@malloy-publisher/server 0.10.3 → 0.10.5

package/dist/app/api-doc.yaml

@@ -6685,8 +6685,11 @@ components:
             `sqlSource` answer 400 for anything else (another statement type, or
             more than one statement), and `sqlTemporaryTable` answers 400 always.
             This is a rule on statements, not on what a SELECT reads: that is
-            bounded by the session's storage secret and catalog role. Absent or
-            false is the pre-existing behavior.
+            bounded by the catalog role and by the session's storage secret,
+            which on a managed connection attached read-only is scoped to the
+            `main` schema's recorded path, so a SELECT reads only that schema's
+            files; another schema's files, and any other object in the bucket,
+            are unsigned (403). Absent or false is the pre-existing behavior.
         fingerprint:
           type: string
           description: >
@@ -7157,7 +7160,11 @@ components:
                 every attach uses the data path the catalog recorded at its
                 creation, and no attach ever creates a catalog: the shape for a
                 catalog created elsewhere, through the admin API
-                (admin-api-doc.yaml) or by another tool.
+                (admin-api-doc.yaml) or by another tool. Either way the storage
+                secret is scoped to the data path, the given one or the
+                recorded one: a read of any other object through this
+                connection is unsigned, and on S3 the host's AWS_* environment
+                never signs it either. A catalog with neither is not attached.
             s3Connection:
               $ref: "#/components/schemas/S3Connection"
               description: AWS S3 connection configuration for data storage
@@ -7990,17 +7997,18 @@ components:
     BuildPlan:
       type: object
       description: |
-        The package's persist build plan. Mirrors Malloy's native build plan plus
-        the minimal per-source detail a caller needs to assign
-        identity/naming/realization. Lineage, policy, and connection capability
-        are intentionally omitted until they carry real data.
+        The package's persist build plan, from Malloy's build targets: the order
+        its persist sources build in, the tables each reads, and the minimal
+        per-source detail a caller needs to assign identity/naming/realization.
+        Policy and connection capability are intentionally omitted until they
+        carry real data.
       required: [graphs, sources]
       properties:
         graphs:
           type: array
           description: >-
             Dependency-ordered build graphs. One per connection per model, not one
-            per connection: a model contributes a graph for each connection its ROOT
+            per connection: a model contributes a graph for each connection its
             persist sources use, and a package's plan concatenates every model's, so
             the same source appears in the graph of every model that imports it.
           items:
@@ -8143,8 +8151,9 @@ components:
         nodes:
           type: array
           description:
-            Leveled build nodes; each inner array is one parallelizable level,
-            levels run in order.
+            A single level holding every persist source of the graph, in build
+            order. Each node's `dependsOn` names every source on every table it
+            reads, so the edges are complete without walking anything.
           items:
             type: array
             items:
@@ -8159,7 +8168,11 @@ components:
           description: "sourceName@modelURL"
         dependsOn:
           type: array
-          description: Upstream sourceIDs in this graph.
+          description: >-
+            sourceIDs of the sources on the tables this source reads. Sources on
+            one table (a source and its extensions) read none of each other. A
+            source Malloy cannot plan, which is refused rather than built, lists
+            none.
           items:
             type: string
 

package/dist/instrumentation.mjs

@@ -164831,7 +164831,7 @@ var init_telemetry = __esm(() => {
 });
 
 // package.json
-var version = "0.10.3";
+var version = "0.10.5";
 var init_package = () => {};
 
 // src/version.ts

package/dist/package_load_worker.mjs

@@ -22216,7 +22216,7 @@ async function compileSynthesizedPreaggregation(args) {
   const { runtime, importBaseURL } = await args.getRuntime(new Map([[synthesizedURL.href, text]]));
   const materializer = runtime.loadModel(synthesizedURL, { importBaseURL });
   const model = await materializer.getModel();
-  return { plans, model, materializer, text };
+  return { plans, model, materializer, runtime, text };
 }
 async function tryCompileSynthesizedPreaggregation(args) {
   try {
@@ -23215,27 +23215,47 @@ function composeDeclaredQueryMetadata(layers) {
   const resolved = Object.assign({}, ...ordered);
   return Object.keys(resolved).length > 0 ? resolved : null;
 }
-function flattenDependsOn(node) {
-  return node.dependsOn.map((d) => d.sourceID);
-}
-function* iterGraphSources(graph, sources) {
-  const seen = new Set;
-  function* visit(node) {
-    if (seen.has(node.sourceID))
-      return;
-    for (const dep of node.dependsOn) {
-      yield* visit(dep);
+function sourceBuildOf(build, unbuildable) {
+  const order = [];
+  const dependsOn = {};
+  for (const target of build.targets) {
+    const reads = target.dependsOn.flatMap((t) => t.sources.map((s) => s.sourceID));
+    for (const source of target.sources) {
+      order.push(source.sourceID);
+      dependsOn[source.sourceID] = reads;
     }
-    seen.add(node.sourceID);
-    const source = sources[node.sourceID];
+  }
+  for (const { source } of unbuildable) {
+    if (source.connectionName !== build.connectionName)
+      continue;
+    order.push(source.sourceID);
+    dependsOn[source.sourceID] = [];
+  }
+  return { connectionName: build.connectionName, order, dependsOn };
+}
+function sourceBuildsOf(targets) {
+  const builds = targets.connections.map((c) => sourceBuildOf(c, targets.unbuildable));
+  const planned = new Set(builds.map((b) => b.connectionName));
+  for (const { source } of targets.unbuildable) {
+    if (planned.has(source.connectionName))
+      continue;
+    planned.add(source.connectionName);
+    builds.push(sourceBuildOf({ connectionName: source.connectionName, targets: [] }, targets.unbuildable));
+  }
+  return builds;
+}
+function plannedSources(targets) {
+  return [
+    ...targets.connections.flatMap((c) => c.targets.flatMap((t) => t.sources)),
+    ...targets.unbuildable.map((u) => u.source)
+  ];
+}
+function* sourcesInBuildOrder(build, sources) {
+  for (const sourceID of build.order) {
+    const source = sources[sourceID];
     if (source)
       yield source;
   }
-  for (const level of graph.nodes) {
-    for (const node of level) {
-      yield* visit(node);
-    }
-  }
 }
 function computeSourceEntityId(source, connectionDigests) {
   return source.makeBuildId(connectionDigests[source.connectionName], addressPartitionLayout(source, source.getSQL()));
@@ -23324,7 +23344,7 @@ async function classifyPersistSourceGate(persistSource, modelDef, materializer,
 }
 function emptyBuildPlanParts() {
   return {
-    graphs: [],
+    builds: [],
     sources: {},
     sourceModelPaths: {},
     droppedPersistSources: [],
@@ -23333,7 +23353,7 @@ function emptyBuildPlanParts() {
   };
 }
 function mergeBuildPlanParts(into, from) {
-  into.graphs.push(...from.graphs);
+  into.builds.push(...from.builds);
   Object.assign(into.sources, from.sources);
   Object.assign(into.sourceModelPaths, from.sourceModelPaths);
   into.droppedPersistSources.push(...from.droppedPersistSources);
@@ -23341,7 +23361,14 @@ function mergeBuildPlanParts(into, from) {
   Object.assign(into.sourceGateOutcomes, from.sourceGateOutcomes);
 }
 async function collectModelBuildPlan(parts, args) {
-  const { modelPath, packagePath, materializer, malloyModel, getRuntime } = args;
+  const {
+    modelPath,
+    packagePath,
+    materializer,
+    malloyModel,
+    runtime,
+    getRuntime
+  } = args;
   const synthesized = args.synthesized !== undefined ? args.synthesized : await tryCompileSynthesizedPreaggregation({
     packagePath,
     modelPath,
@@ -23349,14 +23376,14 @@ async function collectModelBuildPlan(parts, args) {
     contents: malloyModel._modelDef?.contents ?? {}
   });
   if (synthesized) {
-    const rollupPlan = synthesized.model.getBuildPlan();
-    const rollupNames = new Set(synthesized.plans.map((p) => p.rollupSourceName));
-    parts.graphs.push(...rollupPlan.graphs);
+    const rollupTargets = await synthesized.runtime.getBuildTargets(synthesized.model);
+    parts.builds.push(...sourceBuildsOf(rollupTargets));
     const planByName = new Map(synthesized.plans.map((p) => [p.rollupSourceName, p]));
     let rollupClassificationCtx;
-    for (const [sourceID, source] of Object.entries(rollupPlan.sources)) {
-      if (!rollupNames.has(source.name))
+    for (const source of plannedSources(rollupTargets)) {
+      if (!planByName.has(source.name))
         continue;
+      const sourceID = source.sourceID;
       parts.sources[sourceID] = source;
       parts.sourceModelPaths[sourceID] = modelPath;
       const rollup = planByName.get(source.name);
@@ -23375,23 +23402,25 @@ async function collectModelBuildPlan(parts, args) {
   const modelTag = malloyModel.modelAnnotations.parseAsTag("!").tag;
   if (!modelTag.has("experimental", "persistence"))
     return;
-  const buildPlan = malloyModel.getBuildPlan();
-  for (const msg of buildPlan.tagParseLog) {
+  const targets = await runtime.getBuildTargets(malloyModel);
+  for (const msg of targets.tagParseLog) {
     logger.warn("Persist annotation issue", {
       modelPath,
       message: msg.message,
       severity: msg.severity
     });
   }
-  const recognizedNames = new Set(Object.values(buildPlan.sources).map((s) => s.name));
+  const planned = plannedSources(targets);
+  const recognizedNames = new Set(planned.map((s) => s.name));
   for (const name of detectDroppedPersistSources(malloyModel, recognizedNames)) {
     parts.droppedPersistSources.push({ name, modelPath });
   }
-  if (buildPlan.graphs.length === 0)
+  if (planned.length === 0)
     return;
-  parts.graphs.push(...buildPlan.graphs);
+  parts.builds.push(...sourceBuildsOf(targets));
   let classificationCtx;
-  for (const [sourceID, source] of Object.entries(buildPlan.sources)) {
+  for (const source of planned) {
+    const sourceID = source.sourceID;
     parts.sources[sourceID] = source;
     parts.sourceModelPaths[sourceID] = modelPath;
     if (!classificationCtx) {
@@ -23404,28 +23433,30 @@ async function collectModelBuildPlan(parts, args) {
     parts.sourceGateOutcomes[sourceID] = await classifyPersistSourceGate(source, classificationCtx.modelDef, materializer, classificationCtx.deps, modelPath);
   }
 }
-async function resolveConnectionDigests(connections, graphs, onSkipped) {
+async function resolveConnectionDigests(connections, builds, onSkipped) {
   const connectionDigests = {};
-  for (const graph of graphs) {
-    const conn = connections.get(graph.connectionName);
+  for (const build of builds) {
+    const conn = connections.get(build.connectionName);
     if (!conn) {
-      onSkipped(graph.connectionName);
+      onSkipped(build.connectionName);
       continue;
     }
-    if (!connectionDigests[graph.connectionName]) {
-      connectionDigests[graph.connectionName] = await conn.getDigest();
+    if (!connectionDigests[build.connectionName]) {
+      connectionDigests[build.connectionName] = await conn.getDigest();
     }
   }
   return connectionDigests;
 }
-function deriveBuildPlan(graphs, sources, connectionDigests, sourceNames, sourceModelPaths, packageMaterialization, options) {
+function deriveBuildPlan(builds, sources, connectionDigests, sourceNames, sourceModelPaths, packageMaterialization, options) {
   const include = sourceNames ? new Set(sourceNames) : null;
-  const wireGraphs = graphs.map((graph) => ({
-    connectionName: graph.connectionName,
-    nodes: graph.nodes.map((level) => level.map((node) => ({
-      sourceID: node.sourceID,
-      dependsOn: flattenDependsOn(node)
-    })))
+  const wireGraphs = builds.map((build) => ({
+    connectionName: build.connectionName,
+    nodes: [
+      build.order.map((sourceID) => ({
+        sourceID,
+        dependsOn: build.dependsOn[sourceID] ?? []
+      }))
+    ]
   }));
   const wireSources = {};
   const refusedSources = {};
@@ -23514,7 +23545,7 @@ function deriveBuildPlan(graphs, sources, connectionDigests, sourceNames, source
 function deriveBuildPlanOutcome(compiled, materializationConfig) {
   const droppedPersistSources = compiled.droppedPersistSources ?? [];
   const incrementalDeclarations = collectIncrementalDeclarations(compiled.sources);
-  const plan = compiled.graphs.length === 0 ? null : deriveBuildPlan(compiled.graphs, compiled.sources, compiled.connectionDigests, undefined, compiled.sourceModelPaths, materializationConfig, {
+  const plan = compiled.builds.length === 0 ? null : deriveBuildPlan(compiled.builds, compiled.sources, compiled.connectionDigests, undefined, compiled.sourceModelPaths, materializationConfig, {
     preaggregatePlans: compiled.preaggregatePlans,
     sourceGateOutcomes: compiled.sourceGateOutcomes
   });
@@ -24474,6 +24505,7 @@ async function compileMalloyModel(job, malloyConfig, modelPath, load) {
     modelPath,
     materializer: mm,
     model: compiled,
+    runtime,
     importBaseURL,
     queries,
     sources
@@ -24559,6 +24591,7 @@ async function prepareForMainThread(job, malloyConfig, load, model) {
         packagePath: job.packagePath,
         materializer,
         malloyModel: model.model,
+        runtime: model.runtime,
         getRuntime: companionRuntime,
         synthesized: companion
       });
@@ -24798,8 +24831,8 @@ async function finishWorkerBuildPlan(malloyConfig, modelPaths, load, materializa
     }
     const connections = await resolvePackageConnections({
       getMalloyConnection: (name) => malloyConfig.connections.lookupConnection(name)
-    }, parts.graphs.map((g) => g.connectionName));
-    const connectionDigests = await resolveConnectionDigests(connections, parts.graphs, (name) => digestSkipped.push(name));
+    }, parts.builds.map((b) => b.connectionName));
+    const connectionDigests = await resolveConnectionDigests(connections, parts.builds, (name) => digestSkipped.push(name));
     const outcome = deriveBuildPlanOutcome({ ...parts, connectionDigests }, materializationConfig);
     return {
       ok: true,

package/dist/server.mjs

@@ -164832,7 +164832,7 @@ var init_telemetry = __esm(() => {
 });
 
 // package.json
-var version = "0.10.3";
+var version = "0.10.5";
 var init_package = () => {};
 
 // src/version.ts
@@ -268349,7 +268349,7 @@ var require_bcrypt_pbkdf = __commonJS((exports, module) => {
 
 // ../../node_modules/cpu-features/build/Release/cpufeatures.node
 var require_cpufeatures = __commonJS((exports, module) => {
-  module.exports = __require("./cpufeatures-1yrn0vtw.node");
+  module.exports = __require("./cpufeatures-gknxfsk5.node");
 });
 
 // ../../node_modules/cpu-features/lib/index.js
@@ -268960,6 +268960,11 @@ var require_utils93 = __commonJS((exports, module) => {
   };
 });
 
+// ../../node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
+var require_sshcrypto = __commonJS((exports, module) => {
+  module.exports = __require("./sshcrypto-a4xyg5e8.node");
+});
+
 // ../../node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -269446,7 +269451,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
+    binding = require_sshcrypto();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -283780,7 +283785,7 @@ function validateMotherDuckShape(connection) {
     throw new Error("MotherDuck access token is required.");
   }
 }
-function validateDuckLakeShape(connection) {
+function validateDuckLakeShape(connection, origin2) {
   if (!connection.ducklakeConnection) {
     throw new Error("DuckLake connection configuration is missing.");
   }
@@ -283789,7 +283794,7 @@ function validateDuckLakeShape(connection) {
   }
   const storage = connection.ducklakeConnection.storage;
   if (storage?.s3Connection) {
-    validateS3ProviderShape(storage.s3Connection, connection.name);
+    validateS3ProviderShape(storage.s3Connection, connection.name, origin2);
   }
   if (connection.ducklakeConnection.catalog.metadataSchema !== undefined) {
     const schema = connection.ducklakeConnection.catalog.metadataSchema;
@@ -283866,7 +283871,7 @@ function validatePublisherShape(connection) {
     throw new Error(`Invalid publisher connection '${connection.name}': connectionUri must use http or https (got '${parsedUri.protocol}'). ` + `Fix: set connectionUri to an absolute https URL like "https://…/connections/${connection.name}".`);
   }
 }
-function validateTypeShape(connection) {
+function validateTypeShape(connection, origin2) {
   switch (connection.type) {
     case "sqlserver":
       return validateSqlServerShape(connection);
@@ -283877,7 +283882,7 @@ function validateTypeShape(connection) {
     case "motherduck":
       return validateMotherDuckShape(connection);
     case "ducklake":
-      return validateDuckLakeShape(connection);
+      return validateDuckLakeShape(connection, origin2);
     case "trino":
       return validateTrinoShape(connection);
     case "databricks":
@@ -283888,7 +283893,7 @@ function validateTypeShape(connection) {
       return validatePublisherShape(connection);
   }
 }
-function validateConnectionShape(connection) {
+function validateConnectionShape(connection, origin2 = "connection") {
   if (connection.proxy) {
     validateProxyShape(connection, connection.proxy);
   }
@@ -283901,7 +283906,7 @@ function validateConnectionShape(connection) {
   if (connection.postgresConnection) {
     postgresStatementTimeoutMs(connection.name ?? "", connection.postgresConnection);
   }
-  validateTypeShape(connection);
+  validateTypeShape(connection, origin2);
 }
 function storageDestinationRoot(environmentPath) {
   return path4.join(environmentPath, STORAGE_DESTINATIONS_DIR);
@@ -283950,7 +283955,7 @@ function validateStorageDestinations(destinations = []) {
       continue;
     }
     try {
-      validateConnectionShape(destination);
+      validateConnectionShape(destination, "storage-destination");
       const storage = destination.ducklakeConnection?.storage;
       if (storage?.s3Connection) {
         resolveCloudStorageCredentials({
@@ -284168,7 +284173,7 @@ function buildCoreEntry(connection, environmentPath) {
       throw new Error(`Unsupported connection type: ${connection.type}`);
   }
 }
-function assembleEnvironmentConnections(connections = [], environmentPath = "") {
+function assembleEnvironmentConnections(connections = [], environmentPath = "", origin2 = "connection") {
   const pojo = { connections: {} };
   const metadata = new Map;
   const apiConnections = [];
@@ -284185,7 +284190,7 @@ function assembleEnvironmentConnections(connections = [], environmentPath = "")
     }
     processedConnections.add(connection.name);
     validateDuckdbApiSurface(connection);
-    validateConnectionShape(connection);
+    validateConnectionShape(connection, origin2);
     warnOnConnectionQueryMetadata(connection);
     const apiConnection = cloneApiConnection(connection);
     apiConnection.attributes = getStaticConnectionAttributes(connection.type);
@@ -295166,17 +295171,19 @@ async function attachDuckLakeWithMode(connection, dbName, ducklakeConfig, option
   const hasS3 = !!ducklakeConfig.storage?.s3Connection;
   const hasGCS = !!ducklakeConfig.storage?.gcsConnection;
   if (hasS3) {
-    await attachCloudStorage(connection, {
-      name: `${dbName}_storage`,
-      type: "s3",
-      s3Connection: ducklakeConfig.storage.s3Connection
-    });
-  } else if (hasGCS) {
-    await attachCloudStorage(connection, {
-      name: `${dbName}_storage`,
-      type: "gcs",
-      gcsConnection: ducklakeConfig.storage.gcsConnection
-    });
+    await connection.runSQL("SET GLOBAL enable_global_s3_configuration=false");
+  }
+  const storage = hasS3 ? {
+    name: `${dbName}_storage`,
+    type: "s3",
+    s3Connection: ducklakeConfig.storage.s3Connection
+  } : hasGCS ? {
+    name: `${dbName}_storage`,
+    type: "gcs",
+    gcsConnection: ducklakeConfig.storage.gcsConnection
+  } : undefined;
+  if (storage) {
+    resolveCloudStorageCredentials(storage, options.origin ?? "connection");
   }
   const pg = ducklakeConfig.catalog.postgresConnection;
   const pgConnString = buildPgConnectionString(pg, {
@@ -295189,8 +295196,8 @@ async function attachDuckLakeWithMode(connection, dbName, ducklakeConfig, option
   logger.debug(`Final escaped connection string: ${redactPgSecrets(escapedPgConnString)}`);
   const dataPath = ducklakeConfig.storage?.bucketUrl;
   const metadataSchema = ducklakeConfig.catalog.metadataSchema;
-  const presence = await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString, metadataSchema);
-  if (presence === "absent") {
+  const preflight = await preflightDuckLakeCatalogFormat(connection, dbName, pgConnString, metadataSchema);
+  if (preflight === "absent") {
     if (options.skipIfAbsent) {
       return false;
     }
@@ -295215,14 +295222,44 @@ async function attachDuckLakeWithMode(connection, dbName, ducklakeConfig, option
       throw error;
     }
   }
+  if (storage) {
+    try {
+      const scope = await attachedDuckLakeScope(connection, dbName, {
+        configuredDataPath: dataPath,
+        metadataSchema,
+        readOnly: options.readOnly,
+        managed: options.managed === true && options.origin !== "storage-destination"
+      });
+      if (!scope) {
+        throw new Error(`No storage secret could be scoped for DuckLake catalog '${dbName}': ` + `the config states no data path, and the catalog records no data ` + `path (or, for a managed view, no path for its main schema) to ` + `scope it to. The catalog was not attached.`);
+      }
+      await attachCloudStorage(connection, storage, options.origin, scope);
+    } catch (error) {
+      await connection.runSQL(`DETACH ${quoteIdentifier(dbName, "duckdb")};`).catch(() => {});
+      throw error;
+    }
+  }
   return true;
 }
-async function recordedCatalogSettings(connection, alias, metadataSchema) {
-  const metadataCatalog = [
+async function attachedDuckLakeScope(connection, dbName, input) {
+  const recordedDataPath = input.configuredDataPath ? undefined : (await recordedCatalogSettings(connection, dbName, input.metadataSchema)).data_path;
+  const mainSchemaPath = input.managed && input.readOnly ? await recordedSchemaPath(connection, dbName, input.metadataSchema, "main") : undefined;
+  return storageSecretScope({
+    configuredDataPath: input.configuredDataPath,
+    recordedDataPath,
+    mainSchemaPath,
+    readOnly: input.readOnly,
+    managed: input.managed
+  });
+}
+function metadataCatalogRef(alias, metadataSchema) {
+  return [
     `__ducklake_metadata_${alias}`,
     ...metadataSchema ? [metadataSchema] : []
   ].map((part) => quoteIdentifier(part, "duckdb")).join(".");
-  const rows = runSQLRows(await connection.runSQL(`SELECT key, value FROM ${metadataCatalog}.ducklake_metadata WHERE scope IS NULL`));
+}
+async function recordedCatalogSettings(connection, alias, metadataSchema) {
+  const rows = runSQLRows(await connection.runSQL(`SELECT key, value FROM ${metadataCatalogRef(alias, metadataSchema)}.ducklake_metadata WHERE scope IS NULL`));
   const settings = {};
   for (const row of rows) {
     if (typeof row.key === "string" && row.value != null) {
@@ -295231,6 +295268,43 @@ async function recordedCatalogSettings(connection, alias, metadataSchema) {
   }
   return settings;
 }
+async function recordedSchemaPath(connection, alias, metadataSchema, schemaName) {
+  const row = runSQLRows(await connection.runSQL(`SELECT path, path_is_relative FROM ${metadataCatalogRef(alias, metadataSchema)}.ducklake_schema ` + `WHERE schema_name = '${escapeSQL(schemaName)}' AND end_snapshot IS NULL LIMIT 1`))[0];
+  if (!row || typeof row.path !== "string")
+    return;
+  return { path: row.path, relative: row.path_is_relative !== false };
+}
+function stripTrailingSlashes(url3) {
+  let end = url3.length;
+  while (end > 0 && url3[end - 1] === "/")
+    end--;
+  return url3.slice(0, end);
+}
+function oneTrailingSlash(url3) {
+  return `${stripTrailingSlashes(url3)}/`;
+}
+function isBucketlessUrl(url3) {
+  const at = url3.indexOf("://");
+  return at >= 0 && stripTrailingSlashes(url3.slice(at + 3)) === "";
+}
+function storageSecretScope(input) {
+  const root = input.configuredDataPath || input.recordedDataPath;
+  if (!root || isBucketlessUrl(root))
+    return;
+  if (input.managed && input.readOnly) {
+    const main = input.mainSchemaPath;
+    if (!main)
+      return;
+    if (!main.relative) {
+      return isBucketlessUrl(main.path) ? undefined : oneTrailingSlash(main.path);
+    }
+    let start = 0;
+    while (start < main.path.length && main.path[start] === "/")
+      start++;
+    return oneTrailingSlash(`${oneTrailingSlash(root)}${main.path.slice(start)}`);
+  }
+  return oneTrailingSlash(root);
+}
 function dataPathClauses(dataPath, readOnly) {
   if (dataPath) {
     return `DATA_PATH '${escapeSQL(dataPath)}', OVERRIDE_DATA_PATH true`;
@@ -295250,13 +295324,16 @@ function firstAttachClauses(options) {
 async function attachDuckLakeForCreate(connection, dbName, ducklakeConfig, settings) {
   await attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
     readOnly: false,
+    origin: "storage-destination",
     encrypted: settings.encrypted,
     dataInliningRowLimit: settings.dataInliningRowLimit
   });
 }
-async function attachDuckLake(connection, dbName, ducklakeConfig) {
+async function attachDuckLake(connection, dbName, ducklakeConfig, options = {}) {
   await attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
-    readOnly: ducklakeConfig.readOnly !== false
+    readOnly: ducklakeConfig.readOnly !== false,
+    origin: options.origin,
+    managed: options.managed
   });
 }
 function managedSearchPathSql(dbName) {
@@ -295267,17 +295344,21 @@ async function setManagedSearchPath(connection, dbName) {
   await connection.runSQL(managedSearchPathSql(dbName));
 }
 async function attachDuckLakeReadOnly(connection, dbName, ducklakeConfig) {
-  await attachDuckLake(connection, dbName, ducklakeConfig);
+  await attachDuckLake(connection, dbName, ducklakeConfig, {
+    origin: "storage-destination"
+  });
 }
 async function attachDuckLakeReadOnlyIfPresent(connection, dbName, ducklakeConfig) {
   return attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
     readOnly: true,
-    skipIfAbsent: true
+    skipIfAbsent: true,
+    origin: "storage-destination"
   });
 }
 async function attachDuckLakeReadWrite(connection, dbName, ducklakeConfig) {
   await attachDuckLakeWithMode(connection, dbName, ducklakeConfig, {
-    readOnly: false
+    readOnly: false,
+    origin: "storage-destination"
   });
 }
 async function federateSourceForPassthrough(connection, sourceType, config, deps = {}) {
@@ -295481,13 +295562,15 @@ function buildCloudStorageSecretSQL(secretName, credentials) {
   const isGCS = credentials.type === "gcs";
   const escapedKeyId = escapeSQL(credentials.accessKeyId);
   const escapedSecret = escapeSQL(credentials.secretAccessKey);
+  const scopeClause = credentials.scope ? `SCOPE '${escapeSQL(credentials.scope)}'` : "";
   let createSecretCommand;
   if (isGCS) {
     createSecretCommand = `
          CREATE OR REPLACE SECRET ${secretName} (
             TYPE gcs,
             KEY_ID '${escapedKeyId}',
-            SECRET '${escapedSecret}'
+            SECRET '${escapedSecret}'${scopeClause ? `,
+            ${scopeClause}` : ""}
          );
       `;
   } else {
@@ -295523,6 +295606,9 @@ function buildCloudStorageSecretSQL(secretName, credentials) {
     if (credentials.provider !== "credential_chain" && credentials.sessionToken) {
       clauses.push(`SESSION_TOKEN '${escapeSQL(credentials.sessionToken)}'`);
     }
+    if (scopeClause) {
+      clauses.push(scopeClause);
+    }
     createSecretCommand = `
             CREATE OR REPLACE SECRET ${secretName} (
                ${clauses.join(`,
@@ -295532,9 +295618,12 @@ function buildCloudStorageSecretSQL(secretName, credentials) {
   }
   return createSecretCommand;
 }
-async function attachCloudStorage(connection, attachedDb) {
+async function attachCloudStorage(connection, attachedDb, origin2 = "connection", scope) {
   const storageType = attachedDb.type?.toUpperCase() || "";
-  const credentials = resolveCloudStorageCredentials(attachedDb);
+  const credentials = {
+    ...resolveCloudStorageCredentials(attachedDb, origin2),
+    scope
+  };
   await installAndLoadExtension(connection, "httpfs");
   if (credentials.provider === "credential_chain") {
     await installAndLoadExtension(connection, "aws");
@@ -295826,8 +295915,8 @@ function applyConnectionFingerprint(connection, metadata) {
 function isDuckDBConnection(connection) {
   return connection instanceof DuckDBConnection;
 }
-function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", isUpdateConnectionRequest = false) {
-  const assembled = assembleEnvironmentConnections(connections, environmentPath);
+function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", isUpdateConnectionRequest = false, { origin: origin2 = "connection" } = {}) {
+  const assembled = assembleEnvironmentConnections(connections, environmentPath, origin2);
   const duckLakeCache = new Map;
   const snowflakeJwtCache = new Map;
   const azureDuckDBCache = new Map;
@@ -295866,7 +295955,10 @@ function buildEnvironmentMalloyConfig(connections = [], environmentPath = "", is
         }
         const connection2 = await connectionPromise;
         if (isUpdateConnectionRequest || !await isDatabaseAttached(connection2, name)) {
-          await attachDuckLake(connection2, name, metadata.apiConnection.ducklakeConnection);
+          await attachDuckLake(connection2, name, metadata.apiConnection.ducklakeConnection, {
+            origin: origin2,
+            managed: metadata.apiConnection.managed === true
+          });
           if (metadata.apiConnection.managed === true) {
             await setManagedSearchPath(connection2, name);
           }
@@ -348115,7 +348207,7 @@ async function compileSynthesizedPreaggregation(args) {
   const { runtime, importBaseURL } = await args.getRuntime(new Map([[synthesizedURL.href, text]]));
   const materializer = runtime.loadModel(synthesizedURL, { importBaseURL });
   const model = await materializer.getModel();
-  return { plans, model, materializer, text };
+  return { plans, model, materializer, runtime, text };
 }
 async function tryCompileSynthesizedPreaggregation(args) {
   try {
@@ -348302,27 +348394,47 @@ function composeDeclaredQueryMetadata(layers) {
   const resolved = Object.assign({}, ...ordered);
   return Object.keys(resolved).length > 0 ? resolved : null;
 }
-function flattenDependsOn(node) {
-  return node.dependsOn.map((d) => d.sourceID);
-}
-function* iterGraphSources(graph, sources) {
-  const seen = new Set;
-  function* visit(node) {
-    if (seen.has(node.sourceID))
-      return;
-    for (const dep of node.dependsOn) {
-      yield* visit(dep);
+function sourceBuildOf(build, unbuildable) {
+  const order = [];
+  const dependsOn = {};
+  for (const target of build.targets) {
+    const reads = target.dependsOn.flatMap((t2) => t2.sources.map((s2) => s2.sourceID));
+    for (const source of target.sources) {
+      order.push(source.sourceID);
+      dependsOn[source.sourceID] = reads;
     }
-    seen.add(node.sourceID);
-    const source = sources[node.sourceID];
+  }
+  for (const { source } of unbuildable) {
+    if (source.connectionName !== build.connectionName)
+      continue;
+    order.push(source.sourceID);
+    dependsOn[source.sourceID] = [];
+  }
+  return { connectionName: build.connectionName, order, dependsOn };
+}
+function sourceBuildsOf(targets) {
+  const builds = targets.connections.map((c) => sourceBuildOf(c, targets.unbuildable));
+  const planned = new Set(builds.map((b) => b.connectionName));
+  for (const { source } of targets.unbuildable) {
+    if (planned.has(source.connectionName))
+      continue;
+    planned.add(source.connectionName);
+    builds.push(sourceBuildOf({ connectionName: source.connectionName, targets: [] }, targets.unbuildable));
+  }
+  return builds;
+}
+function plannedSources(targets) {
+  return [
+    ...targets.connections.flatMap((c) => c.targets.flatMap((t2) => t2.sources)),
+    ...targets.unbuildable.map((u) => u.source)
+  ];
+}
+function* sourcesInBuildOrder(build, sources) {
+  for (const sourceID of build.order) {
+    const source = sources[sourceID];
     if (source)
       yield source;
   }
-  for (const level of graph.nodes) {
-    for (const node of level) {
-      yield* visit(node);
-    }
-  }
 }
 function computeSourceEntityId(source, connectionDigests) {
   return source.makeBuildId(connectionDigests[source.connectionName], addressPartitionLayout(source, source.getSQL()));
@@ -348411,7 +348523,7 @@ async function classifyPersistSourceGate(persistSource, modelDef, materializer,
 }
 function emptyBuildPlanParts() {
   return {
-    graphs: [],
+    builds: [],
     sources: {},
     sourceModelPaths: {},
     droppedPersistSources: [],
@@ -348420,7 +348532,7 @@ function emptyBuildPlanParts() {
   };
 }
 function mergeBuildPlanParts(into, from) {
-  into.graphs.push(...from.graphs);
+  into.builds.push(...from.builds);
   Object.assign(into.sources, from.sources);
   Object.assign(into.sourceModelPaths, from.sourceModelPaths);
   into.droppedPersistSources.push(...from.droppedPersistSources);
@@ -348428,7 +348540,14 @@ function mergeBuildPlanParts(into, from) {
   Object.assign(into.sourceGateOutcomes, from.sourceGateOutcomes);
 }
 async function collectModelBuildPlan(parts, args) {
-  const { modelPath, packagePath, materializer, malloyModel, getRuntime } = args;
+  const {
+    modelPath,
+    packagePath,
+    materializer,
+    malloyModel,
+    runtime,
+    getRuntime
+  } = args;
   const synthesized = args.synthesized !== undefined ? args.synthesized : await tryCompileSynthesizedPreaggregation({
     packagePath,
     modelPath,
@@ -348436,14 +348555,14 @@ async function collectModelBuildPlan(parts, args) {
     contents: malloyModel._modelDef?.contents ?? {}
   });
   if (synthesized) {
-    const rollupPlan = synthesized.model.getBuildPlan();
-    const rollupNames = new Set(synthesized.plans.map((p) => p.rollupSourceName));
-    parts.graphs.push(...rollupPlan.graphs);
+    const rollupTargets = await synthesized.runtime.getBuildTargets(synthesized.model);
+    parts.builds.push(...sourceBuildsOf(rollupTargets));
     const planByName = new Map(synthesized.plans.map((p) => [p.rollupSourceName, p]));
     let rollupClassificationCtx;
-    for (const [sourceID, source] of Object.entries(rollupPlan.sources)) {
-      if (!rollupNames.has(source.name))
+    for (const source of plannedSources(rollupTargets)) {
+      if (!planByName.has(source.name))
         continue;
+      const sourceID = source.sourceID;
       parts.sources[sourceID] = source;
       parts.sourceModelPaths[sourceID] = modelPath;
       const rollup = planByName.get(source.name);
@@ -348462,23 +348581,25 @@ async function collectModelBuildPlan(parts, args) {
   const modelTag = malloyModel.modelAnnotations.parseAsTag("!").tag;
   if (!modelTag.has("experimental", "persistence"))
     return;
-  const buildPlan = malloyModel.getBuildPlan();
-  for (const msg of buildPlan.tagParseLog) {
+  const targets = await runtime.getBuildTargets(malloyModel);
+  for (const msg of targets.tagParseLog) {
     logger.warn("Persist annotation issue", {
       modelPath,
       message: msg.message,
       severity: msg.severity
     });
   }
-  const recognizedNames = new Set(Object.values(buildPlan.sources).map((s2) => s2.name));
+  const planned = plannedSources(targets);
+  const recognizedNames = new Set(planned.map((s2) => s2.name));
   for (const name of detectDroppedPersistSources(malloyModel, recognizedNames)) {
     parts.droppedPersistSources.push({ name, modelPath });
   }
-  if (buildPlan.graphs.length === 0)
+  if (planned.length === 0)
     return;
-  parts.graphs.push(...buildPlan.graphs);
+  parts.builds.push(...sourceBuildsOf(targets));
   let classificationCtx;
-  for (const [sourceID, source] of Object.entries(buildPlan.sources)) {
+  for (const source of planned) {
+    const sourceID = source.sourceID;
     parts.sources[sourceID] = source;
     parts.sourceModelPaths[sourceID] = modelPath;
     if (!classificationCtx) {
@@ -348491,28 +348612,30 @@ async function collectModelBuildPlan(parts, args) {
     parts.sourceGateOutcomes[sourceID] = await classifyPersistSourceGate(source, classificationCtx.modelDef, materializer, classificationCtx.deps, modelPath);
   }
 }
-async function resolveConnectionDigests(connections, graphs, onSkipped) {
+async function resolveConnectionDigests(connections, builds, onSkipped) {
   const connectionDigests = {};
-  for (const graph of graphs) {
-    const conn = connections.get(graph.connectionName);
+  for (const build of builds) {
+    const conn = connections.get(build.connectionName);
     if (!conn) {
-      onSkipped(graph.connectionName);
+      onSkipped(build.connectionName);
       continue;
     }
-    if (!connectionDigests[graph.connectionName]) {
-      connectionDigests[graph.connectionName] = await conn.getDigest();
+    if (!connectionDigests[build.connectionName]) {
+      connectionDigests[build.connectionName] = await conn.getDigest();
     }
   }
   return connectionDigests;
 }
-function deriveBuildPlan(graphs, sources, connectionDigests, sourceNames, sourceModelPaths, packageMaterialization, options) {
+function deriveBuildPlan(builds, sources, connectionDigests, sourceNames, sourceModelPaths, packageMaterialization, options) {
   const include = sourceNames ? new Set(sourceNames) : null;
-  const wireGraphs = graphs.map((graph) => ({
-    connectionName: graph.connectionName,
-    nodes: graph.nodes.map((level) => level.map((node) => ({
-      sourceID: node.sourceID,
-      dependsOn: flattenDependsOn(node)
-    })))
+  const wireGraphs = builds.map((build) => ({
+    connectionName: build.connectionName,
+    nodes: [
+      build.order.map((sourceID) => ({
+        sourceID,
+        dependsOn: build.dependsOn[sourceID] ?? []
+      }))
+    ]
   }));
   const wireSources = {};
   const refusedSources = {};
@@ -348601,7 +348724,7 @@ function deriveBuildPlan(graphs, sources, connectionDigests, sourceNames, source
 function deriveBuildPlanOutcome(compiled, materializationConfig) {
   const droppedPersistSources = compiled.droppedPersistSources ?? [];
   const incrementalDeclarations = collectIncrementalDeclarations(compiled.sources);
-  const plan = compiled.graphs.length === 0 ? null : deriveBuildPlan(compiled.graphs, compiled.sources, compiled.connectionDigests, undefined, compiled.sourceModelPaths, materializationConfig, {
+  const plan = compiled.builds.length === 0 ? null : deriveBuildPlan(compiled.builds, compiled.sources, compiled.connectionDigests, undefined, compiled.sourceModelPaths, materializationConfig, {
     preaggregatePlans: compiled.preaggregatePlans,
     sourceGateOutcomes: compiled.sourceGateOutcomes
   });
@@ -350136,14 +350259,14 @@ async function buildDownstreamIntoStorage(params) {
         message: `Chained build model did not compile over the rebound parents: ${errMessage(err)}`
       });
     }
-    const plan = model.getBuildPlan();
-    let downstream;
-    for (const ps of Object.values(plan.sources)) {
-      if (ps.name === downstreamName) {
-        downstream = ps;
-        break;
-      }
+    const targets = await runtime.getBuildTargets(model, { virtualMap });
+    const unbuildable = targets.unbuildable.find((u) => u.source.name === downstreamName);
+    if (unbuildable) {
+      throw new MaterializationEligibilityError({
+        message: `Chained build model could not plan '${downstreamName}' over ` + `the rebound parents: ${unbuildable.problem.message}`
+      });
     }
+    const downstream = plannedSources(targets).find((ps) => ps.name === downstreamName);
     if (!downstream) {
       throw new MaterializationEligibilityError({
         message: `Chained build model did not yield a persist source named ` + `'${downstreamName}' (the downstream references something the ` + `rebound parents don't provide).`
@@ -359860,6 +359983,98 @@ var require_recursive_readdir = __commonJS((exports, module) => {
   module.exports = readdir3;
 });
 
+// src/service/preaggregation_coverage.ts
+function rollupMeasuresByMember(plans) {
+  return new Map(plans.map((p2) => [
+    p2.rollupSourceName,
+    new Set(p2.measures.map((m3) => m3.name))
+  ]));
+}
+function rollupCoverageViolation(query, rollupMeasures) {
+  const ir2 = query;
+  const member = ir2?.compositeResolvedSourceDef?.as;
+  if (!member)
+    return;
+  const merged = rollupMeasures.get(member);
+  if (!merged)
+    return;
+  const memberFields = new Map((ir2?.compositeResolvedSourceDef?.fields ?? []).map((f5) => [
+    f5.as ?? f5.name,
+    f5
+  ]));
+  const followed = new Set;
+  let violation;
+  const visitRef = (path16) => {
+    if (!path16)
+      return;
+    if (path16.length !== 1) {
+      violation = `reference ${path16.join(".")} reaches past the rollup's own fields`;
+      return;
+    }
+    const name = path16[0];
+    if (merged.has(name) || followed.has(name))
+      return;
+    followed.add(name);
+    visitExpr(memberFields.get(name)?.e);
+  };
+  const visitExpr = (e2) => {
+    if (violation || !e2 || typeof e2 !== "object")
+      return;
+    if (Array.isArray(e2)) {
+      for (const item of e2)
+        visitExpr(item);
+      return;
+    }
+    const n = e2;
+    if (n.node === "aggregate") {
+      violation = `aggregate ${String(n.function)}() is computed over the rollup's rows, not from a stored partial`;
+      return;
+    }
+    if (n.node === "function_call" && n.overload?.returnType?.expressionType === "aggregate") {
+      violation = `aggregate function ${String(n.name)}() is computed over the rollup's rows, not from a stored partial`;
+      return;
+    }
+    if (n.node === "field") {
+      visitRef(n.path);
+      return;
+    }
+    for (const [key, value] of Object.entries(n)) {
+      if (key === "overload" || key === "at")
+        continue;
+      visitExpr(value);
+    }
+  };
+  const visitStage = (stage) => {
+    if (violation)
+      return;
+    if (stage?.type === "project" || stage?.type === "index") {
+      violation = `${stage.type === "project" ? "a select:" : "an index:"} stage over the rollup returns one row per grain group, not the source's rows`;
+      return;
+    }
+    for (const field of stage?.queryFields ?? []) {
+      if (field.type === "fieldref")
+        visitRef(field.path);
+      else if (field.type === "turtle")
+        visitStage(field.pipeline?.[0]);
+      else
+        visitExpr(field.e);
+    }
+    for (const filter2 of stage?.filterList ?? [])
+      visitExpr(filter2.e);
+  };
+  visitStage(ir2?.pipeline?.[0]);
+  return violation ? `${member}: ${violation}` : undefined;
+}
+var RollupCoverageError;
+var init_preaggregation_coverage = __esm(() => {
+  RollupCoverageError = class RollupCoverageError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "RollupCoverageError";
+    }
+  };
+});
+
 // src/service/render_tag_targets.ts
 function renderTagTargets(queries, sources) {
   const targets = [];
@@ -363064,6 +363279,11 @@ class StorageServeShape {
     await this.host.ensureSharedQueryModel(this.serveShapeCache.materializer);
     const runnable = this.serveShapeCache.materializer.loadRestrictedQuery(queryString);
     const probeSQL = await runnable.getSQL({ virtualMap, givens });
+    if (groups.length > 0) {
+      const uncovered = rollupCoverageViolation((await runnable.getPreparedQuery())._query, rollupMeasuresByMember(this.host.rollupPlans()));
+      if (uncovered)
+        throw new RollupCoverageError(uncovered);
+    }
     const rollupPaths = [
       ...buildVirtualMap(groups.flatMap((g2) => g2.members))
     ].flatMap(([, byHandle]) => [...byHandle.values()]);
@@ -363264,6 +363484,7 @@ var init_model_serve_shape = __esm(() => {
   init_materialization_metrics();
   init_connection();
   init_materialization_serve_transform();
+  init_preaggregation_coverage();
   init_preaggregation_serve_bindings();
   staleBindingsWithheld = lazyCounter("publisher_storage_bindings_withheld_total", "Storage serve bindings withheld from a routed query because the freshness gate found them stale; each one is read live instead. Until now staleness was visible only as a later live read.");
 });
@@ -363306,6 +363527,7 @@ var init_model = __esm(() => {
   init_config();
   init_preaggregation_synthesis();
   init_preaggregation_compile();
+  init_preaggregation_coverage();
   init_render_tag_targets();
   init_model_info();
   init_logger();
@@ -365487,13 +365709,17 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
             });
           } catch (shapeErr) {
             recordStorageServeRouting("live_fallback");
-            const { shapeSources, staleSources } = serveShapeDiagnostics(this.storageServe.serveBindings, this.storageServe.freshServeBindings(Date.now()));
-            logger.info("storage serve-shape ineligible for this query; serving live", {
-              modelPath: this.modelPath,
-              error: shapeErr instanceof Error ? shapeErr.message : String(shapeErr),
-              shapeSources,
-              staleSources
-            });
+            if (shapeErr instanceof RollupCoverageError) {
+              logger.debug("storage rollup cannot answer this query; serving live", { modelPath: this.modelPath, error: shapeErr.message });
+            } else {
+              const { shapeSources, staleSources } = serveShapeDiagnostics(this.storageServe.serveBindings, this.storageServe.freshServeBindings(Date.now()));
+              logger.info("storage serve-shape ineligible for this query; serving live", {
+                modelPath: this.modelPath,
+                error: shapeErr instanceof Error ? shapeErr.message : String(shapeErr),
+                shapeSources,
+                staleSources
+              });
+            }
           }
         }
         const everyRollupIsStorageBound = this.preaggregateRollupPlans.length > 0 && this.preaggregateRollupPlans.every((plan) => !!plan.storage);
@@ -365504,10 +365730,13 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
               givens: querySurfaceGivens,
               buildManifest
             });
+            const uncovered = rollupCoverageViolation((await candidate.getPreparedQuery())._query, rollupMeasuresByMember(this.preaggregateRollupPlans));
+            if (uncovered)
+              throw new RollupCoverageError(uncovered);
             runnable = candidate;
             preaggRouted = true;
           } catch (preaggErr) {
-            logger.debug("query does not compile against the pre-aggregation model; serving live", {
+            logger.debug("query cannot be served from the pre-aggregation model; serving live", {
               modelPath: this.modelPath,
               error: preaggErr instanceof Error ? preaggErr.message : String(preaggErr)
             });
@@ -366140,18 +366369,19 @@ async function compilePackageBuildPlan(pkg, signal) {
       packagePath: pkg.getPackagePath(),
       materializer,
       malloyModel,
+      runtime,
       getRuntime: (overlay) => Model.getModelRuntime(pkg.getPackagePath(), modelPath, pkg.getMalloyConfig(), { overlay })
     });
   }
-  const connections = await resolvePackageConnections(pkg, parts.graphs.map((g2) => g2.connectionName));
-  const connectionDigests = await resolveConnectionDigests(connections, parts.graphs, (connectionName) => {
+  const connections = await resolvePackageConnections(pkg, parts.builds.map((b3) => b3.connectionName));
+  const connectionDigests = await resolveConnectionDigests(connections, parts.builds, (connectionName) => {
     recordConnectionDigestSkipped();
     logger.warn("Skipping connection digest; connection did not resolve", {
       connectionName
     });
   });
   return {
-    graphs: parts.graphs,
+    builds: parts.builds,
     sources: parts.sources,
     connectionDigests,
     connections,
@@ -370262,10 +370492,10 @@ class Environment {
       if (this.destinations.length > 0) {
         fs17.mkdirSync(destinationRoot, { recursive: true });
       }
-      this.destinationMalloyConfig = buildEnvironmentMalloyConfig(this.destinations, destinationRoot);
+      this.destinationMalloyConfig = buildEnvironmentMalloyConfig(this.destinations, destinationRoot, false, { origin: "storage-destination" });
     } catch (error) {
       logger.error(`Failed to assemble storage destinations for environment ${this.environmentName}; serving without them`, { error });
-      this.destinationMalloyConfig = buildEnvironmentMalloyConfig([], storageDestinationRoot(this.environmentPath));
+      this.destinationMalloyConfig = buildEnvironmentMalloyConfig([], storageDestinationRoot(this.environmentPath), false, { origin: "storage-destination" });
     }
     if (previous && previous !== this.destinationMalloyConfig) {
       this.retireConnectionGeneration(`environment ${this.environmentName} destinations`, () => previous.releaseConnections());
@@ -374591,11 +374821,11 @@ function resolveInstruction(index, persistSource, connectionDigests) {
     return;
   return { instruction, orchestrated: false, sourceEntityId };
 }
-function assertNoTableCollisions(graphs, sources, connectionDigests, index) {
+function assertNoTableCollisions(builds, sources, connectionDigests, index) {
   const claimedBy = new Map;
   const collisions = [];
-  for (const graph of graphs) {
-    for (const persistSource of iterGraphSources(graph, sources)) {
+  for (const build of builds) {
+    for (const persistSource of sourcesInBuildOrder(build, sources)) {
       let address;
       try {
         address = computeSourceEntityId(persistSource, connectionDigests);
@@ -374605,7 +374835,7 @@ function assertNoTableCollisions(graphs, sources, connectionDigests, index) {
       const instruction = index.bySourceID.get(persistSource.sourceID) ?? index.bySourceEntityId.get(address);
       if (!instruction)
         continue;
-      const target = physicalTargetKey(instruction, graph.connectionName);
+      const target = physicalTargetKey(instruction, build.connectionName);
       const claim = claimedBy.get(target);
       if (!claim) {
         claimedBy.set(target, {
@@ -374896,8 +375126,8 @@ class MaterializationService {
     const refusals = [];
     const cleared = new Map;
     const seen = new Set;
-    for (const graph of compiled.graphs) {
-      for (const persistSource of iterGraphSources(graph, compiled.sources)) {
+    for (const build of compiled.builds) {
+      for (const persistSource of sourcesInBuildOrder(build, compiled.sources)) {
         if (include && !include.has(persistSource.name))
           continue;
         if (getPersistStorageMode() === "off" && declaredStorage(persistSource)) {
@@ -375153,7 +375383,7 @@ class MaterializationService {
     return incrementalRunContext(compiled, run, this.repository);
   }
   async executeInstructedBuild(compiled, environment, instructions, seedEntries, signal, strict = false, owner, buildMetadata, incremental, priorRefusals = [], clearedTiers) {
-    const { graphs, sources, connectionDigests, connections } = compiled;
+    const { builds, sources, connectionDigests, connections } = compiled;
     const index = indexInstructions(instructions);
     const run = {
       compiled,
@@ -375173,17 +375403,17 @@ class MaterializationService {
       builtSources: [],
       writtenTargets: new Map
     };
-    assertNoTableCollisions(graphs, sources, connectionDigests, index);
+    assertNoTableCollisions(builds, sources, connectionDigests, index);
     try {
-      for (const graph of graphs) {
-        const connection = connections.get(graph.connectionName);
+      for (const build of builds) {
+        const connection = connections.get(build.connectionName);
         if (!connection) {
-          throw new BadRequestError(`Connection '${graph.connectionName}' not found`);
+          throw new BadRequestError(`Connection '${build.connectionName}' not found`);
         }
-        for (const persistSource of iterGraphSources(graph, sources)) {
+        for (const persistSource of sourcesInBuildOrder(build, sources)) {
           if (signal.aborted)
             throw new Error("Build cancelled");
-          await this.buildInstructedSource(run, persistSource, graph.connectionName, connection);
+          await this.buildInstructedSource(run, persistSource, build.connectionName, connection);
         }
       }
       if (run.builtSources.length === 0 && run.failedReasons.length > 0) {
@@ -376944,7 +377174,7 @@ function readerSql(uri, format, options = {}) {
   return `read_parquet(${path25})`;
 }
 function assertUnderDataPath(uri, dataPath) {
-  const root = dataPath.replace(/\/+$/, "");
+  const root = stripTrailingSlashes(dataPath);
   const outside = () => new BadRequestError(`The object must sit under the catalog's data path (${root}/).`);
   if (!root || !uri.startsWith(`${root}/`))
     throw outside();

package/package.json

@@ -19,7 +19,7 @@
       "snowflake"
    ],
    "homepage": "https://docs.malloydata.dev/documentation/user_guides/publishing/mcp_agents",
-   "version": "0.10.3",
+   "version": "0.10.5",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"