@lightdash/cli 2.86.0 → 2.88.0

package/dist/handlers/apps/build.d.ts

@@ -0,0 +1,6 @@
+export type AppsBuildOptions = {
+    outDir?: string;
+    verbose: boolean;
+};
+export declare const appsBuildHandler: (pathArg: string | undefined, options: AppsBuildOptions) => Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/handlers/apps/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/build.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,gBAAgB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,gBAAgB,YAChB,MAAM,GAAG,SAAS,WAClB,gBAAgB,KAC1B,OAAO,CAAC,IAAI,CA6Cd,CAAC"}

package/dist/handlers/apps/build.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appsBuildHandler = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const path = tslib_1.__importStar(require("path"));
+const globalState_1 = tslib_1.__importDefault(require("../../globalState"));
+const styles = tslib_1.__importStar(require("../../styles"));
+const appCodeFiles_1 = require("./appCodeFiles");
+const pathContainment_1 = require("./pathContainment");
+const validate_1 = require("./validate");
+const appsBuildHandler = async (pathArg, options) => {
+    globalState_1.default.setVerbose(options.verbose);
+    const appDir = path.resolve(process.cwd(), pathArg ?? '.');
+    const outDir = path.resolve(process.cwd(), options.outDir ?? path.join(appDir, 'dist'));
+    (0, pathContainment_1.assertOutDirDoesNotContainAppDir)(appDir, outDir);
+    // The lexical check above can be bypassed by symlinks (an appDir that is
+    // itself a symlink into outDir's real tree, or an outDir reached through
+    // a symlinked ancestor whose target contains appDir), so re-run the same
+    // check on the canonicalized paths before doing anything destructive.
+    const [canonicalAppDir, canonicalOutDir] = await Promise.all([
+        (0, pathContainment_1.canonicalizeForContainment)(appDir),
+        (0, pathContainment_1.canonicalizeForContainment)(outDir),
+    ]);
+    (0, pathContainment_1.assertOutDirDoesNotContainAppDir)(canonicalAppDir, canonicalOutDir);
+    let bundle;
+    try {
+        bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+    }
+    catch (error) {
+        throw new common_1.ParameterError((0, common_1.getErrorMessage)(error));
+    }
+    if (bundle.files.length === 0) {
+        throw new common_1.ParameterError(`App bundle has no files under src/ to build: ${appDir}`);
+    }
+    const issues = await (0, validate_1.validateDataAppBuild)({ appDir, bundle, outDir });
+    if (issues.length > 0) {
+        for (const buildIssue of issues) {
+            globalState_1.default.log(`${styles.error('error')} ${(0, validate_1.formatIssue)(buildIssue)}`);
+        }
+        throw new common_1.ParameterError(`Build failed with ${issues.length} error(s).`);
+    }
+    globalState_1.default.log(styles.success(`✓ Built ${appDir} → ${outDir}`));
+};
+exports.appsBuildHandler = appsBuildHandler;

package/dist/handlers/apps/build.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=build.test.d.ts.map

package/dist/handlers/apps/build.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/build.test.ts"],"names":[],"mappings":""}

package/dist/handlers/apps/build.test.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const fs_1 = require("fs");
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+const appCodeFiles_1 = require("./appCodeFiles");
+const build_1 = require("./build");
+const pathContainment_1 = require("./pathContainment");
+const validate_1 = require("./validate");
+const describePosix = process.platform === 'win32' ? describe.skip : describe;
+const defaultManifest = {
+    codeVersion: 1,
+    projectUuid: 'project-uuid',
+    slug: 'orders-app',
+    version: 1,
+    name: 'Orders app',
+    description: '',
+    template: null,
+    downloadedAt: '2026-08-01T00:00:00.000Z',
+    externalConnections: [],
+};
+const validSource = `
+    import { query } from '@lightdash/query-sdk';
+    query('orders').dimensions(['status']);
+`;
+const makeApp = async () => {
+    const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-app-build-'));
+    const code = {
+        manifest: defaultManifest,
+        files: [
+            {
+                path: 'src/App.tsx',
+                contentBase64: Buffer.from(validSource).toString('base64'),
+            },
+        ],
+    };
+    await (0, appCodeFiles_1.writeBundleToDir)(dir, code);
+    await fs_1.promises.mkdir(path.join(dir, 'node_modules'));
+    return dir;
+};
+const makeOutDir = async () => path.join(await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-app-build-outdir-')), 'dist');
+// Writes an app bundle into an already-existing directory, for symlink
+// bypass tests that need control over exactly where the real files live.
+const writeAppBundleTo = async (dir) => {
+    const code = {
+        manifest: defaultManifest,
+        files: [
+            {
+                path: 'src/App.tsx',
+                contentBase64: Buffer.from(validSource).toString('base64'),
+            },
+        ],
+    };
+    await (0, appCodeFiles_1.writeBundleToDir)(dir, code);
+    await fs_1.promises.mkdir(path.join(dir, 'node_modules'));
+};
+// Fakes a successful `vite build` by writing dist/index.html into the build
+// dir it receives, without actually running Vite.
+const fakeSuccessfulViteBuild = async (command) => {
+    if (command.command !== 'vite')
+        return;
+    await fs_1.promises.mkdir(path.join(command.cwd, 'dist'));
+    await fs_1.promises.writeFile(path.join(command.cwd, 'dist', 'index.html'), '<html>built</html>');
+};
+describe('validateDataAppBuild outDir', () => {
+    it('copies the built dist output into outDir and still cleans the temp build dir', async () => {
+        const appDir = await makeApp();
+        const bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+        const outDir = await makeOutDir();
+        const buildDirs = [];
+        const runCommand = async (command) => {
+            if (command.command === 'vite')
+                buildDirs.push(command.cwd);
+            await fakeSuccessfulViteBuild(command);
+        };
+        const issues = await (0, validate_1.validateDataAppBuild)({
+            appDir,
+            bundle,
+            runCommand,
+            outDir,
+        });
+        expect(issues).toEqual([]);
+        await expect(fs_1.promises.readFile(path.join(outDir, 'index.html'), 'utf-8')).resolves.toBe('<html>built</html>');
+        expect(buildDirs).toHaveLength(1);
+        await expect(fs_1.promises.stat(buildDirs[0])).rejects.toThrow();
+    });
+    it('clears stale files from a previous build before copying the new output', async () => {
+        const appDir = await makeApp();
+        const bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+        const outDir = await makeOutDir();
+        await fs_1.promises.mkdir(outDir, { recursive: true });
+        await fs_1.promises.writeFile(path.join(outDir, 'stale-chunk-abc123.js'), '// stale');
+        const issues = await (0, validate_1.validateDataAppBuild)({
+            appDir,
+            bundle,
+            runCommand: fakeSuccessfulViteBuild,
+            outDir,
+        });
+        expect(issues).toEqual([]);
+        await expect(fs_1.promises.readFile(path.join(outDir, 'index.html'), 'utf-8')).resolves.toBe('<html>built</html>');
+        await expect(fs_1.promises.stat(path.join(outDir, 'stale-chunk-abc123.js'))).rejects.toThrow();
+    });
+    it('does not copy anything and leaves a pre-existing outDir untouched when the build fails', async () => {
+        const appDir = await makeApp();
+        const bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+        const outDir = await makeOutDir();
+        await fs_1.promises.mkdir(outDir, { recursive: true });
+        await fs_1.promises.writeFile(path.join(outDir, 'previous-build.js'), '// kept');
+        const viteError = Object.assign(new Error('Command failed'), {
+            stderr: 'src/App.tsx:1: broken import',
+        });
+        const issues = await (0, validate_1.validateDataAppBuild)({
+            appDir,
+            bundle,
+            outDir,
+            runCommand: vi.fn().mockRejectedValue(viteError),
+        });
+        expect(issues).toEqual([
+            expect.objectContaining({
+                code: 'build',
+                message: expect.stringContaining('broken import'),
+            }),
+        ]);
+        await expect(fs_1.promises.readFile(path.join(outDir, 'previous-build.js'), 'utf-8')).resolves.toBe('// kept');
+    });
+});
+describe('appsBuildHandler', () => {
+    it('fails fast with a ParameterError when the directory has no lightdash-app.yml', async () => {
+        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-app-build-missing-'));
+        await expect((0, build_1.appsBuildHandler)(dir, { verbose: false })).rejects.toThrow(common_1.ParameterError);
+    });
+    it('fails fast with a ParameterError when the bundle has no files under src/', async () => {
+        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-app-build-empty-'));
+        await (0, appCodeFiles_1.writeBundleToDir)(dir, { manifest: defaultManifest, files: [] });
+        await expect((0, build_1.appsBuildHandler)(dir, { verbose: false })).rejects.toThrow(/no files under src\//);
+    });
+    it('refuses --out-dir equal to the app directory before doing any build work', async () => {
+        const appDir = await makeApp();
+        await expect((0, build_1.appsBuildHandler)(appDir, { outDir: appDir, verbose: false })).rejects.toThrow(common_1.ParameterError);
+        // The app bundle must still be intact — no wipe happened.
+        await expect(fs_1.promises.stat(path.join(appDir, 'src', 'App.tsx'))).resolves.toBeDefined();
+    });
+    it('refuses --out-dir that is a parent of the app directory before doing any build work', async () => {
+        const parentDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-app-build-parent-'));
+        const appDir = path.join(parentDir, 'app');
+        await fs_1.promises.mkdir(appDir);
+        const code = {
+            manifest: defaultManifest,
+            files: [
+                {
+                    path: 'src/App.tsx',
+                    contentBase64: Buffer.from(validSource).toString('base64'),
+                },
+            ],
+        };
+        await (0, appCodeFiles_1.writeBundleToDir)(appDir, code);
+        await fs_1.promises.mkdir(path.join(appDir, 'node_modules'));
+        await expect((0, build_1.appsBuildHandler)(appDir, {
+            outDir: parentDir,
+            verbose: false,
+        })).rejects.toThrow(common_1.ParameterError);
+        await expect(fs_1.promises.stat(path.join(appDir, 'src', 'App.tsx'))).resolves.toBeDefined();
+    });
+});
+describe('assertOutDirDoesNotContainAppDir', () => {
+    it('throws when outDir equals appDir', () => {
+        expect(() => (0, pathContainment_1.assertOutDirDoesNotContainAppDir)('/repo/apps/orders', '/repo/apps/orders')).toThrow(common_1.ParameterError);
+    });
+    it('throws when appDir is nested inside outDir', () => {
+        expect(() => (0, pathContainment_1.assertOutDirDoesNotContainAppDir)('/repo/apps/orders', '/repo/apps')).toThrow(common_1.ParameterError);
+    });
+    it('throws when outDir is the filesystem root and appDir is anywhere under it', () => {
+        expect(() => (0, pathContainment_1.assertOutDirDoesNotContainAppDir)('/repo/apps/orders', '/')).toThrow(common_1.ParameterError);
+    });
+    it('does not throw for a normal sibling out-dir', () => {
+        expect(() => (0, pathContainment_1.assertOutDirDoesNotContainAppDir)('/repo/apps/orders', '/repo/build-output')).not.toThrow();
+    });
+    it('does not throw for the default outDir nested inside appDir (appDir/dist)', () => {
+        expect(() => (0, pathContainment_1.assertOutDirDoesNotContainAppDir)('/repo/apps/orders', '/repo/apps/orders/dist')).not.toThrow();
+    });
+});
+describePosix('out-dir containment guard: symlink bypasses', () => {
+    it('refuses when appDir is a symlink whose real location is inside outDir', async () => {
+        // outDir already exists as a real directory, and the "app" the CLI
+        // is asked to build actually lives inside it — reached only via a
+        // symlink from elsewhere, so the lexical check alone would miss it.
+        const outDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-outdir-'));
+        const realAppDir = path.join(outDir, 'app-real');
+        await fs_1.promises.mkdir(realAppDir);
+        await writeAppBundleTo(realAppDir);
+        const linkParent = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-applink-'));
+        const appLink = path.join(linkParent, 'app-link');
+        await fs_1.promises.symlink(realAppDir, appLink);
+        await expect((0, build_1.appsBuildHandler)(appLink, { outDir, verbose: false })).rejects.toThrow(common_1.ParameterError);
+        await expect(fs_1.promises.stat(path.join(realAppDir, 'src', 'App.tsx'))).resolves.toBeDefined();
+    });
+    it('refuses when outDir is reached via a symlinked ancestor whose target contains appDir', async () => {
+        const parentDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-parent-'));
+        const appDir = path.join(parentDir, 'app');
+        await fs_1.promises.mkdir(appDir);
+        await writeAppBundleTo(appDir);
+        const linkParent = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-outlink-'));
+        const outDirViaSymlink = path.join(linkParent, 'link-to-parent');
+        await fs_1.promises.symlink(parentDir, outDirViaSymlink);
+        await expect((0, build_1.appsBuildHandler)(appDir, {
+            outDir: outDirViaSymlink,
+            verbose: false,
+        })).rejects.toThrow(common_1.ParameterError);
+        await expect(fs_1.promises.stat(path.join(appDir, 'src', 'App.tsx'))).resolves.toBeDefined();
+    });
+    it('allows a legitimate sibling outDir reached via a symlinked ancestor', async () => {
+        const rootDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-root-'));
+        const appDir = path.join(rootDir, 'app-real');
+        await fs_1.promises.mkdir(appDir);
+        await writeAppBundleTo(appDir);
+        const realOutDir = path.join(rootDir, 'out-real');
+        const linkParent = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-rootlink-'));
+        const linkToRoot = path.join(linkParent, 'link-to-root');
+        await fs_1.promises.symlink(rootDir, linkToRoot);
+        const outDirViaSymlink = path.join(linkToRoot, 'out-real');
+        const bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+        const issues = await (0, validate_1.validateDataAppBuild)({
+            appDir,
+            bundle,
+            outDir: outDirViaSymlink,
+            runCommand: fakeSuccessfulViteBuild,
+        });
+        expect(issues).toEqual([]);
+        await expect(fs_1.promises.readFile(path.join(realOutDir, 'index.html'), 'utf-8')).resolves.toBe('<html>built</html>');
+    });
+    it('validateDataAppBuild rechecks containment itself when called directly with a dangerous pair', async () => {
+        // Bypasses appsBuildHandler's guard entirely, simulating any future
+        // caller of validateDataAppBuild that doesn't run the check itself.
+        const parentDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-direct-parent-'));
+        const appDir = path.join(parentDir, 'app');
+        await fs_1.promises.mkdir(appDir);
+        await writeAppBundleTo(appDir);
+        const linkParent = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-symlink-direct-link-'));
+        const outDirViaSymlink = path.join(linkParent, 'link-to-parent');
+        await fs_1.promises.symlink(parentDir, outDirViaSymlink);
+        const bundle = await (0, appCodeFiles_1.readBundleFromDir)(appDir);
+        await expect((0, validate_1.validateDataAppBuild)({
+            appDir,
+            bundle,
+            outDir: outDirViaSymlink,
+            runCommand: fakeSuccessfulViteBuild,
+        })).rejects.toThrow(common_1.ParameterError);
+        await expect(fs_1.promises.stat(path.join(appDir, 'src', 'App.tsx'))).resolves.toBeDefined();
+    });
+});

package/dist/handlers/apps/pathContainment.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Resolves `absolutePath` through any symlinks so it can be safely compared
+ * for containment against another canonicalized path. The path may not
+ * exist yet (e.g. an --out-dir that hasn't been built to), so this walks up
+ * to the nearest existing ancestor, realpaths that ancestor, and re-joins
+ * the non-existent remainder lexically.
+ *
+ * Any realpath failure other than "this segment doesn't exist" (permission
+ * denied, a symlink loop, ...) is rethrown rather than swallowed. Callers
+ * must treat that as "cannot prove this path is safe" and refuse the
+ * operation — never fall back to the un-canonicalized path.
+ */
+export declare const canonicalizeForContainment: (absolutePath: string) => Promise<string>;
+/**
+ * The build wipes outDir before copying the new output in. If outDir is (or
+ * contains) appDir, that wipe deletes the app source being built. Both
+ * arguments must already be resolved to absolute, canonical (symlink-free)
+ * paths — see `canonicalizeForContainment`.
+ */
+export declare const assertOutDirDoesNotContainAppDir: (appDir: string, outDir: string) => void;
+/**
+ * Defense-in-depth recheck for the deletion site itself: outDir may have
+ * changed since an earlier containment check ran, or a caller may not have
+ * run one at all. If outDir doesn't exist yet there is nothing to delete,
+ * so this is a no-op. If it exists, both paths are canonicalized and
+ * re-checked with the same predicate as the pre-build guard. Throws
+ * ParameterError on violation; never trusts the caller's un-canonicalized
+ * paths.
+ */
+export declare const assertOutDirSafeToClear: (appDir: string, outDir: string) => Promise<void>;
+//# sourceMappingURL=pathContainment.d.ts.map

package/dist/handlers/apps/pathContainment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathContainment.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/pathContainment.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,iBACrB,MAAM,KACrB,OAAO,CAAC,MAAM,CAuBhB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,WACjC,MAAM,UACN,MAAM,KACf,IAWF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,WACxB,MAAM,UACN,MAAM,KACf,OAAO,CAAC,IAAI,CAcd,CAAC"}

package/dist/handlers/apps/pathContainment.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertOutDirSafeToClear = exports.assertOutDirDoesNotContainAppDir = exports.canonicalizeForContainment = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const fs_1 = require("fs");
+const path = tslib_1.__importStar(require("path"));
+/**
+ * Resolves `absolutePath` through any symlinks so it can be safely compared
+ * for containment against another canonicalized path. The path may not
+ * exist yet (e.g. an --out-dir that hasn't been built to), so this walks up
+ * to the nearest existing ancestor, realpaths that ancestor, and re-joins
+ * the non-existent remainder lexically.
+ *
+ * Any realpath failure other than "this segment doesn't exist" (permission
+ * denied, a symlink loop, ...) is rethrown rather than swallowed. Callers
+ * must treat that as "cannot prove this path is safe" and refuse the
+ * operation — never fall back to the un-canonicalized path.
+ */
+const canonicalizeForContainment = async (absolutePath) => {
+    let current = absolutePath;
+    const missingSegments = [];
+    while (true) {
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            const real = await fs_1.promises.realpath(current);
+            return missingSegments.length > 0
+                ? path.join(real, ...missingSegments.reverse())
+                : real;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                throw error;
+            }
+            const parent = path.dirname(current);
+            if (parent === current) {
+                // Reached the filesystem root and even it didn't resolve.
+                throw error;
+            }
+            missingSegments.push(path.basename(current));
+            current = parent;
+        }
+    }
+};
+exports.canonicalizeForContainment = canonicalizeForContainment;
+/**
+ * The build wipes outDir before copying the new output in. If outDir is (or
+ * contains) appDir, that wipe deletes the app source being built. Both
+ * arguments must already be resolved to absolute, canonical (symlink-free)
+ * paths — see `canonicalizeForContainment`.
+ */
+const assertOutDirDoesNotContainAppDir = (appDir, outDir) => {
+    const relativeAppDirFromOutDir = path.relative(outDir, appDir);
+    const appDirIsInsideOutDir = relativeAppDirFromOutDir !== '' &&
+        !relativeAppDirFromOutDir.startsWith('..') &&
+        !path.isAbsolute(relativeAppDirFromOutDir);
+    if (outDir === appDir || appDirIsInsideOutDir) {
+        throw new common_1.ParameterError('--out-dir must not contain the app directory (would delete the app source on build)');
+    }
+};
+exports.assertOutDirDoesNotContainAppDir = assertOutDirDoesNotContainAppDir;
+/**
+ * Defense-in-depth recheck for the deletion site itself: outDir may have
+ * changed since an earlier containment check ran, or a caller may not have
+ * run one at all. If outDir doesn't exist yet there is nothing to delete,
+ * so this is a no-op. If it exists, both paths are canonicalized and
+ * re-checked with the same predicate as the pre-build guard. Throws
+ * ParameterError on violation; never trusts the caller's un-canonicalized
+ * paths.
+ */
+const assertOutDirSafeToClear = async (appDir, outDir) => {
+    let canonicalOutDir;
+    try {
+        canonicalOutDir = await fs_1.promises.realpath(outDir);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            // Nothing exists at outDir yet, so there's nothing to delete.
+            return;
+        }
+        // Cannot prove outDir is safe to clear — refuse rather than guess.
+        throw error;
+    }
+    const canonicalAppDir = await (0, exports.canonicalizeForContainment)(appDir);
+    (0, exports.assertOutDirDoesNotContainAppDir)(canonicalAppDir, canonicalOutDir);
+};
+exports.assertOutDirSafeToClear = assertOutDirSafeToClear;

package/dist/handlers/apps/pathContainment.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pathContainment.test.d.ts.map

package/dist/handlers/apps/pathContainment.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathContainment.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/pathContainment.test.ts"],"names":[],"mappings":""}

package/dist/handlers/apps/pathContainment.test.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const fs_1 = require("fs");
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+const pathContainment_1 = require("./pathContainment");
+const describePosix = process.platform === 'win32' ? describe.skip : describe;
+const mkTmpDir = (prefix) => fs_1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
+describePosix('canonicalizeForContainment', () => {
+    it('returns the realpath of an existing directory unchanged when there are no symlinks', async () => {
+        const dir = await mkTmpDir('ld-canon-plain-');
+        await expect((0, pathContainment_1.canonicalizeForContainment)(dir)).resolves.toBe(await fs_1.promises.realpath(dir));
+    });
+    it('resolves a symlinked existing directory to its real target', async () => {
+        const target = await mkTmpDir('ld-canon-target-');
+        const linkParent = await mkTmpDir('ld-canon-linkparent-');
+        const link = path.join(linkParent, 'link');
+        await fs_1.promises.symlink(target, link);
+        await expect((0, pathContainment_1.canonicalizeForContainment)(link)).resolves.toBe(await fs_1.promises.realpath(target));
+    });
+    it('walks up to the nearest existing ancestor and rejoins non-existent segments', async () => {
+        const target = await mkTmpDir('ld-canon-target-');
+        const linkParent = await mkTmpDir('ld-canon-linkparent-');
+        const link = path.join(linkParent, 'link');
+        await fs_1.promises.symlink(target, link);
+        const nonExistent = path.join(link, 'not', 'yet', 'created');
+        await expect((0, pathContainment_1.canonicalizeForContainment)(nonExistent)).resolves.toBe(path.join(await fs_1.promises.realpath(target), 'not', 'yet', 'created'));
+    });
+    it('rethrows a non-ENOENT realpath failure instead of treating it as non-existent', async () => {
+        const dir = await mkTmpDir('ld-canon-notdir-');
+        const filePath = path.join(dir, 'a-file');
+        await fs_1.promises.writeFile(filePath, 'not a directory');
+        const impossiblePath = path.join(filePath, 'nested', 'more');
+        await expect((0, pathContainment_1.canonicalizeForContainment)(impossiblePath)).rejects.toMatchObject({ code: 'ENOTDIR' });
+    });
+});
+describePosix('assertOutDirSafeToClear', () => {
+    it('is a no-op when outDir does not exist yet', async () => {
+        const appDir = await mkTmpDir('ld-safeclear-app-');
+        const outDirParent = await mkTmpDir('ld-safeclear-outparent-');
+        const outDir = path.join(outDirParent, 'dist');
+        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).resolves.toBeUndefined();
+    });
+    it('does not throw for a disjoint existing outDir', async () => {
+        const appDir = await mkTmpDir('ld-safeclear-app-');
+        const outDir = await mkTmpDir('ld-safeclear-outdir-');
+        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).resolves.toBeUndefined();
+    });
+    it('throws ParameterError when an existing outDir canonically contains appDir', async () => {
+        const outDir = await mkTmpDir('ld-safeclear-container-');
+        const appDir = path.join(outDir, 'app');
+        await fs_1.promises.mkdir(appDir);
+        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).rejects.toThrow(common_1.ParameterError);
+    });
+    it('throws ParameterError when outDir is reached via a symlinked ancestor that contains appDir', async () => {
+        const parentDir = await mkTmpDir('ld-safeclear-parent-');
+        const appDir = path.join(parentDir, 'app');
+        await fs_1.promises.mkdir(appDir);
+        const linkParent = await mkTmpDir('ld-safeclear-linkparent-');
+        const link = path.join(linkParent, 'link-to-parent');
+        await fs_1.promises.symlink(parentDir, link);
+        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, link)).rejects.toThrow(common_1.ParameterError);
+    });
+});

package/dist/handlers/apps/validate.d.ts

@@ -69,10 +69,12 @@ export declare const validateDataAppBuild: (args: {
     appDir: string;
     bundle: DataAppCode;
     runCommand?: RunDataAppBuildCommand;
+    outDir?: string;
 }) => Promise<AppsValidationIssue[]>;
 export declare const fetchLiveDataAppExploreIndex: (projectUuid: string) => Promise<DataAppExploreIndex>;
 export declare const validateLocalDataApp: (appPath: string, options: ValidateAppOptions) => Promise<AppValidationResult>;
 export declare const buildAppsValidationReport: (apps: AppValidationResult[], live: boolean, build?: boolean) => AppsValidationReport;
+export declare const formatIssue: (entry: AppsValidationIssue) => string;
 /** "2 data app(s)", "1 custom chart type(s)", or both — driven by manifest templates. */
 export declare const describeValidatedBundles: (summary: AppsValidationReport['summary']) => string;
 export declare const renderAppsValidationHuman: (report: AppsValidationReport, verbose?: boolean) => string;

package/dist/handlers/apps/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBH,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC7B,MAAM,mBAAmB,CAAC;AAsB3B,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC7B,OAAO,GACP,QAAQ,GACR,cAAc,GACd,qBAAqB,GACrB,UAAU,GACV,gBAAgB,GAChB,oBAAoB,GACpB,cAAc,CAAC;AAErB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG;IAClE,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,IAAI,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,oBAAoB,EAAE,iCAAiC,EAAE,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,IAAI,EAAE,mBAAmB,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,CAAC;KACvB,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACxC,CAAC;AAmLF,KAAK,mBAAmB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CACjC,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;AAmEnB,eAAO,MAAM,oBAAoB,SAAgB;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACvC,KAAG,OAAO,CAAC,mBAAmB,EAAE,CA+HhC,CAAC;AAUF,eAAO,MAAM,4BAA4B,gBACxB,MAAM,KACpB,OAAO,CAAC,mBAAmB,CAqB7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACpB,MAAM,WACN,kBAAkB,KAC5B,OAAO,CAAC,mBAAmB,CAkJ7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,SAC5B,mBAAmB,EAAE,QACrB,OAAO,sBAEd,oBA8BF,CAAC;AAkCF,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,YACxB,oBAAoB,CAAC,SAAS,CAAC,KACzC,MAQF,CAAC;AAQF,eAAO,MAAM,yBAAyB,WAC1B,oBAAoB,wBAE7B,MAkDF,CAAC;AAEF,eAAO,MAAM,wBAAwB,WACzB,oBAAoB,KAC7B,MAKM,CAAC;AAEV,eAAO,MAAM,mBAAmB,aAClB,MAAM,EAAE,GAAG,SAAS,WACrB,mBAAmB,KAC7B,OAAO,CAAC,IAAI,CA4Cd,CAAC"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBH,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC7B,MAAM,mBAAmB,CAAC;AAuB3B,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC7B,OAAO,GACP,QAAQ,GACR,cAAc,GACd,qBAAqB,GACrB,UAAU,GACV,gBAAgB,GAChB,oBAAoB,GACpB,cAAc,CAAC;AAErB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG;IAClE,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,IAAI,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,oBAAoB,EAAE,iCAAiC,EAAE,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,IAAI,EAAE,mBAAmB,EAAE,CAAC;CAC/B,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,WAAW,CAAC;KACvB,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACxC,CAAC;AAmLF,KAAK,mBAAmB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CACjC,OAAO,EAAE,mBAAmB,KAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;AAmEnB,eAAO,MAAM,oBAAoB,SAAgB;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,mBAAmB,EAAE,CAkJhC,CAAC;AAUF,eAAO,MAAM,4BAA4B,gBACxB,MAAM,KACpB,OAAO,CAAC,mBAAmB,CAqB7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACpB,MAAM,WACN,kBAAkB,KAC5B,OAAO,CAAC,mBAAmB,CAkJ7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,SAC5B,mBAAmB,EAAE,QACrB,OAAO,sBAEd,oBA8BF,CAAC;AAYF,eAAO,MAAM,WAAW,UAAW,mBAAmB,KAAG,MAKxD,CAAC;AAiBF,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,YACxB,oBAAoB,CAAC,SAAS,CAAC,KACzC,MAQF,CAAC;AAQF,eAAO,MAAM,yBAAyB,WAC1B,oBAAoB,wBAE7B,MAkDF,CAAC;AAEF,eAAO,MAAM,wBAAwB,WACzB,oBAAoB,KAC7B,MAKM,CAAC;AAEV,eAAO,MAAM,mBAAmB,aAClB,MAAM,EAAE,GAAG,SAAS,WACrB,mBAAmB,KAC7B,OAAO,CAAC,IAAI,CA4Cd,CAAC"}

package/dist/handlers/apps/validate.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appsValidateHandler = exports.renderAppsValidationJson = exports.renderAppsValidationHuman = exports.describeValidatedBundles = exports.buildAppsValidationReport = exports.validateLocalDataApp = exports.fetchLiveDataAppExploreIndex = exports.validateDataAppBuild = void 0;
+exports.appsValidateHandler = exports.renderAppsValidationJson = exports.renderAppsValidationHuman = exports.describeValidatedBundles = exports.formatIssue = exports.buildAppsValidationReport = exports.validateLocalDataApp = exports.fetchLiveDataAppExploreIndex = exports.validateDataAppBuild = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@lightdash/common");
 const execa_1 = tslib_1.__importDefault(require("execa"));
@@ -14,6 +14,7 @@ const globalState_1 = tslib_1.__importDefault(require("../../globalState"));
 const styles = tslib_1.__importStar(require("../../styles"));
 const apiClient_1 = require("../dbt/apiClient");
 const appCodeFiles_1 = require("./appCodeFiles");
+const pathContainment_1 = require("./pathContainment");
 const scaffolding_1 = require("./scaffolding");
 const emptyCoverage = () => ({
     callSites: 0,
@@ -239,9 +240,26 @@ const validateDataAppBuild = async (args) => {
                 issue('build', `Vite build failed:\n${commandFailureOutput(error)}`),
             ];
         }
+        if (args.outDir !== undefined) {
+            // Defense in depth: this deletion site must not trust that a
+            // caller already checked containment (or that outDir hasn't
+            // changed since it did). Re-resolve symlinks and refuse rather
+            // than delete anything we can't prove is safe.
+            await (0, pathContainment_1.assertOutDirSafeToClear)(args.appDir, args.outDir);
+            // Vite emits content-hashed chunk filenames, so a merge-only copy
+            // would leave stale chunks from a previous build behind. Clear
+            // outDir immediately before copying a successful build into it —
+            // never on the failure path, which must leave it untouched.
+            await fs_1.promises.rm(args.outDir, { recursive: true, force: true });
+            await fs_1.promises.cp(path.join(buildDir, 'dist'), args.outDir, {
+                recursive: true,
+            });
+        }
         return [];
     }
     catch (error) {
+        if (error instanceof common_1.ParameterError)
+            throw error;
         return [
             issue('build', `Could not prepare the Vite build: ${(0, common_1.getErrorMessage)(error)}`),
         ];
@@ -420,6 +438,7 @@ const formatIssue = (entry) => {
         : '';
     return `${prefix}${entry.message}`;
 };
+exports.formatIssue = formatIssue;
 const referenceKindLabels = {
     query: 'query',
     savedChart: 'saved chart',
@@ -466,10 +485,10 @@ const renderAppsValidationHuman = (report, verbose = false) => {
             }
         }
         for (const warning of app.warnings) {
-            lines.push(`  ${styles.warning('warning')} ${formatIssue(warning)}`);
+            lines.push(`  ${styles.warning('warning')} ${(0, exports.formatIssue)(warning)}`);
         }
         for (const error of app.errors) {
-            lines.push(`  ${styles.error('error')} ${formatIssue(error)}`);
+            lines.push(`  ${styles.error('error')} ${(0, exports.formatIssue)(error)}`);
         }
     }
     lines.push('');

package/dist/index.js

@@ -8,6 +8,7 @@ const uuid_1 = require("uuid");
 const env_1 = require("./env");
 const error_1 = require("./error");
 const globalState_1 = tslib_1.__importDefault(require("./globalState"));
+const build_1 = require("./handlers/apps/build");
 const createApp_1 = require("./handlers/apps/createApp");
 const preview_1 = require("./handlers/apps/preview");
 const validate_1 = require("./handlers/apps/validate");
@@ -473,6 +474,12 @@ appsProgram
     .default('human'))
     .option('--verbose', undefined, false)
     .action(validate_1.appsValidateHandler);
+appsProgram
+    .command('build [path]')
+    .description('Build a data app or custom chart type with the same Vite production build as Lightdash Cloud, and keep the output.')
+    .option('--out-dir <dir>', 'Directory to write the built dist output to. Relative paths resolve against the current working directory (default: <path>/dist)')
+    .option('--verbose', undefined, false)
+    .action(build_1.appsBuildHandler);
 commander_1.program
     .command('deploy')
     .description('Compiles and deploys a Lightdash project')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "2.86.0",
+  "version": "2.88.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -45,8 +45,8 @@
     "unique-names-generator": "4.7.1",
     "uuid": "11.1.1",
     "yaml": "2.8.3",
-    "@lightdash/common": "2.86.0",
-    "@lightdash/warehouses": "2.86.0"
+    "@lightdash/warehouses": "2.88.0",
+    "@lightdash/common": "2.88.0"
   },
   "devDependencies": {
     "@types/inquirer": "8.2.4",