@malloydata/malloy-tests 0.0.433 → 0.0.435

package/mysql/mysql_start.sh

@@ -4,11 +4,31 @@ set -e
 rm -rf .tmp
 mkdir .tmp
 
-# run docker
 SCRIPTDIR=$(cd $(dirname $0); pwd)
-DATADIR=$(dirname $SCRIPTDIR)/data/mysql
 CONTAINER_NAME="mysql-malloy"
 
+# The image starts mysqld twice: a temporary server to initialize the data
+# directory, listening on the unix socket only, and then the real server on
+# 3306. Both log "mysqld: ready for connections", so the log cannot say which
+# one is up. Wait on a TCP connection, which is what the loader needs.
+wait_for_mysql() {
+  local counter=0
+  echo -n "Waiting for $CONTAINER_NAME ..."
+  until docker exec "$CONTAINER_NAME" mysqladmin ping --protocol=TCP -h127.0.0.1 -uroot --silent > /dev/null 2>&1
+  do
+    counter=$((counter+1))
+    # give up after 2 minutes
+    if [ $counter -eq 60 ]
+    then
+      echo
+      return 1
+    fi
+    echo -n .
+    sleep 2
+  done
+  echo
+}
+
 # Check for existing container
 if docker container inspect "$CONTAINER_NAME" > /dev/null 2>&1; then
   if [ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME")" = "true" ]; then
@@ -17,39 +37,25 @@ if docker container inspect "$CONTAINER_NAME" > /dev/null 2>&1; then
   fi
   echo "Restarting existing $CONTAINER_NAME container..."
   docker start "$CONTAINER_NAME"
-  while ! docker logs "$CONTAINER_NAME" 2>&1 | grep -q "mysqld: ready for connections"; do
-    sleep 2
-  done
+  if ! wait_for_mysql; then
+    docker logs "$CONTAINER_NAME" >& ./.tmp/mysql-malloy.logs
+    echo "MySQL did not restart successfully, check .tmp/mysql-malloy.logs"
+    exit 1
+  fi
   echo "MySQL running on port 3306"
   exit 0
 fi
 
-docker run -p 3306:3306 -d -v $DATADIR:/init_data --name "$CONTAINER_NAME" -e MYSQL_ALLOW_EMPTY_PASSWORD=yes -d mysql:8.4.2
-
-# wait for server to start
-counter=0
-echo -n Starting Docker ...
-while ! docker logs "$CONTAINER_NAME" 2>&1 | grep -q "mysqld: ready for connections"
-do
-  sleep 10
-  counter=$((counter+1))
-  # if doesn't start after 2 minutes, output logs and kill process
-  if [ $counter -eq 120 ]
-  then
-    docker logs "$CONTAINER_NAME" >& ./.tmp/mysql-malloy.logs
-    docker rm -f "$CONTAINER_NAME"
-    echo "MySQL did not start successfully, check .tmp/mysql-malloy.logs"
-    exit 1
-    break
-  fi
-  echo -n ...
-done
+docker run -p 3306:3306 -d --name "$CONTAINER_NAME" -e MYSQL_ALLOW_EMPTY_PASSWORD=yes mysql:8.4.2
+
+if ! wait_for_mysql; then
+  docker logs "$CONTAINER_NAME" >& ./.tmp/mysql-malloy.logs
+  docker rm -f "$CONTAINER_NAME"
+  echo "MySQL did not start successfully, check .tmp/mysql-malloy.logs"
+  exit 1
+fi
 
-# load the test data.
-echo
 echo Loading Test Data
-docker exec "$CONTAINER_NAME" cp /init_data/malloytest.mysql.gz /tmp
-docker exec "$CONTAINER_NAME" gunzip /tmp/malloytest.mysql.gz
-docker exec "$CONTAINER_NAME" mysql -P3306 -h127.0.0.1 -uroot -e 'drop database if exists malloytest; create database malloytest; use malloytest; source /tmp/malloytest.mysql;'
+MYSQL_HOST=127.0.0.1 MYSQL_PORT=3306 MYSQL_USER=root sh "$SCRIPTDIR/load_test_data.sh"
 
 echo "MySQL running on port 3306"

package/package.json

@@ -14,21 +14,22 @@
   "scripts": {
     "lint": "eslint '**/*.ts{,x}'",
     "lint-fix": "eslint '**/*.ts{,x}' --fix",
-    "test": "jest --config=../jest.config.js",
+    "test": "echo 'Read the Testing section of the repo-root CONTEXT.md for information on testing in this monorepo'; exit 1",
     "build": "node ../node_modules/typescript/bin/tsc --build",
     "clean": "node ../node_modules/typescript/bin/tsc --build --clean && rm -f tsconfig.tsbuildinfo",
     "malloyc": "ts-node ../scripts/malloy-to-json"
   },
   "dependencies": {
-    "@malloydata/db-bigquery": "0.0.433",
-    "@malloydata/db-duckdb": "0.0.433",
-    "@malloydata/db-postgres": "0.0.433",
-    "@malloydata/db-snowflake": "0.0.433",
-    "@malloydata/db-trino": "0.0.433",
-    "@malloydata/malloy": "0.0.433",
-    "@malloydata/malloy-tag": "0.0.433",
-    "@malloydata/render": "0.0.433",
-    "@malloydata/render-validator": "0.0.433",
+    "@malloydata/db-bigquery": "0.0.435",
+    "@malloydata/db-duckdb": "0.0.435",
+    "@malloydata/db-postgres": "0.0.435",
+    "@malloydata/db-snowflake": "0.0.435",
+    "@malloydata/db-sqlserver": "0.0.435",
+    "@malloydata/db-trino": "0.0.435",
+    "@malloydata/malloy": "0.0.435",
+    "@malloydata/malloy-tag": "0.0.435",
+    "@malloydata/render": "0.0.435",
+    "@malloydata/render-validator": "0.0.435",
     "events": "^3.3.0",
     "jsdom": "^22.1.0",
     "luxon": "^3.7.2",
@@ -42,5 +43,5 @@
   "overrides": {
     "typescript": "^6.0.3"
   },
-  "version": "0.0.433"
+  "version": "0.0.435"
 }

package/postgres/load_test_data.sh

@@ -0,0 +1,12 @@
+#! /bin/bash
+#
+# Load the malloytest tables into a running postgres from
+# test/data/malloytest-parquet. Connects with the PG* variables.
+#
+set -e
+
+SCRIPTDIR=$(cd $(dirname $0); pwd)
+ROOTDIR=$(cd "$SCRIPTDIR/../.."; pwd)
+
+cd "$ROOTDIR"
+npx ts-node test/postgres/load_test_data.ts

package/postgres/load_test_data.ts

@@ -0,0 +1,34 @@
+/*
+ * Copyright Contributors to the Malloy project
+ * SPDX-License-Identifier: MIT
+ */
+
+/* eslint-disable no-console */
+
+/*
+ * Load the malloytest tables into a running postgres from the parquet files.
+ * Connects the way psql and the postgres test connection do, through libpq's
+ * PG* variables, which the extension reads when the attach string is empty.
+ */
+
+import {
+  loadExtension,
+  loadMalloytest,
+  openDuckDB,
+} from '../data/parquet_loader';
+
+(async () => {
+  const db = await openDuckDB();
+  await loadExtension(db, 'postgres');
+  await db.run("ATTACH '' AS pg (TYPE postgres)");
+  // The sampling tests use TABLESAMPLE SYSTEM_ROWS
+  await db.run(
+    "CALL postgres_execute('pg', 'CREATE EXTENSION IF NOT EXISTS tsm_system_rows')"
+  );
+  console.log('Loading malloytest into postgres');
+  await loadMalloytest(db, 'pg.malloytest', {
+    // Postgres has no anonymous record type for the nested columns
+    skip: ['ga_sample'],
+  });
+  await db.close();
+})();

package/postgres/postgres_start.sh

@@ -7,9 +7,7 @@ set -e
 rm -rf .tmp
 mkdir .tmp
 
-# run docker
 SCRIPTDIR=$(cd $(dirname $0); pwd)
-DATADIR=$(dirname $SCRIPTDIR)/data/postgres
 
 # Verify required environment variables and show export commands for any that are wrong
 EXPORTS=""
@@ -55,7 +53,7 @@ if docker container inspect "$CONTAINER_NAME" > /dev/null 2>&1; then
   exit 0
 fi
 
-docker run -p 5432:5432 -d -v $DATADIR:/init_data \
+docker run -p 5432:5432 -d \
  --name "$CONTAINER_NAME" \
   -e POSTGRES_USER=root -e POSTGRES_PASSWORD=postgres \
   -e TZ=UTC \
@@ -74,8 +72,6 @@ done
 echo "Container $CONTAINER_NAME is now healthy!"
 
 echo "Loading data ..."
-#  configure
-echo CREATE EXTENSION tsm_system_rows\; | psql
-gunzip -c ${DATADIR}/malloytest-postgres.sql.gz | psql
+sh "$SCRIPTDIR/load_test_data.sh"
 
 echo "Ready"

package/presto/Dockerfile.slim

@@ -1,11 +1,13 @@
 # Slim Presto image for Malloy CI testing
 #
-# This image is ~850MB vs ~9GB for the official prestodb/presto image.
-# It includes only what's needed to run Presto with the BigQuery connector.
+# This image is ~1.4GB vs ~9GB for the official prestodb/presto image.
+# It includes only what's needed to run Presto with the hive connector, which
+# serves the test parquet (see hive.properties), and the CLI that creates the
+# tables.
 #
 # How this was created:
 # 1. The official prestodb/presto:0.287 image contains 42 connector plugins (~2GB)
-#    but we only need presto-bigquery (~36MB)
+#    but we only need hive-hadoop2 (~306MB)
 # 2. We use eclipse-temurin as the base because:
 #    - Presto requires Java 11 (not newer - tested, Java 17 fails with classloading errors)
 #    - Presto requires full JDK (not JRE - needs com.sun.tools.attach classes)
@@ -18,7 +20,7 @@
 #
 # Size comparison (as of 0.287):
 #   Official image: 9.11 GB
-#   This slim image: ~850 MB
+#   This slim image: ~1.4 GB
 
 ARG PRESTO_VERSION=0.287
 
@@ -39,8 +41,12 @@ COPY --from=presto-official /opt/presto-server/lib /opt/presto-server/lib
 COPY --from=presto-official /opt/presto-server/bin /opt/presto-server/bin
 COPY --from=presto-official /opt/presto-server/etc /opt/presto-server/etc
 
-# Copy only BigQuery plugin (the only connector we use for testing)
-COPY --from=presto-official /opt/presto-server/plugin/presto-bigquery /opt/presto-server/plugin/presto-bigquery
+# Copy only the hive plugin (the only connector we use for testing)
+COPY --from=presto-official /opt/presto-server/plugin/hive-hadoop2 /opt/presto-server/plugin/hive-hadoop2
+
+# The CLI, which presto_start.sh uses to create the tables
+COPY --from=presto-official /opt/presto-cli /opt/presto-cli
+RUN ln -s /opt/presto-cli /usr/local/bin/presto-cli
 
 EXPOSE 8080
 

package/presto/hive.properties

@@ -0,0 +1,8 @@
+# The hive catalog serves test/data/malloytest-parquet, mounted read-only
+# under /data/malloytest, with the tables hive_ddl.ts declares. The file
+# metastore lives inside the container.
+connector.name=hive-hadoop2
+hive.metastore=file
+hive.metastore.catalog.dir=file:///tmp/hive-metastore
+# Match parquet columns by name; presto's default is by position
+hive.parquet.use-column-names=true

package/presto/presto_start.sh

@@ -1,10 +1,19 @@
 #! /bin/bash
-
+#
+# Start a presto container whose hive catalog serves test/data/malloytest-parquet
+# as the malloytest schema. The parquet is read in place; nothing is loaded.
+#
+#   presto_start.sh [--slim]   use the slim image from Dockerfile.slim
+#
 set -e
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTDIR=$(cd $(dirname $0); pwd)
+ROOTDIR=$(cd "$SCRIPTDIR/../.."; pwd)
+DATADIR=$ROOTDIR/test/data/malloytest-parquet
 PRESTO_VERSION=0.287
 USE_SLIM=false
+CONTAINER_NAME="presto-malloy"
+PORT=${PRESTO_PORT:-8080}
 
 # Parse arguments
 for arg in "$@"; do
@@ -16,32 +25,40 @@ for arg in "$@"; do
   esac
 done
 
+cd "$ROOTDIR"
 rm -rf .tmp
 mkdir .tmp
 
-# generate config file
-> ./.tmp/bigquery-pesto.properties
-cat << EOF > ./.tmp/bigquery-pesto.properties
-connector.name=bigquery
-bigquery.project-id=advance-lacing-417917
-bigquery.credentials-key=$BQ_CREDENTIALS_KEY
-EOF
-
 # Select image
 if [ "$USE_SLIM" = true ]; then
   PRESTO_IMAGE="presto-slim:${PRESTO_VERSION}"
   # Build slim image if it doesn't exist
   if ! docker image inspect "$PRESTO_IMAGE" > /dev/null 2>&1; then
     echo "Building slim Presto image..."
-    docker build -f "$SCRIPT_DIR/Dockerfile.slim" \
+    docker build -f "$SCRIPTDIR/Dockerfile.slim" \
       --build-arg PRESTO_VERSION="$PRESTO_VERSION" \
-      -t "$PRESTO_IMAGE" "$SCRIPT_DIR"
+      -t "$PRESTO_IMAGE" "$SCRIPTDIR"
   fi
 else
   PRESTO_IMAGE="prestodb/presto:${PRESTO_VERSION}"
 fi
 
-CONTAINER_NAME="presto-malloy"
+# Only the log since this script started: a restarted container's old log
+# already says SERVER STARTED.
+SINCE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+wait_for_presto() {
+  local counter=0
+  while ! docker logs --since "$SINCE" "$CONTAINER_NAME" 2>&1 | grep -q "SERVER STARTED"; do
+    counter=$((counter+1))
+    # give up after 2 minutes
+    if [ $counter -eq 120 ]; then
+      docker logs "$CONTAINER_NAME" >& ./.tmp/presto-malloy.logs
+      return 1
+    fi
+    sleep 1
+  done
+}
 
 # Check for existing container
 if docker container inspect "$CONTAINER_NAME" > /dev/null 2>&1; then
@@ -51,31 +68,36 @@ if docker container inspect "$CONTAINER_NAME" > /dev/null 2>&1; then
   fi
   echo "Restarting existing $CONTAINER_NAME container..."
   docker start "$CONTAINER_NAME"
-  while ! docker logs "$CONTAINER_NAME" 2>&1 | grep -q "SERVER STARTED"; do
-    sleep 1
-  done
-  echo "Presto running on port 8080"
+  if ! wait_for_presto; then
+    echo "Presto did not restart successfully, check .tmp/presto-malloy.logs"
+    exit 1
+  fi
+  echo "Presto running on port $PORT"
   exit 0
 fi
 
-# run docker
-docker run -p ${PRESTO_PORT:-8080}:8080 -d -v ./.tmp/bigquery-pesto.properties:/opt/presto-server/etc/catalog/bigquery.properties --name "$CONTAINER_NAME" "$PRESTO_IMAGE"
-
-# wait for server to start
-counter=0
-while ! docker logs "$CONTAINER_NAME" 2>&1 | grep -q "SERVER STARTED"
-do
-  sleep 1
-  counter=$((counter+1))
-  # if doesn't start after 2 minutes, output logs and kill process
-  if [ $counter -eq 120 ]
-  then
-    docker logs "$CONTAINER_NAME" >& ./.tmp/presto-malloy.logs
-    docker rm -f "$CONTAINER_NAME"
-    echo "Presto did not start successfully, check .tmp/presto-malloy.logs"
-    exit 1
-    break
-  fi
+# A hive external_location is a directory, so each parquet file gets one.
+MOUNTS=()
+for parquet in "$DATADIR"/*.parquet; do
+  table=$(basename "$parquet" .parquet)
+  MOUNTS+=(-v "$parquet:/data/malloytest/$table/$table.parquet:ro")
 done
 
-echo "Presto running on port 8080"
+docker run -p $PORT:8080 -d "${MOUNTS[@]}" \
+  -v "$SCRIPTDIR/hive.properties:/opt/presto-server/etc/catalog/hive.properties:ro" \
+  --name "$CONTAINER_NAME" "$PRESTO_IMAGE"
+
+# A container without its tables must not survive to be "already running"
+trap 'docker rm -f "$CONTAINER_NAME" > /dev/null; echo "Presto setup failed, check .tmp/presto-malloy.logs"' ERR
+
+if ! wait_for_presto; then
+  false
+fi
+
+echo "Creating the malloytest tables"
+npx ts-node test/trino/hive_ddl.ts hive file:///data/malloytest --presto > .tmp/hive_ddl.sql
+docker cp .tmp/hive_ddl.sql "$CONTAINER_NAME":/tmp/hive_ddl.sql
+docker exec "$CONTAINER_NAME" presto-cli -f /tmp/hive_ddl.sql
+trap - ERR
+
+echo "Presto running on port $PORT"

package/src/core/experimental-dialects.spec.ts

@@ -3,13 +3,14 @@
  * SPDX-License-Identifier: MIT
  */
 
-import type {
-  FetchSchemaOptions,
-  MalloyError,
-  SQLSourceDef,
+import type {MalloyError} from '@malloydata/malloy';
+import {
+  DuckDBDialect,
+  getDialect,
+  InMemoryURLReader,
+  registerDialect,
+  SingleConnectionRuntime,
 } from '@malloydata/malloy';
-import {DuckDBDialect, registerDialect} from '@malloydata/malloy';
-import {testRuntimeFor} from '../runtimes';
 import {DuckDBConnection} from '@malloydata/db-duckdb';
 
 const envDatabases = (
@@ -33,30 +34,24 @@ async function getError<T>(promise: Promise<T>): Promise<Error | undefined> {
   return undefined;
 }
 
+/**
+ * A file acknowledges an experimental dialect with
+ * `##! experimental.dialect.NAME` wherever it takes one on: by naming a
+ * connection on it, or by importing a source or query that uses it. The
+ * acknowledgment is a pragma, so an importer gets no credit for the line in
+ * the file it imports.
+ */
 describe('experimental dialects', () => {
   const duckdbX = 'duckdb_experimental';
+  const flag = `##! experimental.dialect.${duckdbX}`;
+
   class DuckdbXConnection extends DuckDBConnection {
     name = duckdbX;
-    public async festchSchemaFOrSQLSource(
-      sqlRef: SQLSourceDef,
-      options: FetchSchemaOptions
-    ): Promise<
-      | {structDef: SQLSourceDef; error?: undefined}
-      | {error: string; structDef?: undefined}
-    > {
-      const result = await super.fetchSchemaForSQLStruct(sqlRef, options);
-      if (result.error === undefined) {
-        return {structDef: {...result.structDef, dialect: duckdbX}};
-      }
-      return result;
-    }
     get dialectName(): string {
       return duckdbX;
     }
   }
 
-  const connection = new DuckdbXConnection(duckdbX, ':memory:');
-
   class DuckdbXDialect extends DuckDBDialect {
     experimental = true;
     name = duckdbX;
@@ -65,35 +60,124 @@ describe('experimental dialects', () => {
     }
   }
 
+  const connection = new DuckdbXConnection(duckdbX, ':memory:');
   registerDialect(new DuckdbXDialect());
-  const runtime = testRuntimeFor(connection);
-  runtime.isTestRuntime = false; // Enables checking experimental dialects
-
-  test('generate an error when used without experiment enabled', async () => {
-    const error = await getError(
-      runtime.getModel(`
-        source: s is ${duckdbX}.sql('SELECT 1 as one')
-      `)
+
+  const libURL = 'file:///lib.malloy';
+  const lib = [
+    flag,
+    `source: s is ${duckdbX}.sql('SELECT 1 as one')`,
+    'query: q is s -> { select: one }',
+  ].join('\n');
+
+  function runtime(): SingleConnectionRuntime {
+    return new SingleConnectionRuntime({
+      connection,
+      urlReader: new InMemoryURLReader(new Map([[libURL, lib]])),
+    });
+  }
+
+  /** The one problem a refused compile reports, with the line it points at. */
+  async function refusal(
+    src: string
+  ): Promise<{message: string; line: number | undefined}> {
+    const error = await getError(runtime().getModel(src));
+    expect(error).toBeDefined();
+    const problems = (error as MalloyError).problems;
+    expect(problems).toHaveLength(1);
+    return {
+      message: problems[0].message,
+      line: problems[0].at?.range.start.line,
+    };
+  }
+
+  test('naming a connection on the dialect needs the flag', async () => {
+    const got = await refusal(
+      ['-- line zero', `source: s is ${duckdbX}.sql('SELECT 1 as one')`].join(
+        '\n'
+      )
     );
-    expect(error).not.toBeUndefined();
-    if (error !== undefined) {
-      const problems = (error as MalloyError).problems;
-      expect(problems.length).toBe(1);
-      expect(problems[0].message).toContain(
-        `##! experimental.dialect.${duckdbX}`
+    expect(got.message).toContain(flag);
+    expect(got.line).toBe(1);
+  });
+
+  test.each([['constructor'], ['__proto__'], ['toString']])(
+    'a connection named %s is checked like any other',
+    async connName => {
+      const named = new DuckdbXConnection(duckdbX, ':memory:');
+      named.name = connName;
+      const error = await getError(
+        new SingleConnectionRuntime({connection: named}).getModel(
+          `source: s is ${connName}.sql('SELECT 1 as one')`
+        )
       );
+      expect(error).toBeDefined();
+      expect((error as MalloyError).problems[0].message).toContain(flag);
+      await named.close();
     }
+  );
+
+  test('the flag admits a connection on the dialect', async () => {
+    await runtime().getModel(
+      [flag, `source: s is ${duckdbX}.sql('SELECT 1 as one')`].join('\n')
+    );
   });
 
-  test('does not generate an error when used with experiment enabled', async () => {
-    await runtime.getModel(`
-      ##! experimental.dialect.${duckdbX}
-      source: s is ${duckdbX}.sql('SELECT 1 as one')
-    `);
+  test('importing a source on the dialect needs the flag, reported at the import', async () => {
+    const got = await refusal(
+      ['-- line zero', `import "${libURL}"`, 'run: s -> { select: one }'].join(
+        '\n'
+      )
+    );
+    expect(got.message).toContain(flag);
+    expect(got.line).toBe(1);
+  });
+
+  test('importing only a query on the dialect needs the flag', async () => {
+    const got = await refusal(`import {q} from "${libURL}"`);
+    expect(got.message).toContain(flag);
+  });
+
+  test('the flag admits an import and use of the dialect', async () => {
+    const sql = await runtime()
+      .loadModel([flag, `import "${libURL}"`].join('\n'))
+      .loadQuery('run: s -> { select: one }')
+      .getSQL();
+    expect(sql).toContain('SELECT');
+  });
+
+  test('a query over a model needs nothing of its own', async () => {
+    const sql = await runtime()
+      .loadModel(
+        [flag, `source: s is ${duckdbX}.sql('SELECT 1 as one')`].join('\n')
+      )
+      .loadQuery('run: s -> { select: one }')
+      .getSQL();
+    expect(sql).toContain('SELECT');
+  });
+
+  test('an accepted dialect needs no flag anywhere', async () => {
+    // What the shared-suite harness does once per process for the dialect
+    // under test. Undone below by registering a fresh dialect object.
+    getDialect(duckdbX).acceptExperimental();
+    try {
+      const sql = await runtime()
+        .loadModel(
+          [
+            `import "${libURL}"`,
+            `source: t is ${duckdbX}.sql('SELECT 2 as two')`,
+          ].join('\n')
+        )
+        .loadQuery('run: s -> { select: one }')
+        .getSQL();
+      expect(sql).toContain('SELECT');
+    } finally {
+      registerDialect(new DuckdbXDialect());
+    }
   });
 
   afterAll(async () => {
-    await runtime.connection.close();
+    await connection.close();
     registerDialect(new DuckDBDialect());
   });
 });

package/src/core/restricted-mode.spec.ts

@@ -35,6 +35,33 @@ describe('loadRestrictedQuery — end-to-end through the public API', () => {
     expect(result.data.path(0, 'ct').value).toBeGreaterThan(0);
   });
 
+  test('timezone injection is rejected before SQL generation or execution', async () => {
+    const model = runtime.loadModel(`
+      source: states is duckdb.table('malloytest.state_facts')
+    `);
+    const queryText = `run: states -> {
+      timezone: "UTC' || (SELECT 'UTC') || '"
+      select: d is now.day
+      limit: 1
+    }`;
+    const expectedError = {
+      problems: expect.arrayContaining([
+        expect.objectContaining({
+          code: 'invalid-timezone',
+          severity: 'error',
+        }),
+      ]),
+    };
+    // Separate query instances exercise each entry point without reusing
+    // the other entry point's cached compilation failure.
+    await expect(
+      model.loadRestrictedQuery(queryText).getSQL()
+    ).rejects.toMatchObject(expectedError);
+    await expect(
+      model.loadRestrictedQuery(queryText).run()
+    ).rejects.toMatchObject(expectedError);
+  });
+
   test('restricted query with `import` throws MalloyError tagged restricted-mode', async () => {
     const model = runtime.loadModel(`
       source: states is duckdb.table('malloytest.state_facts')

package/src/core/tags.spec.ts

@@ -340,6 +340,28 @@ describe('tags in results', () => {
   });
 });
 
+describe('property names inherited from Object.prototype', () => {
+  // A tag property name comes from source text, so `__proto__`, `constructor`
+  // and `toString` are ordinary names with no special meaning.
+  test('an annotation carries an inherited name through to the result', async () => {
+    const loaded = runtime.loadQuery(
+      `run: duckdb.sql("select 1 as num") -> {
+        select:
+          # __proto__=1 toString.nested=2 constructor
+          one is num
+      }`
+    );
+    const result = await loaded.run();
+    const one = result.resultExplore.getFieldByName('one');
+    const {tag, log} = one.tagParse();
+    expect(log).toEqual([]);
+    expect(tag.numeric('__proto__')).toEqual(1);
+    expect(tag.numeric('toString', 'nested')).toEqual(2);
+    expect(tag.has('constructor')).toBe(true);
+    expect(tag.has('valueOf')).toBe(false);
+  });
+});
+
 afterAll(async () => {
   await runtime.connection.close();
 });