@malloydata/malloy 0.0.431 → 0.0.432

package/dist/api/foundation/config.js

@@ -6,6 +6,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MalloyConfig = exports.Manifest = void 0;
 exports.isBuildManifestEntry = isBuildManifestEntry;
+const registry_1 = require("../../connection/registry");
 const config_compile_1 = require("./config_compile");
 const config_resolve_1 = require("./config_resolve");
 const config_lookup_1 = require("./config_lookup");
@@ -165,7 +166,7 @@ class MalloyConfig {
         // it happens async at `lookupConnection` time, so overlays that touch
         // IO (secret stores, session reads) have a natural async seam.
         const prepared = (0, config_resolve_1.prepareConfig)(compiled.compiled, mergedOverlays, log);
-        this._managedLookup = (0, config_lookup_1.buildManagedLookup)(prepared.compiledConnections, mergedOverlays, log);
+        this._managedLookup = (0, config_lookup_1.buildManagedLookup)(prepared.compiledConnections, rawConnectionEntries(pojo), mergedOverlays, log);
         this._connections = this._managedLookup;
         this._overlays = mergedOverlays;
         this.virtualMap = toVirtualMap(prepared.virtualMap, log);
@@ -476,6 +477,27 @@ function toVirtualMap(raw, log) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/**
+ * The connection entries exactly as authored, kept alongside the compiled tree
+ * and handed to each factory as `rawConfigData`. Compilation replaces an
+ * overlay reference with a `ConfigReference` node and resolution replaces that
+ * with the value, so this is the only place a connector can still see *which*
+ * overlay a value came from — which is what BigQuery's `getDigest` needs to
+ * tell two impersonated identities apart.
+ *
+ * No validation here beyond the shape: entries the compiler rejected are
+ * absent from `compiledConnections` and so are never looked up.
+ */
+function rawConnectionEntries(pojo) {
+    const entries = {};
+    if (!isRecord(pojo) || !isRecord(pojo['connections']))
+        return entries;
+    for (const [name, entry] of Object.entries(pojo['connections'])) {
+        if ((0, registry_1.isConnectionConfigEntry)(entry))
+            entries[name] = entry;
+    }
+    return entries;
+}
 function isBuildManifestEntry(value) {
     return isRecord(value) && typeof value['tableName'] === 'string';
 }

package/dist/api/foundation/config_compile.d.ts

@@ -3,7 +3,7 @@ import type { LogMessage } from '../../lang/parse-log';
  * A compiled config node. The compiler produces a tree of these; the resolver
  * walks the tree against a ConfigOverlays dict and produces a plain POJO.
  */
-export type ConfigNode = ConfigDict | ConfigLiteral | ConfigReference;
+export type ConfigNode = ConfigDict | ConfigLiteral | ConfigReference | ConfigInvalid;
 export interface ConfigDict {
     kind: 'dict';
     entries: Record<string, ConfigNode>;
@@ -23,6 +23,17 @@ export interface ConfigReference {
     /** Path into the overlay. */
     path: string[];
 }
+/**
+ * A property the user wrote that can never produce a value — it failed its
+ * type check. Compilation records it rather than dropping it so that a
+ * `mustHaveValue` property can tell "the user wrote something unusable" apart
+ * from "the user wrote nothing." It resolves to `undefined` like any other
+ * failure; the difference is only that the key is still visible in the
+ * compiled tree.
+ */
+export interface ConfigInvalid {
+    kind: 'invalid';
+}
 export type SectionCompiler = (value: unknown, log: LogMessage[]) => ConfigNode | undefined;
 /**
  * Compile a POJO into a typed dictionary tree, collecting validation warnings.

package/dist/api/foundation/config_compile.js

@@ -110,34 +110,49 @@ function compileConnectionEntry(prefix, typeName, rawEntry, log) {
     return entry;
 }
 /**
- * Compile a single connection property value. At non-`json` property slots,
- * a single-key object whose value is a string or string[] is recognized as
- * an overlay reference. `json`-typed slots always pass through as literal
- * data — this is the security invariant that prevents reference injection
- * into structured config.
+ * Compile a single connection property value.
+ *
+ * At non-`json` property slots, a single-key object whose value is a string or
+ * string[] is recognized as an overlay reference. `json`-typed slots always
+ * pass through as literal data — this is the security invariant that prevents
+ * reference injection into structured config.
+ *
+ * A property's `source` overrides that reading in both directions. `'literal'`
+ * refuses a reference; `'overlay'` refuses a literal, which is also what lets
+ * a reference be recognized in a slot that would otherwise hold a dictionary.
  */
 function compileConnectionProperty(path, propDef, value, log) {
-    if (value === undefined || value === null)
-        return undefined;
-    if (propDef.type === 'json') {
-        return { kind: 'value', value };
+    if (value === undefined || value === null) {
+        return propDef.mustHaveValue ? { kind: 'invalid' } : undefined;
     }
     const ref = asReferenceShape(value);
-    if (ref !== undefined) {
-        if (propDef.requireLiteralString) {
-            log.push(makeWarning(path, 'must be a literal string and cannot use an overlay reference'));
-            return { kind: 'value', value };
-        }
-        return ref;
+    switch (propDef.source) {
+        case 'overlay':
+            if (ref === undefined) {
+                log.push(makeWarning(path, 'must name an overlay, as in {env: "NAME"}; a value written here ' +
+                    'directly is not allowed'));
+                return { kind: 'invalid' };
+            }
+            return ref;
+        case 'literal':
+            if (ref !== undefined) {
+                log.push(makeWarning(path, 'must be written here directly and cannot name an overlay'));
+                return { kind: 'invalid' };
+            }
+            break;
+        default:
+            if (propDef.type === 'json') {
+                return { kind: 'value', value };
+            }
+            if (ref !== undefined) {
+                return ref;
+            }
+            break;
     }
     const typeError = checkValueType(value, propDef.type);
     if (typeError) {
-        if (propDef.requireLiteralString) {
-            log.push(makeWarning(path, `must be a literal string, got ${describeConfigValue(value)}`));
-            return { kind: 'value', value };
-        }
         log.push(makeWarning(path, `${typeError} (expected ${propDef.type})`));
-        return undefined;
+        return propDef.mustHaveValue ? { kind: 'invalid' } : undefined;
     }
     return { kind: 'value', value };
 }
@@ -221,11 +236,6 @@ function makeWarning(path, message) {
         code: 'config-validation',
     };
 }
-function describeConfigValue(value) {
-    if (Array.isArray(value))
-        return 'array';
-    return typeof value;
-}
 function checkValueType(value, expectedType) {
     switch (expectedType) {
         case 'number':
@@ -245,6 +255,7 @@ function checkValueType(value, expectedType) {
                 return `should be a string, got ${typeof value}`;
             break;
         case 'json':
+        case 'opaque':
             break;
     }
     return undefined;

package/dist/api/foundation/config_lookup.d.ts

@@ -1,5 +1,5 @@
 import type { LogMessage } from '../../lang/parse-log';
-import type { ManagedConnectionLookup } from '../../connection/registry';
+import type { ConnectionConfigEntry, ManagedConnectionLookup } from '../../connection/registry';
 import type { ConfigDict } from './config_compile';
 import type { ConfigOverlays } from './config_overlays';
 /**
@@ -28,4 +28,4 @@ import type { ConfigOverlays } from './config_overlays';
  * intentional consequence of deferred resolution: we don't pay for
  * warnings on connections nobody asks about.
  */
-export declare function buildManagedLookup(compiledConnections: Record<string, ConfigDict>, overlays: ConfigOverlays, log: LogMessage[]): ManagedConnectionLookup;
+export declare function buildManagedLookup(compiledConnections: Record<string, ConfigDict>, rawConnections: Record<string, ConnectionConfigEntry>, overlays: ConfigOverlays, log: LogMessage[]): ManagedConnectionLookup;

package/dist/api/foundation/config_lookup.js

@@ -32,7 +32,7 @@ const registry_1 = require("../../connection/registry");
  * intentional consequence of deferred resolution: we don't pay for
  * warnings on connections nobody asks about.
  */
-function buildManagedLookup(compiledConnections, overlays, log) {
+function buildManagedLookup(compiledConnections, rawConnections, overlays, log) {
     const entries = Object.entries(compiledConnections);
     const firstConnectionName = entries.length > 0 ? entries[0][0] : undefined;
     const cache = new Map();
@@ -51,7 +51,7 @@ function buildManagedLookup(compiledConnections, overlays, log) {
             if (!compiledEntry) {
                 throw new Error(`No connection named "${connectionName}" found in config`);
             }
-            const resolved = await resolveCompiledEntry(compiledEntry, overlays, log);
+            const resolved = await resolveCompiledEntry(connectionName, compiledEntry, overlays, log);
             // compileConnections guarantees `is` is present and a string-valued
             // literal node — resolveCompiledEntry preserves it. Defensive check
             // in case a compiler bug sneaks through.
@@ -71,8 +71,7 @@ function buildManagedLookup(compiledConnections, overlays, log) {
                     connConfig[key] = value;
                 }
             }
-            (0, registry_1.validateConnectionConfigProperties)(connectionName, resolved.is, connConfig);
-            const connection = await typeDef.factory(connConfig);
+            const connection = await typeDef.factory(connConfig, rawConnections[connectionName]);
             cache.set(connectionName, connection);
             return connection;
         },
@@ -97,7 +96,7 @@ function buildManagedLookup(compiledConnections, overlays, log) {
  * followed by property-default application. Returns the plain POJO that
  * gets handed to the factory.
  */
-async function resolveCompiledEntry(entry, overlays, log) {
+async function resolveCompiledEntry(connectionName, entry, overlays, log) {
     const resolved = await resolveNode(entry, overlays, log);
     // resolveNode returns `unknown`. The compileConnections pipeline
     // guarantees every connection entry is an object dict with `is` set to
@@ -106,9 +105,35 @@ async function resolveCompiledEntry(entry, overlays, log) {
     if (!(0, registry_1.isConnectionConfigEntry)(resolved)) {
         throw new Error('Connection entry did not resolve to a valid {is: string, ...} dict');
     }
+    // Before defaults, so that a declared default can't quietly satisfy a
+    // promise the user's own value failed to keep.
+    requireAuthoredValues(connectionName, entry, resolved);
     await applyPropertyDefaults(resolved, overlays);
     return resolved;
 }
+/**
+ * Enforce `mustHaveValue`: a property the user wrote must survive resolution.
+ *
+ * The compiled entry is the record of what was authored — a reference that
+ * resolved to nothing, or a value that failed its type check, is gone from
+ * `resolved` but still present here. Absence from both is fine; that's the
+ * user declining to set the property, which is what `optional` already means.
+ */
+function requireAuthoredValues(connectionName, entry, resolved) {
+    var _a;
+    for (const prop of (_a = (0, registry_1.getConnectionProperties)(resolved.is)) !== null && _a !== void 0 ? _a : []) {
+        if (!prop.mustHaveValue)
+            continue;
+        if (entry.entries[prop.name] === undefined)
+            continue;
+        if (resolved[prop.name] !== undefined)
+            continue;
+        throw new Error(`Connection "${connectionName}" sets "${prop.name}", but no value ` +
+            'arrived — an overlay reference that did not resolve, or a value that ' +
+            'was rejected. Omitting the property is allowed; this one cannot fall ' +
+            'back silently.');
+    }
+}
 /**
  * Walk a node, awaiting any overlay calls. References that fail to resolve
  * return `undefined`; the parent dict walker drops the corresponding
@@ -119,6 +144,8 @@ async function resolveNode(node, overlays, log) {
     switch (node.kind) {
         case 'value':
             return node.value;
+        case 'invalid':
+            return undefined;
         case 'reference':
             return resolveReference(node, overlays, log);
         case 'dict': {

package/dist/connection/registry.d.ts

@@ -1,12 +1,29 @@
 import type { Connection, ConnectionConfig, LookupConnection } from './types';
 /**
  * A factory function that creates a Connection from a config object.
+ *
+ * `rawConfigData` is the connection's entry exactly as the user wrote it,
+ * before overlay references were resolved — so an overlay-supplied property
+ * still reads as `{tenantAuth: "acme"}` rather than as the value it produced.
+ * A connector needs it when a resolved value has no stable identity of its own
+ * but the connection's digest depends on which one it is; BigQuery's
+ * `authClient` is the case that exists today. It is undefined for hosts that
+ * build connections from an already-resolved config.
+ *
+ * Being unresolved, it is the *non-secret* twin of `config`: it holds
+ * `{env: "PGPASSWORD"}` where `config` holds the password.
  */
-export type ConnectionTypeFactory = (config: ConnectionConfig) => Promise<Connection>;
+export type ConnectionTypeFactory = (config: ConnectionConfig, rawConfigData?: ConnectionConfigEntry) => Promise<Connection>;
 /**
  * The type of a connection property value.
  */
-export type ConnectionPropertyType = 'string' | 'number' | 'boolean' | 'password' | 'secret' | 'file' | 'json' | 'text';
+export type ConnectionPropertyType = 'string' | 'number' | 'boolean' | 'password' | 'secret' | 'file' | 'json' | 'text'
+/**
+ * A value with no declared shape that Malloy never inspects. Only reachable
+ * through an overlay — pair it with `source: 'overlay'`, since a config file
+ * has no way to write a live object down.
+ */
+ | 'opaque';
 /**
  * Describes a single configuration property for a connection type.
  *
@@ -35,12 +52,31 @@ export interface ConnectionPropertyDefinition {
     /** For type 'file': extension filters for picker dialogs. */
     fileFilters?: Record<string, string[]>;
     /**
-     * For security-sensitive string slots, preserve malformed/reference-shaped
-     * raw values so registry lookup can fail closed instead of silently dropping
-     * the property during generic compilation. Factories must not rely on this
-     * metadata as their only validation layer.
+     * Where this property's value is allowed to come from. Unset means either —
+     * a literal in the config file, or an overlay reference.
+     *
+     * `'literal'` refuses overlay references. For a property whose value is only
+     * meaningful if it was written down deliberately.
+     *
+     * `'overlay'` refuses literals: the config file can only *name* an overlay
+     * the host registered, never supply the value itself. This is also what
+     * makes a reference unambiguous in a slot that would otherwise hold a
+     * dictionary — if a literal isn't legal there, a single-key object can only
+     * be a reference.
      */
-    requireLiteralString?: true;
+    source?: 'literal' | 'overlay';
+    /**
+     * Writing this property is a promise that it will produce a value. Omitting
+     * it is fine; setting it and having nothing survive resolution is an error
+     * rather than a silent drop.
+     *
+     * For properties whose absence triggers a fallback that isn't safe — DuckDB's
+     * `securityPolicy`, where absent means the `none` policy, or a credential
+     * whose absence means the ambient one. Without this, a misspelled overlay
+     * source or an unset environment variable removes the property and the
+     * connection is built as if the user had never asked for it.
+     */
+    mustHaveValue?: true;
 }
 /**
  * A connection type definition: factory plus property metadata.
@@ -106,11 +142,6 @@ export declare function getRegisteredConnectionTypes(): string[];
  * lookup to hand fully-resolved configs to the right factory.
  */
 export declare function getConnectionTypeDef(typeName: string): ConnectionTypeDef | undefined;
-/**
- * Enforce registry-level literal-string requirements after overlay resolution
- * and before a connection factory sees the config.
- */
-export declare function validateConnectionConfigProperties(connectionName: string, typeName: string, config: ConnectionConfig): void;
 /**
  * Parse a JSON config string into a ConnectionsConfig.
  * Entries without a valid `is` field are silently dropped.

package/dist/connection/registry.js

@@ -10,7 +10,6 @@ exports.getConnectionProperties = getConnectionProperties;
 exports.getConnectionTypeDisplayName = getConnectionTypeDisplayName;
 exports.getRegisteredConnectionTypes = getRegisteredConnectionTypes;
 exports.getConnectionTypeDef = getConnectionTypeDef;
-exports.validateConnectionConfigProperties = validateConnectionConfigProperties;
 exports.readConnectionsConfig = readConnectionsConfig;
 exports.writeConnectionsConfig = writeConnectionsConfig;
 exports.createConnectionsFromConfig = createConnectionsFromConfig;
@@ -67,22 +66,6 @@ function getRegisteredConnectionTypes() {
 function getConnectionTypeDef(typeName) {
     return registry.get(typeName);
 }
-/**
- * Enforce registry-level literal-string requirements after overlay resolution
- * and before a connection factory sees the config.
- */
-function validateConnectionConfigProperties(connectionName, typeName, config) {
-    var _a, _b;
-    const props = (_b = (_a = registry.get(typeName)) === null || _a === void 0 ? void 0 : _a.properties) !== null && _b !== void 0 ? _b : [];
-    for (const prop of props) {
-        if (!prop.requireLiteralString)
-            continue;
-        const value = config[prop.name];
-        if (value !== undefined && typeof value !== 'string') {
-            throw new Error(`Connection "${connectionName}" property "${prop.name}" must be a literal string`);
-        }
-    }
-}
 /**
  * Parse a JSON config string into a ConnectionsConfig.
  * Entries without a valid `is` field are silently dropped.
@@ -144,7 +127,6 @@ function createConnectionsFromConfig(config, onConnectionCreated) {
                     connConfig[key] = value;
                 }
             }
-            validateConnectionConfigProperties(connectionName, entry.is, connConfig);
             const connection = await typeDef.factory(connConfig);
             if (onConnectionCreated) {
                 onConnectionCreated(connectionName, connection);

package/dist/connection/types.d.ts

@@ -49,9 +49,15 @@ export interface InfoConnection {
 export type ConnectionParameterValue = string | number | boolean | null | Array<ConnectionParameterValue> | {
     [key: string]: ConnectionParameterValue;
 };
+/**
+ * A value with no declared shape, supplied by a host overlay rather than
+ * written in a config file — an auth client, a session handle, anything live.
+ * Malloy never inspects one; it carries it from the overlay to the factory.
+ */
+export type OpaqueConnectionValue = object;
 export interface ConnectionConfig {
     name: string;
-    [key: string]: ConnectionParameterValue | undefined;
+    [key: string]: ConnectionParameterValue | OpaqueConnectionValue | undefined;
 }
 export interface ConnectionMetadata {
     url?: string;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const MALLOY_VERSION = "0.0.431";
+export declare const MALLOY_VERSION = "0.0.432";

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MALLOY_VERSION = void 0;
 // generated with 'generate-version-file' script; do not edit manually
-exports.MALLOY_VERSION = '0.0.431';
+exports.MALLOY_VERSION = '0.0.432';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloy",
-  "version": "0.0.431",
+  "version": "0.0.432",
   "license": "MIT",
   "exports": {
     ".": "./dist/index.js",
@@ -51,9 +51,9 @@
     "generate-version-file": "VERSION=$(npm pkg get version --workspaces=false | tr -d \\\")\necho \"// generated with 'generate-version-file' script; do not edit manually\\nexport const MALLOY_VERSION = '$VERSION';\" > src/version.ts"
   },
   "dependencies": {
-    "@malloydata/malloy-filter": "0.0.431",
-    "@malloydata/malloy-interfaces": "0.0.431",
-    "@malloydata/malloy-tag": "0.0.431",
+    "@malloydata/malloy-filter": "0.0.432",
+    "@malloydata/malloy-interfaces": "0.0.432",
+    "@malloydata/malloy-tag": "0.0.432",
     "@noble/hashes": "^1.8.0",
     "antlr4ts": "^0.5.0-alpha.4",
     "assert": "^2.0.0",