) {
+  const found = [];
+  for (const text of texts) {
+    const trimmed2 = text.trimStart();
+    const route = noteRoute(trimmed2);
+    if (route === AUTHORIZE_ROUTE)
+      continue;
+    const nearMiss = route === undefined ? MALFORMED_AUTHORIZE_ATTEMPT.test(trimmed2) : route === "" ? MOTLY_AUTHORIZE_PAYLOAD.test(notePayload(trimmed2)) : route.toLowerCase() === AUTHORIZE_ROUTE;
+    if (!nearMiss)
+      continue;
+    found.push(trimmed2.split(/[\r\n]/, 1)[0]);
+  }
+  return found;
+}
+function assertNoAuthorizeNearMisses(found) {
+  if (found.length === 0)
+    return;
+  const unique = [...new Set(found)];
+  throw new ModelCompilationError({
+    message: `These annotations are not \`authorize\` gates and nothing enforces ` + `them:
+${unique.map((t) => `  - \`${t}\``).join(`
+`)}
+` + `Malloy routes an annotation by its prefix, and only ` + `\`#(authorize)\` (or \`##(authorize)\`, or the block form ` + `\`#|(authorize)\`) reaches the authorize route — a space after the ` + `\`#\`, spaces inside the brackets, or anything trailing the closing ` + `bracket makes it a plain tag Malloy hands to something else. Write ` + `\`#(authorize) "<expression>"\` on the \`source:\` statement you mean ` + `to protect. This is refused rather than interpreted: guessing at the ` + `intent would let publisher start enforcing a filter on a package that ` + `has been serving every row.`
+  });
+}
+function describeMisplacedAuthorizeAnnotation(f) {
+  if (f.kind === "query")
+    return `on query "${f.name}"`;
+  if (f.kind === "file")
+    return "at the file level (`##(authorize)`)";
+  return `on field "${f.fieldName}" of source "${f.name}"`;
+}
+function assertNoMisplacedAuthorizeAnnotations(found) {
+  if (found.length === 0)
+    return;
+  const positions = found.map((f) => `  - ${describeMisplacedAuthorizeAnnotation(f)}`).join(`
+`);
+  throw new ModelCompilationError({
+    message: `An \`#(authorize)\` annotation is never enforced at:
+${positions}
+` + `A gate only applies where model load looks for one — a \`source:\`'s ` + `own annotation, or one it inherits from an \`extend\`/query-source ` + `base. File-level \`##(authorize)\` is deprecated and no longer ` + `enforced anywhere, so it always lands here: declare \`#(authorize)\` ` + `on each \`source:\` it was meant to protect instead. Every other ` + `position above should move to the \`source:\` statement it is meant ` + `to protect.`
+  });
+}
 function buildAuthorizeProbe(exprs, givenDecls = []) {
   const selects = exprs.map((expr, i) => `__auth_${i} is (${expr})`).join(`
       `);
@@ -247014,6 +247070,158 @@ function referencedGivenNames(expr) {
   }
   return names;
 }
+function classifyAuthorizeGate(condition, declaredTypes, declaredDefaults) {
+  const fieldUsage = condition.refSummary?.fieldUsage;
+  if (!Array.isArray(fieldUsage) || fieldUsage.length === 0) {
+    return { shape: "given_only" };
+  }
+  const givenNames = [];
+  const literalAtoms = [];
+  let rejection;
+  const reject = (cause, detail) => {
+    rejection ??= { shape: "rejected", cause, detail };
+    return false;
+  };
+  const givenOperand = (node) => {
+    const n = asNode(node);
+    return n && n.node === "given" && typeof n.refName === "string" ? n.refName : null;
+  };
+  const isLiteralOperand = (node) => {
+    const n = asNode(node);
+    return !!n && (n.node === "numberLiteral" || n.node === "stringLiteral" || n.node === "true" || n.node === "false");
+  };
+  const literalOperandText = (node) => {
+    const n = asNode(node);
+    if (!n)
+      return null;
+    if (n.node === "true" || n.node === "false")
+      return n.node;
+    if (n.node === "numberLiteral" && typeof n.literal === "string") {
+      return n.literal;
+    }
+    if (n.node === "stringLiteral" && typeof n.literal === "string") {
+      return `'${n.literal.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+    }
+    return null;
+  };
+  const declaredTypeOf = (name) => {
+    const declared = declaredTypes.get(name);
+    if (declared === undefined) {
+      reject("unreachable_given", `\`$${name}\` is not on this model's given surface, so the gate ` + `would bind its declaration default rather than the caller's ` + `value. Declare it here, importing it if it lives elsewhere ` + `(\`import { ${name} } from "…"\`)`);
+      return null;
+    }
+    return declared;
+  };
+  const walk = (node, depth) => {
+    if (depth > MAX_GATE_WALK_DEPTH) {
+      return reject("unsupported_node", "the gate nests too deeply to read");
+    }
+    const n = asNode(node);
+    if (!n || typeof n.node !== "string") {
+      return reject("unsupported_node", "the gate has an unreadable shape");
+    }
+    const kind = n.node;
+    if (BOOLEAN_NODES.has(kind)) {
+      const kids = asNode(n.kids);
+      if (!kids) {
+        return reject("unsupported_node", `\`${kind}\` has no operands`);
+      }
+      return walk(kids.left, depth + 1) && walk(kids.right, depth + 1);
+    }
+    if (TRANSPARENT_NODES.has(kind)) {
+      return walk(n.e, depth + 1);
+    }
+    if (kind === "inGiven") {
+      if (n.not === true) {
+        return reject("unsupported_node", "a negated membership test (`not in`) is not an access rule; " + "write the gate as the set of rows a caller MAY read");
+      }
+      const given = givenOperand(n.givenRef);
+      if (given === null) {
+        return reject("unsupported_node", "`in` must test membership of a declared given");
+      }
+      const declared = declaredTypeOf(given);
+      if (declared === null)
+        return false;
+      if (!isArrayType(declared)) {
+        return reject("scalar_given_rejects_in", `\`$${given}\` is declared \`${declared}\` (a scalar), so ` + `\`in $${given}\` is not a membership test. Compare it with ` + `\`=\` instead`);
+      }
+      givenNames.push(given);
+      return walkFieldOperand(n.e);
+    }
+    if (SCALAR_COMPARISON_NODES.has(kind)) {
+      const kids = asNode(n.kids);
+      if (!kids) {
+        return reject("unsupported_node", `\`${kind}\` has no operands`);
+      }
+      const left = givenOperand(kids.left);
+      const right = givenOperand(kids.right);
+      const given = left ?? right;
+      if (given === null) {
+        return reject("no_given_reference", `\`${kind}\` must compare a field against a given; a comparison ` + `against a constant is a fixed filter and belongs in the ` + `source's own \`where:\``);
+      }
+      const declared = declaredTypeOf(given);
+      if (declared === null)
+        return false;
+      if (isArrayType(declared)) {
+        return reject("array_given_needs_in", `\`$${given}\` is declared \`${declared}\` (an array), so ` + `comparing it with \`${kind}\` compiles and then fails in the ` + `warehouse. Write \`in $${given}\` — it is also the spelling ` + `that matches no rows when the array is empty`);
+      }
+      const otherSide = left === null ? kids.left : kids.right;
+      if (isLiteralOperand(otherSide)) {
+        givenNames.push(given);
+        const literalText = literalOperandText(otherSide);
+        if (literalText !== null) {
+          literalAtoms.push(left !== null ? `$${given} ${kind} ${literalText}` : `${literalText} ${kind} $${given}`);
+        }
+        return true;
+      }
+      if (declaredDefaults.has(given)) {
+        return reject("field_given_has_default", `\`${kind}\` compares row field data against \`$${given}\`, ` + `which is declared with a default (\`${declaredDefaults.get(given)}\`). ` + `A caller who supplies no value for \`$${given}\` gets that ` + `default, and the comparison then applies to every row — ` + `admitting rows it was meant to exclude. Declare \`$${given}\` ` + `with no default so a caller must supply one explicitly`);
+      }
+      givenNames.push(given);
+      return walkFieldOperand(otherSide);
+    }
+    return reject("unsupported_node", `\`${kind}\` is not permitted in a gate; a row-level gate is a ` + `boolean combination of \`<field> <operator> $GIVEN\` comparisons`);
+  };
+  const walkFieldOperand = (node) => {
+    const n = asNode(node);
+    if (!n || n.node !== "field" || !Array.isArray(n.path)) {
+      return reject("unsupported_node", `a gate compares a FIELD against a given; \`${asNode(node)?.node ?? "that operand"}\` is not a field reference`);
+    }
+    return true;
+  };
+  let ok;
+  try {
+    ok = walk(condition.e, 0);
+  } catch {
+    return {
+      shape: "rejected",
+      cause: "unsupported_node",
+      detail: "the gate's compiled shape could not be read"
+    };
+  }
+  if (!ok) {
+    return rejection ?? {
+      shape: "rejected",
+      cause: "unsupported_node",
+      detail: "the gate is not an allowed shape"
+    };
+  }
+  if (givenNames.length === 0) {
+    return {
+      shape: "rejected",
+      cause: "no_given_reference",
+      detail: "a row-level gate must compare a field against a given; a gate " + "that references none is a fixed filter and belongs in the " + "source's own `where:`"
+    };
+  }
+  return { shape: "row_level", givenNames, literalAtoms };
+}
+function isArrayType(declaredType) {
+  const normalized = declaredType.trim().toLowerCase();
+  return normalized === "array" || normalized.endsWith("[]");
+}
+function asNode(node) {
+  return node !== null && typeof node === "object" ? node : null;
+}
 function inferGivenType(value) {
   if (typeof value === "string")
     return "string";
@@ -247056,9 +247264,8 @@ async function runProbe(executor, probeText, givens) {
 }
 async function evaluateAuthorize(executor, exprs, givens, declaredTypes, options) {
   const selfContainedFirst = options?.selfContainedFirst ?? false;
-  const ambientPrefix = options?.ambientPrefix ?? 0;
-  for (const [index, expr] of exprs.entries()) {
-    if (selfContainedFirst && index >= ambientPrefix) {
+  for (const expr of exprs) {
+    if (selfContainedFirst) {
       if (await evaluateSelfContainedFirst(executor, expr, givens, declaredTypes)) {
         return true;
       }
@@ -247106,27 +247313,123 @@ async function evaluateSelfContainedFirst(executor, expr, givens, declaredTypes)
     }
   }
 }
-async function validateAuthorizeProbes(compiler, sources) {
-  for (const source of sources) {
-    const exprs = source.authorize;
-    if (!exprs || exprs.length === 0)
-      continue;
+function quoteMalloyIdentifier(name) {
+  return "`" + name.replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
+}
+function buildRowLevelProbe(graftTarget, filterText) {
+  return `run: ${quoteMalloyIdentifier(graftTarget)} extend { where: ${filterText} } -> { select: __authorize_probe is 1; limit: 1 }`;
+}
+function liftProbeFilterCondition(prepared, label, filterText) {
+  const filterList = prepared._query?.structRef?.filterList;
+  if (!Array.isArray(filterList) || filterList.length === 0) {
+    throw new Error(`${label} carries no filter condition`);
+  }
+  const lifted = filterList[filterList.length - 1];
+  if (lifted.code !== filterText) {
+    throw new Error(`${label} carries the wrong condition — expected "${filterText}", got "${lifted.code ?? ""}"`);
+  }
+  if (!lifted.isSourceFilter) {
+    throw new Error(`${label} carries a condition that is not a source filter`);
+  }
+  return lifted;
+}
+function gateFilterText(exprs) {
+  return exprs.map((e) => `(${e})`).join(" or ");
+}
+async function liftRowLevelCondition(compiler, sourceName, exprs) {
+  const filterText = gateFilterText(exprs);
+  const prepared = await compiler.loadQuery(buildRowLevelProbe(sourceName, filterText)).getPreparedQuery();
+  return liftProbeFilterCondition(prepared, `row-level probe for "${sourceName}"`, filterText);
+}
+async function runOneRowProbeOrThrow(compiler, sourceName, exprs) {
+  try {
+    await compiler.loadQuery(buildAuthorizeProbe(exprs)).getPreparedQuery();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new ModelCompilationError({
+      message: `Invalid #(authorize) annotation on source "${sourceName}" [${exprs.join(" | ")}]: ${detail}`
+    });
+  }
+}
+async function assertNoVacuousDefaultAtom(executor, sourceName, literalAtoms) {
+  for (const atom of literalAtoms) {
+    let vacuous;
     try {
-      await compiler.loadQuery(buildAuthorizeProbe(exprs)).getPreparedQuery();
+      vacuous = await runProbe(executor, buildAuthorizeProbe([atom]), {});
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
+      if (NO_DEFAULT_GIVEN_PATTERN.test(detail))
+        continue;
       throw new ModelCompilationError({
-        message: `Invalid #(authorize) annotation on source "${source.name ?? "(unnamed)"}" [${exprs.join(" | ")}]: ${detail}`
+        message: `Invalid #(authorize) annotation on source "${sourceName}": ` + `the atom \`${atom}\` could not be evaluated against its ` + `given's declared default (${detail}).`
       });
     }
+    if (vacuous) {
+      throw new ModelCompilationError({
+        message: `Invalid #(authorize) annotation on source "${sourceName}": ` + `the atom \`${atom}\` evaluates to TRUE when a caller supplies ` + `no givens (its given's own declared default). An OR'd atom ` + `that is true by default makes the whole row filter admit ` + `every row for that caller. Give the given a default this ` + `atom evaluates false against, or declare it with no default ` + `so a caller must supply one explicitly.`
+      });
+    }
+  }
+}
+async function validateAuthorizeProbes(compiler, options) {
+  const declaredTypes = options.declaredTypes ?? new Map;
+  const declaredDefaults = options.declaredDefaults ?? new Map;
+  const provenNoteObjects = new Set;
+  const ownNotesOf = options.authorizeOwnNotes ?? new Map;
+  const pending = [];
+  for (const [sourceName, groups] of options.authorizeMap ?? []) {
+    for (const exprs of groups) {
+      if (exprs.length === 0)
+        continue;
+      let condition;
+      try {
+        condition = await liftRowLevelCondition(compiler, sourceName, exprs);
+      } catch (err) {
+        pending.push({ sourceName, exprs, err });
+        continue;
+      }
+      const classification = classifyAuthorizeGate(condition, declaredTypes, declaredDefaults);
+      if (classification.shape === "given_only") {
+        await runOneRowProbeOrThrow(compiler, sourceName, exprs);
+        for (const note of ownNotesOf.get(sourceName) ?? []) {
+          provenNoteObjects.add(note);
+        }
+        continue;
+      }
+      if (classification.shape === "rejected") {
+        options.onRowLevelGateRejected?.(classification.cause);
+        const ownNotes = ownNotesOf.get(sourceName) ?? [];
+        if (ownNotes.length === 0) {
+          options.onRowLevelGateUnexpressible?.(sourceName, classification.detail);
+          continue;
+        }
+        throw new ModelCompilationError({
+          message: `Invalid #(authorize) annotation on source "${sourceName}" ` + `[${exprs.join(" | ")}]: ${classification.detail}`
+        });
+      }
+      await assertNoVacuousDefaultAtom(compiler, sourceName, classification.literalAtoms);
+      for (const note of ownNotesOf.get(sourceName) ?? []) {
+        provenNoteObjects.add(note);
+      }
+    }
+  }
+  for (const failure of pending) {
+    const ownNotes = ownNotesOf.get(failure.sourceName) ?? [];
+    const inherited = ownNotes.length === 0 || ownNotes.every((note) => provenNoteObjects.has(note));
+    if (inherited) {
+      const detail = failure.err instanceof Error ? failure.err.message : String(failure.err);
+      options.onRowLevelGateRejected?.("entry_point_unexpressible");
+      options.onRowLevelGateUnexpressible?.(failure.sourceName, detail);
+      continue;
+    }
+    await runOneRowProbeOrThrow(compiler, failure.sourceName, failure.exprs);
   }
 }
 function parseAuthorizeAnnotation(annotation) {
-  const trimmed2 = annotation.trim();
-  const prefix = AUTHORIZE_ANNOTATION_PREFIX.exec(trimmed2);
-  if (!prefix)
+  const content = authorizeNoteContent(annotation);
+  if (content === undefined)
     return null;
-  return unwrapQuotedExpression(trimmed2.slice(prefix[0].length).trim());
+  return unwrapQuotedExpression(content.trim());
 }
 function collectAuthorizeExprs(annotations) {
   const exprs = [];
@@ -247174,14 +247477,20 @@ function unwrapQuotedExpression(body) {
   }
   return expr;
 }
-var AUTHORIZE_TAG, AUTHORIZE_ANNOTATION_ANYWHERE, AUTHORIZE_ANNOTATION_PREFIX, GIVEN_REF_PATTERN, STRING_LITERAL_PATTERN;
+var AUTHORIZE_ROUTE = "authorize", AUTHORIZE_TAG_LIKE, AUTHORIZE_ANNOTATION_ANYWHERE, MOTLY_AUTHORIZE_PAYLOAD, MALFORMED_AUTHORIZE_ATTEMPT, GIVEN_REF_PATTERN, STRING_LITERAL_PATTERN, everyMemberOf = () => (...members) => members, ROW_LEVEL_GATE_REJECTION_CAUSES, BOOLEAN_NODES, TRANSPARENT_NODES, SCALAR_COMPARISON_NODES, MAX_GATE_WALK_DEPTH = 64, NO_DEFAULT_GIVEN_PATTERN;
 var init_authorize = __esm(() => {
   init_errors();
-  AUTHORIZE_TAG = String.raw`##?\(\s*authorize\s*\)`;
-  AUTHORIZE_ANNOTATION_ANYWHERE = new RegExp(AUTHORIZE_TAG);
-  AUTHORIZE_ANNOTATION_PREFIX = new RegExp(`^${AUTHORIZE_TAG}`);
+  AUTHORIZE_TAG_LIKE = String.raw`##?\|?[ \t]*[([{<]?[ \t]*authorize(?=[)\]}>]|[ \t]|$)`;
+  AUTHORIZE_ANNOTATION_ANYWHERE = new RegExp(AUTHORIZE_TAG_LIKE, "iu");
+  MOTLY_AUTHORIZE_PAYLOAD = /^[ \t]*[([{<][ \t]*authorize[ \t]*[)\]}>]/iu;
+  MALFORMED_AUTHORIZE_ATTEMPT = /^##?\|?[ \t]*[([{<]?[ \t]*authorize/iu;
   GIVEN_REF_PATTERN = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
   STRING_LITERAL_PATTERN = /'(?:\\.|[^'\\])*'/g;
+  ROW_LEVEL_GATE_REJECTION_CAUSES = everyMemberOf()("array_given_needs_in", "scalar_given_rejects_in", "field_given_has_default", "unsupported_node", "no_given_reference", "unreachable_given", "entry_point_unexpressible");
+  BOOLEAN_NODES = new Set(["and", "or"]);
+  TRANSPARENT_NODES = new Set(["()"]);
+  SCALAR_COMPARISON_NODES = new Set(["=", "!=", ">", ">=", "<", "<="]);
+  NO_DEFAULT_GIVEN_PATTERN = /has no value and no default/;
 });
 
 // src/authorize_metrics.ts
@@ -247197,9 +247506,22 @@ function recordAuthorizeBypass(entryPoint) {
   });
   bypassCounter.add(1, { entry_point: entryPoint });
 }
-var guardRejectionCounter = null, bypassCounter = null;
+function recordRowLevelGateDecision(decision) {
+  rowLevelDecisionCounter ??= publisherMeter().createCounter("publisher_authorize_row_level_total", {
+    description: "How a row-level `#(authorize)` gate resolved a request. Label: decision ('denied_by_gate'|'empty_after_filter'). 'denied_by_gate' is the fail-closed refusal when the gate could not be applied; 'empty_after_filter' is a successful response with zero rows after the filter matched none, which is NOT an error."
+  });
+  rowLevelDecisionCounter.add(1, { decision });
+}
+function recordRowLevelGateRejected(cause) {
+  rowLevelRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_row_level_rejected_total", {
+    description: "Row-level `#(authorize)` gates refused at package load because their compiled condition is not an allowed shape, or an inherited gate that could not be expressed at one derived entry point. Label: cause (" + ROW_LEVEL_GATE_REJECTION_CAUSES.map((c) => `'${c}'`).join("|") + "). All but 'entry_point_unexpressible' fail the whole model load; that one fires at load without failing it — see the doc above. Alert on any nonzero value since the last publish, not on a rate."
+  });
+  rowLevelRejectionCounter.add(1, { cause });
+}
+var guardRejectionCounter = null, bypassCounter = null, rowLevelDecisionCounter = null, rowLevelRejectionCounter = null;
 var init_authorize_metrics = __esm(() => {
   init_telemetry();
+  init_authorize();
 });
 
 // src/materialization_metrics.ts
@@ -247800,7 +248122,10 @@ function annotationTexts(annote) {
   return texts.length > 0 ? texts : undefined;
 }
 function ownLevelNoteTexts(annote) {
-  return [...annote?.blockNotes ?? [], ...annote?.notes ?? []].map((note) => note.text);
+  return ownLevelNotes(annote).map((note) => note.text);
+}
+function ownLevelNotes(annote) {
+  return [...annote?.blockNotes ?? [], ...annote?.notes ?? []];
 }
 var init_annotations = () => {};
 
@@ -247995,6 +248320,18 @@ function assertMaterializationEligible(persistSource) {
     });
   }
 }
+function assertColocatedPersistNotAuthorizeGated(persistSource, sourceName = persistSource.name, origin2 = "persist") {
+  if (referencesAuthorize(persistSource)) {
+    recordEligibilityRefused("authorize");
+    const gated = origin2 === "preaggregate" ? `the source '${sourceName}' rolls up is protected by an ` + `#(authorize) gate (its own or a joined source's)` : `it is protected by an #(authorize) gate (its own or a joined ` + `source's)`;
+    const remedy = origin2 === "preaggregate" ? `Remove the '#@ preaggregate' annotation from the gated source's ` + `measure(s), or move the gate to a source that is not ` + `pre-aggregated.` : `Drop '#@ persist' from this source, or move the gate to a source ` + `that is not materialized.`;
+    const what = origin2 === "preaggregate" ? `Pre-aggregation rollup '${sourceName}' cannot be built` : `Source '${sourceName}' cannot be materialized (colocated ` + `'#@ persist')`;
+    const alsoRollup = origin2 === "preaggregate" ? ` A rollup also groups ACROSS the gated column, so it could not ` + `be row-filtered afterwards even in principle.` : "";
+    throw new MaterializationEligibilityError({
+      message: `${what}: ${gated}. An authorize expression is evaluated per ` + `request; a materialized-once table served frozen carries no gate, ` + `so it would be served to everyone, bypassing authorization.` + `${alsoRollup} This is refused for safety. ${remedy}`
+    });
+  }
+}
 function unboundParameterNames(persistSource) {
   const def = persistSource._sourceDef;
   if (def === null || typeof def !== "object") {
@@ -249248,16 +249585,182 @@ var init_preaggregation_validation = __esm(() => {
   init_preaggregation_classifier();
 });
 
+// src/service/gate_registry_walk.ts
+import { isSourceDef } from "@malloydata/malloy";
+function resolveDeclaredSource(struct, modelDef) {
+  if (!modelDef)
+    return { kind: "none" };
+  let sawBrokenEntry = false;
+  for (const id of [struct.referenceID, struct.sourceID]) {
+    const entry = id ? modelDef.sourceRegistry?.[id]?.entry : undefined;
+    if (!entry)
+      continue;
+    const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
+    if (declared === struct)
+      continue;
+    if (!declared || !isSourceDef(declared)) {
+      sawBrokenEntry = true;
+      continue;
+    }
+    return { kind: "resolved", source: declared };
+  }
+  return sawBrokenEntry ? { kind: "unresolvable" } : { kind: "none" };
+}
+function ancestorGateExprs(struct, modelDef, seen = new Set) {
+  let inherited = struct.annotations?.inherits;
+  for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+    const exprs2 = collectAuthorizeExprs(ownLevelNoteTexts(inherited));
+    if (exprs2.length > 0)
+      return exprs2;
+    inherited = inherited.inherits;
+  }
+  if (inherited)
+    return ["false"];
+  seen.add(struct);
+  if (seen.size > ANCESTOR_WALK_MAX_DEPTH)
+    return ["false"];
+  const declared = resolveDeclaredSource(struct, modelDef);
+  if (declared.kind === "unresolvable")
+    return ["false"];
+  if (declared.kind === "none" || seen.has(declared.source))
+    return [];
+  const exprs = collectAuthorizeExprs(ownLevelNoteTexts(declared.source.annotations));
+  return exprs.length > 0 ? exprs : ancestorGateExprs(declared.source, modelDef, seen);
+}
+function resolveQuerySourceBase(struct, modelDef) {
+  const duck = struct;
+  if (duck.type !== "query_source")
+    return;
+  const ref = duck.query?.structRef;
+  const base = typeof ref === "string" ? modelDef?.contents[ref] : ref;
+  return base && isSourceDef(base) ? base : undefined;
+}
+function resolveCompositeResolvedBase(struct) {
+  const duck = struct;
+  return duck.type === "query_source" ? duck.query?.compositeResolvedSourceDef : undefined;
+}
+function effectiveAncestorGateExprs(struct, modelDef, seen = new Set) {
+  const direct = ancestorGateExprs(struct, modelDef, new Set(seen));
+  if (direct.length > 0)
+    return [direct];
+  if (seen.has(struct))
+    return [];
+  seen.add(struct);
+  const groups = [];
+  const base = resolveQuerySourceBase(struct, modelDef);
+  if (!base) {
+    const duck = struct;
+    if (duck.type === "query_source")
+      groups.push(["false"]);
+  } else if (!seen.has(base)) {
+    const ownExprs = collectAuthorizeExprs(ownLevelNoteTexts(base.annotations));
+    groups.push(...ownExprs.length > 0 ? [ownExprs] : effectiveAncestorGateExprs(base, modelDef, seen));
+  }
+  const composite = resolveCompositeResolvedBase(struct);
+  if (composite && !seen.has(composite)) {
+    const parentOwnNotes = base ? ownLevelNotes(base.annotations) : [];
+    const compositeOwnNotes = ownLevelNotes(composite.annotations).filter((note) => !parentOwnNotes.includes(note));
+    const compositeOwn = collectAuthorizeExprs(compositeOwnNotes.map((note) => note.text));
+    groups.push(...compositeOwn.length > 0 ? [compositeOwn] : effectiveAncestorGateExprs(composite, modelDef, seen));
+  }
+  return groups;
+}
+function derivedStructsReachable(roots, modelDef) {
+  const seen = new Set(roots);
+  const found = [];
+  const worklist = [...roots];
+  for (let i = 0;i < worklist.length; i++) {
+    const struct = worklist[i];
+    for (const next of [
+      resolveQuerySourceBase(struct, modelDef),
+      resolveCompositeResolvedBase(struct)
+    ]) {
+      if (!next || seen.has(next))
+        continue;
+      seen.add(next);
+      found.push(next);
+      worklist.push(next);
+    }
+  }
+  return found;
+}
+var ANCESTOR_WALK_MAX_DEPTH = 32;
+var init_gate_registry_walk = __esm(() => {
+  init_annotations();
+  init_authorize();
+});
+
 // src/service/source_extraction.ts
 import {
-  isSourceDef
+  isJoined as isJoined2,
+  isSourceDef as isSourceDef2
 } from "@malloydata/malloy";
+function joinFieldNamesUnresolvableDeclaration(field, modelDef) {
+  const ids = [field.referenceID, field.sourceID].filter((id) => !!id);
+  if (ids.length === 0)
+    return false;
+  for (const id of ids) {
+    const entry = modelDef.sourceRegistry?.[id]?.entry;
+    if (!entry)
+      continue;
+    const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
+    if (declared && isSourceDef2(declared))
+      return false;
+  }
+  return true;
+}
 function extractSourcesFromModelDef(modelDef, givens, onParseError) {
   const filterMap = new Map;
   const authorizeMap = new Map;
-  const ownAuthorizeSources = [];
-  const fileLevelAuthorize = collectAuthorizeExprs((modelAnnotations(modelDef).notes ?? []).map((note) => note.text));
-  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef(obj)).map((sourceObj) => {
+  const misplacedAuthorize = [];
+  const gatedSourceOwnAuthorizeNotes = new Set;
+  const nearMissAuthorize = [];
+  const sweptStructs = [];
+  for (const obj of Object.values(modelDef.contents)) {
+    if (!isSourceDef2(obj))
+      continue;
+    const struct = obj;
+    sweptStructs.push(obj);
+    for (const note of ownLevelNotes(struct.annotations)) {
+      if (containsAuthorizeAnnotationTag([note.text])) {
+        gatedSourceOwnAuthorizeNotes.add(note);
+      }
+    }
+    nearMissAuthorize.push(...collectAuthorizeNearMisses([
+      ...ownLevelNotes(struct.annotations),
+      ...struct.fields.flatMap((field) => ownLevelNotes(field.annotations))
+    ].map((note) => note.text)));
+  }
+  for (const value of Object.values(modelDef.sourceRegistry ?? {})) {
+    const entry = value.entry;
+    if (entry.type === "source_registry_reference")
+      continue;
+    if (!isSourceDef2(entry))
+      continue;
+    sweptStructs.push(entry);
+    for (const note of ownLevelNotes(entry.annotations)) {
+      if (containsAuthorizeAnnotationTag([note.text])) {
+        gatedSourceOwnAuthorizeNotes.add(note);
+      }
+    }
+    nearMissAuthorize.push(...collectAuthorizeNearMisses(ownLevelNotes(entry.annotations).map((note) => note.text)));
+  }
+  for (const struct of derivedStructsReachable(sweptStructs, modelDef)) {
+    nearMissAuthorize.push(...collectAuthorizeNearMisses([
+      ...ownLevelNotes(struct.annotations),
+      ...struct.fields.flatMap((field) => ownLevelNotes(field.annotations))
+    ].map((note) => note.text)));
+  }
+  {
+    const folded = modelAnnotations(modelDef);
+    nearMissAuthorize.push(...collectAuthorizeNearMisses([...folded.notes ?? [], ...folded.blockNotes ?? []].map((note) => note.text)));
+  }
+  assertNoAuthorizeNearMisses(nearMissAuthorize);
+  const authorizeOwnNotes = new Map;
+  if (containsAuthorizeAnnotationTag((modelAnnotations(modelDef).notes ?? []).map((note) => note.text))) {
+    misplacedAuthorize.push({ kind: "file" });
+  }
+  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef2(obj)).map((sourceObj) => {
     const struct = sourceObj;
     const sourceName = struct.as || struct.name;
     const annotations = annotationTexts(struct.annotations);
@@ -249295,36 +249798,44 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
     }
     const ownNotes = ownLevelNoteTexts(struct.annotations);
     const ownGates = collectAuthorizeExprs(ownNotes);
-    let inheritedGates = [];
-    if (ownGates.length === 0) {
-      for (let cur2 = struct.annotations?.inherits;cur2; cur2 = cur2.inherits) {
-        const exprs = collectAuthorizeExprs(ownLevelNoteTexts(cur2));
-        if (exprs.length > 0) {
-          inheritedGates = exprs;
-          break;
-        }
-      }
-    }
-    const effective = [
-      ...fileLevelAuthorize,
-      ...ownGates.length > 0 ? ownGates : inheritedGates
-    ];
+    authorizeOwnNotes.set(sourceName, ownLevelNotes(struct.annotations).filter((note) => containsAuthorizeAnnotationTag([note.text])));
+    const inheritedGroups = ownGates.length === 0 ? effectiveAncestorGateExprs(struct, modelDef) : [];
+    const effectiveGroups = ownGates.length > 0 ? [ownGates] : inheritedGroups;
     let authorize;
-    if (effective.length > 0) {
-      authorizeMap.set(sourceName, effective);
-      authorize = effective;
-    }
-    const ownEffective = [...fileLevelAuthorize, ...ownGates];
-    if (ownEffective.length > 0) {
-      ownAuthorizeSources.push({
-        name: sourceName,
-        authorize: ownEffective
-      });
+    if (effectiveGroups.length > 0) {
+      authorizeMap.set(sourceName, effectiveGroups);
+      authorize = effectiveGroups.flat();
     }
     const views = struct.fields.filter((field) => field.type === "turtle").filter((turtle) => turtle.pipeline.map((stage) => stage.type).every((type) => type === "reduce")).map((turtle) => ({
       name: turtle.as || turtle.name,
       annotations: annotationTexts(turtle.annotations)
     }));
+    for (const field of struct.fields) {
+      const fieldAuthorizeNotes = ownLevelNotes(field.annotations).filter((note) => containsAuthorizeAnnotationTag([note.text]));
+      if (fieldAuthorizeNotes.length === 0)
+        continue;
+      if (fieldAuthorizeNotes.every((note) => gatedSourceOwnAuthorizeNotes.has(note))) {
+        continue;
+      }
+      const fieldName2 = field.as || field.name;
+      if (isJoined2(field) && isSourceDef2(field)) {
+        const joinedStruct = field;
+        if (joinFieldNamesUnresolvableDeclaration(joinedStruct, modelDef)) {
+          continue;
+        }
+        misplacedAuthorize.push({
+          kind: "field",
+          name: sourceName,
+          fieldName: fieldName2
+        });
+        continue;
+      }
+      misplacedAuthorize.push({
+        kind: "field",
+        name: sourceName,
+        fieldName: fieldName2
+      });
+    }
     return {
       name: sourceName,
       annotations,
@@ -249334,20 +249845,33 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
       authorize
     };
   });
-  return { sources, filterMap, authorizeMap, ownAuthorizeSources };
+  return {
+    sources,
+    filterMap,
+    authorizeMap,
+    misplacedAuthorize,
+    authorizeOwnNotes
+  };
 }
 function extractQueriesFromModelDef(modelDef) {
   const isNamedQuery = (obj) => obj.type === "query";
-  return Object.values(modelDef.contents).filter(isNamedQuery).map((queryObj) => ({
+  const namedQueries = Object.values(modelDef.contents).filter(isNamedQuery);
+  const misplacedAuthorize = namedQueries.filter((queryObj) => containsAuthorizeAnnotationTag(ownLevelNoteTexts(queryObj.annotations))).map((queryObj) => ({
+    kind: "query",
+    name: queryObj.as || queryObj.name
+  }));
+  const queries = namedQueries.map((queryObj) => ({
     name: queryObj.as || queryObj.name,
     sourceName: typeof queryObj.structRef === "string" ? queryObj.structRef : undefined,
     annotations: annotationTexts(queryObj.annotations)
   }));
+  return { queries, misplacedAuthorize };
 }
 var init_source_extraction = __esm(() => {
   init_annotations();
   init_authorize();
   init_filter();
+  init_gate_registry_walk();
 });
 
 // src/service/model.ts
@@ -249355,7 +249879,7 @@ import {
   API,
   FixedConnectionMap,
   InMemoryURLReader as InMemoryURLReader2,
-  isSourceDef as isSourceDef2,
+  isSourceDef as isSourceDef3,
   MalloyConfig as MalloyConfig2,
   MalloyError as MalloyError2,
   Annotations as Annotations4,
@@ -249371,7 +249895,7 @@ import { readFileSync } from "fs";
 import { createRequire as createRequire2 } from "module";
 import * as path8 from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
-function quoteMalloyIdentifier(name) {
+function quoteMalloyIdentifier2(name) {
   return "`" + (name ?? "").replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
 }
 function makeHydrationRuntime(malloyConfig, buildManifest) {
@@ -249414,6 +249938,7 @@ function hydrateNotebookCells(runtime, notebookCells) {
       text: sc.text,
       runnable,
       modelMaterializer,
+      modelDef: cellModelDef,
       newSources: sc.newSources,
       queryInfo: sc.queryInfo
     };
@@ -249428,7 +249953,7 @@ function hydrateMarkdownOnlyCells(notebookCells) {
     return { type: "code", text: sc.text };
   });
 }
-var MALLOY_VERSION, ANCESTOR_WALK_MAX_DEPTH = 32, Model;
+var MALLOY_VERSION, Model;
 var init_model = __esm(() => {
   init_telemetry();
   init_materialization_metrics();
@@ -249451,6 +249976,7 @@ var init_model = __esm(() => {
   init_json_utils();
   init_query_metadata();
   init_preaggregation_validation();
+  init_gate_registry_walk();
   init_source_extraction();
   init_authorize_metrics();
   MALLOY_VERSION = createRequire2(import.meta.url)("@malloydata/malloy/package.json").version;
@@ -249473,7 +249999,6 @@ var init_model = __esm(() => {
     compilationError;
     filterMap;
     givens;
-    fileLevelAuthorize = [];
     declaredQueryMetadataMemo;
     declaredSourceQueryMetadataMemo;
     authorizeReferencedGivenNames = new Set;
@@ -249482,6 +250007,11 @@ var init_model = __esm(() => {
     freshnessResolver;
     preaggregateEntityIdResolver;
     entryPointGatesBySource = new Map;
+    gateRuntime;
+    gateShapeCache = new Map;
+    graftedMaterializerCache = new Map;
+    static GRAFTED_MATERIALIZER_CACHE_MAX = 32;
+    rowLevelFilteredRunnables = new WeakSet;
     meter = publisherMeter();
     queryExecutionHistogram = this.meter.createHistogram("malloy_model_query_duration", {
       description: "How long it takes to execute a Malloy model query",
@@ -249505,11 +250035,6 @@ var init_model = __esm(() => {
       this.compilationError = compilationError;
       this.filterMap = filterMap ?? new Map;
       this.givens = givens;
-      try {
-        this.fileLevelAuthorize = this.modelDef ? collectAuthorizeExprs((modelAnnotations(this.modelDef).notes ?? []).map((note) => note.text)) : [];
-      } catch {
-        this.fileLevelAuthorize = [];
-      }
       try {
         this.entryPointGatesBySource = this.computeEntryPointGatesBySource();
       } catch {
@@ -249539,8 +250064,64 @@ var init_model = __esm(() => {
     getFilters(sourceName) {
       return this.filterMap.get(sourceName) ?? [];
     }
+    setGateRuntime(runtime) {
+      this.gateRuntime = runtime;
+    }
+    defaultGraftScope() {
+      if (!this.modelDef || !this.modelMaterializer)
+        return;
+      return {
+        modelDef: this.modelDef,
+        materializer: this.modelMaterializer,
+        cacheScope: "model"
+      };
+    }
+    graftScopeForCell(cellIndex) {
+      const cells = this.runnableNotebookCells;
+      if (!cells)
+        return;
+      for (let i = cellIndex - 1;i >= 0; i--) {
+        const prior = cells[i];
+        if (prior.type === "code" && prior.modelDef && prior.modelMaterializer) {
+          return {
+            modelDef: prior.modelDef,
+            materializer: prior.modelMaterializer,
+            cacheScope: `cell:${i}`
+          };
+        }
+      }
+      return;
+    }
+    selfGraftScopeForCell(cellIndex) {
+      const cell = this.runnableNotebookCells?.[cellIndex];
+      if (!cell?.modelDef || !cell.modelMaterializer)
+        return;
+      return {
+        modelDef: cell.modelDef,
+        materializer: cell.modelMaterializer,
+        cacheScope: `cell-self:${cellIndex}`
+      };
+    }
+    async resolveNotebookCellGraftScope(cellIndex, runnable) {
+      const selfScope = this.selfGraftScopeForCell(cellIndex);
+      const earlierScope = this.graftScopeForCell(cellIndex);
+      if (!earlierScope)
+        return { graftScope: selfScope, usesOwnScope: true };
+      const { struct, modelDef } = await this.resolveRunTargetStruct(runnable);
+      if (struct && modelDef && this.resolveGraftTarget(struct, modelDef, earlierScope.modelDef)) {
+        return { graftScope: earlierScope, usesOwnScope: false };
+      }
+      return { graftScope: selfScope, usesOwnScope: true };
+    }
+    givenDeclaredTypesCache;
     givenDeclaredTypes() {
-      return new Map((this.givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
+      this.givenDeclaredTypesCache ??= new Map((this.givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
+      return this.givenDeclaredTypesCache;
+    }
+    givenDeclaredDefaultsCache;
+    givenDeclaredDefaults() {
+      this.givenDeclaredDefaultsCache ??= new Map((this.givens ?? []).filter((g) => g.name != null && g.default != null).map((g) => [g.name, g.default]));
+      return this.givenDeclaredDefaultsCache;
     }
     getAuthorize(sourceName) {
       return this.sources?.find((source) => source.name === sourceName)?.authorize ?? [];
@@ -249565,7 +250146,6 @@ var init_model = __esm(() => {
             names.add(name);
         }
       };
-      addExprs(this.fileLevelAuthorize);
       for (const gates of this.entryPointGatesBySource.values()) {
         for (const { exprs } of gates)
           addExprs(exprs);
@@ -249578,7 +250158,7 @@ var init_model = __esm(() => {
       if (!modelDef)
         return byName;
       for (const entry of Object.values(modelDef.contents)) {
-        if (!isSourceDef2(entry))
+        if (!isSourceDef3(entry))
           continue;
         const name = entry.as ?? entry.name;
         byName.set(name, this.collectEntryPointGates(entry, modelDef, new Set, true));
@@ -249586,27 +250166,68 @@ var init_model = __esm(() => {
       return byName;
     }
     hasAuthorize() {
-      return this.fileLevelAuthorize.length > 0 || (this.sources?.some((s) => (s.authorize?.length ?? 0) > 0) ?? false);
-    }
-    effectiveAuthorizeFor(sourceName) {
-      if (sourceName && this.sources?.some((s) => s.name === sourceName)) {
-        return this.getAuthorize(sourceName);
-      }
-      return this.fileLevelAuthorize;
+      return this.sources?.some((s) => (s.authorize?.length ?? 0) > 0) ?? false;
+    }
+    anyAuthorizeNote;
+    hasAnyAuthorizeNote() {
+      if (this.anyAuthorizeNote !== undefined)
+        return this.anyAuthorizeNote;
+      this.anyAuthorizeNote = (() => {
+        const modelDef = this.modelDef;
+        if (!modelDef)
+          return false;
+        try {
+          const structs = [];
+          for (const obj of Object.values(modelDef.contents)) {
+            if (isSourceDef3(obj))
+              structs.push(obj);
+          }
+          for (const value of Object.values(modelDef.sourceRegistry ?? {})) {
+            const entry = value.entry;
+            if (entry.type === "source_registry_reference")
+              continue;
+            if (isSourceDef3(entry))
+              structs.push(entry);
+          }
+          structs.push(...derivedStructsReachable(structs, modelDef));
+          for (const struct of structs) {
+            if (containsAuthorizeAnnotationTag(annotationTexts(struct.annotations) ?? [])) {
+              return true;
+            }
+            for (const field of struct.fields) {
+              if (containsAuthorizeAnnotationTag(annotationTexts(field.annotations) ?? [])) {
+                return true;
+              }
+            }
+          }
+          return false;
+        } catch {
+          return true;
+        }
+      })();
+      return this.anyAuthorizeNote;
     }
-    async assertAuthorized(sourceName, givens, bypassAuthorize = false) {
+    async assertAuthorized(sourceName, givens, bypassAuthorize = false, graftScope = this.defaultGraftScope()) {
       if (bypassAuthorize) {
         this.noteAuthorizeBypass("source", sourceName);
         return;
       }
       const gates = sourceName ? this.entryPointGatesBySource.get(sourceName) : undefined;
       if (gates) {
-        for (const { label, exprs, selfContained, ambientPrefix } of gates) {
-          await this.assertAuthorizedExprs(label, exprs, givens, selfContained, ambientPrefix);
+        for (const entry of gates) {
+          const resolution = this.modelDef ? await this.resolveGateShape(entry, this.modelDef, graftScope) : { kind: "given_only" };
+          if (resolution.kind === "row_level")
+            continue;
+          if (resolution.kind === "deny") {
+            recordRowLevelGateDecision("denied_by_gate");
+            if (resolution.cause)
+              recordRowLevelGateRejected(resolution.cause);
+            throw new AccessDeniedError(`Access denied for source "${entry.label}".`);
+          }
+          await this.assertAuthorizedExprs(entry.label, entry.exprs, givens, entry.selfContained);
         }
         return;
       }
-      await this.assertAuthorizedExprs(sourceName ?? "(query)", this.effectiveAuthorizeFor(sourceName), givens);
     }
     noteAuthorizeBypass(entryPoint, sourceName) {
       recordAuthorizeBypass(entryPoint);
@@ -249617,7 +250238,7 @@ var init_model = __esm(() => {
         packageName: this.packageName
       });
     }
-    async assertAuthorizedExprs(label, exprs, givens, selfContainedFirst = false, ambientPrefix = 0) {
+    async assertAuthorizedExprs(label, exprs, givens, selfContainedFirst = false) {
       if (exprs.length === 0)
         return;
       const deny = () => {
@@ -249627,7 +250248,7 @@ var init_model = __esm(() => {
         deny();
       let passed = false;
       try {
-        passed = await evaluateAuthorize(this.modelMaterializer, exprs, givens, this.givenDeclaredTypes(), { selfContainedFirst, ambientPrefix });
+        passed = await evaluateAuthorize(this.modelMaterializer, exprs, givens, this.givenDeclaredTypes(), { selfContainedFirst });
       } catch (err) {
         logger.debug("Authorize probe failed; denying", {
           sourceName: label,
@@ -249640,28 +250261,102 @@ var init_model = __esm(() => {
         deny();
     }
     async assertAuthorizedForAllSources(runnable, givens, bypassAuthorize = false) {
-      if (bypassAuthorize) {
-        this.noteAuthorizeBypass("runnable", await this.resolveAuthorizeSourceFromRunnable(runnable));
-        return;
-      }
-      const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
-      await this.assertAuthorized(ownSourceName, givens);
-      await this.assertAuthorizedFromCompiledRunnable(runnable, givens);
+      await this.authorizeAndBindRunnable(runnable, givens, {
+        bypassAuthorize
+      });
     }
-    async assertAuthorizedFromCompiledRunnable(runnable, givens) {
+    async collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate = false) {
+      const ownSourceName = await this.resolveAuthorizeSourceFromRunnable(runnable);
+      if (!skipOwnSourceGate) {
+        await this.assertAuthorized(ownSourceName, givens, false, graftScope);
+      }
       const { struct, modelDef, compositeResolvedSourceDef } = await this.resolveRunTargetStruct(runnable);
       const seen = new Set;
       const entryPointGates = this.collectEntryPointGates(struct, modelDef, seen, true);
       if (compositeResolvedSourceDef && modelDef) {
-        entryPointGates.push(...this.collectEntryPointGates(compositeResolvedSourceDef, modelDef, seen, true));
+        entryPointGates.push(...this.collectEntryPointGates(compositeResolvedSourceDef, modelDef, seen, true, undefined, struct ? ownLevelNotes(struct.annotations) : []));
       }
-      for (const {
-        label,
-        exprs,
-        selfContained,
-        ambientPrefix
-      } of entryPointGates) {
-        await this.assertAuthorizedExprs(label, exprs, givens, selfContained, ambientPrefix);
+      return { entryPointGates, modelDef };
+    }
+    async assertAuthorizedFromCompiledRunnable(runnable, givens) {
+      await this.authorizeAndBindRunnable(runnable, givens, {
+        skipOwnSourceGate: true
+      });
+    }
+    queryHadRowLevelFilterAttached(runnable) {
+      return this.rowLevelFilteredRunnables.has(runnable);
+    }
+    async probeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate = false) {
+      const { entryPointGates, modelDef } = await this.collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate);
+      const rowLevel = [];
+      for (const entry of entryPointGates) {
+        const resolution = modelDef ? await this.resolveGateShape(entry, modelDef, graftScope) : { kind: "given_only" };
+        if (resolution.kind === "row_level") {
+          rowLevel.push({
+            label: entry.label,
+            graftTarget: resolution.graftTarget,
+            filterText: resolution.filterText,
+            condition: resolution.condition
+          });
+          continue;
+        }
+        if (resolution.kind === "deny") {
+          recordRowLevelGateDecision("denied_by_gate");
+          if (resolution.cause)
+            recordRowLevelGateRejected(resolution.cause);
+          throw new AccessDeniedError(`Access denied for source "${entry.label}".`);
+        }
+        await this.assertAuthorizedExprs(entry.label, entry.exprs, givens, entry.selfContained);
+      }
+      return rowLevel;
+    }
+    async queryEntryPointHasRowLevelGate(runnable) {
+      try {
+        const { struct, modelDef, compositeResolvedSourceDef } = await this.resolveRunTargetStruct(runnable);
+        if (!modelDef)
+          return true;
+        const seen = new Set;
+        const gates = this.collectEntryPointGates(struct, modelDef, seen, true);
+        if (compositeResolvedSourceDef) {
+          gates.push(...this.collectEntryPointGates(compositeResolvedSourceDef, modelDef, seen, true, undefined, struct ? ownLevelNotes(struct.annotations) : []));
+        }
+        const graftScope = this.defaultGraftScope();
+        for (const entry of gates) {
+          const resolution = await this.resolveGateShape(entry, modelDef, graftScope);
+          if (resolution.kind !== "given_only")
+            return true;
+        }
+        return false;
+      } catch {
+        return true;
+      }
+    }
+    async authorizeAndBindRunnable(runnable, givens, options) {
+      if (options?.bypassAuthorize) {
+        this.noteAuthorizeBypass("runnable", await this.resolveAuthorizeSourceFromRunnable(runnable));
+        return runnable;
+      }
+      const graftScope = options?.graftScope ?? this.defaultGraftScope();
+      const rowLevel = await this.probeEntryPointGates(runnable, givens, graftScope, options?.skipOwnSourceGate ?? false);
+      if (rowLevel.length === 0)
+        return runnable;
+      if (!options?.recompile) {
+        recordRowLevelGateDecision("denied_by_gate");
+        throw new AccessDeniedError(`Access denied for source "${rowLevel[0].label}".`);
+      }
+      try {
+        const graftedMaterializer = this.getOrBuildGraftedMaterializer(rowLevel, graftScope);
+        const recompiled = options.recompile(graftedMaterializer);
+        await this.assertGateLanded(recompiled, rowLevel);
+        this.rowLevelFilteredRunnables.add(recompiled);
+        return recompiled;
+      } catch (err) {
+        recordRowLevelGateDecision("denied_by_gate");
+        logger.debug("Row-level authorize attach failed; denying", {
+          modelPath: this.modelPath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        throw new AccessDeniedError(`Access denied for source "${rowLevel[0].label}".`);
       }
     }
     async resolveRunTargetStruct(runnable) {
@@ -249689,107 +250384,233 @@ var init_model = __esm(() => {
         };
       }
     }
-    gateExprsForOwnAnnotations(struct, modelDef) {
-      const ownNotes = ownLevelNoteTexts(struct.annotations);
+    gateExprsForOwnAnnotations(struct, modelDef, excludeNotes = []) {
+      const ownNotes = ownLevelNotes(struct.annotations).filter((note) => !excludeNotes.includes(note));
       try {
-        const own = collectAuthorizeExprs(ownNotes);
+        const own = collectAuthorizeExprs(ownNotes.map((note) => note.text));
         if (own.length > 0) {
-          return {
-            exprs: [...this.fileLevelAuthorize, ...own],
-            fromAncestor: false,
-            ambientPrefix: this.fileLevelAuthorize.length
-          };
+          return { exprs: own, fromAncestor: false };
         }
-        const ancestor = this.ancestorGateExprs(struct, modelDef);
-        return {
-          exprs: [...this.fileLevelAuthorize, ...ancestor],
-          fromAncestor: ancestor.length > 0,
-          ambientPrefix: this.fileLevelAuthorize.length
-        };
+        const ancestor = ancestorGateExprs(struct, modelDef);
+        return { exprs: ancestor, fromAncestor: ancestor.length > 0 };
       } catch {
-        return { exprs: ["false"], fromAncestor: false, ambientPrefix: 0 };
+        return { exprs: ["false"], fromAncestor: false };
       }
     }
-    ancestorGateExprs(struct, modelDef, seen = new Set) {
-      let inherited = struct.annotations?.inherits;
-      for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
-        const exprs2 = collectAuthorizeExprs(ownLevelNoteTexts(inherited));
-        if (exprs2.length > 0)
-          return exprs2;
-        inherited = inherited.inherits;
-      }
-      if (inherited)
-        return ["false"];
-      seen.add(struct);
-      if (seen.size > ANCESTOR_WALK_MAX_DEPTH)
-        return ["false"];
-      const declared = this.resolveDeclaredSource(struct, modelDef);
-      if (declared.kind === "unresolvable")
-        return ["false"];
-      if (declared.kind === "none" || seen.has(declared.source))
-        return [];
-      const exprs = collectAuthorizeExprs(ownLevelNoteTexts(declared.source.annotations));
-      return exprs.length > 0 ? exprs : this.ancestorGateExprs(declared.source, modelDef, seen);
-    }
-    resolveDeclaredSource(struct, modelDef) {
-      if (!modelDef)
-        return { kind: "none" };
-      let sawBrokenEntry = false;
-      for (const id of [struct.referenceID, struct.sourceID]) {
-        const entry = id ? modelDef.sourceRegistry?.[id]?.entry : undefined;
-        if (!entry)
-          continue;
-        const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
-        if (declared === struct)
-          continue;
-        if (!declared || !isSourceDef2(declared)) {
-          sawBrokenEntry = true;
-          continue;
-        }
-        return { kind: "resolved", source: declared };
-      }
-      return sawBrokenEntry ? { kind: "unresolvable" } : { kind: "none" };
-    }
-    collectEntryPointGates(struct, modelDef, seen = new Set, treatAsOwnGate = false) {
+    collectEntryPointGates(struct, modelDef, seen = new Set, treatAsOwnGate = false, entryPointStruct = struct, excludeNotes = []) {
       if (!struct || !modelDef || seen.has(struct))
         return [];
       seen.add(struct);
       const results = [];
       const label = struct.as ?? struct.name;
-      const {
-        exprs: ownExprs,
-        fromAncestor,
-        ambientPrefix
-      } = this.gateExprsForOwnAnnotations(struct, modelDef);
+      const { exprs: ownExprs, fromAncestor } = this.gateExprsForOwnAnnotations(struct, modelDef, excludeNotes);
       if (ownExprs.length > 0) {
         results.push({
           label,
           exprs: ownExprs,
           selfContained: fromAncestor || !treatAsOwnGate,
-          ambientPrefix
+          struct: entryPointStruct
         });
       }
       const duck = struct;
       if (duck.type === "query_source") {
-        const ref = duck.query?.structRef;
-        const base = typeof ref === "string" ? modelDef.contents[ref] : ref;
-        if (base && isSourceDef2(base)) {
-          results.push(...this.collectEntryPointGates(base, modelDef, seen));
+        const base = resolveQuerySourceBase(struct, modelDef);
+        if (base) {
+          results.push(...this.collectEntryPointGates(base, modelDef, seen, false, entryPointStruct));
         } else {
           results.push({
             label,
             exprs: ["false"],
-            selfContained: true,
-            ambientPrefix: 0
+            selfContained: true
           });
         }
         const resolved = duck.query?.compositeResolvedSourceDef;
         if (resolved) {
-          results.push(...this.collectEntryPointGates(resolved, modelDef, seen));
+          results.push(...this.collectEntryPointGates(resolved, modelDef, seen, false, entryPointStruct, base ? ownLevelNotes(base.annotations) : []));
         }
       }
       return results;
     }
+    async resolveGateShape(entry, originModelDef, graftScope) {
+      if (!entry.struct)
+        return { kind: "given_only" };
+      if (!graftScope) {
+        logger.debug("Row-level gate has no graft scope to attach to (no scope was available at all, not the gate's own condition); denying", { modelPath: this.modelPath, label: entry.label });
+        return { kind: "deny" };
+      }
+      const graftTarget = this.resolveGraftTarget(entry.struct, originModelDef, graftScope.modelDef);
+      if (!graftTarget) {
+        return this.classifyWithoutGraft(entry, graftScope.materializer);
+      }
+      const filterText = gateFilterText(entry.exprs);
+      const cacheKey = `${graftScope.cacheScope}\x00${graftTarget}\x00${filterText}`;
+      let cached2 = this.gateShapeCache.get(cacheKey);
+      if (!cached2) {
+        let condition;
+        try {
+          condition = await this.liftGateCondition(graftTarget, filterText, graftScope.materializer);
+        } catch (err) {
+          logger.debug("Row-level gate condition failed to lift; checking whether it is given-only before denying", {
+            modelPath: this.modelPath,
+            graftTarget,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          return this.classifyWithoutGraft(entry, graftScope.materializer);
+        }
+        const classification = classifyAuthorizeGate(condition, this.givenDeclaredTypes(), this.givenDeclaredDefaults());
+        cached2 = { classification, condition };
+        this.gateShapeCache.set(cacheKey, cached2);
+      }
+      if (cached2.classification.shape === "given_only") {
+        return { kind: "given_only" };
+      }
+      if (cached2.classification.shape === "rejected") {
+        return { kind: "deny", cause: cached2.classification.cause };
+      }
+      return {
+        kind: "row_level",
+        graftTarget,
+        filterText,
+        condition: cached2.condition
+      };
+    }
+    async classifyWithoutGraft(entry, materializer) {
+      try {
+        await materializer.loadQuery(buildAuthorizeProbe(entry.exprs)).getPreparedQuery();
+        return { kind: "given_only" };
+      } catch (err) {
+        logger.debug("Row-level gate has no attachable graft and does not compile as given-only; denying", {
+          modelPath: this.modelPath,
+          label: entry.label,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        return { kind: "deny" };
+      }
+    }
+    resolveGraftTarget(struct, originModelDef, graftModelDef) {
+      const direct = this.findContentsKey(struct, graftModelDef);
+      if (direct)
+        return direct;
+      let current = struct;
+      const seen = new Set([struct]);
+      for (let depth = 0;depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+        const declared = resolveDeclaredSource(current, originModelDef);
+        let next;
+        if (declared.kind === "resolved" && !seen.has(declared.source)) {
+          next = declared.source;
+        } else if (declared.kind === "none") {
+          next = this.findSourceByOwnAnnotationIdentity(current, graftModelDef, seen);
+        }
+        if (!next)
+          return;
+        const key = this.findContentsKey(next, graftModelDef);
+        if (key)
+          return key;
+        seen.add(next);
+        current = next;
+      }
+      return;
+    }
+    findContentsKey(struct, modelDef) {
+      for (const [key, value] of Object.entries(modelDef.contents)) {
+        if (value === struct)
+          return key;
+      }
+      if (struct.sourceID) {
+        for (const [key, value] of Object.entries(modelDef.contents)) {
+          if (isSourceDef3(value) && value.sourceID === struct.sourceID) {
+            return key;
+          }
+        }
+      }
+      return;
+    }
+    findSourceByOwnAnnotationIdentity(struct, modelDef, exclude) {
+      const ownNotes = [
+        ...struct.annotations?.blockNotes ?? [],
+        ...struct.annotations?.notes ?? []
+      ];
+      if (ownNotes.length === 0)
+        return;
+      for (const value of Object.values(modelDef.contents)) {
+        if (!isSourceDef3(value) || value === struct || exclude.has(value)) {
+          continue;
+        }
+        const candidateNotes = [
+          ...value.annotations?.blockNotes ?? [],
+          ...value.annotations?.notes ?? []
+        ];
+        if (candidateNotes.some((note) => ownNotes.includes(note))) {
+          return value;
+        }
+      }
+      return;
+    }
+    async liftGateCondition(graftTarget, filterText, materializer) {
+      const probe = materializer.loadQuery(buildRowLevelProbe(graftTarget, filterText));
+      const prepared = await probe.getPreparedQuery();
+      return liftProbeFilterCondition(prepared, `lifted probe for "${graftTarget}"`, filterText);
+    }
+    getOrBuildGraftedMaterializer(grafts, graftScope) {
+      const key = `${graftScope.cacheScope}\x00` + grafts.map((g) => `${g.graftTarget}\x00${g.filterText}`).sort().join("\x01");
+      const materializer = this.graftedMaterializerCache.get(key);
+      if (materializer) {
+        this.graftedMaterializerCache.delete(key);
+        this.graftedMaterializerCache.set(key, materializer);
+        return materializer;
+      }
+      const built = this.buildGraftedMaterializer(grafts, graftScope.modelDef);
+      this.graftedMaterializerCache.set(key, built);
+      while (this.graftedMaterializerCache.size > Model.GRAFTED_MATERIALIZER_CACHE_MAX) {
+        const oldest = this.graftedMaterializerCache.keys().next();
+        if (oldest.done)
+          break;
+        this.graftedMaterializerCache.delete(oldest.value);
+      }
+      return built;
+    }
+    buildGraftedMaterializer(grafts, modelDef) {
+      if (!this.gateRuntime) {
+        throw new Error("no retained runtime to graft a row-level gate through");
+      }
+      const copy = structuredClone(modelDef);
+      for (const { graftTarget, condition } of grafts) {
+        const target = copy.contents[graftTarget];
+        if (!target || !isSourceDef3(target)) {
+          throw new Error(`graft target "${graftTarget}" is not a source in this model`);
+        }
+        target.filterList = [...target.filterList ?? [], condition];
+      }
+      return this.gateRuntime._loadModelFromModelDef(copy);
+    }
+    async assertGateLanded(recompiled, grafts) {
+      const prepared = await recompiled.getPreparedQuery();
+      const modelDef = prepared._modelDef ?? this.modelDef;
+      const structRef = prepared._query?.structRef;
+      const resolvedRef = typeof structRef === "string" ? modelDef?.contents[structRef] : structRef;
+      const struct = resolvedRef && typeof resolvedRef === "object" ? resolvedRef : undefined;
+      for (const { condition } of grafts) {
+        if (!condition.code || !this.filterListContainsCode(struct, modelDef, condition.code, 0)) {
+          throw new Error("a row-level gate condition did not land on the recompiled query");
+        }
+      }
+    }
+    static MAX_GATE_PROOF_DEPTH = 8;
+    filterListContainsCode(struct, modelDef, code, depth) {
+      if (!struct || depth > Model.MAX_GATE_PROOF_DEPTH)
+        return false;
+      if (struct.filterList?.some((f) => f.code === code))
+        return true;
+      const duck = struct;
+      if (duck.type === "query_source" && modelDef) {
+        const ref = duck.query?.structRef;
+        const base = typeof ref === "string" ? modelDef.contents[ref] : ref;
+        if (base && isSourceDef3(base)) {
+          return this.filterListContainsCode(base, modelDef, code, depth + 1);
+        }
+      }
+      return false;
+    }
     async assertAuthorizedForText(text, givens) {
       await this.assertAuthorized(extractRunTargetSourceName(text), givens);
     }
@@ -249842,8 +250663,22 @@ var init_model = __esm(() => {
           const sourceResult = Model.getSources(modelDef, givens);
           sources = sourceResult.sources;
           filterMap = sourceResult.filterMap;
-          queries = Model.getQueries(modelDef);
-          await validateAuthorizeProbes(modelMaterializer, sourceResult.ownAuthorizeSources);
+          const queryResult = Model.getQueries(modelDef);
+          queries = queryResult.queries;
+          assertNoMisplacedAuthorizeAnnotations([
+            ...sourceResult.misplacedAuthorize,
+            ...queryResult.misplacedAuthorize
+          ]);
+          const declaredGivenTypes = new Map((givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
+          const declaredGivenDefaults = new Map((givens ?? []).filter((g) => g.name != null && g.default != null).map((g) => [g.name, g.default]));
+          await validateAuthorizeProbes(modelMaterializer, {
+            authorizeMap: sourceResult.authorizeMap,
+            declaredTypes: declaredGivenTypes,
+            declaredDefaults: declaredGivenDefaults,
+            authorizeOwnNotes: sourceResult.authorizeOwnNotes,
+            onRowLevelGateRejected: recordRowLevelGateRejected,
+            onRowLevelGateUnexpressible: (sourceName, detail) => logger.warn("Row-level #(authorize) gate not expressible at this entry point; every query against it will be denied", { packageName, modelPath, sourceName, detail })
+          });
           const imports = modelDef.imports || [];
           const importedSourceNames = new Set;
           for (const importLocation of imports) {
@@ -249873,7 +250708,9 @@ var init_model = __esm(() => {
             }
           }
         }
-        return new Model(packageName, modelPath, dataStyles, modelType, modelMaterializer, modelDef, sources, queries, sourceInfos.length > 0 ? sourceInfos : undefined, runnableNotebookCells, undefined, filterMap, givens);
+        const model = new Model(packageName, modelPath, dataStyles, modelType, modelMaterializer, modelDef, sources, queries, sourceInfos.length > 0 ? sourceInfos : undefined, runnableNotebookCells, undefined, filterMap, givens);
+        model.setGateRuntime(runtime);
+        return model;
       } catch (error) {
         let computedError = error;
         if (error instanceof Error && error.stack) {
@@ -249898,6 +250735,9 @@ var init_model = __esm(() => {
       const sourceInfos = data.sourceInfos;
       const givens = data.givens;
       const filterMap = data.filterMap ? new Map(data.filterMap) : undefined;
+      for (const warning of data.authorizeWarnings ?? []) {
+        logger.warn(warning, { packageName, modelPath: data.modelPath });
+      }
       if (!modelDef) {
         return new Model(packageName, data.modelPath, dataStyles, data.modelType, undefined, undefined, sources, queries, sourceInfos, data.modelType === "notebook" ? hydrateMarkdownOnlyCells(data.notebookCells) : undefined, undefined, filterMap, givens, modelInfo);
       }
@@ -249905,6 +250745,7 @@ var init_model = __esm(() => {
       const modelMaterializer = runtime._loadModelFromModelDef(modelDef);
       const runnableNotebookCells = data.modelType === "notebook" ? hydrateNotebookCells(runtime, data.notebookCells) : undefined;
       const model = new Model(packageName, data.modelPath, dataStyles, data.modelType, modelMaterializer, modelDef, sources, queries, sourceInfos, runnableNotebookCells, undefined, filterMap, givens, modelInfo);
+      model.setGateRuntime(runtime);
       return model;
     }
     static fromCompilationError(packageName, modelPath, modelType, error) {
@@ -250117,7 +250958,7 @@ var init_model = __esm(() => {
         }
         targets.push({
           label: query.name,
-          queryString: `run: ${quoteMalloyIdentifier(query.name)}`
+          queryString: `run: ${quoteMalloyIdentifier2(query.name)}`
         });
       }
       for (const source of this.sources ?? []) {
@@ -250127,7 +250968,7 @@ var init_model = __esm(() => {
           }
           targets.push({
             label: `${source.name} -> ${view.name}`,
-            queryString: `run: ${quoteMalloyIdentifier(source.name)} -> ${quoteMalloyIdentifier(view.name)}`
+            queryString: `run: ${quoteMalloyIdentifier2(source.name)} -> ${quoteMalloyIdentifier2(view.name)}`
           });
         }
       }
@@ -250307,6 +251148,7 @@ var init_model = __esm(() => {
       }
       let runnable;
       let liveRunnable;
+      let queryString;
       let serveVirtualMap;
       let serveShapeBindings = [];
       let servedFrom;
@@ -250337,13 +251179,12 @@ var init_model = __esm(() => {
             throw err;
           }
         }
-        let queryString;
         if (!sourceName && !queryName && query) {
           queryString = `
 ` + query;
         } else if (queryName && !query) {
           queryString = `
-run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMalloyIdentifier(queryName)}`;
+run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMalloyIdentifier2(queryName)}`;
         } else {
           const endTime = performance.now();
           const executionTime2 = endTime - startTime;
@@ -250368,7 +251209,10 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
         }
         runnable = this.modelMaterializer.loadRestrictedQuery(queryString);
         liveRunnable = runnable;
-        if (getPersistStorageMode() === "on" && this.serveBindings.length > 0 && this.serveDestinationConfig) {
+        const storageRoutingPossible = getPersistStorageMode() === "on" && this.serveBindings.length > 0 && !!this.serveDestinationConfig;
+        const preaggServeMaterializer = this.preaggregateServeMaterializer;
+        const routingBlockedByRowLevelGate = (storageRoutingPossible || !!preaggServeMaterializer) && !bypassAuthorize && this.hasAnyAuthorizeNote() && await this.queryEntryPointHasRowLevelGate(runnable);
+        if (storageRoutingPossible && !routingBlockedByRowLevelGate) {
           try {
             const shaped = await this.loadServeShapeQuery(queryString);
             runnable = shaped.runnable;
@@ -250388,9 +251232,9 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
             });
           }
         }
-        if (this.preaggregateServeMaterializer && !serveVirtualMap) {
+        if (preaggServeMaterializer && !routingBlockedByRowLevelGate && !serveVirtualMap) {
           try {
-            const candidate = this.preaggregateServeMaterializer.loadRestrictedQuery(queryString);
+            const candidate = preaggServeMaterializer.loadRestrictedQuery(queryString);
             await candidate.getSQL({
               givens: querySurfaceGivens,
               buildManifest
@@ -250430,7 +251274,10 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
       if (boundary === "deferred") {
         this.assertQueryBoundaryCompiled(compiledSource, query);
       }
-      await this.assertAuthorizedForAllSources(runnable, givens ?? {}, bypassAuthorize);
+      runnable = await this.authorizeAndBindRunnable(runnable, givens ?? {}, {
+        recompile: (mm) => mm.loadRestrictedQuery(queryString),
+        bypassAuthorize
+      });
       const maxRows = getMaxQueryRows();
       const maxBytes = getMaxResponseBytes();
       const effectiveBuildManifest = serveVirtualMap ? undefined : preaggRouted ? buildManifest : liveBuildManifest;
@@ -250530,6 +251377,9 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
         servedFrom = "live_fallback";
         executionTime = performance.now() - startTime;
       }
+      if (this.queryHadRowLevelFilterAttached(runnable) && queryResults.totalRows === 0) {
+        recordRowLevelGateDecision("empty_after_filter");
+      }
       assertWithinModelRowLimit(queryResults.totalRows, maxRows, "model_query");
       const wrappedResult = API.util.wrapResult(queryResults);
       const serializedResult = stringifyQueryResponse(responseShape === "compact" ? queryResults.data.value : wrappedResult, queryResults.totalRows, maxBytes, "model_query", responseShape === "compact" ? bigIntReplacer : undefined);
@@ -250626,7 +251476,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
         return;
       try {
         const entry = this.modelDef.contents?.[sourceName];
-        if (!entry || !isSourceDef2(entry))
+        if (!entry || !isSourceDef3(entry))
           return;
         const def = entry;
         if (!def.annotations)
@@ -250694,26 +251544,35 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
           text: cell.text
         };
       }
-      if (cell.runnable) {
-        await this.assertAuthorizedForAllSources(cell.runnable, givens ?? {});
-      }
       let queryName = undefined;
       let queryResult = undefined;
       if (cell.runnable) {
         try {
           let runnableToExecute = cell.runnable;
-          if (!bypassFilters && cell.modelMaterializer) {
-            const effectiveSource = extractRunTargetSourceName(cell.text);
-            if (effectiveSource) {
-              const filters = this.getFilters(effectiveSource);
-              if (filters.length > 0) {
-                const filterClause = buildFilterClause(filters, filterParams ?? {});
-                if (filterClause) {
-                  const refinedQuery = injectFilterRefinement(cell.text, filterClause);
-                  runnableToExecute = cell.modelMaterializer.loadQuery(refinedQuery);
-                }
-              }
-            }
+          let textToExecute = cell.text;
+          const { graftScope, usesOwnScope } = await this.resolveNotebookCellGraftScope(cellIndex, cell.runnable);
+          if (!graftScope) {
+            logger.debug("Notebook cell has no graft scope to attach a row-level gate against (no earlier code cell, and this cell has no compiled model of its own)", { modelPath: this.modelPath, cellIndex });
+          }
+          const effectiveSource = !bypassFilters && cell.modelMaterializer ? extractRunTargetSourceName(cell.text) : undefined;
+          const cellFilters = effectiveSource ? this.getFilters(effectiveSource) : [];
+          if (cell.modelMaterializer && cellFilters.length > 0) {
+            await this.probeEntryPointGates(cell.runnable, givens ?? {}, graftScope);
+          }
+          const filterClause = cellFilters.length > 0 ? buildFilterClause(cellFilters, filterParams ?? {}) : undefined;
+          if (filterClause && cell.modelMaterializer) {
+            textToExecute = injectFilterRefinement(cell.text, filterClause);
+            runnableToExecute = cell.modelMaterializer.loadQuery(textToExecute);
+          }
+          if (cell.modelMaterializer) {
+            const textForRecompile = textToExecute;
+            const queryDefForOwnScopeRepoint = usesOwnScope ? (await runnableToExecute.getPreparedQuery())._query : undefined;
+            runnableToExecute = await this.authorizeAndBindRunnable(runnableToExecute, givens ?? {}, {
+              recompile: usesOwnScope ? (mm) => mm._loadQueryFromQueryDef(queryDefForOwnScopeRepoint) : (mm) => mm.loadQuery(textForRecompile),
+              graftScope
+            });
+          } else {
+            await this.assertAuthorizedForAllSources(runnableToExecute, givens ?? {});
           }
           const cellMaxRows = getMaxQueryRows();
           const cellMaxBytes = getMaxResponseBytes();
@@ -250737,6 +251596,9 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
           });
           const query = (await runnableToExecute.getPreparedQuery())._query;
           queryName = query.as || query.name;
+          if (result?._queryResult && result.totalRows === 0 && this.queryHadRowLevelFilterAttached(runnableToExecute)) {
+            recordRowLevelGateDecision("empty_after_filter");
+          }
           if (result?._queryResult) {
             assertWithinModelRowLimit(result.totalRows, cellMaxRows, "notebook_cell");
           }
@@ -250745,6 +251607,9 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
             assertWithinModelByteLimit(queryResult, cellMaxBytes, "notebook_cell");
           }
         } catch (error) {
+          if (error instanceof AccessDeniedError) {
+            throw error;
+          }
           if (error instanceof FilterValidationError) {
             throw new BadRequestError(error.message);
           }
@@ -250824,14 +251689,23 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
       return malloyConfig;
     }
     static getQueries(modelDef) {
-      return extractQueriesFromModelDef(modelDef);
+      const { queries, misplacedAuthorize } = extractQueriesFromModelDef(modelDef);
+      return { queries, misplacedAuthorize };
     }
     static getSources(modelDef, givens) {
-      const { sources, filterMap, ownAuthorizeSources } = extractSourcesFromModelDef(modelDef, givens, (sourceName, err) => logger.warn(`Failed to parse filter annotations on source "${sourceName}"`, { error: err }));
+      const {
+        sources,
+        filterMap,
+        authorizeMap,
+        misplacedAuthorize,
+        authorizeOwnNotes
+      } = extractSourcesFromModelDef(modelDef, givens, (sourceName, err) => logger.warn(`Failed to parse filter annotations on source "${sourceName}"`, { error: err }));
       return {
         sources,
         filterMap,
-        ownAuthorizeSources
+        authorizeMap,
+        misplacedAuthorize,
+        authorizeOwnNotes
       };
     }
     static async getModelMaterializer(runtime, importBaseURL, modelURL, modelPath) {
@@ -250932,6 +251806,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier(sourceName)} -> ` : ""}${quoteMallo
             text: stmt.text,
             runnable,
             modelMaterializer: localMM,
+            modelDef: currentModelDef,
             newSources,
             queryInfo
           };
@@ -295572,6 +296447,8 @@ class MaterializationService {
         const destination = resolveStorageDestination(persistSource);
         if (destination) {
           assertMaterializationEligible(persistSource);
+        } else {
+          assertColocatedPersistNotAuthorizeGated(persistSource, persistSource.name, compiled.preaggregatePlans?.[persistSource.sourceID] ? "preaggregate" : "persist");
         }
         const sourceEntityId = computeSourceEntityId(persistSource, compiled.connectionDigests);
         if (seen.has(sourceEntityId))
@@ -295834,6 +296711,8 @@ class MaterializationService {
           const orchestratedInstruction = bySourceID.get(persistSource.sourceID);
           if (orchestratedInstruction?.destination && getPersistStorageMode() !== "off") {
             assertMaterializationEligible(persistSource);
+          } else {
+            assertColocatedPersistNotAuthorizeGated(persistSource, persistSource.name, compiled.preaggregatePlans?.[persistSource.sourceID] ? "preaggregate" : "persist");
           }
           const sourceEntityId = computeSourceEntityId(persistSource, connectionDigests);
           const instruction = orchestratedInstruction ?? bySourceEntityId.get(sourceEntityId);