DEV-1608: Cube → SLayer ingestion (Stage 1)

.claude/skills/slayer-models.md

@@ -88,7 +88,7 @@ Saved query-backed models support two access patterns:
 
 Variable precedence (highest first): runtime kwarg > stage `.variables` > outer query `.variables` > `model.query_variables`.
 
-**Variables in model SQL (DEV-1625)**: the same `{var}` mechanism also substitutes into a model's **raw-SQL (Mode A) surfaces** — `SlayerModel.sql`, `SlayerModel.filters`, `Column.sql`, `Column.filter` — for a query's **direct source model** (the primitive for parameterizing hand-written SQL, e.g. Cube `FILTER_PARAMS`). Same precedence and `{{`/`}}` escaping. Contract: **raise-on-missing once any variable is in play** (a `query_variables` default or a caller value); a **fully variable-free execution leaves braces as literals** so raw brace literals like `'{1,2,3}'` survive untouched. String values are Mode-A-escaped (write the quotes yourself: `WHERE region = '{region}'`; trusted input — not dialect-aware, so avoid untrusted values on backslash-escaping backends like MySQL); `inspect_model` shows the literal `{var}` template. Nested `source_queries` stages, query-backed direct sources, join targets, and cross-model targets are deferred (DEV-1678) — a `{var}` there stays literal and errors on the stray placeholder.
+**Variables in model SQL (DEV-1625)**: the same `{var}` mechanism also substitutes into a model's **raw-SQL (Mode A) surfaces** — `SlayerModel.sql`, `SlayerModel.filters`, `Column.sql`, `Column.filter` — for a query's **direct source model** (the primitive for parameterizing hand-written SQL, e.g. Cube `FILTER_PARAMS`). Same precedence and `{{`/`}}` escaping. Contract: **raise-on-missing once any variable is in play** (a `query_variables` default or a caller value); a **fully variable-free execution leaves braces as literals** so raw brace literals like `'{1,2,3}'` survive untouched. String values are Mode-A-escaped (write the quotes yourself: `WHERE region = '{region}'`; trusted input — not dialect-aware, so avoid untrusted values on backslash-escaping backends like MySQL); a **list** value renders an injection-safe `IN`-list body (`region IN ({regions})` with `{"regions": ["US","CA"]}` → `region IN ('US', 'CA')`; write the parens, elements auto-quoted; empty list raises); `inspect_model` shows the literal `{var}` template. Nested `source_queries` stages, query-backed direct sources, join targets, and cross-model targets are deferred (DEV-1678) — a `{var}` there stays literal and errors on the stray placeholder.
 
 You **cannot** supply `columns` or `backing_query_sql` when saving a query-backed model — they're engine-managed cache; the save path rejects them. Caches refresh **only on save paths**: `engine.save_model()` and `create_model_from_query(save=True)`. `engine.execute()` never writes to storage — even on stale or empty caches.
 

.claude/skills/slayer-query.md

@@ -76,7 +76,7 @@ Result column naming: `revenue:sum` → `orders.revenue_sum` (colon becomes unde
 
 **Top-N filtering**: use `"rank(<measure>) <= N"` (e.g. `"rank(revenue:sum) <= 10"`) — dialect-portable and auto-promoted to a post-filter on the outer query. Raw `OVER (...)` SQL inside a filter or `ModelMeasure.formula` is rejected with an actionable error. Filtering on a `Column` whose `sql` contains a window function is also rejected (DEV-1369): use `rank()` / `dense_rank()` / `percent_rank()` / `ntile(n=<N>)` for top-N, or factor the windowed expression into an earlier stage of a multi-stage `source_queries` model.
 
-**Variable substitution**: `{var}` placeholders in filter strings are substituted from the query's `variables` dict (or per-model defaults). Use `{{`/`}}` for literal braces. Write the surrounding quotes yourself (`status = '{status}'`); string values are auto-escaped so an embedded quote stays inside the literal. Numbers (incl. bool) insert verbatim; non-finite floats are rejected; undefined vars raise. The same `{var}` mechanism also fills the raw-SQL (Mode A) surfaces of the query's direct source model — `SlayerModel.sql`, `SlayerModel.filters`, `Column.sql`, `Column.filter` (DEV-1625). See slayer-models skill for details.
+**Variable substitution**: `{var}` placeholders in filter strings are substituted from the query's `variables` dict (or per-model defaults). Use `{{`/`}}` for literal braces. Write the surrounding quotes yourself (`status = '{status}'`); string values are auto-escaped so an embedded quote stays inside the literal. Numbers (incl. bool) insert verbatim; non-finite floats are rejected; undefined vars raise. A **list** value renders an injection-safe `IN`-list for an `in`/`not in` filter (`region in ({regions})` with `{"regions": ["US","CA"]}` → `region IN ('US', 'CA')`) — write the parens, omit per-element quotes (auto-quoted); empty list raises. The same `{var}` mechanism also fills the raw-SQL (Mode A) surfaces of the query's direct source model — `SlayerModel.sql`, `SlayerModel.filters`, `Column.sql`, `Column.filter` (DEV-1625). See slayer-models skill for details.
 
 ## Executing
 

CLAUDE.md

@@ -53,7 +53,7 @@ data dir, override with `$SLAYER_STORAGE`.
 - Dots denote join paths in queries (`customers.regions.name`); `__` denotes path aliases in model SQL (`customers__regions.name`)
 - Models are keyed by `(data_source, name)`; joins resolve within the parent model's datasource
 - Models/queries/datasource configs carry a `version` field; storage migrations run automatically on load (`slayer/storage/migrations.py`)
-- Filters support `{variable}` placeholders from `query.variables`; datasource configs support `${ENV_VAR}`
+- Filters support `{variable}` placeholders from `query.variables` (scalars, plus lists → injection-safe `IN`-list body: `region IN ({regions})`); datasource configs support `${ENV_VAR}`
 
 ## Database Support