@malloy-publisher/server 0.9.11 → 0.9.12

package/dist/server.mjs

@@ -205154,15 +205154,36 @@ function filesystemAccessFailure(error2) {
 function isMysqlConfigFault(code) {
   return typeof code === "string" && (MYSQL_CONFIG_CODES.has(code) || code.startsWith("HANDSHAKE_"));
 }
-function isConnectionFailure(error2) {
-  let current = error2;
+function isSqlserverConnectTimeout(error2, code) {
+  return code === "ETIMEOUT" && error2.name === "ConnectionError";
+}
+function wrappedError(error2) {
+  if (error2.cause instanceof Error)
+    return error2.cause;
+  return error2.originalError;
+}
+function causeChainHasTlsVerificationFailure(error2) {
+  let current = wrappedError(error2);
   for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    const { code } = current;
+    if (typeof code === "string" && TLS_VERIFICATION_CODES.has(code)) {
+      return true;
+    }
+    current = wrappedError(current);
+  }
+  return false;
+}
+function isConnectionFailure(error2) {
+  for (const current of causeChain(error2)) {
     const { code, fatal } = current;
     if (typeof code === "string") {
       if (NODE_CONNECTION_CODES.has(code))
         return true;
       if (POSTGRES_CONNECTION_SQLSTATE.test(code))
         return true;
+      if (SQLSERVER_CONNECTION_CODES.has(code) || isSqlserverConnectTimeout(current, code)) {
+        return !causeChainHasTlsVerificationFailure(current);
+      }
     }
     if (fatal === true && !isMysqlConfigFault(code))
       return true;
@@ -205170,13 +205191,18 @@ function isConnectionFailure(error2) {
     if (CODELESS_CONNECTION_MESSAGES.some((re) => re.test(message))) {
       return true;
     }
-    current = current.cause;
   }
   return false;
 }
-function isCredentialRejection(error2) {
+function* causeChain(error2) {
   let current = error2;
   for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    yield current;
+    current = wrappedError(current);
+  }
+}
+function isCredentialRejection(error2) {
+  for (const current of causeChain(error2)) {
     const { code } = current;
     if (typeof code === "string" || typeof code === "number") {
       const value = String(code);
@@ -205184,12 +205210,13 @@ function isCredentialRejection(error2) {
         return true;
       if (MYSQL_AUTH_CODES.has(value))
         return true;
+      if (SQLSERVER_AUTH_CODES.has(value))
+        return true;
       if (SNOWFLAKE_AUTH_CODES.has(value))
         return true;
     }
     if (current.name === "BigQueryAuthenticationError")
       return true;
-    current = current.cause;
   }
   return false;
 }
@@ -205204,6 +205231,19 @@ function databaseAccessFailure(error2) {
     return new ConnectionFailedError(message);
   return;
 }
+function statementRejection(error2) {
+  for (const current of causeChain(error2)) {
+    const { code, severity } = current;
+    if (severity === "FATAL" || severity === "PANIC")
+      return;
+    if (typeof code !== "string" || !POSTGRES_STATEMENT_SQLSTATES.has(code)) {
+      continue;
+    }
+    const message = current.message;
+    return code === POSTGRES_UNDEFINED_TABLE && POSTGRES_RELATION_MISSING.test(message) ? new TableNotFoundError(message) : new InvalidArgumentError(message);
+  }
+  return;
+}
 function describeFilesystemAccessFailure(errno) {
   const code = errno.code ?? "";
   const target = errno.path ? ` '${errno.path}'` : "";
@@ -205343,7 +205383,7 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SNOWFLAKE_AUTH_CODES, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, SQLSERVER_CONNECTION_CODES, TLS_VERIFICATION_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SQLSERVER_AUTH_CODES, SNOWFLAKE_AUTH_CODES, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
@@ -205369,7 +205409,8 @@ var init_errors = __esm(() => {
     /^(Error: )?Connection lost: The server closed the connection\.$/,
     new RegExp(`^(Error: )?(connect|read|write|getaddrinfo) (${[
       ...NODE_CONNECTION_CODES
-    ].join("|")})\\b`)
+    ].join("|")})\\b`),
+    /^Failed to connect to \S+( \(redirected from \S+\))?( in \d+ms| - (?!.*certificate).+)$/i
   ];
   MYSQL_CONFIG_CODES = new Set([
     "ER_ACCESS_DENIED_ERROR",
@@ -205378,9 +205419,46 @@ var init_errors = __esm(() => {
     "AUTH_SWITCH_PLUGIN_ERROR",
     "MYSQL_CLEAR_PASSWORD_NOT_ENABLED"
   ]);
+  SQLSERVER_CONNECTION_CODES = new Set(["ESOCKET", "EINSTLOOKUP"]);
+  TLS_VERIFICATION_CODES = new Set([
+    "CERT_HAS_EXPIRED",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "UNABLE_TO_GET_ISSUER_CERT",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
+  ]);
   POSTGRES_AUTH_SQLSTATE = /^28[0-9A-Z]{3}$/;
   MYSQL_AUTH_CODES = new Set(["ER_ACCESS_DENIED_ERROR"]);
+  SQLSERVER_AUTH_CODES = new Set(["ELOGIN"]);
   SNOWFLAKE_AUTH_CODES = new Set(["390100", "390144", "390195", "390318"]);
+  POSTGRES_STATEMENT_SQLSTATES = new Set([
+    "42601",
+    "42703",
+    "42P01",
+    "42883",
+    "42704",
+    "42P02",
+    "42702",
+    "42725",
+    "42P09",
+    "42P10",
+    "42804",
+    "42846",
+    "42803",
+    "42P20",
+    "42P18",
+    "42P19",
+    "42712",
+    "42701",
+    "42602",
+    "42622",
+    "42809",
+    "42P21",
+    "42P22"
+  ]);
+  POSTGRES_RELATION_MISSING = /^relation ".*" does not exist$/;
   NotImplementedError = class NotImplementedError extends Error {
     constructor(message) {
       super(message);
@@ -262101,6 +262179,11 @@ var require_utils93 = __commonJS((exports, module) => {
   };
 });
 
+// ../../node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
+var require_sshcrypto = __commonJS((exports, module) => {
+  module.exports = __require("./sshcrypto-cqb52edz.node");
+});
+
 // ../../node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -262587,7 +262670,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
+    binding = require_sshcrypto();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -338983,6 +339066,7 @@ import {
   buildPoolOptions,
   SnowflakeConnection
 } from "@malloydata/db-snowflake";
+import"@malloydata/db-sqlserver";
 import"@malloydata/db-trino";
 import {
   contextOverlay,
@@ -344267,6 +344351,7 @@ var DOUBLED_ESCAPE_DIALECTS = new Set([
   "motherduck",
   "postgres",
   "publisher",
+  "sqlserver",
   "trino"
 ]);
 function sqlLiteral(value, connectionType) {
@@ -345119,6 +345204,13 @@ function getStaticConnectionAttributes(type) {
         canPersist: true,
         canStream: false
       };
+    case "sqlserver":
+      return {
+        dialectName: "sqlserver",
+        isPool: true,
+        canPersist: false,
+        canStream: true
+      };
     case "duckdb":
     case "motherduck":
     case "ducklake":
@@ -345265,6 +345357,20 @@ function validateConnectionShape(connection) {
     case "postgres":
     case "mysql":
       break;
+    case "sqlserver": {
+      const sqlserver = connection.sqlserverConnection;
+      if (!sqlserver) {
+        throw new Error("SQL Server connection configuration is missing.");
+      }
+      const port = sqlserver.port;
+      if (port !== undefined && port !== null && (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535)) {
+        throw new Error(`Connection '${connection.name}' has an invalid sqlserverConnection.port ` + `${JSON.stringify(port)} (expected an integer from 1 to 65535).`);
+      }
+      if (sqlserver.instanceName && sqlserver.port) {
+        logger.warn(`Connection '${connection.name}' sets both sqlserverConnection.instanceName ` + `and port; the instance is located through SQL Browser and the port is not used.`);
+      }
+      break;
+    }
     case "bigquery": {
       const bigquery = connection.bigqueryConnection;
       if (bigquery?.impersonateServiceAccount) {
@@ -345512,6 +345618,9 @@ function canonicalizeJsonValue(value) {
   }
   return sorted;
 }
+function blankAsUnset(value) {
+  return value === "" ? undefined : value;
+}
 function assembleEnvironmentConnections(connections = [], environmentPath = "") {
   const pojo = { connections: {} };
   const metadata = new Map;
@@ -345574,6 +345683,22 @@ function assembleEnvironmentConnections(connections = [], environmentPath = "")
         };
         break;
       }
+      case "sqlserver": {
+        const sqlserver = connection.sqlserverConnection;
+        pojo.connections[connection.name] = {
+          is: "sqlserver",
+          server: sqlserver?.server,
+          port: sqlserver?.port,
+          database: sqlserver?.database,
+          user: sqlserver?.user,
+          password: sqlserver?.password,
+          encrypt: sqlserver?.encrypt,
+          trustServerCertificate: sqlserver?.trustServerCertificate,
+          hostNameInCertificate: blankAsUnset(sqlserver?.hostNameInCertificate),
+          instanceName: blankAsUnset(sqlserver?.instanceName)
+        };
+        break;
+      }
       case "bigquery": {
         const serviceAccountKey = parseServiceAccountKey(connection.bigqueryConnection?.serviceAccountKeyJson);
         const impersonateServiceAccount = connection.bigqueryConnection?.impersonateServiceAccount;
@@ -347507,6 +347632,16 @@ var MYSQL = {
   database: "scalar",
   user: "scalar"
 };
+var SQLSERVER = {
+  server: "scalar",
+  port: "scalar",
+  database: "scalar",
+  user: "scalar",
+  encrypt: "scalar",
+  trustServerCertificate: "scalar",
+  hostNameInCertificate: "scalar",
+  instanceName: "scalar"
+};
 var MOTHERDUCK = { database: "scalar" };
 var PUBLISHER = { connectionUri: "scalar" };
 var S3 = {
@@ -347572,6 +347707,7 @@ var PUBLIC_CONNECTION = {
   trinoConnection: TRINO,
   databricksConnection: DATABRICKS,
   mysqlConnection: MYSQL,
+  sqlserverConnection: SQLSERVER,
   duckdbConnection: DUCKDB,
   motherduckConnection: MOTHERDUCK,
   ducklakeConnection: DUCKLAKE,
@@ -347585,6 +347721,7 @@ var PUBLIC_FIELDS_BY_SCHEMA = {
   TrinoConnection: Object.keys(TRINO),
   DatabricksConnection: Object.keys(DATABRICKS),
   MysqlConnection: Object.keys(MYSQL),
+  SqlserverConnection: Object.keys(SQLSERVER),
   DuckdbConnection: Object.keys(DUCKDB),
   MotherDuckConnection: Object.keys(MOTHERDUCK),
   DucklakeConnection: Object.keys(DUCKLAKE),
@@ -348077,6 +348214,27 @@ async function getSchemasForPostgres(connection, malloyConnection) {
     throw new Error(`Failed to get schemas for Postgres connection ${connection.name}: ${error2.message}`, { cause: error2 });
   }
 }
+async function getSchemasForSQLServer(connection, malloyConnection) {
+  if (!connection.sqlserverConnection) {
+    throw new Error("SQL Server connection is required");
+  }
+  try {
+    const result = await runIntrospectionSQL(malloyConnection, "SELECT DISTINCT table_schema AS schema_name FROM information_schema.tables ORDER BY table_schema");
+    const rows = standardizeRunSQLResult2(result);
+    return rows.map((row) => {
+      const typedRow = row;
+      const schemaName = String(typedRow.schema_name ?? typedRow.SCHEMA_NAME ?? "");
+      return {
+        name: schemaName,
+        isHidden: false,
+        isDefault: schemaName === "dbo"
+      };
+    });
+  } catch (error2) {
+    logger.error(`Error getting schemas for SQL Server connection ${connection.name}`, { error: error2 });
+    throw new Error(`Failed to get schemas for SQL Server connection ${connection.name}: ${error2.message}`, { cause: error2 });
+  }
+}
 async function getSchemasForMySQL(connection) {
   if (!connection.mysqlConnection) {
     throw new Error("Mysql connection is required");
@@ -348426,6 +348584,8 @@ async function getSchemasForConnection(connection, malloyConnection) {
       return getSchemasForPostgres(connection, malloyConnection);
     case "mysql":
       return getSchemasForMySQL(connection);
+    case "sqlserver":
+      return getSchemasForSQLServer(connection, malloyConnection);
     case "snowflake":
       return getSchemasForSnowflake(connection, malloyConnection);
     case "trino":
@@ -348613,6 +348773,8 @@ async function listTablesForSchema(connection, schemaName, malloyConnection, tab
       return listTablesForMySQL(connection, schemaName, malloyConnection, tableNames);
     case "postgres":
       return listTablesForPostgres(connection, schemaName, malloyConnection, tableNames);
+    case "sqlserver":
+      return listTablesForSQLServer(connection, schemaName, malloyConnection, tableNames);
     case "snowflake":
       return listTablesForSnowflake(connection, schemaName, malloyConnection, tableNames);
     case "trino":
@@ -348681,6 +348843,27 @@ async function listTablesForMySQL(connection, schemaName, malloyConnection, tabl
     throw new Error(`Failed to get tables for MySQL schema ${schemaName} in connection ${connection.name}: ${error2.message}`, { cause: error2 });
   }
 }
+function sqlserverNLiteral(value) {
+  return `N'${sqlLiteral(value, "sqlserver")}'`;
+}
+function sqlserverInFilter(columnName, values) {
+  if (!values || values.length === 0)
+    return "";
+  return `AND ${columnName} IN (${values.map(sqlserverNLiteral).join(", ")})`;
+}
+async function listTablesForSQLServer(connection, schemaName, malloyConnection, tableNames) {
+  if (!connection.sqlserverConnection) {
+    throw new Error("SQL Server connection is required");
+  }
+  try {
+    const result = await runIntrospectionSQL(malloyConnection, `SELECT table_name, column_name, data_type FROM information_schema.columns WHERE table_schema = ${sqlserverNLiteral(schemaName)} ${sqlserverInFilter("table_name", tableNames)} ORDER BY table_name, ordinal_position`);
+    const rows = standardizeRunSQLResult2(result);
+    return groupColumnRowsIntoTables(rows, (t2) => `${schemaName}.${t2}`);
+  } catch (error2) {
+    logger.error(`Error getting tables for SQL Server schema ${schemaName} in connection ${connection.name}`, { error: error2 });
+    throw new Error(`Failed to get tables for SQL Server schema ${schemaName} in connection ${connection.name}: ${error2.message}`, { cause: error2 });
+  }
+}
 async function listTablesForPostgres(connection, schemaName, malloyConnection, tableNames) {
   if (!connection.postgresConnection) {
     throw new Error("Postgres connection is required");
@@ -349001,12 +349184,12 @@ function classifyDriverFailure(error2) {
     return error2;
   }
   const message = error2 instanceof Error ? error2.message : typeof error2 === "string" ? error2 : JSON.stringify(error2);
-  return databaseAccessFailure(error2) ?? driverErrorToPublisherError(message);
+  return databaseAccessFailure(error2) ?? statementRejection(error2) ?? driverErrorToPublisherError(message);
 }
 function sqlRunFailure(error2) {
   if (error2 instanceof ConnectionError)
     return error2;
-  return databaseAccessFailure(error2) ?? new ConnectionError(error2.message);
+  return databaseAccessFailure(error2) ?? statementRejection(error2) ?? new ConnectionError(error2.message);
 }
 async function withDatabaseAccessClassified(list) {
   try {
@@ -349096,8 +349279,11 @@ class ConnectionController {
         throw new TableNotFoundError(`Table ${tablePath} not found`);
       }
       if (typeof source === "string") {
-        const prefix = `Error fetching schema for ${tablePath}: `;
-        const accessFailure = source.startsWith(prefix) ? databaseAccessFailure(new Error(source.slice(prefix.length))) : undefined;
+        if (source === `Table ${tablePath} not found`) {
+          throw new TableNotFoundError(source);
+        }
+        const driverMessage = lookupFailureDriverMessage(source, tablePath);
+        const accessFailure = driverMessage === undefined ? undefined : databaseAccessFailure(new Error(driverMessage));
         throw accessFailure ?? driverErrorToPublisherError(source);
       }
       return {
@@ -349376,6 +349562,16 @@ class ConnectionController {
     };
   }
 }
+function lookupFailureDriverMessage(source, tablePath) {
+  const prefix = `Error fetching schema for ${tablePath}: `;
+  if (source.startsWith(prefix))
+    return source.slice(prefix.length);
+  const sqlserverPrefix = `Error fetching schema for table ${tablePath}: `;
+  if (source.startsWith(sqlserverPrefix)) {
+    return source.slice(sqlserverPrefix.length).replace(/^\d+: /, "");
+  }
+  return;
+}
 
 // src/controller/report.controller.ts
 init_errors();
@@ -351499,7 +351695,7 @@ with both queries. Otherwise it is still \`NOT-RETURNED\` / \`LOW-RANK\`.
 Use when the entity was found and used, and the definition or the data behind it
 is wrong (bad grain, wrong join key, inverted filter). Owner: model. A doc whose
 factual claim the data contradicts (a population statement, a grain claim) is
-also model-definition: the SQL may be right while the stated contract is false,
+also model-definition: the field may compute correctly while its doc is false,
 and an agent that trusts the doc answers wrongly without ever failing a query.
 Probe the claim before writing the issue.
 
@@ -352213,7 +352409,7 @@ trusting a name that looks familiar, and write down the mapping you used in
 |---|---|---|
 | \`prompt\`, \`query\`, \`input\`, \`nl_question\` | the question | \`query\` is the trap: in half of these it is the SQL or Malloy they ran, not the question |
 | \`answer\`, \`expected\`, \`output\`, \`ground_truth\` | a golden value, prose, or both mixed in one string | a paragraph under \`answer\` is criteria, not a value. Classify it, do not store it as a number |
-| \`sql\`, \`malloy\`, \`gold_query\` | their derivation | run it (\`SKILL.md\` step 3). This is the field that upgrades a typed number into something checkable |
+| \`sql\`, \`malloy\`, \`gold_query\` | their derivation | Malloy: run it (\`SKILL.md\` step 3). SQL: keep it as evidence of how they got the number, but do not run it; derive the number in Malloy over the truth package instead. Either way, this is the field that upgrades a typed number into something checkable |
 | \`criteria\`, \`rubric\`, \`assertions\`, \`must_include\` | prose criteria | apply the query test in \`SKILL.md\` step 4 to EACH one, not to the field |
 | \`id\`, \`case_id\`, \`uuid\` | their id | keep it, prefixed. Two sets from one customer collide otherwise |
 | \`difficulty\`, \`category\`, \`tags\` | their own labels | keep as-is on the case for slicing. Never let one become \`split\` |
@@ -352376,7 +352572,7 @@ data with no question in front of them?* Reject:
 
 - a field that hard-codes this question's filter and serves no other question
 - this question's text, qid, or expected numbers in a doc, comment, or name
-- a join copied from gold SQL that you have not probed as a real relationship
+- a join copied from a golden's query that you have not probed as a real relationship
 
 The golden is a hypothesis source. The data is still the verifier.
 
@@ -352385,12 +352581,16 @@ The golden is a hypothesis source. The data is still the verifier.
 Every structural claim needs a query you ran: join key, primary key, filter
 value existence, snapshot assumption, value space, cardinality.
 
-\`\`\`sql
-SELECT COUNT(*), COUNT(DISTINCT col) FROM t;
-SELECT a.k, COUNT(*) FROM a JOIN b ON … GROUP BY 1 ORDER BY 2 DESC;
-SELECT col, COUNT(*) FROM t GROUP BY 1 ORDER BY 2 DESC LIMIT 5;
+\`\`\`malloy
+run: t -> { aggregate: row_count is count(), distinct_keys is count(col) }
+run: b -> { group_by: k; aggregate: n is count(); order_by: n desc; limit: 5 }
+run: t -> { group_by: col; aggregate: n is count(); order_by: n desc; limit: 5 }
 \`\`\`
 
+Run probes in Malloy, against the raw tables (the truth package, or a bare
+\`connection.table()\` source), never as SQL. The second line is the join probe:
+any \`n\` above 1 means \`k\` is not a key on \`b\`, so a \`join_one\` on it fans out.
+
 A false \`primary_key\` compiles and silently corrupts every aggregate. Of one
 pilot's 11 accepted edits, 4 of 5 wrong ones died to a single
 \`COUNT(*)\` vs \`COUNT(DISTINCT …)\` probe that was never run.
@@ -352735,7 +352935,7 @@ Output, exactly this shape:
    plainly the answer explained itself, and however the rubric is worded. Say
    in \`why\` that you are overriding a rubric clause, so the clause gets fixed.
    This rule exists because a set shipped one: a question asked for sales over
-   the company's season, the answer gave the meteorological window 25% lower
+   the company's season, the answer gave the meteorological window 20% lower
    and said which window it used, and a clause granting \`near_match\` for a
    stated window kept a materially wrong answer out of the pass rate
    entirely -- the arm reported 100%.
@@ -381478,7 +381678,7 @@ var storageServeRoutingCounter = lazyCounter4("publisher_storage_serve_routing_t
 var storageTableRetainedCounter = lazyCounter4("publisher_storage_tables_retained_total", "Tables a FAILED run left in a storage= destination and deliberately did not " + "reclaim, because the source is refreshed incrementally and the name may be " + "the one it serves from. Label: destination. Not all of these are orphans — " + "a rebuild at a fresh generational name is, a seed on the live serving name " + "is not, and the manifest entry cannot separate them — so read this as an " + "upper bound on what is accumulating rather than a leak count. It is the " + "only accounting there is until reclaiming a destination exists, which is " + "why it is a counter and not just a log line: the question is a rate, not " + "whether it ever happened.");
 var storageBuildFailureCounter = lazyCounter4("publisher_storage_build_failures_total", "storage= build failures (federation/passthrough/attach/CTAS), distinct from " + "in-warehouse build failures. Labels: destination (connection name), " + "reason ('build_failed'|'billed_read_not_captured'). The second is the " + "expensive one: the warehouse read ran and was charged, and the rows could " + "not be captured — so a re-drive pays for it again. Worth alerting on " + "separately from a failure that costs only a retry.");
 var attributionSkippedCounter = lazyCounter4("publisher_storage_build_attribution_skipped_total", "storage= builds whose warehouse read went out UNATTRIBUTED while tagging was " + "on. Label: reason ('job_listing_unavailable'|'tag_failed'|" + "'read_row_not_found'|'read_row_ambiguous'|'cost_query_failed'). " + "The read still ran and the " + "build still succeeded — what was lost is the label in the customer's own " + "query history, and the cost on this side. Without this an operator who " + "turns tagging on and sees nothing has a single log line to go on.");
-var eligibilityRefusedCounter = lazyCounter4("publisher_materialization_eligibility_refused_total", "materialization-eligibility refusals, both tiers. Label: reason " + "('free_parameter'|'given_in_persisted_query'|'dynamic_projection'|" + "'dynamic_join'|'dynamic_joined_where'|'partition_without_storage'|" + "'partition_column_unknown'|'partition_column_not_public'|" + "'merge_key_scope_unresolved'|'preaggregate_over_dynamic_source'|" + "'authorize'|'partition'|'not_duckdb_portable'|" + "'public_surface_unknown'). 'given' is retained on the enum for records " + "that carry it and is no longer produced: where a given sits decides the " + "outcome, so one reason covering every placement cannot be raised.");
+var eligibilityRefusedCounter = lazyCounter4("publisher_materialization_eligibility_refused_total", "materialization-eligibility refusals, both tiers. Label: reason " + "('free_parameter'|'given_in_persisted_query'|'dynamic_projection'|" + "'dynamic_join'|'dynamic_joined_where'|'partition_without_storage'|" + "'partition_column_unknown'|'partition_column_not_public'|" + "'merge_key_scope_unresolved'|'preaggregate_over_dynamic_source'|" + "'authorize'|'partition'|'not_duckdb_portable'|" + "'public_surface_unknown'|'read_only_dialect'). 'given' is retained on the enum for records " + "that carry it and is no longer produced: where a given sits decides the " + "outcome, so one reason covering every placement cannot be raised.");
 var serveShapeTierDropCounter = lazyCounter4("publisher_storage_serve_shape_tier_drop_total", "storage serve-shape compile escalations: a refinement tier failed to " + "compile and the riskiest category was dropped, or one or more lifted " + "entry points failed to compile and were dropped alone. Label: tier (the " + "failed tier index, 0=full; 'lifts' for dropped lifts).");
 var serveShapeTypeFallbackCounter = lazyCounter4("publisher_storage_serve_shape_type_fallback_total", "Captured DuckDB column types mapped to json in the serve shape (type " + "fidelity loss). Label: kind ('array'|'unrecognized').");
 var chainedStorageBuildCounter = lazyCounter4("publisher_storage_chained_build_total", "Chained storage= source builds (a source reading a storage-materialized " + "upstream). Label: outcome ('parent_reuse'|'inline_fallback'|" + "'strict_shape_fallback'|'strict_refused'|'infra_failure'). The " + "parent_reuse share is the headline signal for how far the " + "stack-on-the-parent path gets us vs recompute-from-raw.");
@@ -384511,7 +384711,16 @@ function assertMergeKeyScopeResolvable(persistSource, terms, annotationFields, w
     message: `${what} cannot be materialized: it declares 'merge_key=' and is ` + `scoped by a term this pass cannot express as a predicate over the ` + `stored table's own columns (${unscopable.map((term) => `'${term.code}'`).join(", ")}). An incremental refresh matches rows by the merge ` + `key, and the stored table holds every caller's rows, so the match ` + `must also carry the scoping columns or it would update rows ` + `belonging to other callers. Scope this source with a term over its ` + `own columns, or drop 'merge_key=' to refresh by watermark range.`
   });
 }
+var READ_ONLY_DIALECTS = new Set(["sqlserver"]);
 function assertColocatedPersistNotAuthorizeGated(persistSource, sourceName = persistSource.name, origin2 = "persist", gateOutcome, annotationFields = {}) {
+  if (!annotationFields.storage && READ_ONLY_DIALECTS.has(persistSource.dialectName)) {
+    recordEligibilityRefused("read_only_dialect");
+    const what2 = origin2 === "preaggregate" ? `Pre-aggregation rollup '${sourceName}'` : `Source '${sourceName}'`;
+    throw new MaterializationEligibilityError({
+      reason: "read_only_dialect",
+      message: `${what2} cannot be materialized (colocated '#@ persist'): its ` + `connection '${persistSource.connectionName}' is on the ` + `'${persistSource.dialectName}' dialect, whose connection is ` + `read-only and creates no tables, so there is nowhere in the ` + `source warehouse to write the result. The source serves live. ` + `Remove the annotation, or persist a source on a connection that ` + `can write.`
+    });
+  }
   const partition = resolvePartitionColumns(persistSource, annotationFields);
   if (!partition.ok) {
     recordEligibilityRefused(partition.reason);
@@ -394266,7 +394475,7 @@ ${query}`);
   }
 }
 // package.json
-var version2 = "0.9.11";
+var version2 = "0.9.12";
 
 // src/version.ts
 var SERVER_VERSION = version2;
@@ -400837,7 +401046,7 @@ function registerSearchDatabaseSchemaTool(mcpServer, environmentStore) {
     if (n === 0)
       return [];
     return [
-      `${n} table(s) have a path this server will not vouch for across every dialect it serves, so malloySource is omitted for them rather than risk a line that does not compile. Build it from tablePath: on your own dialect the path may work as-is, or may need the offending segment quoted. Double quotes on DuckDB, Postgres, Snowflake and Trino; backticks on MySQL, BigQuery and Databricks.`
+      `${n} table(s) have a path this server will not vouch for across every dialect it serves, so malloySource is omitted for them rather than risk a line that does not compile. Build it from tablePath: on your own dialect the path may work as-is, or may need the offending segment quoted. Double quotes on DuckDB, Postgres, Snowflake, Trino and SQL Server; backticks on MySQL, BigQuery and Databricks.`
     ];
   };
   const assertCanAdmit = async (environmentName) => {
@@ -406083,6 +406292,15 @@ function parseFrameAncestors(raw) {
   return raw.trim();
 }
 
+// src/service/experimental_dialects.ts
+import { getDialect } from "@malloydata/malloy";
+var BUNDLED_EXPERIMENTAL_DIALECTS = ["sqlserver"];
+function acceptBundledExperimentalDialects() {
+  for (const name of BUNDLED_EXPERIMENTAL_DIALECTS) {
+    getDialect(name).acceptExperimental();
+  }
+}
+
 // src/server.ts
 assertSupportedNodeVersion();
 function parseArgs() {
@@ -406158,6 +406376,7 @@ parseArgs();
 getPersistStorageMode();
 getPersistCollisionEnforce();
 getQueryMetadataMode();
+acceptBundledExperimentalDialects();
 var PUBLISHER_PORT = Number(process.env.PUBLISHER_PORT || 4000);
 var PUBLISHER_HOST = process.env.PUBLISHER_HOST || "0.0.0.0";
 var MCP_PORT = Number(process.env.MCP_PORT || 4040);

package/package.json

@@ -19,7 +19,7 @@
       "snowflake"
    ],
    "homepage": "https://docs.malloydata.dev/documentation/user_guides/publishing/mcp_agents",
-   "version": "0.9.11",
+   "version": "0.9.12",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"
@@ -70,6 +70,7 @@
       "@malloydata/db-postgres": "^0.0.435",
       "@malloydata/db-publisher": "^0.0.435",
       "@malloydata/db-snowflake": "^0.0.435",
+      "@malloydata/db-sqlserver": "^0.0.435",
       "@malloydata/db-trino": "^0.0.435",
       "@malloydata/malloy": "^0.0.435",
       "@malloydata/malloy-filter": "^0.0.435",

package/dist/app/assets/EnvironmentPage-tIGzymgb.js

@@ -1 +0,0 @@
-import{a as r,D as t,j as e,ab as i,aA as o}from"./index-gQEuz0Cg.js";function m(){const a=r(),{environmentName:n}=t();if(n){const s=i({environmentName:n});return e.jsx(o,{onSelectPackage:a,resourceUri:s})}else return e.jsx("div",{children:e.jsx("h2",{children:"Missing environment name"})})}export{m as default};

package/dist/app/assets/HomePage-7QkNvQ_3.js

@@ -1 +0,0 @@
-import{a as n,j as t,v as o}from"./index-gQEuz0Cg.js";function s(){const a=n();return t.jsx(o,{onClickEnvironment:a})}export{s as default};