@malloydata/malloyyo 0.2.19 → 0.2.21

package/dist/frame-runtime/index.ts

@@ -66,3 +66,22 @@ export function mountInPage(opts: {
   // the reset). Returns the React root so the caller can unmount() on teardown.
   return mount(DefaultDashboard, WIDGETS, opts.root, { bodyReset: false });
 }
+
+/** Static-site entry (`malloyyo dashboard bundle`): like mountInPage, but mounts
+    the dashboard's OWN component when it has one. The published site has no
+    server and no iframe — the host runs Malloy + DuckDB-WASM in this same page,
+    so there is no trust boundary to sandbox across and custom and tag-only
+    dashboards can share one mount. A null Dashboard falls back to
+    DefaultDashboard, exactly as mountDashboard does. */
+export function mountStatic(
+  Dashboard: unknown,
+  opts: {
+    root: HTMLElement;
+    run: (req: { query?: string; malloy?: string }, givens: Record<string, unknown>) => Promise<unknown>;
+    navigate: (dashboard: string, givens: Record<string, unknown>) => void;
+    syncGivens: (givens: Record<string, unknown>) => void;
+  },
+): { unmount: () => void } {
+  setHost({ run: opts.run, navigate: opts.navigate, syncGivens: opts.syncGivens });
+  return mount(Dashboard ?? DefaultDashboard, WIDGETS, opts.root, { bodyReset: false });
+}

package/dist/frame-wasm-entry.tsx

@@ -0,0 +1,186 @@
+// @ts-nocheck
+// Browser entry for a STATIC dashboard site (`malloyyo dashboard bundle`).
+//
+// The other two entries assume a server holds the privileged capability:
+// frame-entry.tsx postMessages a trusted parent, frame-inpage-entry.tsx fetches
+// /api/run. This one has no server at all. Malloy compiles in the page and
+// DuckDB-WASM executes the SQL, so `host.run` is a local function call.
+//
+// That also means there is nothing to sandbox: with no credential in the page,
+// the iframe bought isolation from a threat that no longer exists, so custom and
+// tag-only dashboards share a single in-page mount (mountStatic).
+// Exported as boot(Dashboard) rather than self-executing: `dashboard bundle`
+// generates one tiny entry per dashboard that imports its own component and
+// calls this, so a single build can emit N dashboards that share one chunk.
+import * as duckdb from "@duckdb/duckdb-wasm";
+import { DuckDBWASMConnection } from "@malloydata/db-duckdb/wasm";
+import { API, SingleConnectionRuntime } from "@malloydata/malloy";
+import { mountStatic } from "./frame-runtime/index";
+import { givensFromSearch, givensToParams } from "./shared/givens-url";
+
+const info = window.__DASHBOARD__ || {};
+const MODEL_FILES = window.__MODEL_FILES__ || {};
+const ENTRY = `file:///${info.entryFile}`;
+
+// ── DuckDB-WASM ─────────────────────────────────────────────────────
+
+// Bundle URLs MUST be absolute. selectBundle hands them to the WORKER, whose
+// base URL is the worker's own directory — a relative path resolves against
+// that, 404s, and instantiate() then hangs forever with no error. This bites
+// hardest on GitHub Pages, where the site is served from /<repo>/.
+const abs = (p: string) => new URL(p, document.baseURI).href;
+
+// Where the DuckDB binaries come from. The build sets __DUCKDB_BASE__ when it
+// self-hosts them; absent, we use duckdb-wasm's own jsDelivr helper, which pins
+// the exact installed version in an immutable, CORS-open URL.
+const DUCKDB_BASE: string | undefined = (window as any).__DUCKDB_BASE__;
+
+class StaticWasmConnection extends DuckDBWASMConnection {
+  getBundles() {
+    if (!DUCKDB_BASE) return duckdb.getJsDelivrBundles();
+    const at = (f: string) => abs(DUCKDB_BASE + f);
+    return {
+      mvp: { mainModule: at("duckdb-mvp.wasm"), mainWorker: at("duckdb-browser-mvp.worker.js") },
+      eh: { mainModule: at("duckdb-eh.wasm"), mainWorker: at("duckdb-browser-eh.worker.js") },
+    };
+  }
+}
+
+// Whole-file fetch, not ranged reads.
+//
+// __TABLE_FILES__ maps each table reference the model makes to the URL this
+// page fetches for it. The KEY is what the model wrote and what DuckDB will
+// look up, so registering the bytes under that exact name means the model needs
+// no rewriting between `dashboard dev` (reads the file off disk) and here.
+//
+// Project-relative refs like `data/x.parquet` resolve against the page, so they
+// are SAME-ORIGIN — no CORS involved at all. Absolute URLs are fetched
+// cross-origin and do need CORS on that host.
+//
+// This cannot go through db-duckdb's registerRemoteTableCallback: findTables
+// skips anything matching ^https?:// ("handled by duckdb-wasm"), so the callback
+// never fires for a remote URL. Pre-registering is also strictly better — one
+// bulk GET instead of dozens of ranged round trips.
+const TABLE_FILES: Record<string, string> = (window as any).__TABLE_FILES__ || {};
+
+async function preloadTables(db: any) {
+  await Promise.all(
+    Object.entries(TABLE_FILES).map(async ([name, href]) => {
+      const url = new URL(href, document.baseURI).href;
+      const r = await fetch(url);
+      if (!r.ok) throw new Error(`fetch ${url} failed: ${r.status} ${r.statusText}`);
+      await db.registerFileBuffer(name, new Uint8Array(await r.arrayBuffer()));
+    }),
+  );
+}
+
+// ── Malloy ──────────────────────────────────────────────────────────
+
+// Model sources are inlined at build time (model-files.js) and keyed by the
+// file:// URL Malloy resolves imports against, so nothing is fetched at runtime.
+const urlReader = {
+  readURL: async (url: URL | string) => {
+    const key = url.toString();
+    const src = MODEL_FILES[key];
+    if (src == null) {
+      throw new Error(`model file not found: ${key}\nhave: ${Object.keys(MODEL_FILES).join(", ")}`);
+    }
+    return src;
+  },
+};
+
+let runtimeP: Promise<unknown> | null = null;
+function getRuntime() {
+  if (!runtimeP) {
+    runtimeP = (async () => {
+      const connection = new StaticWasmConnection({ name: "duckdb" });
+      await connection.connecting;
+      await preloadTables((connection as any).database);
+      return new SingleConnectionRuntime({ connection, urlReader });
+    })();
+  }
+  return runtimeP;
+}
+
+// Panel/data query text may arrive with or without a leading `run:`.
+const asRun = (t: string) => (/^\s*run\s*:/.test(t) ? t : `run: ${t}`);
+
+// Match `dashboard dev` exactly (host.ts passes this on every run path). Without
+// an explicit limit Malloy applies its own much smaller default, which silently
+// truncates tiles rather than erroring — they just look half-empty.
+const ROW_LIMIT = 5000;
+
+/** The host contract, served locally. `query` names a model-published query (or
+    a `source -> view` path); `malloy` is query text the runtime builds itself
+    (the given typeahead). Shape matches the dev server's: {ok, rows,
+    stable_result, problems[]}. */
+async function run(req: { query?: string; malloy?: string }, givens: Record<string, unknown>) {
+  try {
+    const runtime: any = await getRuntime();
+    const model = runtime.loadModel(new URL(ENTRY));
+    const text = req.malloy != null ? asRun(req.malloy) : asRun(req.query as string);
+    const result = await model.loadQuery(text).run({ rowLimit: ROW_LIMIT, givens: givens ?? {} });
+    // Same shaping the engine does (mcp-engine/src/run.ts): plain rows for
+    // components that draw themselves, plus the interfaces-format result the
+    // Malloy renderer needs for DefaultDashboard / <Panel>.
+    return {
+      ok: true,
+      rows: result.toJSON().queryResult.result,
+      stable_result: API.util.wrapResult(result),
+    };
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { ok: false, problems: [{ message: msg }] };
+  }
+}
+
+// ── mount ───────────────────────────────────────────────────────────
+
+// Same param encoding as the dev server (shared/givens-url); only the path
+// shape differs — sibling .html pages here vs `/?d=` there.
+const givensToUrl = (dashboard: string, givens: Record<string, unknown>) => {
+  const u = new URL(`./${dashboard}.html`, document.baseURI);
+  u.search = givensToParams(givens).toString();
+  return u.pathname + u.search;
+};
+
+// Custom dashboards drive drills by posting to `parent` directly:
+//   parent.postMessage({ type: "navigate", dashboard, givens }, "*")
+// Under `dashboard dev` the component runs in a sandboxed iframe, so `parent`
+// is the trusted shell, which listens and navigates. Here there IS no iframe —
+// the dashboard owns the top window — so `parent === window` and those messages
+// are posted to ourselves with nobody listening: clicking a name silently did
+// nothing. Re-implement the shell's half of the protocol against our own window.
+function installMessageBridge(name: string) {
+  window.addEventListener("message", (e: MessageEvent) => {
+    if (e.source !== window) return; // no other frames exist; ignore anything else
+    const m = e.data;
+    if (!m || typeof m !== "object") return;
+    if (m.type === "givens" && m.givens) {
+      history.replaceState(null, "", givensToUrl(name, m.givens));
+      return;
+    }
+    if (m.type === "navigate" && typeof m.dashboard === "string") {
+      location.href = givensToUrl(m.dashboard, m.givens || {});
+    }
+  });
+}
+
+/** Mount this page's dashboard. `Dashboard` is the model repo's own component,
+    or null for a tag-only dashboard (mountStatic falls back to the renderer). */
+export function boot(Dashboard: unknown) {
+  // Seed shareable-link values the same way the dev server does — server-side
+  // there, here from our own query string, but through the SAME encoder, so the
+  // `$` prefix the runtime keys off is preserved. Set before mount: the runtime
+  // reads this global lazily when it computes initial given values.
+  (window as any).__INITIAL_GIVENS__ = givensFromSearch(location.search);
+  installMessageBridge(info.name);
+  return mountStatic(Dashboard, {
+    root: document.getElementById("root") as HTMLElement,
+    run,
+    navigate: (dashboard, givens) => {
+      location.href = givensToUrl(dashboard, givens);
+    },
+    syncGivens: (givens) => history.replaceState(null, "", givensToUrl(info.name, givens)),
+  });
+}

package/dist/index.js

@@ -2699,11 +2699,48 @@ async function serveMcp(opts) {
 
 // src/dashboard.ts
 import http2 from "node:http";
+import fs4 from "node:fs";
+import path5 from "node:path";
+import * as esbuild2 from "esbuild";
+
+// src/shared/givens-url.ts
+function givensFromSearch(search) {
+  const g = {};
+  for (const [k, v] of new URLSearchParams(search)) {
+    if (k !== "d") g[k] = v;
+  }
+  return g;
+}
+
+// src/shared/nav.ts
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var NAV_CSS = `
+.dash-nav{display:flex;gap:4px;align-items:center;padding:8px 14px;background:#000;font:13px system-ui,-apple-system,sans-serif;flex-wrap:wrap}
+/* The home icon is an <a> too, so it opts OUT of the switcher-link padding and
+   keeps its own square hit area. */
+.dash-nav a.brand{display:inline-flex;align-items:center;justify-content:center;color:#9aa1ac;padding:5px;border-radius:6px;text-decoration:none}
+.dash-nav a.brand:hover{background:#1f232a;color:#fff}
+.dash-nav .brand svg{display:block}
+.dash-nav .sep{width:1px;align-self:stretch;background:#2c3038;margin:0 10px}
+.dash-nav a{padding:4px 10px;border-radius:6px;text-decoration:none;color:#c9ced6}
+.dash-nav a:hover{background:#1f232a;color:#fff}
+.dash-nav a.on{background:#fff;color:#000;font-weight:550}
+`;
+var HOME_ICON = `<svg viewBox="0 0 24 24" width="17" height="17" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false"><path d="M3 10.2 12 3.5l9 6.7"/><path d="M5.2 8.9V20h13.6V8.9"/><path d="M9.6 20v-6.2h4.8V20"/></svg>`;
+function navHtml(active, all, href, homeHref = "./") {
+  const brand = `<a class="brand" href="${esc(homeHref)}" title="Home" aria-label="Home">${HOME_ICON}</a>`;
+  if (all.length <= 1) return `<nav class="dash-nav">${brand}</nav>`;
+  const links = all.map(
+    (x) => `<a href="${esc(href(x.name))}"${x.name === active ? ' class="on"' : ""}>${esc(x.title || x.name)}</a>`
+  ).join("");
+  return `<nav class="dash-nav">${brand}<span class="sep"></span>${links}</nav>`;
+}
+
+// src/discover.ts
 import fs3 from "node:fs";
 import path4 from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
-import * as esbuild2 from "esbuild";
 var require2 = createRequire(import.meta.url);
 var HOST_LIBS = [
   "react",
@@ -2736,8 +2773,6 @@ function resolveRuntimeDir() {
   }
   return found;
 }
-var resolveFrameEntry = () => path4.join(resolveRuntimeDir(), "..", "frame-entry.tsx");
-var resolveInPageEntry = () => path4.join(resolveRuntimeDir(), "..", "frame-inpage-entry.tsx");
 var hostAliasPlugin = {
   name: "host-alias",
   setup(b) {
@@ -2763,15 +2798,35 @@ async function discoverDashboards(root, runner) {
   }
   return dashboards;
 }
-var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function browserBuildBase() {
+  const shims = path4.join(resolveRuntimeDir(), "..", "shims");
+  return {
+    platform: "browser",
+    jsx: "automatic",
+    loader: { ".css": "empty" },
+    define: { "process.env.NODE_ENV": '"production"' },
+    alias: {
+      assert: path4.join(shims, "assert.cjs"),
+      util: path4.join(shims, "util.cjs")
+    },
+    banner: {
+      js: "globalThis.process||={env:{},platform:'browser',versions:{},argv:[],cwd:()=>'/'};"
+    }
+  };
+}
+
+// src/dashboard.ts
+var resolveFrameEntry = () => path5.join(resolveRuntimeDir(), "..", "frame-entry.tsx");
+var resolveInPageEntry = () => path5.join(resolveRuntimeDir(), "..", "frame-inpage-entry.tsx");
+var esc2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 function makeBundler() {
   const cache = /* @__PURE__ */ new Map();
   const frameEntry = resolveFrameEntry();
   const runtimeDir = resolveRuntimeDir();
-  const runtimeIndex = path4.join(runtimeDir, "index.ts");
-  const runtimeStamp = () => fs3.statSync(frameEntry).mtimeMs + fs3.readdirSync(runtimeDir).map((f) => fs3.statSync(path4.join(runtimeDir, f)).mtimeMs).reduce((a, b) => a + b, 0);
+  const runtimeIndex = path5.join(runtimeDir, "index.ts");
+  const runtimeStamp = () => fs4.statSync(frameEntry).mtimeMs + fs4.readdirSync(runtimeDir).map((f) => fs4.statSync(path5.join(runtimeDir, f)).mtimeMs).reduce((a, b) => a + b, 0);
   return async function bundle(dash) {
-    const stamp = runtimeStamp() + (dash.tsxPath ? fs3.statSync(dash.tsxPath).mtimeMs : 0);
+    const stamp = runtimeStamp() + (dash.tsxPath ? fs4.statSync(dash.tsxPath).mtimeMs : 0);
     const hit = cache.get(dash.name);
     if (hit && hit.stamp === stamp) return hit.js;
     const result = await esbuild2.build({
@@ -2816,7 +2871,7 @@ function makeInPageBundler() {
   let cached;
   const entry = resolveInPageEntry();
   const runtimeDir = resolveRuntimeDir();
-  const stampOf = () => fs3.statSync(entry).mtimeMs + fs3.readdirSync(runtimeDir).map((f) => fs3.statSync(path4.join(runtimeDir, f)).mtimeMs).reduce((a, b) => a + b, 0);
+  const stampOf = () => fs4.statSync(entry).mtimeMs + fs4.readdirSync(runtimeDir).map((f) => fs4.statSync(path5.join(runtimeDir, f)).mtimeMs).reduce((a, b) => a + b, 0);
   return async function bundle() {
     const stamp = stampOf();
     if (cached && cached.stamp === stamp) return cached.js;
@@ -2837,13 +2892,9 @@ function makeInPageBundler() {
     return js;
   };
 }
-var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><meta name="viewport" content="width=device-width,initial-scale=1"></head><body style="margin:0">${body}</body></html>`;
-function navHtml(dash, all) {
-  if (all.length <= 1) return "";
-  return `<nav style="display:flex;gap:4px;align-items:center;padding:8px 12px;background:#f6f7f9;border-bottom:1px solid #e2e4e8;font:13px system-ui,sans-serif"><span style="color:#888;margin-right:8px">Dashboards</span>` + all.map((x) => {
-    const on = x.name === dash.name;
-    return `<a href="/?d=${encodeURIComponent(x.name)}" style="padding:4px 10px;border-radius:6px;text-decoration:none;${on ? "background:#1a1a1a;color:#fff" : "color:#333"}">${esc(x.title || x.name)}</a>`;
-  }).join("") + `</nav>`;
+var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>${NAV_CSS}</style></head><body style="margin:0">${body}</body></html>`;
+function navHtml2(dash, all) {
+  return navHtml(dash.name, all, (n) => `/?d=${encodeURIComponent(n)}`);
 }
 function inPageShell(dash, all, givenSpecs, initialGivens, tileSpecs) {
   const info = {
@@ -2858,7 +2909,7 @@ function inPageShell(dash, all, givenSpecs, initialGivens, tileSpecs) {
     autorun: dash.autorun
   };
   return html(
-    navHtml(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${JSON.stringify(info)};window.__GIVENS__=${JSON.stringify(givenSpecs)};window.__INITIAL_GIVENS__=${JSON.stringify(initialGivens)}</script><script>try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}</script><script src="/inpage.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    navHtml2(dash, all) + `<div id="root"></div><script>window.__DASHBOARD__=${JSON.stringify(info)};window.__GIVENS__=${JSON.stringify(givenSpecs)};window.__INITIAL_GIVENS__=${JSON.stringify(initialGivens)}</script><script>try{new EventSource('/events').onmessage=()=>location.reload();}catch(e){}</script><script src="/inpage.js?d=${encodeURIComponent(dash.name)}"></script>`,
     dash.title
   );
 }
@@ -2866,7 +2917,7 @@ function parentShell(dash, frameBase, all, initialGivens) {
   const givensQs = Object.entries(initialGivens).map(([k, v]) => `&${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("");
   const d = JSON.stringify(dash.name);
   const fb = JSON.stringify(frameBase);
-  const nav = navHtml(dash, all);
+  const nav = navHtml2(dash, all);
   return html(
     `<div style="display:flex;flex-direction:column;height:100vh">` + nav + // allow-popups(+escape-sandbox): let a # link mark open its target in a
     // normal new tab on click instead of being blocked by the sandbox.
@@ -2904,9 +2955,7 @@ window.addEventListener('message',async(e)=>{
   );
 }
 function givensFromUrl(url4) {
-  const g = {};
-  for (const [k, v] of url4.searchParams) if (k !== "d") g[k] = v;
-  return g;
+  return givensFromSearch(url4.search);
 }
 function frameDoc(dash, givenSpecs, initialGivens, tileSpecs) {
   const info = {
@@ -2934,7 +2983,7 @@ async function readBody(req) {
 }
 async function serveDashboard(opts) {
   await import("@malloydata/malloy-connections");
-  const root = path4.resolve(opts.root ?? process.cwd());
+  const root = path5.resolve(opts.root ?? process.cwd());
   const port = opts.port ?? 4173;
   const framePort = port + 1;
   const frameBase = `http://localhost:${framePort}`;
@@ -2967,7 +3016,7 @@ async function serveDashboard(opts) {
   };
   let debounce;
   try {
-    fs3.watch(root, { recursive: true }, (_evt, filename) => {
+    fs4.watch(root, { recursive: true }, (_evt, filename) => {
       const f = filename?.toString() ?? "";
       if (!f.endsWith(".malloy") && !f.includes("dashboards")) return;
       clearTimeout(debounce);
@@ -2999,7 +3048,7 @@ async function serveDashboard(opts) {
             return send(
               200,
               "text/html; charset=utf-8",
-              html(`<pre style="color:crimson;padding:16px">model error: ${esc(g.error)}</pre>`, dash.title)
+              html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
             );
           }
           return send(200, "text/html; charset=utf-8", frameDoc(dash, g.union, givensFromUrl(url4), g.tiles));
@@ -3024,7 +3073,7 @@ async function serveDashboard(opts) {
             return send(
               200,
               "text/html; charset=utf-8",
-              html(`<pre style="color:crimson;padding:16px">model error: ${esc(g.error)}</pre>`, dash.title)
+              html(`<pre style="color:crimson;padding:16px">model error: ${esc2(g.error)}</pre>`, dash.title)
             );
           }
           return send(200, "text/html; charset=utf-8", inPageShell(dash, dashboards, g.union, givensFromUrl(url4), g.tiles));
@@ -3064,9 +3113,445 @@ async function serveDashboard(opts) {
   });
 }
 
+// src/bundle.ts
+import fs6 from "node:fs";
+import path7 from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import * as esbuild3 from "esbuild";
+
+// src/static-server.ts
+import fs5 from "node:fs";
+import http3 from "node:http";
+import path6 from "node:path";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json",
+  // Must be exact: instantiateStreaming rejects anything else, and the failure
+  // shows up as a hang rather than an error.
+  ".wasm": "application/wasm",
+  ".parquet": "application/octet-stream",
+  ".svg": "image/svg+xml"
+};
+function serveStatic(dir, port) {
+  const server = http3.createServer((req, res) => {
+    const rel = decodeURIComponent((req.url ?? "/").split("?")[0]);
+    let file = path6.join(dir, rel === "/" ? "index.html" : rel);
+    if (!file.startsWith(dir)) return void res.writeHead(403).end();
+    if (fs5.existsSync(file) && fs5.statSync(file).isDirectory()) file = path6.join(file, "index.html");
+    if (!fs5.existsSync(file)) return void res.writeHead(404).end("not found");
+    const st = fs5.statSync(file);
+    const type = MIME[path6.extname(file)] ?? "application/octet-stream";
+    const range = req.headers.range;
+    if (range) {
+      const m = /bytes=(\d*)-(\d*)/.exec(range);
+      const start = m?.[1] ? Number(m[1]) : 0;
+      const end = m?.[2] ? Number(m[2]) : st.size - 1;
+      res.writeHead(206, {
+        "Content-Type": type,
+        "Content-Range": `bytes ${start}-${end}/${st.size}`,
+        "Accept-Ranges": "bytes",
+        "Content-Length": end - start + 1
+      });
+      return void fs5.createReadStream(file, { start, end }).pipe(res);
+    }
+    res.writeHead(200, { "Content-Type": type, "Content-Length": st.size, "Accept-Ranges": "bytes" });
+    fs5.createReadStream(file).pipe(res);
+  });
+  return new Promise((resolve3, reject) => {
+    let attempt = 0;
+    const tryPort = (p) => {
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && attempt < 10) {
+          attempt++;
+          tryPort(p + 1);
+          return;
+        }
+        reject(err);
+      });
+      server.listen(p, () => {
+        if (p !== port) console.log(`
+(port ${port} busy \u2014 using ${p})`);
+        console.log(`
+serving ${path6.basename(dir)}/ on http://localhost:${p}  (ctrl-c to stop)`);
+        resolve3();
+      });
+    };
+    tryPort(port);
+  });
+}
+
+// src/bundle.ts
+var require3 = createRequire2(import.meta.url);
+var esc3 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function inlineModelFiles(root) {
+  const files = {};
+  const skip = /* @__PURE__ */ new Set(["node_modules", ".git", "docs", "dist"]);
+  const walk = (dir) => {
+    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith(".") || skip.has(entry.name)) continue;
+      const abs = path7.join(dir, entry.name);
+      if (entry.isDirectory()) walk(abs);
+      else if (entry.name.endsWith(".malloy")) {
+        const rel = path7.relative(root, abs).split(path7.sep).join("/");
+        files[`file:///${rel}`] = fs6.readFileSync(abs, "utf8");
+      }
+    }
+  };
+  walk(root);
+  return files;
+}
+function reachableModelFiles(modelFiles, entries) {
+  const IMPORT = /\bimport\s+(?:\{[^}]*\}\s+from\s+)?['"]([^'"]+)['"]/g;
+  const out = {};
+  const queue = entries.map((e) => `file:///${e.replace(/^\.?\//, "")}`);
+  while (queue.length) {
+    const key = queue.shift();
+    if (key in out) continue;
+    const src = modelFiles[key];
+    if (src == null) continue;
+    out[key] = src;
+    const dir = key.slice(0, key.lastIndexOf("/"));
+    for (const m of src.matchAll(IMPORT)) {
+      queue.push(new URL(m[1], dir + "/").href);
+    }
+  }
+  return out;
+}
+function findTableRefs(modelFiles) {
+  const refs = /* @__PURE__ */ new Set();
+  const re = /\btable\(\s*(['"])([^'"]+)\1/g;
+  for (const src of Object.values(modelFiles)) {
+    for (const m of src.matchAll(re)) refs.add(m[2]);
+  }
+  return [...refs].sort();
+}
+function isDataFile(ref) {
+  if (/^https?:\/\//i.test(ref)) return true;
+  return /\.(parquet|csv|tsv|json|ndjson)$/i.test(ref);
+}
+function tableFilePlan(modelFiles, outRel) {
+  const map = {};
+  const copies = [];
+  const out = outRel.replace(/^\.?\//, "").replace(/\/$/, "");
+  for (const ref of findTableRefs(modelFiles)) {
+    if (!isDataFile(ref)) continue;
+    if (/^https?:\/\//i.test(ref)) {
+      map[ref] = ref;
+      continue;
+    }
+    const rel = ref.replace(/^\.?\//, "");
+    if (out && (rel === out || rel.startsWith(out + "/"))) {
+      map[ref] = `./${rel.slice(out.length + 1)}`;
+    } else {
+      map[ref] = `./${rel}`;
+      copies.push(rel);
+    }
+  }
+  return { map, copies };
+}
+function copyDuckDBAssets(outDir) {
+  const names = [
+    "duckdb-mvp.wasm",
+    "duckdb-eh.wasm",
+    "duckdb-browser-mvp.worker.js",
+    "duckdb-browser-eh.worker.js"
+  ];
+  const dir = path7.join(outDir, "duckdb");
+  fs6.mkdirSync(dir, { recursive: true });
+  const copied = [];
+  for (const n of names) {
+    const src = require3.resolve(`@duckdb/duckdb-wasm/dist/${n}`);
+    fs6.copyFileSync(src, path7.join(dir, n));
+    copied.push(n);
+  }
+  return copied;
+}
+function navFor(dash, all, cleanUrls) {
+  return navHtml(
+    dash.name,
+    all,
+    (n) => cleanUrls ? `./${encodeURIComponent(n)}` : `./${encodeURIComponent(n)}.html`
+  );
+}
+function page(dash, all, title, givenSpecs, tileSpecs, cleanUrls) {
+  const info = {
+    name: dash.name,
+    query: dash.query,
+    title: dash.title,
+    description: dash.description,
+    entryFile: dash.entryFile,
+    tiles: dash.tiles,
+    tileSpecs,
+    dashboard_columns: dash.dashboard_columns,
+    givens: dash.givens,
+    autorun: dash.autorun
+  };
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc3(dash.title || dash.name)}${title ? ` \xB7 ${esc3(title)}` : ""}</title>
+<link rel="stylesheet" href="./assets/site.css">
+</head>
+<body>
+${navFor(dash, all, cleanUrls)}
+<div id="root"></div>
+<script>
+window.__DASHBOARD__ = ${JSON.stringify(info)};
+// Given SPECS (label/type/default/suggest) are introspected from the model's
+// given: declarations at BUILD time \u2014 the runtime reads them from here to draw
+// controls and seed initial values. Without them there are no controls and
+// every given starts empty.
+window.__GIVENS__ = ${JSON.stringify(givenSpecs)};
+// __INITIAL_GIVENS__ is NOT set here on purpose: the entry bundle sets it from
+// location.search using shared/givens-url, the same encoder the dev server uses.
+// An inline copy is what drifted last time (it stripped the dollar-sign prefix
+// the runtime keys off, so every shareable link fell back to defaults).
+</script>
+<script src="./assets/model-files.js"></script>
+<script type="module" src="./assets/${dash.name}.js"></script>
+</body>
+</html>
+`;
+}
+function indexPage(dashboards, title, custom, cleanUrls) {
+  const link = (n) => cleanUrls ? `./${encodeURIComponent(n)}` : `./${encodeURIComponent(n)}.html`;
+  const body = custom ? `<div id="root"></div>
+<script>window.__DASHBOARDS__ = ${JSON.stringify(
+    dashboards.map((d) => ({ name: d.name, title: d.title, description: d.description, href: link(d.name) }))
+  )};</script>
+<script type="module" src="./assets/index.js"></script>` : `<main class="index"><h1>${esc3(title)}</h1><ul>` + dashboards.map(
+    (d) => `<li><a href="${link(d.name)}"><strong>${esc3(d.title || d.name)}</strong>` + (d.description ? `<span>${esc3(d.description)}</span>` : "") + `</a></li>`
+  ).join("") + `</ul></main>`;
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc3(title)}</title>
+<link rel="stylesheet" href="./assets/site.css">
+</head>
+<body>
+${navHtml("", dashboards, link)}
+${body}
+</body>
+</html>
+`;
+}
+var SITE_CSS = `:root{--bg:#fbfbfc;--fg:#16181d;--muted:#6b7280;--card:#fff;--line:#e4e6eb;--accent:#2a78d6}
+@media(prefers-color-scheme:dark){:root{--bg:#14161a;--fg:#e8eaed;--muted:#9aa1ac;--card:#1c1f25;--line:#2c3038;--accent:#4f9bff}}
+*{box-sizing:border-box}
+body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif}
+.index{max-width:760px;margin:0 auto;padding:48px 20px}
+.index h1{font-size:22px;font-weight:650;margin:0 0 22px}
+.index ul{list-style:none;padding:0;margin:0;display:grid;gap:10px}
+.index a{display:flex;flex-direction:column;gap:3px;padding:16px 18px;border:1px solid var(--line);border-radius:12px;background:var(--card);text-decoration:none;color:inherit}
+.index a:hover{border-color:var(--accent)}
+.index span{font-size:13px;color:var(--muted)}
+` + NAV_CSS;
+async function bundleDashboards(opts = {}) {
+  const root = path7.resolve(opts.root ?? process.cwd());
+  const outDir = path7.resolve(root, opts.out ?? "docs");
+  const title = opts.title ?? path7.basename(root);
+  const target = opts.target ?? "pages";
+  const cleanUrls = target === "vercel";
+  const selfHostDuckdb = opts.duckdb === "bundled";
+  const runner = await makeRunner(root);
+  const dashboards = await discoverDashboards(root, runner);
+  if (dashboards.length === 0) throw new Error(`no dashboards found in ${path7.join(root, "dashboards")}`);
+  const manifestPath = path7.join(outDir, ".bundle-manifest.json");
+  let priorData = [];
+  try {
+    priorData = JSON.parse(fs6.readFileSync(manifestPath, "utf8")).dataFiles ?? [];
+  } catch {
+  }
+  for (const sub of ["assets", "duckdb"]) {
+    fs6.rmSync(path7.join(outDir, sub), { recursive: true, force: true });
+  }
+  if (fs6.existsSync(outDir)) {
+    for (const f of fs6.readdirSync(outDir)) {
+      if (f.endsWith(".html")) fs6.rmSync(path7.join(outDir, f), { force: true });
+    }
+  }
+  fs6.mkdirSync(path7.join(outDir, "assets"), { recursive: true });
+  if (target === "pages") {
+    fs6.writeFileSync(path7.join(outDir, ".nojekyll"), "");
+  } else {
+    fs6.rmSync(path7.join(outDir, ".nojekyll"), { force: true });
+    fs6.writeFileSync(
+      path7.join(outDir, "vercel.json"),
+      JSON.stringify(
+        {
+          $schema: "https://openapi.vercel.sh/vercel.json",
+          cleanUrls: true,
+          headers: [
+            {
+              source: "/duckdb/(.*)",
+              headers: [{ key: "Cache-Control", value: "public, max-age=31536000, immutable" }]
+            },
+            {
+              source: "/assets/(.*)",
+              headers: [{ key: "Cache-Control", value: "public, max-age=31536000, immutable" }]
+            }
+          ]
+        },
+        null,
+        2
+      ) + "\n"
+    );
+  }
+  const modelFiles = inlineModelFiles(root);
+  const outRel = path7.relative(root, outDir).split(path7.sep).join("/");
+  const usedFiles = reachableModelFiles(
+    modelFiles,
+    dashboards.map((d) => d.entryFile).filter((f) => !!f)
+  );
+  const { map: tableFiles, copies } = tableFilePlan(usedFiles, outRel);
+  for (const rel of copies) {
+    const from = path7.join(root, rel);
+    if (!fs6.existsSync(from)) {
+      throw new Error(
+        `model reads '${rel}' but ${from} does not exist.
+Data files are referenced by a path relative to the project root.`
+      );
+    }
+    const to = path7.join(outDir, rel);
+    fs6.mkdirSync(path7.dirname(to), { recursive: true });
+    fs6.copyFileSync(from, to);
+  }
+  const copiedData = copies;
+  for (const stale of priorData) {
+    if (copies.includes(stale)) continue;
+    fs6.rmSync(path7.join(outDir, stale), { force: true });
+    try {
+      fs6.rmdirSync(path7.dirname(path7.join(outDir, stale)));
+    } catch {
+    }
+    console.log(`  removed stale ${stale}`);
+  }
+  fs6.writeFileSync(manifestPath, JSON.stringify({ dataFiles: copies }, null, 2) + "\n");
+  fs6.writeFileSync(
+    path7.join(outDir, "assets", "model-files.js"),
+    `window.__MODEL_FILES__ = ${JSON.stringify(modelFiles)};
+window.__TABLE_FILES__ = ${JSON.stringify(tableFiles)};
+` + (selfHostDuckdb ? `window.__DUCKDB_BASE__ = "./duckdb/";
+` : "")
+  );
+  const landing = ["jsx", "tsx"].map((ext) => path7.join(root, "dashboards", `index.${ext}`)).find((f) => fs6.existsSync(f));
+  const runtimeDir = resolveRuntimeDir();
+  const runtimeIndex = path7.join(runtimeDir, "index.ts");
+  const wasmEntry = path7.join(runtimeDir, "..", "frame-wasm-entry.tsx");
+  const byEntry = new Map(dashboards.map((d) => [`vdash:${d.name}`, d]));
+  await esbuild3.build({
+    entryPoints: Object.fromEntries(dashboards.map((d) => [d.name, `vdash:${d.name}`])),
+    bundle: true,
+    splitting: true,
+    format: "esm",
+    outdir: path7.join(outDir, "assets"),
+    minify: true,
+    logLevel: "warning",
+    ...browserBuildBase(),
+    plugins: [
+      {
+        name: "virtual-dashboard-per-entry",
+        setup(b) {
+          b.onResolve({ filter: /^vdash:/ }, (args) => ({ path: args.path, namespace: "vdash" }));
+          b.onLoad({ filter: /.*/, namespace: "vdash" }, (args) => {
+            const dash = byEntry.get(args.path);
+            if (!dash) throw new Error(`no dashboard for entry ${args.path}`);
+            const imp = dash.tsxPath ? `import Dashboard from ${JSON.stringify(dash.tsxPath)};` : `const Dashboard = null;`;
+            return {
+              contents: `${imp}
+import { boot } from ${JSON.stringify(wasmEntry)};
+boot(Dashboard);
+`,
+              loader: "js",
+              // Resolve the component's own imports (react, @malloyyo/dashboard)
+              // from the model repo's directory, matching `dashboard dev`.
+              resolveDir: path7.dirname(dash.tsxPath ?? path7.join(root, "dashboards", "x"))
+            };
+          });
+          b.onResolve({ filter: /^@malloyyo\/dashboard$/ }, () => ({ path: runtimeIndex }));
+        }
+      },
+      hostAliasPlugin
+    ]
+  });
+  fs6.writeFileSync(path7.join(outDir, "assets", "site.css"), SITE_CSS);
+  for (const d of dashboards) {
+    let specs = [];
+    let tileSpecs;
+    if (d.tiles && d.entryFile) {
+      const t = await runner.dashboardTiles(d.entryFile, d.tiles);
+      specs = t.union;
+      tileSpecs = t.tiles;
+    } else {
+      const got = d.entryFile ? await runner.givensForQueryIn(d.entryFile, d.query) : await runner.givensForQuery(d.query);
+      if (!got.ok) throw new Error(`dashboard ${d.name}: ${got.error}`);
+      specs = got.givens;
+    }
+    fs6.writeFileSync(path7.join(outDir, `${d.name}.html`), page(d, dashboards, title, specs, tileSpecs, cleanUrls));
+  }
+  fs6.writeFileSync(path7.join(outDir, "index.html"), indexPage(dashboards, title, !!landing, cleanUrls));
+  if (landing) {
+    await esbuild3.build({
+      stdin: {
+        contents: `import React from "react";
+import { createRoot } from "react-dom/client";
+import Landing from ${JSON.stringify(landing)};
+createRoot(document.getElementById("root")).render(React.createElement(Landing, { dashboards: window.__DASHBOARDS__ || [] }));
+`,
+        resolveDir: path7.dirname(landing),
+        loader: "js"
+      },
+      bundle: true,
+      format: "esm",
+      minify: true,
+      outfile: path7.join(outDir, "assets", "index.js"),
+      logLevel: "warning",
+      // Same base as the dashboard pass. A landing page needs no Malloy today,
+      // but one that imported anything reaching antlr4ts would otherwise die at
+      // load with "process is not defined" from the util polyfill.
+      ...browserBuildBase(),
+      plugins: [hostAliasPlugin]
+    });
+  }
+  const duck = selfHostDuckdb ? copyDuckDBAssets(outDir) : [];
+  if (!selfHostDuckdb) fs6.rmSync(path7.join(outDir, "duckdb"), { recursive: true, force: true });
+  const bytes = (p) => fs6.statSync(p).size;
+  const assetDir = path7.join(outDir, "assets");
+  const jsTotal = fs6.readdirSync(assetDir).filter((f) => f.endsWith(".js")).reduce((a, f) => a + bytes(path7.join(assetDir, f)), 0);
+  console.log(`
+bundled ${dashboards.length} dashboard(s) \u2192 ${path7.relative(process.cwd(), outDir) || "."}/`);
+  for (const d of dashboards) console.log(`  ${d.name}.html   ${d.title ?? ""}`);
+  console.log(`
+  js         ${(jsTotal / 1048576).toFixed(2)} MB`);
+  console.log(
+    selfHostDuckdb ? `  duckdb     ${duck.length} assets (self-hosted)` : `  duckdb     jsDelivr CDN (nothing copied)`
+  );
+  console.log(`  model      ${Object.keys(modelFiles).length} .malloy files inlined`);
+  if (copiedData.length) {
+    const mb = copiedData.reduce((a, r) => a + fs6.statSync(path7.join(root, r)).size, 0) / 1048576;
+    console.log(`  data       ${copiedData.length} file(s) copied, ${mb.toFixed(1)} MB (same-origin)`);
+  }
+  console.log(
+    target === "pages" ? `
+Publish: commit ${path7.basename(outDir)}/ and point GitHub Pages at it.` : `
+Publish: deploy ${path7.basename(outDir)}/ to Vercel (vercel.json written: clean URLs + asset caching).`
+  );
+  if (opts.serve !== false) {
+    await serveStatic(outDir, opts.port ?? 4180);
+    await new Promise(() => {
+    });
+  }
+}
+
 // src/init.ts
-import fs4 from "node:fs";
-import path5 from "node:path";
+import fs7 from "node:fs";
+import path8 from "node:path";
 var AUTHOR_MCP = {
   mcpServers: {
     // No -C: the server roots at the launch cwd (the project dir), so this file
@@ -3086,11 +3571,11 @@ function exportableNames(src) {
   return [...names];
 }
 function scaffoldIndex(root) {
-  const indexPath = path5.join(root, "index.malloy");
-  if (fs4.existsSync(indexPath)) {
+  const indexPath = path8.join(root, "index.malloy");
+  if (fs7.existsSync(indexPath)) {
     return { wrote: false, note: "index.malloy already exists \u2014 left as-is" };
   }
-  const models = fs4.readdirSync(root).filter((f) => f.endsWith(".malloy") && f !== "index.malloy").sort();
+  const models = fs7.readdirSync(root).filter((f) => f.endsWith(".malloy") && f !== "index.malloy").sort();
   if (models.length === 0) {
     return { wrote: false, note: "no .malloy files found \u2014 skipped index.malloy" };
   }
@@ -3103,7 +3588,7 @@ function scaffoldIndex(root) {
   ];
   let anyNames = false;
   for (const file of models) {
-    const names = exportableNames(fs4.readFileSync(path5.join(root, file), "utf8"));
+    const names = exportableNames(fs7.readFileSync(path8.join(root, file), "utf8"));
     if (names.length === 0) {
       blocks.push(`// ${file}: no top-level source/query/given detected \u2014 add exports by hand`);
       continue;
@@ -3114,24 +3599,24 @@ function scaffoldIndex(root) {
     blocks.push(`export { ${list} }`);
     blocks.push("");
   }
-  fs4.writeFileSync(indexPath, blocks.join("\n") + "\n");
+  fs7.writeFileSync(indexPath, blocks.join("\n") + "\n");
   return {
     wrote: true,
     note: anyNames ? `wrote index.malloy re-exporting ${models.length} model file(s) \u2014 REVIEW it` : "wrote index.malloy skeleton \u2014 no exports detected, fill them in by hand"
   };
 }
 async function initCmd(dir) {
-  const root = path5.resolve(dir);
-  if (!fs4.existsSync(root) || !fs4.statSync(root).isDirectory()) {
+  const root = path8.resolve(dir);
+  if (!fs7.existsSync(root) || !fs7.statSync(root).isDirectory()) {
     throw new Error(`not a directory: ${root}`);
   }
-  const mcpPath = path5.join(root, ".mcp.json");
-  if (fs4.existsSync(mcpPath)) {
+  const mcpPath = path8.join(root, ".mcp.json");
+  if (fs7.existsSync(mcpPath)) {
     console.log(`\u2022 .mcp.json exists \u2014 leaving it. For author-by-default it should be:`);
     console.log(`    ${JSON.stringify(AUTHOR_MCP.mcpServers.malloyyo_author)}`);
     console.log(`  (server key "malloyyo_author", command "malloyyo mcp --develop").`);
   } else {
-    fs4.writeFileSync(mcpPath, JSON.stringify(AUTHOR_MCP, null, 2) + "\n");
+    fs7.writeFileSync(mcpPath, JSON.stringify(AUTHOR_MCP, null, 2) + "\n");
     console.log(`\u2713 wrote .mcp.json \u2014 \`cd ${dir} && claude\` now opens in AUTHOR mode`);
   }
   const idx = scaffoldIndex(root);
@@ -3145,22 +3630,22 @@ async function initCmd(dir) {
 
 // src/launch.ts
 import { spawn as spawn2 } from "node:child_process";
-import fs5 from "node:fs";
+import fs8 from "node:fs";
 import os from "node:os";
-import path6 from "node:path";
+import path9 from "node:path";
 var SURFACE_FLAG = { author: "--develop", test: "--explore" };
 var SERVER_KEY = { author: "malloyyo_author", test: "malloyyo_test" };
 async function launchCmd(mode, opts) {
-  const root = path6.resolve(opts.root ?? process.cwd());
-  const tmpDir = fs5.mkdtempSync(path6.join(os.tmpdir(), "malloyyo-launch-"));
-  const cfgPath = path6.join(tmpDir, "mcp.json");
+  const root = path9.resolve(opts.root ?? process.cwd());
+  const tmpDir = fs8.mkdtempSync(path9.join(os.tmpdir(), "malloyyo-launch-"));
+  const cfgPath = path9.join(tmpDir, "mcp.json");
   const cfg = {
     mcpServers: {
       // Absolute -C: an ephemeral config, so pinning the root is robust.
       [SERVER_KEY[mode]]: { command: "malloyyo", args: ["mcp", SURFACE_FLAG[mode], "-C", root] }
     }
   };
-  fs5.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
+  fs8.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
   const label = mode === "author" ? "AUTHOR (compile/edit)" : "TEST (claude.ai web preview)";
   process.stderr.write(`\u25B6 launching Claude in ${label} mode over ${root}
 `);
@@ -3179,11 +3664,11 @@ async function launchCmd(mode, opts) {
     });
     child.on("exit", () => resolve3());
   });
-  fs5.rmSync(tmpDir, { recursive: true, force: true });
+  fs8.rmSync(tmpDir, { recursive: true, force: true });
 }
 
 // package.json
-var version = "0.2.19";
+var version = "0.2.21";
 
 // src/index.ts
 function shortSha(sha) {
@@ -3290,10 +3775,35 @@ program.command("author").option("-C, --root <dir>", "project root (default: cur
 program.command("test").option("-C, --root <dir>", "project root (default: current directory)").description("launch Claude wired ONLY to the explore surface \u2014 the claude.ai web preview").action(async (opts) => {
   await launchCmd("test", opts);
 });
-program.command("dashboard").argument("<action>", "action to run (currently: dev)").option("-C, --root <dir>", "project root (default: current directory)").option("-p, --port <port>", "port to serve on", "4173").description("preview dashboard artifacts in ./dashboards against the local Malloy model").action(async (action, opts) => {
-  if (action !== "dev") throw new Error(`unknown dashboard action '${action}' (expected: dev)`);
-  await serveDashboard({ root: opts.root, port: Number(opts.port) });
-});
+program.command("dashboard").argument("<action>", "action to run (dev | bundle)").option("-C, --root <dir>", "project root (default: current directory)").option("-p, --port <port>", "port to serve on (dev)", "4173").option("-o, --out <dir>", "output directory (bundle)", "docs").option("--title <title>", "site title (bundle; default: project directory name)").option("--target <target>", "deploy target: pages | vercel (bundle)", "pages").option("--duckdb <source>", "DuckDB binaries: cdn | bundled (bundle)", "cdn").option("--no-serve", "bundle only; don't serve the result (bundle)").description("preview dashboards locally (dev), or build a static site from them (bundle)").action(
+  async (action, opts) => {
+    if (action === "dev") {
+      await serveDashboard({ root: opts.root, port: Number(opts.port) });
+      return;
+    }
+    if (action === "bundle") {
+      if (opts.target !== "pages" && opts.target !== "vercel") {
+        throw new Error(`unknown --target '${opts.target}' (expected: pages | vercel)`);
+      }
+      if (opts.duckdb !== "cdn" && opts.duckdb !== "bundled") {
+        throw new Error(`unknown --duckdb '${opts.duckdb}' (expected: cdn | bundled)`);
+      }
+      await bundleDashboards({
+        root: opts.root,
+        out: opts.out,
+        title: opts.title,
+        serve: opts.serve,
+        target: opts.target,
+        duckdb: opts.duckdb,
+        // `dashboard dev` owns 4173/4174; default the bundle preview clear of
+        // both so you can run the two side by side.
+        port: opts.port === "4173" ? 4180 : Number(opts.port)
+      });
+      return;
+    }
+    throw new Error(`unknown dashboard action '${action}' (expected: dev | bundle)`);
+  }
+);
 program.parseAsync().catch((err) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);

package/dist/shared/givens-url.ts

@@ -0,0 +1,33 @@
+// The URL <-> givens encoding, in ONE place.
+//
+// Both hosts need it and they used to have separate copies: `dashboard dev`
+// parsed the query server-side, and the static bundle re-implemented it in an
+// inline script. The copies drifted — the static one stripped the `$` prefix
+// that the runtime keys off (runtime.tsx: `if (k[0] === "$")`), so shareable
+// links silently fell back to defaults. That class of bug is the reason this
+// module exists; import it instead of writing the loop again.
+//
+// Deliberately dependency-free (no React, no node builtins) so the Node dev
+// server and the browser bundle can share the same file.
+
+/** Query string -> given values. Keys KEEP their `$` prefix — the runtime
+    requires it — and `d` (the dashboard selector) is dropped. */
+export function givensFromSearch(search: string): Record<string, string> {
+  const g: Record<string, string> = {};
+  for (const [k, v] of new URLSearchParams(search)) {
+    if (k !== "d") g[k] = v;
+  }
+  return g;
+}
+
+/** Given values -> `$`-prefixed query params, skipping empties. Accepts keys
+    with or without the prefix so callers can pass either the runtime's bare
+    names or values already read out of a URL. */
+export function givensToParams(givens: Record<string, unknown>): URLSearchParams {
+  const p = new URLSearchParams();
+  for (const [k, v] of Object.entries(givens ?? {})) {
+    if (v == null || String(v) === "") continue;
+    p.set(k.charAt(0) === "$" ? k : "$" + k, String(v));
+  }
+  return p;
+}

package/dist/shared/nav.ts

@@ -0,0 +1,72 @@
+// The dashboard switcher bar, in ONE place.
+//
+// `dashboard dev` and every `dashboard bundle` target render the same bar; only
+// the LINK SHAPE differs (`/?d=name` for the dev server, `./name.html` or a
+// clean `/name` for the bundle targets). That difference is a callback, not a
+// reason to keep two copies — the previous two copies had already drifted in
+// styling, and the same drift is what produced the givens-URL bug.
+//
+// Dependency-free so the Node dev server and the emitted static site share it.
+
+export interface NavDashboard {
+  name: string;
+  title?: string;
+}
+
+const esc = (s: string) =>
+  s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+/** The Malloy mark, inlined rather than shipped as a file so a site stays
+    self-contained and a subpath deploy (GitHub Pages) can't 404 it. */
+export const LOGO = `<svg viewBox="0 0 240 240" width="20" height="20" aria-hidden="true" focusable="false">\
+<g transform="translate(8, 44)" fill-rule="nonzero" stroke-width="10">\
+<path d="M66.8164971,8.04981927 C70.8741349,0.502462438 80.0934949,-2.2220379 87.4085141,1.96447745 C94.5645112,6.05998159 97.2471437,15.2521193 93.5616777,22.7156028 L93.3065249,23.2105325 L28.3940308,143.950181 C24.3363931,151.497538 15.117033,154.222038 7.80201383,150.035523 C0.646016803,145.940018 -2.0366157,136.747881 1.64885028,129.284397 L1.90400302,128.789468 L66.8164971,8.04981927 Z" stroke="#1573A1" fill="#1573A1"/>\
+<path d="M192.878294,8.04981927 C196.98997,0.0579198953 207.437352,-1.75261923 213.470311,1.96447745 C219.503269,5.68157413 221.641451,12.7091374 223.25,15.6301759 L219.368321,23.2105325 L154.455827,143.950181 C150.39819,151.497538 141.17883,154.222038 133.86381,150.035523 C126.707813,145.940018 124.025181,136.747881 127.710647,129.284397 L127.9658,128.789468 L192.878294,8.04981927 Z" stroke="#FBBC04" fill="#FBBC04" transform="translate(174.655898, 76.056961) scale(-1, 1) translate(-174.655898, -76.056961)"/>\
+<path d="M129.943475,8.04981927 C134.001113,0.502462438 143.220473,-2.2220379 150.535492,1.96447745 C157.691489,6.05998159 160.374122,15.2521193 156.688656,22.7156028 L156.433503,23.2105325 L91.5210087,143.950181 C87.463371,151.497538 78.2440109,154.222038 70.9289918,150.035523 C63.7729947,145.940018 61.0903622,136.747881 64.7758282,129.284397 L65.0309809,128.789468 L129.943475,8.04981927 Z" stroke="#E37400" fill="#E37400"/>\
+<path d="M132.146094,8.04981927 C136.203731,0.502462438 145.423091,-2.2220379 152.738111,1.96447745 C159.894108,6.05998159 162.57674,15.2521193 158.891274,22.7156028 L158.636121,23.2105325 L93.7236274,143.950181 C89.6659896,151.497538 80.4466296,154.222038 73.1316104,150.035523 C65.9756133,145.940018 63.2929808,136.747881 66.9784468,129.284397 L67.2335996,128.789468 L132.146094,8.04981927 Z" stroke="#11B5CB" fill="#11B5CB" transform="translate(112.934861, 76.000000) scale(-1, 1) translate(-112.934861, -76.000000)"/>\
+</g></svg>`;
+
+/** Deliberately black in both light and dark schemes — this is a brand bar, not
+    page chrome, so it shouldn't invert with the color scheme. */
+export const NAV_CSS = `
+.dash-nav{display:flex;gap:4px;align-items:center;padding:8px 14px;background:#000;font:13px system-ui,-apple-system,sans-serif;flex-wrap:wrap}
+/* The home icon is an <a> too, so it opts OUT of the switcher-link padding and
+   keeps its own square hit area. */
+.dash-nav a.brand{display:inline-flex;align-items:center;justify-content:center;color:#9aa1ac;padding:5px;border-radius:6px;text-decoration:none}
+.dash-nav a.brand:hover{background:#1f232a;color:#fff}
+.dash-nav .brand svg{display:block}
+.dash-nav .sep{width:1px;align-self:stretch;background:#2c3038;margin:0 10px}
+.dash-nav a{padding:4px 10px;border-radius:6px;text-decoration:none;color:#c9ced6}
+.dash-nav a:hover{background:#1f232a;color:#fff}
+.dash-nav a.on{background:#fff;color:#000;font-weight:550}
+`;
+
+/** Render the bar. `href` maps a dashboard name to a link for THIS host — the
+    only thing that varies across dev / pages / vercel. The brand shows even for
+    a single dashboard; only the switcher links are conditional. */
+export const MALLOYYO_REPO = "https://github.com/malloydata/malloyyo";
+
+/** Home, back to the landing page. Attribution lives on that page rather than
+    in the bar — the bar should be navigation. */
+const HOME_ICON = `<svg viewBox="0 0 24 24" width="17" height="17" fill="none" stroke="currentColor" \
+stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false">\
+<path d="M3 10.2 12 3.5l9 6.7"/><path d="M5.2 8.9V20h13.6V8.9"/><path d="M9.6 20v-6.2h4.8V20"/></svg>`;
+
+export function navHtml(
+  active: string,
+  all: NavDashboard[],
+  href: (name: string) => string,
+  homeHref = "./",
+): string {
+  const brand =
+    `<a class="brand" href="${esc(homeHref)}" title="Home" aria-label="Home">${HOME_ICON}</a>`;
+  if (all.length <= 1) return `<nav class="dash-nav">${brand}</nav>`;
+  const links = all
+    .map(
+      (x) =>
+        `<a href="${esc(href(x.name))}"${x.name === active ? ' class="on"' : ""}>` +
+        `${esc(x.title || x.name)}</a>`,
+    )
+    .join("");
+  return `<nav class="dash-nav">${brand}<span class="sep"></span>${links}</nav>`;
+}

package/dist/shims/assert.cjs

@@ -0,0 +1,16 @@
+// antlr4ts (Malloy's parser runtime) does `require("assert")` in 13 files and
+// only ever calls it as a bare function. Resolving that to the npm `assert`
+// polyfill drags in `util`, which references `process` and dies in a browser
+// with "process is not defined". This is the whole API surface actually used.
+function assert(condition, message) {
+  if (!condition) throw new Error(message || "assertion failed");
+}
+assert.ok = assert;
+assert.equal = (a, b, m) => assert(a == b, m || `${a} != ${b}`);
+assert.strictEqual = (a, b, m) => assert(a === b, m || `${a} !== ${b}`);
+assert.notEqual = (a, b, m) => assert(a != b, m || `${a} == ${b}`);
+assert.notStrictEqual = (a, b, m) => assert(a !== b, m || `${a} === ${b}`);
+assert.fail = (m) => assert(false, m);
+assert.default = assert;
+
+module.exports = assert;

package/dist/shims/util.cjs

@@ -0,0 +1,7 @@
+// antlr4ts/misc/BitSet.js requires("util") for exactly one thing: the
+// `util.inspect.custom` symbol, used to pretty-print in a Node REPL. The npm
+// `util` polyfill that satisfies it is large and references `process`.
+const inspect = (v) => String(v);
+inspect.custom = Symbol.for("nodejs.util.inspect.custom");
+
+module.exports = { inspect, default: { inspect } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {
@@ -32,6 +32,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@duckdb/duckdb-wasm": "1.33.1-dev45.0",
+    "@malloydata/db-duckdb": "^0.0.425",
     "@malloydata/malloy": "^0.0.425",
     "@malloydata/malloy-connections": "^0.0.425",
     "@malloydata/malloy-filter": "^0.0.425",