@metabase/cli 0.3.2-alpha.fix-transform-test-ee-path.8ac2a7a → 0.4.0

package/dist/{client-ClL6gf7G.mjs → client-ToLiPu9q.mjs}

@@ -1,22 +1,26 @@
-import { Q as ConfigError, et as InternalError, it as TimeoutError, rt as ResponseShapeError, st as errorMessage } from "./cli.mjs";
+import { at as ConfigError, ct as NetworkError, ft as ValidationError, lt as ResponseShapeError, mt as formatZodIssue, n as methodRequirements, ot as InternalError, pt as errorMessage, ut as TimeoutError } from "./cli.mjs";
 import { n as Notification, r as NotificationCardPayload, t as CARD_PAYLOAD_TYPE } from "./notification-DaA4bBHW.mjs";
-import { H as parseJsonOrPlain, L as HttpError } from "./runtime-Dtb93zKy.mjs";
-import { n as createTransport } from "./transport-CyVo29u7.mjs";
-import { a as FieldSearchMatches, i as FieldRemappedValue, l as FieldValues, n as FieldBaseType, o as FieldSemanticType, t as Field } from "./field-CcN4oZy6.mjs";
+import { $ as CapabilityError, B as assertCredentialHeaderSafe, G as normalizeUrl, H as credentialSecrets, I as isRetryableStatus, J as checkFeatures, L as JSON_CONTENT_TYPE, M as buildNetworkError, N as isConnectionClosed, P as HttpError, Q as probeServer, R as parseJson, V as credentialAuthHeader, X as createServerProfile, Z as PROBE_PATH, z as parseJsonOrPlain } from "./runtime-CZ5zh32z.mjs";
+import { n as throwIfAborted, r as untilAborted, t as combineAborts } from "./signal-CxWeLszu.mjs";
+import { f as FieldWithDataSensitivity, h as fieldRemappedValueSchema, m as fieldDetailSchema, n as FieldBaseType, o as FieldSearchMatches, s as FieldSemanticType, u as FieldValues } from "./field-5nivEfd6.mjs";
 import { a as TemporalUnit, r as ParameterValues } from "./parameter-Celg0wZa.mjs";
-import { a as CardQueryResult, l as DatasetQuery, s as CardType, t as Card } from "./card-voh1k4hl.mjs";
-import { c as TableVisibilityType, i as TableForeignKey, o as TableQueryMetadata, r as TableDataLayerTier, t as Table } from "./table-DfuY0N8e.mjs";
-import { t as Database } from "./database-JtHTqSpq.mjs";
+import { a as CardQueryResult, d as PivotExportFormat, l as DatasetQuery, t as Card } from "./card-Bv4ZN0oV.mjs";
+import { b as TableVisibilityType, p as TableQueryMetadata, s as TableDataLayerTier, t as Table, u as TableForeignKey, v as TableSelectors } from "./table-Ci6bhZkb.mjs";
+import { t as Database } from "./database-D-CRyRIv.mjs";
 import { t as Snippet } from "./snippet-CyKAgIZl.mjs";
-import { c as CollectionItem, i as CollectionAuthorityLevel, m as CollectionTreeNode, r as Collection, s as CollectionId } from "./collection-BxdPxD38.mjs";
+import { o as compiledQuerySchema, r as QueryMetadata } from "./dataset-p5oNPQgL.mjs";
+import { c as CollectionItem, m as CollectionTreeNode, r as Collection } from "./collection-D3KXhvnc.mjs";
 import { t as ContentTranslationUploadResult } from "./content-translation-BrHOrmj9.mjs";
-import { a as DashboardDetail, c as Dashcard, r as DashboardCopy, t as Dashboard } from "./dashboard-D0hwTC-f.mjs";
-import { r as pollUntil } from "./poll-KLl4Eq8Y.mjs";
-import { t as Document } from "./document-BHpLJbKU.mjs";
+import { l as Dashcard, o as DashboardDetail, r as DashboardCopy, t as Dashboard } from "./dashboard-Phz3XpRM.mjs";
+import { r as pollUntil } from "./poll-Dz4tUm2f.mjs";
+import { i as DependencyEntity, s as DependencyGraph, t as BreakingSource, u as DependencyNode } from "./dependency-DKSjKT8P.mjs";
+import { t as Document } from "./document-DFCj1Az_.mjs";
 import { i as EidTranslateResult } from "./eid-translation-zEHtr5Oc.mjs";
-import { c as SyncSettingsUpdateResult, i as SyncExportPreflight, n as SyncDirtyItem, p as isSyncTaskTerminal, s as SyncRemoteChanges, t as SyncBranchCreated, u as SyncTask } from "./git-sync-BwBRmEhE.mjs";
-import { a as toLibrary, i as libraryWireSchema, n as LibraryCollectionInfo } from "./library-BPIzb3K_.mjs";
+import { c as SyncRemoteChanges, d as SyncTask, i as SyncExportPreflight, l as SyncSettingsUpdateResult, m as isSyncTaskTerminal, n as SyncDirtyItem, t as SyncBranchCreated } from "./git-sync-COokpYgc.mjs";
+import { t as Glossary } from "./glossary-BlNCrYbw.mjs";
+import { a as libraryWireSchema, i as LibraryPublishTablesInput, n as LibraryCollectionInfo, o as toLibrary } from "./library-Ck0EK5bi.mjs";
 import { t as Measure } from "./measure-CtfjqJFP.mjs";
+import { r as ModerationReviewCreateInput, t as ModerationReview } from "./moderation-review-BdqEH6N1.mjs";
 import { t as Pulse } from "./pulse-Dz0ocv0l.mjs";
 import { a as TransformDagTransform, d as TransformTarget, g as transformRowSchema, h as transformDetailSchema, i as TransformDagRunResult, l as TransformRunSummary, m as isTransformRunTerminal, o as TransformRun, p as isTransformRunFailed, u as TransformSourceTableEntry } from "./transform-DiW7bREn.mjs";
 import { r as SearchResult } from "./search-BAXg-EJw.mjs";
@@ -26,9 +30,9 @@ import { n as SetupResult } from "./setup-CO7QV-ao.mjs";
 import { i as TimelineEvent, t as Timeline } from "./timeline-CCSU2qOS.mjs";
 import { c as transformJobSchema, n as TransformJobActiveResult, s as transformJobRunResultSchema } from "./transform-job-CCguL6LP.mjs";
 import { t as TransformTag } from "./transform-tag-CcElGp3C.mjs";
-import { i as TransformTestRunResult, t as TransformTest } from "./transform-test-BjjCQ2xm.mjs";
 import { t as UploadResult } from "./upload-DAtxBBms.mjs";
 import { z } from "zod";
+import { setTimeout } from "node:timers/promises";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -41,43 +45,324 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
-//#region ../client/src/domain/dataset.ts
-const CompiledQuery = z.object({
-	query: z.union([z.string(), z.array(z.unknown())]),
-	params: z.array(z.unknown()).nullable().optional(),
-	collection: z.string().optional()
-}).loose();
-const FieldRef = z.tuple([
-	z.literal("field"),
-	z.string(),
-	z.object({ "base-type": FieldBaseType }).loose()
+//#region ../client/src/http/response-shape.ts
+async function parseJsonResponse(text, schema, context) {
+	try {
+		return parseJson(text, schema, { source: context.url });
+	} catch (error) {
+		if (error instanceof ValidationError) throw ResponseShapeError.fromZodIssues({
+			kind: "zod",
+			method: context.method,
+			url: context.url,
+			status: context.status,
+			zodIssues: error.developerDetail.zodIssues,
+			serverTag: await context.getServerTag(),
+			serverSkew: context.serverSkew
+		});
+		throw error;
+	}
+}
+//#endregion
+//#region ../client/src/http/retry.ts
+const BASE_DELAY_MS = 250;
+const MAX_DELAY_MS = 8e3;
+const MS_PER_SECOND = 1e3;
+function backoffDelay({ attempt, retryAfterHeader }) {
+	const fromHeader = parseRetryAfter(retryAfterHeader);
+	if (fromHeader !== null) return fromHeader;
+	return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
+}
+function parseRetryAfter(header) {
+	if (!header) return null;
+	const numeric = Number(header);
+	if (Number.isFinite(numeric) && numeric >= 0) return Math.round(numeric * MS_PER_SECOND);
+	const dateMs = Date.parse(header);
+	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
+	return null;
+}
+function sleep(ms, signal) {
+	return setTimeout(ms, void 0, { signal });
+}
+async function runWithRetries(attempt, signal) {
+	let attemptIndex = 0;
+	while (true) {
+		const outcome = await attempt(attemptIndex);
+		if (outcome.kind === "success") return outcome.response;
+		await sleep(outcome.delayMs, signal);
+		attemptIndex += 1;
+	}
+}
+//#endregion
+//#region ../client/src/http/transport.ts
+const UNAUTHORIZED_STATUS = 401;
+const DEFAULT_TIMEOUT_MS = 3e4;
+const OCTET_STREAM_CONTENT_TYPE = "application/octet-stream";
+const TEXT_CONTENT_TYPE_PREFIX = "text/";
+const ERROR_BODY_BYTE_CAP = 64 * 1024;
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
 ]);
-const VirtualField = z.object({
-	id: z.union([z.number().int(), FieldRef]),
-	table_id: z.string(),
-	name: z.string(),
-	display_name: z.string(),
-	base_type: FieldBaseType,
-	semantic_type: FieldSemanticType.nullable(),
-	fk_target_field_id: z.number().int().nullable().optional()
-}).loose();
-const VirtualTable = z.object({
-	id: z.string(),
-	db_id: z.number().int(),
-	display_name: z.string(),
-	schema: z.string(),
-	description: z.string().nullable(),
-	type: CardType,
-	moderated_status: z.string().nullable(),
-	entity_id: z.string().nullable(),
-	fields: z.array(VirtualField)
-}).loose();
-const QueryMetadata = z.object({
-	databases: z.array(Database),
-	tables: z.array(z.union([TableQueryMetadata, VirtualTable])),
-	fields: z.array(Field),
-	snippets: z.array(Snippet)
-}).loose();
+function createTransport(config, options) {
+	const baseUrl = normalizeUrl(config.url);
+	assertCredentialHeaderSafe(config.credential);
+	const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+	let settledProfile = options.server ?? null;
+	const getServerTag = options.getServerTag ?? (async () => tagOf(settledProfile));
+	const serverSkew = () => settledProfile === null ? null : settledProfile.skew;
+	const refreshCredential = options.refreshCredential;
+	let credential = config.credential;
+	const knownSecrets = new Set(credentialSecrets(credential));
+	const redactionContext = { knownSecrets };
+	let refreshInFlight = null;
+	function tryRefreshCredential() {
+		const refresh = refreshCredential;
+		if (credential.kind !== "oauth" || refresh === void 0) return Promise.resolve(false);
+		refreshInFlight ??= refreshOnce(refresh).finally(() => {
+			refreshInFlight = null;
+		});
+		return refreshInFlight;
+	}
+	async function refreshOnce(refresh) {
+		const next = await refresh();
+		if (next === null) return false;
+		credential = next;
+		for (const secret of credentialSecrets(next)) knownSecrets.add(secret);
+		return true;
+	}
+	async function attemptOnce(prepared, attempt) {
+		const hasRetriesLeft = attempt < prepared.retries;
+		const timeoutSignal = AbortSignal.timeout(prepared.timeoutMs);
+		const combined = combineAborts(timeoutSignal, prepared.cancelSignal);
+		let response;
+		try {
+			response = await fetchImpl(prepared.url, {
+				method: prepared.method,
+				headers: prepared.headers,
+				body: prepared.body,
+				signal: combined
+			});
+		} catch (error) {
+			throwIfAborted(prepared.cancelSignal);
+			const isStaleSocketFirstTry = attempt === 0 && isConnectionClosed(error);
+			if (prepared.idempotent && (hasRetriesLeft || isStaleSocketFirstTry)) return {
+				kind: "retry",
+				delayMs: backoffDelay({ attempt })
+			};
+			if (timeoutSignal.aborted) throw new TimeoutError(`Request timed out after ${prepared.timeoutMs}ms`, {
+				kind: "http",
+				method: prepared.method,
+				url: prepared.url,
+				timeoutMs: prepared.timeoutMs
+			});
+			throw buildNetworkError(error, prepared.method, prepared.url);
+		}
+		const canRetryStatus = hasRetriesLeft && prepared.idempotent;
+		if (!response.ok && isRetryableStatus(response.status) && canRetryStatus) {
+			const retryAfter = response.headers.get("Retry-After");
+			response.body?.cancel().catch(() => void 0);
+			return {
+				kind: "retry",
+				delayMs: backoffDelay({
+					attempt,
+					retryAfterHeader: retryAfter
+				})
+			};
+		}
+		if (!response.ok) {
+			const rawBody = await readBodyForError(response);
+			const serverTag = await getServerTag();
+			throw new HttpError({
+				status: response.status,
+				statusText: response.statusText,
+				method: prepared.method,
+				url: prepared.url,
+				responseHeaders: response.headers,
+				rawBody,
+				serverTag,
+				redactionContext
+			});
+		}
+		assertContentType(response, prepared);
+		return {
+			kind: "success",
+			response
+		};
+	}
+	async function executeRaw(prepared) {
+		try {
+			return await runWithRetries((attempt) => attemptOnce(prepared, attempt), prepared.cancelSignal);
+		} catch (error) {
+			throwIfAborted(prepared.cancelSignal);
+			throw error;
+		}
+	}
+	async function executeWithAuthRefresh(path, opts) {
+		const prepared = prepare(path, opts);
+		try {
+			return {
+				response: await executeRaw(prepared),
+				prepared
+			};
+		} catch (error) {
+			if (error instanceof HttpError && error.status === UNAUTHORIZED_STATUS) {
+				if (await tryRefreshCredential()) {
+					const retried = prepare(path, opts);
+					return {
+						response: await executeRaw(retried),
+						prepared: retried
+					};
+				}
+			}
+			throw error;
+		}
+	}
+	function prepare(path, opts = {}) {
+		const method = opts.method ?? "GET";
+		const expectContentType = opts.expectContentType ?? "json";
+		const url = buildUrl(baseUrl, path, opts.query);
+		const headers = new Headers();
+		const auth = credentialAuthHeader(credential);
+		headers.set(auth.name, auth.value);
+		headers.set("accept", acceptHeader(expectContentType));
+		headers.set("user-agent", options.userAgent);
+		let body = null;
+		if (opts.body !== void 0 && opts.body !== null) if (typeof opts.body === "string" || opts.body instanceof URLSearchParams) body = opts.body;
+		else if (opts.body instanceof FormData || opts.body instanceof ReadableStream) body = opts.body;
+		else if (opts.body instanceof Uint8Array) {
+			body = opts.body;
+			headers.set("content-type", OCTET_STREAM_CONTENT_TYPE);
+		} else {
+			body = JSON.stringify(opts.body);
+			headers.set("content-type", JSON_CONTENT_TYPE);
+		}
+		return {
+			url,
+			method,
+			headers,
+			body,
+			expectContentType,
+			retries: opts.retries ?? 3,
+			idempotent: opts.idempotent ?? IDEMPOTENT_METHODS.has(method),
+			timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+			cancelSignal: combineAborts(opts.signal, options.signal)
+		};
+	}
+	let serverProfile = options.server === void 0 ? null : Promise.resolve(options.server);
+	async function server(wait = {}) {
+		throwIfAborted(wait.signal);
+		if (serverProfile === null) {
+			const probe = probeServer(transport).then((info) => {
+				settledProfile = createServerProfile(info);
+				return settledProfile;
+			});
+			probe.catch(() => {
+				serverProfile = null;
+			});
+			serverProfile = probe;
+		}
+		return untilAborted(serverProfile, wait.signal);
+	}
+	const enforceRequirements = options.enforceRequirements ?? true;
+	async function requireFeatures(features, wait = {}) {
+		if (!enforceRequirements || features.length === 0) return;
+		const failure = checkFeatures(features, await server(wait));
+		if (failure !== null) throw new CapabilityError(failure);
+	}
+	async function requireMethod(key, wait = {}) {
+		return requireFeatures(methodRequirements(key), wait);
+	}
+	const transport = {
+		server,
+		require: requireMethod,
+		requireFeatures,
+		async requestRaw(path, opts) {
+			return (await executeWithAuthRefresh(path, opts ?? {})).response;
+		},
+		async requestParsed(schema, path, opts) {
+			const { response, prepared } = await executeWithAuthRefresh(path, {
+				...opts,
+				expectContentType: "json"
+			});
+			return parseJsonResponse(await response.text(), schema, {
+				method: prepared.method,
+				url: prepared.url,
+				status: response.status,
+				getServerTag,
+				serverSkew: serverSkew()
+			});
+		},
+		async requestStream(path, opts) {
+			const { response, prepared } = await executeWithAuthRefresh(path, {
+				...opts,
+				expectContentType: opts?.expectContentType ?? "binary"
+			});
+			if (!response.body) throw new NetworkError("Response had no body to stream", {
+				method: prepared.method,
+				url: prepared.url,
+				cause: "missing body"
+			});
+			return response.body;
+		}
+	};
+	return transport;
+}
+function tagOf(profile) {
+	return profile === null ? null : profile.version.tag;
+}
+function buildUrl(baseUrl, path, query) {
+	const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+	const target = new URL(baseUrl + normalizedPath);
+	if (query) for (const [key, value] of Object.entries(query)) {
+		if (value === void 0) continue;
+		if (Array.isArray(value)) for (const entry of value) target.searchParams.append(key, String(entry));
+		else target.searchParams.append(key, String(value));
+	}
+	return target.toString();
+}
+function acceptHeader(expected) {
+	if (expected === "json") return JSON_CONTENT_TYPE;
+	if (expected === "text") return "text/*";
+	return "*/*";
+}
+function assertContentType(response, prepared) {
+	if (prepared.expectContentType === "binary") return;
+	const contentType = response.headers.get("content-type");
+	if (contentType === null) throwContentTypeMismatch(response, prepared, prepared.expectContentType);
+	if (prepared.expectContentType === "json" && !contentType.includes("application/json")) throwContentTypeMismatch(response, prepared, "json");
+	if (prepared.expectContentType === "text" && !contentType.startsWith(TEXT_CONTENT_TYPE_PREFIX)) throwContentTypeMismatch(response, prepared, "text");
+}
+function throwContentTypeMismatch(response, prepared, expected) {
+	const actual = response.headers.get("content-type") ?? "no content-type";
+	throw new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method: prepared.method,
+		url: prepared.url,
+		responseHeaders: response.headers,
+		rawBody: null,
+		overrideUserMessage: `Expected ${expected} response but got ${actual}`
+	});
+}
+async function readBodyForError(response) {
+	try {
+		return Buffer.from(await response.arrayBuffer()).subarray(0, ERROR_BODY_BYTE_CAP).toString("utf8");
+	} catch (error) {
+		return `[body read failed: ${errorMessage(error)}]`;
+	}
+}
+//#endregion
+//#region ../client/src/resources/pivot-export.ts
+const PivotedExportsSetting = z.object({ "enable-pivoted-exports": z.boolean() });
+/**
+* Refuse a pivoted export the server would answer with plain rows: a JSON export keeps only the
+* ungrouped rows, and an admin can turn pivoted CSV and XLSX exports off.
+*/
+async function assertPivotedExport(transport, format, options) {
+	if (!PivotExportFormat.safeParse(format).success) throw new ConfigError(`a ${format} export cannot be pivoted; only ${PivotExportFormat.options.join(" and ")} can`);
+	if (!(await transport.requestParsed(PivotedExportsSetting, "/api/session/properties", { ...options }))["enable-pivoted-exports"]) throw new ConfigError("the server has pivoted exports turned off (the enable-pivoted-exports setting), so it would export the plain rows");
+}
 //#endregion
 //#region ../client/src/resources/card.ts
 const CardApiList = z.array(Card);
@@ -134,15 +419,22 @@ function cardResource(transport) {
 		});
 	}
 	/**
-	* Run a saved card and stream its result as a download. Unlike `query`, this endpoint takes a
-	* form-encoded body and answers bytes, so a caller consumes the stream rather than a value.
+	* Run the query associated with a Card, and return its results as a file in the specified
+	* format. Unlike `query`, this endpoint takes a form-encoded body and answers bytes, so a caller
+	* consumes the stream rather than a value. A pivot the server would answer with plain rows (a
+	* JSON export, or pivoted exports turned off) is refused. `csv_include_bom` opens a CSV with a
+	* UTF-8 byte order mark; a server without it drops the key silently, so asking for one is refused
+	* there before the wire.
 	*/
 	async function exportQuery(id, format, params, options = {}) {
 		await transport.require("card.exportQuery", options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
+		if (params.pivot_results) await assertPivotedExport(transport, format, options);
 		const body = new URLSearchParams({
 			parameters: JSON.stringify(params.parameters),
 			format_rows: String(params.format_rows),
-			pivot_results: String(params.pivot_results)
+			pivot_results: String(params.pivot_results),
+			csv_include_bom: String(params.csv_include_bom)
 		});
 		return transport.requestStream(`/api/card/${id}/query/${format}`, {
 			...options,
@@ -226,20 +518,20 @@ function refPath(ref) {
 	return encodeURIComponent(ref);
 }
 /**
-* List collections including the Library and its children, parsing each through the caller's own
-* projection. `Collection` pins `type`, `namespace` and `authority_level` to closed enums, so a
-* consumer reading a few fields off every collection on the instance narrows here: one collection
-* carrying a server value outside those sets then costs nothing to a caller that never reads the
-* field.
+* List every collection the caller can read, the Library and its children among them, parsing each
+* through the caller's own projection. `Collection` pins `type`, `namespace` and `authority_level`
+* to closed enums, so a consumer reading a few fields off every collection on the instance narrows
+* here: one collection carrying a server value outside those sets then costs nothing to a caller
+* that never reads the field.
 */
-async function listCollectionsWithLibrary(transport, schema, options = {}) {
-	return transport.requestParsed(z.array(schema), "/api/collection", {
-		...options,
-		query: { "include-library": true }
-	});
+async function listCollectionsAs(transport, schema, options = {}) {
+	return transport.requestParsed(z.array(schema), "/api/collection", { ...options });
 }
 function collectionResource(transport) {
-	/** List collections. `filter` picks a server-side preset: everything, archived, or personal. */
+	/**
+	* List collections. `filter` picks a server-side preset: everything, archived, or personal. Every
+	* preset includes the Library collections that match it.
+	*/
 	async function list(params = {}, options = {}) {
 		await transport.require("collection.list", options);
 		return {
@@ -250,18 +542,6 @@ function collectionResource(transport) {
 			total: null
 		};
 	}
-	/**
-	* List collections including the Library and its children, which the plain listing omits.
-	* The Library's own children carry neither `type` nor `is_remote_synced`, so this is where a
-	* caller resolves both.
-	*/
-	async function listWithLibrary(options = {}) {
-		await transport.require("collection.listWithLibrary", options);
-		return {
-			data: await listCollectionsWithLibrary(transport, Collection, options),
-			total: null
-		};
-	}
 	/** Get one collection by id, entity id, or the `root`/`trash` alias. */
 	async function get(ref, options = {}) {
 		await transport.require("collection.get", options);
@@ -276,7 +556,11 @@ function collectionResource(transport) {
 			body: params
 		});
 	}
-	/** Update a collection, patching only the fields the body carries. */
+	/**
+	* Update a collection, patching the fields the body carries. The server reads an absent
+	* `archived` as `false`, so a patch without it restores an archived collection, and a patch that
+	* moves a collection into the trash ignores `parent_id`.
+	*/
 	async function update(ref, params, options = {}) {
 		await transport.require("collection.update", options);
 		return transport.requestParsed(Collection, `/api/collection/${refPath(ref)}`, {
@@ -309,16 +593,18 @@ function collectionResource(transport) {
 		});
 	}
 	/** Fetch the collection hierarchy as a forest of nested nodes. */
-	async function tree(options = {}) {
+	async function tree(params = {}, options = {}) {
 		await transport.require("collection.tree", options);
 		return {
-			data: await transport.requestParsed(CollectionTreeApiList, "/api/collection/tree", { ...options }),
+			data: await transport.requestParsed(CollectionTreeApiList, "/api/collection/tree", {
+				...options,
+				query: { "include-library": params["include-library"] }
+			}),
 			total: null
 		};
 	}
 	return {
 		list,
-		listWithLibrary,
 		get,
 		create,
 		update,
@@ -407,9 +693,13 @@ function dashboardResource(transport) {
 	}
 	/**
 	* Copy a dashboard, with its tabs and dashcards, into `collection_id` (root when absent). A deep
-	* copy duplicates the cards it can; otherwise the copy references them, except dashboard
-	* questions, which are always duplicated. Cards the caller cannot read are left behind and
-	* reported as `uncopied`.
+	* copy duplicates its questions and metrics and references its models. With `is_deep_copy`
+	* false or absent the copy references every card, and a dashboard holding unarchived dashboard
+	* questions is refused. Archived cards, cards the caller cannot read, and every card on a
+	* dashcard whose main card the caller cannot read are left out and reported as `uncopied`, once
+	* per dashcard they sat on. A left-out main card takes its dashcard with it; a left-out series
+	* card stays on a dashcard whose main card is referenced and is dropped from one whose main card
+	* is duplicated. Action, link and placeholder dashcards are not copied.
 	*/
 	async function copy(id, params = {}, options = {}) {
 		await transport.require("dashboard.copy", options);
@@ -663,7 +953,8 @@ function datasetResource(transport) {
 	*/
 	async function native(datasetQuery, params = {}, options = {}) {
 		await transport.require("dataset.native", options);
-		return transport.requestParsed(CompiledQuery, "/api/dataset/native", {
+		const { features } = await transport.server(options);
+		return transport.requestParsed(compiledQuerySchema(features), "/api/dataset/native", {
 			...options,
 			method: "POST",
 			body: {
@@ -686,18 +977,33 @@ function datasetResource(transport) {
 		});
 	}
 	/**
-	* Run an ad-hoc query and stream its result as a download. Unlike `query`, this endpoint answers
-	* bytes, so a caller consumes the stream rather than a value.
+	* Execute a query and download the result data as a file in the specified format. Unlike
+	* `query`, this endpoint answers bytes, so a caller consumes the stream rather than a value.
+	* `visualization_settings` drive `format_rows` column formatting and, through
+	* `pivot_table.column_split`, the layout `pivot_results` lays the rows out in. The server only
+	* computes that layout for a query it runs as a pivot, which it reads from the query's own
+	* `was-pivot`, so `pivot_results` sets it. A pivot the server would answer with plain rows (a
+	* JSON export, or pivoted exports turned off) is refused. `csv_include_bom` opens a CSV with a
+	* UTF-8 byte order mark; a server without it drops the key silently, so asking for one is refused
+	* there before the wire.
 	*/
 	async function exportQuery(format, params, options = {}) {
 		await transport.require("dataset.exportQuery", options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
+		if (params.pivot_results) await assertPivotedExport(transport, format, options);
+		const exported = params.pivot_results ? {
+			...params.query,
+			"was-pivot": true
+		} : params.query;
 		return transport.requestStream(`/api/dataset/${format}`, {
 			...options,
 			method: "POST",
 			body: {
-				query: params.query,
+				query: exported,
+				visualization_settings: params.visualization_settings,
 				format_rows: params.format_rows,
-				pivot_results: params.pivot_results
+				pivot_results: params.pivot_results,
+				csv_include_bom: params.csv_include_bom
 			}
 		});
 	}
@@ -709,133 +1015,18 @@ function datasetResource(transport) {
 	};
 }
 //#endregion
-//#region ../client/src/domain/dependency.ts
-const DependencyType = z.enum([
-	"table",
-	"card",
-	"snippet",
-	"transform",
-	"dashboard",
-	"document",
-	"sandbox",
-	"segment",
-	"measure"
-]);
-const DependencyUsageType = z.enum([
-	"table",
-	"snippet",
-	"transform",
-	"dashboard",
-	"document",
-	"sandbox",
-	"segment",
-	"question",
-	"model",
-	"metric",
-	"measure"
-]);
-const DependencyFindingErrorType = z.enum([
-	"missing-column",
-	"missing-table-alias",
-	"missing-table",
-	"missing-card",
-	"duplicate-column",
-	"syntax-error",
-	"validation-exception-error"
-]);
-const DependencyErrorSourceType = z.enum([
-	"table",
-	"card",
-	"transform"
-]);
-z.enum([
-	"name",
-	"location",
-	"view-count"
-]);
-z.enum([
-	"name",
-	"location",
-	"dependents-with-errors",
-	"dependents-errors"
-]);
-const DependencyCollectionRef = z.object({
-	id: CollectionId,
-	name: z.string(),
-	authority_level: CollectionAuthorityLevel.nullable(),
-	is_personal: z.boolean().optional()
-}).loose();
-const DependencyContainerRef = z.object({
-	id: z.number().int(),
-	name: z.string()
-}).loose();
-const DependencyEntityData = z.object({
-	name: z.string().nullable().optional(),
-	display_name: z.string().nullable().optional(),
-	description: z.string().nullable().optional(),
-	type: CardType.nullable().optional(),
-	display: z.string().nullable().optional(),
-	database_id: z.number().int().nullable().optional(),
-	db_id: z.number().int().nullable().optional(),
-	schema: z.string().nullable().optional(),
-	collection_id: CollectionId.nullable().optional(),
-	collection: DependencyCollectionRef.nullable().optional(),
-	dashboard_id: z.number().int().nullable().optional(),
-	dashboard: DependencyContainerRef.nullable().optional(),
-	document_id: z.number().int().nullable().optional(),
-	document: DependencyContainerRef.nullable().optional(),
-	table_id: z.number().int().nullable().optional(),
-	view_count: z.number().int().nullable().optional()
-}).loose();
-const DependencyEntity = z.object({
-	id: z.number().int(),
-	type: DependencyType,
-	data: DependencyEntityData
-}).loose();
-const DependencyNode = DependencyEntity.extend({ dependents_count: z.partialRecord(DependencyUsageType, z.number().int()).nullable() });
-const DependencyFindingError = z.object({
-	id: z.number().int(),
-	analyzed_entity_type: DependencyType,
-	analyzed_entity_id: z.number().int(),
-	error_type: DependencyFindingErrorType,
-	error_detail: z.string().nullable().optional(),
-	source_entity_type: DependencyErrorSourceType.nullable().optional(),
-	source_entity_id: z.number().int().nullable().optional()
-}).loose();
-const BreakingSource = DependencyNode.extend({ dependents_errors: z.array(DependencyFindingError).nullable().optional() });
-const DependencyEdge = z.object({
-	from_entity_type: DependencyType,
-	from_entity_id: z.number().int(),
-	to_entity_type: DependencyType,
-	to_entity_id: z.number().int()
-}).loose();
-const DependencyGraph = z.object({
-	nodes: z.array(DependencyNode),
-	edges: z.array(DependencyEdge)
-}).loose();
-//#endregion
 //#region ../client/src/resources/dependency.ts
 const DependencyNodeApiList = z.array(DependencyNode);
 const DependencyEntityApiList = z.array(DependencyEntity);
-const RENAMED_FILTERS = [
-	"dependent-types",
-	"dependent-card-types",
-	"card-types",
-	"include-personal-collections",
-	"sort-column",
-	"sort-direction"
-];
-function filterFeatures(params) {
-	return RENAMED_FILTERS.some((key) => params[key] !== void 0) ? ["dependencyKebabCaseFilters"] : [];
-}
 function dependencyResource(transport) {
 	/**
 	* The upstream dependency graph of one entity. `nodes` holds the starting entity plus every
 	* entity it depends on, directly or transitively; each edge runs from the dependent to what it
-	* depends on.
+	* depends on. A measure starts a graph only on a server with `measureDependencyGraph`.
 	*/
 	async function graph(type, id, options = {}) {
 		await transport.require("dependency.graph", options);
+		if (type === "measure") await transport.requireFeatures(["measureDependencyGraph"], options);
 		return transport.requestParsed(DependencyGraph, "/api/ee/dependencies/graph", {
 			...options,
 			query: {
@@ -852,7 +1043,6 @@ function dependencyResource(transport) {
 	*/
 	async function dependents(type, id, params = {}, options = {}) {
 		await transport.require("dependency.dependents", options);
-		await transport.requireFeatures(filterFeatures(params), options);
 		return {
 			data: await transport.requestParsed(DependencyNodeApiList, "/api/ee/dependencies/graph/dependents", {
 				...options,
@@ -879,7 +1069,6 @@ function dependencyResource(transport) {
 	*/
 	async function broken(type, id, params = {}, options = {}) {
 		await transport.require("dependency.broken", options);
-		await transport.requireFeatures(filterFeatures(params), options);
 		return {
 			data: await transport.requestParsed(DependencyEntityApiList, "/api/ee/dependencies/graph/broken", {
 				...options,
@@ -897,15 +1086,23 @@ function dependencyResource(transport) {
 		};
 	}
 	/**
-	* Walk the entities nothing depends on, one page at a time. `types` and `card-types` narrow
-	* which kinds are listed, `query` matches against names and locations,
+	* Walk the entities that no readable, unarchived dependent depends on, one page at a time: an
+	* entity used only by archived content, or by content the caller cannot read, is listed. `types`
+	* and `card-types` narrow which kinds are listed, `query` matches against names and locations,
 	* `include-personal-collections` admits content in personal collections, and `sort-column` /
-	* `sort-direction` order the result. This endpoint pages on the server, so the caller consumes
-	* pages and decides how far to pull.
+	* `sort-direction` order the result. A `query` leaves sandboxes out, since they have no name or
+	* location to match, so sandboxes alone with a `query` answer one empty page without a request.
+	* This endpoint pages on the server, so the caller consumes pages and decides how far to pull.
 	*/
 	async function* unreferencedPages(params = {}, options = {}) {
 		await transport.require("dependency.unreferencedPages", options);
-		await transport.requireFeatures(filterFeatures(params), options);
+		if (queryLeavesNoKind(params)) {
+			yield {
+				items: [],
+				total: 0
+			};
+			return;
+		}
 		yield* paginatePages(transport, "/api/ee/dependencies/graph/unreferenced", DependencyNode, {
 			query: itemListQuery(params),
 			...options.offset !== void 0 && { offset: options.offset },
@@ -923,7 +1120,13 @@ function dependencyResource(transport) {
 	*/
 	async function* breakingPages(params = {}, options = {}) {
 		await transport.require("dependency.breakingPages", options);
-		await transport.requireFeatures(filterFeatures(params), options);
+		if (queryLeavesNoKind(params)) {
+			yield {
+				items: [],
+				total: 0
+			};
+			return;
+		}
 		yield* paginatePages(transport, "/api/ee/dependencies/graph/breaking", BreakingSource, {
 			query: itemListQuery(params),
 			...options.offset !== void 0 && { offset: options.offset },
@@ -940,9 +1143,14 @@ function dependencyResource(transport) {
 		breakingPages
 	};
 }
+function queryLeavesNoKind(params) {
+	const { query, types } = params;
+	if (query === void 0 || types === void 0 || types.length === 0) return false;
+	return types.every((type) => type === "sandbox");
+}
 function itemListQuery(params) {
 	return {
-		types: params.types,
+		types: params.types === void 0 ? void 0 : [...new Set(params.types)],
 		"card-types": params["card-types"],
 		query: params.query,
 		"include-personal-collections": params["include-personal-collections"],
@@ -1109,21 +1317,39 @@ async function fetchOptionalParsed(client, path, schema, options = {}) {
 //#region ../client/src/resources/field.ts
 const FieldApiSummary = z.tuple([z.tuple([z.literal("count"), z.number().int()]), z.tuple([z.literal("distincts"), z.number().int()])]);
 function fieldResource(transport) {
-	/** Get one field by id. */
+	/**
+	* Get one field by id. A server that labels data sensitivity answers `data_sensitivity`, `null`
+	* for an unlabelled field; any other answers the field without the key (`hasDataSensitivity`).
+	*/
 	async function get(id, options = {}) {
 		await transport.require("field.get", options);
-		return transport.requestParsed(Field, `/api/field/${id}`, { ...options });
+		const { features } = await transport.server(options);
+		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, { ...options });
 	}
 	/**
 	* Update a field by id, patching only the fields the body carries. A `data_sensitivity` label is
 	* a person's call the server's classifier never overwrites, and `null` withdraws it so the
 	* classifier's own applies again; a server without the column would drop the key silently, so
-	* the label is refused there before the wire.
+	* the label is refused there before the wire. Answers the field the way `get` does.
 	*/
 	async function update(id, params, options = {}) {
 		await transport.require("field.update", options);
 		await transport.requireFeatures(params.data_sensitivity === void 0 ? [] : ["fieldDataSensitivity"], options);
-		return transport.requestParsed(Field, `/api/field/${id}`, {
+		const { features } = await transport.server(options);
+		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, {
+			...options,
+			method: "PUT",
+			body: params
+		});
+	}
+	/**
+	* Label a field's data sensitivity by hand. A person's label is never overwritten by the server's
+	* classifier; `null` withdraws it, so whatever label the classifier wrote shows again. Answers
+	* the field with the label it now carries.
+	*/
+	async function setDataSensitivity(id, params, options = {}) {
+		await transport.require("field.setDataSensitivity", options);
+		return transport.requestParsed(FieldWithDataSensitivity, `/api/field/${id}`, {
 			...options,
 			method: "PUT",
 			body: params
@@ -1131,8 +1357,11 @@ function fieldResource(transport) {
 	}
 	/**
 	* Search the values of `searchId` that contain `value`, case-insensitively, answering the
-	* matching values of `id` paired with them. An FK on either side is followed to the PK it
-	* points at. Without `value`, the first `limit` values.
+	* matching values of `id` paired with them, ordered by value, at most `limit` of them. An FK on
+	* either side is followed to the PK it points at, and a field that resolves to the same field as
+	* `searchId` answers each value alone. Without `value`, the first `limit` values. A field with
+	* custom display values answers every mapped value with its display value instead, matching
+	* `value` against the display value, ignoring both `searchId` and `limit`.
 	*/
 	async function search(id, searchId, params, options = {}) {
 		await transport.require("field.search", options);
@@ -1146,11 +1375,13 @@ function fieldResource(transport) {
 	}
 	/**
 	* The value of `remappedId` on the one row where `id` equals `value`, as `[value, remapped]`,
-	* or `null` when no row matches. `value` is parsed as a number for a numeric field.
+	* or `null` when no row matches. For a numeric field the server reads the leading number of
+	* `value` and ignores any text after it, refusing only a `value` that has none.
 	*/
 	async function remapping(id, remappedId, params, options = {}) {
 		await transport.require("field.remapping", options);
-		return fetchOptionalParsed(transport, `/api/field/${id}/remapping/${remappedId}`, FieldRemappedValue, {
+		const { features } = await transport.server(options);
+		return fetchOptionalParsed(transport, `/api/field/${id}/remapping/${remappedId}`, fieldRemappedValueSchema(features, id === remappedId), {
 			...options,
 			query: { value: params.value }
 		});
@@ -1173,6 +1404,7 @@ function fieldResource(transport) {
 	return {
 		get,
 		update,
+		setDataSensitivity,
 		search,
 		remapping,
 		summary,
@@ -1204,6 +1436,7 @@ const SyncStashStarted = z.object({
 	task_id: z.number().int().positive()
 });
 const RemoteSyncSetting = z.string().nullable();
+const RemoteSyncBranchProperty = z.object({ "remote-sync-branch": z.string().nullable().optional() });
 const FORBIDDEN_STATUS = 403;
 const UNREGISTERED_STATUS = 404;
 function isRemoteUnreadable(error) {
@@ -1251,16 +1484,24 @@ function gitSyncResource(transport) {
 	/**
 	* Import content from the remote into Metabase. The endpoint queues a task and returns at once;
 	* pass `wait` to poll that task until it reaches a terminal status. A server already up to date
-	* answers no task id, and there is then nothing to poll.
+	* answers no task id, and there is then nothing to poll. A server that guards the tracked branch
+	* refuses with 409 when `expected_branch` disagrees with the setting; left out, it is the tracked
+	* branch as read just before the request. `merge` folds the remote's changes into local content
+	* by a three-way merge and keeps un-pushed local changes, where a plain import refuses on a dirty
+	* instance.
 	*/
 	async function importFromRemote(params = {}, options = {}) {
 		await transport.require("gitSync.import", options);
+		await requireMerge(params.merge, options);
+		const expectedBranch = await guardedBranch(params.expected_branch, options);
 		const started = await transport.requestParsed(SyncImportStarted, "/api/ee/remote-sync/import", {
 			...options,
 			method: "POST",
 			body: {
 				branch: params.branch,
-				force: params.force
+				force: params.force,
+				merge: params.merge,
+				expected_branch: expectedBranch
 			}
 		});
 		const message = started.message ?? null;
@@ -1274,19 +1515,36 @@ function gitSyncResource(transport) {
 			final: await settle(params.wait, options)
 		};
 	}
+	async function requireMerge(merge, options) {
+		if (merge === true) await transport.requireFeatures(["remoteSyncMerge"], options);
+	}
+	async function guardedBranch(given, options) {
+		if (given !== void 0) return given;
+		const { features } = await transport.server(options);
+		if (!features.remoteSyncBranchGuard) return;
+		return trackedBranch(options);
+	}
 	/**
 	* Export Metabase's content to the remote. The endpoint queues a task and returns at once; pass
-	* `wait` to poll that task until it reaches a terminal status.
+	* `wait` to poll that task until it reaches a terminal status. A server that guards the tracked
+	* branch refuses with 409 when `branch` is not the tracked one; left out, it is the tracked branch
+	* as read just before the request there, and the server's own default elsewhere. When the remote
+	* has moved past the last sync, a plain export ends in a `conflict` task where `merge` is
+	* available, and is refused with 400 before any task elsewhere; `merge` folds the remote's changes
+	* in by a three-way merge instead, and `force` overwrites them.
 	*/
 	async function exportToRemote(params = {}, options = {}) {
 		await transport.require("gitSync.export", options);
+		await requireMerge(params.merge, options);
+		const branchName = await guardedBranch(params.branch, options);
 		const started = await transport.requestParsed(SyncExportStarted, "/api/ee/remote-sync/export", {
 			...options,
 			method: "POST",
 			body: {
-				branch: params.branch,
+				branch: branchName,
 				message: params.message,
-				force: params.force
+				force: params.force,
+				merge: params.merge
 			}
 		});
 		if (params.wait === void 0) return {
@@ -1371,7 +1629,7 @@ function gitSyncResource(transport) {
 	async function syncedCollections(options = {}) {
 		await transport.require("gitSync.syncedCollections", options);
 		return {
-			data: (await listCollectionsWithLibrary(transport, SyncScopeCollection, options)).filter((entry) => entry.is_remote_synced === true),
+			data: (await listCollectionsAs(transport, SyncScopeCollection, options)).filter((entry) => entry.is_remote_synced === true),
 			total: null
 		};
 	}
@@ -1387,17 +1645,22 @@ function gitSyncResource(transport) {
 		}
 	}
 	/**
-	* The branch git-sync tracks, or null when none is configured, the caller may not read it, or
-	* the server has no remote-sync module.
+	* The branch git-sync tracks, or null when none is configured. Refuses when the caller may not
+	* read the setting (it is admin-only) or the server has no remote-sync module, rather than
+	* reading either as unset.
 	*/
 	async function branch(options = {}) {
 		await transport.require("gitSync.branch", options);
-		try {
-			return await fetchOptionalParsed(transport, "/api/setting/remote-sync-branch", RemoteSyncSetting, options);
-		} catch (error) {
-			if (isRemoteUnreadable(error)) return null;
-			throw error;
-		}
+		const tracked = (await transport.requestParsed(RemoteSyncBranchProperty, PROBE_PATH, { ...options }))["remote-sync-branch"];
+		if (tracked === void 0) throw new ConfigError("the remote-sync-branch setting is not readable: it is visible to admins only, and absent on a server without the remote-sync module");
+		return tracked;
+	}
+	/** The branch git-sync tracks, refused when none is configured or the caller may not read it. */
+	async function trackedBranch(options = {}) {
+		await transport.require("gitSync.trackedBranch", options);
+		const tracked = await branch(options);
+		if (tracked === null) throw new ConfigError("git-sync tracks no branch: the remote-sync-branch setting is unset");
+		return tracked;
 	}
 	/**
 	* Poll the current task until it reaches a terminal status. A server with no task at all
@@ -1429,36 +1692,11 @@ function gitSyncResource(transport) {
 		syncedCollections,
 		remoteUrl,
 		branch,
+		trackedBranch,
 		waitForTask
 	};
 }
 //#endregion
-//#region ../client/src/domain/glossary.ts
-const GlossaryCreator = z.object({
-	id: z.number().int(),
-	email: z.string(),
-	first_name: z.string().nullable(),
-	last_name: z.string().nullable()
-}).loose();
-const Glossary = z.object({
-	id: z.number().int(),
-	term: z.string(),
-	definition: z.string(),
-	creator_id: z.number().int(),
-	creator: GlossaryCreator,
-	created_at: z.string(),
-	updated_at: z.string()
-}).loose();
-Glossary.pick({
-	id: true,
-	term: true,
-	definition: true
-}).strip();
-z.object({
-	term: z.string().min(1),
-	definition: z.string().min(1)
-}).strict();
-//#endregion
 //#region ../client/src/resources/glossary.ts
 const GlossaryApiList = z.object({ data: z.array(Glossary) }).loose();
 function glossaryResource(transport) {
@@ -1511,6 +1749,17 @@ function glossaryResource(transport) {
 	};
 }
 //#endregion
+//#region ../client/src/resources/request-body.ts
+/**
+* Parse the body a caller hands a method, refusing one that does not match `schema` before any
+* request. `what` names the body in the refusal.
+*/
+function parseRequestBody(schema, value, what) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) throw new ConfigError(`invalid ${what}: ${parsed.error.issues.map(formatZodIssue).join("; ")}`);
+	return parsed.data;
+}
+//#endregion
 //#region ../client/src/resources/library.ts
 const LIBRARY_ROOT_PATH = "/api/ee/library/";
 const PUBLISH_TABLES_PATH = "/api/ee/data-studio/table/publish-tables";
@@ -1527,7 +1776,7 @@ function libraryResource(transport) {
 		return toLibrary(wire, await libraryListing(options));
 	}
 	async function libraryListing(options) {
-		const data = await listCollectionsWithLibrary(transport, LibraryCollectionInfo, options);
+		const data = await listCollectionsAs(transport, LibraryCollectionInfo, options);
 		const byId = /* @__PURE__ */ new Map();
 		for (const collection of data) if (typeof collection.id === "number") byId.set(collection.id, collection);
 		return byId;
@@ -1560,26 +1809,31 @@ function libraryResource(transport) {
 	}
 	/**
 	* Publish tables — and every upstream table they depend on — into a collection, so they lead the
-	* data pickers and rank up in search. Answers the collection they landed in.
+	* data pickers and rank up in search. Answers the collection they landed in. The endpoint
+	* answers the same whether or not the selectors matched a table, so a body that does not match
+	* `LibraryPublishTablesInput` is refused before any request.
 	*/
 	async function publishTables(params, options = {}) {
 		await transport.require("library.publishTables", options);
+		const body = parseRequestBody(LibraryPublishTablesInput, params, "tables to publish");
 		return (await transport.requestParsed(PublishTablesResponse, PUBLISH_TABLES_PATH, {
 			...options,
 			method: "POST",
-			body: params
+			body
 		})).target_collection;
 	}
 	/**
 	* Clear the Library collection from tables, and recursively from every downstream table that
-	* depends on them. The endpoint answers no JSON body.
+	* depends on them. The endpoint answers no JSON body, whether or not the selectors matched a
+	* table, so selectors that do not match `TableSelectors` are refused before any request.
 	*/
 	async function unpublishTables(params, options = {}) {
 		await transport.require("library.unpublishTables", options);
+		const body = parseRequestBody(TableSelectors, params, "table selectors");
 		await transport.requestRaw(UNPUBLISH_TABLES_PATH, {
 			...options,
 			method: "POST",
-			body: params,
+			body,
 			expectContentType: "binary"
 		});
 	}
@@ -1832,48 +2086,21 @@ function metricResource(transport) {
 	};
 }
 //#endregion
-//#region ../client/src/domain/moderation-review.ts
-const ModeratedItemType = z.enum(["card", "dashboard"]);
-const ModerationStatus = z.enum(["verified"]);
-const ModerationReview = z.object({
-	id: z.number().int(),
-	moderated_item_id: z.number().int(),
-	moderated_item_type: ModeratedItemType,
-	moderator_id: z.number().int(),
-	status: ModerationStatus.nullable(),
-	text: z.string().nullable(),
-	most_recent: z.boolean(),
-	created_at: z.string(),
-	updated_at: z.string()
-}).loose();
-ModerationReview.pick({
-	id: true,
-	moderated_item_id: true,
-	moderated_item_type: true,
-	status: true,
-	text: true,
-	most_recent: true
-}).strip();
-z.object({
-	moderated_item_id: z.number().int().positive(),
-	moderated_item_type: ModeratedItemType,
-	status: ModerationStatus.nullable().optional(),
-	text: z.string().nullable().optional()
-}).strict();
-//#endregion
 //#region ../client/src/resources/moderation-review.ts
 function moderationReviewResource(transport) {
 	/**
 	* Create a moderation review on a card or dashboard. `status: "verified"` marks the item
 	* verified, `null` or an absent status records a note that leaves it unverified. The new review
 	* becomes the item's most recent one; the server keeps the ten newest per item. Admins only.
+	* A body that does not match `ModerationReviewCreateInput` is refused before any request.
 	*/
 	async function create(params, options = {}) {
 		await transport.require("moderationReview.create", options);
+		const body = parseRequestBody(ModerationReviewCreateInput, params, "moderation review");
 		return transport.requestParsed(ModerationReview, "/api/moderation-review", {
 			...options,
 			method: "POST",
-			body: params
+			body
 		});
 	}
 	return { create };
@@ -2394,8 +2621,10 @@ function searchResource(transport) {
 	* may match, `archived` swaps the active set for the archived one, `table_db_id` restricts to
 	* items on one database, `verified` to verified content, `collection` to one collection and its
 	* descendants, `created_by` to items created by any of those users, `search_native_query` also
-	* matches the text of native queries, `include_metadata` attaches each card's `result_metadata`,
-	* and `limit`/`offset` are the window the server applies before ranking hydration.
+	* matches native query text but narrows to the models that carry one (cards, models, metrics,
+	* actions, transforms), `include_metadata` attaches each card's `result_metadata`,
+	* `include_dashboard_questions` also matches questions saved into a dashboard (excluded by
+	* default), and `limit`/`offset` are the window the server applies before ranking hydration.
 	*/
 	async function query(params = {}, options = {}) {
 		await transport.require("search.query", options);
@@ -2412,7 +2641,8 @@ function searchResource(transport) {
 				collection: params.collection,
 				created_by: params.created_by,
 				search_native_query: params.search_native_query,
-				include_metadata: params.include_metadata
+				include_metadata: params.include_metadata,
+				include_dashboard_questions: params.include_dashboard_questions
 			}
 		});
 		return {
@@ -2596,14 +2826,18 @@ function snippetResource(transport) {
 const TableApiList = z.array(Table);
 const TableApiFks = z.array(TableForeignKey);
 const SyncSchemaResponse = z.object({ status: z.literal("ok") });
-const RescanValuesResponse = z.object({ status: z.literal("success") });
+const FieldValuesResponse = z.object({ status: z.literal("success") });
 const BulkEditResponse = z.object({});
 const BULK_EDIT_PATH = "/api/data-studio/table/edit";
+const BULK_SYNC_SCHEMA_PATH = "/api/data-studio/table/sync-schema";
+const BULK_RESCAN_VALUES_PATH = "/api/data-studio/table/rescan-values";
+const BULK_DISCARD_VALUES_PATH = "/api/data-studio/table/discard-values";
 const LIST_PARAM_FEATURES = [
 	["can-query", "tableListAccessFilters"],
 	["can-write", "tableListAccessFilters"],
 	["include-transform-targets", "tableListTransformTargets"],
-	["unused-only", "tableUnusedFilter"]
+	["unused-only", "tableUnusedFilter"],
+	["published-only", "tableListPublishedFilter"]
 ];
 function listParamFeatures(params) {
 	return LIST_PARAM_FEATURES.filter(([param]) => params[param] !== void 0).map(([, feature]) => feature);
@@ -2617,7 +2851,7 @@ function tableResource(transport) {
 	* List every table the caller can see, across all databases. `term` matches names and display
 	* names; `can-query` and `can-write` keep only the tables the caller may query or edit the
 	* metadata of; `include-transform-targets` adds tables a transform writes to; `unused-only` keeps
-	* tables nothing depends on.
+	* tables nothing depends on; `published-only` keeps tables published to the library.
 	*/
 	async function list(params = {}, options = {}) {
 		await transport.require("table.list", options);
@@ -2635,6 +2869,7 @@ function tableResource(transport) {
 					"owner-email": params["owner-email"],
 					"orphan-only": params["orphan-only"],
 					"unused-only": params["unused-only"],
+					"published-only": params["published-only"],
 					"can-query": params["can-query"],
 					"can-write": params["can-write"],
 					"include-transform-targets": params["include-transform-targets"]
@@ -2684,38 +2919,107 @@ function tableResource(transport) {
 		};
 	}
 	/**
-	* Trigger a manual update of this table's schema metadata. The sync runs after the call returns;
-	* a warehouse the server cannot connect to is a 422.
+	* Trigger a sync of this table: its columns, their fingerprints and its cached field values. It
+	* never discovers new tables. The sync runs after the call returns; a warehouse the server cannot
+	* connect to is a 422.
 	*/
 	async function syncSchema(id, options = {}) {
 		await transport.require("table.syncSchema", options);
-		await transport.requestParsed(SyncSchemaResponse, `/api/table/${id}/sync_schema`, {
-			...options,
-			method: "POST"
-		});
+		return {
+			id,
+			status: (await transport.requestParsed(SyncSchemaResponse, `/api/table/${id}/sync_schema`, {
+				...options,
+				method: "POST"
+			})).status
+		};
 	}
 	/**
-	* Trigger an update of the field values of every eligible field of this table. The scan runs
-	* after the call returns.
+	* Trigger an update of the field values of every eligible field of this table that already has a
+	* cached set. The scan runs after the call returns.
 	*/
 	async function rescanValues(id, options = {}) {
 		await transport.require("table.rescanValues", options);
-		await transport.requestParsed(RescanValuesResponse, `/api/table/${id}/rescan_values`, {
-			...options,
-			method: "POST"
-		});
+		return {
+			id,
+			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/rescan_values`, {
+				...options,
+				method: "POST"
+			})).status
+		};
+	}
+	/**
+	* Discard the cached field values of every field of this table, custom display values included.
+	* No scan recreates a discarded set; the server rebuilds it, without the display values, the next
+	* time the field's values are read.
+	*/
+	async function discardValues(id, options = {}) {
+		await transport.require("table.discardValues", options);
+		return {
+			id,
+			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/discard_values`, {
+				...options,
+				method: "POST"
+			})).status
+		};
 	}
 	/**
 	* Set the same metadata on every table the selectors pick out. A table leaving the `hidden` data
-	* layer is re-synced after the call returns.
+	* layer is re-synced after the call returns. The server answers the same whether or not the
+	* selectors matched a table.
 	*/
 	async function bulkEdit(params, options = {}) {
 		await transport.require("table.bulkEdit", options);
+		await requireDataAuthorityNull(params.data_authority, options);
 		await transport.requestParsed(BulkEditResponse, BULK_EDIT_PATH, {
 			...options,
 			method: "POST",
 			body: params
 		});
+		return {
+			accepted: true,
+			...params
+		};
+	}
+	async function requireDataAuthorityNull(value, options) {
+		if (value === null) await transport.requireFeatures(["tableUserValueWithdrawal"], options);
+	}
+	async function postSelection(path, selectors, options) {
+		const body = parseRequestBody(TableSelectors, selectors, "table selectors");
+		await transport.requestRaw(path, {
+			...options,
+			method: "POST",
+			body,
+			expectContentType: "binary"
+		});
+		return {
+			accepted: true,
+			...body
+		};
+	}
+	/**
+	* Trigger a sync of every table the selectors pick out: its columns, their fingerprints and its
+	* cached field values. Every database behind them must answer a connection test first, or the
+	* call is a 422; the syncs run after it returns.
+	*/
+	async function bulkSyncSchema(selectors, options = {}) {
+		await transport.require("table.bulkSyncSchema", options);
+		return postSelection(BULK_SYNC_SCHEMA_PATH, selectors, options);
+	}
+	/**
+	* Trigger a field-values rescan of every table the selectors pick out, refreshing the sets that
+	* are already cached. The scans run after the call returns.
+	*/
+	async function bulkRescanValues(selectors, options = {}) {
+		await transport.require("table.bulkRescanValues", options);
+		return postSelection(BULK_RESCAN_VALUES_PATH, selectors, options);
+	}
+	/**
+	* Discard the cached field values of every table the selectors pick out, custom display values
+	* included. No scan recreates a discarded set.
+	*/
+	async function bulkDiscardValues(selectors, options = {}) {
+		await transport.require("table.bulkDiscardValues", options);
+		return postSelection(BULK_DISCARD_VALUES_PATH, selectors, options);
 	}
 	async function updateFromCsv(id, action, file, options) {
 		await transport.requestRaw(`/api/table/${id}/${UPLOAD_UPDATE_PATHS[action]}`, {
@@ -2757,7 +3061,11 @@ function tableResource(transport) {
 		fks,
 		syncSchema,
 		rescanValues,
+		discardValues,
 		bulkEdit,
+		bulkSyncSchema,
+		bulkRescanValues,
+		bulkDiscardValues,
 		appendCsv,
 		replaceCsv
 	};
@@ -3584,6 +3892,167 @@ function transformTagResource(transport) {
 	};
 }
 //#endregion
+//#region ../client/src/domain/transform-test.ts
+const TransformTestTable = z.object({
+	schema: z.string().min(1).nullable().optional(),
+	name: z.string().min(1)
+}).loose();
+const TransformTestColumn = z.object({
+	name: z.string().min(1),
+	cast_type: z.string().min(1)
+}).loose();
+const TransformTestCell = z.union([
+	z.boolean(),
+	z.number(),
+	z.string(),
+	z.null()
+]);
+const TransformTestRow = z.record(z.string(), TransformTestCell);
+const TransformTestSqlInput = z.object({
+	table: TransformTestTable,
+	format: z.literal("sql"),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestRowsInput = z.object({
+	table: TransformTestTable,
+	format: z.literal("rows"),
+	columns: z.array(TransformTestColumn).min(1),
+	rows: z.array(TransformTestRow)
+}).loose();
+const TransformTestInput = z.discriminatedUnion("format", [TransformTestSqlInput, TransformTestRowsInput]);
+const TransformTestEqualsSqlExpectation = z.object({
+	type: z.literal("equals"),
+	name: z.string().min(1),
+	format: z.literal("sql"),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestEqualsRowsExpectation = z.object({
+	type: z.literal("equals"),
+	name: z.string().min(1),
+	format: z.literal("rows"),
+	columns: z.array(TransformTestColumn).min(1),
+	rows: z.array(TransformTestRow)
+}).loose();
+const TransformTestEqualsExpectation = z.discriminatedUnion("format", [TransformTestEqualsSqlExpectation, TransformTestEqualsRowsExpectation]);
+const TransformTestEmptyExpectation = z.object({
+	type: z.literal("empty"),
+	name: z.string().min(1),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestExpectation = z.discriminatedUnion("type", [TransformTestEqualsExpectation, TransformTestEmptyExpectation]);
+const TransformTest = z.object({
+	id: z.number().int(),
+	entity_id: z.string(),
+	transform_id: z.number().int(),
+	creator_id: z.number().int(),
+	name: z.string(),
+	description: z.string().nullable(),
+	inputs: z.array(TransformTestInput),
+	expectations: z.array(TransformTestExpectation),
+	created_at: z.string(),
+	updated_at: z.string()
+}).loose();
+TransformTest.pick({
+	id: true,
+	transform_id: true,
+	name: true,
+	description: true
+}).strip();
+z.object({
+	transform_id: z.number().int().positive(),
+	name: z.string().min(1),
+	description: z.string().nullable().optional(),
+	inputs: z.array(TransformTestInput),
+	expectations: z.array(TransformTestExpectation)
+}).loose();
+z.object({
+	transform_id: z.number().int().positive().optional(),
+	name: z.string().min(1).optional(),
+	description: z.string().nullable().optional(),
+	inputs: z.array(TransformTestInput).optional(),
+	expectations: z.array(TransformTestExpectation).optional()
+}).loose();
+const TransformTestResultColumn = z.object({
+	name: z.string(),
+	database_type: z.string()
+}).loose();
+const TransformTestExpectationError = z.object({
+	type: z.string(),
+	message: z.string()
+}).loose();
+const TransformTestCellMismatch = z.object({
+	column: z.string(),
+	expected: TransformTestCell,
+	actual: TransformTestCell
+}).loose();
+const TransformTestRowCounts = z.object({
+	actual: z.number().int(),
+	expected: z.number().int()
+}).loose();
+const TransformTestEqualsFindings = z.object({
+	name: z.string(),
+	type: z.literal("equals"),
+	status: z.enum(["passed", "failed"]),
+	columns: z.array(TransformTestResultColumn),
+	"row-counts": TransformTestRowCounts,
+	"extra-rows": z.array(TransformTestRow),
+	"missing-rows": z.array(TransformTestRow),
+	"cell-mismatches": z.array(TransformTestCellMismatch),
+	truncated: z.number().int()
+}).loose();
+const TransformTestEqualsError = z.object({
+	name: z.string(),
+	type: z.literal("equals"),
+	status: z.literal("error"),
+	error: TransformTestExpectationError
+}).loose();
+const TransformTestEqualsResult = z.discriminatedUnion("status", [TransformTestEqualsFindings, TransformTestEqualsError]);
+const TransformTestEmptyPassed = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("passed")
+}).loose();
+const TransformTestEmptyFailed = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("failed"),
+	columns: z.array(TransformTestResultColumn),
+	sample: z.array(TransformTestRow),
+	truncated: z.number().int()
+}).loose();
+const TransformTestEmptyError = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("error"),
+	error: TransformTestExpectationError
+}).loose();
+const TransformTestEmptyResult = z.discriminatedUnion("status", [
+	TransformTestEmptyPassed,
+	TransformTestEmptyFailed,
+	TransformTestEmptyError
+]);
+const TransformTestExpectationResult = z.discriminatedUnion("type", [TransformTestEqualsResult, TransformTestEmptyResult]);
+const TransformTestRunResult = z.object({
+	status: z.enum(["passed", "failed"]),
+	expectations: z.array(TransformTestExpectationResult),
+	tables: z.record(z.string(), z.string())
+}).loose();
+z.enum([
+	"transform-test.unknown-column",
+	"transform-test.ambiguous-column",
+	"transform-test.missing-inputs",
+	"transform-test.unused-inputs",
+	"transform-test.duplicate-input-table",
+	"transform-test.unparseable-source",
+	"transform-test.unremapped-reference",
+	"transform-test.unsupported-transform",
+	"transform-test.unsupported-driver",
+	"transform-test.transform-failed",
+	"transform-test.setup-failed",
+	"transform-test.expectation-failed",
+	"transform-test.unsupported-format"
+]);
+//#endregion
 //#region ../client/src/resources/transform-test.ts
 const TransformTestApiList = z.array(TransformTest);
 function transformTestResource(transport) {