@malloydata/malloyyo 0.2.8 → 0.2.9

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 
 // src/config.ts
 import { readFileSync, existsSync } from "node:fs";
@@ -38,8 +38,8 @@ function resolveTarget(dir, name) {
 }
 function resolveInstance(dir, arg) {
   if (arg && /^https?:\/\//i.test(arg)) {
-    const url3 = normalizeUrl(arg);
-    return { name: url3, url: url3 };
+    const url4 = normalizeUrl(arg);
+    return { name: url4, url: url4 };
   }
   const targets = readTargetMap(dir);
   const entries = Object.entries(targets);
@@ -84,6 +84,29 @@ function gatherDirectory(dir) {
   const config = existsSync2(configPath) ? readFileSync2(configPath, "utf8") : void 0;
   return { files, config };
 }
+function listDashboardDirs(dir) {
+  const base = join2(dir, "dashboards");
+  if (!existsSync2(base)) return [];
+  return readdirSync(base).filter((name) => {
+    const d = join2(base, name);
+    return statSync(d).isDirectory() && existsSync2(join2(d, "manifest.json"));
+  }).sort();
+}
+function gatherDashboards(dir) {
+  const base = join2(dir, "dashboards");
+  return listDashboardDirs(dir).map((name) => {
+    const raw = readFileSync2(join2(base, name, "manifest.json"), "utf8");
+    let manifest;
+    try {
+      manifest = JSON.parse(raw);
+    } catch (e) {
+      throw new Error(`dashboards/${name}/manifest.json: invalid JSON (${e.message})`);
+    }
+    const tsxPath = join2(base, name, "Dashboard.tsx");
+    if (!existsSync2(tsxPath)) throw new Error(`dashboards/${name}: missing Dashboard.tsx`);
+    return { name, manifest, source: readFileSync2(tsxPath, "utf8") };
+  });
+}
 function gitInfo(dir) {
   const git = (args) => execFileSync("git", args, {
     cwd: dir,
@@ -111,213 +134,15 @@ function gitInfo(dir) {
   }
 }
 
-// src/oauth.ts
-import http from "node:http";
-import crypto from "node:crypto";
-import { spawn } from "node:child_process";
-
-// src/store.ts
-import { homedir } from "node:os";
-import { dirname, join as join3 } from "node:path";
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync, existsSync as existsSync3, chmodSync } from "node:fs";
-function credsPath() {
-  const base = process.env.XDG_CONFIG_HOME || join3(homedir(), ".config");
-  return join3(base, "malloyyo", "credentials.json");
-}
-function readAll() {
-  const p = credsPath();
-  if (!existsSync3(p)) return {};
-  try {
-    return JSON.parse(readFileSync3(p, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function loadCreds(url3) {
-  return readAll()[url3];
-}
-function saveCreds(url3, creds) {
-  const p = credsPath();
-  mkdirSync(dirname(p), { recursive: true });
-  const all = readAll();
-  all[url3] = creds;
-  writeFileSync(p, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
-  try {
-    chmodSync(p, 384);
-  } catch {
-  }
-}
-function clearCreds(url3) {
-  const all = readAll();
-  if (!(url3 in all)) return false;
-  delete all[url3];
-  writeFileSync(credsPath(), JSON.stringify(all, null, 2) + "\n", { mode: 384 });
-  return true;
-}
-
-// src/oauth.ts
-var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
-async function discover(baseUrl) {
-  const res = await fetch(`${baseUrl}/api/oauth/discovery/authorization-server`);
-  if (!res.ok) throw new Error(`OAuth discovery failed at ${baseUrl}: ${res.status} ${res.statusText}`);
-  return await res.json();
-}
-function pkce() {
-  const verifier = crypto.randomBytes(32).toString("base64url");
-  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-async function registerClient(registrationEndpoint, redirectUri) {
-  const res = await fetch(registrationEndpoint, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      client_name: "malloyyo CLI",
-      redirect_uris: [redirectUri],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      scope: "mcp"
-    })
-  });
-  if (!res.ok) throw new Error(`client registration failed: ${res.status} ${await res.text()}`);
-  return (await res.json()).client_id;
-}
-function openBrowser(url3) {
-  const [cmd, args] = process.platform === "darwin" ? ["open", [url3]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url3]] : ["xdg-open", [url3]];
-  try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
-}
-function awaitRedirect(state) {
-  return new Promise((resolveServer) => {
-    let resolveCode;
-    let rejectCode;
-    const code = new Promise((res, rej) => {
-      resolveCode = res;
-      rejectCode = rej;
-    });
-    const timer = setTimeout(() => rejectCode(new Error("timed out waiting for browser sign-in")), LOGIN_TIMEOUT_MS);
-    const server = http.createServer((req, res) => {
-      const u = new URL(req.url ?? "/", "http://localhost");
-      if (u.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      const err = u.searchParams.get("error");
-      const got = u.searchParams.get("code");
-      const ok = !err && !!got && u.searchParams.get("state") === state;
-      res.writeHead(ok ? 200 : 400, { "content-type": "text/html" });
-      res.end(
-        `<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>${ok ? "\u2713 Signed in to malloyyo" : "Sign-in failed"}</h2><p>${ok ? "You can close this tab and return to the terminal." : err ?? "state mismatch"}</p></body>`
-      );
-      clearTimeout(timer);
-      if (ok) resolveCode(got);
-      else rejectCode(new Error(err ?? "state mismatch or missing code"));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolveServer({ port, code, close: () => server.close() });
-    });
-  });
-}
-async function login(baseUrl) {
-  const ep = await discover(baseUrl);
-  const { verifier, challenge } = pkce();
-  const state = crypto.randomBytes(16).toString("base64url");
-  const { port, code, close } = await awaitRedirect(state);
-  try {
-    const redirectUri = `http://localhost:${port}/callback`;
-    const clientId = await registerClient(ep.registration_endpoint, redirectUri);
-    const authUrl = new URL(ep.authorization_endpoint);
-    authUrl.search = new URLSearchParams({
-      response_type: "code",
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-      scope: "mcp",
-      state
-    }).toString();
-    console.log("Opening your browser to sign in\u2026");
-    console.log(`If it doesn't open, visit:
-  ${authUrl.toString()}
-`);
-    openBrowser(authUrl.toString());
-    const authCode = await code;
-    const res = await fetch(ep.token_endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code: authCode,
-        redirect_uri: redirectUri,
-        client_id: clientId,
-        code_verifier: verifier
-      })
-    });
-    if (!res.ok) throw new Error(`token exchange failed: ${res.status} ${await res.text()}`);
-    const grant = await res.json();
-    const creds = {
-      clientId,
-      accessToken: grant.access_token,
-      refreshToken: grant.refresh_token,
-      expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
-    };
-    saveCreds(baseUrl, creds);
-    return creds;
-  } finally {
-    close();
-  }
-}
-async function refresh(baseUrl, creds) {
-  const ep = await discover(baseUrl);
-  const res = await fetch(ep.token_endpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: creds.refreshToken,
-      client_id: creds.clientId
-    })
-  });
-  if (!res.ok) throw new Error(`refresh failed: ${res.status}`);
-  const grant = await res.json();
-  const updated = {
-    clientId: creds.clientId,
-    accessToken: grant.access_token,
-    refreshToken: grant.refresh_token,
-    expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
-  };
-  saveCreds(baseUrl, updated);
-  return updated;
-}
-async function getAccessToken(target, opts) {
-  if (opts.tokenFlag) return opts.tokenFlag;
-  if (target.tokenEnv && process.env[target.tokenEnv]) return process.env[target.tokenEnv];
-  let creds = loadCreds(target.url);
-  if (!creds) {
-    throw new Error(`Not authenticated for ${target.url}.
-Run:  malloyyo login ${target.name}`);
-  }
-  if (creds.expiresAt - Date.now() < 6e4) {
-    try {
-      creds = await refresh(target.url, creds);
-    } catch {
-      throw new Error(`Session expired for ${target.url}.
-Run:  malloyyo login ${target.name}`);
-    }
-  }
-  return creds.accessToken;
-}
+// src/lint.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3, resolve } from "node:path";
+import * as esbuild from "esbuild";
 
-// src/mcp.ts
+// src/host.ts
 import fs from "node:fs";
 import path2 from "node:path";
 import url2 from "node:url";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
   MalloyConfig,
   Runtime,
@@ -753,30 +578,30 @@ function walkFields(fields, structDefFields, depth, ctx, anon) {
       const ef = f;
       const cls = classifyJoinTarget(ef, ctx.knownSources);
       const inlineMode = ctx.opts.expand === "inline";
-      const join4 = { name: f.name, relationship: joinRel(ef) };
-      applyDocs(join4, f.annotations);
-      if (cls.kind === "ref") join4.source_ref = cls.name;
+      const join5 = { name: f.name, relationship: joinRel(ef) };
+      applyDocs(join5, f.annotations);
+      if (cls.kind === "ref") join5.source_ref = cls.name;
       else if (cls.kind === "anon" && !inlineMode) {
-        join4.anon_src_index = allocAnon(ef, cls.refId, depth + 1, ctx, anon);
+        join5.anon_src_index = allocAnon(ef, cls.refId, depth + 1, ctx, anon);
       }
-      if (needsQuote(f.name)) join4.must_quote = true;
-      if (annotations.length > 0) join4.annotations = annotations;
-      if (loc) join4.location = loc;
+      if (needsQuote(f.name)) join5.must_quote = true;
+      if (annotations.length > 0) join5.annotations = annotations;
+      if (loc) join5.location = loc;
       const synthetic = isScalarArray(ef) || isRepeatedRecord(ef) || isAnonymousRecord(ef);
-      if (isScalarArray(ef)) join4.column_shape = "scalar_array";
-      else if (isRepeatedRecord(ef)) join4.column_shape = "record_array";
-      else if (isAnonymousRecord(ef)) join4.column_shape = "record";
+      if (isScalarArray(ef)) join5.column_shape = "scalar_array";
+      else if (isRepeatedRecord(ef)) join5.column_shape = "record_array";
+      else if (isAnonymousRecord(ef)) join5.column_shape = "record";
       if (!synthetic && mLoc) {
         const body = sliceSource(ctx.readSource(mLoc.url), mLoc);
-        if (body) join4.body = body;
+        if (body) join5.body = body;
       }
       const shouldInline = inlineMode || cls.kind === "own";
       if (shouldInline && depth < MAX_JOIN_DEPTH) {
         const childStructFields = ef.structDef.fields ?? [];
         const sub = walkFields(ef.allFields, childStructFields, depth + 1, ctx, anon);
-        join4.fields = stripScalarArrayValue(ef, sub);
+        join5.fields = stripScalarArrayValue(ef, sub);
       }
-      groups.joins.push(join4);
+      groups.joins.push(join5);
       continue;
     }
     if (f.isQueryField()) {
@@ -1180,6 +1005,67 @@ async function executeMaterialized(query, opts, loadProblems, decorate = (p) =>
     return { ok: false, problems: [...loadProblems, errorProblem(e, uri)] };
   }
 }
+async function run(runtime, entry, opts = {}) {
+  let materializer;
+  let modelQueries;
+  let loadProblems;
+  try {
+    materializer = runtime.loadModel(entry);
+    const model = await materializer.getModel();
+    modelQueries = { named: [...model.queries().named], unnamed: model.queries().unnamed };
+    loadProblems = mapProblems(model.problems);
+  } catch (e) {
+    if (e instanceof MalloyError2) {
+      return { ok: false, problems: mapProblems(e.problems) };
+    }
+    return { ok: false, problems: [errorProblem(e, entry.href)] };
+  }
+  let query;
+  if (opts.name !== void 0) {
+    if (!modelQueries.named.includes(opts.name)) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "selector-not-found",
+            `No query named '${opts.name}'. Available: ` + JSON.stringify({ queries: modelQueries.named, runs: modelQueries.unnamed }),
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadQueryByName(opts.name);
+  } else if (typeof opts.index === "number") {
+    if (opts.index < 0 || opts.index >= modelQueries.unnamed) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "selector-out-of-range",
+            `Index ${opts.index} out of range; the model has ${modelQueries.unnamed} run: statement(s).`,
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadQueryByIndex(opts.index);
+  } else {
+    if (modelQueries.unnamed === 0) {
+      return {
+        ok: false,
+        problems: [
+          codeProblem(
+            "no-run",
+            "The source has no run: statement. Specify a named query via `name`, or add a run: to the source.",
+            entry.href
+          )
+        ]
+      };
+    }
+    query = materializer.loadFinalQuery();
+  }
+  return executeMaterialized(query, opts, loadProblems, (p) => p, entry.href);
+}
 async function queryGivens(q) {
   try {
     const pq = await q.getPreparedQuery();
@@ -1693,36 +1579,383 @@ function exploreSurface(host, opts = {}) {
   };
 }
 
-// ../mcp-engine/dist/mcp-sdk.js
-import {
-  CallToolRequestSchema,
-  ListToolsRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-var HOST_ONLY2 = "host_only";
-function toContent(result) {
-  const { malloy_text, [HOST_ONLY2]: _hostOnly, ...rest } = result;
-  const content = [
-    { type: "text", text: JSON.stringify(rest, null, 2) }
-  ];
-  if (typeof malloy_text === "string" && malloy_text.length > 0) {
-    content.push({ type: "text", text: malloy_text });
-  }
-  return { content, structuredContent: { ...rest } };
+// src/host.ts
+var ENTRY = "index.malloy";
+function fsReader() {
+  return {
+    readURL: async (u) => {
+      if (u.protocol !== "file:") {
+        throw new Error(`unsupported URL scheme for import: ${u.href}`);
+      }
+      return fs.promises.readFile(u, "utf8");
+    }
+  };
 }
-function lowLevel(server) {
-  return "server" in server ? server.server : server;
+async function loadConfig(rootUrl, reader) {
+  const discovered = await discoverConfig(rootUrl, rootUrl, reader).catch(() => null);
+  return discovered ?? new MalloyConfig({ includeDefaultConnections: true }, {
+    rootDirectory: rootUrl.toString()
+  });
 }
-function attachSurface(server, surface, opts = {}) {
-  const s = lowLevel(server);
-  const byName = new Map(surface.tools.map((t) => [t.name, t]));
-  s.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: surface.tools.map((t) => ({
-      name: t.name,
-      title: t.title,
-      description: t.description,
-      inputSchema: t.inputSchema
-    }))
-  }));
+async function makeRunner(root) {
+  await import("@malloydata/malloy-connections");
+  const abs = path2.resolve(root);
+  const rootUrl = url2.pathToFileURL(abs + path2.sep);
+  async function lease(fn) {
+    const reader = fsReader();
+    const config = await loadConfig(rootUrl, reader);
+    const { reader: prepared, entry } = prepareSource(reader, { url: path2.join(abs, ENTRY) });
+    const runtime = new Runtime({ config, urlReader: prepared });
+    try {
+      return await fn(runtime, entry);
+    } finally {
+      await config.shutdown("idle").catch(() => {
+      });
+    }
+  }
+  return {
+    root: abs,
+    entryExists: () => fs.existsSync(path2.join(abs, ENTRY)),
+    run(queryName, givens) {
+      return lease(
+        (runtime, entry) => run(runtime, entry, { name: queryName, givens, stableResult: true, rowLimit: 5e3 })
+      );
+    },
+    validate(queryName, givens) {
+      return lease(async (runtime, entry) => {
+        try {
+          const mm = runtime.loadModel(entry);
+          const model = await mm.getModel();
+          const named = [...model.queries().named];
+          if (!named.includes(queryName)) {
+            return { ok: false, error: `no query named '${queryName}' (model has: ${named.join(", ") || "none"})` };
+          }
+          const q = mm.loadQueryByName(queryName);
+          const has = givens && Object.keys(givens).length > 0;
+          await q.getSQL(has ? { givens } : void 0);
+          return { ok: true };
+        } catch (e) {
+          return { ok: false, error: e instanceof Error ? e.message : String(e) };
+        }
+      });
+    }
+  };
+}
+
+// src/lint.ts
+async function lintDashboards(root) {
+  const abs = resolve(root);
+  const names = listDashboardDirs(abs);
+  const dashboards = [];
+  if (names.length === 0) return { ok: true, dashboards };
+  const runner = await makeRunner(abs);
+  if (!runner.entryExists()) {
+    return { ok: false, dashboards: [{ name: "(model)", errors: [`no index.malloy at ${abs}`] }] };
+  }
+  for (const name of names) {
+    const errors = [];
+    const dir = join3(abs, "dashboards", name);
+    let manifest = null;
+    try {
+      manifest = JSON.parse(readFileSync3(join3(dir, "manifest.json"), "utf8"));
+    } catch (e) {
+      errors.push(`manifest.json: invalid JSON (${e.message})`);
+    }
+    let query;
+    const givenValues = {};
+    if (manifest) {
+      if (typeof manifest.title !== "string") errors.push(`manifest: "title" must be a string`);
+      if (typeof manifest.query !== "string") errors.push(`manifest: "query" must be a string`);
+      else query = manifest.query;
+      const givens = manifest.givens;
+      if (!Array.isArray(givens)) {
+        errors.push(`manifest: "givens" must be an array`);
+      } else {
+        for (const g of givens) {
+          if (typeof g?.name !== "string") {
+            errors.push(`manifest: every given needs a string "name"`);
+            continue;
+          }
+          if (g.type !== "string" && g.type !== "number") {
+            errors.push(`given "${g.name}": "type" must be "string" or "number"`);
+          }
+          if (g.default !== void 0) givenValues[g.name] = g.default;
+        }
+      }
+    }
+    const tsxPath = join3(dir, "Dashboard.tsx");
+    if (!existsSync3(tsxPath)) {
+      errors.push(`missing Dashboard.tsx`);
+    } else {
+      try {
+        await esbuild.transform(readFileSync3(tsxPath, "utf8"), { loader: "tsx", jsx: "automatic" });
+      } catch (e) {
+        const msg = e.errors?.map((x) => x.text).join("; ") ?? String(e);
+        errors.push(`Dashboard.tsx: ${msg}`);
+      }
+    }
+    if (query) {
+      const v = await runner.validate(query, givenValues);
+      if (!v.ok) errors.push(v.error);
+    }
+    dashboards.push({ name, errors });
+  }
+  return { ok: dashboards.every((d) => d.errors.length === 0), dashboards };
+}
+function printLintReport(report) {
+  for (const d of report.dashboards) {
+    if (d.errors.length === 0) {
+      console.log(`  \u2713 ${d.name}`);
+    } else {
+      console.log(`  \u2717 ${d.name}`);
+      for (const e of d.errors) console.log(`      ${e}`);
+    }
+  }
+}
+
+// src/oauth.ts
+import http from "node:http";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+
+// src/store.ts
+import { homedir } from "node:os";
+import { dirname, join as join4 } from "node:path";
+import { mkdirSync, readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, chmodSync } from "node:fs";
+function credsPath() {
+  const base = process.env.XDG_CONFIG_HOME || join4(homedir(), ".config");
+  return join4(base, "malloyyo", "credentials.json");
+}
+function readAll() {
+  const p = credsPath();
+  if (!existsSync4(p)) return {};
+  try {
+    return JSON.parse(readFileSync4(p, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function loadCreds(url4) {
+  return readAll()[url4];
+}
+function saveCreds(url4, creds) {
+  const p = credsPath();
+  mkdirSync(dirname(p), { recursive: true });
+  const all = readAll();
+  all[url4] = creds;
+  writeFileSync(p, JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(p, 384);
+  } catch {
+  }
+}
+function clearCreds(url4) {
+  const all = readAll();
+  if (!(url4 in all)) return false;
+  delete all[url4];
+  writeFileSync(credsPath(), JSON.stringify(all, null, 2) + "\n", { mode: 384 });
+  return true;
+}
+
+// src/oauth.ts
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+async function discover(baseUrl) {
+  const res = await fetch(`${baseUrl}/api/oauth/discovery/authorization-server`);
+  if (!res.ok) throw new Error(`OAuth discovery failed at ${baseUrl}: ${res.status} ${res.statusText}`);
+  return await res.json();
+}
+function pkce() {
+  const verifier = crypto.randomBytes(32).toString("base64url");
+  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+async function registerClient(registrationEndpoint, redirectUri) {
+  const res = await fetch(registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "malloyyo CLI",
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      scope: "mcp"
+    })
+  });
+  if (!res.ok) throw new Error(`client registration failed: ${res.status} ${await res.text()}`);
+  return (await res.json()).client_id;
+}
+function openBrowser(url4) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url4]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url4]] : ["xdg-open", [url4]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+function awaitRedirect(state) {
+  return new Promise((resolveServer) => {
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    const timer = setTimeout(() => rejectCode(new Error("timed out waiting for browser sign-in")), LOGIN_TIMEOUT_MS);
+    const server = http.createServer((req, res) => {
+      const u = new URL(req.url ?? "/", "http://localhost");
+      if (u.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const err = u.searchParams.get("error");
+      const got = u.searchParams.get("code");
+      const ok = !err && !!got && u.searchParams.get("state") === state;
+      res.writeHead(ok ? 200 : 400, { "content-type": "text/html" });
+      res.end(
+        `<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>${ok ? "\u2713 Signed in to malloyyo" : "Sign-in failed"}</h2><p>${ok ? "You can close this tab and return to the terminal." : err ?? "state mismatch"}</p></body>`
+      );
+      clearTimeout(timer);
+      if (ok) resolveCode(got);
+      else rejectCode(new Error(err ?? "state mismatch or missing code"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolveServer({ port, code, close: () => server.close() });
+    });
+  });
+}
+async function login(baseUrl) {
+  const ep = await discover(baseUrl);
+  const { verifier, challenge } = pkce();
+  const state = crypto.randomBytes(16).toString("base64url");
+  const { port, code, close } = await awaitRedirect(state);
+  try {
+    const redirectUri = `http://localhost:${port}/callback`;
+    const clientId = await registerClient(ep.registration_endpoint, redirectUri);
+    const authUrl = new URL(ep.authorization_endpoint);
+    authUrl.search = new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      scope: "mcp",
+      state
+    }).toString();
+    console.log("Opening your browser to sign in\u2026");
+    console.log(`If it doesn't open, visit:
+  ${authUrl.toString()}
+`);
+    openBrowser(authUrl.toString());
+    const authCode = await code;
+    const res = await fetch(ep.token_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code: authCode,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: verifier
+      })
+    });
+    if (!res.ok) throw new Error(`token exchange failed: ${res.status} ${await res.text()}`);
+    const grant = await res.json();
+    const creds = {
+      clientId,
+      accessToken: grant.access_token,
+      refreshToken: grant.refresh_token,
+      expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
+    };
+    saveCreds(baseUrl, creds);
+    return creds;
+  } finally {
+    close();
+  }
+}
+async function refresh(baseUrl, creds) {
+  const ep = await discover(baseUrl);
+  const res = await fetch(ep.token_endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: creds.refreshToken,
+      client_id: creds.clientId
+    })
+  });
+  if (!res.ok) throw new Error(`refresh failed: ${res.status}`);
+  const grant = await res.json();
+  const updated = {
+    clientId: creds.clientId,
+    accessToken: grant.access_token,
+    refreshToken: grant.refresh_token,
+    expiresAt: Date.now() + (grant.expires_in ?? 86400) * 1e3
+  };
+  saveCreds(baseUrl, updated);
+  return updated;
+}
+async function getAccessToken(target, opts) {
+  if (opts.tokenFlag) return opts.tokenFlag;
+  if (target.tokenEnv && process.env[target.tokenEnv]) return process.env[target.tokenEnv];
+  let creds = loadCreds(target.url);
+  if (!creds) {
+    throw new Error(`Not authenticated for ${target.url}.
+Run:  malloyyo login ${target.name}`);
+  }
+  if (creds.expiresAt - Date.now() < 6e4) {
+    try {
+      creds = await refresh(target.url, creds);
+    } catch {
+      throw new Error(`Session expired for ${target.url}.
+Run:  malloyyo login ${target.name}`);
+    }
+  }
+  return creds.accessToken;
+}
+
+// src/mcp.ts
+import fs2 from "node:fs";
+import path3 from "node:path";
+import url3 from "node:url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  MalloyConfig as MalloyConfig2,
+  Runtime as Runtime2,
+  discoverConfig as discoverConfig2
+} from "@malloydata/malloy";
+
+// ../mcp-engine/dist/mcp-sdk.js
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var HOST_ONLY2 = "host_only";
+function toContent(result) {
+  const { malloy_text, [HOST_ONLY2]: _hostOnly, ...rest } = result;
+  const content = [
+    { type: "text", text: JSON.stringify(rest, null, 2) }
+  ];
+  if (typeof malloy_text === "string" && malloy_text.length > 0) {
+    content.push({ type: "text", text: malloy_text });
+  }
+  return { content, structuredContent: { ...rest } };
+}
+function lowLevel(server) {
+  return "server" in server ? server.server : server;
+}
+function attachSurface(server, surface, opts = {}) {
+  const s = lowLevel(server);
+  const byName = new Map(surface.tools.map((t) => [t.name, t]));
+  s.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: surface.tools.map((t) => ({
+      name: t.name,
+      title: t.title,
+      description: t.description,
+      inputSchema: t.inputSchema
+    }))
+  }));
   s.setRequestHandler(CallToolRequestSchema, async (req) => {
     const tool = byName.get(req.params.name);
     if (!tool) {
@@ -1760,18 +1993,78 @@ function attachSurface(server, surface, opts = {}) {
   }
 }
 
+// src/dashboard-guidance.ts
+var DASHBOARD_GUIDANCE = `
+
+# Authoring dashboards
+
+You can build a **dashboard** for this model: a small React view that renders one
+or more of the model's queries, with filter controls. Store it in the repo under
+\`./dashboards/<name>/\`. Preview it with \`malloyyo dashboard dev\`.
+
+## Before you write anything
+1. Call \`describe_source\` to see the model's **named queries** and its
+   **givens** (the declared filter inputs, e.g. STATE, DECADE, with their types).
+   A dashboard may ONLY run named queries the model exposes, driven by givens \u2014
+   never invent Malloy in the dashboard.
+2. If the query or givens you need don't exist yet, add them to the \`.malloy\`
+   model first (a top-level \`query:\` that references \`$GIVEN\` in its filters),
+   then re-check with \`describe_source\`.
+
+## Files to create
+\`./dashboards/<name>/manifest.json\`
+\`\`\`json
+{
+  "title": "Human title",
+  "query": "<a named query from the model>",
+  "givens": [
+    { "name": "STATE",  "label": "State",  "type": "string", "control": "select",
+      "options": ["CA","NY","TX"], "default": "CA" },
+    { "name": "DECADE", "label": "Decade", "type": "number", "control": "select",
+      "options": [1980,1990], "default": 1980 }
+  ]
+}
+\`\`\`
+Given \`name\`s must match the model's given names exactly; \`type\` must match.
+
+\`./dashboards/<name>/Dashboard.tsx\` \u2014 a default-exported React component. It
+receives everything as props from the host runtime; it must NOT import data
+libraries, fetch, or hold credentials:
+\`\`\`tsx
+export default function Dashboard({ manifest, givens, setGiven, Panel }) {
+  // givens   : current filter values, e.g. { STATE: "CA", DECADE: 1980 }
+  // setGiven : (name, value) => void  \u2014 change a filter, the Panel re-runs
+  // Panel    : <Panel givens={givens} /> runs manifest.query with those givens
+  //            and renders the result with Malloy's renderer
+  // Lay out the controls + Panel however you like \u2014 this is your React.
+}
+\`\`\`
+
+## Rules
+- Only React is available to the dashboard (plus the injected \`Panel\`). No other
+  imports, no network, no arbitrary Malloy \u2014 the runtime sandboxes it.
+- Interactivity is done by changing **givens** (which drive the query's filters),
+  not by rewriting queries.
+- The dashboard runs against the SAME model you're exploring, so what you preview
+  is what the model actually returns.
+
+## Preview
+From the model repo: \`malloyyo dashboard dev\` \u2192 open the printed URL. Editing
+\`Dashboard.tsx\` and reloading rebuilds it.
+`;
+
 // src/mcp.ts
-var ENTRY = "index.malloy";
+var ENTRY2 = "index.malloy";
 function defaultConfig(rootUrl) {
-  return new MalloyConfig({ includeDefaultConnections: true }, {
+  return new MalloyConfig2({ includeDefaultConnections: true }, {
     rootDirectory: rootUrl.toString()
   });
 }
-async function loadConfig(root, reader) {
-  const rootUrl = url2.pathToFileURL(root + path2.sep);
+async function loadConfig2(root, reader) {
+  const rootUrl = url3.pathToFileURL(root + path3.sep);
   let discovered;
   try {
-    discovered = await discoverConfig(rootUrl, rootUrl, reader);
+    discovered = await discoverConfig2(rootUrl, rootUrl, reader);
   } catch (e) {
     return {
       config: defaultConfig(rootUrl),
@@ -1784,19 +2077,19 @@ async function loadConfig(root, reader) {
   }
   return { config: defaultConfig(rootUrl), problems: [] };
 }
-function fsReader() {
+function fsReader2() {
   return {
     readURL: async (u) => {
       if (u.protocol !== "file:") {
         throw new Error(`unsupported URL scheme for import: ${u.href}`);
       }
-      return fs.promises.readFile(u, "utf8");
+      return fs2.promises.readFile(u, "utf8");
     }
   };
 }
 function resolveUnderRoot(root, p) {
-  const abs = p.includes("://") ? path2.resolve(decodeURIComponent(new URL(p).pathname)) : path2.resolve(root, p);
-  if (abs !== root && !abs.startsWith(root + path2.sep)) {
+  const abs = p.includes("://") ? path3.resolve(decodeURIComponent(new URL(p).pathname)) : path3.resolve(root, p);
+  if (abs !== root && !abs.startsWith(root + path3.sep)) {
     throw new Error(`path is outside the project root: ${p}`);
   }
   return abs;
@@ -1805,7 +2098,7 @@ function makeConfigSource(root) {
   let cached;
   const signature = () => ["malloy-config.json", "malloy-config-local.json"].map((name) => {
     try {
-      const st = fs.statSync(path2.join(root, name));
+      const st = fs2.statSync(path3.join(root, name));
       return `${name}:${st.mtimeMs}:${st.size}`;
     } catch {
       return `${name}:absent`;
@@ -1814,7 +2107,7 @@ function makeConfigSource(root) {
   return async () => {
     const sig = signature();
     if (cached?.sig !== sig) {
-      cached = { sig, loaded: await loadConfig(root, fsReader()) };
+      cached = { sig, loaded: await loadConfig2(root, fsReader2()) };
     }
     return cached.loaded;
   };
@@ -1825,10 +2118,10 @@ function makeWithRuntime(root, currentConfig) {
     return gateConfigProblems(problems, async () => {
       const resolved = "url" in input ? { url: resolveUnderRoot(root, input.url) } : {
         source: input.source,
-        baseUrl: input.baseUrl ? resolveUnderRoot(root, input.baseUrl) : root + path2.sep
+        baseUrl: input.baseUrl ? resolveUnderRoot(root, input.baseUrl) : root + path3.sep
       };
-      const { reader, entry, readSource } = prepareSource(fsReader(), resolved);
-      const runtime = new Runtime({ config, urlReader: reader });
+      const { reader, entry, readSource } = prepareSource(fsReader2(), resolved);
+      const runtime = new Runtime2({ config, urlReader: reader });
       try {
         return await fn({ runtime, entry, readSource });
       } finally {
@@ -1839,17 +2132,17 @@ function makeWithRuntime(root, currentConfig) {
 }
 function makeExploreHost(root, currentConfig) {
   const withRuntime = makeWithRuntime(root, currentConfig);
-  const published = (ref) => ref === ENTRY && fs.existsSync(path2.join(root, ENTRY));
+  const published = (ref) => ref === ENTRY2 && fs2.existsSync(path3.join(root, ENTRY2));
   return {
     withModel: (ref, fn) => {
       if (!published(ref)) throw new Error(`no published model '${ref}'`);
-      return withRuntime({ url: ENTRY }, fn);
+      return withRuntime({ url: ENTRY2 }, fn);
     },
     list: async () => {
-      if (!published(ENTRY)) return { entries: [] };
-      const entry = await withRuntime({ url: ENTRY }, async (m) => {
+      if (!published(ENTRY2)) return { entries: [] };
+      const entry = await withRuntime({ url: ENTRY2 }, async (m) => {
         const compiled = await compile(m.runtime, m.entry, { exportedOnly: true });
-        return compiled.ok && compiled.model ? modelCatalogEntry(ENTRY, compiled.model) : { model_ref: ENTRY };
+        return compiled.ok && compiled.model ? modelCatalogEntry(ENTRY2, compiled.model) : { model_ref: ENTRY2 };
       });
       return { entries: [entry] };
     }
@@ -1857,14 +2150,14 @@ function makeExploreHost(root, currentConfig) {
 }
 async function serveMcp(opts) {
   await import("@malloydata/malloy-connections");
-  const root = path2.resolve(opts.root ?? process.cwd());
+  const root = path3.resolve(opts.root ?? process.cwd());
   const currentConfig = makeConfigSource(root);
   const surface = exploreSurface(makeExploreHost(root, currentConfig));
   const instanceName = process.env.INSTANCE_NAME || "Malloyyo";
   const server = new McpServer(
     { name: "malloyyo-explore", version: opts.version },
     {
-      instructions: renderInstructions(surface.instructions, instanceName),
+      instructions: renderInstructions(surface.instructions, instanceName) + DASHBOARD_GUIDANCE,
       capabilities: { tools: {}, prompts: {}, resources: {} }
     }
   );
@@ -1877,23 +2170,230 @@ async function serveMcp(opts) {
   });
 }
 
+// src/dashboard.ts
+import http2 from "node:http";
+import fs3 from "node:fs";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import * as esbuild2 from "esbuild";
+var require2 = createRequire(import.meta.url);
+var HOST_LIBS = [
+  "react",
+  "react-dom",
+  "react-dom/client",
+  "react/jsx-runtime",
+  "react/jsx-dev-runtime",
+  "@malloydata/render"
+];
+var HOST_ALIAS = {};
+for (const spec of HOST_LIBS) {
+  try {
+    HOST_ALIAS[spec] = require2.resolve(spec);
+  } catch {
+  }
+}
+function resolveFrameEntry() {
+  const candidates = [
+    new URL("./frame-entry.tsx", import.meta.url),
+    // dev: src/dashboard.ts
+    new URL("../src/frame-entry.tsx", import.meta.url)
+    // built: dist/index.js
+  ].map((u) => fileURLToPath(u));
+  const found = candidates.find((c) => fs3.existsSync(c));
+  if (!found) {
+    throw new Error(
+      "frame-entry.tsx not found \u2014 `dashboard dev` currently needs the CLI source checkout (looked in ./ and ../src). See docs/repo-artifacts.md packaging note."
+    );
+  }
+  return found;
+}
+function discoverDashboards(root) {
+  const base = path4.join(root, "dashboards");
+  if (!fs3.existsSync(base)) return [];
+  const out = [];
+  for (const name of fs3.readdirSync(base)) {
+    const dir = path4.join(base, name);
+    const mf = path4.join(dir, "manifest.json");
+    if (!fs3.statSync(dir).isDirectory() || !fs3.existsSync(mf)) continue;
+    try {
+      out.push({ name, dir, manifest: JSON.parse(fs3.readFileSync(mf, "utf8")) });
+    } catch (e) {
+      console.error(`  ! skipping ${name}: bad manifest.json (${e.message})`);
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function makeBundler() {
+  const cache = /* @__PURE__ */ new Map();
+  const frameEntry = resolveFrameEntry();
+  return async function bundle(dash) {
+    const dashboardFile = path4.join(dash.dir, "Dashboard.tsx");
+    const mtimeMs = fs3.statSync(dashboardFile).mtimeMs + fs3.statSync(frameEntry).mtimeMs;
+    const hit = cache.get(dash.name);
+    if (hit && hit.mtimeMs === mtimeMs) return hit.js;
+    const result = await esbuild2.build({
+      entryPoints: [frameEntry],
+      bundle: true,
+      format: "iife",
+      platform: "browser",
+      jsx: "automatic",
+      write: false,
+      logLevel: "silent",
+      loader: { ".css": "empty" },
+      define: { "process.env.NODE_ENV": '"production"' },
+      plugins: [
+        {
+          name: "virtual-dashboard",
+          setup(b) {
+            b.onResolve({ filter: /^virtual:dashboard$/ }, () => ({ path: dashboardFile }));
+            b.onResolve(
+              { filter: /^(react($|\/)|react-dom($|\/)|@malloydata\/render$)/ },
+              (args) => HOST_ALIAS[args.path] ? { path: HOST_ALIAS[args.path] } : void 0
+            );
+          }
+        }
+      ]
+    });
+    const js = result.outputFiles[0].text;
+    cache.set(dash.name, { mtimeMs, js });
+    return js;
+  };
+}
+var html = (body, title) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><meta name="viewport" content="width=device-width,initial-scale=1"></head><body style="margin:0">${body}</body></html>`;
+function parentShell(dash, frameBase, all) {
+  const d = JSON.stringify(dash.name);
+  const fb = JSON.stringify(frameBase);
+  const nav = all.length > 1 ? `<nav style="display:flex;gap:4px;align-items:center;padding:8px 12px;background:#f6f7f9;border-bottom:1px solid #e2e4e8;font:13px system-ui,sans-serif"><span style="color:#888;margin-right:8px">Dashboards</span>` + all.map((x) => {
+    const on = x.name === dash.name;
+    return `<a href="/?d=${encodeURIComponent(x.name)}" style="padding:4px 10px;border-radius:6px;text-decoration:none;${on ? "background:#1a1a1a;color:#fff" : "color:#333"}">${esc(x.manifest.title || x.name)}</a>`;
+  }).join("") + `</nav>` : "";
+  return html(
+    `<div style="display:flex;flex-direction:column;height:100vh">` + nav + `<iframe id="f" sandbox="allow-scripts allow-same-origin" src="${frameBase}/frame?d=${encodeURIComponent(dash.name)}" style="border:0;flex:1;width:100%"></iframe></div><script>
+const f=document.getElementById('f');
+window.addEventListener('message',async(e)=>{
+  if(e.source!==f.contentWindow||e.origin!==${fb})return;
+  const m=e.data; if(!m||m.type!=='run')return;
+  let out;
+  try{
+    const res=await fetch('/api/run',{method:'POST',headers:{'content-type':'application/json'},
+      body:JSON.stringify({d:${d},query:m.query,givens:m.givens})});
+    out=await res.json();
+  }catch(err){ out={ok:false,problems:[{message:String(err)}]}; }
+  f.contentWindow.postMessage({type:'result',id:m.id,...out},${fb});
+});
+</script>`,
+    dash.manifest.title
+  );
+}
+function frameDoc(dash) {
+  return html(
+    `<div id="root"></div><script>window.__MANIFEST__=${JSON.stringify(dash.manifest)}</script><script src="/bundle.js?d=${encodeURIComponent(dash.name)}"></script>`,
+    dash.manifest.title
+  );
+}
+async function readBody(req) {
+  const chunks = [];
+  for await (const c of req) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function serveDashboard(opts) {
+  await import("@malloydata/malloy-connections");
+  const root = path4.resolve(opts.root ?? process.cwd());
+  const port = opts.port ?? 4173;
+  const framePort = port + 1;
+  const frameBase = `http://localhost:${framePort}`;
+  const dashboards = discoverDashboards(root);
+  if (dashboards.length === 0) {
+    throw new Error(`No dashboards found under ${path4.join(root, "dashboards")}/`);
+  }
+  const byName = new Map(dashboards.map((d) => [d.name, d]));
+  const runner = await makeRunner(root);
+  if (!runner.entryExists()) {
+    throw new Error(`No index.malloy at ${root} \u2014 run this from a Malloy model repo.`);
+  }
+  const bundle = makeBundler();
+  const pick = (url4) => byName.get(url4.searchParams.get("d") ?? dashboards[0].name) ?? dashboards[0];
+  const handler = async (req, res) => {
+    const onFramePort = (req.socket.localPort ?? port) === framePort;
+    const url4 = new URL(req.url ?? "/", `http://localhost:${onFramePort ? framePort : port}`);
+    const send = (code, type, body, extra = {}) => {
+      res.writeHead(code, { "content-type": type, ...extra });
+      res.end(body);
+    };
+    try {
+      if (onFramePort) {
+        if (url4.pathname === "/frame") {
+          return send(200, "text/html; charset=utf-8", frameDoc(pick(url4)));
+        }
+        if (url4.pathname === "/bundle.js") {
+          return send(200, "application/javascript; charset=utf-8", await bundle(pick(url4)));
+        }
+        return send(404, "text/plain", "not found");
+      }
+      if (url4.pathname === "/") {
+        return send(200, "text/html; charset=utf-8", parentShell(pick(url4), frameBase, dashboards));
+      }
+      if (url4.pathname === "/api/run" && req.method === "POST") {
+        const { d, query, givens } = JSON.parse(await readBody(req));
+        const dash = byName.get(d);
+        if (!dash) return send(404, "application/json", JSON.stringify({ ok: false, problems: [{ message: `no dashboard '${d}'` }] }));
+        if (query !== dash.manifest.query) {
+          return send(403, "application/json", JSON.stringify({ ok: false, problems: [{ message: `query '${query}' is not declared by ${d}` }] }));
+        }
+        const out = await runner.run(query, givens ?? {});
+        return send(200, "application/json", JSON.stringify(out));
+      }
+      send(404, "text/plain", "not found");
+    } catch (e) {
+      send(500, "application/json", JSON.stringify({ ok: false, problems: [{ message: e.message }] }));
+    }
+  };
+  const shellServer = http2.createServer(handler);
+  const frameServer = http2.createServer(handler);
+  await new Promise((r) => shellServer.listen(port, r));
+  await new Promise((r) => frameServer.listen(framePort, r));
+  console.error(`
+  malloyyo dashboard dev \u2014 model: ${root}`);
+  console.error(`  http://localhost:${port}/   (artifact origin: ${frameBase})`);
+  for (const d of dashboards) {
+    console.error(`    \u2022 ${d.name}  \u2192  http://localhost:${port}/?d=${d.name}`);
+  }
+  console.error(`  Ctrl-C to stop.
+`);
+  await new Promise(() => {
+  });
+}
+
 // package.json
-var version = "0.2.8";
+var version = "0.2.9";
 
 // src/index.ts
 function shortSha(sha) {
   return sha ? sha.slice(0, 7) : "";
 }
 async function publish(target, dir, opts) {
-  const root = resolve(dir);
+  const root = resolve2(dir);
   const t = resolveTarget(root, target);
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const { files, config } = gatherDirectory(root);
   if (files.length === 0) {
     throw new Error(`No .malloy files found under ${root}`);
   }
+  if (!opts.skipLint) {
+    const report = await lintDashboards(root);
+    if (report.dashboards.length > 0) {
+      console.log("dashboards:");
+      printLintReport(report);
+    }
+    if (!report.ok) {
+      throw new Error("dashboard lint failed \u2014 fix the above, or pass --skip-lint");
+    }
+  }
   const git = gitInfo(root);
-  const body = { files, config, git };
+  const dashboards = gatherDashboards(root);
+  const body = { files, config, git, dashboards };
   const provenance = git.sha ? `${git.branch}@${shortSha(git.sha)}${git.dirty ? " (dirty)" : ""}` : "(no git)";
   console.log(`\u2192 ${t.url}  dataset=${t.dataset}`);
   console.log(`  ${files.length} file(s)  ${provenance}`);
@@ -1910,10 +2410,12 @@ async function publish(target, dir, opts) {
   if (!res.ok || !out.ok) {
     throw new Error(`publish failed: ${out.error ?? `${res.status} ${res.statusText}`}`);
   }
-  console.log(`\u2713 published version ${out.version} \u2014 ${out.sources?.length ?? 0} source(s)`);
+  console.log(
+    `\u2713 published version ${out.version} \u2014 ${out.sources?.length ?? 0} source(s)` + (dashboards.length ? `, ${dashboards.length} dashboard(s)` : "")
+  );
 }
 async function status(target, opts) {
-  const t = resolveTarget(resolve("."), target);
+  const t = resolveTarget(resolve2("."), target);
   const bearer = await getAccessToken(t, { tokenFlag: opts.token });
   const res = await fetch(`${t.url}/api/datasets/${t.dataset}/model/status`, {
     headers: { authorization: `Bearer ${bearer}` }
@@ -1928,25 +2430,38 @@ async function status(target, opts) {
   console.log(`  ${s.compileError ? `\u2717 ${s.compileError}` : `\u2713 compiled ${s.compiledAt ?? ""}`}`);
 }
 async function loginCmd(target) {
-  const inst = resolveInstance(resolve("."), target);
+  const inst = resolveInstance(resolve2("."), target);
   await login(inst.url);
   console.log(`\u2713 logged in to ${inst.name} (${inst.url})`);
 }
 async function logoutCmd(target) {
-  const inst = resolveInstance(resolve("."), target);
+  const inst = resolveInstance(resolve2("."), target);
   console.log(clearCreds(inst.url) ? `\u2713 logged out of ${inst.url}` : `not logged in to ${inst.url}`);
 }
 var program = new Command();
 program.name("malloyyo").description("Publish Malloy models to a Malloyyo instance").version(version);
 program.command("login").argument("[target]", "target name or instance URL (optional if the config has one target)").description("sign in to an instance in your browser (stores a token)").action(loginCmd);
 program.command("logout").argument("[target]", "target name or instance URL (optional if the config has one target)").description("forget the stored token for an instance").action(logoutCmd);
-program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
+program.command("publish").argument("<target>", "named target from the `malloyyo` config block").argument("[dir]", "directory to publish", ".").option("--token <token>", "bearer token (overrides login/env)").option("--dry-run", "gather and report what would be sent, but don't POST").option("--skip-lint", "skip the pre-publish dashboard lint").description('push the Malloy model in <dir> (default ".") to <target>').action(publish);
+program.command("lint").argument("[dir]", "directory to lint", ".").description("validate ./dashboards against the model (manifest, query, givens, Dashboard.tsx)").action(async (dir) => {
+  const report = await lintDashboards(resolve2(dir));
+  if (report.dashboards.length === 0) {
+    console.log("no dashboards to lint");
+    return;
+  }
+  printLintReport(report);
+  if (!report.ok) process.exit(1);
+});
 program.command("status").argument("<target>", "named target from the `malloyyo` config block").option("--token <token>", "bearer token (overrides login/env)").description("show what's live on <target>: version, commit, compile state").action(status);
 program.command("mcp").option("-C, --root <dir>", "project root (default: current directory)").description(
   "run a local stdio MCP server (the explore / test-window surface) over the Malloy model in the current directory"
 ).action(async (opts) => {
   await serveMcp({ root: opts.root, version });
 });
+program.command("dashboard").argument("<action>", "action to run (currently: dev)").option("-C, --root <dir>", "project root (default: current directory)").option("-p, --port <port>", "port to serve on", "4173").description("preview dashboard artifacts in ./dashboards against the local Malloy model").action(async (action, opts) => {
+  if (action !== "dev") throw new Error(`unknown dashboard action '${action}' (expected: dev)`);
+  await serveDashboard({ root: opts.root, port: Number(opts.port) });
+});
 program.parseAsync().catch((err) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@malloydata/malloyyo",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Publish Malloy models to a Malloyyo instance",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,7 @@
   },
   "scripts": {
     "prebuild": "npm --prefix ../mcp-engine run build",
-    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:@malloydata/* --external:@modelcontextprotocol/* --outfile=dist/index.js",
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:esbuild --external:@malloydata/* --external:@modelcontextprotocol/* --outfile=dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
     "pretest": "npm run build",