@malloydata/malloyyo 0.2.7 → 0.2.9

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "node:fs";
@@ -38,8 +38,8 @@ function resolveTarget(dir, name) {
 }
 function resolveInstance(dir, arg) {
   if (arg && /^https?:\/\//i.test(arg)) {
-    const url3 = normalizeUrl(arg);
-    return { name: url3, url: url3 };
+    const url4 = normalizeUrl(arg);
+    return { name: url4, url: url4 };
   }
   const targets = readTargetMap(dir);
   const entries = Object.entries(targets);
@@ -84,6 +84,29 @@ function gatherDirectory(dir) {
   const config = existsSync2(configPath) ? readFileSync2(configPath, "utf8") : void 0;
   return { files, config };
 }
+function listDashboardDirs(dir) {
+  const base = join2(dir, "dashboards");
+  if (!existsSync2(base)) return [];
+  return readdirSync(base).filter((name) => {
+    const d = join2(base, name);
+    return statSync(d).isDirectory() && existsSync2(join2(d, "manifest.json"));
+  }).sort();
+}
+function gatherDashboards(dir) {
+  const base = join2(dir, "dashboards");
+  return listDashboardDirs(dir).map((name) => {
+    const raw = readFileSync2(join2(base, name, "manifest.json"), "utf8");
+    let manifest;
+    try {
+      manifest = JSON.parse(raw);
+    } catch (e) {
+      throw new Error(`dashboards/${name}/manifest.json: invalid JSON (${e.message})`);
+    }
+    const tsxPath = join2(base, name, "Dashboard.tsx");
+    if (!existsSync2(tsxPath)) throw new Error(`dashboards/${name}: missing Dashboard.tsx`);
+    return { name, manifest, source: readFileSync2(tsxPath, "utf8") };
+  });
+}
 function gitInfo(dir) {
   const git = (args) => execFileSync("git", args, {
     cwd: dir,
@@ -111,213 +134,15 @@ function gitInfo(dir) {
   }
 }
 
-// src/oauth.ts
-import http from "node:http";
-import crypto from "node:crypto";
-import { spawn } from "node:child_process";
-
-// src/store.ts
-import { homedir } from "node:os";
-import { dirname, join as join3 } from "node:path";
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync, existsSync as existsSync3, chmodSync } from "node:fs";
-function credsPath() {
-  const base = process.env.XDG_CONFIG_HOME || join3(homedir(), ".config");
-  return join3(base, "malloyyo", "credentials.json");
-}
-function readAll() {
-  const p = credsPath();
-  if (!existsSync3(p)) return {};
-  try {
-    return JSON.parse(readFileSync3(p, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function loadCreds(url3) {
-  return readAll()[url3];
-}
-function saveCreds(url3, creds) {
-  const p = credsPath();
-  mkdirSync(dirname(p), { recursive: true });
-  const all = readAll();
-  all[url3] = creds;
-  writeFileSync(p, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
-  try {
-    chmodSync(p, 384);
-  } catch {
-  }
-}
-function clearCreds(url3) {
-  const all = readAll();
-  if (!(url3 in all)) return false;
-  delete all[url3];
-  writeFileSync(credsPath(), JSON.stringify(all, null, 2) + "\n", { mode: 384 });
-  return true;
-}
-
-// src/oauth.ts
-var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
-async function discover(baseUrl) {
-  const res = await fetch(`${baseUrl}/api/oauth/discovery/authorization-server`);
-  if (!res.ok) throw new Error(`OAuth discovery failed at ${baseUrl}: ${res.status} ${res.statusText}`);
-  return await res.json();
-}
-function pkce() {
-  const verifier = crypto.randomBytes(32).toString("base64url");
-  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-async function registerClient(registrationEndpoint, redirectUri) {
-  const res = await fetch(registrationEndpoint, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      client_name: "malloyyo CLI",
-      redirect_uris: [redirectUri],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      scope: "mcp"
-    })
-  });
-  if (!res.ok) throw new Error(`client registration failed: ${res.status} ${await res.text()}`);
-  return (await res.json()).client_id;
-}
-function openBrowser(url3) {
-  const [cmd, args] = process.platform === "darwin" ? ["open", [url3]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url3]] : ["xdg-open", [url3]];
-  try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
-}
-function awaitRedirect(state) {
-  return new Promise((resolveServer) => {
-    let resolveCode;
-    let rejectCode;
-    const code = new Promise((res, rej) => {
-      resolveCode = res;
-      rejectCode = rej;
-    });
-    const timer = setTimeout(() => rejectCode(new Error("timed out waiting for browser sign-in")), LOGIN_TIMEOUT_MS);
-    const server = http.createServer((req, res) => {
-      const u = new URL(req.url ?? "/", "http://localhost");
-      if (u.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      const err = u.searchParams.get("error");
-      const got = u.searchParams.get("code");
-      const ok = !err && !!got && u.searchParams.get("state") === state;
-      res.writeHead(ok ? 200 : 400, { "content-type": "text/html" });
-      res.end(
-        `<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>${ok ? "\u2713 Signed in to malloyyo" : "Sign-in failed"}</h2><p>${ok ? "You can close this tab and return to the terminal." : err ?? "state mismatch"}</p></body>`
-      );
-      clearTimeout(timer);
-      if (ok) resolveCode(got);
-      else rejectCode(new Error(err ?? "state mismatch or missing code"));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolveServer({ port, code, close: () => server.close() });
-    });
-  });
-}
-async function login(baseUrl) {
-  const ep = await discover(baseUrl);
-  const { verifier, challenge } = pkce();
-  const state = crypto.randomBytes(16).toString("base64url");
-  const { port, code, close } = await awaitRedirect(state);
-  try {
-    const redirectUri = `http://localhost:${port}/callback`;
-    const clientId = await registerClient(ep.registration_endpoint, redirectUri);
-    const authUrl = new URL(ep.authorization_endpoint);
-    authUrl.search = new URLSearchParams({
-      response_type: "code",
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-      scope: "mcp",
-      state
-    }).toString();
-    console.log("Opening your browser to sign in\u2026");
-    console.log(`If it doesn't open, visit:
-  ${authUrl.toString()}
-`);
-    openBrowser(authUrl.toString());
-    const authCode = await code;
-    const res = await fetch(ep.token_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code: authCode,
-        redirect_uri: redirectUri,
-        client_id: clientId,
-        code_verifier: verifier
-      })
-    });
-    if (!res.ok) throw new Error(`token exchange failed: ${res.status} ${await res.text()}`);
-    const grant = await res.json();
-    const creds = {
-      clientId,
-      accessToken: grant.access_token,
-      refreshToken: grant.refresh_token,
-      expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
-    };
-    saveCreds(baseUrl, creds);
-    return creds;
-  } finally {
-    close();
-  }
-}
-async function refresh(baseUrl, creds) {
-  const ep = await discover(baseUrl);
-  const res = await fetch(ep.token_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: creds.refreshToken,
-      client_id: creds.clientId
-    })
-  });
-  if (!res.ok) throw new Error(`refresh failed: ${res.status}`);
-  const grant = await res.json();
-  const updated = {
-    clientId: creds.clientId,
-    accessToken: grant.access_token,
-    refreshToken: grant.refresh_token,
-    expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
-  };
-  saveCreds(baseUrl, updated);
-  return updated;
-}
-async function getAccessToken(target, opts) {
-  if (opts.tokenFlag) return opts.tokenFlag;
-  if (target.tokenEnv && process.env[target.tokenEnv]) return process.env[target.tokenEnv];
-  let creds = loadCreds(target.url);
-  if (!creds) {
-    throw new Error(`Not authenticated for ${target.url}.
-Run:  malloyyo login ${target.name}`);
-  }
-  if (creds.expiresAt - Date.now() < 6e4) {
-    try {
-      creds = await refresh(target.url, creds);
-    } catch {
-      throw new Error(`Session expired for ${target.url}.
-Run:  malloyyo login ${target.name}`);
-    }
-  }
-  return creds.accessToken;
-}
+// src/lint.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3, resolve } from "node:path";
+import * as esbuild from "esbuild";
 
-// src/mcp.ts
+// src/host.ts
 import fs from "node:fs";
 import path2 from "node:path";
 import url2 from "node:url";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
   MalloyConfig,
   Runtime,
@@ -341,7 +166,7 @@ var contentFiles = {
   "develop/getting-started.md": '---\ndescription: Getting started \u2014 build a Malloy model step by step\n---\n\n# Building a Malloy model, step by step\n\nA model is a `malloy-config.json` (the connection to the data) and an\n`index.malloy` (the published query surface), optionally with other `.malloy`\nfiles that `index.malloy` imports. You edit these with your own file tools; the\nMCP tools compile, inspect, and test what you wrote. Never read `.malloy` as\ntext \u2014 compiling a bare source is how you read a table\'s schema.\n\n## 1. Verify the connection first\n\nConfirm the connection named in `malloy-config.json` resolves \u2014 compile a\nthrowaway probe inline with `compile` (no file needed):\n\n    source: _probe is CONN.sql("SELECT 1 AS one")\n\nIf it compiles, the connection is good. If not, fix the connection / config\nbefore going further \u2014 a broken connection produces an empty schema and then a\ncascade of misleading `field-not-found` errors; ignore the cascade and fix the\nconnection. Call `yo_help("develop/connection-setup")` for how to set up or repair a connection.\n\n## 2. Identify the tables the model needs\n\nIf you are unsure which tables matter, ask the fox \u2014 they own the data and know\nwhere it lives.\n\n## 3. Get a base source per table\n\nA base is "what\'s in the table and what\'s computable from it" \u2014 no joins.\nDiscover the schema by compiling a bare stub inline with `compile`:\n\n    source: users_base is CONN.table("users")\n\n`compile` returns the full column list + types \u2014 that is your schema browser.\nThen write the base into its own file and iterate with `compile_file`, adding\nonly the dimensions and measures intrinsic to that one table:\n\n    // users_base.malloy\n    source: users_base is CONN.table("users") extend {\n      measure: user_count is count()\n    }\n\nIf the data lives in files rather than database tables \u2014 common when the\nconnection is DuckDB \u2014 DuckDB lets you name a file path as the table (a\nproject-relative path):\n\n    source: users_base is CONN.table(\'data/users.parquet\')\n\nOnly drop to a `.sql()` block when a single file-as-table can\'t express what you\nneed \u2014 e.g. globbing or unioning several files:\n\n    source: users_base is CONN.sql("SELECT * FROM read_parquet(\'data/users-*.parquet\')")\n\n(`read_parquet` there is DuckDB SQL, not Malloy \u2014 see `yo_help("develop/connection-setup")`.)\n\n## 4. Assemble index.malloy \u2014 the published surface\n\nImport the bases, join them into the consumer-facing sources, and explicitly\nexport what consumers may query:\n\n    import "users_base.malloy"\n    import "orders_base.malloy"\n\n    source: users is users_base extend {\n      join_many: orders is orders_base on id = orders.user_id\n    }\n    source: orders is orders_base extend { }\n\n    export { users, orders }\n\n**Export discipline** \u2014 the model is a published artifact, so be deliberate about\nits public surface:\n\n- Imported names are private. Base sources stay internal scaffolding unless you\n  export them.\n- Without an `export` statement, everything you define is public. Add one and the\n  surface becomes explicit: only the names you list \u2014 defined or imported \u2014 are\n  public.\n- Hide intermediates. A staging source you define only so other sources can build\n  on it should not be exported.\n- The export list is the consumer\'s menu \u2014 exactly what the test window and real\n  consumers can query, nothing more.\n\n## The loop\n\nEdit a file \u2192 `compile_file` \u2192 fix `problems[]` \u2192 `query` (pass the model file\'s\npath as `ref`; `execute: false` validates first and reports the givens the query\nneeds, supplied via `givens`). Query text is restricted \u2014 `import`, `given:`\ndeclarations, `connection.table`/`connection.sql`, raw SQL, and `##!` flags\nbelong in the model file, not the query. When `compile`/`compile_file` returns\n`formatted: false`, call `prettify` and save its output. Use project-relative\ndata paths, not absolute \u2014 they resolve against the project root and survive\npublishing the model.\n',
   "develop/working-with-models.md": "---\ndescription: Working with an existing Malloy model\n---\n\n# Working with an existing model\n\nAn existing model is an `index.malloy` (plus any `.malloy` files it imports) and\na `malloy-config.json`.\n\n## Understand the model\n\n- **Read `malloy-config.json` directly** \u2014 it is JSON, so read it as text. It\n  lists the connection(s) the model queries against; `yo_help(\"develop/connection-setup\")` explains\n  the format (and how to set one up or repair it).\n- **Do NOT read `.malloy` as text \u2014 compile it.** `compile_file` returns the\n  structured model: each source with its fields, joins, views, and named queries,\n  plus `problems[]`. That is how you describe what is in the model. (Compiling a\n  bare source \u2014 no `extend` block \u2014 likewise reads a raw table's schema.)\n\n## The loop\n\nEdit a file \u2192 `compile_file` \u2192 fix `problems[]` \u2192 `query`. Pass the model file's\npath as `ref`; `execute: false` validates first and reports the givens the query\nneeds (supplied via `givens`). Query text is restricted \u2014 `import`, `given:`\ndeclarations, `connection.table`/`connection.sql`, raw SQL, and `##!` flags\nbelong in the model file, not the query. When `compile`/`compile_file` returns\n`formatted: false`, run `prettify` and save its output. Use project-relative data\npaths, not absolute.\n",
   "explore/how-to.md": '---\ndescription: Extended instructions working with this MCP server\n---\n# General Notes\nMalloy is a combined semantic layer/query language. It describes data and analysis, and it can generate and execute SQL.\n\nYou answer questions from published Malloy semantic models. A model publishes sources and queries.\n\n* Some tools return problems[] to indicate invalid Malloy.  problems may have a `help_topic` field \u2014 call `yo_help(help_topic)` for detailed guidance.\n* `yo_help()` with no topic will show an index which include error explanations, examples of Malloy syntax for common patterns, and a language reference manual (Malloy syntax is still evolving).\n* Tools that inspect Malloy code return objects with schemas, among other things.  An entry with a name which requires `back-tick-quoting` (reserved word, special characters), will have `must_quote: true`\n* When limiting queries, do ranking, top-N, and member selection in Malloy, not in client code.  Results are byte-budgeted: oversized results are truncated (the response says so and may link the full result). Reading aggregated rows is better analysis and the only way to see everything.\n* Compose your answer from what the model publishes. When composing a query, you can make new sources, extending existing sources with measures dimensions and joins. If the model\'s surface genuinely cannot answer a question, that is useful signal about the model.\n\n# Answering A Question\nTo answer a question you need to see what sources are available which pertain to the question.\n\n`list_sources` (when available) \u2014 see the sources you can query, grouped by model, with each model\'s named queries. If you already know the source, go straight to describe_source.\n\n# Build the Query\n* New to a pattern? `yo_help("explore/query-examples")` \u2014 the handful of Malloy query shapes (views, the workhorse group_by/aggregate, filtered aggregates, `all()`, `extend:`, `select:`, `nest:`) that cover almost every question, with the SQL habits that are wrong in Malloy.\n* `describe_source(source, model_ref)` \u2014 always describe a source before querying it (`model_ref` optional when the name is unique). Returns:\n  * `described_source` \u2014 the source\'s `dimensions` (columns), `measures`, and `views` (the author\'s saved queries). A dimension\'s `type` is a scalar or a nested record (`origin.city`); an array column has no `type` \u2014 it shows up as a `joins` entry at its `path`.\n  * `joins` \u2014 keyed by path, the arrays and source-joins this source reaches. `fans_out` marks a path that fans out. Each entry is one of: `{ source }` (fields in `join_source_map`), `{ source_def }` (an anonymous source\'s fields, inline), or an array `{ is_array, source_def }` \u2014 a record array\'s fields are used directly (`parcels.sku`), a scalar array\'s element is `each` (`tags.each`). To write a reference, use the entry\'s `quoted_path` if it has one, else the key.\n  * `join_source_map` \u2014 the named sources those `{ source }` joins resolve to, deduped.\n  * In its own content block, the source\'s raw Malloy, for anything the structured output above doesn\'t cover.\n* `query(source: "...", malloy: "run: source -> { ... }", execute: false)` \u2014 validate without running; it returns the SQL. Iterate until clean. (`model_ref` optional, needed only when the source name is ambiguous.)\n* Some queries accept parameters (givens). More info if needed: yo_help("language/givens-model-level-parameters")\n\n# Run the query\n* Pass a plain-English question with EVERY query, describing what that specific query answers. Queries are recorded/shared independently. Don\'t try to group related queries.\n* query(source: "...", malloy: "run: source -> { ... }", question: "...") \u2014 run it; get the rows.\n\n# Displaying Results\n* Lead with a natural-language restatement of the query \u2014 a short heading works well.\n* A successful query comes back with an ltool_link \u2014 {text, url}, already assembled. It opens this exact query so the user can keep exploring, or share the insight. Follow the data with a markdown link, [\u2197 text](url).\n* When it helps the reader add a short note on how you got the answer: the Malloy logic (filters, grouping, aggregation, ordering, pipeline stages), and any post-processing done outside Malloy.',
-  "explore/query-examples.md": "---\ndescription: Worked query examples \u2014 the handful of Malloy shapes that cover almost every question. Read this before writing a query from scratch.\n---\n# Query Examples\n\nAlmost every query is one of the shapes below. Examples use a `flights` source\n(dimensions like `carrier`, `distance`, `origin`, `destination`, `state`,\n`dep_delay`, `is_small_plane`; measures `flight_count`, `total_distance`).\nSubstitute the real fields from `describe_source`.\n\nTwo rules first: do ordering, limiting, and ranking **in Malloy**, not in client\ncode \u2014 and reuse what the source already publishes before writing your own.\n\n## Run a saved view\n\nThe source may already answer the question. A view is invoked by name:\n\n```malloy\nrun: flights -> by_carrier\n```\n\nRefine a saved view in place with `+ { \u2026 }` \u2014 no need to rewrite it:\n\n```malloy\nrun: flights -> by_carrier + { where: state = 'CA' }\n```\n\n## The workhorse query\n\nWhen no view fits, write a stage. The vast majority of queries are this shape \u2014\n`group_by` the dimensions, `aggregate` the **measures the source already\ndeclares**, `where` to filter, `order_by` to rank. Reuse the measures\n`describe_source` lists (here `flight_count`); don't re-derive an aggregate the\nsource already defines (`count()`):\n\n```malloy\nrun: flights -> {\n  group_by: destination\n  aggregate: flight_count\n  where: state = 'CA'\n  order_by: flight_count desc\n  limit: 10\n}\n```\n\nEvery clause is `keyword:` (note the colon, including `order_by:`).\n\n### Aggregate moves\n\n**Filtered aggregate** \u2014 `measure { where: \u2026 }` filters *that one number* only,\nindependent of the stage `where:`. Two kinds of `where`: stage-level (which rows\nenter the query) vs aggregate-level (which rows a single aggregate counts).\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count\n    percent_late is flight_count { where: dep_delay > 15 } / flight_count * 100\n}\n```\n\n**Aggregates from scratch** \u2014 *only when the source has no measure for what you\nneed*, define your own with `is`:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count is count()                -- row count\n    destination_count is count(destination) -- DISTINCT destinations\n    total_distance is distance.sum()        -- field-first aggregation\n}\n```\n\n**Percent of total with `all()`** \u2014 `all(expr)` ignores the `group_by:` to give\nthe grand total, so a share is `part / all(part)`:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count\n    pct_of_total is flight_count / all(flight_count)\n}\n```\n\n(`all(expr, dim)` totals within a subgroup \u2014 it takes the **alias from\n`group_by:`**, not a dotted path.)\n\n### Declare once, reuse \u2014 `extend:`\n\nWhen an expression repeats in a query, define it locally in an `extend:` block:\n\n```malloy\nrun: flights -> {\n  extend: {\n    measure: total_distance is distance.sum()\n    dimension: state_first_letter is substr(state, 1, 1)\n  }\n  group_by: state_first_letter\n  aggregate:\n    total_distance\n    small_plane_distance is total_distance { where: is_small_plane }\n}\n```\n\n**Composing aggregates.** You can't reference one aggregate from another in the\nsame stage (`aggregate: a is \u2026, b is a/2` fails \u2014 *\"'a' is not defined\"*). To\nbuild a value *from* other aggregates \u2014 a ratio, a share \u2014 define the parts as\nmeasures in `extend:` (measures **can** reference each other), then use them:\n\n```malloy\nrun: flights -> {\n  extend: {\n    measure:\n      late_flights is flight_count { where: dep_delay > 15 }\n      pct_late is late_flights / flight_count\n  }\n  group_by: carrier\n  aggregate: late_flights, pct_late\n  order_by: pct_late desc\n}\n```\n\nTo rank by a computed value, name it (in `aggregate:` or `extend:`) and\n`order_by:` that name \u2014 `order_by:` takes an output field name, never a raw\nexpression, and there is no `derive:` step.\n\n## Flat detail rows \u2014 `select:`\n\nTo fetch raw rows instead of aggregating, use `select:` (the columns to return):\n\n```malloy\nrun: flights -> {\n  select: id, carrier, origin, destination, distance\n  where: distance > 1000\n  order_by: distance desc\n  limit: 100\n}\n```\n\nA stage is **either** a reduction (`group_by:` / `aggregate:`) **or** a projection\n(`select:`) \u2014 never both in the same stage. And `select:` **cannot** be combined\nwith `nest:` in any way; nesting belongs to reductions.\n\n## Nesting \u2014 a sub-table per row\n\n`nest:` attaches a whole query to each row of the outer one. This is where\nanswers get their depth (a per-row ranked breakdown):\n\n```malloy\nrun: flights -> {\n  group_by: origin\n  aggregate: flight_count\n  nest: by_carrier is {\n    group_by: carrier\n    aggregate: flight_count\n    order_by: flight_count desc\n    limit: 5\n  }\n}\n```\n\n## SQL habits that are WRONG in Malloy\n\n| You'd write in SQL | Malloy |\n| --- | --- |\n| `COUNT(DISTINCT x)` | `count(x)` \u2014 `count(distinct x)` is a deprecated error |\n| `SUM(x)` | `x.sum()` |\n| `SUM(x) OVER ()` | `all(x)` |\n| `COUNT(*) FILTER (WHERE c)` / `CASE WHEN` | `count() { where: c }` |\n| `SELECT \u2026 GROUP BY \u2026` | `group_by:` + `aggregate:` (one stage is reduction OR `select:`, never both) |\n",
+  "explore/query-examples.md": "---\ndescription: Worked query examples \u2014 the handful of Malloy shapes that cover almost every question. Read this before writing a query from scratch.\n---\n# Query Examples\n\nAlmost every query is one of the shapes below. Examples use a `flights` source\n(dimensions like `carrier`, `distance`, `origin`, `destination`, `state`,\n`dep_delay`, `is_small_plane`; measures `flight_count`, `total_distance`).\nSubstitute the real fields from `describe_source`.\n\nTwo rules first: do ordering, limiting, and ranking **in Malloy**, not in client\ncode \u2014 and reuse what the source already publishes before writing your own.\n\n## Run a saved view\n\nThe source may already answer the question. A view is invoked by name:\n\n```malloy\nrun: flights -> by_carrier\n```\n\nRefine a saved view in place with `+ { \u2026 }` \u2014 no need to rewrite it:\n\n```malloy\nrun: flights -> by_carrier + { where: state = 'CA' }\n```\n\n## The workhorse query\n\nWhen no view fits, write a stage. The vast majority of queries are this shape \u2014\n`group_by` the dimensions, `aggregate` the **measures the source already\ndeclares**, `where` to filter, `order_by` to rank. Reuse the measures\n`describe_source` lists (here `flight_count`); don't re-derive an aggregate the\nsource already defines (`count()`):\n\n```malloy\nrun: flights -> {\n  group_by: destination\n  aggregate: flight_count\n  where: state = 'CA'\n  order_by: flight_count desc\n  limit: 10\n}\n```\n\nEvery clause is `keyword:` (note the colon, including `order_by:`).\n\n### Aggregate moves\n\n**Filtered aggregate** \u2014 `measure { where: \u2026 }` filters *that one number* only,\nindependent of the stage `where:`. Two kinds of `where`: stage-level (which rows\nenter the query) vs aggregate-level (which rows a single aggregate counts).\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count\n    percent_late is flight_count { where: dep_delay > 15 } / flight_count * 100\n}\n```\n\n**Aggregates from scratch** \u2014 *only when the source has no measure for what you\nneed*, define your own with `is`:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count is count()                -- row count\n    destination_count is count(destination) -- DISTINCT destinations\n    total_distance is distance.sum()        -- field-first aggregation\n}\n```\n\n**Percent of total with `all()`** \u2014 `all(expr)` ignores the `group_by:` to give\nthe grand total, so a share is `part / all(part)`:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate:\n    flight_count\n    pct_of_total is flight_count / all(flight_count)\n}\n```\n\n(`all(expr, dim)` totals within a subgroup \u2014 it takes the **alias from\n`group_by:`**, not a dotted path.)\n\n### Declare once, reuse \u2014 `extend:`\n\nWhen an expression repeats in a query, define it locally in an `extend:` block:\n\n```malloy\nrun: flights -> {\n  extend: {\n    measure: total_distance is distance.sum()\n    dimension: state_first_letter is substr(state, 1, 1)\n  }\n  group_by: state_first_letter\n  aggregate:\n    total_distance\n    small_plane_distance is total_distance { where: is_small_plane }\n}\n```\n\n**Composing aggregates.** You can't reference one aggregate from another in the\nsame stage (`aggregate: a is \u2026, b is a/2` fails \u2014 *\"'a' is not defined\"*). To\nbuild a value *from* other aggregates \u2014 a ratio, a share \u2014 define the parts as\nmeasures in `extend:` (measures **can** reference each other), then use them:\n\n```malloy\nrun: flights -> {\n  extend: {\n    measure:\n      late_flights is flight_count { where: dep_delay > 15 }\n      pct_late is late_flights / flight_count\n  }\n  group_by: carrier\n  aggregate: late_flights, pct_late\n  order_by: pct_late desc\n}\n```\n\nTo rank by a computed value, name it (in `aggregate:` or `extend:`) and\n`order_by:` that name \u2014 `order_by:` takes an output field name, never a raw\nexpression, and there is no `derive:` step.\n\n## Flat detail rows \u2014 `select:`\n\nTo fetch raw rows instead of aggregating, use `select:` (the columns to return):\n\n```malloy\nrun: flights -> {\n  select: id, carrier, origin, destination, distance\n  where: distance > 1000\n  order_by: distance desc\n  limit: 100\n}\n```\n\nA stage is **either** a reduction (`group_by:` / `aggregate:`) **or** a projection\n(`select:`) \u2014 never both in the same stage. And `select:` **cannot** be combined\nwith `nest:` in any way; nesting belongs to reductions.\n\n## Nesting \u2014 a sub-table per row\n\n`nest:` attaches a whole query to each row of the outer one. This is where\nanswers get their depth (a per-row ranked breakdown):\n\n```malloy\nrun: flights -> {\n  group_by: origin\n  aggregate: flight_count\n  nest: by_carrier is {\n    group_by: carrier\n    aggregate: flight_count\n    order_by: flight_count desc\n    limit: 5\n  }\n}\n```\n\n**Listing top-N detail rows in a nest \u2014 `group_by:`, not `select:`.** A nest is a\nreduction, so to nest raw rows (not an aggregate) list the columns with\n`group_by:` (`select:` is not allowed inside a nest):\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate: flight_count\n  nest: longest_flights is {\n    group_by: origin, destination, distance\n    order_by: distance desc\n    limit: 5\n  }\n}\n```\n\n## Multi-stage \u2014 aggregate, then aggregate again (`->`)\n\nA second `->` runs another stage over the **output** of the first. Reach for it\nwhen you need to aggregate an aggregate \u2014 e.g. the **peak** of a per-period\ntotal. You can't write `flight_count.max()` (that's an aggregate of an aggregate\n\u2014 it errors); compute the per-period total in one stage, then take the max in the\nnext:\n\n```malloy\nrun: flights -> {\n  group_by: carrier, dep_year\n  aggregate: flights_that_year is flight_count\n} -> {\n  group_by: carrier\n  aggregate: peak_year is flights_that_year.max()\n}\n```\n\nIn the second stage `flights_that_year` is an ordinary column (the first stage's\noutput), so `.max()` is valid. The same shape filters or re-ranks already-\naggregated rows.\n\n## SQL habits that are WRONG in Malloy\n\n| You'd write in SQL | Malloy |\n| --- | --- |\n| `COUNT(DISTINCT x)` | `count(x)` \u2014 `count(distinct x)` is a deprecated error |\n| `SUM(x)` | `x.sum()` |\n| `SUM(x) OVER ()` | `all(x)` |\n| `COUNT(*) FILTER (WHERE c)` / `CASE WHEN` | `count() { where: c }` |\n| `SELECT \u2026 GROUP BY \u2026` | `group_by:` + `aggregate:` (one stage is reduction OR `select:`, never both) |\n",
   "explore/restricted-queries.md": "# Restricted Query Explanation\n\nThe `query` tool runs your Malloy against a **published model**. You have that\nmodel's entire published surface to work with \u2014 and you can build on it. The\nmodel is an inentionally curated subset of the data available in the\ndatabase.\n\n## You can\n\n- Use everything the model defines: its **sources, dimensions, measures, views,\n  joins, and named queries**. `describe_source` shows exactly what's there.\n- **Run a named query and refine it** \u2014\n  `run: top_carriers + { where: dep_year = 2024 }`.\n- **Define your own** dimensions, measures, and **your own sources and joins** \u2014\n  as long as they are *derived from the model's sources*. You are not limited to\n  the author's fields; compose new ones from them.\n- Reference the model's `$NAME` givens and supply values via the `givens` map on\n  the `query` call (use `execute: false` to discover which a query needs).\n- Use a model field that was itself defined with raw SQL \u2014 the author vouched\n  for the model's own definitions.\n\n## What is \"Restricted\"\n\nIf you see `restricted-construct-forbidden`, the query used something that\nreaches *outside* the published model: pulling in another file (`import`),\nopening a raw connection (`connection.table(...)` / `connection.sql(...)`),\nwriting raw SQL (`name!type(...)` or the `sql_*` functions), declaring new\n`given:`s, or setting `##!` compiler flags.\n\nThe fix is never to work around it \u2014 express the answer in terms of what the\nmodel publishes (define derived sources, joins, dimensions, and measures from\nthe model's sources). If something fundamental is missing, that's feedback for\nthe model's author.\n",
   "language/malloy-language-reference.md": '<!-- Copied from malloy-cli (jrtipton/malloy-cli) skills/malloy-language-reference.md on 2026-06-11.\n     Deliberate temporary fork \u2014 converge when the engine is extracted to @malloydata. -->\n---\ndescription: Malloy language reference \u2014 concepts, syntax, compilation model. Load this before writing or reviewing Malloy code.\n---\n# Malloy Language Reference\n\nMalloy is a semantic data modeling and query language. It compiles to SQL and runs against existing database engines (DuckDB, BigQuery, Snowflake, PostgreSQL, MySQL, Trino, Presto). It is not a SQL wrapper or abstraction layer \u2014 it has its own type system, scoping rules, expression semantics, and compilation pipeline.\n\nMalloy is designed around how humans think about data, not how data computations are mechanically accomplished. SQL is oriented around the machine \u2014 you specify joins, group-by columns, subqueries, and window functions in terms of what the database needs to do. Malloy is oriented around the analyst \u2014 you describe relationships, name computations, and compose questions in terms of what the data means. Malloy bridges the gap between these two by compiling the human-oriented description into correct, efficient SQL.\n\nA core design principle is that **most queries are themselves designing a new semantic model.** Formulating a question about data \u2014 choosing what to group by, what to aggregate, what to nest \u2014 is inherently an act of defining a new way to look at that data. Malloy is built around this idea: the output of every query is not just a result set but a new source with its own schema, and data comprehension is an ongoing iterative process where later stages want not only the data from a previous stage but how that data came into being. This is why query output carries metadata, why queries can be used as sources, and why views and pipelines compose naturally.\n\n## Documents and Statements\n\nA Malloy file (`.malloy`) is a sequence of statements, optionally separated by semicolons. There are five statement types:\n\n- **`import`** \u2014 import sources and queries from another `.malloy` file\n- **`source:`** \u2014 define a named, reusable data source with its schema and extensions\n- **`query:`** \u2014 define a named query (source + view) for reuse\n- **`run:`** \u2014 execute a query (the "do it now" statement)\n- **`given:`** \u2014 declare model-level parameters supplied at run time (experimental, see Givens)\n\n```malloy\nimport "shared_model.malloy"\n\nsource: flights is duckdb.table(\'flights.parquet\') extend {\n  measure: flight_count is count()\n}\n\nquery: carrier_summary is flights -> {\n  group_by: carrier\n  aggregate: flight_count\n}\n\nrun: carrier_summary\n```\n\nComments use `//` or `--` (both are line comments).\n\n## Sources\n\nA **source** is anything you can hand a SQL database and get a schema back \u2014 a table name, a SQL SELECT, or the output of another Malloy query. The columns in that schema become the source\'s initial fields (all dimensions).\n\n```malloy\nsource: flights is duckdb.table(\'flights.parquet\')\nsource: limited is duckdb.sql("""SELECT * FROM flights LIMIT 100""")\nsource: carrier_facts is carrier_summary   -- a query used as a source\n```\n\nWhat makes sources central to Malloy is **extension**. The `extend` block lets you layer on dimensions, measures, views, joins, filters, primary keys, field restrictions, and renames. These extensions travel with the source \u2014 any query against it gets them for free.\n\n```malloy\nsource: flights is duckdb.table(\'flights.parquet\') extend {\n  primary_key: id\n\n  dimension: distance_km is distance * 1.609344\n\n  measure:\n    flight_count is count()\n    total_distance is sum(distance)\n\n  join_one: carriers with carrier\n  join_one: origin_airport is airports on origin_airport.code = origin\n\n  where: dep_time > @2001\n\n  view: by_carrier is {\n    group_by: carrier\n    aggregate: flight_count, total_distance\n  }\n}\n```\n\nSources can extend other sources, creating a refinement chain:\n\n```malloy\nsource: ca_flights is flights extend {\n  where: origin.state = \'CA\'\n}\n```\n\nField access control uses `accept:` (allowlist) or `except:` (denylist) to restrict which inherited columns are visible. Fields can be renamed with `rename: new_name is old_name`.\n\n## Joins\n\nJoins are declared in the source, not reconstructed in every query. This is a fundamental design difference from SQL: the graph structure of your data is a property of the model.\n\n```malloy\njoin_one: carriers with carrier                          -- FK \u2192 PK shorthand\njoin_one: origin_airport is airports on origin_airport.code = origin  -- explicit ON\njoin_many: line_items on line_items.order_id = id        -- one-to-many\njoin_cross: other_table on other_table.key = key         -- cross join\n```\n\n- `join_one` \u2014 the joined source has at most one row per source row (many-to-one or one-to-one)\n- `join_many` \u2014 the joined source has potentially many rows per source row\n- `join_cross` \u2014 a full cross product\n\nThe `with` shorthand requires the joined source to have a declared `primary_key`. All joins are left outer by default. There is no right join \u2014 Malloy\'s graph model doesn\'t need one.\n\n**Choosing `join_one` vs `join_many`:** Ask "for a single row in the base source, can the joined source match more than one row?" If yes \u2192 `join_many`. If no (or at most one) \u2192 `join_one`. The common mistake is reaching for `join_many` when joining a *lookup or summary table* (e.g., joining an inventory snapshot to a purchase history on a wine key). Even though the joined table may have many rows overall, if each base row resolves to *at most one* joined row, use `join_one`. Use `join_many` only when the join genuinely fans out the base rows \u2014 e.g., joining line items to orders, or notes to a wine catalog.\n\nWhen you reference a joined source\'s fields, you use dot notation: `carriers.nickname`, `origin_airport.state`. This is one of Malloy\'s most important abstractions: **the access path to nested data is identical regardless of how the nesting is physically stored.** An array of records embedded in a column, a `join_many` to a separate table, a record-typed column \u2014 all are navigated with the same dot notation. The SQL required to traverse these different physical arrangements varies wildly (unnesting arrays, LEFT JOINs, correlated subqueries, ARRAY_AGG), but Malloy hides all of that. You think about the logical shape of your data \u2014 "flights have carriers, carriers have a nickname" \u2014 and write `carriers.nickname`. The compiler figures out what SQL is needed to get there. This means you can restructure your physical schema (normalize a nested array into a separate table, or denormalize a joined table into a record column) without changing any of the Malloy that references that data.\n\n## Fields\n\nMalloy has four kinds of fields: **dimensions**, **measures**, **views**, and **calculations**.\n\n### Dimensions\n\nScalar expressions \u2014 they compute a value per row. All columns inherited from a table are dimensions. Computed dimensions reference other dimensions or columns:\n\n```malloy\ndimension: full_name is concat(first_name, \' \', last_name)\ndimension: is_long_haul is distance > 1000\n```\n\n### Measures\n\nAggregate expressions \u2014 they compute a value across a set of rows. A field is a measure when its defining expression contains an aggregate function (`count`, `sum`, `avg`, `min`, `max`):\n\n```malloy\nmeasure:\n  flight_count is count()\n  total_distance is sum(distance)\n  avg_distance is avg(distance)\n  pct_delayed is count() { where: dep_delay > 30 } / count()\n```\n\n**`count(expr)` counts distinct values.** Unlike SQL\'s `COUNT(DISTINCT expr)`, Malloy uses `count(expr)` for distinct counting. The `count(distinct expr)` form is a deprecated syntax that will produce an error. Use `count()` for total row count, `count(field)` for distinct values of that field:\n\n```malloy\naggregate:\n  total_rows is count()               -- all rows\n  unique_carriers is count(carrier)   -- distinct carriers\n```\n\nMeasures can be filtered inline with `{ where: ... }`, which is how you build things like "percent of flights delayed" without subqueries.\n\n### Views\n\nA view is a query saved into the source \u2014 a reusable transformation:\n\n```malloy\nview: by_carrier is {\n  group_by: carrier\n  aggregate: flight_count, total_distance\n  limit: 10\n}\n```\n\nViews can reference other views from the same source as a starting point, and can be extended with `+`.\n\n### Calculations\n\nWindow functions over the grouped result. Calculations can only be defined in a query stage with `calculate:`, never in a source definition, because they depend on the output columns of the query:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate: flight_count\n  calculate: carrier_rank is rank()\n}\n```\n\n## Queries and Views\n\nA query pairs a source with a view (the transformation). Everything after the first `->` is the view.\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate: flight_count\n}\n```\n\n### Reduction vs. Projection\n\nEach stage of a view performs exactly one of:\n\n- **Reduction** \u2014 uses `group_by:` and/or `aggregate:` to reduce grain. Analogous to `SELECT ... GROUP BY` in SQL.\n- **Projection** \u2014 uses `select:` to pick fields without aggregation. Analogous to `SELECT` without `GROUP BY`.\n\nThese cannot be mixed in a single stage. A stage with `group_by:` cannot have `select:`, and vice versa.\n\n### Source-level definitions vs. query-level operations\n\nThe same `name is expression` syntax defines fields in both sources and queries:\n\n```malloy\n-- In a source (reusable):\nsource: flights is ... extend {\n  measure: flight_count is count()          -- defines a measure in the model\n}\n\n-- In a query (ad hoc):\nrun: flights -> {\n  aggregate: flight_count is count()        -- defines the same measure inline\n}\n```\n\nWhen used in a source, `measure:` and `dimension:` are **definition statements** \u2014 they add named fields to the source\'s schema. When used in a query, `group_by:`, `aggregate:`, `select:`, `nest:`, and `calculate:` are **query operations** \u2014 they specify what the query does. The field definitions are syntactically identical in both contexts, but the enclosing keyword determines the role:\n\n| Source keyword | Query keyword | What it holds |\n|---|---|---|\n| `dimension:` | `group_by:` or `select:` | scalar expressions |\n| `measure:` | `aggregate:` | aggregate expressions |\n| `view:` | `nest:` | sub-queries |\n| _(n/a)_ | `calculate:` | window functions |\n\nThis is why `measure` and `aggregate` are separate keywords. `measure:` is a *modeling* statement \u2014 "this source has a reusable aggregate computation called X." `aggregate:` is a *query* statement \u2014 "in this query, include these aggregate values in the output." A query\'s `aggregate:` can reference a previously defined measure by name, or define one inline. The distinction parallels the separation between defining a dimension in a source and using it via `group_by:` in a query.\n\n### Multi-stage Pipelines\n\nStages chain with `->`. Each stage\'s output becomes the next stage\'s source:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate: flight_count is count()\n} -> {\n  where: flight_count > 1000\n  select: *\n}\n```\n\n### Refinement with `+`\n\nThe refinement operator `+` merges query operations together. It works both within a view and at the top level on a named query:\n\n```malloy\n-- Refining a view within a query:\nrun: flights -> by_carrier + { limit: 5 } + { nest: by_destination }\n\n-- Refining a named query at the top level:\nrun: carrier_summary + { group_by: origin }   -- add origin grouping to existing query\n```\n\nWhen a dimension name appears as a bare reference, it expands to `{ group_by: name }`. A measure name expands to `{ aggregate: name }`:\n\n```malloy\nrun: flights -> carrier + flight_count + { limit: 10 }\n-- equivalent to: flights -> { group_by: carrier; aggregate: flight_count; limit: 10 }\n```\n\nFor multi-stage queries, refinement semantics get more complex \u2014 but for single-stage queries, `+` straightforwardly merges operations into the stage.\n\n### Nesting\n\n`nest:` embeds an aggregating subquery inside a reduction. Each row of the outer query gets a subtable from the nested query. Nests can nest arbitrarily deep:\n\n```malloy\nrun: flights -> {\n  group_by: carrier\n  aggregate: flight_count\n  nest: top_routes is {\n    group_by: origin, destination\n    aggregate: flight_count\n    limit: 3\n  }\n}\n```\n\n### Other query operations\n\n- **`where:`** \u2014 filter rows (pre-aggregation). Comma-separated filters are ANDed.\n- **`having:`** \u2014 filter groups (post-aggregation), like SQL\'s HAVING.\n- **`limit:`** / **`order_by:`** \u2014 limit and sort output.\n- **`extend`** \u2014 add fields or joins to a source inline within a query expression.\n\n## Aggregate Locality (Symmetric Aggregates)\n\nThis is one of Malloy\'s most important features. In SQL, when you join tables and aggregate, you risk double-counting (the "fan trap"). Malloy solves this with **aggregate locality** \u2014 you specify *where in the join graph* an aggregation should be computed.\n\n```malloy\nrun: flights -> {\n  aggregate:\n    -- avg seats weighted by number of flights (locality: source, i.e. flights)\n    avg_seats_per_flight is source.avg(aircraft.aircraft_models.seats)\n    -- avg seats per aircraft model (locality: aircraft_models)\n    avg_seats_per_model is aircraft.aircraft_models.seats.avg()\n}\n```\n\nThree syntactic forms:\n\n- `avg(expr)` \u2014 aggregate at the current source (implicit locality)\n- `joined_source.avg(expr)` \u2014 aggregate at the specified join point (explicit locality)\n- `joined_source.field.avg()` \u2014 shorthand for aggregating the field at its parent source\n\nFor `sum` and `avg` (asymmetric aggregates), when the expression crosses a join boundary, Malloy *requires* explicit locality \u2014 it won\'t silently give you a wrong answer. For `min`, `max`, and `count` (symmetric), locality doesn\'t change the result, so implicit is always fine.\n\nMalloy implements this with a technique called **symmetric aggregates** \u2014 it internally de-duplicates rows based on primary keys at the appropriate join level, so aggregations are always mathematically correct regardless of join fan-out.\n\n## Ungrouped Aggregates\n\n`all()` and `exclude()` allow computing aggregates at different grouping levels within a single query:\n\n```malloy\nrun: airports -> {\n  group_by: state, faa_region\n  aggregate:\n    airport_count is count()\n    total_airports is all(count())                   -- ungrouped: total across all rows\n    region_airports is all(count(), faa_region)       -- grouped only by faa_region\n    pct_of_total is count() / all(count())\n}\n```\n\n`all(expr)` removes all grouping. `all(expr, dim1, dim2)` keeps only the specified grouping dimensions. `exclude(expr, dim)` removes the specified dimension from grouping.\n\n**Important:** `all(expr, dim)` takes the **local alias name** as defined in the query\'s `group_by:`, not a dotted path. If you want to partition by a joined field, alias it first:\n\n```malloy\n-- WRONG: all(count(), director.primaryName)  -- dot paths don\'t work here\n-- RIGHT:\nrun: movies -> {\n  group_by: director is director.primaryName   -- alias it\n  aggregate:\n    movies is count()\n    director_total is all(count(), director)   -- reference the alias\n    pct is count() / all(count(), director)\n}\n```\n\n## Expressions\n\nMalloy expressions include arithmetic, comparison, logical operators, function calls, type casts, and several Malloy-specific forms.\n\n### Evaluation Spaces\n\nEvery expression has an evaluation space: **literal**, **constant**, **input**, or **output**. Input expressions reference source columns/dimensions. Output expressions reference the results of the current query stage (used in `calculate:`). Some functions constrain their arguments \u2014 e.g., `lag(expr)` requires an output expression, `avg(expr)` requires an input expression.\n\n### Application and Partial Comparison\n\nThe `?` operator applies a condition to a value. Partial comparisons are conditions without a left-hand side:\n\n```malloy\nwhere: state ? \'CA\' | \'NY\'         -- state is \'CA\' or \'NY\'\nwhere: distance ? > 500 & < 2000   -- distance between 500 and 2000\n```\n\n`|` is alternation (OR), `&` is conjunction (AND) within partials.\n\n### Pick Expressions\n\nMalloy\'s equivalent of CASE:\n\n```malloy\ndimension: size_bucket is\n  pick \'short\' when distance < 500\n  pick \'medium\' when distance < 1500\n  else \'long\'\n```\n\n### Filtered Aggregate Expressions\n\nAny aggregate can be filtered inline:\n\n```malloy\nmeasure: ca_flights is count() { where: origin.state = \'CA\' }\n```\n\n### Type Casting\n\n```malloy\ntotal_distance::string       -- Malloy type cast\nname::"VARCHAR(32)"          -- database-native type cast\n```\n\n### Time Literals and Ranges\n\n```malloy\n@2003                       -- the year 2003\n@2003-Q2                    -- second quarter of 2003\n@2024-01-15 10:30:00        -- timestamp literal\ndep_time ? @2003 to @2005   -- range comparison\nnow                         -- current timestamp\n```\n\n## Data Types\n\nMalloy\'s type system: `string`, `number`, `boolean`, `date`, `timestamp`, `timestamptz`, `json`, and `sql native` (for unsupported database types). Compound types: `type[]` for arrays, `{ name :: type, ... }` for records, nesting arbitrarily: `{ x :: number, tags :: string[] }[]`.\n\n## Annotations and Tags\n\nThese are related but distinct concepts.\n\n### Annotations\n\nAnnotations are **text strings** attached to objects during compilation. They are metadata \u2014 they never affect query execution or SQL generation. An annotation starts with `#` and continues to end of line:\n\n```malloy\n# bar_chart\nview: by_carrier is { ... }\n```\n\n- `#` annotations attach to the next object defined below them\n- `##` annotations attach to the model (the file)\n- Block annotations use `#|` ... `|#` for multi-line content (closing delimiter must match the column position of the opener)\n\nAnnotations distribute over definition lists:\n\n```malloy\n# currency\nmeasure:           -- all three measures get the # currency annotation\n  revenue is sum(amount)\n  # percent          -- this measure also gets # percent\n  margin is revenue / cost\n  cost is sum(amount)\n```\n\n### Tags (a use of annotations)\n\nTags are the primary *consumer* of annotation strings. They interpret annotation text using a structured property language (MOTLY). The key distinction: **annotations are the transport mechanism (raw strings attached to objects), tags are the interpretation layer (parsed key-value properties).**\n\nNot all annotations are tags. An annotation is just text. Tags are annotations that happen to be written in the tag property language and parsed by an application.\n\n### Annotation prefixes (routing)\n\nThe character(s) immediately after `#` route the annotation to different consumers:\n\n- `# ` (hash-space) \u2014 renderer tags, parsed by the Malloy VS Code extension for visualization\n- `##!` \u2014 compiler directives (e.g., `##! experimental.parameters`, `##! experimental.givens`)\n- `#"` \u2014 reserved for documentation strings\n- `#(appName)` \u2014 application-specific tags (e.g., `#(docs) hidden`)\n\n```malloy\n# bar_chart size=large        -- renderer tag: tells VS Code how to render\n##! experimental.parameters   -- compiler tag: enables a feature flag\n#(myApp) priority=high        -- custom app tag: ignored by renderer/compiler\n```\n\n### Tag property syntax\n\n```\ntName                         -- boolean flag (exists = true)\ntName=value                   -- set property value\ntName=[a, b, c]               -- array value\ntName: { p1=v1 p2=v2 }       -- nested properties (replaces)\ntName { p1=v1 }               -- nested properties (merges)\n-tName                        -- delete a property\ntName.sub.path=value          -- deep path assignment\n```\n\nValues can be unquoted identifiers, quoted strings, numbers, or typed values prefixed with `@` (`@true`, `@false`, `@2024-01-15`).\n\n## Givens (Model-Level Parameters)\n\n**Status: experimental, gated by `##! experimental.givens`.** Naming is provisional.\n\nGivens are values supplied at run time that the model can reference in any expression. The motivating use case is row-level access control \u2014 a model written once with `where: x.tenant_id = $TENANT` and the tenant supplied per API call \u2014 but they also fit configuration values, session context, and any "one compiled model, many invocations with varying context" pattern.\n\nGivens are model-wide: a single namespace, one value per name per compilation. They are *complementary to* source/query parameters (`source: foo(x :: string) is ...`), not a replacement. Use a parameter when you want two differently-bound copies of the same source side-by-side in one model; use a given when you want one value visible everywhere in the compilation.\n\n### Declaration\n\nThe `given:` top-level statement introduces givens, with a name, a type, and an optional default:\n\n```malloy\ngiven:\n  TENANT :: string\n  MAX_ROWS :: number is 1000\n  CUTOFF_DATE :: date is @2024-01-01\n```\n\nType can be any Malloy atomic type or compound type, including `filter<T>`:\n\n```malloy\ngiven:\n  ROLE :: string\n  ALLOWED_ROLES :: string[]\n  SESSION :: { user_id :: string, tenant :: string }\n  TENANT_FILTER :: filter<string>\n```\n\nDefaults are expressions over constants and other givens. Annotations attach to given declarations the same way they attach to sources or measures.\n\n### Reference: the `$` sigil\n\nInside any expression, a given is referenced with a leading `$`:\n\n```malloy\nsource: orders_for_user is orders extend {\n  where: orders.tenant_id = $TENANT\n}\n\nquery: recent_orders is orders_for_user -> {\n  where: order_date >= $CUTOFF_DATE\n  limit: $MAX_ROWS\n}\n```\n\n`$` appears *only* at expression references. The other three sites where a given\'s name appears \u2014 declaration, import, and supply (caller side) \u2014 use the bare name, because syntactic position already disambiguates. Givens share the top-level declaration namespace with sources/queries/views, so `source: x is ...` plus `given: x :: string` is a name-conflict error.\n\n### Set membership: `expr in $arrayGiven`\n\nThe RHS of `in` is either a parenthesized list of expressions (`in (1, 2, x, y * 7)`, same as SQL) or a given with an array value (`in $ARR`). A bare array-typed expression \u2014 a dimension, a joined array field, an inline `[a, b, c]` literal \u2014 is *not* legal on the RHS; arrays only reach the RHS via the given form.\n\nWhen a given has array type, `expr in $ARR` tests `expr` against the runtime-bound array; `not in $ARR` is the negation. The left-hand side must match the array\'s element type (`string in $string[]`, `number in $number[]`, etc.); mismatches are translate-time errors. Records and nested arrays are out of scope.\n\n```malloy\ngiven:\n  ALLOWED_STATES :: string[]\n  URGENT_STATUSES :: string[]\n\nsource: orders extend {\n  where: state in $ALLOWED_STATES\n  dimension: is_urgent is order_status in $URGENT_STATUSES\n}\n```\n\nAt SQL emit, the array\'s contents land in a generated `IN (...)` clause. Empty or `null` arrays collapse to the obvious result (`IN` \u2192 `FALSE`, `NOT IN` \u2192 `TRUE`). NULL elements inside a non-empty array follow standard SQL `IN` semantics.\n\nTo derive a value from an array \u2014 typically a boolean gate \u2014 *without* the array itself reaching row-position SQL, use an inline given (below).\n\n### Inline givens\n\nAn `inline` given is evaluated at **bind time**, before SQL is emitted: its default expression runs against the resolved given values and reduces to a literal, and that literal is what reaches SQL.\n\n```malloy\ngiven:\n  CAPABILITIES :: string[]\n  inline CAN_READ_ORDERS :: boolean is \'read_orders\' in $CAPABILITIES\n  inline CAN_MUTATE :: boolean\n    is \'write_orders\' in $CAPABILITIES or \'admin\' in $CAPABILITIES\n\nsource: orders extend {\n  where: $CAN_READ_ORDERS   -- SQL sees: WHERE ... AND TRUE  (or FALSE)\n}\n```\n\nThis is the **row-level access-control gate** pattern: the host supplies a capability list as a regular given, an inline given derives a boolean from it, and only the boolean \u2014 not the list \u2014 crosses into row-position SQL. The query planner sees a constant predicate.\n\nRules:\n\n- An inline given **must** have a default. `inline FOO :: number` with no `is` clause is a translate-time error.\n- The default may use:\n  - Boolean and comparison operators: `and`, `or`, `not`, `=`, `!=`, `<`, `<=`, `>`, `>=`\n  - The `in $array` test against another given\n  - Literals (string, number, boolean, null, array) and references to other givens\n- The default cannot call SQL functions, reference fields, or use any operator outside that list. Disallowed operators are reported at translate time with the offending operator names.\n- Inline givens are filtered out of `Model.givens` and `PreparedQuery.givens` \u2014 they\'re computed, not supplied \u2014 so introspection-driven UIs don\'t render editors for them. A caller can still shadow one by binding it explicitly (useful in tests).\n- `inline` is a context-sensitive modifier, not a reserved keyword: fields, sources, views, dimensions, and joins can still be named `inline`.\n\n### Imports\n\nGivens behave like every other top-level named thing under import:\n\n- **Bare import** (`import "b.malloy"`) brings B\'s full export surface in, including all of B\'s givens, under their original names.\n- **Selective import** (`import { source1 } from "b.malloy"`) brings in only what\'s listed. To surface a given to your callers, list it: `import { source1, MAX_ROWS } from "b.malloy"`.\n- **Rename** uses the existing `LOCAL is REMOTE` form: `import { CAP is MAX_ROWS } from "b.malloy"`.\n\nSurfacing controls *who can supply a value*, not whether internal references work. An imported source can reference a given the importer didn\'t surface; the reference still resolves internally, and at run time the unsurfaced given relies on its declaration-site default.\n\nA common project convention is a shared `tenant_givens.malloy` (declaring `$TENANT`, `$USER_ROLE`, etc.) that every root file bare-imports on line 1, so the project\'s given contract is visible at the top of any model.\n\n### Satisfiability\n\nA query referencing `$X` is satisfiable if either `$X` is in the model\'s namespace (so a caller can supply a value) or `$X` has a default at its declaration site. Otherwise the query is unsatisfiable and errors. Latent definitions (views, dimensions, measures) that reference `$X` are fine if no query actually invokes them \u2014 satisfiability is a property of running queries.\n\n### Supplying values\n\nValues can be supplied at two layers, which compose (per-query overrides per-runtime):\n\n**Per-runtime** \u2014 bound to a `Runtime`, applied as defaults to every query through it. Two paths:\n\n1. **`givensPath` in `malloy-config.json`** points at a JSON file of `name \u2192 value`:\n   ```jsonc\n   { "givensPath": "./local-givens.json" }\n   // or env-var indirection (resolved at config load):\n   { "givensPath": { "env": "GAME_STORE_GIVENS" } }\n   ```\n   The values file is a flat JSON map, keys are caller-facing surface names:\n   ```jsonc\n   { "TENANT": "acme", "USER_ROLE": "admin", "CUTOFF_DATE": "2024-01-01" }\n   ```\n\n2. **Direct on the Runtime constructor** (for per-request multi-tenant servers, tests, scripts):\n   ```typescript\n   const runtime = new Runtime({\n     config,\n     givens: { TENANT: claims.tenant_id, USER_ROLE: claims.role },\n     urlReader,\n   });\n   ```\n   Constructor values *merge over* the file at `givensPath` per-key.\n\n**Per-query** \u2014 supplied on a single `.run({ givens: ... })` call:\n```typescript\nawait query.run({ givens: { STATE_FILTER: "CA", LIMIT_OVERRIDE: 50 } })\n```\nAvailable on every compile-or-run entry point (`runtime.loadQuery(...).run(options)`, `preparedQuery.getPreparedResult(options)`, `preparedQuery.getSQL(options)`).\n\nThe resolved per-runtime values are exposed on `runtime.givens` (read-only) for diagnostics.\n\n### Finalized givens (security primitive)\n\nA multi-tenant deployment usually wants `TENANT`/`USER_ROLE`/`REGION` to be runtime-bound and **un-overridable per-query** \u2014 otherwise a downstream endpoint that accidentally accepts user-controlled query params and plumbs them into `.run({ givens: ... })` becomes a tenant-leak vulnerability.\n\n`finalizeGivens` in the config locks names at the API surface:\n\n```jsonc\n{\n  "givensPath": { "env": "GAME_STORE_GIVENS" },\n  "finalizeGivens": ["TENANT", "USER_ROLE", "REGION"]\n}\n```\n\nFinalize doesn\'t change *what* a given resolves to \u2014 only *who* can supply it. A `.run({ givens: { TENANT: ... } })` for a finalized name throws at API entry (named, not silently dropped). Finalized givens are filtered out of `Model.givens` and `PreparedQuery.givens` so introspection-driven UIs don\'t render editors for locked names.\n\n### JS shapes for supplied values\n\nBoth the JSON values file and per-query `givens` maps accept the same per-type shapes:\n\n| Malloy type | JS |\n|---|---|\n| `string` | string |\n| `number` | `number`, `bigint`, or string (precision escape hatch) |\n| `boolean` | boolean |\n| `date` | ISO date string `"2024-01-15"` |\n| `timestamp` (naive) | ISO string without offset \u2014 *not* a JS `Date` |\n| `timestamptz` | JS `Date` or ISO string with offset (string preferred \u2014 makes TZ choice visible) |\n| `T[]` | JS array |\n| `{ name :: T, ... }` | JS object |\n| `filter<T>` | JS string (Malloy filter expression source) |\n\nNaive timestamp givens reject `Date` because `Date` represents a UTC instant, not a wall-clock value, and `new Date("2001-01-01T00:00:00")` silently picks up the system\'s local TZ. Type mismatches throw at the boundary with a path that points at the offending location (e.g., `givens.SESSION.user_id: expected string, got number`). `null` is legal for any given type.\n\n### Introspection\n\n`Model.givens` and `PreparedQuery.givens` expose, to the host, the supplyable givens \u2014 for whole-model parameter editors and per-query "run this" forms respectively. Each entry carries name, type, default expression (or undefined if the caller must supply), location, and access to declaration-site annotations via `tagParse`/`getTaglines`.\n\n## How a Malloy Query Becomes SQL\n\nThe compilation pipeline has two phases:\n\n### Phase 1: Translation (source code \u2192 IR)\n\n```\nMalloy source \u2192 ANTLR lexer/parser \u2192 parse tree \u2192 AST builder \u2192 AST \u2192 IR generator \u2192 IR\n```\n\nThe **Intermediate Representation (IR)** is a plain, serializable data structure (JSON-compatible) that fully describes the semantic model and query. Note that IR is *not* dialect-agnostic \u2014 the same Malloy source compiled against different databases can produce different IR, because schema information, type mappings, and available functions vary by backend. It can be cached, transmitted, and reused. Key IR types:\n\n- **`SourceDef`** \u2014 a source\'s complete definition: schema, fields, joins, filters\n- **`Query`** \u2014 a source paired with a pipeline of operations\n- **`FieldDef`** \u2014 definition of any field (dimension, measure, join, calculation)\n- **`Expr`** \u2014 expression tree (arithmetic, comparisons, aggregates, function calls, field references)\n\nThe translator handles all language-level semantics: scoping, name resolution, type checking, evaluation space validation.\n\n### Phase 2: Compilation (IR \u2192 SQL)\n\n```\nIR \u2192 query compiler \u2192 expression compiler \u2192 dialect-specific SQL generator \u2192 SQL + metadata\n```\n\nThe compiler walks the IR query pipeline, translating each stage into SQL constructs (CTEs, subqueries, GROUP BY, window functions). A **Dialect** layer handles database-specific SQL generation.\n\nThe compiler also produces **metadata** alongside the SQL \u2014 structural information needed to interpret the result set (column types, nesting structure, annotation data). This metadata is what allows Malloy renderers to reconstruct nested/hierarchical results from the flat SQL result set and apply visualization tags.\n\n### Key architectural consequences\n\n- Because the IR is serializable, it can be cached and reused across compilations (though IR is database-specific \u2014 the same source compiled against different backends may produce different IR).\n- Because joins are declared in the source (not the query), the compiler knows the full join graph and can compute symmetric aggregates correctly.\n- Because nested queries are first-class, the compiler generates the appropriate SQL (correlated subqueries or ARRAY_AGG patterns depending on dialect) automatically.\n- Because measures are typed as aggregates in the IR, the compiler can validate that they only appear in aggregate context and enforce locality rules.\n\n## Where to Go Deeper\n\nThis document is a conceptual reference \u2014 enough to reason about the language and its design, but not exhaustive. Here\'s where to find more detail.\n\n### Language Documentation\n\nThe full docs live at [https://docs.malloydata.dev](https://docs.malloydata.dev). Key pages by topic:\n\n| Topic | URL |\n|---|---|\n| Sources, extensions, joins, primary keys | [documentation/language/source](https://docs.malloydata.dev/documentation/language/source) |\n| Queries, views, reduction vs projection | [documentation/language/query](https://docs.malloydata.dev/documentation/language/query), [views](https://docs.malloydata.dev/documentation/language/views) |\n| Fields: dimensions, measures, views, calculations | [documentation/language/fields](https://docs.malloydata.dev/documentation/language/fields) |\n| Aggregate functions and aggregate locality | [documentation/language/aggregates](https://docs.malloydata.dev/documentation/language/aggregates) |\n| Ungrouped aggregates (`all`, `exclude`) | [documentation/language/ungrouped-aggregates](https://docs.malloydata.dev/documentation/language/ungrouped-aggregates) |\n| Nested views / aggregating subqueries | [documentation/language/nesting](https://docs.malloydata.dev/documentation/language/nesting) |\n| Joins | [documentation/language/join](https://docs.malloydata.dev/documentation/language/join) |\n| Expressions, operators, pick, apply | [documentation/language/expressions](https://docs.malloydata.dev/documentation/language/expressions) |\n| Evaluation spaces (literal, constant, input, output) | [documentation/language/eval_space](https://docs.malloydata.dev/documentation/language/eval_space) |\n| Filters and filter placement | [documentation/language/filters](https://docs.malloydata.dev/documentation/language/filters) |\n| Annotations and tags | [documentation/language/tags](https://docs.malloydata.dev/documentation/language/tags) |\n| Calculations and window functions | [documentation/language/calculations_windows](https://docs.malloydata.dev/documentation/language/calculations_windows) |\n| Data types | [documentation/language/datatypes](https://docs.malloydata.dev/documentation/language/datatypes) |\n| Time operations, ranges, timezones | [documentation/language/timestamp-operations](https://docs.malloydata.dev/documentation/language/timestamp-operations), [time-ranges](https://docs.malloydata.dev/documentation/language/time-ranges), [timezones](https://docs.malloydata.dev/documentation/language/timezones) |\n| Imports | [documentation/language/imports](https://docs.malloydata.dev/documentation/language/imports) |\n| Top-level statements and model structure | [documentation/language/statement](https://docs.malloydata.dev/documentation/language/statement) |\n| Functions reference | [documentation/language/functions](https://docs.malloydata.dev/documentation/language/functions) |\n\n### Examples and Patterns\n\nThe docs site includes worked examples of common analytical patterns at [documentation/patterns](https://docs.malloydata.dev/documentation/patterns/): percent-of-total, year-over-year, cohort analysis, sessionization, moving averages, nested subtotals, and more.\n\nEnd-to-end guides are at [documentation/user_guides](https://docs.malloydata.dev/documentation/user_guides/), including [Malloy by Example](https://docs.malloydata.dev/documentation/user_guides/malloy_by_example) (a comprehensive walkthrough) and a three-part series for SQL users ([part 1](https://docs.malloydata.dev/documentation/user_guides/sql_experts1), [part 2](https://docs.malloydata.dev/documentation/user_guides/sql_experts2), [part 3](https://docs.malloydata.dev/documentation/user_guides/sql_experts3)).\n\n### Source Code\n\nThe Malloy implementation lives at [github.com/malloydata/malloy](https://github.com/malloydata/malloy). Key entry points:\n\n| What | Where |\n|---|---|\n| ANTLR grammar (lexer + parser) | `packages/malloy/src/lang/grammar/` |\n| AST node hierarchy | `packages/malloy/src/lang/ast/` |\n| Parse tree \u2192 AST builder | `packages/malloy/src/lang/malloy-to-ast.ts` |\n| IR type definitions | `packages/malloy/src/model/malloy_types.ts` |\n| IR \u2192 SQL compiler | `packages/malloy/src/model/` |\n| Dialect-specific SQL generation | `packages/malloy/src/dialect/` |\n| Tag/annotation parsing (MOTLY) | `packages/malloy-tag/` |\n| Renderer | `packages/malloy-render/` |\n| Architecture overview | `CONTEXT.md` (root and in each package) |\n',
   "language/pick.md": "---\ndescription: pick expressions \u2014 Malloy's CASE/if-then-else\n---\n\n`pick` is Malloy's equivalent of SQL `CASE WHEN`. Each branch is its own\n`pick` keyword; the `else` clause catches the remainder.\n\nThere are two forms of pick. In the first the `when` expression is any\nboolean expression.\n\n```malloy\n    pick 'Female' when upper(first_name) in ('JENNIFER', 'ELIZABETH', 'AMY', 'JESSICA')\n    pick 'Male'   when upper(first_name) in ('JAMES', 'JOHN', 'ROBERT', 'MICHAEL')\n    else 'Unknown'\n```\n\n## Example usage in a query\n\n```malloy\nrun: payments -> {\n  group_by: tier is\n    pick 'high'   when total_amount > 10000\n    pick 'medium' when total_amount > 1000\n    else 'low'\n  aggregate: payment_count is count()\n}\n```\n\n## Common mistakes\n\n- **Every branch needs its own `pick` keyword** \u2014 there is no `when \u2026 then`:\n  ```malloy\n  -- WRONG:\n  pick 'a' when x = 1 'b' when x = 2 else 'c'\n\n  -- RIGHT:\n  pick 'a' when x = 1\n  pick 'b' when x = 2\n  else 'c'\n  ```\n\n- **`else` is required** when the branches don't cover all cases \u2014 omitting it\n  returns `null` for unmatched rows.\n",
@@ -471,6 +296,7 @@ function getHelpTopic(query) {
 }
 var ERROR_TOPIC_MAP = {
   "syntax-error": "explore/query-examples",
+  "aggregate-of-aggregate": "explore/query-examples",
   "field-not-found": "language/fields",
   "aggregate-in-calculate": "language/expressions",
   "not-an-aggregate": "language/fields",
@@ -752,30 +578,30 @@ function walkFields(fields, structDefFields, depth, ctx, anon) {
       const ef = f;
       const cls = classifyJoinTarget(ef, ctx.knownSources);
       const inlineMode = ctx.opts.expand === "inline";
-      const join4 = { name: f.name, relationship: joinRel(ef) };
-      applyDocs(join4, f.annotations);
-      if (cls.kind === "ref") join4.source_ref = cls.name;
+      const join5 = { name: f.name, relationship: joinRel(ef) };
+      applyDocs(join5, f.annotations);
+      if (cls.kind === "ref") join5.source_ref = cls.name;
       else if (cls.kind === "anon" && !inlineMode) {
-        join4.anon_src_index = allocAnon(ef, cls.refId, depth + 1, ctx, anon);
+        join5.anon_src_index = allocAnon(ef, cls.refId, depth + 1, ctx, anon);
       }
-      if (needsQuote(f.name)) join4.must_quote = true;
-      if (annotations.length > 0) join4.annotations = annotations;
-      if (loc) join4.location = loc;
+      if (needsQuote(f.name)) join5.must_quote = true;
+      if (annotations.length > 0) join5.annotations = annotations;
+      if (loc) join5.location = loc;
       const synthetic = isScalarArray(ef) || isRepeatedRecord(ef) || isAnonymousRecord(ef);
-      if (isScalarArray(ef)) join4.column_shape = "scalar_array";
-      else if (isRepeatedRecord(ef)) join4.column_shape = "record_array";
-      else if (isAnonymousRecord(ef)) join4.column_shape = "record";
+      if (isScalarArray(ef)) join5.column_shape = "scalar_array";
+      else if (isRepeatedRecord(ef)) join5.column_shape = "record_array";
+      else if (isAnonymousRecord(ef)) join5.column_shape = "record";
       if (!synthetic && mLoc) {
         const body = sliceSource(ctx.readSource(mLoc.url), mLoc);
-        if (body) join4.body = body;
+        if (body) join5.body = body;
       }
       const shouldInline = inlineMode || cls.kind === "own";
       if (shouldInline && depth < MAX_JOIN_DEPTH) {
         const childStructFields = ef.structDef.fields ?? [];
         const sub = walkFields(ef.allFields, childStructFields, depth + 1, ctx, anon);
-        join4.fields = stripScalarArrayValue(ef, sub);
+        join5.fields = stripScalarArrayValue(ef, sub);
       }
-      groups.joins.push(join4);
+      groups.joins.push(join5);
       continue;
     }
     if (f.isQueryField()) {
@@ -1179,6 +1005,67 @@ async function executeMaterialized(query, opts, loadProblems, decorate = (p) =>
     return { ok: false, problems: [...loadProblems, errorProblem(e, uri)] };
   }
 }
+async function run(runtime, entry, opts = {}) {
+  let materializer;
+  let modelQueries;
+  let loadProblems;
+  try {
+    materializer = runtime.loadModel(entry);
+    const model = await materializer.getModel();
+    modelQueries = { named: [...model.queries().named], unnamed: model.queries().unnamed };
+    loadProblems = mapProblems(model.problems);
+  } catch (e) {
+    if (e instanceof MalloyError2) {
+      return { ok: false, problems: mapProblems(e.problems) };
+    }
+    return { ok: false, problems: [errorProblem(e, entry.href)] };
+  }
+  let query;
+  if (opts.name !== void 0) {
+    if (!modelQueries.named.includes(opts.name)) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "selector-not-found",
+            `No query named '${opts.name}'. Available: ` + JSON.stringify({ queries: modelQueries.named, runs: modelQueries.unnamed }),
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadQueryByName(opts.name);
+  } else if (typeof opts.index === "number") {
+    if (opts.index < 0 || opts.index >= modelQueries.unnamed) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "selector-out-of-range",
+            `Index ${opts.index} out of range; the model has ${modelQueries.unnamed} run: statement(s).`,
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadQueryByIndex(opts.index);
+  } else {
+    if (modelQueries.unnamed === 0) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "no-run",
+            "The source has no run: statement. Specify a named query via `name`, or add a run: to the source.",
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadFinalQuery();
+  }
+  return executeMaterialized(query, opts, loadProblems, (p) => p, entry.href);
+}
 async function queryGivens(q) {
   try {
     const pq = await q.getPreparedQuery();
@@ -1692,36 +1579,383 @@ function exploreSurface(host, opts = {}) {
   };
 }
 
-// ../mcp-engine/dist/mcp-sdk.js
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-var HOST_ONLY2 = "host_only";
-function toContent(result) {
-  const { malloy_text, [HOST_ONLY2]: _hostOnly, ...rest } = result;
-  const content = [
-    { type: "text", text: JSON.stringify(rest, null, 2) }
-  ];
-  if (typeof malloy_text === "string" && malloy_text.length > 0) {
-    content.push({ type: "text", text: malloy_text });
-  }
-  return { content, structuredContent: { ...rest } };
+// src/host.ts
+var ENTRY = "index.malloy";
+function fsReader() {
+  return {
+    readURL: async (u) => {
+      if (u.protocol !== "file:") {
+        throw new Error(`unsupported URL scheme for import: ${u.href}`);
+      }
+      return fs.promises.readFile(u, "utf8");
+    }
+  };
 }
-function lowLevel(server) {
-  return "server" in server ? server.server : server;
+async function loadConfig(rootUrl, reader) {
+  const discovered = await discoverConfig(rootUrl, rootUrl, reader).catch(() => null);
+  return discovered ?? new MalloyConfig({ includeDefaultConnections: true }, {
+    rootDirectory: rootUrl.toString()
+  });
 }
-function attachSurface(server, surface, opts = {}) {
-  const s = lowLevel(server);
-  const byName = new Map(surface.tools.map((t) => [t.name, t]));
-  s.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: surface.tools.map((t) => ({
-      name: t.name,
-      title: t.title,
-      description: t.description,
-      inputSchema: t.inputSchema
-    }))
-  }));
+async function makeRunner(root) {
+  await import("@malloydata/malloy-connections");
+  const abs = path2.resolve(root);
+  const rootUrl = url2.pathToFileURL(abs + path2.sep);
+  async function lease(fn) {
+    const reader = fsReader();
+    const config = await loadConfig(rootUrl, reader);
+    const { reader: prepared, entry } = prepareSource(reader, { url: path2.join(abs, ENTRY) });
+    const runtime = new Runtime({ config, urlReader: prepared });
+    try {
+      return await fn(runtime, entry);
+    } finally {
+      await config.shutdown("idle").catch(() => {
+      });
+    }
+  }
+  return {
+    root: abs,
+    entryExists: () => fs.existsSync(path2.join(abs, ENTRY)),
+    run(queryName, givens) {
+      return lease(
+        (runtime, entry) => run(runtime, entry, { name: queryName, givens, stableResult: true, rowLimit: 5e3 })
+      );
+    },
+    validate(queryName, givens) {
+      return lease(async (runtime, entry) => {
+        try {
+          const mm = runtime.loadModel(entry);
+          const model = await mm.getModel();
+          const named = [...model.queries().named];
+          if (!named.includes(queryName)) {
+            return { ok: false, error: `no query named '${queryName}' (model has: ${named.join(", ") || "none"})` };
+          }
+          const q = mm.loadQueryByName(queryName);
+          const has = givens && Object.keys(givens).length > 0;
+          await q.getSQL(has ? { givens } : void 0);
+          return { ok: true };
+        } catch (e) {
+          return { ok: false, error: e instanceof Error ? e.message : String(e) };
+        }
+      });
+    }
+  };
+}
+
+// src/lint.ts
+async function lintDashboards(root) {
+  const abs = resolve(root);
+  const names = listDashboardDirs(abs);
+  const dashboards = [];
+  if (names.length === 0) return { ok: true, dashboards };
+  const runner = await makeRunner(abs);
+  if (!runner.entryExists()) {
+    return { ok: false, dashboards: [{ name: "(model)", errors: [`no index.malloy at ${abs}`] }] };
+  }
+  for (const name of names) {
+    const errors = [];
+    const dir = join3(abs, "dashboards", name);
+    let manifest = null;
+    try {
+      manifest = JSON.parse(readFileSync3(join3(dir, "manifest.json"), "utf8"));
+    } catch (e) {
+      errors.push(`manifest.json: invalid JSON (${e.message})`);
+    }
+    let query;
+    const givenValues = {};
+    if (manifest) {
+      if (typeof manifest.title !== "string") errors.push(`manifest: "title" must be a string`);
+      if (typeof manifest.query !== "string") errors.push(`manifest: "query" must be a string`);
+      else query = manifest.query;
+      const givens = manifest.givens;
+      if (!Array.isArray(givens)) {
+        errors.push(`manifest: "givens" must be an array`);
+      } else {
+        for (const g of givens) {
+          if (typeof g?.name !== "string") {
+            errors.push(`manifest: every given needs a string "name"`);
+            continue;
+          }
+          if (g.type !== "string" && g.type !== "number") {
+            errors.push(`given "${g.name}": "type" must be "string" or "number"`);
+          }
+          if (g.default !== void 0) givenValues[g.name] = g.default;
+        }
+      }
+    }
+    const tsxPath = join3(dir, "Dashboard.tsx");
+    if (!existsSync3(tsxPath)) {
+      errors.push(`missing Dashboard.tsx`);
+    } else {
+      try {
+        await esbuild.transform(readFileSync3(tsxPath, "utf8"), { loader: "tsx", jsx: "automatic" });
+      } catch (e) {
+        const msg = e.errors?.map((x) => x.text).join("; ") ?? String(e);
+        errors.push(`Dashboard.tsx: ${msg}`);
+      }
+    }
+    if (query) {
+      const v = await runner.validate(query, givenValues);
+      if (!v.ok) errors.push(v.error);
+    }
+    dashboards.push({ name, errors });
+  }
+  return { ok: dashboards.every((d) => d.errors.length === 0), dashboards };
+}
+function printLintReport(report) {
+  for (const d of report.dashboards) {
+    if (d.errors.length === 0) {
+      console.log(`  \u2713 ${d.name}`);
+    } else {
+      console.log(`  \u2717 ${d.name}`);
+      for (const e of d.errors) console.log(`      ${e}`);
+    }
+  }
+}
+
+// src/oauth.ts
+import http from "node:http";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+
+// src/store.ts
+import { homedir } from "node:os";
+import { dirname, join as join4 } from "node:path";
+import { mkdirSync, readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, chmodSync } from "node:fs";
+function credsPath() {
+  const base = process.env.XDG_CONFIG_HOME || join4(homedir(), ".config");
+  return join4(base, "malloyyo", "credentials.json");
+}
+function readAll() {
+  const p = credsPath();
+  if (!existsSync4(p)) return {};
+  try {
+    return JSON.parse(readFileSync4(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function loadCreds(url4) {
+  return readAll()[url4];
+}
+function saveCreds(url4, creds) {
+  const p = credsPath();
+  mkdirSync(dirname(p), { recursive: true });
+  const all = readAll();
+  all[url4] = creds;
+  writeFileSync(p, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(p, 384);
+  } catch {
+  }
+}
+function clearCreds(url4) {
+  const all = readAll();
+  if (!(url4 in all)) return false;
+  delete all[url4];
+  writeFileSync(credsPath(), JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+  return true;
+}
+
+// src/oauth.ts
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+async function discover(baseUrl) {
+  const res = await fetch(`${baseUrl}/api/oauth/discovery/authorization-server`);
+  if (!res.ok) throw new Error(`OAuth discovery failed at ${baseUrl}: ${res.status} ${res.statusText}`);
+  return await res.json();
+}
+function pkce() {
+  const verifier = crypto.randomBytes(32).toString("base64url");
+  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+async function registerClient(registrationEndpoint, redirectUri) {
+  const res = await fetch(registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "malloyyo CLI",
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      scope: "mcp"
+    })
+  });
+  if (!res.ok) throw new Error(`client registration failed: ${res.status} ${await res.text()}`);
+  return (await res.json()).client_id;
+}
+function openBrowser(url4) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url4]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url4]] : ["xdg-open", [url4]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+function awaitRedirect(state) {
+  return new Promise((resolveServer) => {
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    const timer = setTimeout(() => rejectCode(new Error("timed out waiting for browser sign-in")), LOGIN_TIMEOUT_MS);
+    const server = http.createServer((req, res) => {
+      const u = new URL(req.url ?? "/", "http://localhost");
+      if (u.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const err = u.searchParams.get("error");
+      const got = u.searchParams.get("code");
+      const ok = !err && !!got && u.searchParams.get("state") === state;
+      res.writeHead(ok ? 200 : 400, { "content-type": "text/html" });
+      res.end(
+        `<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>${ok ? "\u2713 Signed in to malloyyo" : "Sign-in failed"}</h2><p>${ok ? "You can close this tab and return to the terminal." : err ?? "state mismatch"}</p></body>`
+      );
+      clearTimeout(timer);
+      if (ok) resolveCode(got);
+      else rejectCode(new Error(err ?? "state mismatch or missing code"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolveServer({ port, code, close: () => server.close() });
+    });
+  });
+}
+async function login(baseUrl) {
+  const ep = await discover(baseUrl);
+  const { verifier, challenge } = pkce();
+  const state = crypto.randomBytes(16).toString("base64url");
+  const { port, code, close } = await awaitRedirect(state);
+  try {
+    const redirectUri = `http://localhost:${port}/callback`;
+    const clientId = await registerClient(ep.registration_endpoint, redirectUri);
+    const authUrl = new URL(ep.authorization_endpoint);
+    authUrl.search = new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      scope: "mcp",
+      state
+    }).toString();
+    console.log("Opening your browser to sign in\u2026");
+    console.log(`If it doesn't open, visit:
+  ${authUrl.toString()}
+`);
+    openBrowser(authUrl.toString());
+    const authCode = await code;
+    const res = await fetch(ep.token_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code: authCode,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: verifier
+      })
+    });
+    if (!res.ok) throw new Error(`token exchange failed: ${res.status} ${await res.text()}`);
+    const grant = await res.json();
+    const creds = {
+      clientId,
+      accessToken: grant.access_token,
+      refreshToken: grant.refresh_token,
+      expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
+    };
+    saveCreds(baseUrl, creds);
+    return creds;
+  } finally {
+    close();
+  }
+}
+async function refresh(baseUrl, creds) {
+  const ep = await discover(baseUrl);
+  const res = await fetch(ep.token_endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: creds.refreshToken,
+      client_id: creds.clientId
+    })
+  });
+  if (!res.ok) throw new Error(`refresh failed: ${res.status}`);
+  const grant = await res.json();
+  const updated = {
+    clientId: creds.clientId,
+    accessToken: grant.access_token,
+    refreshToken: grant.refresh_token,
+    expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
+  };
+  saveCreds(baseUrl, updated);
+  return updated;
+}
+async function getAccessToken(target, opts) {
+  if (opts.tokenFlag) return opts.tokenFlag;
+  if (target.tokenEnv && process.env[target.tokenEnv]) return process.env[target.tokenEnv];
+  let creds = loadCreds(target.url);
+  if (!creds) {
+    throw new Error(`Not authenticated for ${target.url}.
+Run:  malloyyo login ${target.name}`);
+  }
+  if (creds.expiresAt - Date.now() < 6e4) {
+    try {
+      creds = await refresh(target.url, creds);
+    } catch {
+      throw new Error(`Session expired for ${target.url}.
+Run:  malloyyo login ${target.name}`);
+    }
+  }
+  return creds.accessToken;
+}
+
+// src/mcp.ts
+import fs2 from "node:fs";
+import path3 from "node:path";
+import url3 from "node:url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  MalloyConfig as MalloyConfig2,
+  Runtime as Runtime2,
+  discoverConfig as discoverConfig2
+} from "@malloydata/malloy";
+
+// ../mcp-engine/dist/mcp-sdk.js
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var HOST_ONLY2 = "host_only";
+function toContent(result) {
+  const { malloy_text, [HOST_ONLY2]: _hostOnly, ...rest } = result;
+  const content = [
+    { type: "text", text: JSON.stringify(rest, null, 2) }
+  ];
+  if (typeof malloy_text === "string" && malloy_text.length > 0) {
+    content.push({ type: "text", text: malloy_text });
+  }
+  return { content, structuredContent: { ...rest } };
+}
+function lowLevel(server) {
+  return "server" in server ? server.server : server;
+}
+function attachSurface(server, surface, opts = {}) {
+  const s = lowLevel(server);
+  const byName = new Map(surface.tools.map((t) => [t.name, t]));
+  s.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: surface.tools.map((t) => ({
+      name: t.name,
+      title: t.title,
+      description: t.description,
+      inputSchema: t.inputSchema
+    }))
+  }));
   s.setRequestHandler(CallToolRequestSchema, async (req) => {
     const tool = byName.get(req.params.name);
     if (!tool) {
@@ -1759,18 +1993,78 @@ function attachSurface(server, surface, opts = {}) {
   }
 }
 
+// src/dashboard-guidance.ts
+var DASHBOARD_GUIDANCE = `
+
+# Authoring dashboards
+
+You can build a **dashboard** for this model: a small React view that renders one
+or more of the model's queries, with filter controls. Store it in the repo under
+\`./dashboards/<name>/\`. Preview it with \`malloyyo dashboard dev\`.
+
+## Before you write anything
+1. Call \`describe_source\` to see the model's **named queries** and its
+   **givens** (the declared filter inputs, e.g. STATE, DECADE, with their types).
+   A dashboard may ONLY run named queries the model exposes, driven by givens \u2014
+   never invent Malloy in the dashboard.
+2. If the query or givens you need don't exist yet, add them to the \`.malloy\`
+   model first (a top-level \`query:\` that references \`$GIVEN\` in its filters),
+   then re-check with \`describe_source\`.
+
+## Files to create
+\`./dashboards/<name>/manifest.json\`
+\`\`\`json
+{
+  "title": "Human title",
+  "query": "<a named query from the model>",
+  "givens": [
+    { "name": "STATE",  "label": "State",  "type": "string", "control": "select",
+      "options": ["CA","NY","TX"], "default": "CA" },
+    { "name": "DECADE", "label": "Decade", "type": "number", "control": "select",
+      "options": [1980,1990], "default": 1980 }
+  ]
+}
+\`\`\`
+Given \`name\`s must match the model's given names exactly; \`type\` must match.
+
+\`./dashboards/<name>/Dashboard.tsx\` \u2014 a default-exported React component. It
+receives everything as props from the host runtime; it must NOT import data
+libraries, fetch, or hold credentials:
+\`\`\`tsx
+export default function Dashboard({ manifest, givens, setGiven, Panel }) {
+  // givens   : current filter values, e.g. { STATE: "CA", DECADE: 1980 }
+  // setGiven : (name, value) => void  \u2014 change a filter, the Panel re-runs
+  // Panel    : <Panel givens={givens} /> runs manifest.query with those givens
+  //            and renders the result with Malloy's renderer
+  // Lay out the controls + Panel however you like \u2014 this is your React.
+}
+\`\`\`
+
+## Rules
+- Only React is available to the dashboard (plus the injected \`Panel\`). No other
+  imports, no network, no arbitrary Malloy \u2014 the runtime sandboxes it.
+- Interactivity is done by changing **givens** (which drive the query's filters),
+  not by rewriting queries.
+- The dashboard runs against the SAME model you're exploring, so what you preview
+  is what the model actually returns.
+
+## Preview
+From the model repo: \`malloyyo dashboard dev\` \u2192 open the printed URL. Editing
+\`Dashboard.tsx\` and reloading rebuilds it.
+`;
+
 // src/mcp.ts
-var ENTRY = "index.malloy";
+var ENTRY2 = "index.malloy";
 function defaultConfig(rootUrl) {
-  return new MalloyConfig({ includeDefaultConnections: true }, {
+  return new MalloyConfig2({ includeDefaultConnections: true }, {
     rootDirectory: rootUrl.toString()
   });
 }
-async function loadConfig(root, reader) {
-  const rootUrl = url2.pathToFileURL(root + path2.sep);
+async function loadConfig2(root, reader) {
+  const rootUrl = url3.pathToFileURL(root + path3.sep);
   let discovered;
   try {
-    discovered = await discoverConfig(rootUrl, rootUrl, reader);
+    discovered = await discoverConfig2(rootUrl, rootUrl, reader);
   } catch (e) {
     return {
       config: defaultConfig(rootUrl),
@@ -1783,19 +2077,19 @@ async function loadConfig(root, reader) {
   }
   return { config: defaultConfig(rootUrl), problems: [] };
 }
-function fsReader() {
+function fsReader2() {
   return {
     readURL: async (u) => {
       if (u.protocol !== "file:") {
         throw new Error(`unsupported URL scheme for import: ${u.href}`);
       }
-      return fs.promises.readFile(u, "utf8");
+      return fs2.promises.readFile(u, "utf8");
     }
   };
 }
 function resolveUnderRoot(root, p) {
-  const abs = p.includes("://") ? path2.resolve(decodeURIComponent(new URL(p).pathname)) : path2.resolve(root, p);
-  if (abs !== root && !abs.startsWith(root + path2.sep)) {
+  const abs = p.includes("://") ? path3.resolve(decodeURIComponent(new URL(p).pathname)) : path3.resolve(root, p);
+  if (abs !== root && !abs.startsWith(root + path3.sep)) {
     throw new Error(`path is outside the project root: ${p}`);
   }
   return abs;
@@ -1804,7 +2098,7 @@ function makeConfigSource(root) {
   let cached;
   const signature = () => ["malloy-config.json", "malloy-config-local.json"].map((name) => {
     try {
-      const st = fs.statSync(path2.join(root, name));
+      const st = fs2.statSync(path3.join(root, name));
       return `${name}:${st.mtimeMs}:${st.size}`;
     } catch {
       return `${name}:absent`;
@@ -1813,7 +2107,7 @@ function makeConfigSource(root) {
   return async () => {
     const sig = signature();
     if (cached?.sig !== sig) {
-      cached = { sig, loaded: await loadConfig(root, fsReader()) };
+      cached = { sig, loaded: await loadConfig2(root, fsReader2()) };
     }
     return cached.loaded;
   };
@@ -1824,10 +2118,10 @@ function makeWithRuntime(root, currentConfig) {
     return gateConfigProblems(problems, async () => {
       const resolved = "url" in input ? { url: resolveUnderRoot(root, input.url) } : {
         source: input.source,
-        baseUrl: input.baseUrl ? resolveUnderRoot(root, input.baseUrl) : root + path2.sep
+        baseUrl: input.baseUrl ? resolveUnderRoot(root, input.baseUrl) : root + path3.sep
       };
-      const { reader, entry, readSource } = prepareSource(fsReader(), resolved);
-      const runtime = new Runtime({ config, urlReader: reader });
+      const { reader, entry, readSource } = prepareSource(fsReader2(), resolved);
+      const runtime = new Runtime2({ config, urlReader: reader });
       try {
         return await fn({ runtime, entry, readSource });
       } finally {
@@ -1838,17 +2132,17 @@ function makeWithRuntime(root, currentConfig) {
 }
 function makeExploreHost(root, currentConfig) {
   const withRuntime = makeWithRuntime(root, currentConfig);
-  const published = (ref) => ref === ENTRY && fs.existsSync(path2.join(root, ENTRY));
+  const published = (ref) => ref === ENTRY2 && fs2.existsSync(path3.join(root, ENTRY2));
   return {
     withModel: (ref, fn) => {
       if (!published(ref)) throw new Error(`no published model '${ref}'`);
-      return withRuntime({ url: ENTRY }, fn);
+      return withRuntime({ url: ENTRY2 }, fn);
     },
     list: async () => {
-      if (!published(ENTRY)) return { entries: [] };
-      const entry = await withRuntime({ url: ENTRY }, async (m) => {
+      if (!published(ENTRY2)) return { entries: [] };
+      const entry = await withRuntime({ url: ENTRY2 }, async (m) => {
         const compiled = await compile(m.runtime, m.entry, { exportedOnly: true });
-        return compiled.ok && compiled.model ? modelCatalogEntry(ENTRY, compiled.model) : { model_ref: ENTRY };
+        return compiled.ok && compiled.model ? modelCatalogEntry(ENTRY2, compiled.model) : { model_ref: ENTRY2 };
       });
       return { entries: [entry] };
     }
@@ -1856,14 +2150,14 @@ function makeExploreHost(root, currentConfig) {
 }
 async function serveMcp(opts) {
   await import("@malloydata/malloy-connections");
-  const root = path2.resolve(opts.root ?? process.cwd());
+  const root = path3.resolve(opts.root ?? process.cwd());
   const currentConfig = makeConfigSource(root);
   const surface = exploreSurface(makeExploreHost(root, currentConfig));
   const instanceName = process.env.INSTANCE_NAME || "Malloyyo";
   const server = new McpServer(
     { name: "malloyyo-explore", version: opts.version },
     {
-      instructions: renderInstructions(surface.instructions, instanceName),
+      instructions: renderInstructions(surface.instructions, instanceName) + DASHBOARD_GUIDANCE,
       capabilities: { tools: {}, prompts: {}, resources: {} }
     }
   );
@@ -1876,23 +2170,230 @@ async function serveMcp(opts) {
   });
 }
 
+// src/dashboard.ts
+import http2 from "node:http";
+import fs3 from "node:fs";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import * as esbuild2 from "esbuild";
+var require2 = createRequire(import.meta.url);
+var HOST_LIBS = [
+  "react",
+  "react-dom",
+  "react-dom/client",
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime",
+  "@malloydata/render"
+];
+var HOST_ALIAS = {};
+for (const spec of HOST_LIBS) {
+  try {
+    HOST_ALIAS[spec] = require2.resolve(spec);
+  } catch {
+  }
+}
+function resolveFrameEntry() {
+  const candidates = [
+    new URL("./frame-entry.tsx", import.meta.url),
+    // dev: src/dashboard.ts
+    new URL("../src/frame-entry.tsx", import.meta.url)
+    // built: dist/index.js
+  ].map((u) => fileURLToPath(u));
+  const found = candidates.find((c) => fs3.existsSync(c));
+  if (!found) {
+    throw new Error(
+      "frame-entry.tsx not found \u2014 `dashboard dev` currently needs the CLI source checkout (looked in ./ and ../src). See docs/repo-artifacts.md packaging note."
+    );
+  }
+  return found;
+}
+function discoverDashboards(root) {
+  const base = path4.join(root, "dashboards");
+  if (!fs3.existsSync(base)) return [];
+  const out = [];
+  for (const name of fs3.readdirSync(base)) {
+    const dir = path4.join(base, name);
+    const mf = path4.join(dir, "manifest.json");
+    if (!fs3.statSync(dir).isDirectory() || !fs3.existsSync(mf)) continue;
+    try {
+      out.push({ name, dir, manifest: JSON.parse(fs3.readFileSync(mf, "utf8")) });
+    } catch (e) {
+      console.error(`  ! skipping ${name}: bad manifest.json (${e.message})`);
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function makeBundler() {
+  const cache = /* @__PURE__ */ new Map();
+  const frameEntry = resolveFrameEntry();
+  return async function bundle(dash) {
+    const dashboardFile = path4.join(dash.dir, "Dashboard.tsx");
+    const mtimeMs = fs3.statSync(dashboardFile).mtimeMs + fs3.statSync(frameEntry).mtimeMs;
+    const hit = cache.get(dash.name);
+    if (hit && hit.mtimeMs === mtimeMs) return hit.js;
+    const result = await esbuild2.build({
+      entryPoints: [frameEntry],
+      bundle: true,
+      format: "iife",
+      platform: "browser",
+      jsx: "automatic",
+      write: false,
+      logLevel: "silent",
+      loader: { ".css": "empty" },
+      define: { "process.env.NODE_ENV": '"production"' },
+      plugins: [
+        {
+          name: "virtual-dashboard",
+          setup(b) {
+            b.onResolve({ filter: /^virtual:dashboard$/ }, () => ({ path: dashboardFile }));
+            b.onResolve(
+              { filter: /^(react($|\/)|react-dom($|\/)|@malloydata\/render$)/ },
+              (args) => HOST_ALIAS[args.path] ? { path: HOST_ALIAS[args.path] } : void 0
+            );
+          }
+        }
+      ]
+    });
+    const js = result.outputFiles[0].text;
+    cache.set(dash.name, { mtimeMs, js });
+    return js;
+  };
+}
+var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><meta name="viewport" content="width=device-width,initial-scale=1"></head><body style="margin:0">${body}</body></html>`;
+function parentShell(dash, frameBase, all) {
+  const d = JSON.stringify(dash.name);
+  const fb = JSON.stringify(frameBase);
+  const nav = all.length > 1 ? `<nav style="display:flex;gap:4px;align-items:center;padding:8px 12px;background:#f6f7f9;border-bottom:1px solid #e2e4e8;font:13px system-ui,sans-serif"><span style="color:#888;margin-right:8px">Dashboards</span>` + all.map((x) => {
+    const on = x.name === dash.name;
+    return `<a href="/?d=${encodeURIComponent(x.name)}" style="padding:4px 10px;border-radius:6px;text-decoration:none;${on ? "background:#1a1a1a;color:#fff" : "color:#333"}">${esc(x.manifest.title || x.name)}</a>`;
+  }).join("") + `</nav>` : "";
+  return html(
+    `<div style="display:flex;flex-direction:column;height:100vh">` + nav + `<iframe id="f" sandbox="allow-scripts allow-same-origin" src="${frameBase}/frame?d=${encodeURIComponent(dash.name)}" style="border:0;flex:1;width:100%"></iframe></div><script>
+const f=document.getElementById('f');
+window.addEventListener('message',async(e)=>{
+  if(e.source!==f.contentWindow||e.origin!==${fb})return;
+  const m=e.data; if(!m||m.type!=='run')return;
+  let out;
+  try{
+    const res=await fetch('/api/run',{method:'POST',headers:{'content-type':'application/json'},
+      body:JSON.stringify({d:${d},query:m.query,givens:m.givens})});
+    out=await res.json();
+  }catch(err){ out={ok:false,problems:[{message:String(err)}]}; }
+  f.contentWindow.postMessage({type:'result',id:m.id,...out},${fb});
+});
+</script>`,
+    dash.manifest.title
+  );
+}
+function frameDoc(dash) {
+  return html(
+    `<div id="root"></div><script>window.__MANIFEST__=${JSON.stringify(dash.manifest)}</script><script src="/bundle.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    dash.manifest.title
+  );
+}
+async function readBody(req) {
+  const chunks = [];
+  for await (const c of req) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function serveDashboard(opts) {
+  await import("@malloydata/malloy-connections");
+  const root = path4.resolve(opts.root ?? process.cwd());
+  const port = opts.port ?? 4173;
+  const framePort = port + 1;
+  const frameBase = `http://localhost:${framePort}`;
+  const dashboards = discoverDashboards(root);
+  if (dashboards.length === 0) {
+    throw new Error(`No dashboards found under ${path4.join(root, "dashboards")}/`);
+  }
+  const byName = new Map(dashboards.map((d) => [d.name, d]));
+  const runner = await makeRunner(root);
+  if (!runner.entryExists()) {
+    throw new Error(`No index.malloy at ${root} \u2014 run this from a Malloy model repo.`);
+  }
+  const bundle = makeBundler();
+  const pick = (url4) => byName.get(url4.searchParams.get("d") ?? dashboards[0].name) ?? dashboards[0];
+  const handler = async (req, res) => {
+    const onFramePort = (req.socket.localPort ?? port) === framePort;
+    const url4 = new URL(req.url ?? "/", `http://localhost:${onFramePort ? framePort : port}`);
+    const send = (code, type, body, extra = {}) => {
+      res.writeHead(code, { "content-type": type, ...extra });
+      res.end(body);
+    };
+    try {
+      if (onFramePort) {
+        if (url4.pathname === "/frame") {
+          return send(200, "text/html; charset=utf-8", frameDoc(pick(url4)));
+        }
+        if (url4.pathname === "/bundle.js") {
+          return send(200, "application/javascript; charset=utf-8", await bundle(pick(url4)));
+        }
+        return send(404, "text/plain", "not found");
+      }
+      if (url4.pathname === "/") {
+        return send(200, "text/html; charset=utf-8", parentShell(pick(url4), frameBase, dashboards));
+      }
+      if (url4.pathname === "/api/run" && req.method === "POST") {
+        const { d, query, givens } = JSON.parse(await readBody(req));
+        const dash = byName.get(d);
+        if (!dash) return send(404, "application/json", JSON.stringify({ ok: false, problems: [{ message: `no dashboard '${d}'` }] }));
+        if (query !== dash.manifest.query) {
+          return send(403, "application/json", JSON.stringify({ ok: false, problems: [{ message: `query '${query}' is not declared by ${d}` }] }));
+        }
+        const out = await runner.run(query, givens ?? {});
+        return send(200, "application/json", JSON.stringify(out));
+      }
+      send(404, "text/plain", "not found");
+    } catch (e) {
+      send(500, "application/json", JSON.stringify({ ok: false, problems: [{ message: e.message }] }));
+    }
+  };
+  const shellServer = http2.createServer(handler);
+  const frameServer = http2.createServer(handler);
+  await new Promise((r) => shellServer.listen(port, r));
+  await new Promise((r) => frameServer.listen(framePort, r));
+  console.error(`
+  malloyyo dashboard dev \u2014 model: ${root}`);
+  console.error(`  http://localhost:${port}/   (artifact origin: ${frameBase})`);
+  for (const d of dashboards) {
+    console.error(`    \u2022 ${d.name}  \u2192  http://localhost:${port}/?d=${d.name}`);
+  }
+  console.error(`  Ctrl-C to stop.
+`);
+  await new Promise(() => {
+  });
+}
+
 // package.json
-var version = "0.2.7";
+var version = "0.2.9";
 
 // src/index.ts
 function shortSha(sha) {
   return sha ? sha.slice(0, 7) : "";
 }
 async function publish(target, dir, opts) {
-  const root = resolve(dir);
+  const root = resolve2(dir);
   const t = resolveTarget(root, target);
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const { files, config } = gatherDirectory(root);
   if (files.length === 0) {
     throw new Error(`No .malloy files found under ${root}`);
   }
+  if (!opts.skipLint) {
+    const report = await lintDashboards(root);
+    if (report.dashboards.length > 0) {
+      console.log("dashboards:");
+      printLintReport(report);
+    }
+    if (!report.ok) {
+      throw new Error("dashboard lint failed \u2014 fix the above, or pass --skip-lint");
+    }
+  }
   const git = gitInfo(root);
-  const body = { files, config, git };
+  const dashboards = gatherDashboards(root);
+  const body = { files, config, git, dashboards };
   const provenance = git.sha ? `${git.branch}@${shortSha(git.sha)}${git.dirty ? " (dirty)" : ""}` : "(no git)";
   console.log(`\u2192 ${t.url}  dataset=${t.dataset}`);
   console.log(`  ${files.length} file(s)  ${provenance}`);
@@ -1909,10 +2410,12 @@ async function publish(target, dir, opts) {
   if (!res.ok || !out.ok) {
     throw new Error(`publish failed: ${out.error ?? `${res.status} ${res.statusText}`}`);
   }
-  console.log(`\u2713 published version ${out.version} \u2014 ${out.sources?.length ?? 0} source(s)`);
+  console.log(
+    `\u2713 published version ${out.version} \u2014 ${out.sources?.length ?? 0} source(s)` + (dashboards.length ? `, ${dashboards.length} dashboard(s)` : "")
+  );
 }
 async function status(target, opts) {
-  const t = resolveTarget(resolve("."), target);
+  const t = resolveTarget(resolve2("."), target);
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const res = await fetch(`${t.url}/api/datasets/${t.dataset}/model/status`, {
     headers: { authorization: `Bearer ${bearer}` }
@@ -1927,25 +2430,38 @@ async function status(target, opts) {
   console.log(`  ${s.compileError ? `\u2717 ${s.compileError}` : `\u2713 compiled ${s.compiledAt ?? ""}`}`);
 }
 async function loginCmd(target) {
-  const inst = resolveInstance(resolve("."), target);
+  const inst = resolveInstance(resolve2("."), target);
   await login(inst.url);
   console.log(`\u2713 logged in to ${inst.name} (${inst.url})`);
 }
 async function logoutCmd(target) {
-  const inst = resolveInstance(resolve("."), target);
+  const inst = resolveInstance(resolve2("."), target);
   console.log(clearCreds(inst.url) ? `\u2713 logged out of ${inst.url}` : `not logged in to ${inst.url}`);
 }
 var program = new Command();
 program.name("malloyyo").description("Publish Malloy models to a Malloyyo instance").version(version);
 program.command("login").argument("[target]", "target name or instance URL (optional if the config has one target)").description("sign in to an instance in your browser (stores a token)").action(loginCmd);
 program.command("logout").argument("[target]", "target name or instance URL (optional if the config has one target)").description("forget the stored token for an instance").action(logoutCmd);
-program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
+program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").option("--skip-lint", "skip the pre-publish dashboard lint").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
+program.command("lint").argument("[dir]", "directory to lint", ".").description("validate ./dashboards against the model (manifest, query, givens, Dashboard.tsx)").action(async (dir) => {
+  const report = await lintDashboards(resolve2(dir));
+  if (report.dashboards.length === 0) {
+    console.log("no dashboards to lint");
+    return;
+  }
+  printLintReport(report);
+  if (!report.ok) process.exit(1);
+});
 program.command("status").argument("<target>", "named target from the `malloyyo` config block").option("--token <token>", "bearer token (overrides login/env)").description("show what's live on <target>: version, commit, compile state").action(status);
 program.command("mcp").option("-C, --root <dir>", "project root (default: current directory)").description(
   "run a local stdio MCP server (the explore / test-window surface) over the Malloy model in the current directory"
 ).action(async (opts) => {
   await serveMcp({ root: opts.root, version });
 });
+program.command("dashboard").argument("<action>", "action to run (currently: dev)").option("-C, --root <dir>", "project root (default: current directory)").option("-p, --port <port>", "port to serve on", "4173").description("preview dashboard artifacts in ./dashboards against the local Malloy model").action(async (action, opts) => {
+  if (action !== "dev") throw new Error(`unknown dashboard action '${action}' (expected: dev)`);
+  await serveDashboard({ root: opts.root, port: Number(opts.port) });
+});
 program.parseAsync().catch((err) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);