@malloy-publisher/server 0.2.4 → 0.2.5

package/dist/server.mjs

@@ -251802,6 +251802,118 @@ var init_gate_registry_walk = __esm(() => {
   init_authorize();
 });
 
+// src/service/partition_annotation.ts
+import { payloadOf as payloadOf2, routeOf as routeOf2 } from "@malloydata/malloy";
+function noteRoute2(text) {
+  return routeOf2({ value: text.trimStart() });
+}
+function containsPartitionAnnotationTag(texts) {
+  return texts.some((text) => noteRoute2(text) === PARTITION_ROUTE);
+}
+function reachesPartitionTagBelow(node, seen = new WeakSet, depth = 0) {
+  if (depth > MAX_PARTITION_IR_WALK_DEPTH) {
+    throw new Error("partition-marker IR walk exceeded max depth");
+  }
+  if (node === null || typeof node !== "object")
+    return false;
+  if (seen.has(node))
+    return false;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    return node.some((item) => reachesPartitionTagBelow(item, seen, depth + 1));
+  }
+  const record = node;
+  if (depth > 0 && record.join !== undefined)
+    return false;
+  if (depth > 0) {
+    for (const key of ["blockNotes", "notes"]) {
+      const arr = record[key];
+      if (!Array.isArray(arr))
+        continue;
+      const texts = arr.map((n) => typeof n === "string" ? n : n && typeof n === "object" && typeof n.text === "string" ? n.text : undefined).filter((text) => text !== undefined);
+      if (containsPartitionAnnotationTag(texts))
+        return true;
+    }
+  }
+  return Object.entries(record).some(([key, value]) => depth === 0 && key === "annotations" ? false : reachesPartitionTagBelow(value, seen, depth + 1));
+}
+function notePayload2(text) {
+  return payloadOf2({ value: text.trimStart() }) ?? "";
+}
+function rejectionMessage(sourceName, body, detail) {
+  return `Source "${sourceName}" declares \`#(partition) ${body}\`: ${detail} ` + `#(partition) only accepts \`<column> = $GIVEN\`, where <column> is a ` + `single field or a dotted join path.`;
+}
+function reject(sourceName, body, cause, detail) {
+  throw new PartitionAnnotationError(cause, rejectionMessage(sourceName, body, detail));
+}
+function parsePartitionAnnotation(sourceName, annotationText) {
+  if (noteRoute2(annotationText) !== PARTITION_ROUTE)
+    return null;
+  const body = notePayload2(annotationText).trim();
+  if (body.length === 0) {
+    reject(sourceName, body, "empty_body", "the expression body is empty.");
+  }
+  if (COMPOUND_BOOLEAN_RE.test(body)) {
+    reject(sourceName, body, "compound_boolean", "a compound boolean (`and`/`or`/`not`) is not allowed — declare one " + "`#(partition)` marker per column.");
+  }
+  if (IN_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "in_operator", "the `in` operator is not allowed.");
+  }
+  if (NEGATED_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "negated_operator", "`!=` is not allowed.");
+  }
+  if (COMPARISON_OPERATOR_RE.test(body)) {
+    reject(sourceName, body, "comparison_operator", "only `=` is allowed, not `<`/`>`/`<=`/`>=`.");
+  }
+  const eq = body.indexOf("=");
+  if (eq === -1) {
+    reject(sourceName, body, "malformed_body", "no `=` was found.");
+  }
+  const left = body.slice(0, eq).trim();
+  const right = body.slice(eq + 1).trim();
+  if (!FIELD_PATH_RE.test(left)) {
+    reject(sourceName, body, "left_not_field_path", `\`${left}\` is not a field path — the left side must be a single ` + "column or a dotted join path, not an expression.");
+  }
+  const givenMatch = GIVEN_REF_RE.exec(right);
+  if (!givenMatch) {
+    reject(sourceName, body, "missing_given_reference", `\`${right}\` is not a given reference — the right side must be ` + "`$NAME`.");
+  }
+  return { column: left, given: givenMatch[1] };
+}
+function collectPartitionPairs(sourceName, annotationTexts2) {
+  const pairs = [];
+  const seenGivens = new Map;
+  for (const text of annotationTexts2) {
+    const pair = parsePartitionAnnotation(sourceName, text);
+    if (pair === null)
+      continue;
+    const priorColumn = seenGivens.get(pair.given);
+    if (priorColumn !== undefined) {
+      throw new PartitionAnnotationError("duplicate_given", `Source "${sourceName}" declares \`#(partition)\` on both ` + `\`${priorColumn}\` and \`${pair.column}\` for the same given ` + `\`$${pair.given}\` — a given can back at most one partition ` + `column per source.`);
+    }
+    seenGivens.set(pair.given, pair.column);
+    pairs.push(pair);
+  }
+  return pairs;
+}
+var PARTITION_ROUTE = "partition", MAX_PARTITION_IR_WALK_DEPTH = 200, PartitionAnnotationError, IDENT = "[A-Za-z_][A-Za-z0-9_]*", FIELD_PATH_RE, GIVEN_REF_RE, COMPOUND_BOOLEAN_RE, IN_OPERATOR_RE, NEGATED_OPERATOR_RE, COMPARISON_OPERATOR_RE;
+var init_partition_annotation = __esm(() => {
+  init_errors();
+  PartitionAnnotationError = class PartitionAnnotationError extends ModelCompilationError {
+    rejectionCause;
+    constructor(rejectionCause, message) {
+      super({ message });
+      this.rejectionCause = rejectionCause;
+    }
+  };
+  FIELD_PATH_RE = new RegExp(`^${IDENT}(?:\\.${IDENT})*$`);
+  GIVEN_REF_RE = new RegExp(`^\\$(${IDENT})$`);
+  COMPOUND_BOOLEAN_RE = /\b(and|or|not)\b/i;
+  IN_OPERATOR_RE = /\bin\b/i;
+  NEGATED_OPERATOR_RE = /!=/;
+  COMPARISON_OPERATOR_RE = /(>=|<=|>|<)/;
+});
+
 // src/service/gate_classification.ts
 import {
   isSourceDef as isSourceDef4
@@ -252032,12 +252144,142 @@ function isBareFalseLiteral(expr) {
 function computeGivenDeclaredTypes(givens) {
   return new Map((givens ?? []).filter((g) => g.name != null && g.type != null).map((g) => [g.name, g.type]));
 }
+function resolveEntryPointPartitions(struct, modelDef, seen = new Set) {
+  if (!struct || !modelDef || seen.has(struct))
+    return [];
+  seen.add(struct);
+  const label = struct.as ?? struct.name;
+  const own = collectPartitionPairs(label, ownLevelNotes(struct.annotations).map((note) => note.text));
+  if (own.length > 0)
+    return own;
+  let inherited = struct.annotations?.inherits;
+  for (let depth = 0;inherited && depth < ANCESTOR_WALK_MAX_DEPTH; depth++) {
+    const pairs = collectPartitionPairs(label, ownLevelNoteTexts(inherited));
+    if (pairs.length > 0)
+      return pairs;
+    inherited = inherited.inherits;
+  }
+  if (inherited)
+    throw unresolvableAncestry(label);
+  const declared = resolveDeclaredSource(struct, modelDef);
+  if (declared.kind === "unresolvable")
+    throw unresolvableAncestry(label);
+  if (declared.kind === "resolved") {
+    const pairs = resolveEntryPointPartitions(declared.source, modelDef, seen);
+    if (pairs.length > 0)
+      return pairs;
+  }
+  const queryBase = resolveQuerySourceBase(struct, modelDef);
+  if (queryBase)
+    return resolveEntryPointPartitions(queryBase, modelDef, seen);
+  return [];
+}
+function unresolvableAncestry(label) {
+  return new PartitionAnnotationError("ancestry_unresolvable", `Could not resolve whether source "${label}" carries a ` + `\`#(partition)\` marker: the derivation chain it inherits from ` + `could not be read. Denying rather than serving unfiltered.`);
+}
+function assertPartitionAnnotationsValid(modelDef) {
+  if (!modelDef)
+    return;
+  for (const [key, obj] of Object.entries(modelDef.contents)) {
+    if (!isSourceDef4(obj))
+      continue;
+    const label = obj.as ?? obj.name ?? key;
+    if (obj.type !== "composite") {
+      let resolved = [];
+      try {
+        resolved = resolveEntryPointPartitions(obj, modelDef);
+      } catch (err) {
+        if (!(err instanceof PartitionAnnotationError) || err.rejectionCause !== "ancestry_unresolvable") {
+          throw err;
+        }
+        continue;
+      }
+      assertNoUnreachableMarker(obj, label, resolved);
+      continue;
+    }
+    if (resolveEntryPointPartitions(obj, modelDef).length > 0) {
+      throw new PartitionAnnotationError("partitioned_composite", `Source "${label}" is a composite source (\`compose(...)\`) and ` + `also declares \`#(partition)\` (on itself or an ancestor it ` + `derives from). A composite run target compiles each query ` + `against one resolved member branch, which a partition filter ` + `cannot attach to — declare \`#(partition)\` on a non-composite ` + `source instead.`);
+    }
+    const marked = partitionedMemberLabel(obj, modelDef);
+    if (marked !== undefined) {
+      throw new PartitionAnnotationError("partitioned_composite", `Source "${label}" is a composite source (\`compose(...)\`) with ` + `member "${marked}", which declares \`#(partition)\`. MEASURED: ` + `querying the composite reads EVERY partition of that member — ` + `the graft lands on the composite's own struct, not the ` + `resolved member branch, so no filter reaches the executed ` + `query. Remove the composite, or drop \`#(partition)\` from ` + `"${marked}" and expose it as its own source.`);
+    }
+  }
+}
+function assertNoUnreachableMarker(struct, label, resolved) {
+  if (resolved.length > 0)
+    return;
+  let reachesBelow;
+  try {
+    reachesBelow = reachesPartitionTagBelow(struct);
+  } catch {
+    reachesBelow = true;
+  }
+  if (!reachesBelow)
+    return;
+  throw new PartitionAnnotationError("marker_unreachable", `Source "${label}" carries a \`#(partition)\` marker that is not ` + `declared on the source itself — it sits on a field, a view, or an ` + `inline \`compose(...)\` inside it. Nothing would filter this ` + `source: every caller would read every partition. Move the marker ` + `onto the \`source:\` declaration.`);
+}
+function partitionedMemberLabel(composite, modelDef, seen = new Set) {
+  if (seen.has(composite))
+    return;
+  seen.add(composite);
+  for (const member of composite.sources ?? []) {
+    const label = member.as ?? member.name;
+    if (resolveEntryPointPartitions(member, modelDef).length > 0) {
+      return label;
+    }
+    if (member.type === "composite") {
+      const nested = partitionedMemberLabel(member, modelDef, seen);
+      if (nested !== undefined)
+        return nested;
+    }
+  }
+  return;
+}
+async function resolvePartitionGraftEntries(struct, originModelDef, graftScope, deps) {
+  if (!struct || !originModelDef)
+    return [];
+  const pairs = resolveEntryPointPartitions(struct, originModelDef);
+  if (pairs.length === 0)
+    return [];
+  const label = struct.as ?? struct.name;
+  if (!graftScope) {
+    logger.debug("Partition filter has no graft scope to attach to; denying", { modelPath: deps.modelPath, label });
+    throw new Error(`partition on "${label}" has no graft scope`);
+  }
+  const graftTarget = resolveGraftTarget(struct, originModelDef, graftScope.modelDef);
+  if (!graftTarget) {
+    logger.debug("Partition filter resolved to no graft target; denying", {
+      modelPath: deps.modelPath,
+      label
+    });
+    throw new Error(`partition on "${label}" resolved to no graft target`);
+  }
+  const entries = [];
+  for (const pair of pairs) {
+    if (!deps.givenDeclaredTypes.has(pair.given)) {
+      logger.warn("Partition references a given off the model surface; denying", { modelPath: deps.modelPath, graftTarget, givenName: pair.given });
+      throw new Error(`partition on "${label}" references \`$${pair.given}\`, which is not on this model's given surface`);
+    }
+    const filterText = `${pair.column} = $${pair.given}`;
+    const condition = await liftGateCondition(graftTarget, filterText, graftScope.materializer);
+    entries.push({
+      label,
+      graftTarget,
+      filterText,
+      condition,
+      givenNames: [pair.given]
+    });
+  }
+  return entries;
+}
 var init_gate_classification = __esm(() => {
   init_logger();
   init_annotations();
   init_authorize();
   init_gate_dimension();
   init_gate_registry_walk();
+  init_partition_annotation();
 });
 
 // src/service/incremental_declaration.ts
@@ -252234,8 +252476,24 @@ function assertMaterializationEligible(persistSource) {
       message: `Source '${sourceName}' cannot be materialized into a storage ` + `destination: it is protected by an #(authorize) gate (its own or a ` + `joined source's). An authorize expression is evaluated per request; ` + `a materialized-once table served frozen carries no gate, so it would ` + `be served to everyone, bypassing authorization. This is refused for ` + `safety. Serve this source live (drop 'storage=').`
     });
   }
+  if (referencesPartition(persistSource)) {
+    recordEligibilityRefused("partition");
+    throw new MaterializationEligibilityError({
+      reason: "partition",
+      message: `Source '${sourceName}' cannot be materialized into a storage ` + `destination: it declares a #(partition) marker. A partition ` + `filter binds a given at query time (the same mechanism as ` + `row-level access control), so a materialized-once table served ` + `frozen would leak every partition's rows to every caller. This ` + `is refused for safety. Serve this source live (drop 'storage=').`
+    });
+  }
 }
 function assertColocatedPersistNotAuthorizeGated(persistSource, sourceName = persistSource.name, origin2 = "persist", gateOutcome) {
+  if (referencesPartition(persistSource)) {
+    recordEligibilityRefused("partition");
+    const what2 = origin2 === "preaggregate" ? `Pre-aggregation rollup '${sourceName}'` : `Source '${sourceName}'`;
+    const gated2 = origin2 === "preaggregate" ? `the source '${sourceName}' rolls up declares` : `it declares`;
+    throw new MaterializationEligibilityError({
+      reason: "partition",
+      message: `${what2} cannot be materialized (colocated '#@ persist'): ` + `${gated2} a #(partition) marker. A partition filter binds a ` + `given at query time; this pass cannot prove the persisted ` + `artifact's read path still applies it, so this is refused for ` + `safety. Move the marker to a source that is not materialized, ` + `or stop persisting this one.`
+    });
+  }
   if (!referencesAuthorize(persistSource))
     return;
   if (origin2 === "persist" && gateOutcome?.classification === "row_level" && gateOutcome.attributed) {
@@ -252311,6 +252569,44 @@ function walkForGiven(node, seen, depth) {
   }
   return false;
 }
+function referencesPartition(persistSource) {
+  try {
+    return walkForPartition(persistSource._sourceDef, new WeakSet, 0);
+  } catch {
+    return true;
+  }
+}
+function walkForPartition(node, seen, depth) {
+  if (depth > MAX_GIVEN_WALK_DEPTH) {
+    throw new Error("partition-usage walk exceeded max depth");
+  }
+  if (node === null || typeof node !== "object")
+    return false;
+  if (seen.has(node))
+    return false;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    for (const item of node) {
+      if (walkForPartition(item, seen, depth + 1))
+        return true;
+    }
+    return false;
+  }
+  const record = node;
+  for (const key of ["blockNotes", "notes"]) {
+    const arr = record[key];
+    if (!Array.isArray(arr))
+      continue;
+    const texts = arr.map((n) => typeof n === "string" ? n : n && typeof n === "object" && typeof n.text === "string" ? n.text : undefined).filter((text) => text !== undefined);
+    if (containsPartitionAnnotationTag(texts))
+      return true;
+  }
+  for (const value of Object.values(record)) {
+    if (walkForPartition(value, seen, depth + 1))
+      return true;
+  }
+  return false;
+}
 function referencesAuthorize(persistSource) {
   try {
     return walkForAuthorize(persistSource._sourceDef, new WeakSet, 0);
@@ -252411,6 +252707,7 @@ var init_materialization_eligibility = __esm(() => {
   init_errors();
   init_materialization_metrics();
   init_authorize();
+  init_partition_annotation();
 });
 
 // src/service/preaggregation_compile.ts
@@ -253865,6 +254162,7 @@ var init_model = __esm(() => {
   init_query_metadata();
   init_preaggregation_validation();
   init_gate_registry_walk();
+  init_partition_annotation();
   init_gate_classification();
   init_source_extraction();
   init_authorize_metrics();
@@ -254060,20 +254358,7 @@ var init_model = __esm(() => {
         if (!modelDef)
           return false;
         try {
-          const structs = [];
-          for (const obj of Object.values(modelDef.contents)) {
-            if (isSourceDef6(obj))
-              structs.push(obj);
-          }
-          for (const value of Object.values(modelDef.sourceRegistry ?? {})) {
-            const entry = value.entry;
-            if (entry.type === "source_registry_reference")
-              continue;
-            if (isSourceDef6(entry))
-              structs.push(entry);
-          }
-          structs.push(...derivedStructsReachable(structs, modelDef));
-          for (const struct of structs) {
+          for (const struct of this.reachableStructsForNoteSweep(modelDef)) {
             if (containsAuthorizeAnnotationTag(annotationTexts(struct.annotations) ?? [])) {
               return true;
             }
@@ -254090,6 +254375,43 @@ var init_model = __esm(() => {
       })();
       return this.anyAuthorizeNote;
     }
+    reachableStructsForNoteSweep(modelDef) {
+      const structs = [];
+      for (const obj of Object.values(modelDef.contents)) {
+        if (isSourceDef6(obj))
+          structs.push(obj);
+      }
+      for (const value of Object.values(modelDef.sourceRegistry ?? {})) {
+        const entry = value.entry;
+        if (entry.type === "source_registry_reference")
+          continue;
+        if (isSourceDef6(entry))
+          structs.push(entry);
+      }
+      structs.push(...derivedStructsReachable(structs, modelDef));
+      return structs;
+    }
+    anyPartitionNote;
+    hasAnyPartitionNote() {
+      if (this.anyPartitionNote !== undefined)
+        return this.anyPartitionNote;
+      this.anyPartitionNote = (() => {
+        const modelDef = this.modelDef;
+        if (!modelDef)
+          return false;
+        try {
+          for (const struct of this.reachableStructsForNoteSweep(modelDef)) {
+            if (containsPartitionAnnotationTag(annotationTexts(struct.annotations) ?? [])) {
+              return true;
+            }
+          }
+          return false;
+        } catch {
+          return true;
+        }
+      })();
+      return this.anyPartitionNote;
+    }
     async assertAuthorized(sourceName, _givens, bypassAuthorize = false, graftScope = this.defaultGraftScope()) {
       if (bypassAuthorize) {
         this.noteAuthorizeBypass("source", sourceName);
@@ -254146,7 +254468,7 @@ var init_model = __esm(() => {
           entryPointGates = Array.from(byKey.values());
         }
       }
-      return { entryPointGates, modelDef };
+      return { entryPointGates, modelDef, struct };
     }
     async assertAuthorizedFromCompiledRunnable(runnable, givens) {
       await this.authorizeAndBindRunnable(runnable, givens, {
@@ -254158,7 +254480,7 @@ var init_model = __esm(() => {
       return this.rowLevelFilteredRunnables.has(runnable);
     }
     async probeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate = false) {
-      const { entryPointGates, modelDef } = await this.collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate);
+      const { entryPointGates, modelDef, struct } = await this.collectAuthorizeEntryPointGates(runnable, givens, graftScope, skipOwnSourceGate);
       const rowLevel = [];
       for (const entry of entryPointGates) {
         const resolution = modelDef ? await this.resolveGateShape(entry, modelDef, graftScope) : { shape: "rejected", cause: undefined };
@@ -254177,6 +254499,16 @@ var init_model = __esm(() => {
           recordRowLevelGateRejected(resolution.cause);
         throw new AccessDeniedError(`Access denied for source "${entry.label}".`);
       }
+      try {
+        rowLevel.push(...await resolvePartitionGraftEntries(struct, modelDef, graftScope, this.gateClassificationDeps()));
+      } catch (err) {
+        recordRowLevelGateDecision("denied_by_gate");
+        logger.debug("Partition filter could not be resolved; denying", {
+          modelPath: this.modelPath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        throw new AccessDeniedError(`Access denied for source "${struct?.as ?? struct?.name ?? "unknown"}".`);
+      }
       return rowLevel;
     }
     async queryEntryPointHasRowLevelGate(runnable) {
@@ -254189,7 +254521,7 @@ var init_model = __esm(() => {
         if (compositeResolvedSourceDef) {
           gates.push(...this.collectEntryPointGates(compositeResolvedSourceDef, modelDef, seen, true, undefined, struct ? ownLevelNotes(struct.annotations) : []));
         }
-        return gates.length > 0;
+        return gates.length > 0 || resolveEntryPointPartitions(struct, modelDef).length > 0;
       } catch {
         return true;
       }
@@ -254520,6 +254852,7 @@ var init_model = __esm(() => {
           filterMap = sourceResult.filterMap;
           const queryResult = Model.getQueries(modelDef);
           queries = queryResult.queries;
+          assertPartitionAnnotationsValid(modelDef);
           assertNoMisplacedAuthorizeAnnotations([
             ...sourceResult.misplacedAuthorize,
             ...queryResult.misplacedAuthorize
@@ -255147,7 +255480,7 @@ run: ${sourceName ? `${quoteMalloyIdentifier2(sourceName)} -> ` : ""}${quoteMall
         liveRunnable = runnable;
         const storageRoutingPossible = getPersistStorageMode() === "on" && this.serveBindings.length > 0 && !!this.serveDestinationConfig;
         const preaggServeMaterializer = this.preaggregateServeMaterializer;
-        const routingBlockedByRowLevelGate = (storageRoutingPossible || !!preaggServeMaterializer) && !bypassAuthorize && this.hasAnyAuthorizeNote() && await this.queryEntryPointHasRowLevelGate(runnable);
+        const routingBlockedByRowLevelGate = (storageRoutingPossible || !!preaggServeMaterializer) && !bypassAuthorize && (this.hasAnyAuthorizeNote() || this.hasAnyPartitionNote()) && await this.queryEntryPointHasRowLevelGate(runnable);
         if (routingBlockedByRowLevelGate) {
           recordStorageServeRouting("blocked_by_row_level_gate");
         }
@@ -256631,10 +256964,10 @@ var require_recursive_readdir = __commonJS((exports, module) => {
       ignores = [];
     }
     if (!callback) {
-      return new Promise(function(resolve4, reject) {
+      return new Promise(function(resolve4, reject2) {
         readdir3(path9, ignores || [], function(err, data) {
           if (err) {
-            reject(err);
+            reject2(err);
           } else {
             resolve4(data);
           }
@@ -288124,19 +288457,34 @@ init_model();
 init_errors();
 var PERSIST_LINE_PATTERN = /^\s*#@\s+persist\b/;
 var UNQUOTED_NAME_PATTERN = /(?<![.\w])name\s*=\s*(?!["'])/;
+var QUOTED_NAME_VALUE_PATTERN = /(?<![.\w])name\s*=\s*(["'])(.*?)\1/g;
+var SAFE_NAME_PATH = /^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*$/;
 function assertPersistNamesQuoted(modelSource, modelPath) {
-  const offenders = [];
+  const unquoted = [];
+  const unsafe = [];
   for (const rawLine of modelSource.split(`
 `)) {
     if (!PERSIST_LINE_PATTERN.test(rawLine))
       continue;
     if (UNQUOTED_NAME_PATTERN.test(rawLine)) {
-      offenders.push(rawLine.trim());
+      unquoted.push(rawLine.trim());
+      continue;
     }
+    for (const match of rawLine.matchAll(QUOTED_NAME_VALUE_PATTERN)) {
+      if (!SAFE_NAME_PATH.test(match[2])) {
+        unsafe.push(rawLine.trim());
+        break;
+      }
+    }
+  }
+  if (unquoted.length > 0) {
+    throw new ModelCompilationError({
+      message: `${modelPath}: persist annotation name must be quoted. Write a quoted ` + `value like name="engaged_events" (or a dialect table path such as ` + `name="my_dataset.engaged_events"), not a bare value -- an unquoted ` + `persist name is dropped from the build plan, so the source would ` + `publish but never materialize. Offending annotation(s): ` + `${unquoted.join("; ")}.`
+    });
   }
-  if (offenders.length > 0) {
+  if (unsafe.length > 0) {
     throw new ModelCompilationError({
-      message: `${modelPath}: persist annotation name must be quoted. Write a quoted ` + `value like name="engaged_events" (or a dialect table path such as ` + `name="my_dataset.engaged_events"), not a bare value — an unquoted ` + `persist name is dropped from the build plan, so the source would ` + `publish but never materialize. Offending annotation(s): ` + `${offenders.join("; ")}.`
+      message: `${modelPath}: persist annotation name must be a plain identifier path -- ` + `dot-separated segments of letters, digits, underscores, and hyphens ` + `(e.g. name="engaged_events", name="my_dataset.engaged_events", or a ` + `hyphenated container path name="my-proj.mydataset.engaged_events"). ` + `The name is inlined into the materialization table DDL, so a value ` + `containing a quote, backtick, semicolon, or space is rejected. ` + `Offending annotation(s): ${unsafe.join("; ")}.`
     });
   }
 }
@@ -290288,8 +290636,8 @@ ${source}` : source ?? "";
   }
   async fetchManifestEntriesWithTimeout(manifestLocation) {
     let timer;
-    const timeout = new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error(`Timed out after ${MANIFEST_FETCH_TIMEOUT_MS}ms fetching manifest ${manifestLocation}`)), MANIFEST_FETCH_TIMEOUT_MS);
+    const timeout = new Promise((_, reject2) => {
+      timer = setTimeout(() => reject2(new Error(`Timed out after ${MANIFEST_FETCH_TIMEOUT_MS}ms fetching manifest ${manifestLocation}`)), MANIFEST_FETCH_TIMEOUT_MS);
     });
     try {
       return await Promise.race([
@@ -291851,8 +292199,8 @@ class EnvironmentStore {
       }
       const file = fs9.createWriteStream(zipFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
-      await new Promise((resolve5, reject) => {
-        file.on("error", reject);
+      await new Promise((resolve5, reject2) => {
+        file.on("error", reject2);
         file.on("finish", resolve5);
       });
       await this.unzipEnvironment(zipFilePath);
@@ -291891,8 +292239,8 @@ class EnvironmentStore {
       }
       const file = fs9.createWriteStream(absoluteFilePath);
       item.Body.transformToWebStream().pipeTo(Writable.toWeb(file));
-      await new Promise((resolve5, reject) => {
-        file.on("error", reject);
+      await new Promise((resolve5, reject2) => {
+        file.on("error", reject2);
         file.on("finish", resolve5);
       });
     }));
@@ -291913,7 +292261,7 @@ class EnvironmentStore {
     await fs9.promises.mkdir(absoluteDirPath, { recursive: true });
     const repoUrl = `https://github.com/${owner}/${repoName}`;
     const reporter = new CloneProgressReporter(cloneProgressLabel(`${owner}/${repoName}`, progressContext));
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve5, reject2) => {
       esm_default2({
         progress: (event) => reporter.onProgress(event)
       }).clone(repoUrl, absoluteDirPath, GIT_CLONE_OPTIONS, (err) => {
@@ -291925,7 +292273,7 @@ class EnvironmentStore {
           }
           const errorData = this.extractErrorDataFromError(err);
           logger.error(`Failed to clone GitHub repository "${repoUrl}"`, errorData);
-          reject(err);
+          reject2(err);
           return;
         }
         resolve5();
@@ -292708,10 +293056,10 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken } = options !== null && options !== undefined ? options : {};
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve5, reject2) => {
       var _a2, _b, _c, _d, _e, _f;
       if (!this._transport) {
-        reject(new Error("Not connected"));
+        reject2(new Error("Not connected"));
         return;
       }
       if (((_a2 = this._options) === null || _a2 === undefined ? undefined : _a2.enforceStrictCapabilities) === true) {
@@ -292747,7 +293095,7 @@ class Protocol {
             reason: String(reason)
           }
         }, { relatedRequestId, resumptionToken, onresumptiontoken }).catch((error) => this._onerror(new Error(`Failed to send cancellation: ${error}`)));
-        reject(reason);
+        reject2(reason);
       };
       this._responseHandlers.set(messageId, (response) => {
         var _a3;
@@ -292755,13 +293103,13 @@ class Protocol {
           return;
         }
         if (response instanceof Error) {
-          return reject(response);
+          return reject2(response);
         }
         try {
           const result = resultSchema.parse(response.result);
           resolve5(result);
         } catch (error) {
-          reject(error);
+          reject2(error);
         }
       });
       (_d = options === null || options === undefined ? undefined : options.signal) === null || _d === undefined || _d.addEventListener("abort", () => {
@@ -292773,7 +293121,7 @@ class Protocol {
       this._setupTimeout(messageId, timeout, options === null || options === undefined ? undefined : options.maxTotalTimeout, timeoutHandler, (_f = options === null || options === undefined ? undefined : options.resetTimeoutOnProgress) !== null && _f !== undefined ? _f : false);
       this._transport.send(jsonrpcRequest, { relatedRequestId, resumptionToken, onresumptiontoken }).catch((error) => {
         this._cleanupTimeout(messageId);
-        reject(error);
+        reject2(error);
       });
     });
   }
@@ -306222,10 +306570,10 @@ var promisifyStore = (passedStore) => {
 
   class PromisifiedStore {
     async increment(key) {
-      return new Promise((resolve6, reject) => {
+      return new Promise((resolve6, reject2) => {
         legacyStore.incr(key, (error, totalHits, resetTime) => {
           if (error)
-            reject(error);
+            reject2(error);
           resolve6({ totalHits, resetTime });
         });
       });

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.2.4",
+   "version": "0.2.5",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"