@metabase/cli 0.3.2 → 0.4.0

package/dist/{client-BnK0evYf.mjs → client-ToLiPu9q.mjs}

@@ -1,22 +1,26 @@
-import { $ as InternalError, Q as ConfigError, at as ValidationError, n as methodRequirements, nt as ResponseShapeError, ot as errorMessage, rt as TimeoutError, tt as NetworkError } from "./cli.mjs";
+import { at as ConfigError, ct as NetworkError, ft as ValidationError, lt as ResponseShapeError, mt as formatZodIssue, n as methodRequirements, ot as InternalError, pt as errorMessage, ut as TimeoutError } from "./cli.mjs";
 import { n as Notification, r as NotificationCardPayload, t as CARD_PAYLOAD_TYPE } from "./notification-DaA4bBHW.mjs";
-import { $ as createServerProfile, B as JSON_CONTENT_TYPE, F as buildNetworkError, G as credentialSecrets, H as parseJsonOrPlain, I as isConnectionClosed, J as normalizeUrl, L as HttpError, U as assertCredentialHeaderSafe, V as parseJson, W as credentialAuthHeader, Z as checkFeatures, et as probeServer, tt as CapabilityError, z as isRetryableStatus } from "./runtime-nCPku2nN.mjs";
-import { n as throwIfAborted, r as untilAborted, t as combineAborts } from "./signal-k7cm5N6h.mjs";
-import { a as FieldSearchMatches, i as FieldRemappedValue, l as FieldValues, n as FieldBaseType, o as FieldSemanticType, t as Field } from "./field-CcN4oZy6.mjs";
+import { $ as CapabilityError, B as assertCredentialHeaderSafe, G as normalizeUrl, H as credentialSecrets, I as isRetryableStatus, J as checkFeatures, L as JSON_CONTENT_TYPE, M as buildNetworkError, N as isConnectionClosed, P as HttpError, Q as probeServer, R as parseJson, V as credentialAuthHeader, X as createServerProfile, Z as PROBE_PATH, z as parseJsonOrPlain } from "./runtime-CZ5zh32z.mjs";
+import { n as throwIfAborted, r as untilAborted, t as combineAborts } from "./signal-CxWeLszu.mjs";
+import { f as FieldWithDataSensitivity, h as fieldRemappedValueSchema, m as fieldDetailSchema, n as FieldBaseType, o as FieldSearchMatches, s as FieldSemanticType, u as FieldValues } from "./field-5nivEfd6.mjs";
 import { a as TemporalUnit, r as ParameterValues } from "./parameter-Celg0wZa.mjs";
-import { a as CardQueryResult, l as DatasetQuery, s as CardType, t as Card } from "./card-voh1k4hl.mjs";
-import { c as TableVisibilityType, i as TableForeignKey, o as TableQueryMetadata, r as TableDataLayerTier, t as Table } from "./table-DfuY0N8e.mjs";
-import { t as Database } from "./database-JtHTqSpq.mjs";
+import { a as CardQueryResult, d as PivotExportFormat, l as DatasetQuery, t as Card } from "./card-Bv4ZN0oV.mjs";
+import { b as TableVisibilityType, p as TableQueryMetadata, s as TableDataLayerTier, t as Table, u as TableForeignKey, v as TableSelectors } from "./table-Ci6bhZkb.mjs";
+import { t as Database } from "./database-D-CRyRIv.mjs";
 import { t as Snippet } from "./snippet-CyKAgIZl.mjs";
-import { c as CollectionItem, i as CollectionAuthorityLevel, m as CollectionTreeNode, r as Collection, s as CollectionId } from "./collection-BxdPxD38.mjs";
+import { o as compiledQuerySchema, r as QueryMetadata } from "./dataset-p5oNPQgL.mjs";
+import { c as CollectionItem, m as CollectionTreeNode, r as Collection } from "./collection-D3KXhvnc.mjs";
 import { t as ContentTranslationUploadResult } from "./content-translation-BrHOrmj9.mjs";
-import { a as DashboardDetail, c as Dashcard, r as DashboardCopy, t as Dashboard } from "./dashboard-D0hwTC-f.mjs";
-import { r as pollUntil } from "./poll-CZeXepUQ.mjs";
-import { t as Document } from "./document-BHpLJbKU.mjs";
+import { l as Dashcard, o as DashboardDetail, r as DashboardCopy, t as Dashboard } from "./dashboard-Phz3XpRM.mjs";
+import { r as pollUntil } from "./poll-Dz4tUm2f.mjs";
+import { i as DependencyEntity, s as DependencyGraph, t as BreakingSource, u as DependencyNode } from "./dependency-DKSjKT8P.mjs";
+import { t as Document } from "./document-DFCj1Az_.mjs";
 import { i as EidTranslateResult } from "./eid-translation-zEHtr5Oc.mjs";
-import { c as SyncSettingsUpdateResult, i as SyncExportPreflight, n as SyncDirtyItem, p as isSyncTaskTerminal, s as SyncRemoteChanges, t as SyncBranchCreated, u as SyncTask } from "./git-sync-BwBRmEhE.mjs";
-import { a as toLibrary, i as libraryWireSchema, n as LibraryCollectionInfo } from "./library-BPIzb3K_.mjs";
+import { c as SyncRemoteChanges, d as SyncTask, i as SyncExportPreflight, l as SyncSettingsUpdateResult, m as isSyncTaskTerminal, n as SyncDirtyItem, t as SyncBranchCreated } from "./git-sync-COokpYgc.mjs";
+import { t as Glossary } from "./glossary-BlNCrYbw.mjs";
+import { a as libraryWireSchema, i as LibraryPublishTablesInput, n as LibraryCollectionInfo, o as toLibrary } from "./library-Ck0EK5bi.mjs";
 import { t as Measure } from "./measure-CtfjqJFP.mjs";
+import { r as ModerationReviewCreateInput, t as ModerationReview } from "./moderation-review-BdqEH6N1.mjs";
 import { t as Pulse } from "./pulse-Dz0ocv0l.mjs";
 import { a as TransformDagTransform, d as TransformTarget, g as transformRowSchema, h as transformDetailSchema, i as TransformDagRunResult, l as TransformRunSummary, m as isTransformRunTerminal, o as TransformRun, p as isTransformRunFailed, u as TransformSourceTableEntry } from "./transform-DiW7bREn.mjs";
 import { r as SearchResult } from "./search-BAXg-EJw.mjs";
@@ -349,43 +353,16 @@ async function readBodyForError(response) {
 	}
 }
 //#endregion
-//#region ../client/src/domain/dataset.ts
-const CompiledQuery = z.object({
-	query: z.union([z.string(), z.array(z.unknown())]),
-	params: z.array(z.unknown()).nullable().optional(),
-	collection: z.string().optional()
-}).loose();
-const FieldRef = z.tuple([
-	z.literal("field"),
-	z.string(),
-	z.object({ "base-type": FieldBaseType }).loose()
-]);
-const VirtualField = z.object({
-	id: z.union([z.number().int(), FieldRef]),
-	table_id: z.string(),
-	name: z.string(),
-	display_name: z.string(),
-	base_type: FieldBaseType,
-	semantic_type: FieldSemanticType.nullable(),
-	fk_target_field_id: z.number().int().nullable().optional()
-}).loose();
-const VirtualTable = z.object({
-	id: z.string(),
-	db_id: z.number().int(),
-	display_name: z.string(),
-	schema: z.string(),
-	description: z.string().nullable(),
-	type: CardType,
-	moderated_status: z.string().nullable(),
-	entity_id: z.string().nullable(),
-	fields: z.array(VirtualField)
-}).loose();
-const QueryMetadata = z.object({
-	databases: z.array(Database),
-	tables: z.array(z.union([TableQueryMetadata, VirtualTable])),
-	fields: z.array(Field),
-	snippets: z.array(Snippet)
-}).loose();
+//#region ../client/src/resources/pivot-export.ts
+const PivotedExportsSetting = z.object({ "enable-pivoted-exports": z.boolean() });
+/**
+* Refuse a pivoted export the server would answer with plain rows: a JSON export keeps only the
+* ungrouped rows, and an admin can turn pivoted CSV and XLSX exports off.
+*/
+async function assertPivotedExport(transport, format, options) {
+	if (!PivotExportFormat.safeParse(format).success) throw new ConfigError(`a ${format} export cannot be pivoted; only ${PivotExportFormat.options.join(" and ")} can`);
+	if (!(await transport.requestParsed(PivotedExportsSetting, "/api/session/properties", { ...options }))["enable-pivoted-exports"]) throw new ConfigError("the server has pivoted exports turned off (the enable-pivoted-exports setting), so it would export the plain rows");
+}
 //#endregion
 //#region ../client/src/resources/card.ts
 const CardApiList = z.array(Card);
@@ -442,15 +419,22 @@ function cardResource(transport) {
 		});
 	}
 	/**
-	* Run a saved card and stream its result as a download. Unlike `query`, this endpoint takes a
-	* form-encoded body and answers bytes, so a caller consumes the stream rather than a value.
+	* Run the query associated with a Card, and return its results as a file in the specified
+	* format. Unlike `query`, this endpoint takes a form-encoded body and answers bytes, so a caller
+	* consumes the stream rather than a value. A pivot the server would answer with plain rows (a
+	* JSON export, or pivoted exports turned off) is refused. `csv_include_bom` opens a CSV with a
+	* UTF-8 byte order mark; a server without it drops the key silently, so asking for one is refused
+	* there before the wire.
 	*/
 	async function exportQuery(id, format, params, options = {}) {
 		await transport.require("card.exportQuery", options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
+		if (params.pivot_results) await assertPivotedExport(transport, format, options);
 		const body = new URLSearchParams({
 			parameters: JSON.stringify(params.parameters),
 			format_rows: String(params.format_rows),
-			pivot_results: String(params.pivot_results)
+			pivot_results: String(params.pivot_results),
+			csv_include_bom: String(params.csv_include_bom)
 		});
 		return transport.requestStream(`/api/card/${id}/query/${format}`, {
 			...options,
@@ -534,20 +518,20 @@ function refPath(ref) {
 	return encodeURIComponent(ref);
 }
 /**
-* List collections including the Library and its children, parsing each through the caller's own
-* projection. `Collection` pins `type`, `namespace` and `authority_level` to closed enums, so a
-* consumer reading a few fields off every collection on the instance narrows here: one collection
-* carrying a server value outside those sets then costs nothing to a caller that never reads the
-* field.
+* List every collection the caller can read, the Library and its children among them, parsing each
+* through the caller's own projection. `Collection` pins `type`, `namespace` and `authority_level`
+* to closed enums, so a consumer reading a few fields off every collection on the instance narrows
+* here: one collection carrying a server value outside those sets then costs nothing to a caller
+* that never reads the field.
 */
-async function listCollectionsWithLibrary(transport, schema, options = {}) {
-	return transport.requestParsed(z.array(schema), "/api/collection", {
-		...options,
-		query: { "include-library": true }
-	});
+async function listCollectionsAs(transport, schema, options = {}) {
+	return transport.requestParsed(z.array(schema), "/api/collection", { ...options });
 }
 function collectionResource(transport) {
-	/** List collections. `filter` picks a server-side preset: everything, archived, or personal. */
+	/**
+	* List collections. `filter` picks a server-side preset: everything, archived, or personal. Every
+	* preset includes the Library collections that match it.
+	*/
 	async function list(params = {}, options = {}) {
 		await transport.require("collection.list", options);
 		return {
@@ -558,18 +542,6 @@ function collectionResource(transport) {
 			total: null
 		};
 	}
-	/**
-	* List collections including the Library and its children, which the plain listing omits.
-	* The Library's own children carry neither `type` nor `is_remote_synced`, so this is where a
-	* caller resolves both.
-	*/
-	async function listWithLibrary(options = {}) {
-		await transport.require("collection.listWithLibrary", options);
-		return {
-			data: await listCollectionsWithLibrary(transport, Collection, options),
-			total: null
-		};
-	}
 	/** Get one collection by id, entity id, or the `root`/`trash` alias. */
 	async function get(ref, options = {}) {
 		await transport.require("collection.get", options);
@@ -584,7 +556,11 @@ function collectionResource(transport) {
 			body: params
 		});
 	}
-	/** Update a collection, patching only the fields the body carries. */
+	/**
+	* Update a collection, patching the fields the body carries. The server reads an absent
+	* `archived` as `false`, so a patch without it restores an archived collection, and a patch that
+	* moves a collection into the trash ignores `parent_id`.
+	*/
 	async function update(ref, params, options = {}) {
 		await transport.require("collection.update", options);
 		return transport.requestParsed(Collection, `/api/collection/${refPath(ref)}`, {
@@ -617,16 +593,18 @@ function collectionResource(transport) {
 		});
 	}
 	/** Fetch the collection hierarchy as a forest of nested nodes. */
-	async function tree(options = {}) {
+	async function tree(params = {}, options = {}) {
 		await transport.require("collection.tree", options);
 		return {
-			data: await transport.requestParsed(CollectionTreeApiList, "/api/collection/tree", { ...options }),
+			data: await transport.requestParsed(CollectionTreeApiList, "/api/collection/tree", {
+				...options,
+				query: { "include-library": params["include-library"] }
+			}),
 			total: null
 		};
 	}
 	return {
 		list,
-		listWithLibrary,
 		get,
 		create,
 		update,
@@ -715,9 +693,13 @@ function dashboardResource(transport) {
 	}
 	/**
 	* Copy a dashboard, with its tabs and dashcards, into `collection_id` (root when absent). A deep
-	* copy duplicates the cards it can; otherwise the copy references them, except dashboard
-	* questions, which are always duplicated. Cards the caller cannot read are left behind and
-	* reported as `uncopied`.
+	* copy duplicates its questions and metrics and references its models. With `is_deep_copy`
+	* false or absent the copy references every card, and a dashboard holding unarchived dashboard
+	* questions is refused. Archived cards, cards the caller cannot read, and every card on a
+	* dashcard whose main card the caller cannot read are left out and reported as `uncopied`, once
+	* per dashcard they sat on. A left-out main card takes its dashcard with it; a left-out series
+	* card stays on a dashcard whose main card is referenced and is dropped from one whose main card
+	* is duplicated. Action, link and placeholder dashcards are not copied.
 	*/
 	async function copy(id, params = {}, options = {}) {
 		await transport.require("dashboard.copy", options);
@@ -971,7 +953,8 @@ function datasetResource(transport) {
 	*/
 	async function native(datasetQuery, params = {}, options = {}) {
 		await transport.require("dataset.native", options);
-		return transport.requestParsed(CompiledQuery, "/api/dataset/native", {
+		const { features } = await transport.server(options);
+		return transport.requestParsed(compiledQuerySchema(features), "/api/dataset/native", {
 			...options,
 			method: "POST",
 			body: {
@@ -994,18 +977,33 @@ function datasetResource(transport) {
 		});
 	}
 	/**
-	* Run an ad-hoc query and stream its result as a download. Unlike `query`, this endpoint answers
-	* bytes, so a caller consumes the stream rather than a value.
+	* Execute a query and download the result data as a file in the specified format. Unlike
+	* `query`, this endpoint answers bytes, so a caller consumes the stream rather than a value.
+	* `visualization_settings` drive `format_rows` column formatting and, through
+	* `pivot_table.column_split`, the layout `pivot_results` lays the rows out in. The server only
+	* computes that layout for a query it runs as a pivot, which it reads from the query's own
+	* `was-pivot`, so `pivot_results` sets it. A pivot the server would answer with plain rows (a
+	* JSON export, or pivoted exports turned off) is refused. `csv_include_bom` opens a CSV with a
+	* UTF-8 byte order mark; a server without it drops the key silently, so asking for one is refused
+	* there before the wire.
 	*/
 	async function exportQuery(format, params, options = {}) {
 		await transport.require("dataset.exportQuery", options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
+		if (params.pivot_results) await assertPivotedExport(transport, format, options);
+		const exported = params.pivot_results ? {
+			...params.query,
+			"was-pivot": true
+		} : params.query;
 		return transport.requestStream(`/api/dataset/${format}`, {
 			...options,
 			method: "POST",
 			body: {
-				query: params.query,
+				query: exported,
+				visualization_settings: params.visualization_settings,
 				format_rows: params.format_rows,
-				pivot_results: params.pivot_results
+				pivot_results: params.pivot_results,
+				csv_include_bom: params.csv_include_bom
 			}
 		});
 	}
@@ -1017,133 +1015,18 @@ function datasetResource(transport) {
 	};
 }
 //#endregion
-//#region ../client/src/domain/dependency.ts
-const DependencyType = z.enum([
-	"table",
-	"card",
-	"snippet",
-	"transform",
-	"dashboard",
-	"document",
-	"sandbox",
-	"segment",
-	"measure"
-]);
-const DependencyUsageType = z.enum([
-	"table",
-	"snippet",
-	"transform",
-	"dashboard",
-	"document",
-	"sandbox",
-	"segment",
-	"question",
-	"model",
-	"metric",
-	"measure"
-]);
-const DependencyFindingErrorType = z.enum([
-	"missing-column",
-	"missing-table-alias",
-	"missing-table",
-	"missing-card",
-	"duplicate-column",
-	"syntax-error",
-	"validation-exception-error"
-]);
-const DependencyErrorSourceType = z.enum([
-	"table",
-	"card",
-	"transform"
-]);
-z.enum([
-	"name",
-	"location",
-	"view-count"
-]);
-z.enum([
-	"name",
-	"location",
-	"dependents-with-errors",
-	"dependents-errors"
-]);
-const DependencyCollectionRef = z.object({
-	id: CollectionId,
-	name: z.string(),
-	authority_level: CollectionAuthorityLevel.nullable(),
-	is_personal: z.boolean().optional()
-}).loose();
-const DependencyContainerRef = z.object({
-	id: z.number().int(),
-	name: z.string()
-}).loose();
-const DependencyEntityData = z.object({
-	name: z.string().nullable().optional(),
-	display_name: z.string().nullable().optional(),
-	description: z.string().nullable().optional(),
-	type: CardType.nullable().optional(),
-	display: z.string().nullable().optional(),
-	database_id: z.number().int().nullable().optional(),
-	db_id: z.number().int().nullable().optional(),
-	schema: z.string().nullable().optional(),
-	collection_id: CollectionId.nullable().optional(),
-	collection: DependencyCollectionRef.nullable().optional(),
-	dashboard_id: z.number().int().nullable().optional(),
-	dashboard: DependencyContainerRef.nullable().optional(),
-	document_id: z.number().int().nullable().optional(),
-	document: DependencyContainerRef.nullable().optional(),
-	table_id: z.number().int().nullable().optional(),
-	view_count: z.number().int().nullable().optional()
-}).loose();
-const DependencyEntity = z.object({
-	id: z.number().int(),
-	type: DependencyType,
-	data: DependencyEntityData
-}).loose();
-const DependencyNode = DependencyEntity.extend({ dependents_count: z.partialRecord(DependencyUsageType, z.number().int()).nullable() });
-const DependencyFindingError = z.object({
-	id: z.number().int(),
-	analyzed_entity_type: DependencyType,
-	analyzed_entity_id: z.number().int(),
-	error_type: DependencyFindingErrorType,
-	error_detail: z.string().nullable().optional(),
-	source_entity_type: DependencyErrorSourceType.nullable().optional(),
-	source_entity_id: z.number().int().nullable().optional()
-}).loose();
-const BreakingSource = DependencyNode.extend({ dependents_errors: z.array(DependencyFindingError).nullable().optional() });
-const DependencyEdge = z.object({
-	from_entity_type: DependencyType,
-	from_entity_id: z.number().int(),
-	to_entity_type: DependencyType,
-	to_entity_id: z.number().int()
-}).loose();
-const DependencyGraph = z.object({
-	nodes: z.array(DependencyNode),
-	edges: z.array(DependencyEdge)
-}).loose();
-//#endregion
 //#region ../client/src/resources/dependency.ts
 const DependencyNodeApiList = z.array(DependencyNode);
 const DependencyEntityApiList = z.array(DependencyEntity);
-const RENAMED_FILTERS = [
-	"dependent-types",
-	"dependent-card-types",
-	"card-types",
-	"include-personal-collections",
-	"sort-column",
-	"sort-direction"
-];
-function filterFeatures(params) {
-	return RENAMED_FILTERS.some((key) => params[key] !== void 0) ? ["dependencyKebabCaseFilters"] : [];
-}
 function dependencyResource(transport) {
 	/**
 	* The upstream dependency graph of one entity. `nodes` holds the starting entity plus every
 	* entity it depends on, directly or transitively; each edge runs from the dependent to what it
-	* depends on.
+	* depends on. A measure starts a graph only on a server with `measureDependencyGraph`.
 	*/
 	async function graph(type, id, options = {}) {
 		await transport.require("dependency.graph", options);
+		if (type === "measure") await transport.requireFeatures(["measureDependencyGraph"], options);
 		return transport.requestParsed(DependencyGraph, "/api/ee/dependencies/graph", {
 			...options,
 			query: {
@@ -1160,7 +1043,6 @@ function dependencyResource(transport) {
 	*/
 	async function dependents(type, id, params = {}, options = {}) {
 		await transport.require("dependency.dependents", options);
-		await transport.requireFeatures(filterFeatures(params), options);
 		return {
 			data: await transport.requestParsed(DependencyNodeApiList, "/api/ee/dependencies/graph/dependents", {
 				...options,
@@ -1187,7 +1069,6 @@ function dependencyResource(transport) {
 	*/
 	async function broken(type, id, params = {}, options = {}) {
 		await transport.require("dependency.broken", options);
-		await transport.requireFeatures(filterFeatures(params), options);
 		return {
 			data: await transport.requestParsed(DependencyEntityApiList, "/api/ee/dependencies/graph/broken", {
 				...options,
@@ -1205,15 +1086,23 @@ function dependencyResource(transport) {
 		};
 	}
 	/**
-	* Walk the entities nothing depends on, one page at a time. `types` and `card-types` narrow
-	* which kinds are listed, `query` matches against names and locations,
+	* Walk the entities that no readable, unarchived dependent depends on, one page at a time: an
+	* entity used only by archived content, or by content the caller cannot read, is listed. `types`
+	* and `card-types` narrow which kinds are listed, `query` matches against names and locations,
 	* `include-personal-collections` admits content in personal collections, and `sort-column` /
-	* `sort-direction` order the result. This endpoint pages on the server, so the caller consumes
-	* pages and decides how far to pull.
+	* `sort-direction` order the result. A `query` leaves sandboxes out, since they have no name or
+	* location to match, so sandboxes alone with a `query` answer one empty page without a request.
+	* This endpoint pages on the server, so the caller consumes pages and decides how far to pull.
 	*/
 	async function* unreferencedPages(params = {}, options = {}) {
 		await transport.require("dependency.unreferencedPages", options);
-		await transport.requireFeatures(filterFeatures(params), options);
+		if (queryLeavesNoKind(params)) {
+			yield {
+				items: [],
+				total: 0
+			};
+			return;
+		}
 		yield* paginatePages(transport, "/api/ee/dependencies/graph/unreferenced", DependencyNode, {
 			query: itemListQuery(params),
 			...options.offset !== void 0 && { offset: options.offset },
@@ -1231,7 +1120,13 @@ function dependencyResource(transport) {
 	*/
 	async function* breakingPages(params = {}, options = {}) {
 		await transport.require("dependency.breakingPages", options);
-		await transport.requireFeatures(filterFeatures(params), options);
+		if (queryLeavesNoKind(params)) {
+			yield {
+				items: [],
+				total: 0
+			};
+			return;
+		}
 		yield* paginatePages(transport, "/api/ee/dependencies/graph/breaking", BreakingSource, {
 			query: itemListQuery(params),
 			...options.offset !== void 0 && { offset: options.offset },
@@ -1248,9 +1143,14 @@ function dependencyResource(transport) {
 		breakingPages
 	};
 }
+function queryLeavesNoKind(params) {
+	const { query, types } = params;
+	if (query === void 0 || types === void 0 || types.length === 0) return false;
+	return types.every((type) => type === "sandbox");
+}
 function itemListQuery(params) {
 	return {
-		types: params.types,
+		types: params.types === void 0 ? void 0 : [...new Set(params.types)],
 		"card-types": params["card-types"],
 		query: params.query,
 		"include-personal-collections": params["include-personal-collections"],
@@ -1417,21 +1317,39 @@ async function fetchOptionalParsed(client, path, schema, options = {}) {
 //#region ../client/src/resources/field.ts
 const FieldApiSummary = z.tuple([z.tuple([z.literal("count"), z.number().int()]), z.tuple([z.literal("distincts"), z.number().int()])]);
 function fieldResource(transport) {
-	/** Get one field by id. */
+	/**
+	* Get one field by id. A server that labels data sensitivity answers `data_sensitivity`, `null`
+	* for an unlabelled field; any other answers the field without the key (`hasDataSensitivity`).
+	*/
 	async function get(id, options = {}) {
 		await transport.require("field.get", options);
-		return transport.requestParsed(Field, `/api/field/${id}`, { ...options });
+		const { features } = await transport.server(options);
+		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, { ...options });
 	}
 	/**
 	* Update a field by id, patching only the fields the body carries. A `data_sensitivity` label is
 	* a person's call the server's classifier never overwrites, and `null` withdraws it so the
 	* classifier's own applies again; a server without the column would drop the key silently, so
-	* the label is refused there before the wire.
+	* the label is refused there before the wire. Answers the field the way `get` does.
 	*/
 	async function update(id, params, options = {}) {
 		await transport.require("field.update", options);
 		await transport.requireFeatures(params.data_sensitivity === void 0 ? [] : ["fieldDataSensitivity"], options);
-		return transport.requestParsed(Field, `/api/field/${id}`, {
+		const { features } = await transport.server(options);
+		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, {
+			...options,
+			method: "PUT",
+			body: params
+		});
+	}
+	/**
+	* Label a field's data sensitivity by hand. A person's label is never overwritten by the server's
+	* classifier; `null` withdraws it, so whatever label the classifier wrote shows again. Answers
+	* the field with the label it now carries.
+	*/
+	async function setDataSensitivity(id, params, options = {}) {
+		await transport.require("field.setDataSensitivity", options);
+		return transport.requestParsed(FieldWithDataSensitivity, `/api/field/${id}`, {
 			...options,
 			method: "PUT",
 			body: params
@@ -1439,8 +1357,11 @@ function fieldResource(transport) {
 	}
 	/**
 	* Search the values of `searchId` that contain `value`, case-insensitively, answering the
-	* matching values of `id` paired with them. An FK on either side is followed to the PK it
-	* points at. Without `value`, the first `limit` values.
+	* matching values of `id` paired with them, ordered by value, at most `limit` of them. An FK on
+	* either side is followed to the PK it points at, and a field that resolves to the same field as
+	* `searchId` answers each value alone. Without `value`, the first `limit` values. A field with
+	* custom display values answers every mapped value with its display value instead, matching
+	* `value` against the display value, ignoring both `searchId` and `limit`.
 	*/
 	async function search(id, searchId, params, options = {}) {
 		await transport.require("field.search", options);
@@ -1454,11 +1375,13 @@ function fieldResource(transport) {
 	}
 	/**
 	* The value of `remappedId` on the one row where `id` equals `value`, as `[value, remapped]`,
-	* or `null` when no row matches. `value` is parsed as a number for a numeric field.
+	* or `null` when no row matches. For a numeric field the server reads the leading number of
+	* `value` and ignores any text after it, refusing only a `value` that has none.
 	*/
 	async function remapping(id, remappedId, params, options = {}) {
 		await transport.require("field.remapping", options);
-		return fetchOptionalParsed(transport, `/api/field/${id}/remapping/${remappedId}`, FieldRemappedValue, {
+		const { features } = await transport.server(options);
+		return fetchOptionalParsed(transport, `/api/field/${id}/remapping/${remappedId}`, fieldRemappedValueSchema(features, id === remappedId), {
 			...options,
 			query: { value: params.value }
 		});
@@ -1481,6 +1404,7 @@ function fieldResource(transport) {
 	return {
 		get,
 		update,
+		setDataSensitivity,
 		search,
 		remapping,
 		summary,
@@ -1512,6 +1436,7 @@ const SyncStashStarted = z.object({
 	task_id: z.number().int().positive()
 });
 const RemoteSyncSetting = z.string().nullable();
+const RemoteSyncBranchProperty = z.object({ "remote-sync-branch": z.string().nullable().optional() });
 const FORBIDDEN_STATUS = 403;
 const UNREGISTERED_STATUS = 404;
 function isRemoteUnreadable(error) {
@@ -1559,16 +1484,24 @@ function gitSyncResource(transport) {
 	/**
 	* Import content from the remote into Metabase. The endpoint queues a task and returns at once;
 	* pass `wait` to poll that task until it reaches a terminal status. A server already up to date
-	* answers no task id, and there is then nothing to poll.
+	* answers no task id, and there is then nothing to poll. A server that guards the tracked branch
+	* refuses with 409 when `expected_branch` disagrees with the setting; left out, it is the tracked
+	* branch as read just before the request. `merge` folds the remote's changes into local content
+	* by a three-way merge and keeps un-pushed local changes, where a plain import refuses on a dirty
+	* instance.
 	*/
 	async function importFromRemote(params = {}, options = {}) {
 		await transport.require("gitSync.import", options);
+		await requireMerge(params.merge, options);
+		const expectedBranch = await guardedBranch(params.expected_branch, options);
 		const started = await transport.requestParsed(SyncImportStarted, "/api/ee/remote-sync/import", {
 			...options,
 			method: "POST",
 			body: {
 				branch: params.branch,
-				force: params.force
+				force: params.force,
+				merge: params.merge,
+				expected_branch: expectedBranch
 			}
 		});
 		const message = started.message ?? null;
@@ -1582,19 +1515,36 @@ function gitSyncResource(transport) {
 			final: await settle(params.wait, options)
 		};
 	}
+	async function requireMerge(merge, options) {
+		if (merge === true) await transport.requireFeatures(["remoteSyncMerge"], options);
+	}
+	async function guardedBranch(given, options) {
+		if (given !== void 0) return given;
+		const { features } = await transport.server(options);
+		if (!features.remoteSyncBranchGuard) return;
+		return trackedBranch(options);
+	}
 	/**
 	* Export Metabase's content to the remote. The endpoint queues a task and returns at once; pass
-	* `wait` to poll that task until it reaches a terminal status.
+	* `wait` to poll that task until it reaches a terminal status. A server that guards the tracked
+	* branch refuses with 409 when `branch` is not the tracked one; left out, it is the tracked branch
+	* as read just before the request there, and the server's own default elsewhere. When the remote
+	* has moved past the last sync, a plain export ends in a `conflict` task where `merge` is
+	* available, and is refused with 400 before any task elsewhere; `merge` folds the remote's changes
+	* in by a three-way merge instead, and `force` overwrites them.
 	*/
 	async function exportToRemote(params = {}, options = {}) {
 		await transport.require("gitSync.export", options);
+		await requireMerge(params.merge, options);
+		const branchName = await guardedBranch(params.branch, options);
 		const started = await transport.requestParsed(SyncExportStarted, "/api/ee/remote-sync/export", {
 			...options,
 			method: "POST",
 			body: {
-				branch: params.branch,
+				branch: branchName,
 				message: params.message,
-				force: params.force
+				force: params.force,
+				merge: params.merge
 			}
 		});
 		if (params.wait === void 0) return {
@@ -1679,7 +1629,7 @@ function gitSyncResource(transport) {
 	async function syncedCollections(options = {}) {
 		await transport.require("gitSync.syncedCollections", options);
 		return {
-			data: (await listCollectionsWithLibrary(transport, SyncScopeCollection, options)).filter((entry) => entry.is_remote_synced === true),
+			data: (await listCollectionsAs(transport, SyncScopeCollection, options)).filter((entry) => entry.is_remote_synced === true),
 			total: null
 		};
 	}
@@ -1695,17 +1645,22 @@ function gitSyncResource(transport) {
 		}
 	}
 	/**
-	* The branch git-sync tracks, or null when none is configured, the caller may not read it, or
-	* the server has no remote-sync module.
+	* The branch git-sync tracks, or null when none is configured. Refuses when the caller may not
+	* read the setting (it is admin-only) or the server has no remote-sync module, rather than
+	* reading either as unset.
 	*/
 	async function branch(options = {}) {
 		await transport.require("gitSync.branch", options);
-		try {
-			return await fetchOptionalParsed(transport, "/api/setting/remote-sync-branch", RemoteSyncSetting, options);
-		} catch (error) {
-			if (isRemoteUnreadable(error)) return null;
-			throw error;
-		}
+		const tracked = (await transport.requestParsed(RemoteSyncBranchProperty, PROBE_PATH, { ...options }))["remote-sync-branch"];
+		if (tracked === void 0) throw new ConfigError("the remote-sync-branch setting is not readable: it is visible to admins only, and absent on a server without the remote-sync module");
+		return tracked;
+	}
+	/** The branch git-sync tracks, refused when none is configured or the caller may not read it. */
+	async function trackedBranch(options = {}) {
+		await transport.require("gitSync.trackedBranch", options);
+		const tracked = await branch(options);
+		if (tracked === null) throw new ConfigError("git-sync tracks no branch: the remote-sync-branch setting is unset");
+		return tracked;
 	}
 	/**
 	* Poll the current task until it reaches a terminal status. A server with no task at all
@@ -1737,36 +1692,11 @@ function gitSyncResource(transport) {
 		syncedCollections,
 		remoteUrl,
 		branch,
+		trackedBranch,
 		waitForTask
 	};
 }
 //#endregion
-//#region ../client/src/domain/glossary.ts
-const GlossaryCreator = z.object({
-	id: z.number().int(),
-	email: z.string(),
-	first_name: z.string().nullable(),
-	last_name: z.string().nullable()
-}).loose();
-const Glossary = z.object({
-	id: z.number().int(),
-	term: z.string(),
-	definition: z.string(),
-	creator_id: z.number().int(),
-	creator: GlossaryCreator,
-	created_at: z.string(),
-	updated_at: z.string()
-}).loose();
-Glossary.pick({
-	id: true,
-	term: true,
-	definition: true
-}).strip();
-z.object({
-	term: z.string().min(1),
-	definition: z.string().min(1)
-}).strict();
-//#endregion
 //#region ../client/src/resources/glossary.ts
 const GlossaryApiList = z.object({ data: z.array(Glossary) }).loose();
 function glossaryResource(transport) {
@@ -1819,6 +1749,17 @@ function glossaryResource(transport) {
 	};
 }
 //#endregion
+//#region ../client/src/resources/request-body.ts
+/**
+* Parse the body a caller hands a method, refusing one that does not match `schema` before any
+* request. `what` names the body in the refusal.
+*/
+function parseRequestBody(schema, value, what) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) throw new ConfigError(`invalid ${what}: ${parsed.error.issues.map(formatZodIssue).join("; ")}`);
+	return parsed.data;
+}
+//#endregion
 //#region ../client/src/resources/library.ts
 const LIBRARY_ROOT_PATH = "/api/ee/library/";
 const PUBLISH_TABLES_PATH = "/api/ee/data-studio/table/publish-tables";
@@ -1835,7 +1776,7 @@ function libraryResource(transport) {
 		return toLibrary(wire, await libraryListing(options));
 	}
 	async function libraryListing(options) {
-		const data = await listCollectionsWithLibrary(transport, LibraryCollectionInfo, options);
+		const data = await listCollectionsAs(transport, LibraryCollectionInfo, options);
 		const byId = /* @__PURE__ */ new Map();
 		for (const collection of data) if (typeof collection.id === "number") byId.set(collection.id, collection);
 		return byId;
@@ -1868,26 +1809,31 @@ function libraryResource(transport) {
 	}
 	/**
 	* Publish tables — and every upstream table they depend on — into a collection, so they lead the
-	* data pickers and rank up in search. Answers the collection they landed in.
+	* data pickers and rank up in search. Answers the collection they landed in. The endpoint
+	* answers the same whether or not the selectors matched a table, so a body that does not match
+	* `LibraryPublishTablesInput` is refused before any request.
 	*/
 	async function publishTables(params, options = {}) {
 		await transport.require("library.publishTables", options);
+		const body = parseRequestBody(LibraryPublishTablesInput, params, "tables to publish");
 		return (await transport.requestParsed(PublishTablesResponse, PUBLISH_TABLES_PATH, {
 			...options,
 			method: "POST",
-			body: params
+			body
 		})).target_collection;
 	}
 	/**
 	* Clear the Library collection from tables, and recursively from every downstream table that
-	* depends on them. The endpoint answers no JSON body.
+	* depends on them. The endpoint answers no JSON body, whether or not the selectors matched a
+	* table, so selectors that do not match `TableSelectors` are refused before any request.
 	*/
 	async function unpublishTables(params, options = {}) {
 		await transport.require("library.unpublishTables", options);
+		const body = parseRequestBody(TableSelectors, params, "table selectors");
 		await transport.requestRaw(UNPUBLISH_TABLES_PATH, {
 			...options,
 			method: "POST",
-			body: params,
+			body,
 			expectContentType: "binary"
 		});
 	}
@@ -2140,48 +2086,21 @@ function metricResource(transport) {
 	};
 }
 //#endregion
-//#region ../client/src/domain/moderation-review.ts
-const ModeratedItemType = z.enum(["card", "dashboard"]);
-const ModerationStatus = z.enum(["verified"]);
-const ModerationReview = z.object({
-	id: z.number().int(),
-	moderated_item_id: z.number().int(),
-	moderated_item_type: ModeratedItemType,
-	moderator_id: z.number().int(),
-	status: ModerationStatus.nullable(),
-	text: z.string().nullable(),
-	most_recent: z.boolean(),
-	created_at: z.string(),
-	updated_at: z.string()
-}).loose();
-ModerationReview.pick({
-	id: true,
-	moderated_item_id: true,
-	moderated_item_type: true,
-	status: true,
-	text: true,
-	most_recent: true
-}).strip();
-z.object({
-	moderated_item_id: z.number().int().positive(),
-	moderated_item_type: ModeratedItemType,
-	status: ModerationStatus.nullable().optional(),
-	text: z.string().nullable().optional()
-}).strict();
-//#endregion
 //#region ../client/src/resources/moderation-review.ts
 function moderationReviewResource(transport) {
 	/**
 	* Create a moderation review on a card or dashboard. `status: "verified"` marks the item
 	* verified, `null` or an absent status records a note that leaves it unverified. The new review
 	* becomes the item's most recent one; the server keeps the ten newest per item. Admins only.
+	* A body that does not match `ModerationReviewCreateInput` is refused before any request.
 	*/
 	async function create(params, options = {}) {
 		await transport.require("moderationReview.create", options);
+		const body = parseRequestBody(ModerationReviewCreateInput, params, "moderation review");
 		return transport.requestParsed(ModerationReview, "/api/moderation-review", {
 			...options,
 			method: "POST",
-			body: params
+			body
 		});
 	}
 	return { create };
@@ -2702,8 +2621,10 @@ function searchResource(transport) {
 	* may match, `archived` swaps the active set for the archived one, `table_db_id` restricts to
 	* items on one database, `verified` to verified content, `collection` to one collection and its
 	* descendants, `created_by` to items created by any of those users, `search_native_query` also
-	* matches the text of native queries, `include_metadata` attaches each card's `result_metadata`,
-	* and `limit`/`offset` are the window the server applies before ranking hydration.
+	* matches native query text but narrows to the models that carry one (cards, models, metrics,
+	* actions, transforms), `include_metadata` attaches each card's `result_metadata`,
+	* `include_dashboard_questions` also matches questions saved into a dashboard (excluded by
+	* default), and `limit`/`offset` are the window the server applies before ranking hydration.
 	*/
 	async function query(params = {}, options = {}) {
 		await transport.require("search.query", options);
@@ -2720,7 +2641,8 @@ function searchResource(transport) {
 				collection: params.collection,
 				created_by: params.created_by,
 				search_native_query: params.search_native_query,
-				include_metadata: params.include_metadata
+				include_metadata: params.include_metadata,
+				include_dashboard_questions: params.include_dashboard_questions
 			}
 		});
 		return {
@@ -2904,14 +2826,18 @@ function snippetResource(transport) {
 const TableApiList = z.array(Table);
 const TableApiFks = z.array(TableForeignKey);
 const SyncSchemaResponse = z.object({ status: z.literal("ok") });
-const RescanValuesResponse = z.object({ status: z.literal("success") });
+const FieldValuesResponse = z.object({ status: z.literal("success") });
 const BulkEditResponse = z.object({});
 const BULK_EDIT_PATH = "/api/data-studio/table/edit";
+const BULK_SYNC_SCHEMA_PATH = "/api/data-studio/table/sync-schema";
+const BULK_RESCAN_VALUES_PATH = "/api/data-studio/table/rescan-values";
+const BULK_DISCARD_VALUES_PATH = "/api/data-studio/table/discard-values";
 const LIST_PARAM_FEATURES = [
 	["can-query", "tableListAccessFilters"],
 	["can-write", "tableListAccessFilters"],
 	["include-transform-targets", "tableListTransformTargets"],
-	["unused-only", "tableUnusedFilter"]
+	["unused-only", "tableUnusedFilter"],
+	["published-only", "tableListPublishedFilter"]
 ];
 function listParamFeatures(params) {
 	return LIST_PARAM_FEATURES.filter(([param]) => params[param] !== void 0).map(([, feature]) => feature);
@@ -2925,7 +2851,7 @@ function tableResource(transport) {
 	* List every table the caller can see, across all databases. `term` matches names and display
 	* names; `can-query` and `can-write` keep only the tables the caller may query or edit the
 	* metadata of; `include-transform-targets` adds tables a transform writes to; `unused-only` keeps
-	* tables nothing depends on.
+	* tables nothing depends on; `published-only` keeps tables published to the library.
 	*/
 	async function list(params = {}, options = {}) {
 		await transport.require("table.list", options);
@@ -2943,6 +2869,7 @@ function tableResource(transport) {
 					"owner-email": params["owner-email"],
 					"orphan-only": params["orphan-only"],
 					"unused-only": params["unused-only"],
+					"published-only": params["published-only"],
 					"can-query": params["can-query"],
 					"can-write": params["can-write"],
 					"include-transform-targets": params["include-transform-targets"]
@@ -2992,38 +2919,107 @@ function tableResource(transport) {
 		};
 	}
 	/**
-	* Trigger a manual update of this table's schema metadata. The sync runs after the call returns;
-	* a warehouse the server cannot connect to is a 422.
+	* Trigger a sync of this table: its columns, their fingerprints and its cached field values. It
+	* never discovers new tables. The sync runs after the call returns; a warehouse the server cannot
+	* connect to is a 422.
 	*/
 	async function syncSchema(id, options = {}) {
 		await transport.require("table.syncSchema", options);
-		await transport.requestParsed(SyncSchemaResponse, `/api/table/${id}/sync_schema`, {
-			...options,
-			method: "POST"
-		});
+		return {
+			id,
+			status: (await transport.requestParsed(SyncSchemaResponse, `/api/table/${id}/sync_schema`, {
+				...options,
+				method: "POST"
+			})).status
+		};
 	}
 	/**
-	* Trigger an update of the field values of every eligible field of this table. The scan runs
-	* after the call returns.
+	* Trigger an update of the field values of every eligible field of this table that already has a
+	* cached set. The scan runs after the call returns.
 	*/
 	async function rescanValues(id, options = {}) {
 		await transport.require("table.rescanValues", options);
-		await transport.requestParsed(RescanValuesResponse, `/api/table/${id}/rescan_values`, {
-			...options,
-			method: "POST"
-		});
+		return {
+			id,
+			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/rescan_values`, {
+				...options,
+				method: "POST"
+			})).status
+		};
+	}
+	/**
+	* Discard the cached field values of every field of this table, custom display values included.
+	* No scan recreates a discarded set; the server rebuilds it, without the display values, the next
+	* time the field's values are read.
+	*/
+	async function discardValues(id, options = {}) {
+		await transport.require("table.discardValues", options);
+		return {
+			id,
+			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/discard_values`, {
+				...options,
+				method: "POST"
+			})).status
+		};
 	}
 	/**
 	* Set the same metadata on every table the selectors pick out. A table leaving the `hidden` data
-	* layer is re-synced after the call returns.
+	* layer is re-synced after the call returns. The server answers the same whether or not the
+	* selectors matched a table.
 	*/
 	async function bulkEdit(params, options = {}) {
 		await transport.require("table.bulkEdit", options);
+		await requireDataAuthorityNull(params.data_authority, options);
 		await transport.requestParsed(BulkEditResponse, BULK_EDIT_PATH, {
 			...options,
 			method: "POST",
 			body: params
 		});
+		return {
+			accepted: true,
+			...params
+		};
+	}
+	async function requireDataAuthorityNull(value, options) {
+		if (value === null) await transport.requireFeatures(["tableUserValueWithdrawal"], options);
+	}
+	async function postSelection(path, selectors, options) {
+		const body = parseRequestBody(TableSelectors, selectors, "table selectors");
+		await transport.requestRaw(path, {
+			...options,
+			method: "POST",
+			body,
+			expectContentType: "binary"
+		});
+		return {
+			accepted: true,
+			...body
+		};
+	}
+	/**
+	* Trigger a sync of every table the selectors pick out: its columns, their fingerprints and its
+	* cached field values. Every database behind them must answer a connection test first, or the
+	* call is a 422; the syncs run after it returns.
+	*/
+	async function bulkSyncSchema(selectors, options = {}) {
+		await transport.require("table.bulkSyncSchema", options);
+		return postSelection(BULK_SYNC_SCHEMA_PATH, selectors, options);
+	}
+	/**
+	* Trigger a field-values rescan of every table the selectors pick out, refreshing the sets that
+	* are already cached. The scans run after the call returns.
+	*/
+	async function bulkRescanValues(selectors, options = {}) {
+		await transport.require("table.bulkRescanValues", options);
+		return postSelection(BULK_RESCAN_VALUES_PATH, selectors, options);
+	}
+	/**
+	* Discard the cached field values of every table the selectors pick out, custom display values
+	* included. No scan recreates a discarded set.
+	*/
+	async function bulkDiscardValues(selectors, options = {}) {
+		await transport.require("table.bulkDiscardValues", options);
+		return postSelection(BULK_DISCARD_VALUES_PATH, selectors, options);
 	}
 	async function updateFromCsv(id, action, file, options) {
 		await transport.requestRaw(`/api/table/${id}/${UPLOAD_UPDATE_PATHS[action]}`, {
@@ -3065,7 +3061,11 @@ function tableResource(transport) {
 		fks,
 		syncSchema,
 		rescanValues,
+		discardValues,
 		bulkEdit,
+		bulkSyncSchema,
+		bulkRescanValues,
+		bulkDiscardValues,
 		appendCsv,
 		replaceCsv
 	};