@malloy-publisher/server 0.9.14 → 0.9.16

package/dist/app/index.html

@@ -16,7 +16,7 @@ SPDX-License-Identifier: MIT
          href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
       />
       <title>Malloy Publisher</title>
-     <script type="module" crossorigin src="/assets/index-B_gOHtqJ.js"></script>
+     <script type="module" crossorigin src="/assets/index-Dzz5PLbw.js"></script>
      <link rel="stylesheet" crossorigin href="/assets/index-DUqldpo0.css">
    </head>
    <body>

package/dist/instrumentation.mjs

@@ -167012,6 +167012,47 @@ var REQUEST_DURATION_BUCKETS_MS = [
   1e4,
   60000
 ];
+var instrumentResets = [];
+function lazyInstrument(create) {
+  let instrument = null;
+  instrumentResets.push(() => instrument = null);
+  return () => instrument ??= create();
+}
+function lazyCounter(name, description, unit) {
+  return lazyInstrument(() => publisherMeter().createCounter(name, {
+    description,
+    ...unit ? { unit } : {}
+  }));
+}
+function lazyHistogram(name, description, { unit = "ms", buckets } = {}) {
+  return lazyInstrument(() => publisherMeter().createHistogram(name, {
+    description,
+    ...unit ? { unit } : {},
+    ...buckets ? { advice: { explicitBucketBoundaries: buckets } } : {}
+  }));
+}
+var tracer = () => import_api.trace.getTracer(METER_NAME);
+async function withSpan(name, attributes, fn, spanTracer = tracer()) {
+  return spanTracer.startActiveSpan(name, { attributes }, async (span) => {
+    try {
+      return await fn(span);
+    } catch (error) {
+      span.recordException(error);
+      span.setStatus({
+        code: import_api.SpanStatusCode.ERROR,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  });
+}
+// package.json
+var version = "0.9.16";
+
+// src/version.ts
+var SERVER_VERSION = version;
 
 // src/instrumentation.ts
 var prometheusExporter = null;
@@ -167045,7 +167086,7 @@ function instrument() {
   sdk = new import_sdk_node.NodeSDK({
     resource: import_resources.resourceFromAttributes({
       [import_semantic_conventions.ATTR_SERVICE_NAME]: "publisher",
-      [import_semantic_conventions.ATTR_SERVICE_VERSION]: "1.0.0"
+      [import_semantic_conventions.ATTR_SERVICE_VERSION]: SERVER_VERSION
     }),
     autoDetectResources: true,
     metricReader: prometheusExporter,

package/dist/package_load_worker.mjs

@@ -12074,8 +12074,8 @@ var require_exception_handler = __commonJS((exports, module) => {
       };
     }
     getTrace(err) {
-      const trace = err ? stackTrace.parse(err) : stackTrace.get();
-      return trace.map((site) => {
+      const trace2 = err ? stackTrace.parse(err) : stackTrace.get();
+      return trace2.map((site) => {
         return {
           column: site.getColumnNumber(),
           file: site.getFileName(),
@@ -12241,8 +12241,8 @@ var require_rejection_handler = __commonJS((exports, module) => {
       };
     }
     getTrace(err) {
-      const trace = err ? stackTrace.parse(err) : stackTrace.get();
-      return trace.map((site) => {
+      const trace2 = err ? stackTrace.parse(err) : stackTrace.get();
+      return trace2.map((site) => {
         return {
           column: site.getColumnNumber(),
           file: site.getFileName(),
@@ -13024,32 +13024,7 @@ var init_logger = __esm(() => {
   SENSITIVE_KEYS = new Set(SENSITIVE_KEY_NAMES.map((name) => name.toLowerCase()));
 });
 
-// src/errors.ts
-import { MalloyError } from "@malloydata/malloy";
-function logInternalFailure(summary, error, level = "error") {
-  const strip = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
-  const message = error.message ?? "";
-  const stack = error.stack ?? "";
-  const framesOnly = stack.startsWith(`${error.name}: ${message}`) ? stack.slice(`${error.name}: ${message}`.length).replace(/^\r?\n/, "") : stack;
-  logger[level](summary, {
-    error: {
-      name: error.name,
-      message: strip(message).slice(0, MAX_LOGGED_DETAIL_CHARS),
-      stack: strip(framesOnly).slice(0, MAX_LOGGED_DETAIL_CHARS)
-    }
-  });
-}
-function filesystemAccessFailure(error) {
-  let current = error;
-  for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
-    const errno = current;
-    if (typeof errno.code === "string" && errno.code in FILESYSTEM_ACCESS_DESCRIPTIONS && typeof errno.syscall === "string") {
-      return errno;
-    }
-    current = errno.cause;
-  }
-  return;
-}
+// src/driver_errors.ts
 function isMysqlConfigFault(code) {
   return typeof code === "string" && (MYSQL_CONFIG_CODES.has(code) || code.startsWith("HANDSHAKE_"));
 }
@@ -13119,6 +13094,165 @@ function isCredentialRejection(error) {
   }
   return false;
 }
+var NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, SQLSERVER_CONNECTION_CODES, TLS_VERIFICATION_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SQLSERVER_AUTH_CODES, SNOWFLAKE_AUTH_CODES;
+var init_driver_errors = __esm(() => {
+  NODE_CONNECTION_CODES = new Set([
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ECONNABORTED",
+    "EPIPE",
+    "ETIMEDOUT",
+    "EAI_AGAIN",
+    "EHOSTUNREACH",
+    "ENETUNREACH"
+  ]);
+  POSTGRES_CONNECTION_SQLSTATE = /^(08[0-9A-Z]{3}|57P0[123])$/;
+  CODELESS_CONNECTION_MESSAGES = [
+    /^Connection terminated unexpectedly$/,
+    /^(Error: )?Can't add new command when connection is in closed state$/,
+    /^(Error: )?Connection lost: The server closed the connection\.$/,
+    new RegExp(`^(Error: )?(connect|read|write|getaddrinfo) (${[
+      ...NODE_CONNECTION_CODES
+    ].join("|")})\\b`),
+    /^Failed to connect to \S+( \(redirected from \S+\))?( in \d+ms| - (?!.*certificate).+)$/i
+  ];
+  MYSQL_CONFIG_CODES = new Set([
+    "ER_ACCESS_DENIED_ERROR",
+    "ER_BAD_DB_ERROR",
+    "ER_NOT_SUPPORTED_AUTH_MODE",
+    "AUTH_SWITCH_PLUGIN_ERROR",
+    "MYSQL_CLEAR_PASSWORD_NOT_ENABLED"
+  ]);
+  SQLSERVER_CONNECTION_CODES = new Set(["ESOCKET", "EINSTLOOKUP"]);
+  TLS_VERIFICATION_CODES = new Set([
+    "CERT_HAS_EXPIRED",
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "ERR_TLS_CERT_ALTNAME_INVALID",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "UNABLE_TO_GET_ISSUER_CERT",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
+  ]);
+  POSTGRES_AUTH_SQLSTATE = /^28[0-9A-Z]{3}$/;
+  MYSQL_AUTH_CODES = new Set(["ER_ACCESS_DENIED_ERROR"]);
+  SQLSERVER_AUTH_CODES = new Set(["ELOGIN"]);
+  SNOWFLAKE_AUTH_CODES = new Set(["390100", "390144", "390195", "390318"]);
+});
+
+// src/pg_helpers.ts
+function redactPgSecrets(s) {
+  return redactUserinfoPasswords(redactUserinfoPasswords(s, ANY_SCHEME_LAST_AT), PG_SCHEME_FIRST_AT).replace(/password=('(?:\\.|[^'\\])*'|"[^"]*"|\S+)/gi, "password=***");
+}
+function runEnd(run, s, from) {
+  run.lastIndex = from;
+  run.exec(s);
+  return run.lastIndex;
+}
+function redactUserinfoPasswords(s, pass) {
+  let out = "";
+  let copied = 0;
+  let stop = -1;
+  let sep = s.indexOf("://");
+  while (sep !== -1) {
+    const userEnd = runEnd(USERNAME_RUN, s, sep + 3);
+    let at = -1;
+    if (s[userEnd] === ":" && pass.hasScheme(s, sep, copied)) {
+      const from = userEnd + 1;
+      if (stop < from)
+        stop = runEnd(pass.passwordRun, s, from);
+      at = pass.passwordEnd(s, from, stop);
+    }
+    if (at === -1) {
+      sep = s.indexOf("://", sep + 1);
+      continue;
+    }
+    out += s.slice(copied, userEnd + 1) + "***@";
+    copied = at + 1;
+    sep = s.indexOf("://", copied);
+  }
+  return out + s.slice(copied);
+}
+function redactConnectionSecretShapes(s) {
+  return redactPgSecrets(s.replace(PEM_TERMINATED_PATTERN, "***").replace(PEM_UNTERMINATED_PATTERN, "***").replace(SECRET_QUOTED_PATTERN, "$1***").replace(SECRET_BARE_PATTERN, "$1***"));
+}
+var USERNAME_RUN, SCHEME_CHAR, SCHEME_LETTER, PG_SCHEMES, ANY_SCHEME_LAST_AT, PG_SCHEME_FIRST_AT, SECRET_FIELD_NAMES, NAME_ALTERNATION, SECRET_QUOTED_PATTERN, SECRET_BARE_PATTERN, PEM_TERMINATED_PATTERN, PEM_UNTERMINATED_PATTERN;
+var init_pg_helpers = __esm(() => {
+  USERNAME_RUN = /[^:/?#\s]*/y;
+  SCHEME_CHAR = /[a-z0-9+.-]/i;
+  SCHEME_LETTER = /[a-z]/i;
+  PG_SCHEMES = ["postgres", "postgresql"];
+  ANY_SCHEME_LAST_AT = {
+    hasScheme(s, sep, floor) {
+      for (let i = sep - 1;i >= floor && SCHEME_CHAR.test(s[i]); i--) {
+        if (SCHEME_LETTER.test(s[i]))
+          return true;
+      }
+      return false;
+    },
+    passwordRun: /[^/\s]*/y,
+    passwordEnd(s, from, stop) {
+      const at = s.slice(from, stop).lastIndexOf("@");
+      return at > 0 ? from + at : -1;
+    }
+  };
+  PG_SCHEME_FIRST_AT = {
+    hasScheme(s, sep, floor) {
+      return PG_SCHEMES.some((scheme) => sep - scheme.length >= floor && s.slice(sep - scheme.length, sep).toLowerCase() === scheme);
+    },
+    passwordRun: /[^@\s]*/y,
+    passwordEnd(s, from, stop) {
+      return stop > from && s[stop] === "@" ? stop : -1;
+    }
+  };
+  SECRET_FIELD_NAMES = [
+    "password",
+    "privateKey",
+    "privateKeyPass",
+    "serviceAccountKeyJson",
+    "accessToken",
+    "oauthClientSecret",
+    "clientSecret",
+    "secretAccessKey",
+    "sessionToken",
+    "peakaKey",
+    "sasUrl",
+    "connectionString",
+    "token",
+    "secret"
+  ];
+  NAME_ALTERNATION = SECRET_FIELD_NAMES.map((n) => n.replace(/([A-Z])/g, "[_-]?$1")).join("|");
+  SECRET_QUOTED_PATTERN = new RegExp(String.raw`(["']?(?:${NAME_ALTERNATION})["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')`, "gi");
+  SECRET_BARE_PATTERN = new RegExp(String.raw`(["']?(?:${NAME_ALTERNATION})["']?\s*=\s*)(?:[^,;\s}"']+)`, "gi");
+  PEM_TERMINATED_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----(?:(?!-----BEGIN )[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+  PEM_UNTERMINATED_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*$/;
+});
+
+// src/errors.ts
+import { MalloyError } from "@malloydata/malloy";
+function logInternalFailure(summary, error, level = "error") {
+  const strip = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
+  const message = error.message ?? "";
+  const stack = error.stack ?? "";
+  const framesOnly = stack.startsWith(`${error.name}: ${message}`) ? stack.slice(`${error.name}: ${message}`.length).replace(/^\r?\n/, "") : stack;
+  logger[level](summary, {
+    error: {
+      name: error.name,
+      message: redactPgSecrets(strip(message)).slice(0, MAX_LOGGED_DETAIL_CHARS),
+      stack: redactPgSecrets(strip(framesOnly)).slice(0, MAX_LOGGED_DETAIL_CHARS)
+    }
+  });
+}
+function filesystemAccessFailure(error) {
+  let current = error;
+  for (let depth = 0;depth < 8 && current instanceof Error; depth++) {
+    const errno = current;
+    if (typeof errno.code === "string" && errno.code in FILESYSTEM_ACCESS_DESCRIPTIONS && typeof errno.syscall === "string") {
+      return errno;
+    }
+    current = errno.cause;
+  }
+  return;
+}
 function databaseAccessFailure(error) {
   if (error instanceof ConnectionAuthError || error instanceof ConnectionFailedError || error instanceof UnconfiguredConnectionError) {
     return error;
@@ -13217,6 +13351,8 @@ function internalErrorToHttpError(error, { log = true, onLogged } = {}) {
     return httpError(404, error.message);
   } else if (error instanceof StorageDestinationNotFoundError) {
     return httpError(404, error.message);
+  } else if (error instanceof StorageCatalogNotFoundError) {
+    return httpError(404, error.message);
   } else if (error instanceof DestinationNotFoundError) {
     return httpError(422, error.message);
   } else if (error instanceof ConnectionAuthError) {
@@ -13284,56 +13420,17 @@ function toQueryTextProblem(problem) {
     ...problem.at ? { at: { range: problem.at.range } } : {}
   };
 }
-var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, NODE_CONNECTION_CODES, POSTGRES_CONNECTION_SQLSTATE, CODELESS_CONNECTION_MESSAGES, MYSQL_CONFIG_CODES, SQLSERVER_CONNECTION_CODES, TLS_VERIFICATION_CODES, POSTGRES_AUTH_SQLSTATE, MYSQL_AUTH_CODES, SQLSERVER_AUTH_CODES, SNOWFLAKE_AUTH_CODES, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, StorageDestinationNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
+var GENERIC_INTERNAL_MESSAGE = "Internal server error.", GENERIC_UPSTREAM_MESSAGE = "Upstream connection error.", GENERIC_UNREACHABLE_MESSAGE = "The database connection is down: the database could not be reached, so the query did not run.", GENERIC_AUTH_MESSAGE = "The database rejected the connection's credentials. Check the connection's user, password, key or token.", MAX_LOGGED_DETAIL_CHARS = 2000, FILESYSTEM_ACCESS_DESCRIPTIONS, POSTGRES_STATEMENT_SQLSTATES, POSTGRES_UNDEFINED_TABLE = "42P01", POSTGRES_RELATION_MISSING, NotImplementedError, BadRequestError, InvalidArgumentError, CompileRefusedError, InvalidModelPathError, RenderTagRefusedError, UnparseableTextError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, DashboardNotFoundError, SkillNotFoundError, AgentNotFoundError, ConflictError, ConnectionNotFoundError, TableNotFoundError, ConnectionError, ConnectionFailedError, UnconfiguredConnectionError, ConnectionPoolExhaustedError, DestinationNotFoundError, StorageDestinationNotFoundError, StorageCatalogNotFoundError, ConnectionAuthError, UnsupportedCatalogFormatError, ModelCompilationError, PackageManifestError, MaterializationEligibilityError, ChainedUpstreamMissingError, ChainedShapeNotCarriedError, PublisherConfigError, ServerConfigurationError, FrozenConfigError, AccessDeniedError, QueryCompileError, NotQueryableError, OffSurfaceError, MaterializationNotFoundError, MaterializationConflictError, WriteConflictError, WriteRolledBackError, WriteRollbackFailedError, WriteVerifyError, InvalidStateTransitionError, ServiceUnavailableError, PackageAdmissionRefusedError, PayloadTooLargeError, ResponseUnserializableError, QueryTimeoutError;
 var init_errors = __esm(() => {
   init_constants();
   init_logger();
+  init_driver_errors();
+  init_pg_helpers();
   FILESYSTEM_ACCESS_DESCRIPTIONS = {
     EACCES: "permission denied",
     EPERM: "operation not permitted",
     EROFS: "read-only file system"
   };
-  NODE_CONNECTION_CODES = new Set([
-    "ECONNREFUSED",
-    "ECONNRESET",
-    "ECONNABORTED",
-    "EPIPE",
-    "ETIMEDOUT",
-    "EAI_AGAIN",
-    "EHOSTUNREACH",
-    "ENETUNREACH"
-  ]);
-  POSTGRES_CONNECTION_SQLSTATE = /^(08[0-9A-Z]{3}|57P0[123])$/;
-  CODELESS_CONNECTION_MESSAGES = [
-    /^Connection terminated unexpectedly$/,
-    /^(Error: )?Can't add new command when connection is in closed state$/,
-    /^(Error: )?Connection lost: The server closed the connection\.$/,
-    new RegExp(`^(Error: )?(connect|read|write|getaddrinfo) (${[
-      ...NODE_CONNECTION_CODES
-    ].join("|")})\\b`),
-    /^Failed to connect to \S+( \(redirected from \S+\))?( in \d+ms| - (?!.*certificate).+)$/i
-  ];
-  MYSQL_CONFIG_CODES = new Set([
-    "ER_ACCESS_DENIED_ERROR",
-    "ER_BAD_DB_ERROR",
-    "ER_NOT_SUPPORTED_AUTH_MODE",
-    "AUTH_SWITCH_PLUGIN_ERROR",
-    "MYSQL_CLEAR_PASSWORD_NOT_ENABLED"
-  ]);
-  SQLSERVER_CONNECTION_CODES = new Set(["ESOCKET", "EINSTLOOKUP"]);
-  TLS_VERIFICATION_CODES = new Set([
-    "CERT_HAS_EXPIRED",
-    "DEPTH_ZERO_SELF_SIGNED_CERT",
-    "ERR_TLS_CERT_ALTNAME_INVALID",
-    "SELF_SIGNED_CERT_IN_CHAIN",
-    "UNABLE_TO_GET_ISSUER_CERT",
-    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
-    "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
-  ]);
-  POSTGRES_AUTH_SQLSTATE = /^28[0-9A-Z]{3}$/;
-  MYSQL_AUTH_CODES = new Set(["ER_ACCESS_DENIED_ERROR"]);
-  SQLSERVER_AUTH_CODES = new Set(["ELOGIN"]);
-  SNOWFLAKE_AUTH_CODES = new Set(["390100", "390144", "390195", "390318"]);
   POSTGRES_STATEMENT_SQLSTATES = new Set([
     "42601",
     "42703",
@@ -13463,6 +13560,11 @@ var init_errors = __esm(() => {
       super(message);
     }
   };
+  StorageCatalogNotFoundError = class StorageCatalogNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
   ConnectionAuthError = class ConnectionAuthError extends Error {
     constructor(message) {
       super(message);
@@ -20352,16 +20454,49 @@ var REQUEST_DURATION_BUCKETS_MS = [
   1e4,
   60000
 ];
+var instrumentResets = [];
+function lazyInstrument(create) {
+  let instrument = null;
+  instrumentResets.push(() => instrument = null);
+  return () => instrument ??= create();
+}
+function lazyCounter(name, description, unit) {
+  return lazyInstrument(() => publisherMeter().createCounter(name, {
+    description,
+    ...unit ? { unit } : {}
+  }));
+}
+function lazyHistogram(name, description, { unit = "ms", buckets } = {}) {
+  return lazyInstrument(() => publisherMeter().createHistogram(name, {
+    description,
+    ...unit ? { unit } : {},
+    ...buckets ? { advice: { explicitBucketBoundaries: buckets } } : {}
+  }));
+}
+var tracer = () => import_api.trace.getTracer(METER_NAME);
+async function withSpan(name, attributes, fn, spanTracer = tracer()) {
+  return spanTracer.startActiveSpan(name, { attributes }, async (span) => {
+    try {
+      return await fn(span);
+    } catch (error) {
+      span.recordException(error);
+      span.setStatus({
+        code: import_api.SpanStatusCode.ERROR,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  });
+}
 
 // src/deprecated_usage_metrics.ts
-var counter = null;
+var counter = lazyCounter("publisher_deprecated_usage_total", "Uses of a deprecated feature: a request to a legacy route or carrying a legacy parameter, or a package load or reload that uses one. Labels: feature.");
 function recordDeprecatedUsage(feature, count = 1) {
   if (count <= 0)
     return;
-  counter ??= publisherMeter().createCounter("publisher_deprecated_usage_total", {
-    description: "Uses of a deprecated feature: a request to a legacy route or carrying a legacy parameter, or a package load or reload that uses one. Labels: feature."
-  });
-  counter.add(count, { feature });
+  counter().add(count, { feature });
 }
 
 // src/service/deprecated/manifest_keys.ts
@@ -21826,50 +21961,32 @@ ${rewrites}
 }
 
 // src/authorize_metrics.ts
-var guardRejectionCounter = null;
-var bypassCounter = null;
-var rowLevelDecisionCounter = null;
-var rowLevelRejectionCounter = null;
-var admitAllCounter = null;
-var lockDecisionCounter = null;
+var guardRejectionCounter = lazyCounter("publisher_authorize_guard_rejected_total", "Requests rejected with 400 for declaring an `#(authorize)` annotation in caller-submitted Malloy text. Labels: field ('query'|'source_name'|'query_name'|'compile_source'), match ('lexed' when Malloy's lexer placed a tag outside prose, 'whole_text' when the text could not be lexed cleanly or is a name, 'no_lexer' when Malloy's parser failed to load so every prose-bearing text refuses).");
+var bypassCounter = lazyCounter("publisher_authorize_bypass_total", "Gate evaluations skipped because the request carried an authorize bypass (private data-management path). Label: entry_point ('source'|'runnable'). Any nonzero value on a path that should not use the bypass is a finding — see the paired `authorize bypass` audit log line for org/package/model/source.");
+var rowLevelDecisionCounter = lazyCounter("publisher_authorize_row_level_total", "How a row-level `#(access_filter)` gate resolved a request. Labels: decision ('denied_by_gate'|'empty_after_filter'), site ('entry_point'|'caller_join'). 'denied_by_gate' is the fail-closed refusal when the gate could not be applied; 'empty_after_filter' is a successful response with zero rows after the filter matched none, which is NOT an error. site says whether the gate was the query's own run target or a source the caller's text joined.");
+var rowLevelRejectionCounter = lazyCounter("publisher_authorize_row_level_rejected_total", "Row-level `#(access_filter)` gates that were refused, warned about, or could not be resolved. Label: cause (" + ROW_LEVEL_GATE_REJECTION_CAUSES.map((c) => `'${c}'`).join("|") + "). Only 'legacy_string_gate' fails the whole model load. 'entry_point_unexpressible', 'source_line_gate_no_given_reference' and 'source_line_gate_negated_membership' warn at load and leave the model servable. 'unreachable_given', 'given_usage_unresolvable' and 'unclassifiable_condition' are request-time only — that entry point denies every request. Alert on any nonzero value since the last publish; the request-time causes also make this a rate signal, so see the doc above before writing an alert.");
+var admitAllCounter = lazyCounter("publisher_authorize_admit_all_total", "Sources declaring their OWN unconditional admit-all gate (`#(authorize) true`), counted once each at package load. Label: route (" + CANONICAL_AUTHORIZE_ROUTES.map((r) => `'${r}'`).join("|") + "). Not an error — `true` is the only spelling for an extension that deliberately re-opens a gated base — but it is the one declaration that turns a gate off, so a jump since the last publish is worth a look.");
+var lockDecisionCounter = lazyCounter("publisher_authorize_lock_total", "How a `#(authorize)` lock resolved a request. Labels: decision ('admitted'|'denied_by_lock'|'denied_unresolvable'), site ('entry_point'|'caller_join'). Both denials are a 403; 'denied_by_lock' is the gate refusing a caller it does not admit (routine), 'denied_unresolvable' is the fail-closed refusal when the gate could not be decided at all. site says whether the lock was on the query's own run target or on a source the caller's text joined.");
 function recordAuthorizeGuardRejection(field) {
-  guardRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_guard_rejected_total", {
-    description: "Requests rejected with 400 for declaring an `#(authorize)` annotation in caller-submitted Malloy text. Labels: field ('query'|'source_name'|'query_name'|'compile_source'), match ('lexed' when Malloy's lexer placed a tag outside prose, 'whole_text' when the text could not be lexed cleanly or is a name, 'no_lexer' when Malloy's parser failed to load so every prose-bearing text refuses)."
-  });
-  guardRejectionCounter.add(1, {
+  guardRejectionCounter().add(1, {
     field,
     match: lastCallerGuardRefusalKind()
   });
 }
 function recordAuthorizeBypass(entryPoint) {
-  bypassCounter ??= publisherMeter().createCounter("publisher_authorize_bypass_total", {
-    description: "Gate evaluations skipped because the request carried an authorize bypass (private data-management path). Label: entry_point ('source'|'runnable'). Any nonzero value on a path that should not use the bypass is a finding — see the paired `authorize bypass` audit log line for org/package/model/source."
-  });
-  bypassCounter.add(1, { entry_point: entryPoint });
+  bypassCounter().add(1, { entry_point: entryPoint });
 }
 function recordRowLevelGateDecision(decision, site = "entry_point") {
-  rowLevelDecisionCounter ??= publisherMeter().createCounter("publisher_authorize_row_level_total", {
-    description: "How a row-level `#(access_filter)` gate resolved a request. Labels: decision ('denied_by_gate'|'empty_after_filter'), site ('entry_point'|'caller_join'). 'denied_by_gate' is the fail-closed refusal when the gate could not be applied; 'empty_after_filter' is a successful response with zero rows after the filter matched none, which is NOT an error. site says whether the gate was the query's own run target or a source the caller's text joined."
-  });
-  rowLevelDecisionCounter.add(1, { decision, site });
+  rowLevelDecisionCounter().add(1, { decision, site });
 }
 function recordRowLevelGateRejected(cause) {
-  rowLevelRejectionCounter ??= publisherMeter().createCounter("publisher_authorize_row_level_rejected_total", {
-    description: "Row-level `#(access_filter)` gates that were refused, warned about, or could not be resolved. Label: cause (" + ROW_LEVEL_GATE_REJECTION_CAUSES.map((c) => `'${c}'`).join("|") + "). Only 'legacy_string_gate' fails the whole model load. 'entry_point_unexpressible', 'source_line_gate_no_given_reference' and 'source_line_gate_negated_membership' warn at load and leave the model servable. 'unreachable_given', 'given_usage_unresolvable' and 'unclassifiable_condition' are request-time only — that entry point denies every request. Alert on any nonzero value since the last publish; the request-time causes also make this a rate signal, so see the doc above before writing an alert."
-  });
-  rowLevelRejectionCounter.add(1, { cause });
+  rowLevelRejectionCounter().add(1, { cause });
 }
 function recordAuthorizeAdmitAllGate(route) {
-  admitAllCounter ??= publisherMeter().createCounter("publisher_authorize_admit_all_total", {
-    description: "Sources declaring their OWN unconditional admit-all gate (`#(authorize) true`), counted once each at package load. Label: route (" + CANONICAL_AUTHORIZE_ROUTES.map((r) => `'${r}'`).join("|") + "). Not an error — `true` is the only spelling for an extension that deliberately re-opens a gated base — but it is the one declaration that turns a gate off, so a jump since the last publish is worth a look."
-  });
-  admitAllCounter.add(1, { route });
+  admitAllCounter().add(1, { route });
 }
 function recordLockDecision(decision, site = "entry_point") {
-  lockDecisionCounter ??= publisherMeter().createCounter("publisher_authorize_lock_total", {
-    description: "How a `#(authorize)` lock resolved a request. Labels: decision ('admitted'|'denied_by_lock'|'denied_unresolvable'), site ('entry_point'|'caller_join'). Both denials are a 403; 'denied_by_lock' is the gate refusing a caller it does not admit (routine), 'denied_unresolvable' is the fail-closed refusal when the gate could not be decided at all. site says whether the lock was on the query's own run target or on a source the caller's text joined."
-  });
-  lockDecisionCounter.add(1, { decision, site });
+  lockDecisionCounter().add(1, { decision, site });
 }
 
 // src/data_styles.ts
@@ -24003,25 +24120,11 @@ function acceptBundledExperimentalDialects() {
 }
 
 // src/materialization_metrics.ts
-var resetHooks = [];
-function lazyCounter(name, description) {
-  let instrument = null;
-  resetHooks.push(() => instrument = null);
-  return () => instrument ??= publisherMeter().createCounter(name, { description });
-}
-function lazyHistogram(name, description, unit) {
-  let instrument = null;
-  resetHooks.push(() => instrument = null);
-  return () => instrument ??= publisherMeter().createHistogram(name, {
-    description,
-    unit
-  });
-}
 var runCounter = lazyCounter("publisher_materialization_runs_total", "Materialization builds completed. Labels: mode ('auto'|'orchestrated'), outcome ('success'|'partial'|'failed'|'cancelled').");
-var runDuration = lazyHistogram("publisher_materialization_run_duration_ms", "Wall-clock duration of a materialization build. Label: mode ('auto'|'orchestrated').", "ms");
+var runDuration = lazyHistogram("publisher_materialization_run_duration_ms", "Wall-clock duration of a materialization build. Label: mode ('auto'|'orchestrated').");
 var sourcesCounter = lazyCounter("publisher_materialization_sources_total", "Persist sources processed by a materialization run. Labels: outcome ('built'|'reused'|'failed'|'refused'), mode ('auto'|'orchestrated').");
 var incrementalStepCounter = lazyCounter("publisher_materialization_incremental_step_total", 'Refreshes of a source declared refresh="incremental". Labels: step ' + "('delta'|'seed'|'skip'), and for seed/skip a bounded reason code " + "(IncrementalStepReasonCode). A 'seed' is a full rebuild the delta path " + "declined, so a rising seed rate means the feature is not engaging — and " + "the reason label says why without a log dive.");
-var buildPlanComputeDuration = lazyHistogram("publisher_materialization_build_plan_compute_duration_ms", "Wall-clock duration of compiling a package's build plan (Package.buildPlan).", "ms");
+var buildPlanComputeDuration = lazyHistogram("publisher_materialization_build_plan_compute_duration_ms", "Wall-clock duration of compiling a package's build plan (Package.buildPlan).");
 var buildPlanComputeFailedCounter = lazyCounter("publisher_materialization_build_plan_compute_failed_total", "Package loads whose build plan failed to compute. The ROOT-CAUSE signal for " + "colocated_bind_dropped{reason='build_plan_unavailable'}, which fires only " + "per dropped entry per load -- a package that loads once and is never " + "reloaded ticks that counter once and then sits with its colocated tier " + "off and a flat total, indistinguishable from healthy.");
 var autoLoadCounter = lazyCounter("publisher_materialization_auto_load_total", "Auto-run manifest auto-load attempts. Label: outcome ('success'|'failure').");
 var connectionDigestSkipCounter = lazyCounter("publisher_materialization_connection_digest_skipped_total", "Connection digests skipped during build-plan compile because the connection did not resolve.");
@@ -24030,7 +24133,7 @@ var manifestBindDegradedCounter = lazyCounter("publisher_materialization_manifes
 var duplicateTargetSkipCounter = lazyCounter("publisher_materialization_duplicate_target_skipped_total", "Sources skipped because the physical table they name was already built in " + "this run. Ordinary for a package that extends a persisted source; a " + "rising count against a package with no extension means the plan is " + "enumerating one table under more names than expected.");
 var sharedAddressInstructionCounter = lazyCounter("publisher_materialization_shared_address_instructions_total", "Content addresses that arrived with more than one instruction naming a " + "DIFFERENT physical table. The host minted a table per source where " + "several sources share one artifact. With a sourceID on each instruction " + "every table is built and only one is recorded, so the rest are orphaned; " + "without one the last instruction wins and the earlier names are never " + "built. Wasteful, not wrong — the table's CONTENT is the same either way.");
 var tableCollisionCounter = lazyCounter("publisher_materialization_table_collision_total", "Two definitions with DIFFERENT content addresses materializing into ONE " + "physical table. Each build overwrites the other's rows while both " + "addresses resolve to the table at serve time, so a query is answered " + "from another source's data. A wrong answer, not wasted work — page on " + "this one. Refused instead of counted-and-continued when " + "PERSIST_COLLISION_ENFORCE is set, so a non-zero rate here is also the " + "measure of what flipping that flag would start refusing.");
-var sourceBuildDuration = lazyHistogram("publisher_materialization_source_build_duration_ms", "Wall-clock duration of building a single persist source.", "ms");
+var sourceBuildDuration = lazyHistogram("publisher_materialization_source_build_duration_ms", "Wall-clock duration of building a single persist source.");
 var dropTablesCounter = lazyCounter("publisher_materialization_drop_tables_total", "Physical tables dropped on delete. Label: outcome ('success'|'failure').");
 var scheduledFireCounter = lazyCounter("publisher_materialization_scheduled_fires_total", "Standalone-scheduler attempts to fire a package's materialization.schedule. " + "Label: outcome ('fired'|'conflict'|'error').");
 var storageServeRoutingCounter = lazyCounter("publisher_storage_serve_routing_total", "storage= serve routing decisions. Label: outcome ('storage'|'live_fallback'|" + "'runtime_live_fallback'|'blocked_by_row_level_gate'). Covers the storage= " + "tier only; a colocated #@ persist hit is in neither the numerator nor the " + "denominator. NOTE 'live_fallback' here means the transform was INELIGIBLE, " + "which QueryResult.servedFrom reports as null - that field's " + "'live_fallback' is this counter's 'runtime_live_fallback'.");
@@ -25295,7 +25398,7 @@ function unboundParameterNames(persistSource) {
   }
   return unbound;
 }
-var MAX_GIVEN_WALK_DEPTH = 200;
+var MAX_AUTHORIZE_WALK_DEPTH = 200;
 function referencesAuthorize(persistSource) {
   try {
     return walkForAuthorize(persistSource._sourceDef, new WeakSet, 0);
@@ -25311,7 +25414,7 @@ function isAuthorizeAnnotation(text) {
   }
 }
 function walkForAuthorize(node, seen, depth) {
-  if (depth > MAX_GIVEN_WALK_DEPTH) {
+  if (depth > MAX_AUTHORIZE_WALK_DEPTH) {
     throw new Error("authorize-usage walk exceeded max depth");
   }
   if (node === null || typeof node !== "object")
@@ -25359,7 +25462,7 @@ function isAuthorizeAttributedToEntryPoint(persistSource) {
   }
 }
 function walkForAuthorizeNotes(node, seen, depth, found, crossJoins) {
-  if (depth > MAX_GIVEN_WALK_DEPTH) {
+  if (depth > MAX_AUTHORIZE_WALK_DEPTH) {
     throw new Error("authorize-usage walk exceeded max depth");
   }
   if (node === null || typeof node !== "object")