fix(server): make index.malloy the one list of what dashboards, notebooks and the model GET can read

[jswir]

A package's root index.malloy is now the one list of what anyone can read, through every route. An agent querying index.malloy, a dashboard tile, a notebook cell and the model GET all see the same sources. Builds are unaffected.

What stops working (read first)

These remove access that works on 0.8.0. All of them are inert with no surface and under queryableSources: "all".

• GET .../models/{path} answers 404 for a file off the surface, with the query route's message. Files it does return carry only the names they publish: modelDef (contents, exports, sourceRegistry, queryList; references is dropped, and a published source no longer carries the extends / sourceID / referenceID of a hidden one), modelInfo, sources and sourceInfos. A join to a hidden source keeps its name and its fields' names and types, which is what querying through it needs, but not the hidden source's table, SQL or connection. sourceText is left out when the text names a source the file does not publish, backticked and non-ASCII names included. A dashboard's text is always returned, because the editor saves with it.
• Notebook cells are held to the surface. A cell over a hidden source answers 404, and 404 rather than 403 when the source is also gated. The notebook GET and cell response list only sources the notebook may read, and the notebook GET leaves out queryInfo for a cell that would be refused. A source an earlier cell derives from a published one still works. A cell's own source over a raw table has nothing published under it, so on a curated package it answers 404.
• A dashboard file admits nothing of its own. Its export {} and its own named queries no longer make a hidden source queryable, even when explores lists the file. A tile that relied on that answers 404 and is named in the load warnings.
• Dashboards that explores left out on purpose are now listed. To hide one, remove its # artifact tag, and take it out of explores if that lists it: an untagged file explores lists is published like any other file, as on main.
• Every dashboard file is now a query path for any caller, not only for its tiles. run: secret there answers 404, but a query over a published source can still join a hidden source the dashboard imports: run: orders extend { join_one: s is secret on id = s.id } -> { group_by: s.x } returns rows. That is how index.malloy already behaves, since the check is on the source a query runs. Only tiles are checked at load. Gate such sources with #(authorize).

What changes

• Every dashboard is listed, whatever the surface. Tiles, a single-query dashboard's query, and filter suggest read only the surface. A source the dashboard declares on top of a published one can be read (source: big is orders extend {...}); one over a hidden source cannot. The load warns once per tile, query or filter that will fail:

  Tile orders_staging -> by_flag on dashboard overview reads orders_staging, which index.malloy doesn't export, so it won't load. Fix: add orders_staging to the export { ... } in index.malloy.
  

  The lint runs the same two checks as the query route, and re-runs after a metadata PATCH. In a package that gates anything with #(authorize), the warning says "a source" rather than naming it, as the query's own 404 does. An error other than a failed compile makes the lint report itself incomplete instead of passing the tile.
• Warnings are two sentences: what is wrong in this package, then Fix: and the one edit. A root index.malloy with no keys gets none. Every non-empty explores is deprecated, and the fix names the files index.malloy must import. explores: [] is deprecated: to publish everything, rename index.malloy. Index.malloy in any other case is reported as ignored. The held-back and withheld-drill warnings are gone.
• queryableSources stays as feat(server): a package's index.malloy is its published surface #1206 left it: marked deprecated in the spec, "declared" warns, and "all" loads with no warning. Nothing replaces "all" for hiding an #(authorize)-gated source from listings while authorized callers still query it.
• The dashboard editor builds its field catalog from the published models, limited to what the dashboard's imports can see. The files it imports are now 404 when they are off the surface. One model that fails to load drops only its own sources from the catalog.
• Skills, docs, api-doc.yaml, the scaffolder briefing and RELEASE_NOTES.md (an [Unreleased] (BREAKING) section) teach the one rule.

Unchanged on purpose

• Materialization and pre-aggregation builds walk every model, so a hidden #@ persist intermediate is still built and an exported source reads its table.
• /compile and compile_model stay exempt.
• The check is on the source a query runs (see the dashboard bullet above). Curation is discovery; #(authorize) is the lock.

How it was checked

• 19 small test packages, one per surface shape (no surface, root index.malloy, explores in each form, dashboards, a notebook, a case-variant file name, an index that exports nothing, a dashboard with tiles over hidden and derived sources, and a hidden persist intermediate) on a local build of this branch: 54 of 54 checks pass. Covered: listings, query status per route, model GET contents, exact warning text, notebook cells, and a materialization build.

• MCP: get_context on an explores-listed dashboard package offers only index.malloy::orders, and execute_query refuses a hidden source through a dashboard path.

• SDK: 1059 pass. Server unit: 4266 pass. The 35 failures are in config.spec and config.theme.spec, and they fail on unmodified main too (bun 1.4). Dashboards and index-convention integration: 67 pass. The full integration run passed except concurrent_package, which times out downloading from GCS without credentials here.

• A real-server run found three modelDef keys still naming a hidden source that the unit test missed, because it searched for a quoted name inside JSON-encoded text. Review then found two more: sourceText of a file that runs a hidden source, and extends / join identities inside a published source. All are fixed, and the test fails without the fix.

• The dashboard join path was confirmed against the real compiler: run: secret on a dashboard path is refused, the join form returns rows, identically on index.malloy.

• Review follow-ups (the last five commits) were checked on a local build: all 19 test packages again, plus a demo package with dashboards, a notebook, named queries and a gated source, clicked through in the Console. Named queries are covered by a new test: an exported one is listed and runs, even through a join to a hidden source; an unexported one and one in a hidden file are neither listed nor runnable. Each new assertion fails on the commit before it. Server unit: 4268 pass (the same 35 config failures). Integration: 359 of 360 (concurrent_package, as above). SDK, skills, scaffolder, hammer, scripts, examples and the Python skill tests all pass.

Known issues, not fixed here

• A dashboard tile over a named query that reads a hidden, #(authorize)-gated source answers 403 naming the source, not the surface's 404. The dashboard's named query defers the surface check to after compile, and the early authorize check refuses first (model.ts, the assertAuthorized(earlySource, …) fast path). A direct run: <source> -> … on the same path correctly answers 404. Reachable only through this PR's dashboard path; to be fixed in a follow-up.
• A bad filter value reads Filter expression parse error: [object Object]. The Malloy compiler builds the message from the parse log entry rather than its message. Publisher forwards given values unchecked, and the SDK draws a free-text box for filter<boolean>. Present on main; separate fixes upstream and in Publisher.
• The notebook refusal tells a saved cell to "address the query to index.malloy", and names no source. A filter's tag text can still name a hidden source in the model GET, when a published source uses that filter.

Not done

• The dashboard editor was not opened in a browser; its catalog change is covered by unit and spec tests only.
• Left for later: returning the surface as data on the package response, a warning for "all", and refusing a surface that exports nothing (such a package still publishes, with a warning).

🤖 Generated with Claude Code

[Sha-Bang]

Approving. Three should-fix items inline, none blocking.

• packages/server/src/service/model.ts:6800: showsFileText misses hidden names that are backticked with a hyphen or are non-ASCII
• packages/server/src/service/model.ts:6866: the notebook GET still returns each cell's queryInfo schema unfiltered
• packages/server/src/service/package.ts:548: an untagged dashboards/*.malloy listed in explores is still an entry point for its own exports