@metabase/cli 0.4.1-alpha.release-65-integration-branch.5cbe297 → 0.5.0

package/dist/{client-1UIUBA_V.mjs → client-BmURNkkW.mjs}

@@ -1,26 +1,25 @@
-import { ct as InternalError, dt as ResponseShapeError, ft as TimeoutError, gt as formatZodIssue, ht as errorMessage, ot as ConfigError } from "./cli.mjs";
+import { At as isNonInterruptFailure, Ct as ResponseShapeError, Dt as errorMessage, Et as ValidationError, G as isRetryableStatus, J as isPlainObject, N as CapabilityError, Ot as formatZodIssue, St as PartialWriteError, U as HttpError, X as parseJson, Y as JSON_CONTENT_TYPE, Z as parseJsonOrPlain, n as isMethodKey, r as methodRequirements, vt as ConfigError, wt as TimeoutError, xt as NetworkError, yt as InternalError } from "./cli.mjs";
 import { n as Notification, r as NotificationCardPayload, t as CARD_PAYLOAD_TYPE } from "./notification-DaA4bBHW.mjs";
-import { P as HttpError, Z as PROBE_PATH, z as parseJsonOrPlain } from "./runtime-X6hVzSMW.mjs";
-import { n as createTransport } from "./transport-BmNrb0Lz.mjs";
+import { B as credentialAuthHeader, F as probeBudget, J as createServerProfile, L as profileFromProperties, M as buildNetworkError, N as isConnectionClosed, P as PROBE_PATH, R as serverInfoFromProperties, V as credentialSecrets, W as normalizeUrl, Z as SessionProperties, z as assertCredentialHeaderSafe } from "./runtime-C5Ha6Ou8.mjs";
+import { n as throwIfAborted, r as untilAborted, t as combineAborts } from "./signal-Dm4N0Bcc.mjs";
+import { n as featureFailures, r as supersedingFeature, t as checkFeatures } from "./requirement-check-T3bjQ0Mr.mjs";
 import { f as FieldWithDataSensitivity, h as fieldRemappedValueSchema, m as fieldDetailSchema, n as FieldBaseType, o as FieldSearchMatches, s as FieldSemanticType, u as FieldValues } from "./field-5nivEfd6.mjs";
 import { a as TemporalUnit, r as ParameterValues } from "./parameter-Celg0wZa.mjs";
-import { r as PivotExportFormat, t as DatasetQuery } from "./query-BKtMP5eH.mjs";
-import { a as CardQueryResult, t as Card } from "./card-P5mBknsl.mjs";
-import { b as TableVisibilityType, p as TableQueryMetadata, s as TableDataLayerTier, t as Table, u as TableForeignKey, v as TableSelectors } from "./table-Ci6bhZkb.mjs";
-import { t as Database } from "./database-BT7DVgSr.mjs";
+import { a as CardQueryResult, d as PivotExportFormat, l as DatasetQuery, t as Card } from "./card-Bv4ZN0oV.mjs";
+import { b as TableVisibilityType, p as TableQueryMetadata, s as TableDataLayerTier, t as Table, u as TableForeignKey, v as TableSelectors } from "./table-zAdW5_3H.mjs";
+import { t as Database } from "./database-BdKkae1m.mjs";
 import { t as Snippet } from "./snippet-CyKAgIZl.mjs";
-import { o as compiledQuerySchema, r as QueryMetadata } from "./dataset-BmvCxGoE.mjs";
-import { c as CollectionItem, m as CollectionTreeNode, r as Collection } from "./collection-BgPYl2c5.mjs";
+import { r as QueryMetadata, t as CompiledQuery } from "./dataset-DZgJm5hP.mjs";
+import { c as CollectionItem, m as CollectionTreeNode, r as Collection } from "./collection-zrZoJfgR.mjs";
 import { t as ContentTranslationUploadResult } from "./content-translation-BrHOrmj9.mjs";
 import { l as Dashcard, o as DashboardDetail, r as DashboardCopy, t as Dashboard } from "./dashboard-Phz3XpRM.mjs";
-import { a as DataActionExecuteResult, s as dataActionSchema } from "./data-action-DZxVB_hD.mjs";
-import { r as pollUntil } from "./poll-DFZRtTA_.mjs";
-import { i as DependencyEntity, s as DependencyGraph, t as BreakingSource, u as DependencyNode } from "./dependency-B4J1bwFh.mjs";
-import { t as Document } from "./document-COQzVLjW.mjs";
+import { r as pollUntil } from "./poll-BKo5dK0l.mjs";
+import { i as DependencyEntity, s as DependencyGraph, t as BreakingSource, u as DependencyNode } from "./dependency-tQBxYjFX.mjs";
+import { t as Document } from "./document-BDobDiap.mjs";
 import { i as EidTranslateResult } from "./eid-translation-zEHtr5Oc.mjs";
 import { c as SyncRemoteChanges, d as SyncTask, i as SyncExportPreflight, l as SyncSettingsUpdateResult, m as isSyncTaskTerminal, n as SyncDirtyItem, t as SyncBranchCreated } from "./git-sync-COokpYgc.mjs";
-import { t as Glossary } from "./glossary-CdW6RFId.mjs";
-import { a as libraryWireSchema, i as LibraryPublishTablesInput, n as LibraryCollectionInfo, o as toLibrary } from "./library-C4M8TF2N.mjs";
+import { t as Glossary } from "./glossary-6LLpItof.mjs";
+import { a as libraryWireSchema, i as LibraryPublishTablesInput, n as LibraryCollectionInfo, o as toLibrary } from "./library-fWEv38OB.mjs";
 import { t as Measure } from "./measure-CtfjqJFP.mjs";
 import { r as ModerationReviewCreateInput, t as ModerationReview } from "./moderation-review-BdqEH6N1.mjs";
 import { t as Pulse } from "./pulse-Dz0ocv0l.mjs";
@@ -32,9 +31,9 @@ import { n as SetupResult } from "./setup-CO7QV-ao.mjs";
 import { i as TimelineEvent, t as Timeline } from "./timeline-CCSU2qOS.mjs";
 import { c as transformJobSchema, n as TransformJobActiveResult, s as transformJobRunResultSchema } from "./transform-job-CCguL6LP.mjs";
 import { t as TransformTag } from "./transform-tag-CcElGp3C.mjs";
-import { i as TransformTestRunResult, t as TransformTest } from "./transform-test-BjjCQ2xm.mjs";
 import { t as UploadResult } from "./upload-DAtxBBms.mjs";
 import { z } from "zod";
+import { setTimeout } from "node:timers/promises";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -47,15 +46,425 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region ../client/src/http/response-shape.ts
+async function parseJsonResponse(text, schema, context) {
+	try {
+		return parseJson(text, schema, { source: context.url });
+	} catch (error) {
+		if (error instanceof ValidationError) throw ResponseShapeError.fromZodIssues({
+			kind: "zod",
+			method: context.method,
+			url: context.url,
+			status: context.status,
+			zodIssues: error.developerDetail.zodIssues,
+			serverTag: await context.getServerTag(),
+			serverSkew: context.serverSkew
+		});
+		throw error;
+	}
+}
+//#endregion
+//#region ../client/src/http/retry.ts
+const BASE_DELAY_MS = 250;
+const MAX_DELAY_MS = 8e3;
+const MS_PER_SECOND = 1e3;
+function backoffDelay({ attempt, retryAfterHeader }) {
+	const fromHeader = parseRetryAfter(retryAfterHeader);
+	if (fromHeader !== null) return fromHeader;
+	return Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
+}
+function parseRetryAfter(header) {
+	if (!header) return null;
+	const numeric = Number(header);
+	if (Number.isFinite(numeric) && numeric >= 0) return Math.round(numeric * MS_PER_SECOND);
+	const dateMs = Date.parse(header);
+	if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
+	return null;
+}
+function sleep(ms, signal) {
+	return setTimeout(ms, void 0, { signal });
+}
+async function runWithRetries(attempt, signal) {
+	let attemptIndex = 0;
+	while (true) {
+		const outcome = await attempt(attemptIndex);
+		if (outcome.kind === "success") return outcome.response;
+		await sleep(outcome.delayMs, signal);
+		attemptIndex += 1;
+	}
+}
+const DEFAULT_TIMEOUT_MS = 3e4;
+const OCTET_STREAM_CONTENT_TYPE = "application/octet-stream";
+const TEXT_CONTENT_TYPE_PREFIX = "text/";
+const ERROR_BODY_BYTE_CAP = 64 * 1024;
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+function createTransport(config, options) {
+	const baseUrl = normalizeUrl(config.url);
+	assertCredentialHeaderSafe(config.credential);
+	const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+	let inForce = options.server ?? null;
+	let newest = null;
+	let probesStarted = 0;
+	let applied = null;
+	const inFlight = /* @__PURE__ */ new Set();
+	const getServerTag = options.getServerTag ?? (async () => tagOf(inForce));
+	const refreshCredential = options.refreshCredential;
+	let credential = config.credential;
+	const knownSecrets = new Set(credentialSecrets(credential));
+	const redactionContext = { knownSecrets };
+	let refreshInFlight = null;
+	function tryRefreshCredential() {
+		const refresh = refreshCredential;
+		if (credential.kind !== "oauth" || refresh === void 0) return Promise.resolve(false);
+		refreshInFlight ??= refreshOnce(refresh).finally(() => {
+			refreshInFlight = null;
+		});
+		return refreshInFlight;
+	}
+	async function refreshOnce(refresh) {
+		const next = await refresh();
+		if (next === null) return false;
+		credential = next;
+		for (const secret of credentialSecrets(next)) knownSecrets.add(secret);
+		return true;
+	}
+	async function attemptOnce(prepared, attempt) {
+		const hasRetriesLeft = attempt < prepared.retries;
+		const timeoutSignal = AbortSignal.timeout(prepared.timeoutMs);
+		const combined = combineAborts(timeoutSignal, prepared.cancelSignal);
+		let response;
+		try {
+			response = await fetchImpl(prepared.url, {
+				method: prepared.method,
+				headers: prepared.headers,
+				body: prepared.body,
+				signal: combined
+			});
+		} catch (error) {
+			throwIfAborted(prepared.cancelSignal);
+			const isStaleSocketFirstTry = attempt === 0 && isConnectionClosed(error);
+			if (prepared.idempotent && (hasRetriesLeft || isStaleSocketFirstTry)) return {
+				kind: "retry",
+				delayMs: backoffDelay({ attempt })
+			};
+			if (timeoutSignal.aborted) throw new TimeoutError(`Request timed out after ${prepared.timeoutMs}ms`, {
+				kind: "http",
+				method: prepared.method,
+				url: prepared.url,
+				timeoutMs: prepared.timeoutMs
+			});
+			throw buildNetworkError(error, prepared.method, prepared.url);
+		}
+		const canRetryStatus = hasRetriesLeft && prepared.idempotent;
+		if (!response.ok && isRetryableStatus(response.status) && canRetryStatus) {
+			const retryAfter = response.headers.get("Retry-After");
+			response.body?.cancel().catch(() => void 0);
+			return {
+				kind: "retry",
+				delayMs: backoffDelay({
+					attempt,
+					retryAfterHeader: retryAfter
+				})
+			};
+		}
+		if (!response.ok) {
+			const rawBody = await readBodyForError(response);
+			const serverTag = await getServerTag();
+			throw new HttpError({
+				status: response.status,
+				statusText: response.statusText,
+				method: prepared.method,
+				url: prepared.url,
+				responseHeaders: response.headers,
+				rawBody,
+				serverTag,
+				redactionContext
+			});
+		}
+		assertContentType(response, prepared);
+		return {
+			kind: "success",
+			response
+		};
+	}
+	async function executeRaw(prepared) {
+		try {
+			return await runWithRetries((attempt) => attemptOnce(prepared, attempt), prepared.cancelSignal);
+		} catch (error) {
+			throwIfAborted(prepared.cancelSignal);
+			throw error;
+		}
+	}
+	async function executeWithAuthRefresh(path, opts) {
+		const prepared = prepare(path, opts);
+		try {
+			return {
+				response: await executeRaw(prepared),
+				prepared
+			};
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 401) {
+				if (await tryRefreshCredential()) {
+					const retried = prepare(path, opts);
+					return {
+						response: await executeRaw(retried),
+						prepared: retried
+					};
+				}
+			}
+			throw error;
+		}
+	}
+	function prepare(path, opts = {}) {
+		const method = opts.method ?? "GET";
+		const expectContentType = opts.expectContentType ?? "json";
+		const url = buildUrl(baseUrl, path, opts.query);
+		const headers = new Headers();
+		const auth = credentialAuthHeader(credential);
+		headers.set(auth.name, auth.value);
+		headers.set("accept", acceptHeader(expectContentType));
+		headers.set("user-agent", options.userAgent);
+		let body = null;
+		if (opts.body !== void 0 && opts.body !== null) if (typeof opts.body === "string" || opts.body instanceof URLSearchParams) body = opts.body;
+		else if (opts.body instanceof FormData || opts.body instanceof ReadableStream) body = opts.body;
+		else if (opts.body instanceof Uint8Array) {
+			body = opts.body;
+			headers.set("content-type", OCTET_STREAM_CONTENT_TYPE);
+		} else {
+			body = JSON.stringify(opts.body);
+			headers.set("content-type", JSON_CONTENT_TYPE);
+		}
+		return {
+			url,
+			method,
+			headers,
+			body,
+			expectContentType,
+			retries: opts.retries ?? 3,
+			idempotent: opts.idempotent ?? IDEMPOTENT_METHODS.has(method),
+			timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+			cancelSignal: combineAborts(opts.signal, options.signal)
+		};
+	}
+	async function readJson(path, opts = {}) {
+		const chosenFor = inForce;
+		const { response, prepared } = await executeWithAuthRefresh(path, {
+			...opts,
+			expectContentType: "json"
+		});
+		return {
+			text: await response.text(),
+			context: {
+				method: prepared.method,
+				url: prepared.url,
+				status: response.status,
+				...namingOf(chosenFor)
+			}
+		};
+	}
+	function namingOf(profile) {
+		if (profile === null) return {
+			getServerTag,
+			serverSkew: null
+		};
+		return {
+			getServerTag: async () => profile.version.tag,
+			serverSkew: profile.skew
+		};
+	}
+	async function runProbe(order, budget) {
+		const read = await readJson(PROBE_PATH, probeBudget(budget));
+		const properties = await parseJsonResponse(read.text, SessionProperties, read.context);
+		const info = serverInfoFromProperties(properties);
+		const profile = createServerProfile(info);
+		if (applied === null || applied.order < order) {
+			options.onServerProbed?.(info, profile);
+			applied = {
+				order,
+				profile
+			};
+			inForce = profile;
+		}
+		return {
+			properties,
+			profile,
+			read
+		};
+	}
+	function startProbe(budget) {
+		probesStarted += 1;
+		const probed = runProbe(probesStarted, budget);
+		newest = probed;
+		inFlight.add(probed);
+		probed.then(() => {
+			inFlight.delete(probed);
+		}, () => {
+			inFlight.delete(probed);
+			if (newest === probed) newest = null;
+		});
+		return probed;
+	}
+	function appliedProfile() {
+		return applied === null ? null : applied.profile;
+	}
+	function verifying() {
+		const settled = appliedProfile();
+		if (newest === null && settled !== null) return Promise.resolve(settled);
+		return (newest ?? startProbe({})).then((probed) => probed.profile, fallBackTo(appliedProfile));
+	}
+	function profileInForce() {
+		const current = inForce;
+		if (current === null) return verifying();
+		if (newest === null) return Promise.resolve(current);
+		return newest.then((probed) => probed.profile, fallBackTo(() => inForce));
+	}
+	async function server(wait = {}) {
+		throwIfAborted(wait.signal);
+		return untilAborted(profileInForce(), wait.signal);
+	}
+	async function verifiedServer(wait = {}) {
+		throwIfAborted(wait.signal);
+		return untilAborted(verifying(), wait.signal);
+	}
+	async function probe(reader, read = {}) {
+		const { signal, ...budget } = read;
+		throwIfAborted(signal);
+		const probed = await untilAborted(startProbe(budget), signal);
+		const context = {
+			...probed.read.context,
+			...namingOf(probed.profile)
+		};
+		return parseJsonResponse(probed.read.text, reader, context);
+	}
+	async function probesSettled() {
+		while (inFlight.size > 0) await Promise.allSettled(inFlight);
+	}
+	async function requireFeatures(features, wait = {}) {
+		if (features.length === 0) return;
+		const profile = await preflightServer(wait);
+		if (profile === null) return;
+		for (const failure of featureFailures(features, profile)) refuseBeforeSending(new CapabilityError(failure));
+	}
+	async function preflightServer(wait = {}) {
+		try {
+			return await verifiedServer(wait);
+		} catch (error) {
+			if (!isNonInterruptFailure(error)) throw error;
+			skipOrThrow({
+				kind: "unverified",
+				failure: error
+			});
+			return null;
+		}
+	}
+	function refuseBeforeSending(refusal) {
+		skipOrThrow({
+			kind: "refused",
+			refusal
+		});
+	}
+	function skipOrThrow(skipped) {
+		const hook = options.onPreflightSkipped;
+		if (hook === void 0) throw skippedError(skipped);
+		hook(skipped);
+	}
+	return {
+		server,
+		verifiedServer,
+		probe,
+		requireFeatures,
+		preflightServer,
+		refuseBeforeSending,
+		probesSettled,
+		async requestRaw(path, opts) {
+			return (await executeWithAuthRefresh(path, opts ?? {})).response;
+		},
+		async requestParsed(schema, path, opts) {
+			const read = await readJson(path, opts);
+			return parseJsonResponse(read.text, schema, read.context);
+		},
+		async requestStream(path, opts) {
+			const { response, prepared } = await executeWithAuthRefresh(path, {
+				...opts,
+				expectContentType: opts?.expectContentType ?? "binary"
+			});
+			if (!response.body) throw new NetworkError("Response had no body to stream", {
+				method: prepared.method,
+				url: prepared.url,
+				cause: "missing body"
+			});
+			return response.body;
+		}
+	};
+}
+function skippedError(skipped) {
+	return skipped.kind === "refused" ? skipped.refusal : skipped.failure;
+}
+function fallBackTo(fallback) {
+	return (error) => {
+		const profile = fallback();
+		if (profile !== null && isNonInterruptFailure(error)) return profile;
+		throw error;
+	};
+}
+function tagOf(profile) {
+	return profile === null ? null : profile.version.tag;
+}
+function buildUrl(baseUrl, path, query) {
+	const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+	const target = new URL(baseUrl + normalizedPath);
+	if (query) for (const [key, value] of Object.entries(query)) {
+		if (value === void 0) continue;
+		if (Array.isArray(value)) for (const entry of value) target.searchParams.append(key, String(entry));
+		else target.searchParams.append(key, String(value));
+	}
+	return target.toString();
+}
+function acceptHeader(expected) {
+	if (expected === "json") return JSON_CONTENT_TYPE;
+	if (expected === "text") return "text/*";
+	return "*/*";
+}
+function assertContentType(response, prepared) {
+	if (prepared.expectContentType === "binary") return;
+	const contentType = response.headers.get("content-type");
+	if (contentType === null) throwContentTypeMismatch(response, prepared, prepared.expectContentType);
+	if (prepared.expectContentType === "json" && !contentType.includes("application/json")) throwContentTypeMismatch(response, prepared, "json");
+	if (prepared.expectContentType === "text" && !contentType.startsWith(TEXT_CONTENT_TYPE_PREFIX)) throwContentTypeMismatch(response, prepared, "text");
+}
+function throwContentTypeMismatch(response, prepared, expected) {
+	const actual = response.headers.get("content-type") ?? "no content-type";
+	throw new HttpError({
+		status: response.status,
+		statusText: response.statusText,
+		method: prepared.method,
+		url: prepared.url,
+		responseHeaders: response.headers,
+		rawBody: null,
+		overrideUserMessage: `Expected ${expected} response but got ${actual}`
+	});
+}
+async function readBodyForError(response) {
+	try {
+		return Buffer.from(await response.arrayBuffer()).subarray(0, ERROR_BODY_BYTE_CAP).toString("utf8");
+	} catch (error) {
+		return `[body read failed: ${errorMessage(error)}]`;
+	}
+}
+//#endregion
 //#region ../client/src/resources/pivot-export.ts
-const PivotedExportsSetting = z.object({ "enable-pivoted-exports": z.boolean() });
+const PivotedExportsProperty = SessionProperties.extend({ "enable-pivoted-exports": z.boolean() });
 /**
 * Refuse a pivoted export the server would answer with plain rows: a JSON export keeps only the
 * ungrouped rows, and an admin can turn pivoted CSV and XLSX exports off.
 */
 async function assertPivotedExport(transport, format, options) {
 	if (!PivotExportFormat.safeParse(format).success) throw new ConfigError(`a ${format} export cannot be pivoted; only ${PivotExportFormat.options.join(" and ")} can`);
-	if (!(await transport.requestParsed(PivotedExportsSetting, "/api/session/properties", { ...options }))["enable-pivoted-exports"]) throw new ConfigError("the server has pivoted exports turned off (the enable-pivoted-exports setting), so it would export the plain rows");
+	if (!(await transport.probe(PivotedExportsProperty, options))["enable-pivoted-exports"]) throw new ConfigError("the server has pivoted exports turned off (the enable-pivoted-exports setting), so it would export the plain rows");
 }
 //#endregion
 //#region ../client/src/resources/card.ts
@@ -63,7 +472,6 @@ const CardApiList = z.array(Card);
 function cardResource(transport) {
 	/** List cards. `f` picks a server-side preset; `model_id` scopes the presets that need an id. */
 	async function list(params = {}, options = {}) {
-		await transport.require("card.list", options);
 		return {
 			data: await transport.requestParsed(CardApiList, "/api/card", {
 				...options,
@@ -77,12 +485,10 @@ function cardResource(transport) {
 	}
 	/** Get one card by id. */
 	async function get(id, options = {}) {
-		await transport.require("card.get", options);
 		return transport.requestParsed(Card, `/api/card/${id}`, { ...options });
 	}
 	/** Create a card — a question, a model, or a metric — from a full card body. */
 	async function create(params, options = {}) {
-		await transport.require("card.create", options);
 		return transport.requestParsed(Card, "/api/card", {
 			...options,
 			method: "POST",
@@ -91,7 +497,6 @@ function cardResource(transport) {
 	}
 	/** Update a card by id, patching only the fields the body carries. */
 	async function update(id, params, options = {}) {
-		await transport.require("card.update", options);
 		return transport.requestParsed(Card, `/api/card/${id}`, {
 			...options,
 			method: "PUT",
@@ -100,12 +505,10 @@ function cardResource(transport) {
 	}
 	/** Archive (soft-delete) a card by id. Metabase models this as an update, not its own endpoint. */
 	async function archive(id, options = {}) {
-		await transport.require("card.archive", options);
 		return update(id, { archived: true }, options);
 	}
 	/** Run a saved card and return the query result envelope. */
 	async function query(id, params, options = {}) {
-		await transport.require("card.query", options);
 		return transport.requestParsed(CardQueryResult, `/api/card/${id}/query`, {
 			...options,
 			method: "POST",
@@ -121,9 +524,8 @@ function cardResource(transport) {
 	* there before the wire.
 	*/
 	async function exportQuery(id, format, params, options = {}) {
-		await transport.require("card.exportQuery", options);
-		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
 		if (params.pivot_results) await assertPivotedExport(transport, format, options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
 		const body = new URLSearchParams({
 			parameters: JSON.stringify(params.parameters),
 			format_rows: String(params.format_rows),
@@ -141,7 +543,6 @@ function cardResource(transport) {
 	* snippets its query references, plus the card's own metadata for a model or a native query.
 	*/
 	async function queryMetadata(id, options = {}) {
-		await transport.require("card.queryMetadata", options);
 		return transport.requestParsed(QueryMetadata, `/api/card/${id}/query_metadata`, { ...options });
 	}
 	return {
@@ -227,7 +628,6 @@ function collectionResource(transport) {
 	* preset includes the Library collections that match it.
 	*/
 	async function list(params = {}, options = {}) {
-		await transport.require("collection.list", options);
 		return {
 			data: await transport.requestParsed(CollectionApiList, "/api/collection", {
 				...options,
@@ -238,12 +638,10 @@ function collectionResource(transport) {
 	}
 	/** Get one collection by id, entity id, or the `root`/`trash` alias. */
 	async function get(ref, options = {}) {
-		await transport.require("collection.get", options);
 		return transport.requestParsed(Collection, `/api/collection/${refPath(ref)}`, { ...options });
 	}
 	/** Create a new collection. */
 	async function create(params, options = {}) {
-		await transport.require("collection.create", options);
 		return transport.requestParsed(Collection, "/api/collection", {
 			...options,
 			method: "POST",
@@ -256,7 +654,6 @@ function collectionResource(transport) {
 	* moves a collection into the trash ignores `parent_id`.
 	*/
 	async function update(ref, params, options = {}) {
-		await transport.require("collection.update", options);
 		return transport.requestParsed(Collection, `/api/collection/${refPath(ref)}`, {
 			...options,
 			method: "PUT",
@@ -265,7 +662,6 @@ function collectionResource(transport) {
 	}
 	/** Archive (soft-delete) a collection. Metabase models this as an update, not its own endpoint. */
 	async function archive(ref, options = {}) {
-		await transport.require("collection.archive", options);
 		return update(ref, { archived: true }, options);
 	}
 	/**
@@ -273,7 +669,6 @@ function collectionResource(transport) {
 	* the caller consumes pages rather than a single list and decides how far to pull.
 	*/
 	async function* itemPages(ref, params = {}, options = {}) {
-		await transport.require("collection.itemPages", options);
 		yield* paginatePages(transport, `/api/collection/${refPath(ref)}/items`, CollectionItem, {
 			query: {
 				models: params.models,
@@ -288,7 +683,6 @@ function collectionResource(transport) {
 	}
 	/** Fetch the collection hierarchy as a forest of nested nodes. */
 	async function tree(params = {}, options = {}) {
-		await transport.require("collection.tree", options);
 		return {
 			data: await transport.requestParsed(CollectionTreeApiList, "/api/collection/tree", {
 				...options,
@@ -308,6 +702,128 @@ function collectionResource(transport) {
 	};
 }
 //#endregion
+//#region ../client/src/version/refusal.ts
+const REFUSAL_STATUSES = /* @__PURE__ */ new Set([
+	400,
+	402,
+	404
+]);
+function explainer(transport, namespace) {
+	function explain(name, method, parameters) {
+		const key = methodKey(namespace, name);
+		return async (...args) => {
+			try {
+				return await method(...args);
+			} catch (error) {
+				throw await explainRefusal(transport, callRequirement(key, parameters, args), error);
+			}
+		};
+	}
+	function explainWalk(name, method, parameters) {
+		const key = methodKey(namespace, name);
+		return async function* (...args) {
+			try {
+				yield* method(...args);
+			} catch (error) {
+				throw await explainRefusal(transport, callRequirement(key, parameters, args), error);
+			}
+		};
+	}
+	function refuse(name, method) {
+		const key = methodKey(namespace, name);
+		return async (...args) => {
+			await transport.requireFeatures(methodRequirements(key), trailingWait(args));
+			return method(...args);
+		};
+	}
+	function refuseAfterReading(name, reader, method) {
+		const key = methodKey(namespace, name);
+		return async (options = {}) => {
+			const properties = await transport.probe(reader, options);
+			const profile = profileFromProperties(properties);
+			for (const failure of featureFailures(methodRequirements(key), profile)) transport.refuseBeforeSending(new CapabilityError(failure));
+			return method(properties);
+		};
+	}
+	return {
+		explain,
+		explainWalk,
+		refuse,
+		refuseAfterReading
+	};
+}
+function trailingWait(args) {
+	const last = args.at(-1);
+	if (isPlainObject(last) && last["signal"] instanceof AbortSignal) return { signal: last["signal"] };
+	return {};
+}
+function methodKey(namespace, name) {
+	const key = `${namespace}.${name}`;
+	if (!isMethodKey(key)) throw new InternalError(`no requirements entry for ${key}`);
+	return key;
+}
+function callRequirement(key, parameters, args) {
+	return {
+		parameters: parameters === void 0 ? [] : parameters(...args),
+		method: methodRequirements(key)
+	};
+}
+/**
+* The error a call failed with, as a `CapabilityError` carrying the server's answer when the server
+* refused it for lacking one of the features `call` needs, and unchanged otherwise. The server's own
+* refusal is the verdict; the profile only names what was missing. The explaining probe is bounded
+* by its own timeout and the client's signal; the error stands when the probe fails, and an
+* interrupt surfaces as one.
+*/
+async function explainRefusal(transport, call, error) {
+	if (!mayBeRefusal(call, error)) return error;
+	let profile;
+	try {
+		profile = await transport.verifiedServer();
+	} catch (probeError) {
+		if (isNonInterruptFailure(probeError)) return error;
+		throw probeError;
+	}
+	const failure = explainedFailure(call, profile, error);
+	return failure === null ? error : new CapabilityError(failure, error);
+}
+/** Every feature `call` needs, parameters first, since a parameter's floor sits above its method's. */
+function callFeatures(call) {
+	return [...call.parameters.map((parameter) => parameter.feature), ...call.method];
+}
+/**
+* Whether `error` may be the server refusing `call` for a feature it lacks. A call that needs no
+* feature cannot be, and neither can a 404 for a missing row, which comes from a route the server
+* serves.
+*/
+function mayBeRefusal(call, error) {
+	if (callFeatures(call).length === 0) return false;
+	if (!(error instanceof HttpError) || error.kind === "resource-missing") return false;
+	return REFUSAL_STATUSES.has(error.status);
+}
+/**
+* The feature `profile` lacks that explains `refusal` of `call`, or `null` when the server has every
+* feature the call needs, so it failed for some other reason, or when the refusal points elsewhere.
+*/
+function explainedFailure(call, profile, refusal) {
+	const failure = checkFeatures(callFeatures(call), profile);
+	if (failure === null || pointsElsewhere(call, profile, refusal)) return null;
+	return failure;
+}
+function pointsElsewhere(call, profile, refusal) {
+	if (refusal.status !== 400 || checkFeatures(call.method, profile) !== null) return false;
+	const named = rejectedFields(refusal);
+	const gated = new Set(call.parameters.filter((parameter) => checkFeatures([parameter.feature], profile) !== null).flatMap((parameter) => parameter.fields));
+	return named.some((field) => !gated.has(field));
+}
+function rejectedFields(refusal) {
+	return [refusal.fieldErrors, refusal.specificFieldErrors].flatMap((errors) => errors === null ? [] : Object.keys(errors).map(topLevelField));
+}
+function topLevelField(path) {
+	const end = path.indexOf(".");
+	return end === -1 ? path : path.slice(0, end);
+}
+//#endregion
 //#region ../client/src/resources/csv-upload.ts
 const CSV_CONTENT_TYPE = "text/csv";
 function buildCsvFormData(file) {
@@ -319,14 +835,13 @@ function buildCsvFormData(file) {
 //#region ../client/src/resources/content-translation.ts
 const CONTENT_TRANSLATION_PATH = "/api/ee/content-translation";
 function contentTranslationResource(transport) {
+	const { explain } = explainer(transport, "contentTranslation");
 	/** Download the complete content translation dictionary as CSV. */
 	async function download(options = {}) {
-		await transport.require("contentTranslation.download", options);
 		return transport.requestStream(`${CONTENT_TRANSLATION_PATH}/csv`, options);
 	}
 	/** Replace the complete content translation dictionary with the attached CSV. */
 	async function upload(file, options = {}) {
-		await transport.require("contentTranslation.upload", options);
 		const form = buildCsvFormData(file);
 		return transport.requestParsed(ContentTranslationUploadResult, `${CONTENT_TRANSLATION_PATH}/upload-dictionary`, {
 			...options,
@@ -335,8 +850,8 @@ function contentTranslationResource(transport) {
 		});
 	}
 	return {
-		download,
-		upload
+		download: explain("download", download),
+		upload: explain("upload", upload)
 	};
 }
 //#endregion
@@ -347,7 +862,6 @@ function dashboardResource(transport) {
 	const card = cardResource(transport);
 	/** List dashboards. `f` picks a server-side preset. */
 	async function list(params = {}, options = {}) {
-		await transport.require("dashboard.list", options);
 		return {
 			data: await transport.requestParsed(DashboardApiList, "/api/dashboard", {
 				...options,
@@ -358,7 +872,6 @@ function dashboardResource(transport) {
 	}
 	/** Get one dashboard by id, with its dashcards, tabs and parameters. */
 	async function get(id, options = {}) {
-		await transport.require("dashboard.get", options);
 		return transport.requestParsed(DashboardDetail, `/api/dashboard/${id}`, { ...options });
 	}
 	/**
@@ -366,7 +879,6 @@ function dashboardResource(transport) {
 	* puts content on a fresh dashboard.
 	*/
 	async function create(params, options = {}) {
-		await transport.require("dashboard.create", options);
 		return transport.requestParsed(Dashboard, "/api/dashboard", {
 			...options,
 			method: "POST",
@@ -378,7 +890,6 @@ function dashboardResource(transport) {
 	* full replacements: whatever the body omits is deleted from the dashboard.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("dashboard.update", options);
 		return transport.requestParsed(DashboardDetail, `/api/dashboard/${id}`, {
 			...options,
 			method: "PUT",
@@ -396,7 +907,6 @@ function dashboardResource(transport) {
 	* is duplicated. Action, link and placeholder dashcards are not copied.
 	*/
 	async function copy(id, params = {}, options = {}) {
-		await transport.require("dashboard.copy", options);
 		return transport.requestParsed(DashboardCopy, `/api/dashboard/${id}/copy`, {
 			...options,
 			method: "POST",
@@ -409,7 +919,6 @@ function dashboardResource(transport) {
 	* an archive is a state change on the dashboard itself, and its dashcards are not part of it.
 	*/
 	async function archive(id, options = {}) {
-		await transport.require("dashboard.archive", options);
 		return transport.requestParsed(Dashboard, `/api/dashboard/${id}`, {
 			...options,
 			method: "PUT",
@@ -422,7 +931,6 @@ function dashboardResource(transport) {
 	* currently stands.
 	*/
 	async function updateDashcard(dashboardId, dashcardId, params, options = {}) {
-		await transport.require("dashboard.updateDashcard", options);
 		const dashboard = await get(dashboardId, options);
 		const target = dashboard.dashcards.find((dashcard) => dashcard.id === dashcardId);
 		if (target === void 0) throw new ConfigError(`dashcard ${dashcardId} not found on dashboard ${dashboardId}`);
@@ -441,7 +949,6 @@ function dashboardResource(transport) {
 	* any other way propagates as the failure it was.
 	*/
 	async function checkCardReferences(dashcards, options = {}) {
-		await transport.require("dashboard.checkCardReferences", options);
 		const grouped = groupByCardId(collectCardReferences(dashcards));
 		return (await Promise.all(Array.from(grouped.entries()).map(async ([cardId, references]) => ({
 			references,
@@ -461,7 +968,7 @@ function dashboardResource(transport) {
 		} catch (error) {
 			if (!(error instanceof HttpError)) throw error;
 			if (error.kind === "resource-missing") return { reason: "missing" };
-			if (error.kind === "auth") return {
+			if (error.kind === "auth" || error.kind === "forbidden") return {
 				reason: "unreadable",
 				detail: error.userMessage
 			};
@@ -472,7 +979,6 @@ function dashboardResource(transport) {
 	* Fetch the selectable values for a dashboard parameter, through the chain-filter value endpoint.
 	*/
 	async function parameterValues(dashboardId, parameterId, options = {}) {
-		await transport.require("dashboard.parameterValues", options);
 		return transport.requestParsed(ParameterValues, `/api/dashboard/${dashboardId}/params/${encodeURIComponent(parameterId)}/values`, { ...options });
 	}
 	/**
@@ -480,7 +986,6 @@ function dashboardResource(transport) {
 	* substring, capped at the first 1000 matches.
 	*/
 	async function searchParameterValues(dashboardId, parameterId, query, options = {}) {
-		await transport.require("dashboard.searchParameterValues", options);
 		const parameter = encodeURIComponent(parameterId);
 		return transport.requestParsed(ParameterValues, `/api/dashboard/${dashboardId}/params/${parameter}/search/${encodeURIComponent(query)}`, { ...options });
 	}
@@ -532,81 +1037,6 @@ function stripEntityId(dashcard) {
 	};
 }
 //#endregion
-//#region ../client/src/resources/data-action.ts
-function dataActionResource(transport) {
-	async function readSchema(options) {
-		const { features } = await transport.server(options);
-		return dataActionSchema(features);
-	}
-	/** List the unarchived data actions the caller can see. `GET /api/action` answers a bare array. */
-	async function list(options = {}) {
-		await transport.require("dataAction.list", options);
-		const schema = await readSchema(options);
-		return {
-			data: await transport.requestParsed(z.array(schema), "/api/action", { ...options }),
-			total: null
-		};
-	}
-	/** Get one unarchived data action by id. */
-	async function get(id, options = {}) {
-		await transport.require("dataAction.get", options);
-		const schema = await readSchema(options);
-		return transport.requestParsed(schema, `/api/action/${id}`, { ...options });
-	}
-	/** Create a data action — a parameterized native query that writes to a database — in a collection. */
-	async function create(params, options = {}) {
-		await transport.require("dataAction.create", options);
-		const schema = await readSchema(options);
-		return transport.requestParsed(schema, "/api/action", {
-			...options,
-			method: "POST",
-			body: params
-		});
-	}
-	/** Update a data action by id, patching only the fields the body carries. */
-	async function update(id, params, options = {}) {
-		await transport.require("dataAction.update", options);
-		const schema = await readSchema(options);
-		return transport.requestParsed(schema, `/api/action/${id}`, {
-			...options,
-			method: "PUT",
-			body: params
-		});
-	}
-	/** Archive (soft-delete) a data action by id. Metabase models this as an update, not its own endpoint. */
-	async function archive(id, options = {}) {
-		await transport.require("dataAction.archive", options);
-		return update(id, { archived: true }, options);
-	}
-	/** Delete a data action by id, removing it and the dashboard buttons that run it. */
-	async function remove(id, options = {}) {
-		await transport.require("dataAction.delete", options);
-		await transport.requestRaw(`/api/action/${id}`, {
-			...options,
-			method: "DELETE",
-			expectContentType: "binary"
-		});
-	}
-	/** Execute a data action by id with parameter values keyed by parameter id. */
-	async function execute(id, params, options = {}) {
-		await transport.require("dataAction.execute", options);
-		return transport.requestParsed(DataActionExecuteResult, `/api/action/${id}/execute`, {
-			...options,
-			method: "POST",
-			body: params
-		});
-	}
-	return {
-		list,
-		get,
-		create,
-		update,
-		archive,
-		delete: remove,
-		execute
-	};
-}
-//#endregion
 //#region ../client/src/resources/database.ts
 const DatabaseApiList = z.object({
 	data: z.array(Database),
@@ -619,7 +1049,6 @@ const SYNC_COMPLETE = "complete";
 function databaseResource(transport) {
 	/** List databases. `include` hydrates each database's tables; `saved` adds the Saved Questions virtual database. */
 	async function list(params = {}, options = {}) {
-		await transport.require("database.list", options);
 		const response = await transport.requestParsed(DatabaseApiList, "/api/database", {
 			...options,
 			query: {
@@ -634,7 +1063,6 @@ function databaseResource(transport) {
 	}
 	/** Get one database by id. `include` hydrates its tables, and `tables.fields` their fields too. */
 	async function get(id, params = {}, options = {}) {
-		await transport.require("database.get", options);
 		return transport.requestParsed(Database, `/api/database/${id}`, {
 			...options,
 			query: { include: params.include }
@@ -642,7 +1070,6 @@ function databaseResource(transport) {
 	}
 	/** List the schema names in a database. */
 	async function schemas(id, options = {}) {
-		await transport.require("database.schemas", options);
 		return {
 			data: await transport.requestParsed(DatabaseApiSchemaList, `/api/database/${id}/schemas`, { ...options }),
 			total: null
@@ -650,7 +1077,6 @@ function databaseResource(transport) {
 	}
 	/** List the tables one schema of a database holds. */
 	async function schemaTables(id, schema, options = {}) {
-		await transport.require("database.schemaTables", options);
 		return {
 			data: await transport.requestParsed(DatabaseApiSchemaTableList, `/api/database/${id}/schema/${encodeURIComponent(schema)}`, { ...options }),
 			total: null
@@ -661,7 +1087,6 @@ function databaseResource(transport) {
 	* pass `wait` to poll the database until it reports its initial sync complete.
 	*/
 	async function syncSchema(id, params = {}, options = {}) {
-		await transport.require("database.syncSchema", options);
 		const ack = await transport.requestParsed(DatabaseTaskAck, `/api/database/${id}/sync_schema`, {
 			...options,
 			method: "POST"
@@ -683,7 +1108,6 @@ function databaseResource(transport) {
 	}
 	/** Trigger a rescan of the cached field values across a database. */
 	async function rescanValues(id, options = {}) {
-		await transport.require("database.rescanValues", options);
 		return {
 			id,
 			status: (await transport.requestParsed(DatabaseTaskAck, `/api/database/${id}/rescan_values`, {
@@ -709,7 +1133,6 @@ function datasetResource(transport) {
 	* MBQL, or native — rather than a reference to a saved one, so nothing here is a card.
 	*/
 	async function query(body, options = {}) {
-		await transport.require("dataset.query", options);
 		return transport.requestParsed(CardQueryResult, "/api/dataset", {
 			...options,
 			method: "POST",
@@ -721,9 +1144,7 @@ function datasetResource(transport) {
 	* defaults server-side to true.
 	*/
 	async function native(datasetQuery, params = {}, options = {}) {
-		await transport.require("dataset.native", options);
-		const { features } = await transport.server(options);
-		return transport.requestParsed(compiledQuerySchema(features), "/api/dataset/native", {
+		return transport.requestParsed(CompiledQuery, "/api/dataset/native", {
 			...options,
 			method: "POST",
 			body: {
@@ -738,7 +1159,6 @@ function datasetResource(transport) {
 	* widens the field filter.
 	*/
 	async function queryMetadata(datasetQuery, options = {}) {
-		await transport.require("dataset.queryMetadata", options);
 		return transport.requestParsed(QueryMetadata, "/api/dataset/query_metadata", {
 			...options,
 			method: "POST",
@@ -757,9 +1177,8 @@ function datasetResource(transport) {
 	* there before the wire.
 	*/
 	async function exportQuery(format, params, options = {}) {
-		await transport.require("dataset.exportQuery", options);
-		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
 		if (params.pivot_results) await assertPivotedExport(transport, format, options);
+		await transport.requireFeatures(params.csv_include_bom ? ["exportCsvByteOrderMark"] : [], options);
 		const exported = params.pivot_results ? {
 			...params.query,
 			"was-pivot": true
@@ -787,15 +1206,20 @@ function datasetResource(transport) {
 //#region ../client/src/resources/dependency.ts
 const DependencyNodeApiList = z.array(DependencyNode);
 const DependencyEntityApiList = z.array(DependencyEntity);
+function graphTypeFeatures(type) {
+	return type === "measure" ? [{
+		feature: "measureDependencyGraph",
+		fields: ["type"]
+	}] : [];
+}
 function dependencyResource(transport) {
+	const { explain, explainWalk } = explainer(transport, "dependency");
 	/**
 	* The upstream dependency graph of one entity. `nodes` holds the starting entity plus every
 	* entity it depends on, directly or transitively; each edge runs from the dependent to what it
 	* depends on. A measure starts a graph only on a server with `measureDependencyGraph`.
 	*/
 	async function graph(type, id, options = {}) {
-		await transport.require("dependency.graph", options);
-		if (type === "measure") await transport.requireFeatures(["measureDependencyGraph"], options);
 		return transport.requestParsed(DependencyGraph, "/api/ee/dependencies/graph", {
 			...options,
 			query: {
@@ -811,7 +1235,6 @@ function dependencyResource(transport) {
 	* personal collections, and `sort-column` / `sort-direction` order the result.
 	*/
 	async function dependents(type, id, params = {}, options = {}) {
-		await transport.require("dependency.dependents", options);
 		return {
 			data: await transport.requestParsed(DependencyNodeApiList, "/api/ee/dependencies/graph/dependents", {
 				...options,
@@ -837,7 +1260,6 @@ function dependencyResource(transport) {
 	* `sort-direction` order the result.
 	*/
 	async function broken(type, id, params = {}, options = {}) {
-		await transport.require("dependency.broken", options);
 		return {
 			data: await transport.requestParsed(DependencyEntityApiList, "/api/ee/dependencies/graph/broken", {
 				...options,
@@ -864,7 +1286,6 @@ function dependencyResource(transport) {
 	* This endpoint pages on the server, so the caller consumes pages and decides how far to pull.
 	*/
 	async function* unreferencedPages(params = {}, options = {}) {
-		await transport.require("dependency.unreferencedPages", options);
 		if (queryLeavesNoKind(params)) {
 			yield {
 				items: [],
@@ -888,7 +1309,6 @@ function dependencyResource(transport) {
 	* caller consumes pages and decides how far to pull.
 	*/
 	async function* breakingPages(params = {}, options = {}) {
-		await transport.require("dependency.breakingPages", options);
 		if (queryLeavesNoKind(params)) {
 			yield {
 				items: [],
@@ -905,11 +1325,11 @@ function dependencyResource(transport) {
 		});
 	}
 	return {
-		graph,
-		dependents,
-		broken,
-		unreferencedPages,
-		breakingPages
+		graph: explain("graph", graph, graphTypeFeatures),
+		dependents: explain("dependents", dependents),
+		broken: explain("broken", broken),
+		unreferencedPages: explainWalk("unreferencedPages", unreferencedPages),
+		breakingPages: explainWalk("breakingPages", breakingPages)
 	};
 }
 function queryLeavesNoKind(params) {
@@ -931,9 +1351,9 @@ function itemListQuery(params) {
 //#region ../client/src/resources/document.ts
 const DocumentApiList = z.object({ items: z.array(Document) }).loose();
 function documentResource(transport) {
+	const { explain } = explainer(transport, "document");
 	/** Get existing documents. */
 	async function list(options = {}) {
-		await transport.require("document.list", options);
 		return {
 			data: (await transport.requestParsed(DocumentApiList, "/api/document", { ...options })).items,
 			total: null
@@ -941,12 +1361,10 @@ function documentResource(transport) {
 	}
 	/** Return an existing document by id. */
 	async function get(id, options = {}) {
-		await transport.require("document.get", options);
 		return transport.requestParsed(Document, `/api/document/${id}`, { ...options });
 	}
 	/** Create a new document. */
 	async function create(params, options = {}) {
-		await transport.require("document.create", options);
 		return transport.requestParsed(Document, "/api/document", {
 			...options,
 			method: "POST",
@@ -955,7 +1373,6 @@ function documentResource(transport) {
 	}
 	/** Update an existing document by id. */
 	async function update(id, params, options = {}) {
-		await transport.require("document.update", options);
 		return transport.requestParsed(Document, `/api/document/${id}`, {
 			...options,
 			method: "PUT",
@@ -964,7 +1381,6 @@ function documentResource(transport) {
 	}
 	/** Archive (soft-delete) a document by id. Metabase models this as an update, not its own endpoint. */
 	async function archive(id, options = {}) {
-		await transport.require("document.archive", options);
 		return update(id, { archived: true }, options);
 	}
 	/**
@@ -972,7 +1388,6 @@ function documentResource(transport) {
 	* it. An archived source is not found.
 	*/
 	async function copy(id, params = {}, options = {}) {
-		await transport.require("document.copy", options);
 		return transport.requestParsed(Document, `/api/document/${id}/copy`, {
 			...options,
 			method: "POST",
@@ -985,7 +1400,7 @@ function documentResource(transport) {
 		create,
 		update,
 		archive,
-		copy
+		copy: explain("copy", copy)
 	};
 }
 //#endregion
@@ -997,7 +1412,6 @@ function eidTranslationResource(transport) {
 	* lookup succeeded — the numeric id.
 	*/
 	async function translate(params, options = {}) {
-		await transport.require("eidTranslation.translate", options);
 		return transport.requestParsed(EidTranslateResult, "/api/eid-translation/translate", {
 			...options,
 			method: "POST",
@@ -1051,6 +1465,7 @@ const Erd = z.object({
 //#region ../client/src/resources/erd.ts
 const ERD_PATH = "/api/ee/erd";
 function erdResource(transport) {
+	const { explain } = explainer(transport, "erd");
 	/**
 	* Get the entity relationship diagram of a database: the readable tables as nodes, each with its
 	* fields, and the foreign keys between them as edges. `table-ids` makes those tables the focal
@@ -1058,7 +1473,6 @@ function erdResource(transport) {
 	* none.
 	*/
 	async function get(params, options = {}) {
-		await transport.require("erd.get", options);
 		return transport.requestParsed(Erd, ERD_PATH, {
 			...options,
 			query: {
@@ -1068,7 +1482,7 @@ function erdResource(transport) {
 			}
 		});
 	}
-	return { get };
+	return { get: explain("get", get) };
 }
 //#endregion
 //#region ../client/src/resources/optional-parsed.ts
@@ -1086,12 +1500,12 @@ async function fetchOptionalParsed(client, path, schema, options = {}) {
 //#region ../client/src/resources/field.ts
 const FieldApiSummary = z.tuple([z.tuple([z.literal("count"), z.number().int()]), z.tuple([z.literal("distincts"), z.number().int()])]);
 function fieldResource(transport) {
+	const { refuse } = explainer(transport, "field");
 	/**
 	* Get one field by id. A server that labels data sensitivity answers `data_sensitivity`, `null`
 	* for an unlabelled field; any other answers the field without the key (`hasDataSensitivity`).
 	*/
 	async function get(id, options = {}) {
-		await transport.require("field.get", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, { ...options });
 	}
@@ -1102,7 +1516,6 @@ function fieldResource(transport) {
 	* the label is refused there before the wire. Answers the field the way `get` does.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("field.update", options);
 		await transport.requireFeatures(params.data_sensitivity === void 0 ? [] : ["fieldDataSensitivity"], options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(fieldDetailSchema(features), `/api/field/${id}`, {
@@ -1113,11 +1526,11 @@ function fieldResource(transport) {
 	}
 	/**
 	* Label a field's data sensitivity by hand. A person's label is never overwritten by the server's
-	* classifier; `null` withdraws it, so whatever label the classifier wrote shows again. Answers
-	* the field with the label it now carries.
+	* classifier; `null` withdraws it, so whatever label the classifier wrote shows again. A server
+	* without the column drops the key silently, so the label is refused there before the wire.
+	* Answers the field with the label it now carries.
 	*/
 	async function setDataSensitivity(id, params, options = {}) {
-		await transport.require("field.setDataSensitivity", options);
 		return transport.requestParsed(FieldWithDataSensitivity, `/api/field/${id}`, {
 			...options,
 			method: "PUT",
@@ -1133,7 +1546,6 @@ function fieldResource(transport) {
 	* `value` against the display value, ignoring both `searchId` and `limit`.
 	*/
 	async function search(id, searchId, params, options = {}) {
-		await transport.require("field.search", options);
 		return transport.requestParsed(FieldSearchMatches, `/api/field/${id}/search/${searchId}`, {
 			...options,
 			query: {
@@ -1148,7 +1560,6 @@ function fieldResource(transport) {
 	* `value` and ignores any text after it, refusing only a `value` that has none.
 	*/
 	async function remapping(id, remappedId, params, options = {}) {
-		await transport.require("field.remapping", options);
 		const { features } = await transport.server(options);
 		return fetchOptionalParsed(transport, `/api/field/${id}/remapping/${remappedId}`, fieldRemappedValueSchema(features, id === remappedId), {
 			...options,
@@ -1157,7 +1568,6 @@ function fieldResource(transport) {
 	}
 	/** Get the row count and the distinct-value count for a field. */
 	async function summary(id, options = {}) {
-		await transport.require("field.summary", options);
 		const [[, count], [, distincts]] = await transport.requestParsed(FieldApiSummary, `/api/field/${id}/summary`, { ...options });
 		return {
 			field_id: id,
@@ -1167,13 +1577,12 @@ function fieldResource(transport) {
 	}
 	/** Get the cached distinct values Metabase holds for a field. */
 	async function values(id, options = {}) {
-		await transport.require("field.values", options);
 		return transport.requestParsed(FieldValues, `/api/field/${id}/values`, { ...options });
 	}
 	return {
 		get,
 		update,
-		setDataSensitivity,
+		setDataSensitivity: refuse("setDataSensitivity", setDataSensitivity),
 		search,
 		remapping,
 		summary,
@@ -1205,22 +1614,22 @@ const SyncStashStarted = z.object({
 	task_id: z.number().int().positive()
 });
 const RemoteSyncSetting = z.string().nullable();
-const RemoteSyncBranchProperty = z.object({ "remote-sync-branch": z.string().nullable().optional() });
-const FORBIDDEN_STATUS = 403;
-const UNREGISTERED_STATUS = 404;
+const RemoteSyncBranchProperty = SessionProperties.extend({ "remote-sync-branch": z.string().nullable().optional() });
+const RemoteSyncUrlProperty = SessionProperties.extend({ "remote-sync-url": z.string().nullable().optional() });
+const BRANCH_UNREADABLE_MESSAGE = "the remote-sync-branch setting is not readable: only admins see it, and a server without remote sync has none";
+const BRANCH_UNSET_MESSAGE = "git-sync tracks no branch: the remote-sync-branch setting is unset";
 function isRemoteUnreadable(error) {
 	if (!(error instanceof HttpError)) return false;
-	return error.status === FORBIDDEN_STATUS || error.status === UNREGISTERED_STATUS;
+	return error.status === 403 || error.status === 404;
 }
 function gitSyncResource(transport) {
+	const { explain, refuse, refuseAfterReading } = explainer(transport, "gitSync");
 	/** Get the running or most recently finished sync task, or null when the server has none. */
 	async function currentTask(options = {}) {
-		await transport.require("gitSync.currentTask", options);
 		return fetchOptionalParsed(transport, "/api/ee/remote-sync/current-task", SyncTask, options);
 	}
 	/** Request cancellation of the running sync task, and answer it in the state that left it. */
 	async function cancelTask(options = {}) {
-		await transport.require("gitSync.cancelTask", options);
 		return transport.requestParsed(SyncTask, "/api/ee/remote-sync/current-task/cancel", {
 			...options,
 			method: "POST"
@@ -1228,12 +1637,10 @@ function gitSyncResource(transport) {
 	}
 	/** Whether Metabase holds content changes the remote has not been told about. */
 	async function isDirty(options = {}) {
-		await transport.require("gitSync.isDirty", options);
 		return (await transport.requestParsed(SyncDirtyFlag, "/api/ee/remote-sync/is-dirty", { ...options })).is_dirty;
 	}
 	/** List the objects whose local state differs from the remote. */
 	async function dirty(options = {}) {
-		await transport.require("gitSync.dirty", options);
 		return {
 			data: (await transport.requestParsed(SyncDirtyList, "/api/ee/remote-sync/dirty", { ...options })).dirty,
 			total: null
@@ -1244,7 +1651,6 @@ function gitSyncResource(transport) {
 	* comparison; `force-refresh` re-reads the remote instead.
 	*/
 	async function hasRemoteChanges(params = {}, options = {}) {
-		await transport.require("gitSync.hasRemoteChanges", options);
 		return transport.requestParsed(SyncRemoteChanges, "/api/ee/remote-sync/has-remote-changes", {
 			...options,
 			query: { "force-refresh": params["force-refresh"] }
@@ -1255,14 +1661,16 @@ function gitSyncResource(transport) {
 	* pass `wait` to poll that task until it reaches a terminal status. A server already up to date
 	* answers no task id, and there is then nothing to poll. A server that guards the tracked branch
 	* refuses with 409 when `expected_branch` disagrees with the setting; left out, it is the tracked
-	* branch as read just before the request. `merge` folds the remote's changes into local content
-	* by a three-way merge and keeps un-pushed local changes, where a plain import refuses on a dirty
+	* branch as read just before the request, on every server with remote sync. A server that guards
+	* the branch also requires it, so there the request is refused before the wire when the setting
+	* is unset or hidden from the caller; a server without the guard ignores the assertion, and gets
+	* none when there is none to read. `merge` folds the remote's changes into local content by a
+	* three-way merge and keeps un-pushed local changes, where a plain import refuses on a dirty
 	* instance.
 	*/
 	async function importFromRemote(params = {}, options = {}) {
-		await transport.require("gitSync.import", options);
+		const expectedBranch = await expectedBranchFor(params.expected_branch, options);
 		await requireMerge(params.merge, options);
-		const expectedBranch = await guardedBranch(params.expected_branch, options);
 		const started = await transport.requestParsed(SyncImportStarted, "/api/ee/remote-sync/import", {
 			...options,
 			method: "POST",
@@ -1284,28 +1692,38 @@ function gitSyncResource(transport) {
 			final: await settle(params.wait, options)
 		};
 	}
-	async function requireMerge(merge, options) {
-		if (merge === true) await transport.requireFeatures(["remoteSyncMerge"], options);
+	async function expectedBranchFor(given, options) {
+		if (given !== void 0) return given;
+		return importAssertion(await readTrackedBranch(options));
 	}
-	async function guardedBranch(given, options) {
+	async function exportBranchFor(given, options) {
 		if (given !== void 0) return given;
-		const { features } = await transport.server(options);
-		if (!features.remoteSyncBranchGuard) return;
-		return trackedBranch(options);
+		return exportBranch(await readTrackedBranch(options));
+	}
+	async function readTrackedBranch(options) {
+		const properties = await transport.probe(RemoteSyncBranchProperty, options);
+		return {
+			tracked: properties["remote-sync-branch"],
+			features: profileFromProperties(properties).features
+		};
+	}
+	async function requireMerge(merge, options) {
+		if (merge === true) await transport.requireFeatures(["remoteSyncMerge"], options);
 	}
 	/**
 	* Export Metabase's content to the remote. The endpoint queues a task and returns at once; pass
 	* `wait` to poll that task until it reaches a terminal status. A server that guards the tracked
-	* branch refuses with 409 when `branch` is not the tracked one; left out, it is the tracked branch
-	* as read just before the request there, and the server's own default elsewhere. When the remote
-	* has moved past the last sync, a plain export ends in a `conflict` task where `merge` is
-	* available, and is refused with 400 before any task elsewhere; `merge` folds the remote's changes
-	* in by a three-way merge instead, and `force` overwrites them.
+	* branch refuses with 409 when `branch` is not the tracked one; left out, it is the tracked
+	* branch as read just before the request, and the request is refused before the wire when the
+	* setting is unset or hidden from the caller. A server without the guard exports to a named
+	* `branch` and tracks it from then on; left out, it gets none and exports to its own. When the
+	* remote has moved past the last sync, a plain export ends in a `conflict` task where `merge` is
+	* available, and is refused with 400 before any task elsewhere; `merge` folds the remote's
+	* changes in by a three-way merge instead, and `force` overwrites them.
 	*/
 	async function exportToRemote(params = {}, options = {}) {
-		await transport.require("gitSync.export", options);
+		const branchName = await exportBranchFor(params.branch, options);
 		await requireMerge(params.merge, options);
-		const branchName = await guardedBranch(params.branch, options);
 		const started = await transport.requestParsed(SyncExportStarted, "/api/ee/remote-sync/export", {
 			...options,
 			method: "POST",
@@ -1333,7 +1751,6 @@ function gitSyncResource(transport) {
 	* otherwise.
 	*/
 	async function exportPreflight(params, options = {}) {
-		await transport.require("gitSync.exportPreflight", options);
 		return transport.requestParsed(SyncExportPreflight, "/api/ee/remote-sync/export-preflight", {
 			...options,
 			query: { branch: params.branch }
@@ -1344,7 +1761,6 @@ function gitSyncResource(transport) {
 	* queues a task and returns at once; pass `wait` to poll that task to a terminal status.
 	*/
 	async function stash(params, options = {}) {
-		await transport.require("gitSync.stash", options);
 		const started = await transport.requestParsed(SyncStashStarted, "/api/ee/remote-sync/stash", {
 			...options,
 			method: "POST",
@@ -1367,7 +1783,6 @@ function gitSyncResource(transport) {
 	}
 	/** List the branches the configured remote carries. */
 	async function branches(options = {}) {
-		await transport.require("gitSync.branches", options);
 		return {
 			data: (await transport.requestParsed(SyncBranchList, "/api/ee/remote-sync/branches", { ...options })).items,
 			total: null
@@ -1375,7 +1790,6 @@ function gitSyncResource(transport) {
 	}
 	/** Create a branch on the remote and point git-sync at it. */
 	async function createBranch(params, options = {}) {
-		await transport.require("gitSync.createBranch", options);
 		return transport.requestParsed(SyncBranchCreated, "/api/ee/remote-sync/create-branch", {
 			...options,
 			method: "POST",
@@ -1384,19 +1798,42 @@ function gitSyncResource(transport) {
 	}
 	/**
 	* Mark one collection as git-synced, or unmark it. The server cascades the flag to descendants
-	* by location prefix, and may queue an export task to carry the change to the remote.
+	* by location prefix, and may queue an import task to bring the instance in line with the
+	* remote. A server without `remoteSyncCollectionsOnlyUpdate` validates every settings update as
+	* a remote configuration and fails one naming no remote, after it has applied the flag, so it is
+	* sent the remote's URL and its token as the server shows it, which it checks against the remote
+	* and keeps as they are, or a blank URL when no remote is configured, which clears the remote
+	* settings that are already empty.
 	*/
 	async function setCollectionSynced(collectionId, synced, options = {}) {
-		await transport.require("gitSync.setCollectionSynced", options);
 		return transport.requestParsed(SyncSettingsUpdateResult, "/api/ee/remote-sync/settings", {
 			...options,
 			method: "PUT",
-			body: { collections: { [collectionId]: synced } }
+			body: await settingsUpdateBody({ [collectionId]: synced }, options)
 		});
 	}
+	async function settingsUpdateBody(collections, options) {
+		const { features } = await transport.server(options);
+		if (features.remoteSyncCollectionsOnlyUpdate) return { collections };
+		const url = (await transport.probe(RemoteSyncUrlProperty, options))["remote-sync-url"];
+		if (url === void 0) return { collections };
+		if (url === null) return {
+			collections,
+			"remote-sync-url": ""
+		};
+		const token = await fetchOptionalParsed(transport, "/api/setting/remote-sync-token", RemoteSyncSetting, options);
+		if (token === null) return {
+			collections,
+			"remote-sync-url": url
+		};
+		return {
+			collections,
+			"remote-sync-url": url,
+			"remote-sync-token": token
+		};
+	}
 	/** The collections currently in git-sync's scope. */
 	async function syncedCollections(options = {}) {
-		await transport.require("gitSync.syncedCollections", options);
 		return {
 			data: (await listCollectionsAs(transport, SyncScopeCollection, options)).filter((entry) => entry.is_remote_synced === true),
 			total: null
@@ -1404,7 +1841,6 @@ function gitSyncResource(transport) {
 	}
 	/** The remote's URL, or null when none is configured or the caller may not read it. */
 	async function remoteUrl(options = {}) {
-		await transport.require("gitSync.remoteUrl", options);
 		try {
 			const url = await fetchOptionalParsed(transport, "/api/setting/remote-sync-url", RemoteSyncSetting, options);
 			return url === "" ? null : url;
@@ -1414,21 +1850,22 @@ function gitSyncResource(transport) {
 		}
 	}
 	/**
-	* The branch git-sync tracks, or null when none is configured. Refuses when the caller may not
-	* read the setting (it is admin-only) or the server has no remote-sync module, rather than
-	* reading either as unset.
+	* The branch git-sync tracks, or null when none is configured. Refuses when the server has no
+	* remote sync or the caller may not read the setting (it is admin-only), rather than reading
+	* either as unset.
 	*/
-	async function branch(options = {}) {
-		await transport.require("gitSync.branch", options);
-		const tracked = (await transport.requestParsed(RemoteSyncBranchProperty, PROBE_PATH, { ...options }))["remote-sync-branch"];
-		if (tracked === void 0) throw new ConfigError("the remote-sync-branch setting is not readable: it is visible to admins only, and absent on a server without the remote-sync module");
+	function branch(properties) {
+		const tracked = properties["remote-sync-branch"];
+		if (tracked === void 0) throw new ConfigError(BRANCH_UNREADABLE_MESSAGE);
 		return tracked;
 	}
-	/** The branch git-sync tracks, refused when none is configured or the caller may not read it. */
-	async function trackedBranch(options = {}) {
-		await transport.require("gitSync.trackedBranch", options);
-		const tracked = await branch(options);
-		if (tracked === null) throw new ConfigError("git-sync tracks no branch: the remote-sync-branch setting is unset");
+	/**
+	* The branch git-sync tracks, refused when none is configured, the server has no remote sync, or
+	* the caller may not read it.
+	*/
+	function trackedBranch(properties) {
+		const tracked = branch(properties);
+		if (tracked === null) throw new ConfigError(BRANCH_UNSET_MESSAGE);
 		return tracked;
 	}
 	/**
@@ -1436,7 +1873,6 @@ function gitSyncResource(transport) {
 	* answers null, which is terminal in the same sense: nothing further will happen.
 	*/
 	async function waitForTask(wait, options = {}) {
-		await transport.require("gitSync.waitForTask", options);
 		return settle(wait, options);
 	}
 	async function settle(wait, options) {
@@ -1446,25 +1882,38 @@ function gitSyncResource(transport) {
 		}), (task) => task === null || isSyncTaskTerminal(task.status), wait);
 	}
 	return {
-		currentTask,
-		cancelTask,
-		isDirty,
-		dirty,
-		hasRemoteChanges,
-		import: importFromRemote,
-		export: exportToRemote,
-		exportPreflight,
-		stash,
-		branches,
-		createBranch,
-		setCollectionSynced,
-		syncedCollections,
+		currentTask: explain("currentTask", currentTask),
+		cancelTask: explain("cancelTask", cancelTask),
+		isDirty: explain("isDirty", isDirty),
+		dirty: explain("dirty", dirty),
+		hasRemoteChanges: explain("hasRemoteChanges", hasRemoteChanges),
+		import: explain("import", importFromRemote),
+		export: explain("export", exportToRemote),
+		exportPreflight: explain("exportPreflight", exportPreflight),
+		stash: explain("stash", stash),
+		branches: explain("branches", branches),
+		createBranch: explain("createBranch", createBranch),
+		setCollectionSynced: explain("setCollectionSynced", setCollectionSynced),
+		syncedCollections: refuse("syncedCollections", syncedCollections),
 		remoteUrl,
-		branch,
-		trackedBranch,
-		waitForTask
+		branch: refuseAfterReading("branch", RemoteSyncBranchProperty, branch),
+		trackedBranch: refuseAfterReading("trackedBranch", RemoteSyncBranchProperty, trackedBranch),
+		waitForTask: explain("waitForTask", waitForTask)
 	};
 }
+function importAssertion(read) {
+	if (!read.features.remoteSync) return;
+	if (read.features.remoteSyncBranchGuard) return requiredBranch(read.tracked);
+	return typeof read.tracked === "string" ? read.tracked : void 0;
+}
+function exportBranch(read) {
+	if (!read.features.remoteSync || !read.features.remoteSyncBranchGuard) return;
+	return requiredBranch(read.tracked);
+}
+function requiredBranch(tracked) {
+	if (typeof tracked === "string") return tracked;
+	throw new ConfigError(tracked === null ? BRANCH_UNSET_MESSAGE : BRANCH_UNREADABLE_MESSAGE);
+}
 //#endregion
 //#region ../client/src/resources/glossary.ts
 const GlossaryApiList = z.object({ data: z.array(Glossary) }).loose();
@@ -1474,7 +1923,6 @@ function glossaryResource(transport) {
 	* contains it, case-insensitively.
 	*/
 	async function list(params = {}, options = {}) {
-		await transport.require("glossary.list", options);
 		return {
 			data: (await transport.requestParsed(GlossaryApiList, "/api/glossary", {
 				...options,
@@ -1485,7 +1933,6 @@ function glossaryResource(transport) {
 	}
 	/** Create a glossary entry, a term and its definition. Terms are unique. */
 	async function create(params, options = {}) {
-		await transport.require("glossary.create", options);
 		return transport.requestParsed(Glossary, "/api/glossary", {
 			...options,
 			method: "POST",
@@ -1494,7 +1941,6 @@ function glossaryResource(transport) {
 	}
 	/** Replace the term and definition of a glossary entry by id. */
 	async function update(id, params, options = {}) {
-		await transport.require("glossary.update", options);
 		return transport.requestParsed(Glossary, `/api/glossary/${id}`, {
 			...options,
 			method: "PUT",
@@ -1503,7 +1949,6 @@ function glossaryResource(transport) {
 	}
 	/** Delete a glossary entry by id. */
 	async function remove(id, options = {}) {
-		await transport.require("glossary.delete", options);
 		await transport.requestRaw(`/api/glossary/${id}`, {
 			...options,
 			method: "DELETE",
@@ -1536,9 +1981,9 @@ const UNPUBLISH_TABLES_PATH = "/api/ee/data-studio/table/unpublish-tables";
 const LIBRARY_DATA_TYPE = "library-data";
 const PublishTablesResponse = z.object({ target_collection: Collection.nullable() });
 function libraryResource(transport) {
+	const { explain } = explainer(transport, "library");
 	/** Get the Library root and its child collections, or `null` on an instance that has none. */
 	async function get(options = {}) {
-		await transport.require("library.get", options);
 		const { features } = await transport.server(options);
 		const wire = await transport.requestParsed(libraryWireSchema(features), LIBRARY_ROOT_PATH, { ...options });
 		if (wire === null) return null;
@@ -1557,7 +2002,6 @@ function libraryResource(transport) {
 	* back from a refetch, which together make this idempotent.
 	*/
 	async function create(options = {}) {
-		await transport.require("library.create", options);
 		const existing = await get(options);
 		if (existing !== null) return existing;
 		await transport.requestRaw(LIBRARY_ROOT_PATH, {
@@ -1570,7 +2014,6 @@ function libraryResource(transport) {
 	}
 	/** The id of the Library's Data collection, creating the Library first when it does not exist. */
 	async function ensureDataCollectionId(options = {}) {
-		await transport.require("library.ensureDataCollectionId", options);
 		const data = (await create(options)).effective_children.find((child) => child.type === LIBRARY_DATA_TYPE);
 		if (data === void 0) throw new Error("Library has no Data collection to publish into");
 		if (typeof data.id !== "number") throw new Error(`Library Data collection has a non-numeric id ${String(data.id)}`);
@@ -1583,7 +2026,6 @@ function libraryResource(transport) {
 	* `LibraryPublishTablesInput` is refused before any request.
 	*/
 	async function publishTables(params, options = {}) {
-		await transport.require("library.publishTables", options);
 		const body = parseRequestBody(LibraryPublishTablesInput, params, "tables to publish");
 		return (await transport.requestParsed(PublishTablesResponse, PUBLISH_TABLES_PATH, {
 			...options,
@@ -1597,7 +2039,6 @@ function libraryResource(transport) {
 	* table, so selectors that do not match `TableSelectors` are refused before any request.
 	*/
 	async function unpublishTables(params, options = {}) {
-		await transport.require("library.unpublishTables", options);
 		const body = parseRequestBody(TableSelectors, params, "table selectors");
 		await transport.requestRaw(UNPUBLISH_TABLES_PATH, {
 			...options,
@@ -1607,20 +2048,20 @@ function libraryResource(transport) {
 		});
 	}
 	return {
-		get,
-		create,
-		ensureDataCollectionId,
-		publishTables,
-		unpublishTables
+		get: explain("get", get),
+		create: explain("create", create),
+		ensureDataCollectionId: explain("ensureDataCollectionId", ensureDataCollectionId),
+		publishTables: explain("publishTables", publishTables),
+		unpublishTables: explain("unpublishTables", unpublishTables)
 	};
 }
 //#endregion
 //#region ../client/src/resources/measure.ts
 const MeasureApiList = z.array(Measure);
 function measureResource(transport) {
+	const { explain } = explainer(transport, "measure");
 	/** List measures. */
 	async function list(options = {}) {
-		await transport.require("measure.list", options);
 		return {
 			data: await transport.requestParsed(MeasureApiList, "/api/measure", { ...options }),
 			total: null
@@ -1628,12 +2069,10 @@ function measureResource(transport) {
 	}
 	/** Get one measure by id. */
 	async function get(id, options = {}) {
-		await transport.require("measure.get", options);
 		return transport.requestParsed(Measure, `/api/measure/${id}`, { ...options });
 	}
 	/** Create a measure — a saved aggregation tied to a table — from a full measure body. */
 	async function create(params, options = {}) {
-		await transport.require("measure.create", options);
 		return transport.requestParsed(Measure, "/api/measure", {
 			...options,
 			method: "POST",
@@ -1645,7 +2084,6 @@ function measureResource(transport) {
 	* required and lands in the audit log.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("measure.update", options);
 		return transport.requestParsed(Measure, `/api/measure/${id}`, {
 			...options,
 			method: "PUT",
@@ -1657,18 +2095,17 @@ function measureResource(transport) {
 	* so it carries the same required `revision_message`.
 	*/
 	async function archive(id, params, options = {}) {
-		await transport.require("measure.archive", options);
 		return update(id, {
 			archived: true,
 			revision_message: params.revision_message
 		}, options);
 	}
 	return {
-		list,
-		get,
-		create,
-		update,
-		archive
+		list: explain("list", list),
+		get: explain("get", get),
+		create: explain("create", create),
+		update: explain("update", update),
+		archive: explain("archive", archive)
 	};
 }
 //#endregion
@@ -1809,12 +2246,12 @@ const MetricDimensionListing = z.object({
 //#endregion
 //#region ../client/src/resources/metric.ts
 function metricResource(transport) {
+	const { explain } = explainer(transport, "metric");
 	/**
 	* Run a metric definition and return the query result envelope: one metric or measure, or an
 	* arithmetic expression over several, each leaf filtered and projected on its own `lib/uuid`.
 	*/
 	async function query(definition, options = {}) {
-		await transport.require("metric.query", options);
 		return transport.requestParsed(CardQueryResult, "/api/metric/dataset", {
 			...options,
 			method: "POST",
@@ -1826,7 +2263,6 @@ function metricResource(transport) {
 	* Takes the same definition `query` does.
 	*/
 	async function breakoutValues(definition, options = {}) {
-		await transport.require("metric.breakoutValues", options);
 		return transport.requestParsed(MetricBreakoutValues, "/api/metric/breakout-values", {
 			...options,
 			method: "POST",
@@ -1838,7 +2274,6 @@ function metricResource(transport) {
 	* add, grouped by source table. `query` filters both by a name substring.
 	*/
 	async function dimensions(id, params = {}, options = {}) {
-		await transport.require("metric.dimensions", options);
 		return transport.requestParsed(MetricDimensionListing, `/api/metric/${id}/dimension`, {
 			...options,
 			query: {
@@ -1849,14 +2284,15 @@ function metricResource(transport) {
 		});
 	}
 	return {
-		query,
-		breakoutValues,
-		dimensions
+		query: explain("query", query),
+		breakoutValues: explain("breakoutValues", breakoutValues),
+		dimensions: explain("dimensions", dimensions)
 	};
 }
 //#endregion
 //#region ../client/src/resources/moderation-review.ts
 function moderationReviewResource(transport) {
+	const { explain } = explainer(transport, "moderationReview");
 	/**
 	* Create a moderation review on a card or dashboard. `status: "verified"` marks the item
 	* verified, `null` or an absent status records a note that leaves it unverified. The new review
@@ -1864,7 +2300,6 @@ function moderationReviewResource(transport) {
 	* A body that does not match `ModerationReviewCreateInput` is refused before any request.
 	*/
 	async function create(params, options = {}) {
-		await transport.require("moderationReview.create", options);
 		const body = parseRequestBody(ModerationReviewCreateInput, params, "moderation review");
 		return transport.requestParsed(ModerationReview, "/api/moderation-review", {
 			...options,
@@ -1872,7 +2307,7 @@ function moderationReviewResource(transport) {
 			body
 		});
 	}
-	return { create };
+	return { create: explain("create", create) };
 }
 //#endregion
 //#region ../client/src/resources/notification.ts
@@ -1903,7 +2338,6 @@ function notificationResource(transport) {
 	* the request pins the card payload type.
 	*/
 	async function list(params = {}, options = {}) {
-		await transport.require("notification.list", options);
 		return {
 			data: await transport.requestParsed(NotificationApiList, "/api/notification", {
 				...options,
@@ -1920,12 +2354,10 @@ function notificationResource(transport) {
 	}
 	/** Get one question alert by id, refusing an id that names a system-event notification. */
 	async function get(id, options = {}) {
-		await transport.require("notification.get", options);
 		return assertCardAlert(await transport.requestParsed(Notification, `/api/notification/${id}`, { ...options }));
 	}
 	/** Create a question alert — its card payload, schedules and handlers — from a full body. */
 	async function create(params, options = {}) {
-		await transport.require("notification.create", options);
 		return transport.requestParsed(Notification, "/api/notification", {
 			...options,
 			method: "POST",
@@ -1934,7 +2366,6 @@ function notificationResource(transport) {
 	}
 	/** Update a question alert by id, merging the patch over the stored notification. */
 	async function update(id, params, options = {}) {
-		await transport.require("notification.update", options);
 		const current = await get(id, options);
 		return transport.requestParsed(Notification, `/api/notification/${id}`, {
 			...options,
@@ -1944,7 +2375,6 @@ function notificationResource(transport) {
 	}
 	/** Archive a question alert by id, stopping every delivery. Metabase models this as an update. */
 	async function archive(id, options = {}) {
-		await transport.require("notification.archive", options);
 		return update(id, { active: false }, options);
 	}
 	/**
@@ -1952,7 +2382,6 @@ function notificationResource(transport) {
 	* body.
 	*/
 	async function send(id, options = {}) {
-		await transport.require("notification.send", options);
 		await get(id, options);
 		await transport.requestRaw(`/api/notification/${id}/send`, {
 			...options,
@@ -2012,7 +2441,6 @@ function permissionResource(transport) {
 	* one database is the question.
 	*/
 	async function graph(options = {}) {
-		await transport.require("permission.graph", options);
 		return transport.requestParsed(PermissionsGraph, "/api/permissions/graph", { ...options });
 	}
 	/**
@@ -2021,12 +2449,10 @@ function permissionResource(transport) {
 	* group up under the database and read `view-data` and `create-queries` down to the table id.
 	*/
 	async function databaseGraph(id, options = {}) {
-		await transport.require("permission.databaseGraph", options);
 		return transport.requestParsed(PermissionsGraph, `/api/permissions/graph/db/${id}`, { ...options });
 	}
 	/** Get the data permissions of one group on every database. Admin only. */
 	async function groupGraph(id, options = {}) {
-		await transport.require("permission.groupGraph", options);
 		return transport.requestParsed(PermissionsGraph, `/api/permissions/graph/group/${id}`, { ...options });
 	}
 	return {
@@ -2048,7 +2474,6 @@ function mergePulseUpdate(current, patch) {
 function pulseResource(transport) {
 	/** List dashboard subscriptions, optionally narrowed to one dashboard or to the archived ones. */
 	async function list(params = {}, options = {}) {
-		await transport.require("pulse.list", options);
 		return {
 			data: await transport.requestParsed(PulseApiList, "/api/pulse", {
 				...options,
@@ -2062,21 +2487,27 @@ function pulseResource(transport) {
 	}
 	/** Get one dashboard subscription by id. */
 	async function get(id, options = {}) {
-		await transport.require("pulse.get", options);
 		return transport.requestParsed(Pulse, `/api/pulse/${id}`, { ...options });
 	}
-	/** Create a dashboard subscription — its cards and its delivery channels — from a full body. */
+	/**
+	* Create a dashboard subscription — its cards and its delivery channels — from a full body.
+	* Non-empty `parameters` need the `dashboard_subscription_filters` premium feature, and are
+	* refused before the wire without it.
+	*/
 	async function create(params, options = {}) {
-		await transport.require("pulse.create", options);
+		await requireSubscriptionFilters(params.parameters, options);
 		return transport.requestParsed(Pulse, "/api/pulse", {
 			...options,
 			method: "POST",
 			body: params
 		});
 	}
-	/** Update a dashboard subscription by id, carrying the server-defaulted flags forward. */
+	/**
+	* Update a dashboard subscription by id, carrying the server-defaulted flags forward. Non-empty
+	* `parameters` are refused as on `create`.
+	*/
 	async function update(id, params, options = {}) {
-		await transport.require("pulse.update", options);
+		await requireSubscriptionFilters(params.parameters, options);
 		const current = await get(id, options);
 		return transport.requestParsed(Pulse, `/api/pulse/${id}`, {
 			...options,
@@ -2089,9 +2520,11 @@ function pulseResource(transport) {
 	* update, and disables each of the subscription's channels as a side effect.
 	*/
 	async function archive(id, options = {}) {
-		await transport.require("pulse.archive", options);
 		return update(id, { archived: true }, options);
 	}
+	async function requireSubscriptionFilters(parameters, options) {
+		if (parameters !== void 0 && parameters.length > 0) await transport.requireFeatures(["dashboardSubscriptionFilters"], options);
+	}
 	return {
 		list,
 		get,
@@ -2194,6 +2627,7 @@ const ReplacementRunStarted = z.object({ run_id: z.number().int().positive() });
 const ReplacementApiRunList = z.array(ReplacementRun);
 const CancelRunResponse = z.object({ success: z.literal(true) });
 function replacementResource(transport) {
+	const { explain } = explainer(transport, "replacement");
 	/**
 	* Check whether every usage of a source entity could be rewritten to read a target entity
 	* instead: the two must share a database, the target must not depend on the source, every source
@@ -2201,7 +2635,6 @@ function replacementResource(transport) {
 	* implicitly or sandboxed. Admins only.
 	*/
 	async function checkReplaceSource(params, options = {}) {
-		await transport.require("replacement.checkReplaceSource", options);
 		return transport.requestParsed(ReplacementCheck, "/api/ee/replacement/check-replace-source", {
 			...options,
 			method: "POST",
@@ -2214,7 +2647,6 @@ function replacementResource(transport) {
 	* while another replacement is running. Admins only.
 	*/
 	async function replaceSource(params, options = {}) {
-		await transport.require("replacement.replaceSource", options);
 		return transport.requestParsed(ReplacementRunStarted, "/api/ee/replacement/replace-source", {
 			...options,
 			method: "POST",
@@ -2229,7 +2661,6 @@ function replacementResource(transport) {
 	* replacement is running. Admins only.
 	*/
 	async function replaceModelWithTransform(params, options = {}) {
-		await transport.require("replacement.replaceModelWithTransform", options);
 		return transport.requestParsed(ReplacementRunStarted, "/api/ee/replacement/replace-model-with-transform", {
 			...options,
 			method: "POST",
@@ -2241,7 +2672,6 @@ function replacementResource(transport) {
 	* `false` only the ended ones. Admins only.
 	*/
 	async function listRuns(params = {}, options = {}) {
-		await transport.require("replacement.listRuns", options);
 		return {
 			data: await transport.requestParsed(ReplacementApiRunList, "/api/ee/replacement/runs", {
 				...options,
@@ -2252,24 +2682,22 @@ function replacementResource(transport) {
 	}
 	/** Get one replacement run by id, with its status and progress. Admins only. */
 	async function getRun(id, options = {}) {
-		await transport.require("replacement.getRun", options);
 		return transport.requestParsed(ReplacementRun, `/api/ee/replacement/runs/${id}`, { ...options });
 	}
 	/** Cancel the replacement in progress. Refuses with a 409 once the run has ended. Admins only. */
 	async function cancelRun(id, options = {}) {
-		await transport.require("replacement.cancelRun", options);
 		await transport.requestParsed(CancelRunResponse, `/api/ee/replacement/runs/${id}/cancel`, {
 			...options,
 			method: "POST"
 		});
 	}
 	return {
-		checkReplaceSource,
-		replaceSource,
-		replaceModelWithTransform,
-		listRuns,
-		getRun,
-		cancelRun
+		checkReplaceSource: explain("checkReplaceSource", checkReplaceSource),
+		replaceSource: explain("replaceSource", replaceSource),
+		replaceModelWithTransform: explain("replaceModelWithTransform", replaceModelWithTransform),
+		listRuns: explain("listRuns", listRuns),
+		getRun: explain("getRun", getRun),
+		cancelRun: explain("cancelRun", cancelRun)
 	};
 }
 //#endregion
@@ -2348,13 +2776,15 @@ const ENTITY_FEATURES = {
 };
 function entityFeatures(entity) {
 	const feature = ENTITY_FEATURES[entity];
-	return feature === void 0 ? [] : [feature];
+	return feature === void 0 ? [] : [{
+		feature,
+		fields: ["entity"]
+	}];
 }
 function revisionResource(transport) {
+	const { explain } = explainer(transport, "revision");
 	/** List the revisions of an entity the caller may read, newest first, each with its diff. */
 	async function list(entity, id, options = {}) {
-		await transport.require("revision.list", options);
-		await transport.requireFeatures(entityFeatures(entity), options);
 		return {
 			data: await transport.requestParsed(RevisionApiList, `/api/revision/${entity}/${id}`, { ...options }),
 			total: null
@@ -2365,8 +2795,6 @@ function revisionResource(transport) {
 	* card the permission to run the query being restored.
 	*/
 	async function revert(params, options = {}) {
-		await transport.require("revision.revert", options);
-		await transport.requireFeatures(entityFeatures(params.entity), options);
 		return transport.requestParsed(RevisionApiRevert, "/api/revision/revert", {
 			...options,
 			method: "POST",
@@ -2374,8 +2802,8 @@ function revisionResource(transport) {
 		});
 	}
 	return {
-		list,
-		revert
+		list: explain("list", list, entityFeatures),
+		revert: explain("revert", revert, (params) => entityFeatures(params.entity))
 	};
 }
 //#endregion
@@ -2384,7 +2812,14 @@ const SearchApiResponse = z.object({
 	data: z.array(SearchResult),
 	total: z.number().int().nonnegative()
 }).loose();
+function verifiedFeatures(params = {}) {
+	return params.verified === true ? [{
+		feature: "contentVerification",
+		fields: ["verified"]
+	}] : [];
+}
 function searchResource(transport) {
+	const { explain } = explainer(transport, "search");
 	/**
 	* Search over the instance's content, ranked against `q`. `models` narrows which kinds of entity
 	* may match, `archived` swaps the active set for the archived one, `table_db_id` restricts to
@@ -2394,9 +2829,12 @@ function searchResource(transport) {
 	* actions, transforms), `include_metadata` attaches each card's `result_metadata`,
 	* `include_dashboard_questions` also matches questions saved into a dashboard (excluded by
 	* default), and `limit`/`offset` are the window the server applies before ranking hydration.
+	* `verified` needs the `content_verification` premium feature, and is refused before the wire
+	* without it: a server granting neither it nor `official_collections` refuses the filter, and one
+	* granting `official_collections` alone takes it without applying it.
 	*/
 	async function query(params = {}, options = {}) {
-		await transport.require("search.query", options);
+		await transport.requireFeatures(verifiedFeatures(params).map((requirement) => requirement.feature), options);
 		const response = await transport.requestParsed(SearchApiResponse, "/api/search", {
 			...options,
 			query: {
@@ -2419,7 +2857,7 @@ function searchResource(transport) {
 			total: response.total
 		};
 	}
-	return { query };
+	return { query: explain("query", query, verifiedFeatures) };
 }
 //#endregion
 //#region ../client/src/resources/segment.ts
@@ -2427,7 +2865,6 @@ const SegmentApiList = z.array(Segment);
 function segmentResource(transport) {
 	/** List every segment the caller can see. */
 	async function list(options = {}) {
-		await transport.require("segment.list", options);
 		return {
 			data: await transport.requestParsed(SegmentApiList, "/api/segment", { ...options }),
 			total: null
@@ -2435,12 +2872,10 @@ function segmentResource(transport) {
 	}
 	/** Get one segment by id. */
 	async function get(id, options = {}) {
-		await transport.require("segment.get", options);
 		return transport.requestParsed(Segment, `/api/segment/${id}`, { ...options });
 	}
 	/** Create a segment — a reusable row filter over one table — from a full segment body. */
 	async function create(params, options = {}) {
-		await transport.require("segment.create", options);
 		return transport.requestParsed(Segment, "/api/segment", {
 			...options,
 			method: "POST",
@@ -2452,7 +2887,6 @@ function segmentResource(transport) {
 	* required: Metabase records every segment change in its revision history.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("segment.update", options);
 		return transport.requestParsed(Segment, `/api/segment/${id}`, {
 			...options,
 			method: "PUT",
@@ -2464,7 +2898,6 @@ function segmentResource(transport) {
 	* same required `revision_message`.
 	*/
 	async function archive(id, params, options = {}) {
-		await transport.require("segment.archive", options);
 		return update(id, {
 			archived: true,
 			revision_message: params.revision_message
@@ -2489,7 +2922,6 @@ function rethrowSettingError(error, key) {
 function settingResource(transport) {
 	/** Get all settings and their values, with descriptions and environment-variable names. */
 	async function list(options = {}) {
-		await transport.require("setting.list", options);
 		return {
 			data: await transport.requestParsed(SettingApiList, "/api/setting", { ...options }),
 			total: null
@@ -2500,12 +2932,10 @@ function settingResource(transport) {
 	* reaches the caller as `null`; a string-typed setting answers bare text rather than JSON.
 	*/
 	async function get(key, options = {}) {
-		await transport.require("setting.get", options);
 		return fetchOptionalParsed(transport, `/api/setting/${encodeURIComponent(key)}`, z.unknown(), options).catch((error) => rethrowSettingError(error, key));
 	}
 	/** Set a single setting's value by key. The endpoint answers 204 with no body. */
 	async function set(key, value, options = {}) {
-		await transport.require("setting.set", options);
 		await transport.requestRaw(`/api/setting/${encodeURIComponent(key)}`, {
 			...options,
 			method: "PUT",
@@ -2527,7 +2957,6 @@ function setupResource(transport) {
 	* applying the instance preferences. The setup token is single-use.
 	*/
 	async function create(params, options = {}) {
-		await transport.require("setup.create", options);
 		return transport.requestParsed(SetupResult, "/api/setup", {
 			...options,
 			method: "POST",
@@ -2542,7 +2971,6 @@ const SnippetApiList = z.array(Snippet);
 function snippetResource(transport) {
 	/** List native query snippets. `archived` swaps the listing to archived snippets. */
 	async function list(params = {}, options = {}) {
-		await transport.require("snippet.list", options);
 		return {
 			data: await transport.requestParsed(SnippetApiList, "/api/native-query-snippet", {
 				...options,
@@ -2553,12 +2981,10 @@ function snippetResource(transport) {
 	}
 	/** Get one native query snippet by id. */
 	async function get(id, options = {}) {
-		await transport.require("snippet.get", options);
 		return transport.requestParsed(Snippet, `/api/native-query-snippet/${id}`, { ...options });
 	}
 	/** Create a native query snippet from a name, its SQL fragment, and an optional collection. */
 	async function create(params, options = {}) {
-		await transport.require("snippet.create", options);
 		return transport.requestParsed(Snippet, "/api/native-query-snippet", {
 			...options,
 			method: "POST",
@@ -2567,7 +2993,6 @@ function snippetResource(transport) {
 	}
 	/** Update a native query snippet by id, patching only the fields the body carries. */
 	async function update(id, params, options = {}) {
-		await transport.require("snippet.update", options);
 		return transport.requestParsed(Snippet, `/api/native-query-snippet/${id}`, {
 			...options,
 			method: "PUT",
@@ -2579,7 +3004,6 @@ function snippetResource(transport) {
 	* own endpoint.
 	*/
 	async function archive(id, options = {}) {
-		await transport.require("snippet.archive", options);
 		return update(id, { archived: true }, options);
 	}
 	return {
@@ -2609,13 +3033,23 @@ const LIST_PARAM_FEATURES = [
 	["published-only", "tableListPublishedFilter"]
 ];
 function listParamFeatures(params) {
-	return LIST_PARAM_FEATURES.filter(([param]) => params[param] !== void 0).map(([, feature]) => feature);
+	return LIST_PARAM_FEATURES.filter(([param]) => params[param] === true).map(([, feature]) => feature);
+}
+function dataLayerFeatures(value, field) {
+	return isTierName(value) ? [{
+		feature: "tableDataLayerTiers",
+		fields: [field]
+	}] : [];
+}
+function isTierName(value) {
+	return value !== null && value !== void 0 && TableDataLayerTier.safeParse(value).success;
 }
 const UPLOAD_UPDATE_PATHS = {
 	append: "append-csv",
 	replace: "replace-csv"
 };
 function tableResource(transport) {
+	const { explain } = explainer(transport, "table");
 	/**
 	* List every table the caller can see, across all databases. `term` matches names and display
 	* names; `can-query` and `can-write` keep only the tables the caller may query or edit the
@@ -2623,9 +3057,7 @@ function tableResource(transport) {
 	* tables nothing depends on; `published-only` keeps tables published to the library.
 	*/
 	async function list(params = {}, options = {}) {
-		await transport.require("table.list", options);
 		await transport.requireFeatures(listParamFeatures(params), options);
-		await requireDataLayer(params["data-layer"], options);
 		return {
 			data: await transport.requestParsed(TableApiList, "/api/table", {
 				...options,
@@ -2649,31 +3081,30 @@ function tableResource(transport) {
 	}
 	/** Get one table by id, without its fields. */
 	async function get(id, options = {}) {
-		await transport.require("table.get", options);
 		return transport.requestParsed(Table, `/api/table/${id}`, { ...options });
 	}
 	/** Update a table by id, patching only the fields the body carries. */
 	async function update(id, params, options = {}) {
-		await transport.require("table.update", options);
-		await requireDataLayer(params.data_layer, options);
-		return transport.requestParsed(Table, `/api/table/${id}`, {
+		await refuseRewrittenDataLayer(params.data_layer, options);
+		await requireDataAuthorityNull(params.data_authority, options);
+		const path = `/api/table/${id}`;
+		const updated = await transport.requestParsed(Table, path, {
 			...options,
 			method: "PUT",
 			body: params
 		});
+		assertCollectionWritten(path, params.collection_id, updated);
+		return updated;
 	}
-	async function requireDataLayer(value, options) {
-		if (value === null || value === void 0) return;
-		if (TableDataLayerTier.safeParse(value).success) {
-			await transport.requireFeatures(["tableDataLayerTiers"], options);
-			return;
-		}
-		const { features } = await transport.server(options);
-		if (features.tableDataLayerTiers) throw new ConfigError(`data_layer "${value}" is a medallion name; this server names a table's layer ${TableDataLayerTier.options.join(", ")}`);
+	async function refuseRewrittenDataLayer(value, options) {
+		if (value === null || value === void 0 || isTierName(value)) return;
+		const profile = await transport.preflightServer(options);
+		if (profile === null) return;
+		const failure = supersedingFeature("tableDataLayerTiers", profile, `data_layer "${value}" is a medallion name; this server names a table's layer ${TableDataLayerTier.options.join(", ")} and would map it onto one of those without a word`);
+		if (failure !== null) transport.refuseBeforeSending(new CapabilityError(failure));
 	}
 	/** Get a table by id with its fields hydrated — the metadata the query builder runs on. */
 	async function queryMetadata(id, options = {}) {
-		await transport.require("table.queryMetadata", options);
 		return transport.requestParsed(TableQueryMetadata, `/api/table/${id}/query_metadata`, { ...options });
 	}
 	/**
@@ -2681,7 +3112,6 @@ function tableResource(transport) {
 	* fields answers no content, which is the same empty list.
 	*/
 	async function fks(id, options = {}) {
-		await transport.require("table.fks", options);
 		return {
 			data: await fetchOptionalParsed(transport, `/api/table/${id}/fks`, TableApiFks, { ...options }) ?? [],
 			total: null
@@ -2693,7 +3123,6 @@ function tableResource(transport) {
 	* connect to is a 422.
 	*/
 	async function syncSchema(id, options = {}) {
-		await transport.require("table.syncSchema", options);
 		return {
 			id,
 			status: (await transport.requestParsed(SyncSchemaResponse, `/api/table/${id}/sync_schema`, {
@@ -2707,7 +3136,6 @@ function tableResource(transport) {
 	* cached set. The scan runs after the call returns.
 	*/
 	async function rescanValues(id, options = {}) {
-		await transport.require("table.rescanValues", options);
 		return {
 			id,
 			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/rescan_values`, {
@@ -2722,7 +3150,6 @@ function tableResource(transport) {
 	* time the field's values are read.
 	*/
 	async function discardValues(id, options = {}) {
-		await transport.require("table.discardValues", options);
 		return {
 			id,
 			status: (await transport.requestParsed(FieldValuesResponse, `/api/table/${id}/discard_values`, {
@@ -2737,7 +3164,6 @@ function tableResource(transport) {
 	* selectors matched a table.
 	*/
 	async function bulkEdit(params, options = {}) {
-		await transport.require("table.bulkEdit", options);
 		await requireDataAuthorityNull(params.data_authority, options);
 		await transport.requestParsed(BulkEditResponse, BULK_EDIT_PATH, {
 			...options,
@@ -2771,7 +3197,6 @@ function tableResource(transport) {
 	* call is a 422; the syncs run after it returns.
 	*/
 	async function bulkSyncSchema(selectors, options = {}) {
-		await transport.require("table.bulkSyncSchema", options);
 		return postSelection(BULK_SYNC_SCHEMA_PATH, selectors, options);
 	}
 	/**
@@ -2779,7 +3204,6 @@ function tableResource(transport) {
 	* are already cached. The scans run after the call returns.
 	*/
 	async function bulkRescanValues(selectors, options = {}) {
-		await transport.require("table.bulkRescanValues", options);
 		return postSelection(BULK_RESCAN_VALUES_PATH, selectors, options);
 	}
 	/**
@@ -2787,7 +3211,6 @@ function tableResource(transport) {
 	* included. No scan recreates a discarded set.
 	*/
 	async function bulkDiscardValues(selectors, options = {}) {
-		await transport.require("table.bulkDiscardValues", options);
 		return postSelection(BULK_DISCARD_VALUES_PATH, selectors, options);
 	}
 	async function updateFromCsv(id, action, file, options) {
@@ -2809,7 +3232,6 @@ function tableResource(transport) {
 	* The file may be at most 50 MB; larger uploads are rejected with a 413 response.
 	*/
 	async function appendCsv(id, file, options = {}) {
-		await transport.require("table.appendCsv", options);
 		return updateFromCsv(id, "append", file, options);
 	}
 	/**
@@ -2819,37 +3241,53 @@ function tableResource(transport) {
 	* The file may be at most 50 MB; larger uploads are rejected with a 413 response.
 	*/
 	async function replaceCsv(id, file, options = {}) {
-		await transport.require("table.replaceCsv", options);
 		return updateFromCsv(id, "replace", file, options);
 	}
 	return {
-		list,
+		list: explain("list", list, (params) => dataLayerFeatures(params?.["data-layer"], "data-layer")),
 		get,
-		update,
+		update: explain("update", update, (_id, params) => dataLayerFeatures(params.data_layer, "data_layer")),
 		queryMetadata,
 		fks,
 		syncSchema,
 		rescanValues,
 		discardValues,
-		bulkEdit,
-		bulkSyncSchema,
-		bulkRescanValues,
-		bulkDiscardValues,
+		bulkEdit: explain("bulkEdit", bulkEdit),
+		bulkSyncSchema: explain("bulkSyncSchema", bulkSyncSchema),
+		bulkRescanValues: explain("bulkRescanValues", bulkRescanValues),
+		bulkDiscardValues: explain("bulkDiscardValues", bulkDiscardValues),
 		appendCsv,
 		replaceCsv
 	};
 }
+function assertCollectionWritten(path, requested, table) {
+	if (requested === void 0 || table.collection_id === requested) return;
+	const answered = table.collection_id === void 0 ? { kind: "unreported" } : {
+		kind: "reported",
+		value: table.collection_id
+	};
+	throw new PartialWriteError(`the server applied the rest of the update to table ${table.id} but not collection_id: ${describeCollectionAnswer(answered)}, because this server does not move a table to a collection through an update`, {
+		method: "PUT",
+		path,
+		field: "collection_id",
+		requested,
+		answered
+	});
+}
+function describeCollectionAnswer(answered) {
+	if (answered.kind === "unreported") return "it answered the table without reporting a collection";
+	if (answered.value === null) return "the table stays in no collection";
+	return `the table stays in collection ${answered.value}`;
+}
 //#endregion
 //#region ../client/src/resources/timeline-event.ts
 function timelineEventResource(transport) {
 	/** Get one timeline event by id. */
 	async function get(id, options = {}) {
-		await transport.require("timelineEvent.get", options);
 		return transport.requestParsed(TimelineEvent, `/api/timeline-event/${id}`, { ...options });
 	}
 	/** Create a timeline event on an existing timeline. */
 	async function create(params, options = {}) {
-		await transport.require("timelineEvent.create", options);
 		return transport.requestParsed(TimelineEvent, "/api/timeline-event", {
 			...options,
 			method: "POST",
@@ -2861,7 +3299,6 @@ function timelineEventResource(transport) {
 	* the event to another timeline.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("timelineEvent.update", options);
 		return transport.requestParsed(TimelineEvent, `/api/timeline-event/${id}`, {
 			...options,
 			method: "PUT",
@@ -2873,12 +3310,10 @@ function timelineEventResource(transport) {
 	* endpoint.
 	*/
 	async function archive(id, options = {}) {
-		await transport.require("timelineEvent.archive", options);
 		return update(id, { archived: true }, options);
 	}
 	/** Permanently delete a timeline event by id. The server answers with no body. */
 	async function remove(id, options = {}) {
-		await transport.require("timelineEvent.delete", options);
 		await transport.requestRaw(`/api/timeline-event/${id}`, {
 			...options,
 			method: "DELETE",
@@ -2900,7 +3335,6 @@ const TimelineWithEvents = Timeline.required({ events: true });
 function timelineResource(transport) {
 	/** List timelines. `archived` swaps the active listing for the archived one. */
 	async function list(params = {}, options = {}) {
-		await transport.require("timeline.list", options);
 		return {
 			data: await transport.requestParsed(TimelineApiList, "/api/timeline", {
 				...options,
@@ -2911,7 +3345,6 @@ function timelineResource(transport) {
 	}
 	/** Get one timeline by id, without its events. */
 	async function get(id, options = {}) {
-		await transport.require("timeline.get", options);
 		return transport.requestParsed(Timeline, `/api/timeline/${id}`, { ...options });
 	}
 	/**
@@ -2919,7 +3352,6 @@ function timelineResource(transport) {
 	* timeline read hydrates them on request, and `archived` chooses which of them come back.
 	*/
 	async function events(id, params = {}, options = {}) {
-		await transport.require("timeline.events", options);
 		return {
 			data: (await transport.requestParsed(TimelineWithEvents, `/api/timeline/${id}`, {
 				...options,
@@ -2933,7 +3365,6 @@ function timelineResource(transport) {
 	}
 	/** Create a timeline from a full timeline body. */
 	async function create(params, options = {}) {
-		await transport.require("timeline.create", options);
 		return transport.requestParsed(Timeline, "/api/timeline", {
 			...options,
 			method: "POST",
@@ -2945,7 +3376,6 @@ function timelineResource(transport) {
 	* cascades to every event on the timeline.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("timeline.update", options);
 		return transport.requestParsed(Timeline, `/api/timeline/${id}`, {
 			...options,
 			method: "PUT",
@@ -2957,12 +3387,10 @@ function timelineResource(transport) {
 	* not its own endpoint.
 	*/
 	async function archive(id, options = {}) {
-		await transport.require("timeline.archive", options);
 		return update(id, { archived: true }, options);
 	}
 	/** Permanently delete a timeline and all its events by id. The server answers with no body. */
 	async function remove(id, options = {}) {
-		await transport.require("timeline.delete", options);
 		await transport.requestRaw(`/api/timeline/${id}`, {
 			...options,
 			method: "DELETE",
@@ -2999,12 +3427,12 @@ TransformMemberRun.pick({
 //#region ../client/src/resources/transform-dag-run.ts
 const TransformMemberRunList = z.array(TransformMemberRun);
 function transformDagRunResource(transport) {
+	const { explain } = explainer(transport, "transformDagRun");
 	/**
 	* List the transform runs a DAG run coordinated so far. A member run is inserted when its
 	* transform starts, so the list grows while the DAG run is in progress.
 	*/
 	async function transformRuns(runId, options = {}) {
-		await transport.require("transformDagRun.transformRuns", options);
 		return {
 			data: await transport.requestParsed(TransformMemberRunList, `/api/transform-dag-run/${runId}/transform-runs`, { ...options }),
 			total: null
@@ -3012,7 +3440,6 @@ function transformDagRunResource(transport) {
 	}
 	/** Cancel an in-progress DAG run and request cancellation of its still-running transforms. */
 	async function cancel(runId, options = {}) {
-		await transport.require("transformDagRun.cancel", options);
 		await transport.requestRaw(`/api/transform-dag-run/${runId}/cancel`, {
 			...options,
 			method: "POST",
@@ -3020,8 +3447,8 @@ function transformDagRunResource(transport) {
 		});
 	}
 	return {
-		transformRuns,
-		cancel
+		transformRuns: explain("transformRuns", transformRuns),
+		cancel: explain("cancel", cancel)
 	};
 }
 //#endregion
@@ -3169,12 +3596,12 @@ function lensPath(id, lensId) {
 	return `/api/ee/transforms/${id}/inspect/${encodeURIComponent(lensId)}`;
 }
 function transformInspectorResource(transport) {
+	const { explain } = explainer(transport, "transformInspector");
 	/**
 	* Discover what the inspector can show for a transform: its source and target tables with field
 	* statistics, the fields its query touches, and the lenses available on it.
 	*/
 	async function discover(id, options = {}) {
-		await transport.require("transformInspector.discover", options);
 		return transport.requestParsed(TransformInspection, `/api/ee/transforms/${id}/inspect`, { ...options });
 	}
 	/**
@@ -3183,7 +3610,6 @@ function transformInspectorResource(transport) {
 	* the `params` its trigger emitted.
 	*/
 	async function lens(id, lensId, params = {}, options = {}) {
-		await transport.require("transformInspector.lens", options);
 		return transport.requestParsed(TransformLens, lensPath(id, lensId), {
 			...options,
 			query: { join_step: params.join_step }
@@ -3195,7 +3621,6 @@ function transformInspectorResource(transport) {
 	* opened with.
 	*/
 	async function query(id, lensId, params, options = {}) {
-		await transport.require("transformInspector.query", options);
 		return transport.requestParsed(CardQueryResult, `${lensPath(id, lensId)}/query`, {
 			...options,
 			method: "POST",
@@ -3203,17 +3628,17 @@ function transformInspectorResource(transport) {
 		});
 	}
 	return {
-		discover,
-		lens,
-		query
+		discover: explain("discover", discover),
+		lens: explain("lens", lens),
+		query: explain("query", query)
 	};
 }
 //#endregion
 //#region ../client/src/resources/transform-job.ts
 function transformJobResource(transport) {
+	const { explain } = explainer(transport, "transformJob");
 	/** List every transform job the caller can see. */
 	async function list(options = {}) {
-		await transport.require("transformJob.list", options);
 		const { features } = await transport.server(options);
 		return {
 			data: await transport.requestParsed(z.array(transformJobSchema(features)), "/api/transform-job", { ...options }),
@@ -3222,13 +3647,11 @@ function transformJobResource(transport) {
 	}
 	/** Get one transform job by id. */
 	async function get(id, options = {}) {
-		await transport.require("transformJob.get", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(transformJobSchema(features), `/api/transform-job/${id}`, { ...options });
 	}
 	/** Create a transform job — a schedule plus the tags it runs — from a full body. */
 	async function create(params, options = {}) {
-		await transport.require("transformJob.create", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(transformJobSchema(features), "/api/transform-job", {
 			...options,
@@ -3238,7 +3661,6 @@ function transformJobResource(transport) {
 	}
 	/** Update a transform job by id, patching only the fields the body carries. */
 	async function update(id, params, options = {}) {
-		await transport.require("transformJob.update", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(transformJobSchema(features), `/api/transform-job/${id}`, {
 			...options,
@@ -3248,7 +3670,6 @@ function transformJobResource(transport) {
 	}
 	/** Delete a transform job by id, leaving the transforms it ran untouched. */
 	async function remove(id, options = {}) {
-		await transport.require("transformJob.delete", options);
 		await transport.requestRaw(`/api/transform-job/${id}`, {
 			...options,
 			method: "DELETE",
@@ -3260,7 +3681,6 @@ function transformJobResource(transport) {
 	* plus those transforms' dependencies; `run_all` re-runs dependencies that are already fresh.
 	*/
 	async function run(id, params = {}, options = {}) {
-		await transport.require("transformJob.run", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(transformJobRunResultSchema(features), `/api/transform-job/${id}/run`, {
 			...options,
@@ -3270,7 +3690,6 @@ function transformJobResource(transport) {
 	}
 	/** List the transforms a job would execute, resolved from the job's tags. */
 	async function transforms(id, options = {}) {
-		await transport.require("transformJob.transforms", options);
 		const { features } = await transport.server(options);
 		return {
 			data: await transport.requestParsed(z.array(transformRowSchema(features)), `/api/transform-job/${id}/transforms`, { ...options }),
@@ -3282,7 +3701,6 @@ function transformJobResource(transport) {
 	* manual runs ignore the flag. The path carries no id and is a different endpoint from `update`.
 	*/
 	async function setActive(active, options = {}) {
-		await transport.require("transformJob.setActive", options);
 		return transport.requestParsed(TransformJobActiveResult, "/api/transform-job/active", {
 			...options,
 			method: "PUT",
@@ -3290,14 +3708,14 @@ function transformJobResource(transport) {
 		});
 	}
 	return {
-		list,
-		get,
-		create,
-		update,
-		delete: remove,
-		run,
-		transforms,
-		setActive
+		list: explain("list", list),
+		get: explain("get", get),
+		create: explain("create", create),
+		update: explain("update", update),
+		delete: explain("delete", remove),
+		run: explain("run", run),
+		transforms: explain("transforms", transforms),
+		setActive: explain("setActive", setActive)
 	};
 }
 //#endregion
@@ -3357,14 +3775,13 @@ function libraryPath(path) {
 	return `/api/ee/transforms-python/library/${encodeURIComponent(path)}`;
 }
 function transformPythonResource(transport) {
+	const { explain } = explainer(transport, "transformPython");
 	/** Get the Python library at a path, the user module every Python transform can import. */
 	async function getLibrary(path, options = {}) {
-		await transport.require("transformPython.getLibrary", options);
 		return transport.requestParsed(PythonLibrary, libraryPath(path), { ...options });
 	}
 	/** Replace the source of the Python library at a path, creating the library when none exists. */
 	async function updateLibrary(path, params, options = {}) {
-		await transport.require("transformPython.updateLibrary", options);
 		return transport.requestParsed(PythonLibrary, libraryPath(path), {
 			...options,
 			method: "PUT",
@@ -3377,7 +3794,6 @@ function transformPythonResource(transport) {
 	* sizes are capped at 100 rows.
 	*/
 	async function testRun(params, options = {}) {
-		await transport.require("transformPython.testRun", options);
 		return transport.requestParsed(PythonApiTestRun, "/api/ee/transforms-python/test-run", {
 			...options,
 			method: "POST",
@@ -3385,9 +3801,9 @@ function transformPythonResource(transport) {
 		});
 	}
 	return {
-		getLibrary,
-		updateLibrary,
-		testRun
+		getLibrary: explain("getLibrary", getLibrary),
+		updateLibrary: explain("updateLibrary", updateLibrary),
+		testRun: explain("testRun", testRun)
 	};
 }
 //#endregion
@@ -3401,6 +3817,7 @@ const TransformRunKickoff = z.object({
 });
 const TransformDagTransformList = z.array(TransformDagTransform);
 function transformResource(transport) {
+	const { explain, explainWalk } = explainer(transport, "transform");
 	async function requestTransformList(path, opts) {
 		const { features } = await transport.server(opts);
 		return {
@@ -3414,18 +3831,15 @@ function transformResource(transport) {
 	}
 	/** List every transform the caller can see. */
 	async function list(options = {}) {
-		await transport.require("transform.list", options);
 		return requestTransformList("/api/transform", { ...options });
 	}
 	/** Get one transform by id. */
 	async function get(id, options = {}) {
-		await transport.require("transform.get", options);
 		const { features } = await transport.server(options);
 		return transport.requestParsed(transformDetailSchema(features), `/api/transform/${id}`, { ...options });
 	}
 	/** Create a transform — a query plus the warehouse table it writes — from a full body. */
 	async function create(params, options = {}) {
-		await transport.require("transform.create", options);
 		return requestTransform("/api/transform", {
 			...options,
 			method: "POST",
@@ -3434,7 +3848,6 @@ function transformResource(transport) {
 	}
 	/** Update a transform by id, patching only the fields the body carries. */
 	async function update(id, params, options = {}) {
-		await transport.require("transform.update", options);
 		return requestTransform(`/api/transform/${id}`, {
 			...options,
 			method: "PUT",
@@ -3443,7 +3856,6 @@ function transformResource(transport) {
 	}
 	/** Delete a transform by id, leaving any table it already materialized in place. */
 	async function remove(id, options = {}) {
-		await transport.require("transform.delete", options);
 		await transport.requestRaw(`/api/transform/${id}`, {
 			...options,
 			method: "DELETE",
@@ -3452,7 +3864,6 @@ function transformResource(transport) {
 	}
 	/** Drop a transform's materialized output table, keeping the transform definition. */
 	async function deleteTable(id, options = {}) {
-		await transport.require("transform.deleteTable", options);
 		await transport.requestRaw(`/api/transform/${id}/table`, {
 			...options,
 			method: "DELETE",
@@ -3461,12 +3872,10 @@ function transformResource(transport) {
 	}
 	/** List the upstream transforms a transform depends on. */
 	async function dependencies(id, options = {}) {
-		await transport.require("transform.dependencies", options);
 		return requestTransformList(`/api/transform/${id}/dependencies`, { ...options });
 	}
 	/** Request cancellation of a transform's current run. */
 	async function cancel(id, options = {}) {
-		await transport.require("transform.cancel", options);
 		await transport.requestRaw(`/api/transform/${id}/cancel`, {
 			...options,
 			method: "POST",
@@ -3475,12 +3884,10 @@ function transformResource(transport) {
 	}
 	/** Get one transform run by run id — not by the id of the transform that produced it. */
 	async function getRun(runId, options = {}) {
-		await transport.require("transform.getRun", options);
 		return transport.requestParsed(TransformRun, `/api/transform/run/${runId}`, { ...options });
 	}
 	/** Walk the run history, newest first, optionally narrowed to a single transform. */
 	async function* runPages(params = {}, options = {}) {
-		await transport.require("transform.runPages", options);
 		yield* paginatePages(transport, "/api/transform/run", TransformRun, {
 			query: { "transform-ids": params["transform-ids"] },
 			...options.offset !== void 0 && { offset: options.offset },
@@ -3494,7 +3901,6 @@ function transformResource(transport) {
 	* DAG reprocess run, or a standalone transform run — and never a member run of a job or DAG.
 	*/
 	async function* runSummaryPages(params = {}, options = {}) {
-		await transport.require("transform.runSummaryPages", options);
 		yield* paginatePages(transport, "/api/transform/runs", TransformRunSummary, {
 			query: {
 				types: params.types,
@@ -3517,7 +3923,6 @@ function transformResource(transport) {
 	* source rather than the rows past the last checkpoint.
 	*/
 	async function resetCheckpoint(id, options = {}) {
-		await transport.require("transform.resetCheckpoint", options);
 		await transport.requestRaw(`/api/transform/${id}/reset-checkpoint`, {
 			...options,
 			method: "POST",
@@ -3532,7 +3937,6 @@ function transformResource(transport) {
 	* `runSummaryPages` with `types: ["dag"]`, and the member runs off `transformDagRun.transformRuns`.
 	*/
 	async function runDag(id, params, options = {}) {
-		await transport.require("transform.runDag", options);
 		return transport.requestParsed(TransformDagRunResult, `/api/transform/${id}/run-dag`, {
 			...options,
 			method: "POST",
@@ -3541,7 +3945,6 @@ function transformResource(transport) {
 	}
 	/** Preview the transforms a DAG reprocess seeded at a transform would run, in execution order. */
 	async function dagTransforms(id, params, options = {}) {
-		await transport.require("transform.dagTransforms", options);
 		return {
 			data: await transport.requestParsed(TransformDagTransformList, `/api/transform/${id}/dag-transforms`, {
 				...options,
@@ -3556,7 +3959,6 @@ function transformResource(transport) {
 	* A server that answers no run id started nothing, and there is then nothing to poll.
 	*/
 	async function run(id, params = {}, options = {}) {
-		await transport.require("transform.run", options);
 		const kickoff = await transport.requestParsed(TransformRunKickoff, `/api/transform/${id}/run`, {
 			...options,
 			method: "POST"
@@ -3597,30 +3999,30 @@ function transformResource(transport) {
 		}
 	}
 	return {
-		list,
-		get,
-		create,
-		update,
-		delete: remove,
-		deleteTable,
-		dependencies,
-		cancel,
-		getRun,
-		runPages,
-		runSummaryPages,
-		resetCheckpoint,
-		runDag,
-		dagTransforms,
-		run
+		list: explain("list", list),
+		get: explain("get", get),
+		create: explain("create", create),
+		update: explain("update", update),
+		delete: explain("delete", remove),
+		deleteTable: explain("deleteTable", deleteTable),
+		dependencies: explain("dependencies", dependencies),
+		cancel: explain("cancel", cancel),
+		getRun: explain("getRun", getRun),
+		runPages: explainWalk("runPages", runPages),
+		runSummaryPages: explainWalk("runSummaryPages", runSummaryPages),
+		resetCheckpoint: explain("resetCheckpoint", resetCheckpoint),
+		runDag: explain("runDag", runDag),
+		dagTransforms: explain("dagTransforms", dagTransforms),
+		run: explain("run", run)
 	};
 }
 //#endregion
 //#region ../client/src/resources/transform-tag.ts
 const TransformTagApiList = z.array(TransformTag);
 function transformTagResource(transport) {
+	const { explain } = explainer(transport, "transformTag");
 	/** List every transform tag the caller can see, built-in tags included. */
 	async function list(options = {}) {
-		await transport.require("transformTag.list", options);
 		return {
 			data: await transport.requestParsed(TransformTagApiList, "/api/transform-tag", { ...options }),
 			total: null
@@ -3628,7 +4030,6 @@ function transformTagResource(transport) {
 	}
 	/** Create a transform tag, the label a transform job matches transforms on. */
 	async function create(params, options = {}) {
-		await transport.require("transformTag.create", options);
 		return transport.requestParsed(TransformTag, "/api/transform-tag", {
 			...options,
 			method: "POST",
@@ -3637,7 +4038,6 @@ function transformTagResource(transport) {
 	}
 	/** Rename a transform tag by id. */
 	async function update(id, params, options = {}) {
-		await transport.require("transformTag.update", options);
 		return transport.requestParsed(TransformTag, `/api/transform-tag/${id}`, {
 			...options,
 			method: "PUT",
@@ -3646,7 +4046,6 @@ function transformTagResource(transport) {
 	}
 	/** Delete a transform tag by id, detaching it from every transform and job carrying it. */
 	async function remove(id, options = {}) {
-		await transport.require("transformTag.delete", options);
 		await transport.requestRaw(`/api/transform-tag/${id}`, {
 			...options,
 			method: "DELETE",
@@ -3654,19 +4053,180 @@ function transformTagResource(transport) {
 		});
 	}
 	return {
-		list,
-		create,
-		update,
-		delete: remove
+		list: explain("list", list),
+		create: explain("create", create),
+		update: explain("update", update),
+		delete: explain("delete", remove)
 	};
 }
 //#endregion
+//#region ../client/src/domain/transform-test.ts
+const TransformTestTable = z.object({
+	schema: z.string().min(1).nullable().optional(),
+	name: z.string().min(1)
+}).loose();
+const TransformTestColumn = z.object({
+	name: z.string().min(1),
+	cast_type: z.string().min(1)
+}).loose();
+const TransformTestCell = z.union([
+	z.boolean(),
+	z.number(),
+	z.string(),
+	z.null()
+]);
+const TransformTestRow = z.record(z.string(), TransformTestCell);
+const TransformTestSqlInput = z.object({
+	table: TransformTestTable,
+	format: z.literal("sql"),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestRowsInput = z.object({
+	table: TransformTestTable,
+	format: z.literal("rows"),
+	columns: z.array(TransformTestColumn).min(1),
+	rows: z.array(TransformTestRow)
+}).loose();
+const TransformTestInput = z.discriminatedUnion("format", [TransformTestSqlInput, TransformTestRowsInput]);
+const TransformTestEqualsSqlExpectation = z.object({
+	type: z.literal("equals"),
+	name: z.string().min(1),
+	format: z.literal("sql"),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestEqualsRowsExpectation = z.object({
+	type: z.literal("equals"),
+	name: z.string().min(1),
+	format: z.literal("rows"),
+	columns: z.array(TransformTestColumn).min(1),
+	rows: z.array(TransformTestRow)
+}).loose();
+const TransformTestEqualsExpectation = z.discriminatedUnion("format", [TransformTestEqualsSqlExpectation, TransformTestEqualsRowsExpectation]);
+const TransformTestEmptyExpectation = z.object({
+	type: z.literal("empty"),
+	name: z.string().min(1),
+	sql: z.string().min(1)
+}).loose();
+const TransformTestExpectation = z.discriminatedUnion("type", [TransformTestEqualsExpectation, TransformTestEmptyExpectation]);
+const TransformTest = z.object({
+	id: z.number().int(),
+	entity_id: z.string(),
+	transform_id: z.number().int(),
+	creator_id: z.number().int(),
+	name: z.string(),
+	description: z.string().nullable(),
+	inputs: z.array(TransformTestInput),
+	expectations: z.array(TransformTestExpectation),
+	created_at: z.string(),
+	updated_at: z.string()
+}).loose();
+TransformTest.pick({
+	id: true,
+	transform_id: true,
+	name: true,
+	description: true
+}).strip();
+z.object({
+	transform_id: z.number().int().positive(),
+	name: z.string().min(1),
+	description: z.string().nullable().optional(),
+	inputs: z.array(TransformTestInput),
+	expectations: z.array(TransformTestExpectation)
+}).loose();
+z.object({
+	transform_id: z.number().int().positive().optional(),
+	name: z.string().min(1).optional(),
+	description: z.string().nullable().optional(),
+	inputs: z.array(TransformTestInput).optional(),
+	expectations: z.array(TransformTestExpectation).optional()
+}).loose();
+const TransformTestResultColumn = z.object({
+	name: z.string(),
+	database_type: z.string()
+}).loose();
+const TransformTestExpectationError = z.object({
+	type: z.string(),
+	message: z.string()
+}).loose();
+const TransformTestCellMismatch = z.object({
+	column: z.string(),
+	expected: TransformTestCell,
+	actual: TransformTestCell
+}).loose();
+const TransformTestRowCounts = z.object({
+	actual: z.number().int(),
+	expected: z.number().int()
+}).loose();
+const TransformTestEqualsFindings = z.object({
+	name: z.string(),
+	type: z.literal("equals"),
+	status: z.enum(["passed", "failed"]),
+	columns: z.array(TransformTestResultColumn),
+	"row-counts": TransformTestRowCounts,
+	"extra-rows": z.array(TransformTestRow),
+	"missing-rows": z.array(TransformTestRow),
+	"cell-mismatches": z.array(TransformTestCellMismatch),
+	truncated: z.number().int()
+}).loose();
+const TransformTestEqualsError = z.object({
+	name: z.string(),
+	type: z.literal("equals"),
+	status: z.literal("error"),
+	error: TransformTestExpectationError
+}).loose();
+const TransformTestEqualsResult = z.discriminatedUnion("status", [TransformTestEqualsFindings, TransformTestEqualsError]);
+const TransformTestEmptyPassed = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("passed")
+}).loose();
+const TransformTestEmptyFailed = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("failed"),
+	columns: z.array(TransformTestResultColumn),
+	sample: z.array(TransformTestRow),
+	truncated: z.number().int()
+}).loose();
+const TransformTestEmptyError = z.object({
+	name: z.string(),
+	type: z.literal("empty"),
+	status: z.literal("error"),
+	error: TransformTestExpectationError
+}).loose();
+const TransformTestEmptyResult = z.discriminatedUnion("status", [
+	TransformTestEmptyPassed,
+	TransformTestEmptyFailed,
+	TransformTestEmptyError
+]);
+const TransformTestExpectationResult = z.discriminatedUnion("type", [TransformTestEqualsResult, TransformTestEmptyResult]);
+const TransformTestRunResult = z.object({
+	status: z.enum(["passed", "failed"]),
+	expectations: z.array(TransformTestExpectationResult),
+	tables: z.record(z.string(), z.string())
+}).loose();
+z.enum([
+	"transform-test.unknown-column",
+	"transform-test.ambiguous-column",
+	"transform-test.missing-inputs",
+	"transform-test.unused-inputs",
+	"transform-test.duplicate-input-table",
+	"transform-test.unparseable-source",
+	"transform-test.unremapped-reference",
+	"transform-test.unsupported-transform",
+	"transform-test.unsupported-driver",
+	"transform-test.transform-failed",
+	"transform-test.setup-failed",
+	"transform-test.expectation-failed",
+	"transform-test.unsupported-format"
+]);
+//#endregion
 //#region ../client/src/resources/transform-test.ts
 const TransformTestApiList = z.array(TransformTest);
 function transformTestResource(transport) {
+	const { explain } = explainer(transport, "transformTest");
 	/** List the transform tests, optionally only those of one transform. */
 	async function list(params = {}, options = {}) {
-		await transport.require("transformTest.list", options);
 		return {
 			data: await transport.requestParsed(TransformTestApiList, "/api/ee/transform-test", {
 				...options,
@@ -3677,7 +4237,6 @@ function transformTestResource(transport) {
 	}
 	/** Get a transform test by id. */
 	async function get(id, options = {}) {
-		await transport.require("transformTest.get", options);
 		return transport.requestParsed(TransformTest, `/api/ee/transform-test/${id}`, { ...options });
 	}
 	/**
@@ -3686,7 +4245,6 @@ function transformTestResource(transport) {
 	* `TransformTestRefusalCode` when they cannot run.
 	*/
 	async function create(params, options = {}) {
-		await transport.require("transformTest.create", options);
 		return transport.requestParsed(TransformTest, "/api/ee/transform-test", {
 			...options,
 			method: "POST",
@@ -3698,7 +4256,6 @@ function transformTestResource(transport) {
 	* transform, inputs or expectations is validated as on create, with the same refusal.
 	*/
 	async function update(id, params, options = {}) {
-		await transport.require("transformTest.update", options);
 		return transport.requestParsed(TransformTest, `/api/ee/transform-test/${id}`, {
 			...options,
 			method: "PUT",
@@ -3707,7 +4264,6 @@ function transformTestResource(transport) {
 	}
 	/** Delete a transform test by id. */
 	async function remove(id, options = {}) {
-		await transport.require("transformTest.delete", options);
 		await transport.requestRaw(`/api/ee/transform-test/${id}`, {
 			...options,
 			method: "DELETE",
@@ -3721,19 +4277,18 @@ function transformTestResource(transport) {
 	* refused and nothing meaningful ran.
 	*/
 	async function run(id, options = {}) {
-		await transport.require("transformTest.run", options);
 		return transport.requestParsed(TransformTestRunResult, `/api/ee/transform-test/${id}/run`, {
 			...options,
 			method: "POST"
 		});
 	}
 	return {
-		list,
-		get,
-		create,
-		update,
-		delete: remove,
-		run
+		list: explain("list", list),
+		get: explain("get", get),
+		create: explain("create", create),
+		update: explain("update", update),
+		delete: explain("delete", remove),
+		run: explain("run", run)
 	};
 }
 //#endregion
@@ -3747,7 +4302,6 @@ function uploadResource(transport) {
 	* The file may be at most 50 MB; larger uploads are rejected with a 413 response.
 	*/
 	async function createFromCsv(file, params, options = {}) {
-		await transport.require("upload.createFromCsv", options);
 		const form = buildCsvFormData(file);
 		form.append("collection_id", params.collection_id);
 		const response = await transport.requestRaw("/api/upload/csv", {
@@ -3800,7 +4354,6 @@ CurrentUser.pick({
 function userResource(transport) {
 	/** Get the user the request's credentials authenticate as. */
 	async function current(options = {}) {
-		await transport.require("user.current", options);
 		return transport.requestParsed(CurrentUser, "/api/user/current", { ...options });
 	}
 	return { current };
@@ -3815,7 +4368,6 @@ function createClient(config, options) {
 		collection: collectionResource(transport),
 		contentTranslation: contentTranslationResource(transport),
 		dashboard: dashboardResource(transport),
-		dataAction: dataActionResource(transport),
 		database: databaseResource(transport),
 		dataset: datasetResource(transport),
 		dependency: dependencyResource(transport),
@@ -3852,6 +4404,8 @@ function createClient(config, options) {
 		upload: uploadResource(transport),
 		user: userResource(transport),
 		server: transport.server,
+		verifiedServer: transport.verifiedServer,
+		probesSettled: transport.probesSettled,
 		requestParsed: transport.requestParsed,
 		requestRaw: transport.requestRaw,
 		requestStream: transport.requestStream