@malloydata/malloyyo 0.2.17 → 0.2.18

package/dist/frame-entry.tsx

@@ -0,0 +1,11 @@
+// @ts-nocheck
+// Browser entry for the SANDBOXED dashboard iframe, bundled on demand by the
+// dashboard dev server. All behavior lives in ./frame-runtime (shared with the
+// hosted app's vendor bundle); this file just mounts the artifact's component.
+// `virtual:dashboard` is aliased by the dev server to the dashboard's
+// Dashboard.tsx — or to the runtime's DefaultDashboard when the `# artifact`
+// tag ships no component.
+import Dashboard from "virtual:dashboard";
+import { mountDashboard } from "./frame-runtime/index";
+
+mountDashboard(Dashboard);

package/dist/frame-inpage-entry.tsx

@@ -0,0 +1,38 @@
+// @ts-nocheck
+// Browser entry for the IN-PAGE (no-iframe) tag-only dashboard preview. A
+// dashboard with no Dashboard.tsx has no untrusted code to sandbox, so the dev
+// server mounts the runtime's DefaultDashboard DIRECTLY in the trusted shell
+// page — full-width, page-scrolling, like the VSCode/Composer preview. This is
+// the in-page twin of frame-entry.tsx (the sandboxed iframe entry for CUSTOM
+// dashboards): same runtime, but a direct-fetch host instead of postMessage.
+import { mountInPage } from "./frame-runtime/index";
+
+const info = window.__DASHBOARD__ || {};
+const name = info.name;
+
+// Reflect committed givens into the shell URL as `?d=<name>&$NAME=…`.
+const givensToUrl = (dashboard, givens) => {
+  const u = new URL(location.href);
+  u.search = "";
+  u.searchParams.set("d", dashboard);
+  for (const [k, v] of Object.entries(givens)) if (v != null && String(v) !== "") u.searchParams.set("$" + k, String(v));
+  return u.pathname + u.search;
+};
+
+mountInPage({
+  root: document.getElementById("root"),
+  // Governed query — the shell's trusted /api/run (the same endpoint the iframe
+  // broker forwards to). Returns the raw result the runtime normalizes.
+  run: (req, givens) =>
+    fetch("/api/run", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ d: name, query: req.query, malloy: req.malloy, givens }),
+    })
+      .then((r) => r.json())
+      .catch((e) => ({ ok: false, problems: [{ message: String(e) }] })),
+  navigate: (dashboard, givens) => {
+    location.href = givensToUrl(dashboard, givens);
+  },
+  syncGivens: (givens) => history.replaceState(null, "", givensToUrl(name, givens)),
+});

package/dist/frame-runtime/combine.ts

@@ -0,0 +1,181 @@
+// Copyright (c) The Malloy Foundation
+// SPDX-License-Identifier: MIT
+
+// Combine N separately-run tile results into ONE `# dashboard` result that the
+// Malloy renderer lays out as a grid of cards — the same structural trick the
+// engine once did server-side, but run client-side so the composite renderer can
+// combine whatever tiles have arrived (Malloy owns the layout).
+//
+// The trick (interfaces format): a `nest:` and a standalone tile result are
+// STRUCTURALLY IDENTICAL — a nest is an `array<record>` whose cell is an
+// `array_cell` of `record_cell`s, which is exactly a tile's `data`/`schema`. So
+// each tile drops into a dashboard card verbatim. Additionally, a tile that is a
+// SINGLE ROW OF MEASURES (an aggregate view, no group-by / no dimensions) is
+// merged straight into the outer dashboard as top-level KPI tiles instead of a
+// named sub-card — matching how a native single-query dashboard renders top-level
+// `aggregate:`. Its `# colspan` is distributed across those KPIs so they sum to
+// the tile's width, and a `# break` lands on the first KPI.
+//
+// Structural types only (same convention as the engine): we touch just the slice
+// of the interfaces Result we read/build.
+
+interface ResultAnnotation {
+  value: string;
+}
+interface RecordField {
+  name: string;
+  type: unknown;
+  annotations?: ResultAnnotation[];
+}
+interface ResultField {
+  kind: string;
+  name: string;
+  type: unknown;
+  annotations?: ResultAnnotation[];
+}
+interface ResultCell {
+  kind: string;
+  array_value?: ResultCell[];
+  record_value?: ResultCell[];
+  [k: string]: unknown;
+}
+export interface CombinableResult {
+  connection_name?: string;
+  annotations?: ResultAnnotation[];
+  model_annotations?: ResultAnnotation[];
+  schema: { fields: ResultField[] };
+  data?: ResultCell;
+  [k: string]: unknown;
+}
+export interface DashboardTile {
+  name: string;
+  result: CombinableResult;
+}
+
+/** Render directives to lift from a tile's result annotations onto its card: the
+    `# …` tags (`# line_chart`, `# colspan=3`, `# break`, …) but NOT `#(malloy) …`
+    metadata, NOT `#" …` docs, and NOT the tile's own `# artifact` tag. */
+function liftRenderTags(annotations?: ResultAnnotation[]): ResultAnnotation[] {
+  if (!annotations) return [];
+  return annotations.filter((a) => a.value.startsWith("# ") && !a.value.startsWith("# artifact"));
+}
+
+/** Turn a tile result into a nest field (an `array<record>` card) carrying the
+    tile's render tags. */
+function tileAsNestField(name: string, res: CombinableResult): ResultField {
+  const fields: RecordField[] = (res.schema?.fields ?? []).map((f) => ({
+    name: f.name,
+    type: f.type,
+    annotations: f.annotations,
+  }));
+  return {
+    kind: "dimension",
+    name,
+    type: { kind: "array_type", element_type: { kind: "record_type", fields } },
+    annotations: liftRenderTags(res.annotations),
+  };
+}
+
+function uniqueName(name: string, taken: Set<string>): string {
+  if (!taken.has(name)) {
+    taken.add(name);
+    return name;
+  }
+  let i = 2;
+  while (taken.has(`${name}_${i}`)) i++;
+  const out = `${name}_${i}`;
+  taken.add(out);
+  return out;
+}
+
+/** A field is a measure when its `#(malloy) …` annotation carries the
+    `calculation` marker (that's what makes the renderer draw it as a big value).
+    Dimensions (group_by / select columns) don't have it. */
+function isMeasure(field: ResultField): boolean {
+  return (field.annotations ?? []).some((a) => /(^|\s)calculation(\s|$)/.test(a.value));
+}
+
+/** A tile is an "aggregate row" when every field is a MEASURE (an aggregate view
+    with no group-by / no dimensions / no nesting — which always yields a single
+    row). Those merge as top-level KPI tiles rather than a card. This is decided
+    from the SCHEMA alone (not the data), so a tile's slot is the same whether we
+    have its schema-only result or its full result — the layout doesn't shift when
+    data arrives. Requiring measures — not just any scalar — keeps a 1-row detail
+    table (`select … limit 1`) rendering as a table card. */
+export function isAggregateRow(res: CombinableResult): boolean {
+  const fields = res.schema?.fields ?? [];
+  return fields.length > 0 && fields.every(isMeasure);
+}
+
+function readNumericTag(annotations: ResultAnnotation[] | undefined, key: string): number | undefined {
+  for (const a of annotations ?? []) {
+    const m = new RegExp(`^#\\s*${key}\\s*=\\s*(\\d+)`).exec(a.value);
+    if (m) return parseInt(m[1], 10);
+  }
+  return undefined;
+}
+function hasTag(annotations: ResultAnnotation[] | undefined, key: string): boolean {
+  return (annotations ?? []).some((a) => new RegExp(`^#\\s*${key}(\\s|=|$)`).test(a.value.trim()));
+}
+
+/** Spread a merged tile's colspan across its N KPIs so they SUM to the tile's
+    width (colspan=4 over 3 KPIs → [2,1,1]); the outer row keeps the author's
+    intended proportions instead of every KPI defaulting to 1. */
+export function distributeColspan(total: number, n: number): number[] {
+  const base = Math.floor(total / n);
+  const rem = total % n;
+  return Array.from({ length: n }, (_, i) => Math.max(1, base + (i < rem ? 1 : 0)));
+}
+
+export interface CombineOptions {
+  columns?: number;
+}
+
+/** Combine tiles into one `# dashboard`-annotated result. Pure — no IO. */
+export function combineTiles(tiles: DashboardTile[], opts: CombineOptions = {}): CombinableResult {
+  const taken = new Set<string>();
+  const cols =
+    typeof opts.columns === "number" && Number.isFinite(opts.columns)
+      ? ` {columns=${Math.trunc(opts.columns)}}`
+      : "";
+  const fields: ResultField[] = [];
+  const cells: (ResultCell | undefined)[] = [];
+  for (const t of tiles) {
+    const res = t.result;
+    if (isAggregateRow(res)) {
+      // Splice the tile's measures in as top-level fields (→ KPI tiles). Keep each
+      // field's own annotations (the `#(malloy) … calculation` marker is what makes
+      // it render as a big-value KPI), and re-apply the tile's colspan (distributed)
+      // and `# break` (on the first KPI, so the group starts a fresh row). When the
+      // tile is still schema-only (no data yet), each KPI cell is null — the slot
+      // is reserved; the value fills in when the tile's real result arrives.
+      const row = res.data?.array_value?.[0]?.record_value ?? [];
+      const defs = res.schema.fields ?? [];
+      const tileColspan = readNumericTag(res.annotations, "colspan");
+      const spans = tileColspan ? distributeColspan(tileColspan, defs.length) : null;
+      const tileBreak = hasTag(res.annotations, "break");
+      defs.forEach((f, i) => {
+        const ann = (f.annotations ?? []).filter((a) => !/^#\s*colspan/.test(a.value.trim()));
+        if (spans) ann.push({ value: `# colspan=${spans[i]}\n` });
+        if (tileBreak && i === 0) ann.push({ value: `# break\n` });
+        fields.push({ ...f, name: uniqueName(f.name, taken), annotations: ann });
+        cells.push(row[i] ?? { kind: "null_cell" });
+      });
+    } else {
+      fields.push(tileAsNestField(uniqueName(t.name, taken), res));
+      // A schema-only tile (no data yet) reserves an EMPTY card; its rows fill in
+      // when the tile's real result arrives.
+      cells.push((res.data as ResultCell) ?? { kind: "array_cell", array_value: [] });
+    }
+  }
+  return {
+    connection_name: tiles[0]?.result.connection_name ?? "composite",
+    model_annotations: tiles[0]?.result.model_annotations,
+    annotations: [{ value: `# dashboard${cols}\n` }],
+    schema: { fields },
+    data: {
+      kind: "array_cell",
+      array_value: [{ kind: "record_cell", record_value: cells as ResultCell[] }],
+    },
+  };
+}

package/dist/frame-runtime/drill.ts

@@ -0,0 +1,138 @@
+// Drill — the shared reading of a `# drill { to=[…] }` dimension click.
+//
+// Two hosts render Malloy results and honor drills: the dashboard frame runtime
+// (runtime.tsx — navigates to a sibling dashboard, or filters in place via a
+// given), and the hosted app's ltool result view (src/components/MalloyResultView.tsx
+// — links out to the dashboard). Both must read the same tag, pick the same
+// target given, and escape the clicked value the same way, so that reading lives
+// here once. What to DO with a resolved drill is each host's business.
+//
+// Browser-only (markDrillableCells touches the DOM), no host access.
+
+import { filters } from "./filters";
+
+/** A Malloy tag, as the renderer's field metadata exposes it. */
+interface Tag {
+  tag(name: string): Tag | undefined;
+  text(name: string): string | undefined;
+  textArray(name: string): string[] | undefined;
+}
+
+/** A result field, from a click payload or the renderer's metadata. */
+interface Field {
+  name: string;
+  tag?: Tag;
+  wasDimension?: () => boolean;
+}
+
+/** What the renderer hands `onClick`. */
+export interface CellClickPayload {
+  isHeader?: boolean;
+  field?: Field;
+  value?: unknown;
+  event?: { clientX?: number; clientY?: number };
+}
+
+/** Enough of the renderer's viz handle to read field metadata. */
+interface VizLike {
+  getMetadata(): { getAllFields(): Field[] } | null | undefined;
+}
+
+/** A resolved drill: where it may go, and the filter to seed when it gets there. */
+export interface Drill {
+  /** `to=` destinations — dashboard slugs and/or the literal `self`. */
+  dests: string[];
+  /** Given to seed at the destination. */
+  given: string;
+  /** Exact-match filter expression for the clicked value, escaped. */
+  filterExpr: string;
+}
+
+/** Slug → menu label: "category_dashboard"/"brand-explorer" → "Category dashboard". */
+export function humanizeSlug(s: string): string {
+  const t = String(s).replace(/[-_]+/g, " ").trim();
+  return t.charAt(0).toUpperCase() + t.slice(1);
+}
+
+/**
+ * Read a cell click as a drill, or null when the cell doesn't drill (a header, a
+ * measure, an untagged dimension, an empty value).
+ */
+export function resolveDrill(payload: CellClickPayload | null | undefined): Drill | null {
+  if (!payload || payload.isHeader) return null;
+  const f = payload.field;
+  // Only dimensions drill — a measure/aggregate click shouldn't navigate.
+  if (!f || typeof f.wasDimension !== "function" || !f.wasDimension()) return null;
+  const drillTag = f.tag && f.tag.tag("drill");
+  if (!drillTag) return null;
+  // `to=[a, self]` (array) or `to=x` (single) — a dest is a dashboard slug or `self`.
+  const one = drillTag.text("to");
+  const dests = drillTag.textArray("to") ?? (one ? [one] : []);
+  if (!dests.length || payload.value == null) return null;
+  return {
+    dests,
+    // The target given defaults to the dimension name upper-cased (category →
+    // CATEGORY); `given=` names it explicitly when the destination's given
+    // differs. One given per drill today; a future syntax may map several from a
+    // single query.
+    given: drillTag.text("given") || String(f.name).toUpperCase(),
+    filterExpr: filters.oneOf(String(payload.value)),
+  };
+}
+
+/**
+ * Names of the fields that declare `# drill`, from the renderer's metadata
+ * (includes any `# label` so callers can match either against the header text).
+ */
+export function drillFieldNames(viz: VizLike): Set<string> {
+  const names = new Set<string>();
+  try {
+    const meta = viz.getMetadata();
+    const fields = meta ? meta.getAllFields() : [];
+    for (const f of fields) {
+      if (f && f.tag && f.tag.tag && f.tag.tag("drill")) {
+        names.add(String(f.name));
+        const label = f.tag.text && f.tag.text("label");
+        if (label) names.add(label);
+      }
+    }
+  } catch {
+    /* metadata unavailable — no affordance, clicks still work */
+  }
+  return names;
+}
+
+// The renderer gives no per-cell field id, but each cell carries an inline
+// `grid-column: N / …` and each table's header cells (.th) hold the field names.
+const gridColStart = (el: HTMLElement): string | null => {
+  const m = (el.style && el.style.gridColumn ? el.style.gridColumn : "").match(/^\s*(\d+)/);
+  return m ? m[1] : null;
+};
+
+/**
+ * Tag drillable cells with `dash-drill` so the host can style them as links and
+ * users can see they're clickable. Per table: header .th cells at a drillable
+ * field → that column's grid-column → mark this table's own body .td cells in
+ * that column.
+ */
+export function markDrillableCells(container: HTMLElement, names: Set<string>): void {
+  if (!names.size) return;
+  for (const table of container.querySelectorAll<HTMLElement>(".malloy-table")) {
+    const mine = (el: Element) => el.closest(".malloy-table") === table; // skip nested tables
+    const cols = new Set<string>();
+    for (const th of table.querySelectorAll<HTMLElement>(".column-cell.th")) {
+      if (!mine(th)) continue;
+      const text = (th.textContent || "").replace(/​/g, "").trim();
+      const gc = gridColStart(th);
+      if (gc && names.has(text)) cols.add(gc);
+    }
+    if (!cols.size) continue;
+    for (const td of table.querySelectorAll<HTMLElement>(".column-cell.td")) {
+      // Only leaf value cells — never a cell that wraps a nested table.
+      const gc = gridColStart(td);
+      if (mine(td) && gc && cols.has(gc) && !td.querySelector(".malloy-table")) {
+        td.classList.add("dash-drill");
+      }
+    }
+  }
+}

package/dist/frame-runtime/filters.ts

@@ -0,0 +1,188 @@
+// JS helpers for Malloy filter expressions — the values dashboards bind to
+// `filter<T>` givens. Controls hold ordinary JS state (a list of picks, a
+// lo/hi pair); these helpers convert to/from filter-expression SOURCE strings
+// with correct escaping, backed by Malloy's own parser (@malloydata/malloy-filter)
+// so a dashboard never string-concatenates a filter by hand.
+//
+// Bundled into the sandboxed frame and handed to Dashboard.tsx as the
+// `filters` prop. Pure functions, no host access.
+
+import {
+  NumberFilterExpression,
+  StringFilterExpression,
+  TemporalFilterExpression,
+  type NumberFilter,
+  type StringFilter,
+  type TemporalFilter,
+  type TemporalUnit,
+} from "@malloydata/malloy-filter";
+
+export type { TemporalUnit };
+
+export interface FilterHelpers {
+  // ── build (JS state → filter expression source) ──────────────────
+  /** Exact-match alternatives: oneOf("CA","NY") → 'CA, NY' (escaped). */
+  oneOf(...values: string[]): string;
+  /** Substring / prefix / suffix match: contains("ann") → '%ann%'. */
+  contains(s: string): string;
+  startsWith(s: string): string;
+  endsWith(s: string): string;
+  /** Inclusive numeric range: between(1910, 1930) → '[1910 to 1930]'. */
+  between(lo: number, hi: number): string;
+  greaterThan(n: number): string;
+  atLeast(n: number): string;
+  lessThan(n: number): string;
+  atMost(n: number): string;
+  /** Rolling window ending now, for a filter<timestamp|date> given:
+      lastN(7, "day") → '7 days' (Malloy's "in the last 7 days"). */
+  lastN(n: number, units: TemporalUnit): string;
+  /** Inclusive literal date/time range: dateRange("2026-01-01", "2026-07-01")
+      → '2026-01-01 to 2026-07-01'. Accepts date ('2026-01-01') or timestamp
+      ('2026-01-01 12:30') literals. */
+  dateRange(from: string, to: string): string;
+  /** One-sided literal bounds: afterDate("2026-01-01") → 'after 2026-01-01'. */
+  afterDate(literal: string): string;
+  beforeDate(literal: string): string;
+
+  // ── read (filter expression source → JS state, null when it isn't that shape) ──
+  /** The exact-match values of a string filter: values('CA, NY') → ["CA","NY"].
+      Null when the expression is not a plain equality list. */
+  values(src: string): string[] | null;
+  /** The inclusive bounds of a numeric range: numberRange('[1910 to 1930]') →
+      {lo: 1910, hi: 1930}. Null when the expression is not a range. */
+  numberRange(src: string): { lo: number; hi: number } | null;
+  /** The bound of a one-sided comparison: threshold('> 200') → {op: ">", n: 200}. */
+  threshold(src: string): { op: ">" | ">=" | "<" | "<=" | "=" | "!="; n: number } | null;
+  /** The rolling window of a temporal filter: inLast('7 days') →
+      {n: 7, units: "day"}. Null when the expression is not that shape. */
+  inLast(src: string): { n: number; units: TemporalUnit } | null;
+  /** The literal bounds of a temporal range: temporalRange('2026-01-01 to
+      2026-07-01') → {from: "2026-01-01", to: "2026-07-01"}. Null otherwise. */
+  temporalRange(src: string): { from: string; to: string } | null;
+
+  // ── validate ──────────────────────────────────────────────────────
+  /** True when src parses as a filter over the Malloy type
+      ("string" | "number" | "timestamp" | "timestamptz" | "date"). */
+  isValid(filterType: string, src: string): boolean;
+}
+
+const str = (f: StringFilter | null) => StringFilterExpression.unparse(f);
+const num = (f: NumberFilter | null) => NumberFilterExpression.unparse(f);
+const tmp = (f: TemporalFilter | null) => TemporalFilterExpression.unparse(f);
+const isTemporalType = (t: string) => t === "timestamp" || t === "timestamptz" || t === "date";
+
+// Exact-match filter source, minimally escaped. `unparse` conservatively
+// backslash-escapes spaces/hyphens/etc. ('Outerwear\ &\ Coats', 'Ray\-Ban')
+// even though those parse fine unescaped — the escaping then leaks into the URL
+// and the Search box as stray `\`. So prefer the CLEAN comma-joined form when it
+// round-trips to exactly these values, and only fall back to escaping when a
+// value carries filter-significant punctuation (an internal comma, a leading
+// '-', a '%', …) that would otherwise change the parse.
+function exactMatch(values: string[]): string {
+  const clean = values.join(", ");
+  const { parsed, log } = StringFilterExpression.parse(clean);
+  const roundTrips =
+    !!parsed &&
+    parsed.operator === "=" &&
+    !("not" in parsed && (parsed as { not?: boolean }).not) &&
+    Array.isArray((parsed as { values?: string[] }).values) &&
+    (parsed as { values: string[] }).values.length === values.length &&
+    (parsed as { values: string[] }).values.every((v, i) => v === values[i]) &&
+    !(log || []).some((l) => l.severity === "error");
+  return roundTrips ? clean : str({ operator: "=", values });
+}
+
+export const filters: FilterHelpers = {
+  oneOf: (...values) => exactMatch(values),
+  contains: (s) => str({ operator: "contains", values: [s] }),
+  startsWith: (s) => str({ operator: "starts", values: [s] }),
+  endsWith: (s) => str({ operator: "ends", values: [s] }),
+  between: (lo, hi) =>
+    num({
+      operator: "range",
+      startOperator: ">=",
+      startValue: String(lo),
+      endOperator: "<=",
+      endValue: String(hi),
+    }),
+  greaterThan: (n) => num({ operator: ">", values: [String(n)] }),
+  atLeast: (n) => num({ operator: ">=", values: [String(n)] }),
+  lessThan: (n) => num({ operator: "<", values: [String(n)] }),
+  atMost: (n) => num({ operator: "<=", values: [String(n)] }),
+  lastN: (n, units) => tmp({ operator: "in_last", units, n: String(n) }),
+  dateRange: (from, to) =>
+    tmp({
+      operator: "to",
+      fromMoment: { moment: "literal", literal: from },
+      toMoment: { moment: "literal", literal: to },
+    }),
+  afterDate: (literal) => tmp({ operator: "after", after: { moment: "literal", literal } }),
+  beforeDate: (literal) => tmp({ operator: "before", before: { moment: "literal", literal } }),
+
+  values(src) {
+    const { parsed } = StringFilterExpression.parse(src);
+    if (parsed && parsed.operator === "=" && !("not" in parsed && parsed.not)) {
+      return (parsed as { values: string[] }).values;
+    }
+    return null;
+  },
+  numberRange(src) {
+    const { parsed } = NumberFilterExpression.parse(src);
+    if (parsed && parsed.operator === "range") {
+      const r = parsed as { startValue: string; endValue: string };
+      const lo = Number(r.startValue);
+      const hi = Number(r.endValue);
+      if (Number.isFinite(lo) && Number.isFinite(hi)) return { lo, hi };
+    }
+    return null;
+  },
+  threshold(src) {
+    const { parsed } = NumberFilterExpression.parse(src);
+    if (
+      parsed &&
+      (parsed.operator === ">" ||
+        parsed.operator === ">=" ||
+        parsed.operator === "<" ||
+        parsed.operator === "<=" ||
+        parsed.operator === "=" ||
+        parsed.operator === "!=")
+    ) {
+      const v = (parsed as { values: string[] }).values;
+      const n = Number(v?.[0]);
+      if (Number.isFinite(n)) return { op: parsed.operator, n };
+    }
+    return null;
+  },
+  inLast(src) {
+    const { parsed } = TemporalFilterExpression.parse(src);
+    if (parsed && parsed.operator === "in_last") {
+      const n = Number(parsed.n);
+      if (Number.isFinite(n)) return { n, units: parsed.units };
+    }
+    return null;
+  },
+  temporalRange(src) {
+    const { parsed } = TemporalFilterExpression.parse(src);
+    if (
+      parsed &&
+      parsed.operator === "to" &&
+      parsed.fromMoment.moment === "literal" &&
+      parsed.toMoment.moment === "literal"
+    ) {
+      return { from: parsed.fromMoment.literal, to: parsed.toMoment.literal };
+    }
+    return null;
+  },
+  isValid(filterType, src) {
+    if (filterType === "number") {
+      const r = NumberFilterExpression.parse(src);
+      return r.parsed !== null && !r.log.some((l) => l.severity === "error");
+    }
+    if (isTemporalType(filterType)) {
+      const r = TemporalFilterExpression.parse(src);
+      return r.parsed !== null && !r.log.some((l) => l.severity === "error");
+    }
+    const r = StringFilterExpression.parse(src);
+    return r.parsed !== null && !r.log.some((l) => l.severity === "error");
+  },
+};

package/dist/frame-runtime/index.ts

@@ -0,0 +1,68 @@
+// @malloyyo/dashboard — the import surface a Dashboard.tsx sees. The bundlers
+// alias "@malloyyo/dashboard" to this file (CLI dev server: esbuild alias;
+// hosted: shimmed to window.__DASH_RUNTIME__, which IS this module bundled
+// into the vendor asset). Everything here also arrives as props on the
+// Dashboard component; imports are the readable form.
+//
+// A CUSTOM dashboard renders itself: hooks + controls + <VegaChart>, drawing
+// its own visuals. It does NOT get the Malloy renderer — `Panel` /
+// `CompositeDashboard` / `DefaultDashboard` are intentionally NOT exported. The
+// renderer runs ONLY in the trusted page for a TAG-ONLY dashboard (no
+// Dashboard.tsx), mounted with mountInPage below. "You want custom, render it
+// yourself." (Importing Panel from a custom dashboard therefore fails to
+// bundle — that's the signal to make it tag-only, or draw it with VegaChart.)
+
+export {
+  filters,
+  runData,
+  useGiven,
+  useOptions,
+  useQuery,
+  mount,
+  setHost,
+  dashboardInfo,
+  givenSpecs,
+} from "./runtime";
+export {
+  Controls,
+  Given,
+  Select,
+  Search,
+  MultiSelect,
+  Range,
+  Checkbox,
+  TimeRange,
+  DEFAULT_TIME_PRESETS,
+  Field,
+} from "./ui";
+export { VegaChart } from "./vega-chart";
+
+import { mount, setHost } from "./runtime";
+import { Controls, Given, Select, Search, MultiSelect, Range, Checkbox, TimeRange, DefaultDashboard } from "./ui";
+import { VegaChart } from "./vega-chart";
+
+const WIDGETS = { Controls, Given, Select, Search, MultiSelect, Range, Checkbox, TimeRange, VegaChart };
+
+/** Sandboxed-iframe entry (CUSTOM dashboards): mount a Dashboard with the widget
+    components in its props. A null Dashboard falls back to DefaultDashboard, but
+    tag-only dashboards no longer reach the iframe — they use mountInPage. */
+export function mountDashboard(Dashboard: unknown): void {
+  mount(Dashboard ?? DefaultDashboard, WIDGETS);
+}
+
+/** Trusted-page entry (TAG-ONLY dashboards, NO iframe): mount DefaultDashboard —
+    the Malloy renderer — directly into `root`, wired to a direct-fetch host the
+    page supplies (run/navigate/syncGivens). This is how a dashboard with no
+    Dashboard.tsx runs full-width, like the VSCode/Composer preview. */
+export function mountInPage(opts: {
+  root: HTMLElement;
+  run: (req: { query?: string; malloy?: string }, givens: Record<string, unknown>) => Promise<unknown>;
+  navigate: (dashboard: string, givens: Record<string, unknown>) => void;
+  syncGivens: (givens: Record<string, unknown>) => void;
+}): { unmount: () => void } {
+  setHost({ run: opts.run, navigate: opts.navigate, syncGivens: opts.syncGivens });
+  // bodyReset:false — the dashboard is one element in the app shell, so it must
+  // not restyle <body> (the iframe host DOES own the whole document, so it keeps
+  // the reset). Returns the React root so the caller can unmount() on teardown.
+  return mount(DefaultDashboard, WIDGETS, opts.root, { bodyReset: false });
+}