@malloy-publisher/server 0.10.6 → 0.11.0

package/dist/app/assets/usePackageLinkNavigate-DpGlRKnc.js

@@ -0,0 +1 @@
+import{p,r as u}from"./index-D8JKtZm5.js";import{w as c}from"./usePackageRoute-BUdFd5dP.js";function n(t,a,r){const s=p();return u.useCallback((o,i)=>s(c(o,t,a,r),i),[s,t,a,r])}export{n as u};

package/dist/app/assets/usePackageRoute-BUdFd5dP.js

@@ -0,0 +1 @@
+import{C as f,a9 as m}from"./index-D8JKtZm5.js";const p=/^(latest|[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?)$/,$="latest",l=e=>p.test(e),g=e=>{const n=e.indexOf("/"),o=n===-1?e:e.slice(0,n);if(l(o))return{segment:o,rest:n===-1?"":e.slice(n+1)}},h=e=>e===void 0||e===$?void 0:e,I=(e,n,o)=>`/${encodeURIComponent(e)}/${encodeURIComponent(n)}${o===void 0?"":`/${encodeURIComponent(o)}`}`,E=(e,n,o,t)=>{if(t===void 0)return e;const i=[`/${encodeURIComponent(n)}/${encodeURIComponent(o)}`,`/${n}/${o}`];for(const s of i){if(e!==s&&!e.startsWith(`${s}/`))continue;const r=e.slice(s.length).replace(/^\//,"");return`${I(n,o,t)}${r===""?"":`/${r}`}`}return e};function R(e={}){const n=f(),o=n.environmentName,t=n.packageName,i=n["*"],s=i===void 0?void 0:g(i),{versions:r,isPending:d,isError:v,refetch:u}=m(o??"",t??"",{enabled:e.always===!0||s!==void 0}),a=r.length>0,c=s&&a?s:void 0;return{environmentName:o,packageName:t,versionSegment:c?.segment,versionId:h(c?.segment),path:c?c.rest:i,versioned:a,deciding:s!==void 0&&d,undecided:s!==void 0&&v,retry:u,writable:!a&&!d&&!v}}export{$ as L,I as p,R as u,h as v,E as w};

package/dist/app/index.html

@@ -16,7 +16,7 @@ SPDX-License-Identifier: MIT
          href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
       />
       <title>Malloy Publisher</title>
-     <script type="module" crossorigin src="/assets/index-CGKV9Dxi.js"></script>
+     <script type="module" crossorigin src="/assets/index-D8JKtZm5.js"></script>
      <link rel="stylesheet" crossorigin href="/assets/index-DUqldpo0.css">
    </head>
    <body>

package/dist/instrumentation.mjs

@@ -164831,7 +164831,7 @@ var init_telemetry = __esm(() => {
 });
 
 // package.json
-var version = "0.10.6";
+var version = "0.11.0";
 var init_package = () => {};
 
 // src/version.ts

package/dist/package_load_worker.mjs

@@ -12133,6 +12133,14 @@ function logInternalFailure(summary, error, level = "error") {
     }
   });
 }
+function refuseVersionDelete(packageName, versionId, inService, latest, activeCount) {
+  if (latest === versionId) {
+    throw new PackageVersionError("VERSION_IS_LATEST", `Version ${versionId} is the latest version of package ${packageName}; make another version latest before deleting it.`);
+  }
+  if (inService && activeCount <= 1) {
+    throw new PackageVersionError("VERSION_IS_LAST_ACTIVE", `Version ${versionId} is the last version of package ${packageName} in service; delete its archived versions first, or delete the package.`);
+  }
+}
 function filesystemAccessFailure(error) {
   let current = error;
   for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
@@ -12202,7 +12210,9 @@ function internalErrorToHttpError(error, { log = true, onLogged } = {}) {
     logInternal("Filesystem access refused", error, "warn");
     return httpError(500, `The server cannot access a path it needs (${describeFilesystemAccessFailure(access)}). ` + `Give the user the server runs as access to it.`);
   }
-  if (error instanceof BadRequestError) {
+  if (error instanceof PackageVersionError) {
+    return httpError(error.status, error.message, error.reason);
+  } else if (error instanceof BadRequestError) {
     return httpError(400, error.message);
   } else if (error instanceof ServerConfigurationError) {
     logInternal("Server configuration error", error, "warn");
@@ -12260,6 +12270,8 @@ function internalErrorToHttpError(error, { log = true, onLogged } = {}) {
     return httpError(422, error.message);
   } else if (error instanceof ModelCompilationError) {
     return httpError(424, error.message);
+  } else if (error instanceof VersionFilesMissingError) {
+    return httpError(424, error.message);
   } else if (error instanceof PackageManifestError) {
     return httpError(424, error.message);
   } else if (error instanceof ConnectionError) {
@@ -12311,12 +12323,36 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, StorageDestinationNotFoundError, StorageCatalogNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, PACKAGE_VERSION_ERROR_STATUS, PackageVersionError, FILESYSTEM_ACCESS_DESCRIPTIONS, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, StorageDestinationNotFoundError, StorageCatalogNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, VersionFilesMissingError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
   init_driver_errors();
   init_pg_helpers();
+  PACKAGE_VERSION_ERROR_STATUS = {
+    MANIFEST_VERSION_MISSING: 400,
+    MANIFEST_VERSION_INVALID: 400,
+    VERSION_ID_INVALID: 400,
+    VERSION_NOT_FOUND: 404,
+    VERSION_CONFLICT: 409,
+    PACKAGE_IS_VERSIONED: 409,
+    VERSION_IS_LATEST: 409,
+    VERSION_IS_LAST_ACTIVE: 409,
+    VERSION_BUILDING: 409,
+    VERSION_NOT_LATEST: 400,
+    VERSION_ARCHIVED: 410
+  };
+  PackageVersionError = class PackageVersionError extends Error {
+    reason;
+    constructor(reason, message) {
+      super(message);
+      this.reason = reason;
+      this.name = "PackageVersionError";
+    }
+    get status() {
+      return PACKAGE_VERSION_ERROR_STATUS[this.reason];
+    }
+  };
   FILESYSTEM_ACCESS_DESCRIPTIONS = {
     EACCES: "permission denied",
     EPERM: "operation not permitted",
@@ -12471,6 +12507,12 @@ var init_errors = __esm(() => {
       super(error.message);
     }
   };
+  VersionFilesMissingError = class VersionFilesMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "VersionFilesMissingError";
+    }
+  };
   PackageManifestError = class PackageManifestError extends Error {
     constructor(message) {
       super(message);
@@ -14203,6 +14245,189 @@ var init_package_revision = __esm(() => {
   MANIFEST_AGENTS_MAX_BYTES = 1024 * 1024;
 });
 
+// src/service/package_manifest.ts
+function parsePackageScope(raw) {
+  if (raw === undefined || raw === null) {
+    return "package";
+  }
+  if (PACKAGE_SCOPES.includes(raw)) {
+    return raw;
+  }
+  throw new PackageManifestError(`Invalid "scope" in the package manifest: ${JSON.stringify(raw)}. ` + `Expected "version" or "package" (default "package").`);
+}
+function resolvePackageScope(rootRaw, materializationRaw) {
+  const envelopeRaw = materializationRaw && typeof materializationRaw === "object" ? materializationRaw.scope : undefined;
+  const rootDeclared = rootRaw !== undefined && rootRaw !== null;
+  const envelopeDeclared = envelopeRaw !== undefined && envelopeRaw !== null;
+  const rootScope = parsePackageScope(rootRaw);
+  const envelopeScope = parsePackageScope(envelopeRaw);
+  if (rootDeclared && envelopeDeclared) {
+    if (rootScope !== envelopeScope) {
+      throw new PackageManifestError(`Conflicting "scope" in publisher.json: root "${rootScope}" vs ` + `"materialization.scope" "${envelopeScope}". The package cannot ` + `load until they agree. Edit "materialization": { "scope": ... } ` + `to the value you want and delete the root-level "scope" (the ` + `server rewrites both homes on its next manifest write).`);
+    }
+    return { scope: envelopeScope, warnings: [] };
+  }
+  if (rootDeclared) {
+    return { scope: rootScope, warnings: [SCOPE_ROOT_DEPRECATION] };
+  }
+  return { scope: envelopeScope, warnings: [] };
+}
+function resolvePackageQueryMetadata(rootRaw, materializationRaw) {
+  const envelopeRaw = materializationRaw && typeof materializationRaw === "object" ? materializationRaw.queryMetadata : undefined;
+  const rootDeclared = rootRaw !== undefined && rootRaw !== null;
+  const envelopeDeclared = envelopeRaw !== undefined && envelopeRaw !== null;
+  if (rootDeclared && envelopeDeclared) {
+    if (sameQueryMetadataBag(rootRaw, envelopeRaw)) {
+      return { queryMetadata: rootRaw, home: "root", warnings: [] };
+    }
+    return {
+      queryMetadata: rootRaw,
+      home: "root",
+      warnings: [QUERY_METADATA_CONFLICT]
+    };
+  }
+  if (envelopeDeclared) {
+    return {
+      queryMetadata: envelopeRaw,
+      home: "envelope",
+      warnings: [QUERY_METADATA_ENVELOPE_DEPRECATION]
+    };
+  }
+  return { queryMetadata: rootRaw, home: "root", warnings: [] };
+}
+function sameQueryMetadataBag(a, b) {
+  return keySortedJson(a) === keySortedJson(b);
+}
+function keySortedJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "undefined";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(keySortedJson).join(",")}]`;
+  }
+  const entries = Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  return `{${entries.map(([name, nested]) => `${JSON.stringify(name)}:${keySortedJson(nested)}`).join(",")}}`;
+}
+function parseFreshness(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const { window: window2, fallback } = raw;
+  const freshness = {};
+  if (typeof window2 === "string") {
+    freshness.window = window2;
+  }
+  if (typeof fallback === "string" && FRESHNESS_FALLBACKS.includes(fallback)) {
+    freshness.fallback = fallback;
+  }
+  return freshness;
+}
+function parseQueryMetadata(raw, label = QUERY_METADATA_HOME_LABELS.envelope) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { metadata: null, warnings: [] };
+  }
+  const out = {};
+  const warnings = [];
+  for (const [name, value] of Object.entries(raw)) {
+    if (typeof value === "string") {
+      out[name] = value;
+    } else {
+      warnings.push(`${label}: property '${name}' must be a ` + `string (got ${value === null ? "null" : typeof value}); it is ` + `not attached to any statement`);
+    }
+  }
+  return {
+    metadata: Object.keys(out).length > 0 ? out : null,
+    warnings
+  };
+}
+function parsePackageMaterialization(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const { schedule, freshness, queryMetadata } = raw;
+  return {
+    schedule: typeof schedule === "string" ? schedule : null,
+    freshness: parseFreshness(freshness),
+    queryMetadata: parseQueryMetadata(queryMetadata).metadata
+  };
+}
+function materializationWithQueryMetadata(parsed, queryMetadataRaw) {
+  const queryMetadata = parseQueryMetadata(queryMetadataRaw).metadata;
+  if (!parsed && !queryMetadata)
+    return null;
+  return {
+    schedule: parsed?.schedule ?? null,
+    freshness: parsed?.freshness ?? null,
+    queryMetadata
+  };
+}
+function queryMetadataParseWarnings(raw, home = "root") {
+  return parseQueryMetadata(raw, QUERY_METADATA_HOME_LABELS[home]).warnings;
+}
+function resolveExplores(input) {
+  const { declaredExplores, declaredQueryableSources, modelPaths } = input;
+  const reportPaths = input.reportPaths ?? new Set;
+  const hasIndexModel = modelPaths.includes(INDEX_MODEL_NAME);
+  const warnings = [];
+  if (declaredExplores !== undefined && !(Array.isArray(declaredExplores) && declaredExplores.every((entry) => typeof entry === "string"))) {
+    throw new PackageManifestError(`Invalid "explores" in publisher.json: it must be a list of file ` + `names, but is ${JSON.stringify(declaredExplores)}. The package ` + `was not loaded. Fix: delete "explores" and add an ` + `${INDEX_MODEL_NAME}.`);
+  }
+  const declared = Array.isArray(declaredExplores) ? declaredExplores.map((entry) => normalizeModelPath(entry)) : undefined;
+  if (declaredQueryableSources !== undefined && declaredQueryableSources !== "all") {
+    warnings.push(QUERYABLE_SOURCES_DEPRECATION);
+  }
+  if (declared !== undefined) {
+    if (declared.length === 0) {
+      warnings.push(hasIndexModel ? EXPLORES_EMPTY_SUPPRESSES_CONVENTION : EXPLORES_EMPTY_IS_UNCURATED);
+    } else {
+      warnings.push(exploresDeprecation(declared, hasIndexModel, reportPaths));
+    }
+    if (hasIndexModel && declared.length > 0 && !declared.includes(INDEX_MODEL_NAME)) {
+      warnings.push(EXPLORES_OMITS_INDEX_MODEL);
+    }
+    return { explores: declared, warnings };
+  }
+  if (!hasIndexModel) {
+    for (const modelPath of modelPaths) {
+      if (!modelPath.includes("/") && modelPath.toLowerCase() === INDEX_MODEL_NAME) {
+        warnings.push(`${modelPath} is ignored: only a root file named exactly ` + `${INDEX_MODEL_NAME} decides what is published. Fix: rename ` + `it to ${INDEX_MODEL_NAME}.`);
+      }
+    }
+    return { explores: undefined, warnings };
+  }
+  return { explores: [INDEX_MODEL_NAME], warnings };
+}
+function listFiles(files) {
+  return files.length <= 1 ? files[0] ?? "" : `${files.slice(0, -1).join(", ")} and ${files[files.length - 1]}`;
+}
+function exploresDeprecation(declared, hasIndexModel, reportPaths) {
+  const lead = `"explores" in publisher.json is deprecated.`;
+  const files = declared.filter((entry) => entry !== INDEX_MODEL_NAME && !reportPaths.has(entry));
+  if (files.length > 0) {
+    return hasIndexModel ? `${lead} Fix: import ${listFiles(files)} into ${INDEX_MODEL_NAME}, ` + `export the sources you publish from it, then delete "explores".` : `${lead} Fix: add an ${INDEX_MODEL_NAME} at the package root that ` + `imports ${listFiles(files)} and exports the sources you want to ` + `publish, then delete "explores".`;
+  }
+  if (declared.includes(INDEX_MODEL_NAME)) {
+    return `${lead} ${INDEX_MODEL_NAME} already publishes the same thing. ` + `Fix: delete "explores".`;
+  }
+  return hasIndexModel ? `${lead} Fix: delete "explores", so ${INDEX_MODEL_NAME} decides what is published.` : `${lead} Fix: add an ${INDEX_MODEL_NAME} at the package root that ` + `exports the sources you want to publish, then delete "explores".`;
+}
+var FRESHNESS_FALLBACKS, PACKAGE_SCOPES, SCOPE_ROOT_DEPRECATION, QUERY_METADATA_HOME_LABELS, QUERY_METADATA_ENVELOPE_DEPRECATION, QUERY_METADATA_CONFLICT, EXPLORES_OMITS_INDEX_MODEL, EXPLORES_EMPTY_SUPPRESSES_CONVENTION, EXPLORES_EMPTY_IS_UNCURATED = `"explores": [] in publisher.json does nothing. Fix: delete it.`, QUERYABLE_SOURCES_DEPRECATION = `"queryableSources" in publisher.json does nothing. Fix: delete it.`;
+var init_package_manifest = __esm(() => {
+  init_constants();
+  init_errors();
+  FRESHNESS_FALLBACKS = ["live", "stale_ok", "fail"];
+  PACKAGE_SCOPES = ["version", "package"];
+  SCOPE_ROOT_DEPRECATION = `"scope" at the manifest root is deprecated: declare it as ` + `"materialization": { "scope": ... } alongside the other build knobs. The ` + `root form still works and will be removed in a future release; until then ` + `the server keeps both homes in sync when it writes the manifest, so an ` + `older publisher still reads the right value.`;
+  QUERY_METADATA_HOME_LABELS = {
+    root: "queryMetadata",
+    envelope: "materialization.queryMetadata"
+  };
+  QUERY_METADATA_ENVELOPE_DEPRECATION = `"queryMetadata" inside "materialization" is deprecated: declare it at the ` + `manifest root instead. It is not a build setting — the properties ride ` + `every statement the package's sources issue, including served queries. The ` + `enveloped form still works and will be removed in a future release; until ` + `then the server keeps both homes in sync when it writes the manifest, so an ` + `older publisher still reads the right value.`;
+  QUERY_METADATA_CONFLICT = `Conflicting "queryMetadata" in publisher.json: the manifest root and ` + `"materialization.queryMetadata" declare different bags, and the root wins. ` + `Delete "materialization": { "queryMetadata": ... } — the server rewrites ` + `both homes on its next manifest write, so an older publisher still reads ` + `the right value.`;
+  EXPLORES_OMITS_INDEX_MODEL = `${INDEX_MODEL_NAME} is ignored because "explores" in publisher.json ` + `doesn't list it. Fix: delete "explores" to publish what ` + `${INDEX_MODEL_NAME} exports, or rename ${INDEX_MODEL_NAME} (and any import ` + `of it) if it isn't meant to decide what is published.`;
+  EXPLORES_EMPTY_SUPPRESSES_CONVENTION = `"explores" in publisher.json is deprecated. Here it stops ` + `${INDEX_MODEL_NAME} from limiting what this package publishes. Fix: to ` + `publish everything, rename ${INDEX_MODEL_NAME}, point any import of it at ` + `the new name, then delete "explores".`;
+});
+
 // src/service/package_retrieval.ts
 import { createHash as createHash2 } from "crypto";
 import * as fs2 from "fs";
@@ -23652,6 +23877,11 @@ init_gate_classification();
 init_gate_dimension();
 init_model_info();
 init_package_revision();
+init_package_manifest();
+init_package_retrieval();
+init_source_extraction();
+init_given();
+init_utils();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
 import {
   contextOverlay,
@@ -23666,194 +23896,6 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 
-// src/service/package_manifest.ts
-init_constants();
-init_errors();
-var FRESHNESS_FALLBACKS = ["live", "stale_ok", "fail"];
-var PACKAGE_SCOPES = ["version", "package"];
-function parsePackageScope(raw) {
-  if (raw === undefined || raw === null) {
-    return "package";
-  }
-  if (PACKAGE_SCOPES.includes(raw)) {
-    return raw;
-  }
-  throw new PackageManifestError(`Invalid "scope" in the package manifest: ${JSON.stringify(raw)}. ` + `Expected "version" or "package" (default "package").`);
-}
-function resolvePackageScope(rootRaw, materializationRaw) {
-  const envelopeRaw = materializationRaw && typeof materializationRaw === "object" ? materializationRaw.scope : undefined;
-  const rootDeclared = rootRaw !== undefined && rootRaw !== null;
-  const envelopeDeclared = envelopeRaw !== undefined && envelopeRaw !== null;
-  const rootScope = parsePackageScope(rootRaw);
-  const envelopeScope = parsePackageScope(envelopeRaw);
-  if (rootDeclared && envelopeDeclared) {
-    if (rootScope !== envelopeScope) {
-      throw new PackageManifestError(`Conflicting "scope" in publisher.json: root "${rootScope}" vs ` + `"materialization.scope" "${envelopeScope}". The package cannot ` + `load until they agree. Edit "materialization": { "scope": ... } ` + `to the value you want and delete the root-level "scope" (the ` + `server rewrites both homes on its next manifest write).`);
-    }
-    return { scope: envelopeScope, warnings: [] };
-  }
-  if (rootDeclared) {
-    return { scope: rootScope, warnings: [SCOPE_ROOT_DEPRECATION] };
-  }
-  return { scope: envelopeScope, warnings: [] };
-}
-var SCOPE_ROOT_DEPRECATION = `"scope" at the manifest root is deprecated: declare it as ` + `"materialization": { "scope": ... } alongside the other build knobs. The ` + `root form still works and will be removed in a future release; until then ` + `the server keeps both homes in sync when it writes the manifest, so an ` + `older publisher still reads the right value.`;
-function resolvePackageQueryMetadata(rootRaw, materializationRaw) {
-  const envelopeRaw = materializationRaw && typeof materializationRaw === "object" ? materializationRaw.queryMetadata : undefined;
-  const rootDeclared = rootRaw !== undefined && rootRaw !== null;
-  const envelopeDeclared = envelopeRaw !== undefined && envelopeRaw !== null;
-  if (rootDeclared && envelopeDeclared) {
-    if (sameQueryMetadataBag(rootRaw, envelopeRaw)) {
-      return { queryMetadata: rootRaw, home: "root", warnings: [] };
-    }
-    return {
-      queryMetadata: rootRaw,
-      home: "root",
-      warnings: [QUERY_METADATA_CONFLICT]
-    };
-  }
-  if (envelopeDeclared) {
-    return {
-      queryMetadata: envelopeRaw,
-      home: "envelope",
-      warnings: [QUERY_METADATA_ENVELOPE_DEPRECATION]
-    };
-  }
-  return { queryMetadata: rootRaw, home: "root", warnings: [] };
-}
-function sameQueryMetadataBag(a, b) {
-  return keySortedJson(a) === keySortedJson(b);
-}
-function keySortedJson(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value) ?? "undefined";
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(keySortedJson).join(",")}]`;
-  }
-  const entries = Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
-  return `{${entries.map(([name, nested]) => `${JSON.stringify(name)}:${keySortedJson(nested)}`).join(",")}}`;
-}
-var QUERY_METADATA_HOME_LABELS = {
-  root: "queryMetadata",
-  envelope: "materialization.queryMetadata"
-};
-var QUERY_METADATA_ENVELOPE_DEPRECATION = `"queryMetadata" inside "materialization" is deprecated: declare it at the ` + `manifest root instead. It is not a build setting — the properties ride ` + `every statement the package's sources issue, including served queries. The ` + `enveloped form still works and will be removed in a future release; until ` + `then the server keeps both homes in sync when it writes the manifest, so an ` + `older publisher still reads the right value.`;
-var QUERY_METADATA_CONFLICT = `Conflicting "queryMetadata" in publisher.json: the manifest root and ` + `"materialization.queryMetadata" declare different bags, and the root wins. ` + `Delete "materialization": { "queryMetadata": ... } — the server rewrites ` + `both homes on its next manifest write, so an older publisher still reads ` + `the right value.`;
-function parseFreshness(raw) {
-  if (!raw || typeof raw !== "object") {
-    return null;
-  }
-  const { window: window2, fallback } = raw;
-  const freshness = {};
-  if (typeof window2 === "string") {
-    freshness.window = window2;
-  }
-  if (typeof fallback === "string" && FRESHNESS_FALLBACKS.includes(fallback)) {
-    freshness.fallback = fallback;
-  }
-  return freshness;
-}
-function parseQueryMetadata(raw, label = QUERY_METADATA_HOME_LABELS.envelope) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return { metadata: null, warnings: [] };
-  }
-  const out = {};
-  const warnings = [];
-  for (const [name, value] of Object.entries(raw)) {
-    if (typeof value === "string") {
-      out[name] = value;
-    } else {
-      warnings.push(`${label}: property '${name}' must be a ` + `string (got ${value === null ? "null" : typeof value}); it is ` + `not attached to any statement`);
-    }
-  }
-  return {
-    metadata: Object.keys(out).length > 0 ? out : null,
-    warnings
-  };
-}
-function parsePackageMaterialization(raw) {
-  if (!raw || typeof raw !== "object") {
-    return null;
-  }
-  const { schedule, freshness, queryMetadata } = raw;
-  return {
-    schedule: typeof schedule === "string" ? schedule : null,
-    freshness: parseFreshness(freshness),
-    queryMetadata: parseQueryMetadata(queryMetadata).metadata
-  };
-}
-function materializationWithQueryMetadata(parsed, queryMetadataRaw) {
-  const queryMetadata = parseQueryMetadata(queryMetadataRaw).metadata;
-  if (!parsed && !queryMetadata)
-    return null;
-  return {
-    schedule: parsed?.schedule ?? null,
-    freshness: parsed?.freshness ?? null,
-    queryMetadata
-  };
-}
-function queryMetadataParseWarnings(raw, home = "root") {
-  return parseQueryMetadata(raw, QUERY_METADATA_HOME_LABELS[home]).warnings;
-}
-function resolveExplores(input) {
-  const { declaredExplores, declaredQueryableSources, modelPaths } = input;
-  const reportPaths = input.reportPaths ?? new Set;
-  const hasIndexModel = modelPaths.includes(INDEX_MODEL_NAME);
-  const warnings = [];
-  if (declaredExplores !== undefined && !(Array.isArray(declaredExplores) && declaredExplores.every((entry) => typeof entry === "string"))) {
-    throw new PackageManifestError(`Invalid "explores" in publisher.json: it must be a list of file ` + `names, but is ${JSON.stringify(declaredExplores)}. The package ` + `was not loaded. Fix: delete "explores" and add an ` + `${INDEX_MODEL_NAME}.`);
-  }
-  const declared = Array.isArray(declaredExplores) ? declaredExplores.map((entry) => normalizeModelPath(entry)) : undefined;
-  if (declaredQueryableSources !== undefined && declaredQueryableSources !== "all") {
-    warnings.push(QUERYABLE_SOURCES_DEPRECATION);
-  }
-  if (declared !== undefined) {
-    if (declared.length === 0) {
-      warnings.push(hasIndexModel ? EXPLORES_EMPTY_SUPPRESSES_CONVENTION : EXPLORES_EMPTY_IS_UNCURATED);
-    } else {
-      warnings.push(exploresDeprecation(declared, hasIndexModel, reportPaths));
-    }
-    if (hasIndexModel && declared.length > 0 && !declared.includes(INDEX_MODEL_NAME)) {
-      warnings.push(EXPLORES_OMITS_INDEX_MODEL);
-    }
-    return { explores: declared, warnings };
-  }
-  if (!hasIndexModel) {
-    for (const modelPath of modelPaths) {
-      if (!modelPath.includes("/") && modelPath.toLowerCase() === INDEX_MODEL_NAME) {
-        warnings.push(`${modelPath} is ignored: only a root file named exactly ` + `${INDEX_MODEL_NAME} decides what is published. Fix: rename ` + `it to ${INDEX_MODEL_NAME}.`);
-      }
-    }
-    return { explores: undefined, warnings };
-  }
-  return { explores: [INDEX_MODEL_NAME], warnings };
-}
-function listFiles(files) {
-  return files.length <= 1 ? files[0] ?? "" : `${files.slice(0, -1).join(", ")} and ${files[files.length - 1]}`;
-}
-function exploresDeprecation(declared, hasIndexModel, reportPaths) {
-  const lead = `"explores" in publisher.json is deprecated.`;
-  const files = declared.filter((entry) => entry !== INDEX_MODEL_NAME && !reportPaths.has(entry));
-  if (files.length > 0) {
-    return hasIndexModel ? `${lead} Fix: import ${listFiles(files)} into ${INDEX_MODEL_NAME}, ` + `export the sources you publish from it, then delete "explores".` : `${lead} Fix: add an ${INDEX_MODEL_NAME} at the package root that ` + `imports ${listFiles(files)} and exports the sources you want to ` + `publish, then delete "explores".`;
-  }
-  if (declared.includes(INDEX_MODEL_NAME)) {
-    return `${lead} ${INDEX_MODEL_NAME} already publishes the same thing. ` + `Fix: delete "explores".`;
-  }
-  return hasIndexModel ? `${lead} Fix: delete "explores", so ${INDEX_MODEL_NAME} decides what is published.` : `${lead} Fix: add an ${INDEX_MODEL_NAME} at the package root that ` + `exports the sources you want to publish, then delete "explores".`;
-}
-var EXPLORES_OMITS_INDEX_MODEL = `${INDEX_MODEL_NAME} is ignored because "explores" in publisher.json ` + `doesn't list it. Fix: delete "explores" to publish what ` + `${INDEX_MODEL_NAME} exports, or rename ${INDEX_MODEL_NAME} (and any import ` + `of it) if it isn't meant to decide what is published.`;
-var EXPLORES_EMPTY_SUPPRESSES_CONVENTION = `"explores" in publisher.json is deprecated. Here it stops ` + `${INDEX_MODEL_NAME} from limiting what this package publishes. Fix: to ` + `publish everything, rename ${INDEX_MODEL_NAME}, point any import of it at ` + `the new name, then delete "explores".`;
-var EXPLORES_EMPTY_IS_UNCURATED = `"explores": [] in publisher.json does nothing. Fix: delete it.`;
-var QUERYABLE_SOURCES_DEPRECATION = `"queryableSources" in publisher.json does nothing. Fix: delete it.`;
-
-// src/package_load/package_load_worker.ts
-init_package_retrieval();
-init_source_extraction();
-init_given();
-init_utils();
-
 // src/package_load/rpc_wait_accountant.ts
 class RpcWaitAccountant {
   now;

package/dist/runtime/publisher.js

@@ -9,7 +9,9 @@
 //   - Publisher.query(model, malloy, opts?)     → Promise<rows[]>
 //   - Publisher.queryFull(model, malloy, opts?) → Promise<MalloyResult>  (envelope for <malloy-render>)
 //       opts: { environment?, package?, sourceName?, queryName?, filterParams?,
-//               bypassFilters?, givens? }. givens is a name→value map bound as
+//               bypassFilters?, givens?, versionId? }. versionId names a published
+//               version; a page opened with `?versionId=` queries its own
+//               package at that version by default. givens is a name→value map bound as
 //               Malloy given: runtime parameters for this query (safe parameterization,
 //               not string interpolation) — see the malloy-html-data-apps skill (reference/runtime.md).
 //   - Publisher.embed(selector, { src, height?, token? })
@@ -68,6 +70,53 @@
       return bearerToken ? { Authorization: "Bearer " + bearerToken } : {};
    }
 
+   // --- Published-version pinning -----------------------------------------
+   // A page opened at a published version (`?versionId=` in its URL) queries
+   // that version, so it keeps answering from the models it shipped with after
+   // the package's `latest` moves on. Only when that version is one the
+   // package has: a proxy may forward a page's query string unchanged, with a
+   // `versionId` of its own, and such a page queries `latest`, as the server
+   // serves its files. One read of the package at the page's version tells.
+   function pageVersionParam() {
+      // Read by hand, not with URLSearchParams, so the runtime also loads where
+      // that is not defined. `+` in a query string is a space.
+      var match = (location.search || "").match(/[?&]versionId=([^&#]*)/);
+      return match && match[1]
+         ? safeDecode(match[1].replace(/\+/g, " "))
+         : undefined;
+   }
+   var pageVersion = pageVersionParam();
+   var pagePin = null;
+   function pinnedVersion() {
+      if (!pageVersion || !ctx.environment || !ctx.package) {
+         return Promise.resolve(undefined);
+      }
+      if (!pagePin) {
+         pagePin = fetch(
+            apiBase +
+               "/environments/" +
+               encodeURIComponent(ctx.environment) +
+               "/packages/" +
+               encodeURIComponent(ctx.package) +
+               "?versionId=" +
+               encodeURIComponent(pageVersion),
+            { credentials: "include", headers: authHeaders() },
+         )
+            .then(function (res) {
+               return res.ok ? res.json() : null;
+            })
+            .then(function (pkg) {
+               return pkg && pkg.versionId === pageVersion
+                  ? pageVersion
+                  : undefined;
+            })
+            .catch(function () {
+               return undefined;
+            });
+      }
+      return pagePin;
+   }
+
    // --- Query helpers -----------------------------------------------------
    function resolveTarget(opts) {
       var env = (opts && opts.environment) || ctx.environment;
@@ -106,6 +155,14 @@
       if (opts.filterParams) body.filterParams = opts.filterParams;
       if (opts.bypassFilters) body.bypassFilters = true;
       if (opts.givens) body.givens = opts.givens;
+      // The page's own version applies only to its own package; a query aimed
+      // elsewhere gets that package's latest unless it names one.
+      var versionId =
+         opts.versionId ||
+         (target.env === ctx.environment && target.pkg === ctx.package
+            ? await pinnedVersion()
+            : undefined);
+      if (versionId) body.versionId = versionId;
 
       var headers = Object.assign(
          { "content-type": "application/json" },