@lightdash/cli 1.54.0 → 1.56.0

package/dist/handlers/download.test.js

@@ -38,7 +38,7 @@ vitest_1.vi.mock('./dbt/apiClient', async (importOriginal) => ({
     getContentAsCodeUploadPermissions: vitest_1.vi.fn(),
     lightdashApi: vitest_1.vi.fn(),
 }));
-const { assertUniqueSpacePaths, downloadSpaces, getDashboardChartSlugs, getFlatSpaceFileNames, hasContentFilters, isAiAgentsUnavailableError, isExternalConnectionsUnavailableError, downloadAiAgents, readAiAgentFiles, readSpaceFiles, readSpaceNames, sanitizeChartForDownload, shouldFallBackToEmbeddedSpaces, shouldDownloadAiAgents, summarizeUploadChanges, upsertAiAgents, upsertExternalConnections, upsertSpaces, upsertVirtualViews, validateSpaceIdentity, writeSpaceFiles, } = download_1.testHelpers;
+const { assertUniqueSpacePaths, downloadSpaces, getDashboardAppSlugs, getDashboardChartSlugs, getFlatSpaceFileNames, hasContentFilters, isAiAgentsUnavailableError, isExternalConnectionsUnavailableError, downloadAiAgents, isFilteredWithNoDashboards, readAiAgentFiles, readSpaceFiles, readSpaceNames, sanitizeChartForDownload, shouldFallBackToEmbeddedSpaces, shouldDownloadAiAgents, summarizeUploadChanges, upsertAiAgents, upsertExternalConnections, upsertSpaces, upsertVirtualViews, validateSpaceIdentity, writeSpaceFiles, } = download_1.testHelpers;
 const makeDownloadHandlerOptions = (overrides = {}) => ({
     verbose: false,
     charts: [],
@@ -155,6 +155,24 @@ const writeFolderDashboard = async (baseDir, slug, chartSlugs) => {
     const yaml = `contentType: dashboard\nname: ${slug}\nslug: ${slug}\nspaceSlug: test-space\ntiles:\n${tilesYaml}\nversion: 1\n`;
     await fs_1.promises.writeFile(path.join(baseDir, 'dashboards', `${slug}.yml`), yaml);
 };
+const makeLooseAppDashboard = (slug, appSlugs) => ({
+    slug,
+    name: slug,
+    spaceSlug: 'test-space',
+    version: 1,
+    tiles: appSlugs.map((appSlug) => ({
+        type: 'data_app',
+        properties: { appSlug },
+    })),
+    needsUpdating: false,
+});
+const writeFolderAppDashboard = async (baseDir, slug, appSlugs) => {
+    const tilesYaml = appSlugs
+        .map((s) => `  - properties:\n      appSlug: ${s}\n    type: data_app`)
+        .join('\n');
+    const yaml = `contentType: dashboard\nname: ${slug}\nslug: ${slug}\nspaceSlug: test-space\ntiles:\n${tilesYaml}\nversion: 1\n`;
+    await fs_1.promises.writeFile(path.join(baseDir, 'dashboards', `${slug}.yml`), yaml);
+};
 describe('summarizeUploadChanges', () => {
     it('reports only phase deltas and warns when resources fail', () => {
         expect(summarizeUploadChanges({ 'charts created': 1, 'spaces skipped': 3 }, {
@@ -282,6 +300,79 @@ describe('getDashboardChartSlugs', () => {
         expect(slugs).toEqual(['real-chart']);
     });
 });
+describe('extractAppSlugsFromDashboards', () => {
+    const dashboard = (tiles) => ({ slug: 'd', tiles });
+    it('collects app slugs and ignores other tile types', () => {
+        expect(download_1.testHelpers.extractAppSlugsFromDashboards([
+            dashboard([
+                {
+                    type: 'data_app',
+                    properties: { appSlug: 'revenue-explorer' },
+                },
+                {
+                    type: 'saved_chart',
+                    properties: { chartSlug: 'a-chart' },
+                },
+                { type: 'markdown', properties: { content: 'hi' } },
+            ]),
+        ])).toEqual(['revenue-explorer']);
+    });
+    it('dedupes and drops null slugs', () => {
+        expect(download_1.testHelpers.extractAppSlugsFromDashboards([
+            dashboard([
+                { type: 'data_app', properties: { appSlug: 'one' } },
+                { type: 'data_app', properties: { appSlug: 'one' } },
+                { type: 'data_app', properties: { appSlug: null } },
+            ]),
+        ])).toEqual(['one']);
+    });
+});
+describe('getDashboardAppSlugs', () => {
+    let tmpDir;
+    beforeEach(async () => {
+        tmpDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'download-test-'));
+        await fs_1.promises.mkdir(path.join(tmpDir, 'dashboards'));
+    });
+    afterEach(async () => {
+        await fs_1.promises.rm(tmpDir, { recursive: true, force: true });
+    });
+    it('extracts app slugs from folder dashboards', async () => {
+        await writeFolderAppDashboard(tmpDir, 'folder-dash', [
+            'app-a',
+            'app-b',
+        ]);
+        const slugs = await getDashboardAppSlugs([], tmpDir);
+        expect(slugs.sort()).toEqual(['app-a', 'app-b']);
+    });
+    it('filters to the selected dashboards only', async () => {
+        await writeFolderAppDashboard(tmpDir, 'wanted', ['wanted-app']);
+        const loose = makeLooseAppDashboard('other', ['other-app']);
+        const slugs = await getDashboardAppSlugs(['wanted'], tmpDir, [loose]);
+        expect(slugs).toEqual(['wanted-app']);
+    });
+    it('dedupes across dashboards and drops null slugs', async () => {
+        await writeFolderAppDashboard(tmpDir, 'folder-dash', ['shared-app']);
+        const loose = makeLooseAppDashboard('loose-dash', ['shared-app', null]);
+        const slugs = await getDashboardAppSlugs([], tmpDir, [loose]);
+        expect(slugs).toEqual(['shared-app']);
+    });
+    it('returns an empty array when no dashboard has an app tile', async () => {
+        await writeFolderDashboard(tmpDir, 'chart-only', ['chart-a']);
+        const slugs = await getDashboardAppSlugs([], tmpDir);
+        expect(slugs).toEqual([]);
+    });
+});
+describe('isFilteredWithNoDashboards', () => {
+    it('is true for a filtered upload that selects no dashboards (e.g. --charts only)', () => {
+        expect(isFilteredWithNoDashboards(true, [])).toBe(true);
+    });
+    it('is false for an unfiltered upload even with no dashboard slugs', () => {
+        expect(isFilteredWithNoDashboards(false, [])).toBe(false);
+    });
+    it('is false once dashboard slugs are provided', () => {
+        expect(isFilteredWithNoDashboards(true, ['my-dashboard'])).toBe(false);
+    });
+});
 describe('sanitizeChartForDownload', () => {
     it('preserves per-value pivot series customizations by default', () => {
         const chart = makeChart([

package/dist/vendor/authoring/AGENTS.md.tmpl

@@ -8,6 +8,6 @@ Edit only `src/`. Root config files are read-only reference — the server rebui
 
 The local build is an optional pre-check. Apps made with `lightdash apps create` already have dependencies installed and can run `npm run build`; after `lightdash download`, use `npm install && npm run build` if you choose to build locally. If install fails, skip it and upload — never modify machine config, npmrc, or dependency files to force it; the server rebuild is authoritative.
 
-Build with the template's preinstalled dependency set (see `package.json`). Adding new npm packages only works when the instance has custom dependencies enabled — assume it does not; ask the user before considering a new library, and never vendor library source into `src/` as a workaround. Where enabled, adding a dependency is the one workflow that still requires pnpm: upload requires a matching `pnpm-lock.yaml`, so `pnpm add <pkg>` (or `pnpm install --lockfile-only`) must succeed locally. If it fails, stop and report the error — hand-editing `package.json` without the lockfile makes the upload fail.
+Build with the template's preinstalled dependency set (see `package.json`). Adding new npm packages only works when the Lightdash organization has custom dependencies enabled — assume it does not; ask the user before considering a new library, and never vendor library source into `src/` as a workaround. Where enabled, adding a dependency is the one workflow that still requires pnpm: upload requires a matching `pnpm-lock.yaml`, so `pnpm add <pkg>` (or `pnpm install --lockfile-only`) must succeed locally. If it fails, stop and report the error — hand-editing `package.json` without the lockfile makes the upload fail.
 
 `.npmrc` sets `ignore-scripts=true` — never remove it or run installs with scripts enabled; this app may be authored by someone else and their dependencies' lifecycle scripts must not run here.

package/dist/vendor/authoring/README.md.tmpl

@@ -13,7 +13,7 @@ Local preview uses your existing CLI login through a project- and route-restrict
 ## What's read-only
 Most root config is read-only: `vite.config.js`, `tailwind.config.js`, `tsconfig.json`, etc. The server rebuilds against a trusted template, so local edits to those files don't change the deployed app.
 
-The app builds against the template's fixed dependency set (see `package.json`) — design within it. Only when custom dependencies are enabled on your Lightdash instance (most instances: not enabled), `package.json` becomes partially editable. This is the one workflow that still requires pnpm: run `pnpm add <pkg>` to declare extra npm dependencies (registry packages, plain semver versions only, up to 60 direct deps). `pnpm-lock.yaml` must be updated to match — `pnpm add` does this; if you edit `package.json` by hand, run `pnpm install --lockfile-only`. Upload rejects new dependencies without a matching lockfile. On upload the CLI warns which packages will be installed in the build sandbox; install scripts never run, and the server replaces `scripts` with the trusted template's (the sandbox build command is not uploader-controlled). The AI builder and in-app UI cannot change the dependency set — dependencies are declared by editing `package.json` and re-uploading.
+The app builds against the template's fixed dependency set (see `package.json`) — design within it. Only when custom dependencies are enabled for your Lightdash organization, `package.json` becomes partially editable. This is the one workflow that still requires pnpm: run `pnpm add <pkg>` to declare extra npm dependencies (registry packages, plain semver versions only, up to 60 direct deps). `pnpm-lock.yaml` must be updated to match — `pnpm add` does this; if you edit `package.json` by hand, run `pnpm install --lockfile-only`. Upload rejects new dependencies without a matching lockfile. On upload the CLI warns which packages will be installed in the build sandbox; install scripts never run, and the server replaces `scripts` with the trusted template's (the sandbox build command is not uploader-controlled). The AI builder and in-app UI cannot change the dependency set — dependencies are declared by editing `package.json` and re-uploading.
 
 `.npmrc` sets `ignore-scripts=true` so dependencies' lifecycle scripts never run on your machine either — downloaded apps may be authored by someone else. Keep it; explicit commands such as `npm run build` still work.
 

package/dist/vendor/authoring/developing-data-apps-locally/SKILL.md

@@ -22,7 +22,7 @@ You are editing a Lightdash **data app** that was created or downloaded with the
 ## Library boundaries — build with what's preinstalled
 
 - The app builds against a **fixed template dependency set** — see `package.json` (React, Recharts, d3 + d3-cloud/d3-sankey, Radix primitives, Tailwind, lucide-react, date-fns, html-to-image, jspdf, and more). **Design within this set**; it covers almost all data-app needs.
-- Adding new npm packages only works when the Lightdash instance has custom dependencies enabled — **assume it does not**. When disabled, upload rejects new dependencies and apps that declare them cannot be downloaded. Do not attempt `pnpm add` to find out; ask the user whether their instance has custom dependencies enabled before considering a new library.
+- Adding new npm packages only works when the Lightdash organization has custom dependencies enabled — **assume it does not**. When disabled, upload rejects new dependency declarations. Do not attempt `pnpm add` to find out; ask the user whether their organization has custom dependencies enabled before considering a new library.
 - Do **not** work around a missing library by vendoring its source into `src/`, inlining minified code, or fetching code at runtime. If the template set genuinely cannot express what's asked, say so and let the user decide.
 
 ## The edit → build → upload loop
@@ -36,7 +36,7 @@ You are editing a Lightdash **data app** that was created or downloaded with the
 - If `npm install` fails (registry policy, an unavailable pinned SDK version, no network access), **skip the local build entirely and go straight to upload**. The server rebuild is authoritative and surfaces build errors on the app page.
 - Do **not** modify machine configuration, `.npmrc` files, registry settings, or the project's dependency files to force an install to work.
 - A missing `node_modules` is a normal state, not a problem to fix. Never run installs just because it is absent.
-- **Exception — adding a dependency** (only on instances with custom dependencies enabled — see "Library boundaries" above). This is the one workflow that still requires pnpm: upload rejects new dependencies unless `pnpm-lock.yaml` was regenerated to match `package.json`, so dependency resolution MUST succeed locally. Use `pnpm add <pkg>` — prefixed with Socket Firewall when available (`sfw pnpm add <pkg>`; check with `command -v sfw`) to block known-malicious packages — or after editing `package.json` run `pnpm install --lockfile-only` (updates the lockfile without installing). If resolution fails, **stop and report the exact pnpm error to the user** — never hand-edit `package.json` and proceed without the lockfile; the upload will fail.
+- **Exception — adding a dependency** (only for organizations with custom dependencies enabled — see "Library boundaries" above). This is the one workflow that still requires pnpm: upload rejects new dependencies unless `pnpm-lock.yaml` was regenerated to match `package.json`, so dependency resolution MUST succeed locally. Use `pnpm add <pkg>` — prefixed with Socket Firewall when available (`sfw pnpm add <pkg>`; check with `command -v sfw`) to block known-malicious packages — or after editing `package.json` run `pnpm install --lockfile-only` (updates the lockfile without installing). If resolution fails, **stop and report the exact pnpm error to the user** — never hand-edit `package.json` and proceed without the lockfile; the upload will fail.
 - **Never run dependency lifecycle scripts.** The app's `.npmrc` sets `ignore-scripts=true` — leave it. A downloaded app can be authored by someone else, and their dependencies' install scripts must not execute on this machine. Explicit `npm run build`/`npm run dev` and `pnpm build`/`pnpm dev` commands still work.
 
 ## Preview locally against real data
@@ -65,4 +65,4 @@ You are editing a Lightdash **data app** that was created or downloaded with the
 
 Most root config is reference only — editing it has **no effect** because the server rebuilds against its trusted template. This applies to `vite.config.js`, `tailwind.config.js`, `tsconfig.json`, and other build/tooling files.
 
-`package.json` is **partially editable** only when custom dependencies are enabled on the Lightdash instance — see "Library boundaries" above; treat it as read-only otherwise. When enabled, you may add npm dependencies with `pnpm add <pkg>` — registry packages with plain semver versions only (no git/file/url specs), up to 60 direct dependencies, and `pnpm-lock.yaml` must be updated alongside (see the exception above — this is the one step that still requires pnpm and must succeed locally). On upload the CLI warns which packages will be installed in the build sandbox; install scripts never run. Other root config (vite/tailwind/tsconfig) remains read-only.
+`package.json` is **partially editable** only when custom dependencies are enabled for the Lightdash organization — see "Library boundaries" above; treat it as read-only otherwise. When enabled, you may add npm dependencies with `pnpm add <pkg>` — registry packages with plain semver versions only (no git/file/url specs), up to 60 direct dependencies, and `pnpm-lock.yaml` must be updated alongside (see the exception above — this is the one step that still requires pnpm and must succeed locally). On upload the CLI warns which packages will be installed in the build sandbox; install scripts never run. Other root config (vite/tailwind/tsconfig) remains read-only.

package/dist/vendor/template/package.json

@@ -56,6 +56,6 @@
         "postcss": "8.5.18",
         "tailwindcss": "3.4.17",
         "typescript": "7.0.2",
-        "vite": "8.0.5"
+        "vite": "8.0.16"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "1.54.0",
+  "version": "1.56.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -41,8 +41,8 @@
     "unique-names-generator": "4.7.1",
     "uuid": "11.1.1",
     "yaml": "2.8.3",
-    "@lightdash/common": "1.54.0",
-    "@lightdash/warehouses": "1.54.0"
+    "@lightdash/common": "1.56.0",
+    "@lightdash/warehouses": "1.56.0"
   },
   "devDependencies": {
     "@types/inquirer": "8.2.4",