malloy-model

Create one base source file per table defining primary keys, dimensions, and measures, then create joined source files per analytical domain that import the base sources and declare join_one or join_many relationships. Verify join cardinality with a group_by query before writing joins.

Every dimension needs the form `name is expression`; a bare column name like `dimension: species` fails with a missing IS error. Raw columns are already queryable in group_by and select, so only declare a dimension when deriving or renaming a field.

Use join_one for many-to-one relationships when the target key is unique, and join_many for one-to-many relationships, which is always safe. Verify uniqueness first by grouping on the foreign key and checking for counts greater than one.

The `given:` syntax is Malloy's native runtime parameter mechanism and is preferred for new models, while `#(filter)` is the older Publisher-specific annotation that injects where clauses server-side. Keep `#(filter)` for required scoping filters and implicit system-injected filters that givens cannot cover.

Use the `#(authorize)` annotation with an expression over declared givens; Publisher evaluates it before running the query and returns 403 if no expression is true. Note that givens are caller-asserted, so authorization is only a real boundary behind a trusted tier that sets them.