@malloydata/malloy 0.0.394 → 0.0.396

package/dist/dialect/table-path.d.ts

@@ -0,0 +1,54 @@
+export type ValidateTablePathResult = {
+    ok: true;
+    canonical: string;
+} | {
+    ok: false;
+    error: string;
+};
+export interface TablePathSegment {
+    /** Decoded segment value: delimiters stripped, escapes unescaped. */
+    value: string;
+    /** Whether the segment appeared in quoted form in the input. */
+    quoted: boolean;
+}
+export type DecodeDottedTablePathResult = {
+    ok: true;
+    segments: TablePathSegment[];
+} | {
+    ok: false;
+    error: string;
+};
+export type TablePathEscapeStyle = 'doubled' | 'backslash';
+export interface DottedTablePathOptions {
+    /** Delimiter for quoted segments (`"`, `` ` ``, …). */
+    quoteChar: string;
+    /**
+     * How a literal `quoteChar` is encoded inside a quoted body:
+     *   - 'doubled':   `qq` inside body escapes one literal `q`.
+     *   - 'backslash': `\X` is a two-character escape; unescaped `q` closes.
+     */
+    escapeStyle: TablePathEscapeStyle;
+    /**
+     * Regex matching one bare segment, anchored at the start of the input.
+     * Must NOT have global/sticky flags; the parser calls `.match()` on
+     * `input.slice(i)` and expects the match to start at position 0.
+     */
+    bareIdentRegex: RegExp;
+    /** Used in error messages only. */
+    dialectName: string;
+}
+/**
+ * Parse `input` as a dotted table path and require end-of-input. On
+ * success, returns the decoded segment values — delimiters stripped,
+ * escape sequences unescaped — so callers that need the segments
+ * (connection metadata lookups) and callers that only need
+ * accept/reject (`validateDottedTablePath`) share one parser.
+ */
+export declare function decodeDottedTablePath(input: string, opts: DottedTablePathOptions): DecodeDottedTablePathResult;
+/**
+ * Validate `input` as a dotted table path. On success the canonical
+ * form is the input verbatim. See `decodeDottedTablePath` for the
+ * underlying parser; this is the validate-only wrapper that doesn't
+ * expose segment internals.
+ */
+export declare function validateDottedTablePath(input: string, opts: DottedTablePathOptions): ValidateTablePathResult;

package/dist/dialect/table-path.js

@@ -0,0 +1,144 @@
+"use strict";
+/*
+ * Copyright Contributors to the Malloy project
+ * SPDX-License-Identifier: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeDottedTablePath = decodeDottedTablePath;
+exports.validateDottedTablePath = validateDottedTablePath;
+/**
+ * Parse `input` as a dotted table path and require end-of-input. On
+ * success, returns the decoded segment values — delimiters stripped,
+ * escape sequences unescaped — so callers that need the segments
+ * (connection metadata lookups) and callers that only need
+ * accept/reject (`validateDottedTablePath`) share one parser.
+ */
+function decodeDottedTablePath(input, opts) {
+    const { quoteChar, escapeStyle, bareIdentRegex, dialectName } = opts;
+    if (input.length === 0) {
+        return { ok: false, error: `${dialectName} table path is empty` };
+    }
+    const segments = [];
+    let i = 0;
+    while (true) {
+        let segValue;
+        let segQuoted;
+        if (input[i] === quoteChar) {
+            const result = consumeQuotedSegment(input, i, quoteChar, escapeStyle);
+            if (result === null) {
+                return {
+                    ok: false,
+                    error: `Invalid ${dialectName} table path: ${JSON.stringify(input)} — ` +
+                        'unterminated quoted segment',
+                };
+            }
+            segValue = result.decoded;
+            segQuoted = true;
+            i = result.end;
+        }
+        else {
+            const m = input.slice(i).match(bareIdentRegex);
+            if (!m || m.index !== 0 || m[0].length === 0) {
+                return {
+                    ok: false,
+                    error: `Invalid ${dialectName} table path: ${JSON.stringify(input)} — ` +
+                        `invalid segment at position ${i}`,
+                };
+            }
+            segValue = m[0];
+            segQuoted = false;
+            i += m[0].length;
+        }
+        // Defense-in-depth: `;` and `--` are forbidden in any decoded segment,
+        // even a legally-quoted one. Real table names don't contain them.
+        if (segValue.includes(';') || segValue.includes('--')) {
+            return {
+                ok: false,
+                error: `Invalid ${dialectName} table path: segment ${JSON.stringify(segValue)} ` +
+                    'contains forbidden character; even when quoted, table-path ' +
+                    'segments may not contain `;` or `--`.',
+            };
+        }
+        segments.push({ value: segValue, quoted: segQuoted });
+        if (i === input.length)
+            return { ok: true, segments };
+        if (input[i] !== '.') {
+            return {
+                ok: false,
+                error: `Invalid ${dialectName} table path: ${JSON.stringify(input)} — ` +
+                    `expected '.' at position ${i}`,
+            };
+        }
+        i++;
+        if (i === input.length) {
+            return {
+                ok: false,
+                error: `Invalid ${dialectName} table path: ${JSON.stringify(input)} — ` +
+                    'trailing dot',
+            };
+        }
+    }
+}
+/**
+ * Validate `input` as a dotted table path. On success the canonical
+ * form is the input verbatim. See `decodeDottedTablePath` for the
+ * underlying parser; this is the validate-only wrapper that doesn't
+ * expose segment internals.
+ */
+function validateDottedTablePath(input, opts) {
+    const result = decodeDottedTablePath(input, opts);
+    if (!result.ok)
+        return result;
+    return { ok: true, canonical: input };
+}
+/**
+ * Read past a quoted segment starting at `input[i]` (must be `quoteChar`).
+ * Returns the segment body (delimiters stripped, escape sequences
+ * unescaped) and the index just after the closing quote, or `null` if
+ * the segment is unterminated.
+ */
+function consumeQuotedSegment(input, i, quoteChar, escapeStyle) {
+    // input[i] === quoteChar
+    let j = i + 1;
+    let decoded = '';
+    while (j < input.length) {
+        if (escapeStyle === 'backslash' && input[j] === '\\') {
+            if (j + 1 >= input.length)
+                return null;
+            decoded += decodeBackslashEscape(input[j + 1]);
+            j += 2;
+            continue;
+        }
+        if (input[j] === quoteChar) {
+            if (escapeStyle === 'doubled' && input[j + 1] === quoteChar) {
+                decoded += quoteChar;
+                j += 2;
+                continue;
+            }
+            return { decoded, end: j + 1 };
+        }
+        decoded += input[j];
+        j++;
+    }
+    return null;
+}
+/**
+ * Decode a single character after a backslash. We intentionally accept
+ * any character — we're a translator-time grammar check, not a strict
+ * lexical conformance test for any particular engine's quoted-identifier
+ * escape table. The engine will surface its own errors at bind time if
+ * it doesn't recognize a particular sequence.
+ */
+function decodeBackslashEscape(c) {
+    switch (c) {
+        case 'n':
+            return '\n';
+        case 't':
+            return '\t';
+        case 'r':
+            return '\r';
+        default:
+            return c;
+    }
+}
+//# sourceMappingURL=table-path.js.map

package/dist/dialect/trino/trino.d.ts

@@ -30,7 +30,6 @@ export declare class TrinoDialect extends PostgresBase {
     supportsTempTables: boolean;
     supportsCountApprox: boolean;
     supportsHyperLogLog: boolean;
-    quoteTablePath(tablePath: string): string;
     sqlGroupSetTable(groupSetCount: number): string;
     exprToSQL(qi: QueryInfo, df: Expr): string | undefined;
     sqlAnyValue(groupSet: number, fieldName: string): string;
@@ -62,8 +61,6 @@ export declare class TrinoDialect extends PostgresBase {
     sqlRegexpMatch(reCmp: RegexMatchExpr): string;
     sqlMeasureTimeExpr(mf: MeasureTimeExpr): string;
     sqlSampleTable(tableSQL: string, sample: Sampling | undefined): string;
-    sqlLiteralString(literal: string): string;
-    sqlLiteralRegexp(literal: string): string;
     getDialectFunctionOverrides(): {
         [name: string]: DialectFunctionOverloadDef[];
     };

package/dist/dialect/trino/trino.js

@@ -200,16 +200,9 @@ class TrinoDialect extends pg_impl_1.PostgresBase {
   WITH
   WITHIN`.split(/\s/);
     }
-    quoteTablePath(tablePath) {
-        // Quote with double quotes if contains dangerous characters
-        if (tablePath.match(/[;-]/)) {
-            return tablePath
-                .split('.')
-                .map(part => `"${part}"`)
-                .join('.');
-        }
-        return tablePath;
-    }
+    // Trino bare identifier is strict ANSI (`[A-Za-z_][A-Za-z0-9_]*`),
+    // which matches the Dialect default — no override needed. Verified
+    // against the live engine.
     sqlGroupSetTable(groupSetCount) {
         return `CROSS JOIN (SELECT row_number() OVER() -1  group_set FROM UNNEST(SEQUENCE(0,${groupSetCount})))`;
     }
@@ -300,7 +293,7 @@ class TrinoDialect extends pg_impl_1.PostgresBase {
         if (childName === '__row_id') {
             return `__row_id_from_${parentAlias}`;
         }
-        return `${parentAlias}.${this.sqlMaybeQuoteIdentifier(childName)}`;
+        return `${parentAlias}.${this.sqlQuoteIdentifier(childName)}`;
     }
     sqlUnnestPipelineHead(isSingleton, sourceSQLExpression) {
         let p = sourceSQLExpression;
@@ -471,12 +464,6 @@ ${(0, utils_1.indent)(sql)}
         }
         return tableSQL;
     }
-    sqlLiteralString(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
-    sqlLiteralRegexp(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
     getDialectFunctionOverrides() {
         return (0, functions_1.expandOverrideMap)(function_overrides_1.TRINO_MALLOY_STANDARD_OVERLOADS);
     }
@@ -503,7 +490,7 @@ ${(0, utils_1.indent)(sql)}
                 const typeSpec = [];
                 for (const f of malloyType.fields) {
                     if ((0, malloy_types_1.isAtomic)(f)) {
-                        typeSpec.push(`${this.sqlMaybeQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
+                        typeSpec.push(`${this.sqlQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
                     }
                 }
                 return `ROW(${typeSpec.join(',')})`;
@@ -515,7 +502,7 @@ ${(0, utils_1.indent)(sql)}
                     const typeSpec = [];
                     for (const f of malloyType.fields) {
                         if ((0, malloy_types_1.isAtomic)(f)) {
-                            typeSpec.push(`${this.sqlMaybeQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
+                            typeSpec.push(`${this.sqlQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
                         }
                     }
                     return `ARRAY<ROW(${typeSpec.join(',')})>`;
@@ -603,7 +590,7 @@ ${(0, utils_1.indent)(sql)}
                 const name = (_a = f.as) !== null && _a !== void 0 ? _a : f.name;
                 rowVals.push((_c = (_b = (0, malloy_types_1.safeRecordGet)(lit.kids, name)) === null || _b === void 0 ? void 0 : _b.sql) !== null && _c !== void 0 ? _c : 'internal-error-record-literal');
                 const elType = this.malloyTypeToSQLType(f);
-                rowTypes.push(`${this.sqlMaybeQuoteIdentifier(name)} ${elType}`);
+                rowTypes.push(`${this.sqlQuoteIdentifier(name)} ${elType}`);
             }
         }
         return `CAST(ROW(${rowVals.join(',')}) AS ROW(${rowTypes.join(',')}))`;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { DuckDBDialect, StandardSQLDialect, TrinoDialect, PostgresDialect, SnowflakeDialect, MySQLDialect, DatabricksDialect, registerDialect, arg, qtz, overload, minScalar, anyExprType, minAggregate, maxScalar, sql, makeParam, param, variadicParam, literal, spread, Dialect, } from './dialect';
-export type { DialectFieldList, DialectFunctionOverloadDef, QueryInfo, MalloyStandardFunctionImplementations, DefinitionBlueprint, DefinitionBlueprintMap, OverloadedDefinitionBlueprint, } from './dialect';
+export { DuckDBDialect, StandardSQLDialect, TrinoDialect, PostgresDialect, SnowflakeDialect, MySQLDialect, DatabricksDialect, registerDialect, arg, qtz, overload, minScalar, anyExprType, minAggregate, maxScalar, sql, makeParam, param, variadicParam, literal, spread, Dialect, decodeDottedTablePath, validateDottedTablePath, } from './dialect';
+export type { DialectFieldList, DialectFunctionOverloadDef, QueryInfo, MalloyStandardFunctionImplementations, DefinitionBlueprint, DefinitionBlueprintMap, OverloadedDefinitionBlueprint, DecodeDottedTablePathResult, DottedTablePathOptions, TablePathEscapeStyle, TablePathSegment, ValidateTablePathResult, } from './dialect';
 export type { QueryRecord, StructDef, TableSourceDef, SQLSourceDef, SourceDef, JoinFieldDef, NamedSourceDefs, MalloyQueryData, DateUnit, ExtractUnit, TimestampUnit, TemporalFieldType, QueryData, QueryValue, Expr, FilterCondition, Argument, Parameter, FieldDef, PipeSegment, QueryFieldDef, IndexFieldDef, TurtleDef, SearchValueMapResult, SearchIndexResult, ModelDef, Query, QueryResult, QueryResultDef, QueryRunStats, QueryScalar, NamedQueryDef, NamedModelObject, ExpressionType, FunctionDef, FunctionOverloadDef, FunctionParameterDef, ExpressionValueType, TypeDesc, FunctionParamTypeDesc, DocumentLocation, DocumentRange, DocumentPosition, Sampling, Annotation, BasicAtomicTypeDef, BasicAtomicDef, AtomicTypeDef, AtomicFieldDef, ArrayDef, ArrayTypeDef, RecordTypeDef, RepeatedRecordTypeDef, RecordDef, RepeatedRecordDef, RecordLiteralNode, StringLiteralNode, ArrayLiteralNode, SourceComponentInfo, DateLiteralNode, TimestampLiteralNode, TimestamptzLiteralNode, TimeLiteralExpr, TypecastExpr, BuildID, BuildManifest, BuildManifestEntry, GivenValue, VirtualMap, } from './model';
 export { isSourceDef, isAtomic, isBasicAtomic, isCompoundArrayData, isJoined, isJoinedSource, isSamplingEnable, isSamplingPercent, isSamplingRows, isRepeatedRecord, isBasicArray, mkArrayDef, mkFieldDef, expressionIsAggregate, expressionIsAnalytic, expressionIsCalculation, expressionIsScalar, expressionIsUngroupedAggregate, indent, composeSQLExpr, isTimestampUnit, isDateUnit, constantExprToSQL, } from './model';
 export { malloyToQuery, MalloyTranslator, } from './lang';

package/dist/index.js

@@ -33,8 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Runtime = exports.Malloy = exports.Model = exports.MalloyTranslator = exports.malloyToQuery = exports.constantExprToSQL = exports.isDateUnit = exports.isTimestampUnit = exports.composeSQLExpr = exports.indent = exports.expressionIsUngroupedAggregate = exports.expressionIsScalar = exports.expressionIsCalculation = exports.expressionIsAnalytic = exports.expressionIsAggregate = exports.mkFieldDef = exports.mkArrayDef = exports.isBasicArray = exports.isRepeatedRecord = exports.isSamplingRows = exports.isSamplingPercent = exports.isSamplingEnable = exports.isJoinedSource = exports.isJoined = exports.isCompoundArrayData = exports.isBasicAtomic = exports.isAtomic = exports.isSourceDef = exports.Dialect = exports.spread = exports.literal = exports.variadicParam = exports.param = exports.makeParam = exports.sql = exports.maxScalar = exports.minAggregate = exports.anyExprType = exports.minScalar = exports.overload = exports.qtz = exports.arg = exports.registerDialect = exports.DatabricksDialect = exports.MySQLDialect = exports.SnowflakeDialect = exports.PostgresDialect = exports.TrinoDialect = exports.StandardSQLDialect = exports.DuckDBDialect = void 0;
-exports.makeDigest = exports.EMPTY_BUILD_MANIFEST = exports.PersistSource = exports.annotationToTaglines = exports.annotationToTag = exports.sqlKey = exports.API = exports.sourceDefToSourceInfo = exports.modelDefToModelInfo = exports.toAsyncGenerator = exports.createConnectionsFromConfig = exports.getRegisteredConnectionTypes = exports.getConnectionTypeDisplayName = exports.getConnectionProperties = exports.registerConnectionType = exports.discoverConfig = exports.defaultConfigOverlays = exports.contextOverlay = exports.envOverlay = exports.MalloyConfig = exports.Manifest = exports.CacheManager = exports.InMemoryModelCache = exports.Explore = exports.DataWriter = exports.Parse = exports.JSONWriter = exports.CSVWriter = exports.QueryMaterializer = exports.Result = exports.PreparedResult = exports.TimestampTimeframe = exports.DateTimeframe = exports.SourceRelationship = exports.JoinRelationship = exports.MalloyError = exports.FixedConnectionMap = exports.InMemoryURLReader = exports.EmptyURLReader = exports.SingleConnectionRuntime = exports.ConnectionRuntime = exports.AtomicFieldType = void 0;
+exports.Model = exports.MalloyTranslator = exports.malloyToQuery = exports.constantExprToSQL = exports.isDateUnit = exports.isTimestampUnit = exports.composeSQLExpr = exports.indent = exports.expressionIsUngroupedAggregate = exports.expressionIsScalar = exports.expressionIsCalculation = exports.expressionIsAnalytic = exports.expressionIsAggregate = exports.mkFieldDef = exports.mkArrayDef = exports.isBasicArray = exports.isRepeatedRecord = exports.isSamplingRows = exports.isSamplingPercent = exports.isSamplingEnable = exports.isJoinedSource = exports.isJoined = exports.isCompoundArrayData = exports.isBasicAtomic = exports.isAtomic = exports.isSourceDef = exports.validateDottedTablePath = exports.decodeDottedTablePath = exports.Dialect = exports.spread = exports.literal = exports.variadicParam = exports.param = exports.makeParam = exports.sql = exports.maxScalar = exports.minAggregate = exports.anyExprType = exports.minScalar = exports.overload = exports.qtz = exports.arg = exports.registerDialect = exports.DatabricksDialect = exports.MySQLDialect = exports.SnowflakeDialect = exports.PostgresDialect = exports.TrinoDialect = exports.StandardSQLDialect = exports.DuckDBDialect = void 0;
+exports.makeDigest = exports.EMPTY_BUILD_MANIFEST = exports.PersistSource = exports.annotationToTaglines = exports.annotationToTag = exports.sqlKey = exports.API = exports.sourceDefToSourceInfo = exports.modelDefToModelInfo = exports.toAsyncGenerator = exports.createConnectionsFromConfig = exports.getRegisteredConnectionTypes = exports.getConnectionTypeDisplayName = exports.getConnectionProperties = exports.registerConnectionType = exports.discoverConfig = exports.defaultConfigOverlays = exports.contextOverlay = exports.envOverlay = exports.MalloyConfig = exports.Manifest = exports.CacheManager = exports.InMemoryModelCache = exports.Explore = exports.DataWriter = exports.Parse = exports.JSONWriter = exports.CSVWriter = exports.QueryMaterializer = exports.Result = exports.PreparedResult = exports.TimestampTimeframe = exports.DateTimeframe = exports.SourceRelationship = exports.JoinRelationship = exports.MalloyError = exports.FixedConnectionMap = exports.InMemoryURLReader = exports.EmptyURLReader = exports.SingleConnectionRuntime = exports.ConnectionRuntime = exports.AtomicFieldType = exports.Runtime = exports.Malloy = void 0;
 /*
  * Copyright 2023 Google LLC
  *
@@ -80,6 +80,8 @@ Object.defineProperty(exports, "variadicParam", { enumerable: true, get: functio
 Object.defineProperty(exports, "literal", { enumerable: true, get: function () { return dialect_1.literal; } });
 Object.defineProperty(exports, "spread", { enumerable: true, get: function () { return dialect_1.spread; } });
 Object.defineProperty(exports, "Dialect", { enumerable: true, get: function () { return dialect_1.Dialect; } });
+Object.defineProperty(exports, "decodeDottedTablePath", { enumerable: true, get: function () { return dialect_1.decodeDottedTablePath; } });
+Object.defineProperty(exports, "validateDottedTablePath", { enumerable: true, get: function () { return dialect_1.validateDottedTablePath; } });
 var model_1 = require("./model");
 Object.defineProperty(exports, "isSourceDef", { enumerable: true, get: function () { return model_1.isSourceDef; } });
 // Used in Composer Demo

package/dist/lang/ast/expressions/expr-func.js

@@ -58,13 +58,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExprFunc = void 0;
 const malloy_types_1 = require("../../../model/malloy_types");
 const ast_utils_1 = require("../ast-utils");
+const utils_1 = require("../../../model/utils");
 const struct_space_field_base_1 = require("../field-space/struct-space-field-base");
 const expr_value_1 = require("../types/expr-value");
 const expression_def_1 = require("../types/expression-def");
 const field_space_1 = require("../types/field-space");
-const utils_1 = require("../../../model/utils");
+const utils_2 = require("../../../model/utils");
 const TDU = __importStar(require("../typedesc-utils"));
 const composite_source_utils_1 = require("../../composite-source-utils");
+// Built-in functions that take a string literal of user-supplied SQL
+// and emit it directly. Gated by experimental.sql_functions in plain
+// Malloy; rejected unconditionally in restricted queries because they
+// are a raw-SQL escape hatch by definition.
+const SQL_FUNCTION_NAMES = [
+    'sql_number',
+    'sql_string',
+    'sql_date',
+    'sql_timestamp',
+    'sql_boolean',
+];
 class ExprFunc extends expression_def_1.ExpressionDef {
     constructor(name, args, isRaw, explicitType, source) {
         super({ args: args });
@@ -86,6 +98,12 @@ class ExprFunc extends expression_def_1.ExpressionDef {
         return true;
     }
     getExpression(fs) {
+        if (this.isRaw && this.isRestricted()) {
+            const typeStr = this.explicitType
+                ? (0, utils_1.typeDefToString)(this.explicitType)
+                : '';
+            return this.loggedErrorExpr('restricted-construct-forbidden', `\`${this.name}!${typeStr}(...)\` cannot be used in a restricted query — direct SQL function calls (\`!type(...)\`) are not permitted.`);
+        }
         return this.getPropsExpression(fs);
     }
     findFunctionDef(dialect) {
@@ -126,7 +144,7 @@ class ExprFunc extends expression_def_1.ExpressionDef {
             const dataType = (_b = this.explicitType) !== null && _b !== void 0 ? _b : inferredType;
             return (0, expr_value_1.computedExprValue)({
                 dataType,
-                value: (0, utils_1.composeSQLExpr)(funcCall),
+                value: (0, utils_2.composeSQLExpr)(funcCall),
                 from: argExprsWithoutImplicit,
             });
         }
@@ -290,13 +308,10 @@ class ExprFunc extends expression_def_1.ExpressionDef {
             frag.partitionBy = partitionByFields;
         }
         const sqlFunctionFieldUsage = [];
-        if ([
-            'sql_number',
-            'sql_string',
-            'sql_date',
-            'sql_timestamp',
-            'sql_boolean',
-        ].includes(func.name)) {
+        if (SQL_FUNCTION_NAMES.includes(func.name)) {
+            if (this.isRestricted()) {
+                return this.loggedErrorExpr('restricted-construct-forbidden', `\`${this.name}(...)\` cannot be used in a restricted query — the \`sql_*\` function family emits user-supplied SQL directly, which is not permitted.`);
+            }
             if (!this.inExperiment('sql_functions', true)) {
                 return this.loggedErrorExpr('sql-functions-experiment-not-enabled', `Cannot use sql_function \`${func.name}\`; use \`sql_functions\` experiment to enable this behavior`);
             }
@@ -327,7 +342,11 @@ class ExprFunc extends expression_def_1.ExpressionDef {
                             return this.loggedErrorExpr('filter-expression-error', 'Filter expressions cannot be used in sql_ functions');
                         }
                         if (result.found.refType === 'parameter') {
-                            expr.push({ node: 'parameter', path: part.path });
+                            expr.push({
+                                node: 'parameter',
+                                path: part.path,
+                                at: this.args[0].location,
+                            });
                         }
                         else {
                             sqlFunctionFieldUsage.push({
@@ -343,7 +362,7 @@ class ExprFunc extends expression_def_1.ExpressionDef {
                         }
                     }
                 }
-                funcCall = (0, utils_1.composeSQLExpr)(expr);
+                funcCall = (0, utils_2.composeSQLExpr)(expr);
             }
         }
         const maxEvalSpace = (0, malloy_types_1.mergeEvalSpaces)(...argExprs.map(e => e.evalSpace));

package/dist/lang/ast/expressions/expr-given.js

@@ -55,6 +55,7 @@ class GivenReference extends expression_def_1.ExpressionDef {
             node: 'given',
             id: entry.id,
             refName: this.name,
+            at: this.location,
         };
         return {
             ...(0, expr_value_1.literalExprValue)({ value: refNode, dataType: given.type }),

package/dist/lang/ast/field-space/reference-field.js

@@ -88,7 +88,7 @@ class ReferenceField extends space_field_1.SpaceField {
                 if (malloy_types_1.TD.isAtomic(foundType)) {
                     this.queryFieldDef = {
                         ...(0, malloy_types_1.mkFieldDef)(TDU.atomicDef(foundType), path[0]),
-                        e: { node: 'parameter', path },
+                        e: { node: 'parameter', path, at: this.fieldRef.location },
                     };
                 }
                 else {

package/dist/lang/ast/source-elements/sql-source.js

@@ -100,6 +100,10 @@ class SQLSource extends source_1.Source {
     }
     getSourceDef() {
         var _a;
+        if (this.isRestricted()) {
+            this.logError('restricted-construct-forbidden', `\`${this.connectionName.refString}.sql(...)\` cannot be used in a restricted query — raw SQL is not permitted.`);
+            return error_factory_1.ErrorFactory.structDef;
+        }
         if (!this.validateConnectionName()) {
             return error_factory_1.ErrorFactory.structDef;
         }

package/dist/lang/ast/source-elements/table-source.d.ts

@@ -3,7 +3,7 @@ import { Source } from './source';
 import type { ModelEntryReference } from '../types/malloy-element';
 type TableInfo = {
     tablePath: string;
-    connectionName?: string | undefined;
+    connectionName: string;
 };
 export declare abstract class TableSource extends Source {
     abstract getTableInfo(): TableInfo | undefined;
@@ -16,10 +16,4 @@ export declare class TableMethodSource extends TableSource {
     constructor(connectionName: ModelEntryReference, tablePath: string);
     getTableInfo(): TableInfo | undefined;
 }
-export declare class TableFunctionSource extends TableSource {
-    readonly tableURI: string;
-    elementType: string;
-    constructor(tableURI: string);
-    getTableInfo(): TableInfo | undefined;
-}
 export {};

package/dist/lang/ast/source-elements/table-source.js

@@ -22,24 +22,38 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TableFunctionSource = exports.TableMethodSource = exports.TableSource = void 0;
+exports.TableMethodSource = exports.TableSource = void 0;
 const find_external_references_1 = require("../../parse-tree-walkers/find-external-references");
 const source_1 = require("./source");
 const error_factory_1 = require("../error-factory");
+const dialect_1 = require("../../../dialect");
 class TableSource extends source_1.Source {
     getSourceDef() {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         const info = this.getTableInfo();
         if (info === undefined) {
             return error_factory_1.ErrorFactory.structDef;
         }
-        const { tablePath, connectionName } = info;
+        const { tablePath: rawTablePath, connectionName } = info;
+        // Re-validate the table path. ImportsAndTablesStep validated and
+        // silently skipped invalid entries; we re-validate here so we can
+        // log a precise translator error at the AST element's location.
+        let tablePath = rawTablePath;
+        const dialectName = (_a = this.translator()) === null || _a === void 0 ? void 0 : _a.root.connectionDialectZone.get(connectionName);
+        if (dialectName !== undefined) {
+            const validation = (0, dialect_1.getDialect)(dialectName).sqlValidateTableName(rawTablePath);
+            if (!validation.ok) {
+                this.logError('invalid-table-path', validation.error);
+                return error_factory_1.ErrorFactory.structDef;
+            }
+            tablePath = validation.canonical;
+        }
         const key = (0, find_external_references_1.constructTableKey)(connectionName, tablePath);
-        const tableDefEntry = (_a = this.translator()) === null || _a === void 0 ? void 0 : _a.root.schemaZone.getEntry(key);
+        const tableDefEntry = (_b = this.translator()) === null || _b === void 0 ? void 0 : _b.root.schemaZone.getEntry(key);
         let msg = `Schema read failure for table '${tablePath}' for connection '${connectionName}'`;
         if (tableDefEntry) {
             if (tableDefEntry.status === 'present') {
-                (_b = this.document()) === null || _b === void 0 ? void 0 : _b.checkExperimentalDialect(this, tableDefEntry.value.dialect);
+                (_c = this.document()) === null || _c === void 0 ? void 0 : _c.checkExperimentalDialect(this, tableDefEntry.value.dialect);
                 tableDefEntry.value.location = this.location;
                 tableDefEntry.value.fields.forEach(field => {
                     field.location = this.location;
@@ -58,7 +72,7 @@ class TableSource extends source_1.Source {
                     }),
                     location: this.location,
                 };
-                (_c = this.document()) === null || _c === void 0 ? void 0 : _c.rememberToAddModelAnnotations(ret);
+                (_d = this.document()) === null || _d === void 0 ? void 0 : _d.rememberToAddModelAnnotations(ret);
                 return ret;
             }
             if (tableDefEntry.status === 'error') {
@@ -80,6 +94,10 @@ class TableMethodSource extends TableSource {
     }
     getTableInfo() {
         var _a;
+        if (this.isRestricted()) {
+            this.logError('restricted-construct-forbidden', `\`${this.connectionName.refString}.table(...)\` cannot be used in a restricted query — direct table access is not permitted.`);
+            return undefined;
+        }
         const connection = this.modelEntry(this.connectionName);
         const name = this.connectionName.refString;
         if (connection === undefined) {
@@ -96,17 +114,4 @@ class TableMethodSource extends TableSource {
     }
 }
 exports.TableMethodSource = TableMethodSource;
-class TableFunctionSource extends TableSource {
-    constructor(tableURI) {
-        super();
-        this.tableURI = tableURI;
-        this.elementType = 'tableFunctionSource';
-    }
-    getTableInfo() {
-        // This use of `deprecatedParseTableURI` is ok because it is for handling the
-        // old, soon-to-be-deprecated table syntax.
-        return (0, find_external_references_1.deprecatedParseTableURI)(this.tableURI);
-    }
-}
-exports.TableFunctionSource = TableFunctionSource;
 //# sourceMappingURL=table-source.js.map

package/dist/lang/ast/statements/define-given.d.ts

@@ -21,4 +21,5 @@ export declare class DefineGivens extends DocStatementList {
     elementType: string;
     readonly givens: GivenDeclaration[];
     constructor(givens: GivenDeclaration[]);
+    executeList(doc: Document): import("../../translate-response").ModelDataRequest;
 }

package/dist/lang/ast/statements/define-given.js

@@ -209,6 +209,13 @@ class DefineGivens extends malloy_element_1.DocStatementList {
         this.elementType = 'defineGivens';
         this.givens = givens;
     }
+    executeList(doc) {
+        if (this.isRestricted()) {
+            this.logError('restricted-construct-forbidden', '`given:` cannot declare new givens in a restricted query — only `$NAME` references to existing givens are allowed.');
+            return undefined;
+        }
+        return super.executeList(doc);
+    }
 }
 exports.DefineGivens = DefineGivens;
 //# sourceMappingURL=define-given.js.map

package/dist/lang/ast/statements/import-statement.js

@@ -89,6 +89,10 @@ class ImportStatement extends malloy_element_1.ListOf {
     }
     execute(doc) {
         var _a;
+        if (this.isRestricted()) {
+            this.logError('restricted-construct-forbidden', `\`import "${this.url}"\` cannot be used in a restricted query — file imports are not permitted.`);
+            return;
+        }
         const trans = this.translator();
         if (!trans) {
             this.logError('no-translator-for-import', 'Cannot import without translation context');

package/dist/lang/ast/types/annotation-elements.d.ts

@@ -12,6 +12,7 @@ export declare class ObjectAnnotation extends MalloyElement implements QueryProp
 }
 export declare class ModelAnnotation extends ObjectAnnotation implements DocStatement {
     elementType: string;
+    getCompilerFlagNotes(): Note[];
     getCompilerFlagLines(): string[];
     execute(doc: Document): void;
 }

package/dist/lang/ast/types/annotation-elements.js

@@ -41,12 +41,19 @@ class ModelAnnotation extends ObjectAnnotation {
         super(...arguments);
         this.elementType = 'modelAnnotation';
     }
+    getCompilerFlagNotes() {
+        return this.notes.filter(note => note.text.match(COMPILER_FLAG_PREFIX));
+    }
     getCompilerFlagLines() {
-        return this.notes
-            .filter(note => note.text.match(COMPILER_FLAG_PREFIX))
-            .map(note => note.text);
+        return this.getCompilerFlagNotes().map(note => note.text);
     }
     execute(doc) {
+        if (this.isRestricted()) {
+            for (const note of this.getCompilerFlagNotes()) {
+                const line = note.text.replace(/\n$/, '');
+                this.logError('restricted-construct-forbidden', `\`${line}\` cannot be used in a restricted query — compiler-flag annotations are not permitted.`, { at: note.at });
+            }
+        }
         if (doc.annotation.notes === undefined) {
             doc.annotation.notes = [];
         }

package/dist/lang/ast/types/malloy-element.d.ts

@@ -37,6 +37,7 @@ export declare abstract class MalloyElement {
      */
     kupuna(): MalloyElement;
     translator(): MalloyTranslation | undefined;
+    isRestricted(): boolean;
     setTranslator(x: MalloyTranslation): void;
     addReference(reference: DocumentReference): void;
     private get sourceURL();

package/dist/lang/ast/types/malloy-element.js

@@ -158,6 +158,10 @@ class MalloyElement {
         }
         return undefined;
     }
+    isRestricted() {
+        var _a, _b;
+        return (_b = (_a = this.translator()) === null || _a === void 0 ? void 0 : _a.root.restrictedMode) !== null && _b !== void 0 ? _b : false;
+    }
     setTranslator(x) {
         this.xlate = x;
     }

package/dist/lang/malloy-to-ast.d.ts

@@ -35,10 +35,11 @@ type HasAnnotations = ParserRuleContext & {
 export declare class MalloyToAST extends AbstractParseTreeVisitor<ast.MalloyElement> implements MalloyParserVisitor<ast.MalloyElement> {
     readonly parseInfo: MalloyParseInfo;
     readonly msgLog: MessageLogger;
+    readonly restrictedMode: boolean;
     readonly timer: Timer;
     private compilerFlagSrc;
     private compilerFlagTag?;
-    constructor(parseInfo: MalloyParseInfo, msgLog: MessageLogger, compilerFlagSrc: string[]);
+    constructor(parseInfo: MalloyParseInfo, msgLog: MessageLogger, compilerFlagSrc: string[], restrictedMode?: boolean);
     getCompilerFlags(): Tag;
     run(): {
         ast: ast.MalloyElement;