@malloydata/malloyyo 0.2.30 → 0.2.32

package/dist/shared/env-refs.ts

@@ -0,0 +1,45 @@
+// Copyright (c) The Malloy Foundation
+// SPDX-License-Identifier: MIT
+//
+// malloy-config.json can hold secrets by reference: `"password": { "env": "PG_PW" }`.
+// Malloy resolves an UNSET reference to empty rather than failing, so the symptom
+// is a baffling connection error — "connect ECONNREFUSED", "password
+// authentication failed" — that never mentions the variable. Both the CLI (this
+// shell) and the push route (that deployment) check for it and say the name.
+
+/** `{"env": "NAME"}` references in `configJson` with no value in `env`. Deduped. */
+export function missingEnvRefs(
+  configJson: string | undefined,
+  env: Record<string, string | undefined> = process.env,
+): string[] {
+  if (!configJson) return [];
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(configJson);
+  } catch {
+    return []; // Malloy reports the bad JSON itself.
+  }
+  const missing = new Set<string>();
+  const walk = (node: unknown): void => {
+    if (Array.isArray(node)) return void node.forEach(walk);
+    if (typeof node !== "object" || node === null) return;
+    const rec = node as Record<string, unknown>;
+    if (typeof rec.env === "string" && !env[rec.env]) missing.add(rec.env);
+    for (const v of Object.values(rec)) walk(v);
+  };
+  walk(parsed);
+  return [...missing];
+}
+
+/** One-line-per-var explanation, or "" when nothing is missing. `where` names
+    the environment the check ran against ("this shell", a server URL). */
+export function missingEnvHint(missing: string[], where: string): string {
+  if (missing.length === 0) return "";
+  const vars = missing.map((v) => `$${v}`).join(", ");
+  const isAre = missing.length > 1 ? "are" : "is";
+  return (
+    `\n  malloy-config.json references ${vars}, which ${isAre} NOT set on ${where}.` +
+    `\n  Malloy reads an unset reference as an empty value, which usually shows up as` +
+    `\n  the connection error above.`
+  );
+}

package/dist/shared/html.ts

@@ -0,0 +1,25 @@
+// Embedding JSON in an inline <script>, in ONE place.
+//
+// `JSON.stringify` is NOT sufficient here and the failure is not obvious: a
+// script element's content is RAW TEXT terminated by the literal `</script`,
+// regardless of the element's `type`. So a value containing
+// `</script><script>…` closes the block and the rest is parsed as HTML —
+// script execution straight out of a dashboard title, a given label, or a URL
+// parameter. JSON.stringify escapes quotes and backslashes; it does not escape
+// `<`. The hosted app hit exactly this (src/lib/dashboards/frame-html.ts); the
+// three CLI shells emit the same document shape, so they share the same fix.
+//
+// Dependency-free so the Node dev server and the emitted static site can both
+// use it.
+
+/** JSON safe to inline inside a `<script>` element. Escapes `<`/`>` so the
+    element cannot be terminated early, plus U+2028/U+2029 — legal raw inside a
+    JSON string, but literal line terminators in JS source. Every escape is
+    inside a string literal, so `JSON.parse` of the result is unchanged. */
+export function safeJson(value: unknown): string {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,7 @@
   },
   "scripts": {
     "build:engine": "cd ../mcp-engine && npm run build",
-    "build": "npm run build:engine && esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:esbuild --external:@malloydata/* --external:@modelcontextprotocol/* --outfile=dist/index.js && node scripts/copy-frame-src.mjs",
+    "build": "npm run build:engine && esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:esbuild --external:@malloydata/* --external:@modelcontextprotocol/* --external:@inquirer/* --outfile=dist/index.js && node scripts/copy-frame-src.mjs",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
     "pretest": "npm run build",
@@ -33,6 +33,7 @@
   },
   "dependencies": {
     "@duckdb/duckdb-wasm": "1.33.1-dev45.0",
+    "@inquirer/password": "^5.1.1",
     "@malloydata/db-duckdb": "^0.0.430",
     "@malloydata/malloy": "^0.0.430",
     "@malloydata/malloy-connections": "^0.0.430",