@malloydata/malloyyo 0.2.29 → 0.2.31

package/README.md

@@ -74,6 +74,21 @@ malloyyo publish main --dry-run # show what would be sent
 malloyyo status main            # what's live: version, commit, compile state
 ```
 
+The target dataset must already exist; publishing to a missing one fails rather than
+inventing it (a config typo would otherwise spawn junk datasets). To provision it from the
+CLI instead of the UI, opt in explicitly:
+
+```bash
+malloyyo publish main --create-dataset   # create the dataset if it isn't there yet
+```
+
+The dataset is created **only after the model compiles**, so a rejected publish still
+creates nothing, and it is created **private** — visibility is a deliberate act in the UI,
+and publishing never changes it. On an existing dataset the flag does nothing: you just get
+the next version. The dataset name comes from the target's `dataset` in the config, and must
+already be a valid name (lowercase letters, digits, underscores) — the CLI won't silently
+create it under a slugified variant that later publishes wouldn't find.
+
 `publish` exits non-zero on a server-side compile failure, so it's safe to gate CI on.
 
 **Token precedence:** `--token` flag → the `malloyyo_token` env var from config (for CI) →

package/dist/index.js

@@ -2608,6 +2608,36 @@ function printLintReport(report) {
   }
 }
 
+// src/shared/env-refs.ts
+function missingEnvRefs(configJson, env = process.env) {
+  if (!configJson) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(configJson);
+  } catch {
+    return [];
+  }
+  const missing = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (Array.isArray(node)) return void node.forEach(walk);
+    if (typeof node !== "object" || node === null) return;
+    const rec = node;
+    if (typeof rec.env === "string" && !env[rec.env]) missing.add(rec.env);
+    for (const v of Object.values(rec)) walk(v);
+  };
+  walk(parsed);
+  return [...missing];
+}
+function missingEnvHint(missing, where) {
+  if (missing.length === 0) return "";
+  const vars = missing.map((v) => `$${v}`).join(", ");
+  const isAre = missing.length > 1 ? "are" : "is";
+  return `
+  malloy-config.json references ${vars}, which ${isAre} NOT set on ${where}.
+  Malloy reads an unset reference as an empty value, which usually shows up as
+  the connection error above.`;
+}
+
 // src/oauth.ts
 import http from "node:http";
 import crypto from "node:crypto";
@@ -2790,6 +2820,11 @@ async function refresh(baseUrl, creds) {
   saveCreds(baseUrl, updated);
   return updated;
 }
+function tokenSource(target, opts) {
+  if (opts.tokenFlag) return "flag";
+  if (target.tokenEnv && process.env[target.tokenEnv]) return "env";
+  return "login";
+}
 async function getAccessToken(target, opts) {
   if (opts.tokenFlag) return opts.tokenFlag;
   if (target.tokenEnv && process.env[target.tokenEnv]) return process.env[target.tokenEnv];
@@ -4202,15 +4237,66 @@ async function launchCmd(mode, opts) {
 }
 
 // package.json
-var version = "0.2.29";
+var version = "0.2.31";
 
 // src/index.ts
 function shortSha(sha) {
   return sha ? sha.slice(0, 7) : "";
 }
+function authHint(status2, t, source) {
+  const login2 = `malloyyo login ${t.name}`;
+  if (status2 === 403) {
+    return `
+  The token is valid, but that account isn't an admin on ${t.url} \u2014
+  publishing is admin-only. Ask an admin there to grant access.`;
+  }
+  switch (source) {
+    case "flag":
+      return `
+  That token came from --token. Drop the flag and run:  ${login2}`;
+    case "env":
+      return `
+  That token came from $${t.tokenEnv}. Re-issue it, or unset it and run:  ${login2}`;
+    default:
+      return `
+  Your saved login for ${t.url} is expired or revoked.
+  Run:  ${login2}`;
+  }
+}
+function failureHint(out, t) {
+  switch (out.kind) {
+    case "missing-import":
+      return `
+  A file the model imports wasn't in the upload. Publish from the directory
+  that holds index.malloy, and check the import path's spelling/case.`;
+    case "connection":
+      if (out.missingEnv?.length) {
+        const vars = out.missingEnv.map((v) => `$${v}`).join(", ");
+        return `
+  malloy-config.json references ${vars}, which ${out.missingEnv.length > 1 ? "are" : "is"} NOT set on ${t.url}.
+  Secrets don't travel with the model \u2014 set them in that deployment's environment
+  (Vercel: Settings \u2192 Environment Variables), then publish again.`;
+      }
+      return `
+  The server couldn't open the connection the model uses. Check the
+  \`connections\` block in malloy-config.json, and that ${t.url} can reach it.`;
+    case "persist":
+      return `
+  The model itself is fine \u2014 this failed writing to the server's database.
+  Retry; if it repeats, the message above is the database's own.`;
+    default:
+      return "";
+  }
+}
+function requestFailed(what, res, out, t, source) {
+  const detail = out.error ?? `${res.status} ${res.statusText}`;
+  const hint = res.status === 401 || res.status === 403 ? authHint(res.status, t, source) : failureHint(out, t);
+  return new Error(`${what} failed: ${detail}${hint}`);
+}
 async function publish(target, dir, opts) {
   const root = resolve2(dir);
   const t = resolveTarget(root, target);
+  const source = tokenSource(t, { tokenFlag: opts.token });
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const { files, config } = gatherDirectory(root);
   if (files.length === 0) {
@@ -4223,27 +4309,33 @@ async function publish(target, dir, opts) {
       printLintReport(report);
     }
     if (!report.ok) {
-      throw new Error("dashboard lint failed \u2014 fix the above, or pass --skip-lint");
+      throw new Error(
+        "dashboard lint failed \u2014 fix the above, or pass --skip-lint" + missingEnvHint(missingEnvRefs(config), "this shell")
+      );
     }
   }
   const git = gitInfo(root);
   const dashboards = await gatherDashboards(root);
   const body = { files, config, git, dashboards };
   const provenance = git.sha ? `${git.branch}@${shortSha(git.sha)}${git.dirty ? " (dirty)" : ""}` : "(no git)";
-  console.log(`\u2192 ${t.url}  dataset=${t.dataset}`);
+  console.log(`\u2192 ${t.url}  dataset=${t.dataset}${opts.createDataset ? " (create if missing)" : ""}`);
   console.log(`  ${files.length} file(s)  ${provenance}`);
   if (opts.dryRun) {
     console.log("dry run \u2014 not sending");
     return;
   }
-  const res = await fetch(`${t.url}/api/datasets/${t.dataset}/model/push`, {
+  const push = `${t.url}/api/datasets/${t.dataset}/model/push${opts.createDataset ? "?create=1" : ""}`;
+  const res = await fetch(push, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${bearer}` },
     body: JSON.stringify(body)
   });
   const out = await res.json().catch(() => ({}));
   if (!res.ok || !out.ok) {
-    throw new Error(`publish failed: ${out.error ?? `${res.status} ${res.statusText}`}`);
+    throw requestFailed("publish", res, out, t, source);
+  }
+  if (out.created) {
+    console.log(`\u2713 created dataset ${out.dataset ?? t.dataset} (private) \u2014 ${t.url}/datasets/${out.dataset ?? t.dataset}`);
   }
   console.log(
     `\u2713 published version ${out.version} \u2014 ${out.sources?.length ?? 0} source(s)` + (dashboards.length ? `, ${dashboards.length} dashboard(s)` : "")
@@ -4251,12 +4343,14 @@ async function publish(target, dir, opts) {
 }
 async function status(target, opts) {
   const t = resolveTarget(resolve2("."), target);
+  const source = tokenSource(t, { tokenFlag: opts.token });
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const res = await fetch(`${t.url}/api/datasets/${t.dataset}/model/status`, {
     headers: { authorization: `Bearer ${bearer}` }
   });
   if (!res.ok) {
-    throw new Error(`status failed: ${res.status} ${res.statusText}`);
+    const body = await res.json().catch(() => ({}));
+    throw requestFailed("status", res, body, t, source);
   }
   const s = await res.json();
   const git = s.git;
@@ -4277,15 +4371,20 @@ var program = new Command();
 program.name("malloyyo").description("Publish Malloy models to a Malloyyo instance").version(version);
 program.command("login").argument("[target]", "target name or instance URL (optional if the config has one target)").description("sign in to an instance in your browser (stores a token)").action(loginCmd);
 program.command("logout").argument("[target]", "target name or instance URL (optional if the config has one target)").description("forget the stored token for an instance").action(logoutCmd);
-program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").option("--skip-lint", "skip the pre-publish dashboard lint").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
+program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").option("--skip-lint", "skip the pre-publish dashboard lint").option("--create-dataset", "create the target dataset if it doesn't exist yet (private)").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
 program.command("lint").argument("[dir]", "directory to lint", ".").description("validate ./dashboards against the model (manifest, query, givens, Dashboard.tsx)").action(async (dir) => {
-  const report = await lintDashboards(resolve2(dir));
+  const root = resolve2(dir);
+  const report = await lintDashboards(root);
   if (report.dashboards.length === 0) {
     console.log("no dashboards to lint");
     return;
   }
   printLintReport(report);
-  if (!report.ok) process.exit(1);
+  if (!report.ok) {
+    const hint = missingEnvHint(missingEnvRefs(gatherDirectory(root).config), "this shell");
+    if (hint) console.error(hint.replace(/^\n/, ""));
+    process.exit(1);
+  }
 });
 program.command("status").argument("<target>", "named target from the `malloyyo` config block").option("--token <token>", "bearer token (overrides login/env)").description("show what's live on <target>: version, commit, compile state").action(status);
 program.command("mcp").option("-C, --root <dir>", "project root (default: current directory)").option("--develop", "author surface: compile/prettify/query any .malloy in the project").option("--explore", "explore surface: the claude.ai web preview (index.malloy only) [default]").description(

package/dist/shared/env-refs.ts

@@ -0,0 +1,45 @@
+// Copyright (c) The Malloy Foundation
+// SPDX-License-Identifier: MIT
+//
+// malloy-config.json can hold secrets by reference: `"password": { "env": "PG_PW" }`.
+// Malloy resolves an UNSET reference to empty rather than failing, so the symptom
+// is a baffling connection error — "connect ECONNREFUSED", "password
+// authentication failed" — that never mentions the variable. Both the CLI (this
+// shell) and the push route (that deployment) check for it and say the name.
+
+/** `{"env": "NAME"}` references in `configJson` with no value in `env`. Deduped. */
+export function missingEnvRefs(
+  configJson: string | undefined,
+  env: Record<string, string | undefined> = process.env,
+): string[] {
+  if (!configJson) return [];
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(configJson);
+  } catch {
+    return []; // Malloy reports the bad JSON itself.
+  }
+  const missing = new Set<string>();
+  const walk = (node: unknown): void => {
+    if (Array.isArray(node)) return void node.forEach(walk);
+    if (typeof node !== "object" || node === null) return;
+    const rec = node as Record<string, unknown>;
+    if (typeof rec.env === "string" && !env[rec.env]) missing.add(rec.env);
+    for (const v of Object.values(rec)) walk(v);
+  };
+  walk(parsed);
+  return [...missing];
+}
+
+/** One-line-per-var explanation, or "" when nothing is missing. `where` names
+    the environment the check ran against ("this shell", a server URL). */
+export function missingEnvHint(missing: string[], where: string): string {
+  if (missing.length === 0) return "";
+  const vars = missing.map((v) => `$${v}`).join(", ");
+  const isAre = missing.length > 1 ? "are" : "is";
+  return (
+    `\n  malloy-config.json references ${vars}, which ${isAre} NOT set on ${where}.` +
+    `\n  Malloy reads an unset reference as an empty value, which usually shows up as` +
+    `\n  the connection error above.`
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {
@@ -33,11 +33,11 @@
   },
   "dependencies": {
     "@duckdb/duckdb-wasm": "1.33.1-dev45.0",
-    "@malloydata/db-duckdb": "^0.0.425",
-    "@malloydata/malloy": "^0.0.425",
-    "@malloydata/malloy-connections": "^0.0.425",
-    "@malloydata/malloy-filter": "^0.0.425",
-    "@malloydata/render": "^0.0.425",
+    "@malloydata/db-duckdb": "^0.0.430",
+    "@malloydata/malloy": "^0.0.430",
+    "@malloydata/malloy-connections": "^0.0.430",
+    "@malloydata/malloy-filter": "^0.0.430",
+    "@malloydata/render": "^0.0.430",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "commander": "^12.1.0",
     "esbuild": "^0.24.0",