chore(deps): upgrade @malloydata/* to 0.0.436

RELEASE_NOTES.md

@@ -21,6 +21,16 @@ Give the heading a title — `## [Unreleased] — what changed`, with an em dash
 
 Two consequences worth knowing. A section merged to `main` ships in the **next** release, whenever that is, so do not write one for work that has not landed. And a heading already stamped with a version is history: a follow-up that changes that behaviour opens a **new** `[Unreleased]` section referencing the shipped version by number, rather than editing the old one.
 
+## [Unreleased] — Malloy 0.0.436: time-zone reads, refinements that keep their ordering, and booleans on SQL Server
+
+Publisher now builds on `@malloydata/*` 0.0.436, up from 0.0.435. The changes that reach a running server:
+
+- **A query that sets a time zone reads dates and times in that zone throughout** ([malloydata/malloy#3145](https://github.com/malloydata/malloy/pull/3145)). Extraction, truncation, calendar offsets and casts to a date convert the instant to the query zone's clock first, on every dialect. Three results can change: a cast between `timestamp` and `timestamptz` keeps the instant instead of consulting the zone; truncating to the hour in a zone with a half-hour offset reads that zone's clock; and a filter on a date column, in a zone east of UTC, reads its day boundaries in that zone.
+- **A refinement keeps the view's written `order_by`** ([malloydata/malloy#3136](https://github.com/malloydata/malloy/pull/3136)). A refinement that set only a `limit` dropped the view's ordering, and a view refined by name lost its ordering to the next inline refinement. Both now keep it, so rows from such a query can come back in a different order.
+- **On SQL Server, a boolean is a condition and never a value** ([malloydata/malloy#3147](https://github.com/malloydata/malloy/pull/3147)). A boolean used where SQL Server needs a value (a result column, a `group_by`, a function argument, a cast, `=` or `!=` against another boolean) is a compile error at that expression, naming what to write instead, such as `pick 'yes' when is_small else 'no'`. `select: *` leaves a boolean field out with a warning. A filter that compiles to a constant, such as `in` over an empty given, now runs on SQL Server.
+- **A SQL Server `datetimeoffset` column is a `timestamptz`** ([malloydata/malloy#3138](https://github.com/malloydata/malloy/pull/3138)), read at UTC or in the query's time zone rather than at the offset it was written with.
+- **Importing a persisted source without the given its SQL reads is a compile error** ([malloydata/malloy#3173](https://github.com/malloydata/malloy/pull/3173)). When a model imports a `#@ persist` source whose SQL reads a given with no default, and the model does not surface that given, it fails to compile with `unsatisfied-given-in-persist-source`. Import the given alongside the source. Publisher refuses to build a persisted source whose SQL reads a given, so no built table is affected.
+
 ## [Unreleased] — A `where:` across a join to a query source or composite is served when untouched and refused when rebound
 
 A package source whose `where:` read a field joined from a query source (for example `source: pipeline_now is deals extend { where: is_open }` where `is_open` is `deal_first_close.close_type is null` and `deal_first_close` is `duckdb.sql(...) -> { ... }`) was refused with `403 Access denied for source "pipeline_now"`, even when nothing had been modified. Malloy names a query source afresh on every compile, so the row-security binding check could not match the served source against the package's own compile of the same file. It now compares a query source by what it queries, so the same shapes serve whether the query source is joined directly, built on another query source, declared with `extend: { join_one: ... }` inside its own query, built on a parameterized source, or a composite member, and whether the `where:` was inherited across files or not.

examples/storefront/public/vendor/malloy-filter.js

@@ -1,6 +1,6 @@
 // Generated file. Do not edit.
 //
-// @malloydata/malloy-filter@0.0.435 (MIT), bundled as a browser ES
+// @malloydata/malloy-filter@0.0.436 (MIT), bundled as a browser ES
 // module by scripts/vendor-malloy-filter.mjs. Regenerate with:
 //
 //   bun run vendor:malloy-filter

package.json

@@ -78,7 +78,7 @@
     "@types/react-dom": "^19.1.6",
     "@types/ssh2": "^1.15.5",
     "eslint": "^8.50.0",
-    "@malloydata/malloy-filter": "^0.0.435",
+    "@malloydata/malloy-filter": "^0.0.436",
     "esbuild": "0.25.9",
     "happy-dom": "^20.11.1",
     "prettier": "^3.0.0",
@@ -96,11 +96,11 @@
   "resolutions": {
     "pg": "8.7.3",
     "esbuild": "0.25.9",
-    "@malloydata/malloy-interfaces": "^0.0.435",
+    "@malloydata/malloy-interfaces": "^0.0.436",
     "@malloydata/malloy-explorer": "0.0.338-dev260215172810",
-    "@malloydata/malloy-query-builder": "^0.0.435",
-    "@malloydata/malloy-filter": "^0.0.435",
-    "@malloydata/malloy-tag": "^0.0.435",
+    "@malloydata/malloy-query-builder": "^0.0.436",
+    "@malloydata/malloy-filter": "^0.0.436",
+    "@malloydata/malloy-tag": "^0.0.436",
     "basic-ftp": "^5.3.1",
     "protobufjs": "^7.5.5",
     "concurrently": "^10.0.6",
@@ -113,6 +113,6 @@
     "seroval-plugins": "^1.6.3"
   },
   "patchedDependencies": {
-    "@malloydata/render@0.0.435": "patches/@malloydata%2Frender@0.0.435.patch"
+    "@malloydata/render@0.0.436": "patches/@malloydata%2Frender@0.0.436.patch"
   }
 }

packages/create-malloy-package/package.json

@@ -50,7 +50,7 @@
    },
    "devDependencies": {
       "@eslint/js": "^8.57.0",
-      "@malloydata/malloy": "^0.0.435",
+      "@malloydata/malloy": "^0.0.436",
       "@modelcontextprotocol/sdk": "^1.31.0",
       "@types/bun": "^1.2.21",
       "@types/node": "^24.10.0",

packages/sdk/package.json

@@ -82,13 +82,13 @@
       "generate-api-types": "bunx openapi-generator-cli generate -i ../../api-doc.yaml -g typescript-axios -o src/client/"
    },
    "peerDependencies": {
-      "@malloydata/malloy": "^0.0.435",
+      "@malloydata/malloy": "^0.0.436",
       "@malloydata/malloy-explorer": "0.0.338-dev260215172810",
-      "@malloydata/malloy-filter": "^0.0.435",
-      "@malloydata/malloy-interfaces": "^0.0.435",
-      "@malloydata/malloy-query-builder": "^0.0.435",
-      "@malloydata/malloy-tag": "^0.0.435",
-      "@malloydata/render": "^0.0.435",
+      "@malloydata/malloy-filter": "^0.0.436",
+      "@malloydata/malloy-interfaces": "^0.0.436",
+      "@malloydata/malloy-query-builder": "^0.0.436",
+      "@malloydata/malloy-tag": "^0.0.436",
+      "@malloydata/render": "^0.0.436",
       "@mui/icons-material": ">=7.1.1",
       "@mui/material": ">=7.1.1",
       "@mui/system": ">=7.1.1",
@@ -113,11 +113,11 @@
    },
    "devDependencies": {
       "@happy-dom/global-registrator": "^20.11.1",
-      "@malloydata/malloy": "^0.0.435",
+      "@malloydata/malloy": "^0.0.436",
       "@malloydata/malloy-explorer": "0.0.338-dev260215172810",
-      "@malloydata/malloy-filter": "^0.0.435",
-      "@malloydata/malloy-query-builder": "^0.0.435",
-      "@malloydata/malloy-tag": "^0.0.435",
+      "@malloydata/malloy-filter": "^0.0.436",
+      "@malloydata/malloy-query-builder": "^0.0.436",
+      "@malloydata/malloy-tag": "^0.0.436",
       "@openapitools/openapi-generator-cli": "^2.40.1",
       "@shikijs/langs": "^1.16.3",
       "@shikijs/themes": "^1.16.3",

packages/server/package.json

@@ -65,20 +65,20 @@
       "@duckdb/node-api": "1.5.5-r.4",
       "@google-cloud/bigquery": "^7.9.4",
       "@google-cloud/storage": "^7.22.0",
-      "@malloydata/db-bigquery": "^0.0.435",
-      "@malloydata/db-databricks": "^0.0.435",
-      "@malloydata/db-duckdb": "^0.0.435",
-      "@malloydata/db-mysql": "^0.0.435",
-      "@malloydata/db-postgres": "^0.0.435",
-      "@malloydata/db-publisher": "^0.0.435",
-      "@malloydata/db-snowflake": "^0.0.435",
-      "@malloydata/db-sqlserver": "^0.0.435",
-      "@malloydata/db-trino": "^0.0.435",
-      "@malloydata/malloy": "^0.0.435",
-      "@malloydata/malloy-filter": "^0.0.435",
-      "@malloydata/malloy-sql": "^0.0.435",
-      "@malloydata/malloy-tag": "^0.0.435",
-      "@malloydata/render-validator": "^0.0.435",
+      "@malloydata/db-bigquery": "^0.0.436",
+      "@malloydata/db-databricks": "^0.0.436",
+      "@malloydata/db-duckdb": "^0.0.436",
+      "@malloydata/db-mysql": "^0.0.436",
+      "@malloydata/db-postgres": "^0.0.436",
+      "@malloydata/db-publisher": "^0.0.436",
+      "@malloydata/db-snowflake": "^0.0.436",
+      "@malloydata/db-sqlserver": "^0.0.436",
+      "@malloydata/db-trino": "^0.0.436",
+      "@malloydata/malloy": "^0.0.436",
+      "@malloydata/malloy-filter": "^0.0.436",
+      "@malloydata/malloy-sql": "^0.0.436",
+      "@malloydata/malloy-tag": "^0.0.436",
+      "@malloydata/render-validator": "^0.0.436",
       "@modelcontextprotocol/sdk": "^1.31.0",
       "@opentelemetry/api": "^1.9.0",
       "@opentelemetry/auto-instrumentations-node": "^0.80.0",