@malloy-publisher/server 0.0.250 → 0.2.0

package/dist/package_load_worker.mjs

@@ -2482,9 +2482,11 @@ var init_errors = __esm(() => {
     }
   };
   MaterializationEligibilityError = class MaterializationEligibilityError extends Error {
+    reason;
     constructor(error) {
       super(error.message);
       this.name = "MaterializationEligibilityError";
+      this.reason = error.reason;
     }
   };
   FrozenConfigError = class FrozenConfigError extends Error {
@@ -2584,7 +2586,7 @@ function assertNoAuthorizeNearMisses(found) {
     message: `These annotations are not \`authorize\` gates and nothing enforces ` + `them:
 ${unique.map((t) => `  - \`${t}\``).join(`
 `)}
-` + `Malloy routes an annotation by its prefix, and only ` + `\`#(authorize)\` (or \`##(authorize)\`, or the block form ` + `\`#|(authorize)\`) reaches the authorize route — a space after the ` + `\`#\`, spaces inside the brackets, or anything trailing the closing ` + `bracket makes it a plain tag Malloy hands to something else. Write ` + `\`#(authorize) "<expression>"\` on the \`source:\` statement you mean ` + `to protect. This is refused rather than interpreted: guessing at the ` + `intent would let publisher start enforcing a filter on a package that ` + `has been serving every row.`
+` + `Malloy routes an annotation by its prefix, and only ` + `\`#(authorize)\` (or \`##(authorize)\`, or the block form ` + `\`#|(authorize)\`) reaches the authorize route — a space after the ` + `\`#\`, spaces inside the brackets, or anything trailing the closing ` + `bracket makes it a plain tag Malloy hands to something else. Write ` + `\`#(authorize) <expression>\` on its own line directly above the ` + `\`source:\` statement you mean to protect (unquoted — the quoted ` + `string form is retired). This is refused rather than interpreted: ` + `guessing at the ` + `intent would let publisher start enforcing a filter on a package that ` + `has been serving every row.`
   });
 }
 function describeMisplacedAuthorizeAnnotation(f) {
@@ -2605,20 +2607,6 @@ ${positions}
 ` + `A gate only applies where model load looks for one — a \`source:\`'s ` + `own annotation, or one it inherits from an \`extend\`/query-source ` + `base. File-level \`##(authorize)\` is deprecated and no longer ` + `enforced anywhere, so it always lands here: declare \`#(authorize)\` ` + `on each \`source:\` it was meant to protect instead. Every other ` + `position above should move to the \`source:\` statement it is meant ` + `to protect.`
   });
 }
-function buildAuthorizeProbe(exprs, givenDecls = []) {
-  const selects = exprs.map((expr, i) => `__auth_${i} is (${expr})`).join(`
-      `);
-  const givenBlock = givenDecls.length > 0 ? `given:
-${givenDecls.map((g) => `  ${g.name} :: ${g.type}`).join(`
-`)}
-
-` : "";
-  return `${givenBlock}run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
-    select:
-      ${selects}
-    limit: 1
-  }`;
-}
 function referencedGivenNames(expr) {
   const scanned = expr.replace(STRING_LITERAL_PATTERN, "''");
   const names = [];
@@ -2632,249 +2620,6 @@ function referencedGivenNames(expr) {
   }
   return names;
 }
-function classifyAuthorizeGate(condition, declaredTypes, declaredDefaults) {
-  const fieldUsage = condition.refSummary?.fieldUsage;
-  if (!Array.isArray(fieldUsage) || fieldUsage.length === 0) {
-    return { shape: "given_only" };
-  }
-  const givenNames = [];
-  const literalAtoms = [];
-  let rejection;
-  const reject = (cause, detail) => {
-    rejection ??= { shape: "rejected", cause, detail };
-    return false;
-  };
-  const givenOperand = (node) => {
-    const n = asNode(node);
-    return n && n.node === "given" && typeof n.refName === "string" ? n.refName : null;
-  };
-  const isLiteralOperand = (node) => {
-    const n = asNode(node);
-    return !!n && (n.node === "numberLiteral" || n.node === "stringLiteral" || n.node === "true" || n.node === "false");
-  };
-  const literalOperandText = (node) => {
-    const n = asNode(node);
-    if (!n)
-      return null;
-    if (n.node === "true" || n.node === "false")
-      return n.node;
-    if (n.node === "numberLiteral" && typeof n.literal === "string") {
-      return n.literal;
-    }
-    if (n.node === "stringLiteral" && typeof n.literal === "string") {
-      return `'${n.literal.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
-    }
-    return null;
-  };
-  const declaredTypeOf = (name) => {
-    const declared = declaredTypes.get(name);
-    if (declared === undefined) {
-      reject("unreachable_given", `\`$${name}\` is not on this model's given surface, so the gate ` + `would bind its declaration default rather than the caller's ` + `value. Declare it here, importing it if it lives elsewhere ` + `(\`import { ${name} } from "…"\`)`);
-      return null;
-    }
-    return declared;
-  };
-  const walk = (node, depth) => {
-    if (depth > MAX_GATE_WALK_DEPTH) {
-      return reject("unsupported_node", "the gate nests too deeply to read");
-    }
-    const n = asNode(node);
-    if (!n || typeof n.node !== "string") {
-      return reject("unsupported_node", "the gate has an unreadable shape");
-    }
-    const kind = n.node;
-    if (BOOLEAN_NODES.has(kind)) {
-      const kids = asNode(n.kids);
-      if (!kids) {
-        return reject("unsupported_node", `\`${kind}\` has no operands`);
-      }
-      return walk(kids.left, depth + 1) && walk(kids.right, depth + 1);
-    }
-    if (TRANSPARENT_NODES.has(kind)) {
-      return walk(n.e, depth + 1);
-    }
-    if (kind === "inGiven") {
-      if (n.not === true) {
-        return reject("unsupported_node", "a negated membership test (`not in`) is not an access rule; " + "write the gate as the set of rows a caller MAY read");
-      }
-      const given = givenOperand(n.givenRef);
-      if (given === null) {
-        return reject("unsupported_node", "`in` must test membership of a declared given");
-      }
-      const declared = declaredTypeOf(given);
-      if (declared === null)
-        return false;
-      if (!isArrayType(declared)) {
-        return reject("scalar_given_rejects_in", `\`$${given}\` is declared \`${declared}\` (a scalar), so ` + `\`in $${given}\` is not a membership test. Compare it with ` + `\`=\` instead`);
-      }
-      givenNames.push(given);
-      return walkFieldOperand(n.e);
-    }
-    if (SCALAR_COMPARISON_NODES.has(kind)) {
-      const kids = asNode(n.kids);
-      if (!kids) {
-        return reject("unsupported_node", `\`${kind}\` has no operands`);
-      }
-      const left = givenOperand(kids.left);
-      const right = givenOperand(kids.right);
-      const given = left ?? right;
-      if (given === null) {
-        return reject("no_given_reference", `\`${kind}\` must compare a field against a given; a comparison ` + `against a constant is a fixed filter and belongs in the ` + `source's own \`where:\``);
-      }
-      const declared = declaredTypeOf(given);
-      if (declared === null)
-        return false;
-      if (isArrayType(declared)) {
-        return reject("array_given_needs_in", `\`$${given}\` is declared \`${declared}\` (an array), so ` + `comparing it with \`${kind}\` compiles and then fails in the ` + `warehouse. Write \`in $${given}\` — it is also the spelling ` + `that matches no rows when the array is empty`);
-      }
-      const otherSide = left === null ? kids.left : kids.right;
-      if (isLiteralOperand(otherSide)) {
-        givenNames.push(given);
-        const literalText = literalOperandText(otherSide);
-        if (literalText !== null) {
-          literalAtoms.push(left !== null ? `$${given} ${kind} ${literalText}` : `${literalText} ${kind} $${given}`);
-        }
-        return true;
-      }
-      if (declaredDefaults.has(given)) {
-        return reject("field_given_has_default", `\`${kind}\` compares row field data against \`$${given}\`, ` + `which is declared with a default (\`${declaredDefaults.get(given)}\`). ` + `A caller who supplies no value for \`$${given}\` gets that ` + `default, and the comparison then applies to every row — ` + `admitting rows it was meant to exclude. Declare \`$${given}\` ` + `with no default so a caller must supply one explicitly`);
-      }
-      givenNames.push(given);
-      return walkFieldOperand(otherSide);
-    }
-    return reject("unsupported_node", `\`${kind}\` is not permitted in a gate; a row-level gate is a ` + `boolean combination of \`<field> <operator> $GIVEN\` comparisons`);
-  };
-  const walkFieldOperand = (node) => {
-    const n = asNode(node);
-    if (!n || n.node !== "field" || !Array.isArray(n.path)) {
-      return reject("unsupported_node", `a gate compares a FIELD against a given; \`${asNode(node)?.node ?? "that operand"}\` is not a field reference`);
-    }
-    return true;
-  };
-  let ok;
-  try {
-    ok = walk(condition.e, 0);
-  } catch {
-    return {
-      shape: "rejected",
-      cause: "unsupported_node",
-      detail: "the gate's compiled shape could not be read"
-    };
-  }
-  if (!ok) {
-    return rejection ?? {
-      shape: "rejected",
-      cause: "unsupported_node",
-      detail: "the gate is not an allowed shape"
-    };
-  }
-  if (givenNames.length === 0) {
-    return {
-      shape: "rejected",
-      cause: "no_given_reference",
-      detail: "a row-level gate must compare a field against a given; a gate " + "that references none is a fixed filter and belongs in the " + "source's own `where:`"
-    };
-  }
-  return { shape: "row_level", givenNames, literalAtoms };
-}
-function isArrayType(declaredType) {
-  const normalized = declaredType.trim().toLowerCase();
-  return normalized === "array" || normalized.endsWith("[]");
-}
-function asNode(node) {
-  return node !== null && typeof node === "object" ? node : null;
-}
-function inferGivenType(value) {
-  if (typeof value === "string")
-    return "string";
-  if (typeof value === "number" || typeof value === "bigint")
-    return "number";
-  if (typeof value === "boolean")
-    return "boolean";
-  if (value instanceof Date)
-    return "timestamp";
-  if (Array.isArray(value)) {
-    if (value.length === 0)
-      return null;
-    const elementType = inferGivenType(value[0]);
-    return elementType ? `${elementType}[]` : null;
-  }
-  return null;
-}
-function bindProbeGivens(expr, givens, declaredTypes) {
-  const decls = [];
-  const bound = {};
-  for (const name of referencedGivenNames(expr)) {
-    if (!(name in givens))
-      continue;
-    const value = givens[name];
-    const type = declaredTypes?.get(name) ?? inferGivenType(value);
-    if (!type)
-      continue;
-    decls.push({ name, type });
-    bound[name] = value;
-  }
-  return { decls, bound };
-}
-function isProbeTrue(cell) {
-  return cell === true || cell === 1 || cell === "true";
-}
-async function runProbe(executor, probeText, givens) {
-  const result = await executor.loadQuery(probeText).run({ rowLimit: 1, givens });
-  const row = result?.data?.value?.[0];
-  return !!(row && isProbeTrue(row.__auth_0));
-}
-async function evaluateAuthorize(executor, exprs, givens, declaredTypes, options) {
-  const selfContainedFirst = options?.selfContainedFirst ?? false;
-  for (const expr of exprs) {
-    if (selfContainedFirst) {
-      if (await evaluateSelfContainedFirst(executor, expr, givens, declaredTypes)) {
-        return true;
-      }
-      continue;
-    }
-    try {
-      if (await runProbe(executor, buildAuthorizeProbe([expr]), givens)) {
-        return true;
-      }
-      continue;
-    } catch {}
-    try {
-      const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
-      if (decls.length === 0)
-        continue;
-      if (await runProbe(executor, buildAuthorizeProbe([expr], decls), bound)) {
-        return true;
-      }
-    } catch {
-      continue;
-    }
-  }
-  return false;
-}
-async function evaluateSelfContainedFirst(executor, expr, givens, declaredTypes) {
-  const referenced = referencedGivenNames(expr);
-  if (referenced.length === 0) {
-    try {
-      return await runProbe(executor, buildAuthorizeProbe([expr]), {});
-    } catch {
-      return false;
-    }
-  }
-  const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
-  if (decls.length !== referenced.length) {
-    return false;
-  }
-  try {
-    return await runProbe(executor, buildAuthorizeProbe([expr], decls), bound);
-  } catch {
-    try {
-      return await runProbe(executor, buildAuthorizeProbe([expr]), givens);
-    } catch {
-      return false;
-    }
-  }
-}
 function quoteMalloyIdentifier(name) {
   return "`" + name.replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
 }
@@ -2903,42 +2648,8 @@ async function liftRowLevelCondition(compiler, sourceName, exprs) {
   const prepared = await compiler.loadQuery(buildRowLevelProbe(sourceName, filterText)).getPreparedQuery();
   return liftProbeFilterCondition(prepared, `row-level probe for "${sourceName}"`, filterText);
 }
-async function runOneRowProbeOrThrow(compiler, sourceName, exprs) {
-  try {
-    await compiler.loadQuery(buildAuthorizeProbe(exprs)).getPreparedQuery();
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    throw new ModelCompilationError({
-      message: `Invalid #(authorize) annotation on source "${sourceName}" [${exprs.join(" | ")}]: ${detail}`
-    });
-  }
-}
-async function assertNoVacuousDefaultAtom(executor, sourceName, literalAtoms) {
-  for (const atom of literalAtoms) {
-    let vacuous;
-    try {
-      vacuous = await runProbe(executor, buildAuthorizeProbe([atom]), {});
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      if (NO_DEFAULT_GIVEN_PATTERN.test(detail))
-        continue;
-      throw new ModelCompilationError({
-        message: `Invalid #(authorize) annotation on source "${sourceName}": ` + `the atom \`${atom}\` could not be evaluated against its ` + `given's declared default (${detail}).`
-      });
-    }
-    if (vacuous) {
-      throw new ModelCompilationError({
-        message: `Invalid #(authorize) annotation on source "${sourceName}": ` + `the atom \`${atom}\` evaluates to TRUE when a caller supplies ` + `no givens (its given's own declared default). An OR'd atom ` + `that is true by default makes the whole row filter admit ` + `every row for that caller. Give the given a default this ` + `atom evaluates false against, or declare it with no default ` + `so a caller must supply one explicitly.`
-      });
-    }
-  }
-}
 async function validateAuthorizeProbes(compiler, options) {
-  const declaredTypes = options.declaredTypes ?? new Map;
-  const declaredDefaults = options.declaredDefaults ?? new Map;
-  const provenNoteObjects = new Set;
   const ownNotesOf = options.authorizeOwnNotes ?? new Map;
-  const pending = [];
   for (const [sourceName, groups] of options.authorizeMap ?? []) {
     for (const exprs of groups) {
       if (exprs.length === 0)
@@ -2947,51 +2658,39 @@ async function validateAuthorizeProbes(compiler, options) {
       try {
         condition = await liftRowLevelCondition(compiler, sourceName, exprs);
       } catch (err) {
-        pending.push({ sourceName, exprs, err });
-        continue;
-      }
-      const classification = classifyAuthorizeGate(condition, declaredTypes, declaredDefaults);
-      if (classification.shape === "given_only") {
-        await runOneRowProbeOrThrow(compiler, sourceName, exprs);
-        for (const note of ownNotesOf.get(sourceName) ?? []) {
-          provenNoteObjects.add(note);
-        }
-        continue;
-      }
-      if (classification.shape === "rejected") {
-        options.onRowLevelGateRejected?.(classification.cause);
+        const detail = err instanceof Error ? err.message : String(err);
         const ownNotes = ownNotesOf.get(sourceName) ?? [];
         if (ownNotes.length === 0) {
-          options.onRowLevelGateUnexpressible?.(sourceName, classification.detail);
+          options.onRowLevelGateRejected?.("entry_point_unexpressible");
+          options.onRowLevelGateUnexpressible?.(sourceName, detail);
           continue;
         }
         throw new ModelCompilationError({
-          message: `Invalid #(authorize) annotation on source "${sourceName}" ` + `[${exprs.join(" | ")}]: ${classification.detail}`
+          message: `Invalid #(authorize) annotation on source "${sourceName}" ` + `[${exprs.join(" | ")}]: ${detail}`
         });
       }
-      await assertNoVacuousDefaultAtom(compiler, sourceName, classification.literalAtoms);
-      for (const note of ownNotesOf.get(sourceName) ?? []) {
-        provenNoteObjects.add(note);
-      }
-    }
-  }
-  for (const failure of pending) {
-    const ownNotes = ownNotesOf.get(failure.sourceName) ?? [];
-    const inherited = ownNotes.length === 0 || ownNotes.every((note) => provenNoteObjects.has(note));
-    if (inherited) {
-      const detail = failure.err instanceof Error ? failure.err.message : String(failure.err);
-      options.onRowLevelGateRejected?.("entry_point_unexpressible");
-      options.onRowLevelGateUnexpressible?.(failure.sourceName, detail);
-      continue;
+      options.onOwnRowLevelConditionCompiled?.(sourceName, condition);
     }
-    await runOneRowProbeOrThrow(compiler, failure.sourceName, failure.exprs);
   }
 }
+function isLegacyQuotedPayload(payload) {
+  const trimmed = payload.trim();
+  return WHOLE_BODY_QUOTED_STRING.test(trimmed) || WHOLE_BODY_SINGLE_QUOTED_STRING.test(trimmed);
+}
+function unquoteLegacyGatePayload(payload) {
+  const trimmed = payload.trim();
+  const inner = trimmed.slice(1, -1);
+  return trimmed[0] === "'" ? inner.replace(SINGLE_QUOTE_ESCAPE, "$1") : inner.replace(DOUBLE_QUOTE_ESCAPE, "$1");
+}
 function parseAuthorizeAnnotation(annotation) {
   const content = authorizeNoteContent(annotation);
   if (content === undefined)
     return null;
-  return unwrapQuotedExpression(content.trim());
+  const trimmed = content.trim();
+  if (trimmed.length === 0) {
+    throw new Error("authorize annotation has an empty expression body");
+  }
+  return trimmed;
 }
 function collectAuthorizeExprs(annotations) {
   const exprs = [];
@@ -3003,43 +2702,57 @@ function collectAuthorizeExprs(annotations) {
   }
   return exprs;
 }
-function unwrapQuotedExpression(body) {
-  if (body.length < 2 || body[0] !== '"') {
-    throw new Error(`authorize annotation expression must be a double-quoted string, got: ${body || "(empty)"}`);
-  }
-  let expr = "";
-  let i = 1;
-  let closed = false;
-  for (;i < body.length; i++) {
-    const ch = body[i];
-    if (ch === "\\" && i + 1 < body.length) {
-      const next = body[i + 1];
-      if (next === '"' || next === "\\") {
-        expr += next;
-        i++;
-        continue;
-      }
-    }
-    if (ch === '"') {
-      closed = true;
-      i++;
-      break;
+function findMultipleAuthorizeGates(authorizeOwnNotes) {
+  const found = [];
+  for (const [sourceName, notes] of authorizeOwnNotes) {
+    if (notes.length > 1) {
+      found.push({ sourceName, texts: notes.map((note) => note.text) });
     }
-    expr += ch;
-  }
-  if (!closed) {
-    throw new Error(`authorize annotation has mismatched quotes: ${body}`);
   }
-  const rest = body.slice(i).trim();
-  if (rest.length > 0) {
-    throw new Error(`authorize annotation has unexpected content after the expression: ${rest}`);
-  }
-  if (expr.trim().length === 0) {
-    throw new Error("authorize annotation has an empty expression body");
+  return found;
+}
+function assertAtMostOneAuthorizeGate(found) {
+  if (found.length === 0)
+    return;
+  const positions = found.map(({ sourceName, texts }) => `  - source "${sourceName}" declares ${texts.length}:
+` + texts.map((t) => `      \`${t.trim().split(/[\r\n]/, 1)[0]}\``).join(`
+`)).join(`
+`);
+  throw new ModelCompilationError({
+    message: `A source may declare at most one \`#(authorize)\` annotation:
+${positions}
+` + `Combine multiple conditions into one expression with \`or\` instead of ` + `repeating the annotation, e.g. ` + "`#(authorize) $ROLE = 'admin' or org_id in $GROUPS`."
+  });
+}
+function findLegacyStringGates(authorizeOwnNotes) {
+  const found = [];
+  for (const [sourceName, notes] of authorizeOwnNotes) {
+    const legacyNotes = notes.filter((note) => {
+      const content = authorizeNoteContent(note.text);
+      return content !== undefined && isLegacyQuotedPayload(content);
+    });
+    if (legacyNotes.length === 0)
+      continue;
+    const exprs = collectAuthorizeExprs(legacyNotes.map((note) => note.text));
+    if (exprs.length > 0) {
+      found.push({ sourceName, exprs });
+    }
   }
-  return expr;
+  return found;
+}
+function assertNoLegacyStringGate(found) {
+  if (found.length === 0)
+    return;
+  const rewrites = found.flatMap(({ sourceName, exprs }) => exprs.map((expr) => `  - source "${sourceName}": replace \`#(authorize) ${expr}\`` + ` with
+      #(authorize) ${unquoteLegacyGatePayload(expr)}`)).join(`
+`);
+  throw new ModelCompilationError({
+    message: `The string form of \`#(authorize)\` (a Malloy-quoted expression on ` + `the \`source:\` line) is no longer accepted. Replace it with the ` + `unquoted expression, carried by an \`#(authorize)\` annotation on ` + `its own line directly above the \`source:\` line:
+${rewrites}
+` + `Test that the rewrite gates the same rows and check the row count ` + `matches what the string form served.`
+  });
 }
-var AUTHORIZE_ROUTE = "authorize", AUTHORIZE_TAG_LIKE, AUTHORIZE_ANNOTATION_ANYWHERE, MOTLY_AUTHORIZE_PAYLOAD, MALFORMED_AUTHORIZE_ATTEMPT, GIVEN_REF_PATTERN, STRING_LITERAL_PATTERN, everyMemberOf = () => (...members) => members, ROW_LEVEL_GATE_REJECTION_CAUSES, BOOLEAN_NODES, TRANSPARENT_NODES, SCALAR_COMPARISON_NODES, MAX_GATE_WALK_DEPTH = 64, NO_DEFAULT_GIVEN_PATTERN;
+var AUTHORIZE_ROUTE = "authorize", AUTHORIZE_TAG_LIKE, AUTHORIZE_ANNOTATION_ANYWHERE, MOTLY_AUTHORIZE_PAYLOAD, MALFORMED_AUTHORIZE_ATTEMPT, GIVEN_REF_PATTERN, SINGLE_QUOTE_ESCAPE, DOUBLE_QUOTE_ESCAPE, STRING_LITERAL_PATTERN, everyMemberOf = () => (...members) => members, ROW_LEVEL_GATE_REJECTION_CAUSES, WHOLE_BODY_QUOTED_STRING, WHOLE_BODY_SINGLE_QUOTED_STRING;
 var init_authorize = __esm(() => {
   init_errors();
   AUTHORIZE_TAG_LIKE = String.raw`##?\|?[ \t]*[([{<]?[ \t]*authorize(?=[)\]}>]|[ \t]|$)`;
@@ -3047,12 +2760,12 @@ var init_authorize = __esm(() => {
   MOTLY_AUTHORIZE_PAYLOAD = /^[ \t]*[([{<][ \t]*authorize[ \t]*[)\]}>]/iu;
   MALFORMED_AUTHORIZE_ATTEMPT = /^##?\|?[ \t]*[([{<]?[ \t]*authorize/iu;
   GIVEN_REF_PATTERN = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
-  STRING_LITERAL_PATTERN = /'(?:\\.|[^'\\])*'/g;
-  ROW_LEVEL_GATE_REJECTION_CAUSES = everyMemberOf()("array_given_needs_in", "scalar_given_rejects_in", "field_given_has_default", "unsupported_node", "no_given_reference", "unreachable_given", "entry_point_unexpressible");
-  BOOLEAN_NODES = new Set(["and", "or"]);
-  TRANSPARENT_NODES = new Set(["()"]);
-  SCALAR_COMPARISON_NODES = new Set(["=", "!=", ">", ">=", "<", "<="]);
-  NO_DEFAULT_GIVEN_PATTERN = /has no value and no default/;
+  SINGLE_QUOTE_ESCAPE = /\\(['\\])/g;
+  DOUBLE_QUOTE_ESCAPE = /\\(["\\])/g;
+  STRING_LITERAL_PATTERN = /'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*"/g;
+  ROW_LEVEL_GATE_REJECTION_CAUSES = everyMemberOf()("unreachable_given", "entry_point_unexpressible", "source_line_gate_no_given_reference", "source_line_gate_negated_membership", "legacy_string_gate", "given_usage_unresolvable", "unclassifiable_condition");
+  WHOLE_BODY_QUOTED_STRING = /^"(?:\\.|[^"\\])*"$/;
+  WHOLE_BODY_SINGLE_QUOTED_STRING = /^'(?:\\.|[^'\\])*'$/;
 });
 
 // src/authorize_metrics.ts
@@ -3076,7 +2789,7 @@ function recordRowLevelGateDecision(decision) {
 }
 function recordRowLevelGateRejected(cause) {
   rowLevelRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_row_level_rejected_total", {
-    description: "Row-level `#(authorize)` gates refused at package load because their compiled condition is not an allowed shape, or an inherited gate that could not be expressed at one derived entry point. Label: cause (" + ROW_LEVEL_GATE_REJECTION_CAUSES.map((c) => `'${c}'`).join("|") + "). All but 'entry_point_unexpressible' fail the whole model load; that one fires at load without failing it — see the doc above. Alert on any nonzero value since the last publish, not on a rate."
+    description: "Row-level `#(authorize)` gates that were refused, warned about, or could not be resolved. Label: cause (" + ROW_LEVEL_GATE_REJECTION_CAUSES.map((c) => `'${c}'`).join("|") + "). Only 'legacy_string_gate' fails the whole model load. 'entry_point_unexpressible', 'source_line_gate_no_given_reference' and 'source_line_gate_negated_membership' warn at load and leave the model servable. 'unreachable_given', 'given_usage_unresolvable' and 'unclassifiable_condition' are request-time only — that entry point denies every request. Alert on any nonzero value since the last publish; the request-time causes also make this a rate signal, so see the doc above before writing an alert."
   });
   rowLevelRejectionCounter.add(1, { cause });
 }
@@ -13639,6 +13352,97 @@ var init_data_styles = __esm(() => {
   init_logger();
 });
 
+// src/service/gate_dimension.ts
+import {
+  isJoined,
+  isSourceDef
+} from "@malloydata/malloy";
+function resolveFieldUsagePath(struct, path) {
+  let current = struct;
+  for (let i = 0;i < path.length - 1; i++) {
+    const seg = path[i];
+    const joinField = (current.fields ?? []).find((f) => (f.as || f.name) === seg && isJoined(f) && (isSourceDef(f) || f.type === "record" || f.type === "array"));
+    if (!joinField)
+      return;
+    current = joinField;
+  }
+  const leaf = path[path.length - 1];
+  const field = (current.fields ?? []).find((f) => (f.as || f.name) === leaf);
+  return field ? { struct: current, field } : undefined;
+}
+function expandRefSummaryGivenIds(struct, refSummary, seen = new Set) {
+  const ids = new Set;
+  for (const g of refSummary?.givenUsage ?? [])
+    ids.add(g.id);
+  for (const usage of refSummary?.fieldUsage ?? []) {
+    if (usage.path.length === 0)
+      continue;
+    const resolved = resolveFieldUsagePath(struct, usage.path);
+    if (!resolved) {
+      return { ok: false, unresolvedPath: usage.path.join(".") };
+    }
+    if (seen.has(resolved.field))
+      continue;
+    seen.add(resolved.field);
+    const nestedRefSummary = resolved.field.refSummary;
+    const nested = expandRefSummaryGivenIds(resolved.struct, nestedRefSummary, seen);
+    if (!nested.ok)
+      return nested;
+    for (const id of nested.givenIds)
+      ids.add(id);
+  }
+  return { ok: true, givenIds: ids };
+}
+function containsNegatedMembership(node, depth = 0) {
+  if (depth > 64 || node === null || typeof node !== "object")
+    return false;
+  const n = node;
+  if (n.node === "inGiven" && n.not === true)
+    return true;
+  if (n.node === "not") {
+    let inner = n.e;
+    while (inner && inner.node === "()") {
+      inner = inner.e;
+    }
+    if (inner && inner.node === "inGiven")
+      return true;
+    return containsNegatedMembership(n.e, depth + 1);
+  }
+  if (n.node === "and" || n.node === "or") {
+    const kids = n.kids;
+    return containsNegatedMembership(kids?.left, depth + 1) || containsNegatedMembership(kids?.right, depth + 1);
+  }
+  if (n.node === "()")
+    return containsNegatedMembership(n.e, depth + 1);
+  return false;
+}
+function validateSourceLineGateGivenUsage(sourceName, struct, refSummary, conditionExpr, modelDef, onWarning) {
+  const expansion = expandRefSummaryGivenIds(struct, refSummary);
+  if (!expansion.ok) {
+    throw new ModelCompilationError({
+      message: `#(authorize) on source "${sourceName}" references ` + `"${expansion.unresolvedPath}", which could not be resolved to a ` + `field this model can reach. An unresolvable reference is refused, ` + `not treated as referencing no given`
+    });
+  }
+  const givenIds = expansion.givenIds;
+  for (const id of givenIds) {
+    const given = modelDef.givens?.[id];
+    if (given && (given.default !== undefined || given.defaultText !== undefined)) {
+      throw new ModelCompilationError({
+        message: `#(authorize) on source "${sourceName}" references ` + `\`$${given.name}\`, which is declared with a default. A ` + `caller who supplies no value for \`$${given.name}\` gets ` + `that default, which can admit rows the gate was meant to ` + `exclude. Declare \`$${given.name}\` with no default`
+      });
+    }
+  }
+  if (givenIds.size === 0) {
+    onWarning?.("source_line_gate_no_given_reference", `#(authorize) on source "${sourceName}" references no given; it is ` + `a fixed predicate, not an access rule keyed on the caller`);
+  }
+  if (containsNegatedMembership(conditionExpr)) {
+    onWarning?.("source_line_gate_negated_membership", `#(authorize) on source "${sourceName}" negates a membership test; ` + `an empty given then matches every row instead of none`);
+  }
+}
+var init_gate_dimension = __esm(() => {
+  init_errors();
+});
+
 // src/service/annotations.ts
 import { Annotations } from "@malloydata/malloy";
 function isReservedRoute(route) {
@@ -13905,7 +13709,7 @@ var init_filter = __esm(() => {
 });
 
 // src/service/gate_registry_walk.ts
-import { isSourceDef } from "@malloydata/malloy";
+import { isSourceDef as isSourceDef2 } from "@malloydata/malloy";
 function resolveDeclaredSource(struct, modelDef) {
   if (!modelDef)
     return { kind: "none" };
@@ -13917,7 +13721,7 @@ function resolveDeclaredSource(struct, modelDef) {
     const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
     if (declared === struct)
       continue;
-    if (!declared || !isSourceDef(declared)) {
+    if (!declared || !isSourceDef2(declared)) {
       sawBrokenEntry = true;
       continue;
     }
@@ -13952,7 +13756,7 @@ function resolveQuerySourceBase(struct, modelDef) {
     return;
   const ref = duck.query?.structRef;
   const base = typeof ref === "string" ? modelDef?.contents[ref] : ref;
-  return base && isSourceDef(base) ? base : undefined;
+  return base && isSourceDef2(base) ? base : undefined;
 }
 function resolveCompositeResolvedBase(struct) {
   const duck = struct;
@@ -14011,8 +13815,8 @@ var init_gate_registry_walk = __esm(() => {
 
 // src/service/source_extraction.ts
 import {
-  isJoined,
-  isSourceDef as isSourceDef2
+  isJoined as isJoined2,
+  isSourceDef as isSourceDef3
 } from "@malloydata/malloy";
 function joinFieldNamesUnresolvableDeclaration(field, modelDef) {
   const ids = [field.referenceID, field.sourceID].filter((id) => !!id);
@@ -14023,26 +13827,40 @@ function joinFieldNamesUnresolvableDeclaration(field, modelDef) {
     if (!entry)
       continue;
     const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
-    if (declared && isSourceDef2(declared))
+    if (declared && isSourceDef3(declared))
       return false;
   }
   return true;
 }
+function isEarlierPosition(a, b) {
+  return a.line < b.line || a.line === b.line && a.character < b.character;
+}
+function considerAuthorizeNoteOwner(declaredBy, note, candidate) {
+  const location = candidate.location;
+  if (!location || location.url !== note.at.url)
+    return;
+  const currentLocation = declaredBy.get(note)?.location;
+  if (!currentLocation || isEarlierPosition(location.range.start, currentLocation.range.start)) {
+    declaredBy.set(note, candidate);
+  }
+}
 function extractSourcesFromModelDef(modelDef, givens, onParseError) {
   const filterMap = new Map;
   const authorizeMap = new Map;
   const misplacedAuthorize = [];
   const gatedSourceOwnAuthorizeNotes = new Set;
+  const authorizeNoteDeclaredBy = new Map;
   const nearMissAuthorize = [];
   const sweptStructs = [];
   for (const obj of Object.values(modelDef.contents)) {
-    if (!isSourceDef2(obj))
+    if (!isSourceDef3(obj))
       continue;
     const struct = obj;
     sweptStructs.push(obj);
     for (const note of ownLevelNotes(struct.annotations)) {
       if (containsAuthorizeAnnotationTag([note.text])) {
         gatedSourceOwnAuthorizeNotes.add(note);
+        considerAuthorizeNoteOwner(authorizeNoteDeclaredBy, note, struct);
       }
     }
     nearMissAuthorize.push(...collectAuthorizeNearMisses([
@@ -14054,12 +13872,13 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
     const entry = value.entry;
     if (entry.type === "source_registry_reference")
       continue;
-    if (!isSourceDef2(entry))
+    if (!isSourceDef3(entry))
       continue;
     sweptStructs.push(entry);
     for (const note of ownLevelNotes(entry.annotations)) {
       if (containsAuthorizeAnnotationTag([note.text])) {
         gatedSourceOwnAuthorizeNotes.add(note);
+        considerAuthorizeNoteOwner(authorizeNoteDeclaredBy, note, entry);
       }
     }
     nearMissAuthorize.push(...collectAuthorizeNearMisses(ownLevelNotes(entry.annotations).map((note) => note.text)));
@@ -14076,10 +13895,11 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
   }
   assertNoAuthorizeNearMisses(nearMissAuthorize);
   const authorizeOwnNotes = new Map;
+  const attributedAuthorizeOwnNotes = new Map;
   if (containsAuthorizeAnnotationTag((modelAnnotations(modelDef).notes ?? []).map((note) => note.text))) {
     misplacedAuthorize.push({ kind: "file" });
   }
-  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef2(obj)).map((sourceObj) => {
+  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef3(obj)).map((sourceObj) => {
     const struct = sourceObj;
     const sourceName = struct.as || struct.name;
     const annotations = annotationTexts(struct.annotations);
@@ -14117,7 +13937,9 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
     }
     const ownNotes = ownLevelNoteTexts(struct.annotations);
     const ownGates = collectAuthorizeExprs(ownNotes);
-    authorizeOwnNotes.set(sourceName, ownLevelNotes(struct.annotations).filter((note) => containsAuthorizeAnnotationTag([note.text])));
+    const ownAuthorizeNotes = ownLevelNotes(struct.annotations).filter((note) => containsAuthorizeAnnotationTag([note.text]));
+    authorizeOwnNotes.set(sourceName, ownAuthorizeNotes);
+    attributedAuthorizeOwnNotes.set(sourceName, ownAuthorizeNotes.filter((note) => authorizeNoteDeclaredBy.get(note) === struct));
     const inheritedGroups = ownGates.length === 0 ? effectiveAncestorGateExprs(struct, modelDef) : [];
     const effectiveGroups = ownGates.length > 0 ? [ownGates] : inheritedGroups;
     let authorize;
@@ -14137,7 +13959,7 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
         continue;
       }
       const fieldName = field.as || field.name;
-      if (isJoined(field) && isSourceDef2(field)) {
+      if (isJoined2(field) && isSourceDef3(field)) {
         const joinedStruct = field;
         if (joinFieldNamesUnresolvableDeclaration(joinedStruct, modelDef)) {
           continue;
@@ -14169,7 +13991,8 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
     filterMap,
     authorizeMap,
     misplacedAuthorize,
-    authorizeOwnNotes
+    authorizeOwnNotes,
+    attributedAuthorizeOwnNotes
   };
 }
 function extractQueriesFromModelDef(modelDef) {
@@ -14570,9 +14393,11 @@ init_authorize_metrics();
 init_data_styles();
 init_errors();
 init_authorize();
+init_gate_dimension();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
 import {
   contextOverlay,
+  isSourceDef as isSourceDef4,
   MalloyConfig,
   MalloyError as MalloyError2,
   modelDefToModelInfo,
@@ -15012,14 +14837,16 @@ function extractSources(modelDef, givens) {
     filterMap,
     authorizeMap,
     misplacedAuthorize,
-    authorizeOwnNotes
+    authorizeOwnNotes,
+    attributedAuthorizeOwnNotes
   } = extractSourcesFromModelDef(modelDef, givens);
   return {
     sources,
     filterMap,
     authorizeMap,
     misplacedAuthorize,
-    authorizeOwnNotes
+    authorizeOwnNotes,
+    attributedAuthorizeOwnNotes
   };
 }
 function authorizeWarningCollector() {
@@ -15031,12 +14858,6 @@ function authorizeWarningCollector() {
     }
   };
 }
-function givenDeclaredTypes(givens) {
-  return new Map((givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
-}
-function givenDeclaredDefaults(givens) {
-  return new Map((givens ?? []).filter((g) => g.name != null && g.default != null).map((g) => [g.name, g.default]));
-}
 function extractQueries(modelDef) {
   const { queries, misplacedAuthorize } = extractQueriesFromModelDef(modelDef);
   return {
@@ -15074,7 +14895,8 @@ async function compileMalloyModel(job, malloyConfig, modelPath) {
     filterMap,
     authorizeMap,
     misplacedAuthorize,
-    authorizeOwnNotes
+    authorizeOwnNotes,
+    attributedAuthorizeOwnNotes
   } = extractSources(modelDef, givens);
   const queryResult = extractQueries(modelDef);
   const queries = queryResult.queries;
@@ -15082,14 +14904,25 @@ async function compileMalloyModel(job, malloyConfig, modelPath) {
     ...misplacedAuthorize,
     ...queryResult.misplacedAuthorize
   ]);
+  const legacyStringGates = findLegacyStringGates(authorizeOwnNotes);
+  legacyStringGates.forEach(() => recordRowLevelGateRejected("legacy_string_gate"));
+  assertNoLegacyStringGate(legacyStringGates);
+  assertAtMostOneAuthorizeGate(findMultipleAuthorizeGates(authorizeOwnNotes));
   const authorizeWarningCollection = authorizeWarningCollector();
   await validateAuthorizeProbes(mm, {
     authorizeMap,
-    declaredTypes: givenDeclaredTypes(givens),
-    declaredDefaults: givenDeclaredDefaults(givens),
-    authorizeOwnNotes,
+    authorizeOwnNotes: attributedAuthorizeOwnNotes,
     onRowLevelGateRejected: recordRowLevelGateRejected,
-    onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible
+    onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible,
+    onOwnRowLevelConditionCompiled: (sourceName, condition) => {
+      const struct = modelDef.contents[sourceName];
+      if (!struct || !isSourceDef4(struct))
+        return;
+      validateSourceLineGateGivenUsage(sourceName, struct, condition.refSummary, condition.e, modelDef, (cause, detail) => {
+        recordRowLevelGateRejected(cause);
+        authorizeWarningCollection.warnings.push(`Row-level #(authorize) gate warning on "${sourceName}" (${cause}): ${detail}`);
+      });
+    }
   });
   return {
     modelPath,
@@ -15209,13 +15042,25 @@ async function compileNotebookModel(job, malloyConfig, modelPath) {
       ...extracted.misplacedAuthorize,
       ...finalQueryResult.misplacedAuthorize
     ]);
+    const finalLegacyStringGates = findLegacyStringGates(extracted.authorizeOwnNotes);
+    finalLegacyStringGates.forEach(() => recordRowLevelGateRejected("legacy_string_gate"));
+    assertNoLegacyStringGate(finalLegacyStringGates);
+    assertAtMostOneAuthorizeGate(findMultipleAuthorizeGates(extracted.authorizeOwnNotes));
+    const finalCompiledModelDef = finalModelDef;
     await validateAuthorizeProbes(mm, {
       authorizeMap: extracted.authorizeMap,
-      declaredTypes: givenDeclaredTypes(finalGivens),
-      declaredDefaults: givenDeclaredDefaults(finalGivens),
-      authorizeOwnNotes: extracted.authorizeOwnNotes,
+      authorizeOwnNotes: extracted.attributedAuthorizeOwnNotes,
       onRowLevelGateRejected: recordRowLevelGateRejected,
-      onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible
+      onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible,
+      onOwnRowLevelConditionCompiled: (sourceName, condition) => {
+        const struct = finalCompiledModelDef.contents[sourceName];
+        if (!struct || !isSourceDef4(struct))
+          return;
+        validateSourceLineGateGivenUsage(sourceName, struct, condition.refSummary, condition.e, finalCompiledModelDef, (cause, detail) => {
+          recordRowLevelGateRejected(cause);
+          authorizeWarningCollection.warnings.push(`Row-level #(authorize) gate warning on "${sourceName}" (${cause}): ${detail}`);
+        });
+      }
     });
   }
   return {