@malloy-publisher/server 0.2.3 → 0.2.5

package/dist/package_load_worker.mjs

@@ -2416,7 +2416,7 @@ function httpError(code, message) {
     }
   };
 }
-var NotImplementedError, BadRequestError, InvalidArgumentError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, MaterializationEligibilityError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var NotImplementedError, BadRequestError, InvalidArgumentError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, ConnectionNotFoundError, ConnectionError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, MaterializationEligibilityError, PublisherConfigError, FrozenConfigError, AccessDeniedError, NotQueryableError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   NotImplementedError = class NotImplementedError extends Error {
@@ -2489,6 +2489,13 @@ var init_errors = __esm(() => {
       this.reason = error.reason;
     }
   };
+  PublisherConfigError = class PublisherConfigError extends Error {
+    constructor(configName, cause) {
+      super(`Could not read ${configName}: ${cause instanceof Error ? cause.message : String(cause)}. Fix the file, or move it aside to fall back to the bundled default.`);
+      this.name = "PublisherConfigError";
+      this.cause = cause;
+    }
+  };
   FrozenConfigError = class FrozenConfigError extends Error {
     constructor(message = `Publisher config can't be updated when ${PUBLISHER_CONFIG_NAME} has { "frozenConfig": true }`) {
       super(message);
@@ -13352,6 +13359,79 @@ var init_data_styles = __esm(() => {
   init_logger();
 });
 
+// src/service/annotations.ts
+import { Annotations } from "@malloydata/malloy";
+function isReservedRoute(route) {
+  return route === "" || !/[\p{L}\p{N}]/u.test(route);
+}
+function ownModelAnnotations(modelDef) {
+  return foldModelAnnotations(modelDef, (id) => id === modelDef.modelID || id.startsWith("internal://"));
+}
+function modelAnnotations(modelDef) {
+  return foldModelAnnotations(modelDef, () => true);
+}
+function foldModelAnnotations(modelDef, admits) {
+  const registry = modelDef.modelAnnotations ?? {};
+  const visited = new Set;
+  const order = [];
+  const visit = (id) => {
+    if (!admits(id))
+      return;
+    if (visited.has(id))
+      return;
+    visited.add(id);
+    const entry = registry[id];
+    if (!entry)
+      return;
+    for (const dep of entry.inheritsFrom)
+      visit(dep);
+    order.push(id);
+  };
+  visit(modelDef.modelID);
+  let folded;
+  for (const id of order) {
+    const own = registry[id].ownNotes;
+    if (!own.notes?.length && !own.blockNotes?.length)
+      continue;
+    folded = {
+      notes: own.notes,
+      blockNotes: own.blockNotes,
+      inherits: folded
+    };
+  }
+  return folded ?? {};
+}
+function ownModelNotes(modelDef) {
+  const registry = modelDef.modelAnnotations ?? {};
+  const isSameDocument = (id) => id === modelDef.modelID || id.startsWith("internal://");
+  const seen = new Set;
+  const texts = [];
+  const visit = (id) => {
+    if (seen.has(id) || !isSameDocument(id))
+      return;
+    seen.add(id);
+    const entry = registry[id];
+    if (!entry)
+      return;
+    for (const dep of entry.inheritsFrom)
+      visit(dep);
+    texts.push(...ownLevelNoteTexts(entry.ownNotes));
+  };
+  visit(modelDef.modelID);
+  return texts;
+}
+function annotationTexts(annote) {
+  const texts = new Annotations(annote).texts();
+  return texts.length > 0 ? texts : undefined;
+}
+function ownLevelNoteTexts(annote) {
+  return ownLevelNotes(annote).map((note) => note.text);
+}
+function ownLevelNotes(annote) {
+  return [...annote?.blockNotes ?? [], ...annote?.notes ?? []];
+}
+var init_annotations = () => {};
+
 // src/service/gate_dimension.ts
 import {
   isJoined,
@@ -13443,78 +13523,590 @@ var init_gate_dimension = __esm(() => {
   init_errors();
 });
 
-// src/service/annotations.ts
-import { Annotations } from "@malloydata/malloy";
-function isReservedRoute(route) {
-  return route === "" || !/[\p{L}\p{N}]/u.test(route);
+// src/service/gate_registry_walk.ts
+import { isSourceDef as isSourceDef2 } from "@malloydata/malloy";
+function resolveDeclaredSource(struct, modelDef) {
+  if (!modelDef)
+    return { kind: "none" };
+  let sawBrokenEntry = false;
+  for (const id of [struct.referenceID, struct.sourceID]) {
+    const entry = id ? modelDef.sourceRegistry?.[id]?.entry : undefined;
+    if (!entry)
+      continue;
+    const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
+    if (declared === struct)
+      continue;
+    if (!declared || !isSourceDef2(declared)) {
+      sawBrokenEntry = true;
+      continue;
+    }
+    return { kind: "resolved", source: declared };
+  }
+  return sawBrokenEntry ? { kind: "unresolvable" } : { kind: "none" };
 }
-function ownModelAnnotations(modelDef) {
-  return foldModelAnnotations(modelDef, (id) => id === modelDef.modelID || id.startsWith("internal://"));
+function ancestorGateExprs(struct, modelDef, seen = new Set) {
+  let inherited = struct.annotations?.inherits;
+  for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+    const exprs2 = collectAuthorizeExprs(ownLevelNoteTexts(inherited));
+    if (exprs2.length > 0)
+      return exprs2;
+    inherited = inherited.inherits;
+  }
+  if (inherited)
+    return ["false"];
+  seen.add(struct);
+  if (seen.size > ANCESTOR_WALK_MAX_DEPTH)
+    return ["false"];
+  const declared = resolveDeclaredSource(struct, modelDef);
+  if (declared.kind === "unresolvable")
+    return ["false"];
+  if (declared.kind === "none" || seen.has(declared.source))
+    return [];
+  const exprs = collectAuthorizeExprs(ownLevelNoteTexts(declared.source.annotations));
+  return exprs.length > 0 ? exprs : ancestorGateExprs(declared.source, modelDef, seen);
 }
-function modelAnnotations(modelDef) {
-  return foldModelAnnotations(modelDef, () => true);
+function resolveQuerySourceBase(struct, modelDef) {
+  const duck = struct;
+  if (duck.type !== "query_source")
+    return;
+  const ref = duck.query?.structRef;
+  const base = typeof ref === "string" ? modelDef?.contents[ref] : ref;
+  return base && isSourceDef2(base) ? base : undefined;
 }
-function foldModelAnnotations(modelDef, admits) {
-  const registry = modelDef.modelAnnotations ?? {};
-  const visited = new Set;
-  const order = [];
-  const visit = (id) => {
-    if (!admits(id))
-      return;
-    if (visited.has(id))
-      return;
-    visited.add(id);
-    const entry = registry[id];
-    if (!entry)
-      return;
-    for (const dep of entry.inheritsFrom)
-      visit(dep);
-    order.push(id);
-  };
-  visit(modelDef.modelID);
-  let folded;
-  for (const id of order) {
-    const own = registry[id].ownNotes;
-    if (!own.notes?.length && !own.blockNotes?.length)
+function resolveCompositeResolvedBase(struct) {
+  const duck = struct;
+  return duck.type === "query_source" ? duck.query?.compositeResolvedSourceDef : undefined;
+}
+function effectiveAncestorGateExprs(struct, modelDef, seen = new Set) {
+  const direct = ancestorGateExprs(struct, modelDef, new Set(seen));
+  if (direct.length > 0)
+    return [direct];
+  if (seen.has(struct))
+    return [];
+  seen.add(struct);
+  const groups = [];
+  const base = resolveQuerySourceBase(struct, modelDef);
+  if (!base) {
+    const duck = struct;
+    if (duck.type === "query_source")
+      groups.push(["false"]);
+  } else if (!seen.has(base)) {
+    const ownExprs = collectAuthorizeExprs(ownLevelNoteTexts(base.annotations));
+    groups.push(...ownExprs.length > 0 ? [ownExprs] : effectiveAncestorGateExprs(base, modelDef, seen));
+  }
+  const composite = resolveCompositeResolvedBase(struct);
+  if (composite && !seen.has(composite)) {
+    const parentOwnNotes = base ? ownLevelNotes(base.annotations) : [];
+    const compositeOwnNotes = ownLevelNotes(composite.annotations).filter((note) => !parentOwnNotes.includes(note));
+    const compositeOwn = collectAuthorizeExprs(compositeOwnNotes.map((note) => note.text));
+    groups.push(...compositeOwn.length > 0 ? [compositeOwn] : effectiveAncestorGateExprs(composite, modelDef, seen));
+  }
+  return groups;
+}
+function derivedStructsReachable(roots, modelDef) {
+  const seen = new Set(roots);
+  const found = [];
+  const worklist = [...roots];
+  for (let i = 0;i < worklist.length; i++) {
+    const struct = worklist[i];
+    for (const next of [
+      resolveQuerySourceBase(struct, modelDef),
+      resolveCompositeResolvedBase(struct)
+    ]) {
+      if (!next || seen.has(next))
+        continue;
+      seen.add(next);
+      found.push(next);
+      worklist.push(next);
+    }
+  }
+  return found;
+}
+var ANCESTOR_WALK_MAX_DEPTH = 32;
+var init_gate_registry_walk = __esm(() => {
+  init_annotations();
+  init_authorize();
+});
+
+// src/service/partition_annotation.ts
+import { payloadOf as payloadOf2, routeOf as routeOf2 } from "@malloydata/malloy";
+function noteRoute2(text) {
+  return routeOf2({ value: text.trimStart() });
+}
+function containsPartitionAnnotationTag(texts) {
+  return texts.some((text) => noteRoute2(text) === PARTITION_ROUTE);
+}
+function reachesPartitionTagBelow(node, seen = new WeakSet, depth = 0) {
+  if (depth > MAX_PARTITION_IR_WALK_DEPTH) {
+    throw new Error("partition-marker IR walk exceeded max depth");
+  }
+  if (node === null || typeof node !== "object")
+    return false;
+  if (seen.has(node))
+    return false;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    return node.some((item) => reachesPartitionTagBelow(item, seen, depth + 1));
+  }
+  const record = node;
+  if (depth > 0 && record.join !== undefined)
+    return false;
+  if (depth > 0) {
+    for (const key of ["blockNotes", "notes"]) {
+      const arr = record[key];
+      if (!Array.isArray(arr))
+        continue;
+      const texts = arr.map((n) => typeof n === "string" ? n : n && typeof n === "object" && typeof n.text === "string" ? n.text : undefined).filter((text) => text !== undefined);
+      if (containsPartitionAnnotationTag(texts))
+        return true;
+    }
+  }
+  return Object.entries(record).some(([key, value]) => depth === 0 && key === "annotations" ? false : reachesPartitionTagBelow(value, seen, depth + 1));
+}
+function notePayload2(text) {
+  return payloadOf2({ value: text.trimStart() }) ?? "";
+}
+function rejectionMessage(sourceName, body, detail) {
+  return `Source "${sourceName}" declares \`#(partition) ${body}\`: ${detail} ` + `#(partition) only accepts \`<column> = $GIVEN\`, where <column> is a ` + `single field or a dotted join path.`;
+}
+function reject(sourceName, body, cause, detail) {
+  throw new PartitionAnnotationError(cause, rejectionMessage(sourceName, body, detail));
+}
+function parsePartitionAnnotation(sourceName, annotationText) {
+  if (noteRoute2(annotationText) !== PARTITION_ROUTE)
+    return null;
+  const body = notePayload2(annotationText).trim();
+  if (body.length === 0) {
+    reject(sourceName, body, "empty_body", "the expression body is empty.");
+  }
+  if (COMPOUND_BOOLEAN_RE.test(body)) {
+    reject(sourceName, body, "compound_boolean", "a compound boolean (`and`/`or`/`not`) is not allowed — declare one " + "`#(partition)` marker per column.");
+  }
+  if (IN_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "in_operator", "the `in` operator is not allowed.");
+  }
+  if (NEGATED_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "negated_operator", "`!=` is not allowed.");
+  }
+  if (COMPARISON_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "comparison_operator", "only `=` is allowed, not `<`/`>`/`<=`/`>=`.");
+  }
+  const eq = body.indexOf("=");
+  if (eq === -1) {
+    reject(sourceName, body, "malformed_body", "no `=` was found.");
+  }
+  const left = body.slice(0, eq).trim();
+  const right = body.slice(eq + 1).trim();
+  if (!FIELD_PATH_RE.test(left)) {
+    reject(sourceName, body, "left_not_field_path", `\`${left}\` is not a field path — the left side must be a single ` + "column or a dotted join path, not an expression.");
+  }
+  const givenMatch = GIVEN_REF_RE.exec(right);
+  if (!givenMatch) {
+    reject(sourceName, body, "missing_given_reference", `\`${right}\` is not a given reference — the right side must be ` + "`$NAME`.");
+  }
+  return { column: left, given: givenMatch[1] };
+}
+function collectPartitionPairs(sourceName, annotationTexts2) {
+  const pairs = [];
+  const seenGivens = new Map;
+  for (const text of annotationTexts2) {
+    const pair = parsePartitionAnnotation(sourceName, text);
+    if (pair === null)
       continue;
-    folded = {
-      notes: own.notes,
-      blockNotes: own.blockNotes,
-      inherits: folded
-    };
+    const priorColumn = seenGivens.get(pair.given);
+    if (priorColumn !== undefined) {
+      throw new PartitionAnnotationError("duplicate_given", `Source "${sourceName}" declares \`#(partition)\` on both ` + `\`${priorColumn}\` and \`${pair.column}\` for the same given ` + `\`$${pair.given}\` — a given can back at most one partition ` + `column per source.`);
+    }
+    seenGivens.set(pair.given, pair.column);
+    pairs.push(pair);
   }
-  return folded ?? {};
+  return pairs;
 }
-function ownModelNotes(modelDef) {
-  const registry = modelDef.modelAnnotations ?? {};
-  const isSameDocument = (id) => id === modelDef.modelID || id.startsWith("internal://");
-  const seen = new Set;
-  const texts = [];
-  const visit = (id) => {
-    if (seen.has(id) || !isSameDocument(id))
-      return;
-    seen.add(id);
-    const entry = registry[id];
-    if (!entry)
-      return;
-    for (const dep of entry.inheritsFrom)
-      visit(dep);
-    texts.push(...ownLevelNoteTexts(entry.ownNotes));
+var PARTITION_ROUTE = "partition", MAX_PARTITION_IR_WALK_DEPTH = 200, PartitionAnnotationError, IDENT = "[A-Za-z_][A-Za-z0-9_]*", FIELD_PATH_RE, GIVEN_REF_RE, COMPOUND_BOOLEAN_RE, IN_OPERATOR_RE, NEGATED_OPERATOR_RE, COMPARISON_OPERATOR_RE;
+var init_partition_annotation = __esm(() => {
+  init_errors();
+  PartitionAnnotationError = class PartitionAnnotationError extends ModelCompilationError {
+    rejectionCause;
+    constructor(rejectionCause, message) {
+      super({ message });
+      this.rejectionCause = rejectionCause;
+    }
+  };
+  FIELD_PATH_RE = new RegExp(`^${IDENT}(?:\\.${IDENT})*$`);
+  GIVEN_REF_RE = new RegExp(`^\\$(${IDENT})$`);
+  COMPOUND_BOOLEAN_RE = /\b(and|or|not)\b/i;
+  IN_OPERATOR_RE = /\bin\b/i;
+  NEGATED_OPERATOR_RE = /!=/;
+  COMPARISON_OPERATOR_RE = /(>=|<=|>|<)/;
+});
+
+// src/service/gate_classification.ts
+import {
+  isSourceDef as isSourceDef3
+} from "@malloydata/malloy";
+function createGateClassificationDeps(givens, modelPath) {
+  return {
+    gateShapeCache: new Map,
+    givenDeclaredTypes: computeGivenDeclaredTypes(givens),
+    modelPath
   };
-  visit(modelDef.modelID);
-  return texts;
 }
-function annotationTexts(annote) {
-  const texts = new Annotations(annote).texts();
-  return texts.length > 0 ? texts : undefined;
+function gateExprsForOwnAnnotations(struct, modelDef, excludeNotes = []) {
+  const ownNotes = ownLevelNotes(struct.annotations).filter((note) => !excludeNotes.includes(note));
+  try {
+    const own = collectAuthorizeExprs(ownNotes.map((note) => note.text));
+    if (own.length > 0) {
+      return { exprs: own, fromAncestor: false };
+    }
+    const ancestor = ancestorGateExprs(struct, modelDef);
+    return { exprs: ancestor, fromAncestor: ancestor.length > 0 };
+  } catch {
+    return { exprs: ["false"], fromAncestor: false };
+  }
 }
-function ownLevelNoteTexts(annote) {
-  return ownLevelNotes(annote).map((note) => note.text);
+function collectEntryPointGates(struct, modelDef, seen = new Set, treatAsOwnGate = false, entryPointStruct = struct, excludeNotes = []) {
+  if (!struct || !modelDef || seen.has(struct))
+    return [];
+  seen.add(struct);
+  const results = [];
+  const label = struct.as ?? struct.name;
+  const { exprs: ownExprs, fromAncestor } = gateExprsForOwnAnnotations(struct, modelDef, excludeNotes);
+  if (ownExprs.length > 0) {
+    results.push({
+      label,
+      exprs: ownExprs,
+      selfContained: fromAncestor || !treatAsOwnGate,
+      struct: entryPointStruct
+    });
+  }
+  const duck = struct;
+  if (duck.type === "query_source") {
+    const base = resolveQuerySourceBase(struct, modelDef);
+    if (base) {
+      results.push(...collectEntryPointGates(base, modelDef, seen, false, entryPointStruct));
+    } else {
+      results.push({
+        label,
+        exprs: ["false"],
+        selfContained: true
+      });
+    }
+    const resolved = duck.query?.compositeResolvedSourceDef;
+    if (resolved) {
+      results.push(...collectEntryPointGates(resolved, modelDef, seen, false, entryPointStruct, base ? ownLevelNotes(base.annotations) : []));
+    }
+  }
+  return results;
 }
-function ownLevelNotes(annote) {
-  return [...annote?.blockNotes ?? [], ...annote?.notes ?? []];
+async function resolveGateShape(entry, originModelDef, graftScope, deps) {
+  if (!entry.struct)
+    return { shape: "rejected" };
+  if (!graftScope) {
+    logger.debug("Row-level gate has no graft scope to attach to (no scope was available at all, not the gate's own condition); denying", { modelPath: deps.modelPath, label: entry.label });
+    return { shape: "rejected" };
+  }
+  const graftTarget = resolveGraftTarget(entry.struct, originModelDef, graftScope.modelDef);
+  if (!graftTarget) {
+    return { shape: "rejected" };
+  }
+  const filterText = gateFilterText(entry.exprs);
+  const cacheKey = `${graftScope.cacheScope}\x00${graftTarget}\x00${filterText}`;
+  let cached = deps.gateShapeCache.get(cacheKey);
+  if (!cached) {
+    let condition;
+    try {
+      condition = await liftGateCondition(graftTarget, filterText, graftScope.materializer);
+    } catch (err) {
+      logger.debug("Row-level gate condition failed to lift; denying", {
+        modelPath: deps.modelPath,
+        graftTarget,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return { shape: "rejected" };
+    }
+    let classification;
+    const hasUsableExpr = condition.e !== undefined && condition.e !== null && typeof condition.e === "object" && typeof condition.e.node === "string";
+    if (!hasUsableExpr) {
+      classification = {
+        shape: "rejected",
+        cause: "unclassifiable_condition",
+        detail: "this entry's lifted condition carries no usable expression"
+      };
+    } else if (isBareFalseLiteral(condition.e)) {
+      classification = { shape: "row_level", givenNames: [] };
+    } else {
+      const targetStruct = graftScope.modelDef.contents[graftTarget];
+      if (!isSourceDef3(targetStruct)) {
+        classification = {
+          shape: "rejected",
+          cause: "given_usage_unresolvable",
+          detail: "this gate's graft target does not resolve to a source on this model"
+        };
+      } else {
+        const expansion = expandRefSummaryGivenIds(targetStruct, condition.refSummary);
+        if (!expansion.ok) {
+          classification = {
+            shape: "rejected",
+            cause: "given_usage_unresolvable",
+            detail: `this gate references \`${expansion.unresolvedPath}\`, which could not be resolved on the graft target`
+          };
+        } else {
+          const givenNames = Array.from(expansion.givenIds).map((id) => graftScope.modelDef.givens?.[id]?.name).filter((name) => !!name);
+          const literalNames = referencedGivenNames(filterText);
+          const accountedFor = new Set(givenNames);
+          const unaccounted = literalNames.filter((name) => !accountedFor.has(name));
+          if (givenNames.length !== expansion.givenIds.size || unaccounted.length > 0) {
+            classification = {
+              shape: "rejected",
+              cause: "unreachable_given",
+              detail: "this gate references a given id that does not resolve to a name on this model"
+            };
+          } else {
+            classification = { shape: "row_level", givenNames };
+          }
+        }
+      }
+    }
+    if (classification.shape === "row_level") {
+      const unreachable = classification.givenNames.find((name) => !deps.givenDeclaredTypes.has(name));
+      if (unreachable !== undefined) {
+        logger.warn("Gate accepted a given off the model surface; denying", {
+          modelPath: deps.modelPath,
+          graftTarget,
+          givenName: unreachable
+        });
+        classification = {
+          shape: "rejected",
+          cause: "unreachable_given",
+          detail: `\`$${unreachable}\` is not on this model's given surface`
+        };
+      }
+    }
+    cached = { classification, condition };
+    deps.gateShapeCache.set(cacheKey, cached);
+  }
+  if (cached.classification.shape === "rejected") {
+    return { shape: "rejected", cause: cached.classification.cause };
+  }
+  return {
+    shape: "row_level",
+    graftTarget,
+    filterText,
+    condition: cached.condition,
+    givenNames: cached.classification.givenNames
+  };
 }
-var init_annotations = () => {};
+function resolveGraftTarget(struct, originModelDef, graftModelDef) {
+  const direct = findContentsKey(struct, graftModelDef);
+  if (direct)
+    return direct;
+  let current = struct;
+  const seen = new Set([struct]);
+  for (let depth = 0;depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+    const declared = resolveDeclaredSource(current, originModelDef);
+    let next;
+    if (declared.kind === "resolved" && !seen.has(declared.source)) {
+      next = declared.source;
+    } else if (declared.kind === "none") {
+      next = findSourceByOwnAnnotationIdentity(current, graftModelDef, seen);
+    }
+    if (!next)
+      return;
+    const key = findContentsKey(next, graftModelDef);
+    if (key)
+      return key;
+    seen.add(next);
+    current = next;
+  }
+  return;
+}
+function findContentsKey(struct, modelDef) {
+  for (const [key, value] of Object.entries(modelDef.contents)) {
+    if (value === struct)
+      return key;
+  }
+  if (struct.sourceID) {
+    for (const [key, value] of Object.entries(modelDef.contents)) {
+      if (isSourceDef3(value) && value.sourceID === struct.sourceID) {
+        return key;
+      }
+    }
+  }
+  return;
+}
+function findSourceByOwnAnnotationIdentity(struct, modelDef, exclude) {
+  const ownNotes = [
+    ...struct.annotations?.blockNotes ?? [],
+    ...struct.annotations?.notes ?? []
+  ];
+  if (ownNotes.length === 0)
+    return;
+  for (const value of Object.values(modelDef.contents)) {
+    if (!isSourceDef3(value) || value === struct || exclude.has(value)) {
+      continue;
+    }
+    const candidateNotes = [
+      ...value.annotations?.blockNotes ?? [],
+      ...value.annotations?.notes ?? []
+    ];
+    if (candidateNotes.some((note) => ownNotes.includes(note))) {
+      return value;
+    }
+  }
+  return;
+}
+async function liftGateCondition(graftTarget, filterText, materializer) {
+  const probe = materializer.loadQuery(buildRowLevelProbe(graftTarget, filterText));
+  const prepared = await probe.getPreparedQuery();
+  return liftProbeFilterCondition(prepared, `lifted probe for "${graftTarget}"`, filterText);
+}
+function isBareFalseLiteral(expr) {
+  let node = expr;
+  while (node.node === "()" && node.e && typeof node.e === "object") {
+    node = node.e;
+  }
+  return node.node === "false";
+}
+function computeGivenDeclaredTypes(givens) {
+  return new Map((givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
+}
+function resolveEntryPointPartitions(struct, modelDef, seen = new Set) {
+  if (!struct || !modelDef || seen.has(struct))
+    return [];
+  seen.add(struct);
+  const label = struct.as ?? struct.name;
+  const own = collectPartitionPairs(label, ownLevelNotes(struct.annotations).map((note) => note.text));
+  if (own.length > 0)
+    return own;
+  let inherited = struct.annotations?.inherits;
+  for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+    const pairs = collectPartitionPairs(label, ownLevelNoteTexts(inherited));
+    if (pairs.length > 0)
+      return pairs;
+    inherited = inherited.inherits;
+  }
+  if (inherited)
+    throw unresolvableAncestry(label);
+  const declared = resolveDeclaredSource(struct, modelDef);
+  if (declared.kind === "unresolvable")
+    throw unresolvableAncestry(label);
+  if (declared.kind === "resolved") {
+    const pairs = resolveEntryPointPartitions(declared.source, modelDef, seen);
+    if (pairs.length > 0)
+      return pairs;
+  }
+  const queryBase = resolveQuerySourceBase(struct, modelDef);
+  if (queryBase)
+    return resolveEntryPointPartitions(queryBase, modelDef, seen);
+  return [];
+}
+function unresolvableAncestry(label) {
+  return new PartitionAnnotationError("ancestry_unresolvable", `Could not resolve whether source "${label}" carries a ` + `\`#(partition)\` marker: the derivation chain it inherits from ` + `could not be read. Denying rather than serving unfiltered.`);
+}
+function assertPartitionAnnotationsValid(modelDef) {
+  if (!modelDef)
+    return;
+  for (const [key, obj] of Object.entries(modelDef.contents)) {
+    if (!isSourceDef3(obj))
+      continue;
+    const label = obj.as ?? obj.name ?? key;
+    if (obj.type !== "composite") {
+      let resolved = [];
+      try {
+        resolved = resolveEntryPointPartitions(obj, modelDef);
+      } catch (err) {
+        if (!(err instanceof PartitionAnnotationError) || err.rejectionCause !== "ancestry_unresolvable") {
+          throw err;
+        }
+        continue;
+      }
+      assertNoUnreachableMarker(obj, label, resolved);
+      continue;
+    }
+    if (resolveEntryPointPartitions(obj, modelDef).length > 0) {
+      throw new PartitionAnnotationError("partitioned_composite", `Source "${label}" is a composite source (\`compose(...)\`) and ` + `also declares \`#(partition)\` (on itself or an ancestor it ` + `derives from). A composite run target compiles each query ` + `against one resolved member branch, which a partition filter ` + `cannot attach to — declare \`#(partition)\` on a non-composite ` + `source instead.`);
+    }
+    const marked = partitionedMemberLabel(obj, modelDef);
+    if (marked !== undefined) {
+      throw new PartitionAnnotationError("partitioned_composite", `Source "${label}" is a composite source (\`compose(...)\`) with ` + `member "${marked}", which declares \`#(partition)\`. MEASURED: ` + `querying the composite reads EVERY partition of that member — ` + `the graft lands on the composite's own struct, not the ` + `resolved member branch, so no filter reaches the executed ` + `query. Remove the composite, or drop \`#(partition)\` from ` + `"${marked}" and expose it as its own source.`);
+    }
+  }
+}
+function assertNoUnreachableMarker(struct, label, resolved) {
+  if (resolved.length > 0)
+    return;
+  let reachesBelow;
+  try {
+    reachesBelow = reachesPartitionTagBelow(struct);
+  } catch {
+    reachesBelow = true;
+  }
+  if (!reachesBelow)
+    return;
+  throw new PartitionAnnotationError("marker_unreachable", `Source "${label}" carries a \`#(partition)\` marker that is not ` + `declared on the source itself — it sits on a field, a view, or an ` + `inline \`compose(...)\` inside it. Nothing would filter this ` + `source: every caller would read every partition. Move the marker ` + `onto the \`source:\` declaration.`);
+}
+function partitionedMemberLabel(composite, modelDef, seen = new Set) {
+  if (seen.has(composite))
+    return;
+  seen.add(composite);
+  for (const member of composite.sources ?? []) {
+    const label = member.as ?? member.name;
+    if (resolveEntryPointPartitions(member, modelDef).length > 0) {
+      return label;
+    }
+    if (member.type === "composite") {
+      const nested = partitionedMemberLabel(member, modelDef, seen);
+      if (nested !== undefined)
+        return nested;
+    }
+  }
+  return;
+}
+async function resolvePartitionGraftEntries(struct, originModelDef, graftScope, deps) {
+  if (!struct || !originModelDef)
+    return [];
+  const pairs = resolveEntryPointPartitions(struct, originModelDef);
+  if (pairs.length === 0)
+    return [];
+  const label = struct.as ?? struct.name;
+  if (!graftScope) {
+    logger.debug("Partition filter has no graft scope to attach to; denying", { modelPath: deps.modelPath, label });
+    throw new Error(`partition on "${label}" has no graft scope`);
+  }
+  const graftTarget = resolveGraftTarget(struct, originModelDef, graftScope.modelDef);
+  if (!graftTarget) {
+    logger.debug("Partition filter resolved to no graft target; denying", {
+      modelPath: deps.modelPath,
+      label
+    });
+    throw new Error(`partition on "${label}" resolved to no graft target`);
+  }
+  const entries = [];
+  for (const pair of pairs) {
+    if (!deps.givenDeclaredTypes.has(pair.given)) {
+      logger.warn("Partition references a given off the model surface; denying", { modelPath: deps.modelPath, graftTarget, givenName: pair.given });
+      throw new Error(`partition on "${label}" references \`$${pair.given}\`, which is not on this model's given surface`);
+    }
+    const filterText = `${pair.column} = $${pair.given}`;
+    const condition = await liftGateCondition(graftTarget, filterText, graftScope.materializer);
+    entries.push({
+      label,
+      graftTarget,
+      filterText,
+      condition,
+      givenNames: [pair.given]
+    });
+  }
+  return entries;
+}
+var init_gate_classification = __esm(() => {
+  init_logger();
+  init_annotations();
+  init_authorize();
+  init_gate_dimension();
+  init_gate_registry_walk();
+  init_partition_annotation();
+});
 
 // src/service/filter.ts
 function parseFilterAnnotation(annotation) {
@@ -13708,115 +14300,10 @@ var init_filter = __esm(() => {
   };
 });
 
-// src/service/gate_registry_walk.ts
-import { isSourceDef as isSourceDef2 } from "@malloydata/malloy";
-function resolveDeclaredSource(struct, modelDef) {
-  if (!modelDef)
-    return { kind: "none" };
-  let sawBrokenEntry = false;
-  for (const id of [struct.referenceID, struct.sourceID]) {
-    const entry = id ? modelDef.sourceRegistry?.[id]?.entry : undefined;
-    if (!entry)
-      continue;
-    const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
-    if (declared === struct)
-      continue;
-    if (!declared || !isSourceDef2(declared)) {
-      sawBrokenEntry = true;
-      continue;
-    }
-    return { kind: "resolved", source: declared };
-  }
-  return sawBrokenEntry ? { kind: "unresolvable" } : { kind: "none" };
-}
-function ancestorGateExprs(struct, modelDef, seen = new Set) {
-  let inherited = struct.annotations?.inherits;
-  for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
-    const exprs2 = collectAuthorizeExprs(ownLevelNoteTexts(inherited));
-    if (exprs2.length > 0)
-      return exprs2;
-    inherited = inherited.inherits;
-  }
-  if (inherited)
-    return ["false"];
-  seen.add(struct);
-  if (seen.size > ANCESTOR_WALK_MAX_DEPTH)
-    return ["false"];
-  const declared = resolveDeclaredSource(struct, modelDef);
-  if (declared.kind === "unresolvable")
-    return ["false"];
-  if (declared.kind === "none" || seen.has(declared.source))
-    return [];
-  const exprs = collectAuthorizeExprs(ownLevelNoteTexts(declared.source.annotations));
-  return exprs.length > 0 ? exprs : ancestorGateExprs(declared.source, modelDef, seen);
-}
-function resolveQuerySourceBase(struct, modelDef) {
-  const duck = struct;
-  if (duck.type !== "query_source")
-    return;
-  const ref = duck.query?.structRef;
-  const base = typeof ref === "string" ? modelDef?.contents[ref] : ref;
-  return base && isSourceDef2(base) ? base : undefined;
-}
-function resolveCompositeResolvedBase(struct) {
-  const duck = struct;
-  return duck.type === "query_source" ? duck.query?.compositeResolvedSourceDef : undefined;
-}
-function effectiveAncestorGateExprs(struct, modelDef, seen = new Set) {
-  const direct = ancestorGateExprs(struct, modelDef, new Set(seen));
-  if (direct.length > 0)
-    return [direct];
-  if (seen.has(struct))
-    return [];
-  seen.add(struct);
-  const groups = [];
-  const base = resolveQuerySourceBase(struct, modelDef);
-  if (!base) {
-    const duck = struct;
-    if (duck.type === "query_source")
-      groups.push(["false"]);
-  } else if (!seen.has(base)) {
-    const ownExprs = collectAuthorizeExprs(ownLevelNoteTexts(base.annotations));
-    groups.push(...ownExprs.length > 0 ? [ownExprs] : effectiveAncestorGateExprs(base, modelDef, seen));
-  }
-  const composite = resolveCompositeResolvedBase(struct);
-  if (composite && !seen.has(composite)) {
-    const parentOwnNotes = base ? ownLevelNotes(base.annotations) : [];
-    const compositeOwnNotes = ownLevelNotes(composite.annotations).filter((note) => !parentOwnNotes.includes(note));
-    const compositeOwn = collectAuthorizeExprs(compositeOwnNotes.map((note) => note.text));
-    groups.push(...compositeOwn.length > 0 ? [compositeOwn] : effectiveAncestorGateExprs(composite, modelDef, seen));
-  }
-  return groups;
-}
-function derivedStructsReachable(roots, modelDef) {
-  const seen = new Set(roots);
-  const found = [];
-  const worklist = [...roots];
-  for (let i = 0;i < worklist.length; i++) {
-    const struct = worklist[i];
-    for (const next of [
-      resolveQuerySourceBase(struct, modelDef),
-      resolveCompositeResolvedBase(struct)
-    ]) {
-      if (!next || seen.has(next))
-        continue;
-      seen.add(next);
-      found.push(next);
-      worklist.push(next);
-    }
-  }
-  return found;
-}
-var ANCESTOR_WALK_MAX_DEPTH = 32;
-var init_gate_registry_walk = __esm(() => {
-  init_annotations();
-  init_authorize();
-});
-
 // src/service/source_extraction.ts
 import {
   isJoined as isJoined2,
-  isSourceDef as isSourceDef3
+  isSourceDef as isSourceDef4
 } from "@malloydata/malloy";
 function joinFieldNamesUnresolvableDeclaration(field, modelDef) {
   const ids = [field.referenceID, field.sourceID].filter((id) => !!id);
@@ -13827,7 +14314,7 @@ function joinFieldNamesUnresolvableDeclaration(field, modelDef) {
     if (!entry)
       continue;
     const declared = entry.type === "source_registry_reference" ? modelDef.contents[entry.name] : entry;
-    if (declared && isSourceDef3(declared))
+    if (declared && isSourceDef4(declared))
       return false;
   }
   return true;
@@ -13853,7 +14340,7 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
   const nearMissAuthorize = [];
   const sweptStructs = [];
   for (const obj of Object.values(modelDef.contents)) {
-    if (!isSourceDef3(obj))
+    if (!isSourceDef4(obj))
       continue;
     const struct = obj;
     sweptStructs.push(obj);
@@ -13872,7 +14359,7 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
     const entry = value.entry;
     if (entry.type === "source_registry_reference")
       continue;
-    if (!isSourceDef3(entry))
+    if (!isSourceDef4(entry))
       continue;
     sweptStructs.push(entry);
     for (const note of ownLevelNotes(entry.annotations)) {
@@ -13899,7 +14386,7 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
   if (containsAuthorizeAnnotationTag((modelAnnotations(modelDef).notes ?? []).map((note) => note.text))) {
     misplacedAuthorize.push({ kind: "file" });
   }
-  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef3(obj)).map((sourceObj) => {
+  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef4(obj)).map((sourceObj) => {
     const struct = sourceObj;
     const sourceName = struct.as || struct.name;
     const annotations = annotationTexts(struct.annotations);
@@ -13959,7 +14446,7 @@ function extractSourcesFromModelDef(modelDef, givens, onParseError) {
         continue;
       }
       const fieldName = field.as || field.name;
-      if (isJoined2(field) && isSourceDef3(field)) {
+      if (isJoined2(field) && isSourceDef4(field)) {
         const joinedStruct = field;
         if (joinFieldNamesUnresolvableDeclaration(joinedStruct, modelDef)) {
           continue;
@@ -14393,11 +14880,12 @@ init_authorize_metrics();
 init_data_styles();
 init_errors();
 init_authorize();
+init_gate_classification();
 init_gate_dimension();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
 import {
   contextOverlay,
-  isSourceDef as isSourceDef4,
+  isSourceDef as isSourceDef5,
   MalloyConfig,
   MalloyError as MalloyError2,
   modelDefToModelInfo,
@@ -14600,10 +15088,10 @@ function newRpcId() {
 }
 function callMain(send) {
   const requestId = newRpcId();
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve2, reject2) => {
     pendingRpc.set(requestId, {
       resolve: (value) => resolve2(value),
-      reject
+      reject: reject2
     });
     send(requestId);
   });
@@ -14900,6 +15388,7 @@ async function compileMalloyModel(job, malloyConfig, modelPath) {
   } = extractSources(modelDef, givens);
   const queryResult = extractQueries(modelDef);
   const queries = queryResult.queries;
+  assertPartitionAnnotationsValid(modelDef);
   assertNoMisplacedAuthorizeAnnotations([
     ...misplacedAuthorize,
     ...queryResult.misplacedAuthorize
@@ -14916,7 +15405,7 @@ async function compileMalloyModel(job, malloyConfig, modelPath) {
     onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible,
     onOwnRowLevelConditionCompiled: (sourceName, condition) => {
       const struct = modelDef.contents[sourceName];
-      if (!struct || !isSourceDef4(struct))
+      if (!struct || !isSourceDef5(struct))
         return;
       validateSourceLineGateGivenUsage(sourceName, struct, condition.refSummary, condition.e, modelDef, (cause, detail) => {
         recordRowLevelGateRejected(cause);
@@ -15038,6 +15527,7 @@ async function compileNotebookModel(job, malloyConfig, modelPath) {
     finalFilterMap = extracted.filterMap;
     const finalQueryResult = extractQueries(finalModelDef);
     finalQueries = finalQueryResult.queries;
+    assertPartitionAnnotationsValid(finalModelDef);
     assertNoMisplacedAuthorizeAnnotations([
       ...extracted.misplacedAuthorize,
       ...finalQueryResult.misplacedAuthorize
@@ -15054,7 +15544,7 @@ async function compileNotebookModel(job, malloyConfig, modelPath) {
       onRowLevelGateUnexpressible: authorizeWarningCollection.onRowLevelGateUnexpressible,
       onOwnRowLevelConditionCompiled: (sourceName, condition) => {
         const struct = finalCompiledModelDef.contents[sourceName];
-        if (!struct || !isSourceDef4(struct))
+        if (!struct || !isSourceDef5(struct))
           return;
         validateSourceLineGateGivenUsage(sourceName, struct, condition.refSummary, condition.e, finalCompiledModelDef, (cause, detail) => {
           recordRowLevelGateRejected(cause);