@metabase/cli 0.5.7 → 0.5.8

package/dist/run-C_IZfmQ7.mjs

@@ -0,0 +1,1055 @@
+import { c as InternalError, f as ResponseShapeError, h as ValidationError, i as AbortError, o as ConfigError, p as TimeoutError, r as isPlainObject, s as FailedResultError, u as NetworkError } from "./predicates-0C0TsWcJ.mjs";
+import { I as CapabilityError, Y as isHttpNotFound, f as serializeJson, ft as profileFlag, o as jsonLineWriter, ot as connectionFlags, q as HttpError, t as interruptSignal } from "./cli.mjs";
+import { t as defineMetabaseCommand } from "./runtime-Dd2uBKqN.mjs";
+import { o as isTransformTestCode } from "./transform-test-D6QIyu8C.mjs";
+import { a as runProcess, n as ProcessNotFoundError, o as runProcessBinary, r as ProcessTimeoutError, t as ProcessInterruptedError } from "./process-ByKCTa6A.mjs";
+import { t as parseMetabaseYaml } from "./yaml-BthVUNj3.mjs";
+import { z } from "zod";
+import { rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { performance } from "node:perf_hooks";
+//#region src/core/ci-coverage.ts
+function byName(a, b) {
+	return a.name.localeCompare(b.name);
+}
+function assessCoverage(inputs) {
+	const logicAtBase = /* @__PURE__ */ new Map();
+	for (const { base } of inputs.changes) if (base?.kind === "transform") logicAtBase.set(base.entityId, base.logic);
+	const changed = /* @__PURE__ */ new Map();
+	for (const { head } of inputs.changes) {
+		if (head?.kind !== "transform" || inputs.testedAtHead.has(head.entityId)) continue;
+		const before = logicAtBase.get(head.entityId);
+		if (before === void 0) changed.set(head.entityId, {
+			entityId: head.entityId,
+			name: head.name,
+			change: "new"
+		});
+		else if (!isDeepStrictEqual(before, head.logic)) changed.set(head.entityId, {
+			entityId: head.entityId,
+			name: head.name,
+			change: "edited"
+		});
+	}
+	const untouchedUntested = [];
+	for (const [entityId, name] of inputs.transformsAtHead) if (!inputs.testedAtHead.has(entityId) && !changed.has(entityId)) untouchedUntested.push({
+		entityId,
+		name
+	});
+	return {
+		untestedChanges: [...changed.values()].toSorted(byName),
+		untouchedUntested: untouchedUntested.toSorted(byName)
+	};
+}
+const UNTOUCHED_CHECK_ID = "untouched";
+function untouchedWarnings(untouched) {
+	if (untouched.length === 0) return [];
+	return [{
+		code: "no-tests-untouched",
+		message: `${untouched.length === 1 ? "1 transform whose logic this change did not touch has" : `${untouched.length} transforms whose logic this change did not touch have`} no tests: ${untouched.map((transform) => transform.name).join(", ")}`
+	}];
+}
+function coverageStage(assessment) {
+	return {
+		name: "lint",
+		run: async (report) => {
+			for (const transform of assessment.untestedChanges) report({
+				check: {
+					kind: "coverage",
+					id: transform.entityId,
+					label: transform.name
+				},
+				verdict: "failed",
+				warnings: [],
+				ms: 0,
+				detail: {
+					change: transform.change,
+					message: `${transform.name} is ${transform.change} in this change and has no transform tests`
+				}
+			});
+			const untouched = assessment.untouchedUntested;
+			report({
+				check: {
+					kind: "coverage",
+					id: UNTOUCHED_CHECK_ID,
+					label: "Transforms whose logic this change did not touch"
+				},
+				verdict: "passed",
+				warnings: untouchedWarnings(untouched),
+				ms: 0,
+				detail: { untested: untouched.map((transform) => ({
+					entity_id: transform.entityId,
+					name: transform.name
+				})) }
+			});
+			return null;
+		}
+	};
+}
+const StageName = z.enum(["lint", "unit"]);
+const Verdict = z.enum([
+	"passed",
+	"failed",
+	"error",
+	"refused"
+]);
+const StageStatus = z.enum([
+	"passed",
+	"failed",
+	"errored",
+	"skipped"
+]);
+const JobState = StageStatus.exclude(["skipped"]);
+const CiWarning = z.object({
+	code: z.string(),
+	message: z.string()
+});
+const StageStop = z.object({
+	code: z.string(),
+	message: z.string()
+});
+const CheckedTransform = z.object({
+	entity_id: z.string(),
+	name: z.string()
+});
+const Snapshot = z.object({
+	base: z.string(),
+	head: z.string()
+});
+const Check = z.object({
+	kind: z.enum([
+		"coverage",
+		"yaml",
+		"cycles",
+		"broken-refs",
+		"transform-test"
+	]),
+	id: z.string(),
+	label: z.string()
+});
+const EventEnvelope = z.object({
+	seq: z.number().int().nonnegative(),
+	job: z.string(),
+	at: z.iso.datetime()
+});
+const JobStart = EventEnvelope.extend({
+	type: z.literal("job.start"),
+	v: z.literal(1),
+	snapshot: Snapshot,
+	checked: z.array(CheckedTransform),
+	warnings: z.array(CiWarning)
+});
+const StageStart = EventEnvelope.extend({
+	type: z.literal("stage.start"),
+	stage: StageName
+});
+const CheckResult = EventEnvelope.extend({
+	type: z.literal("check.result"),
+	stage: StageName,
+	check: Check,
+	verdict: Verdict,
+	warnings: z.array(CiWarning),
+	ms: z.number().nonnegative(),
+	detail: z.unknown()
+});
+const StageEnd = EventEnvelope.extend({
+	type: z.literal("stage.end"),
+	stage: StageName,
+	status: StageStatus,
+	stopped: StageStop.nullable()
+});
+const JobEnd = EventEnvelope.extend({
+	type: z.literal("job.end"),
+	state: JobState,
+	counts: z.object({
+		checks: z.number().int(),
+		warnings: z.number().int()
+	})
+});
+const CiEvent = z.discriminatedUnion("type", [
+	JobStart,
+	StageStart,
+	CheckResult,
+	StageEnd,
+	JobEnd
+]);
+function createEmitter(options) {
+	let seq = 0;
+	return (body) => {
+		const parsed = CiEvent.safeParse({
+			...body,
+			seq,
+			job: options.job,
+			at: options.now().toISOString()
+		});
+		if (!parsed.success) throw new InternalError(`ci event "${body.type}" does not match its schema: ${parsed.error.message}`);
+		seq += 1;
+		options.write(parsed.data);
+		return parsed.data;
+	};
+}
+function stageStatus(verdicts, stopped) {
+	if (verdicts.includes("failed")) return "failed";
+	if (stopped !== null || verdicts.includes("refused") || verdicts.includes("error")) return "errored";
+	return "passed";
+}
+async function runStages(stages, emit) {
+	let state = "passed";
+	let checks = 0;
+	let warnings = 0;
+	for (const stage of stages) {
+		if (state !== "passed") {
+			emit({
+				type: "stage.end",
+				stage: stage.name,
+				status: "skipped",
+				stopped: null
+			});
+			continue;
+		}
+		emit({
+			type: "stage.start",
+			stage: stage.name
+		});
+		const verdicts = [];
+		const stopped = await stage.run((check) => {
+			verdicts.push(check.verdict);
+			checks += 1;
+			warnings += check.warnings.length;
+			emit({
+				type: "check.result",
+				stage: stage.name,
+				...check
+			});
+		});
+		state = stageStatus(verdicts, stopped);
+		emit({
+			type: "stage.end",
+			stage: stage.name,
+			status: state,
+			stopped
+		});
+	}
+	return {
+		state,
+		checks,
+		warnings
+	};
+}
+//#endregion
+//#region src/core/ci-affected.ts
+const SINGLE_PATH_STATUSES = /* @__PURE__ */ new Map([
+	["A", "added"],
+	["M", "modified"],
+	["D", "deleted"],
+	["T", "modified"]
+]);
+const STATUS_CODE = /^(?:[AMDT](?:\d{3})?|[RC]\d{3})$/;
+const RENAME_STATUS = "R";
+const COPY_STATUS = "C";
+function nameStatusError(message) {
+	return new InternalError(`git diff --name-status -z: ${message}`);
+}
+function requireToken(token, what) {
+	if (token === void 0 || token === "") throw nameStatusError(`missing ${what}`);
+	return token;
+}
+function parseNameStatus(output) {
+	if (output === "") return [];
+	if (!output.endsWith("\0")) throw nameStatusError("truncated: the output does not end in a NUL");
+	const tokens = output.slice(0, -1).split("\0");
+	const entries = [];
+	let index = 0;
+	while (index < tokens.length) {
+		const code = requireToken(tokens[index], "a status");
+		if (!STATUS_CODE.test(code)) throw nameStatusError(`unexpected status "${code}"`);
+		const missingPath = `a path for status "${code}"`;
+		const first = tokens[index + 1];
+		const second = tokens[index + 2];
+		const letter = code.charAt(0);
+		const single = SINGLE_PATH_STATUSES.get(letter);
+		if (single !== void 0) {
+			entries.push({
+				status: single,
+				path: requireToken(first, missingPath)
+			});
+			index += 2;
+			continue;
+		}
+		if (letter === RENAME_STATUS) {
+			entries.push({
+				status: "renamed",
+				path: requireToken(second, missingPath),
+				oldPath: requireToken(first, missingPath)
+			});
+			index += 3;
+			continue;
+		}
+		if (letter === COPY_STATUS) {
+			requireToken(first, missingPath);
+			entries.push({
+				status: "added",
+				path: requireToken(second, missingPath)
+			});
+			index += 3;
+			continue;
+		}
+		throw nameStatusError(`unexpected status "${code}"`);
+	}
+	return entries;
+}
+const PORCELAIN_STATUS_WIDTH = 2;
+const PORCELAIN_SOURCE_STATUSES = /* @__PURE__ */ new Set(["R", "C"]);
+function parseStatusPorcelain(output) {
+	if (output === "") return [];
+	if (!output.endsWith("\0")) throw new InternalError("git status --porcelain -z: truncated: the output does not end in a NUL");
+	const paths = [];
+	let sourceFollows = false;
+	for (const record of output.slice(0, -1).split("\0")) {
+		if (sourceFollows) {
+			sourceFollows = false;
+			continue;
+		}
+		const status = record.slice(0, PORCELAIN_STATUS_WIDTH);
+		const path = record.slice(3);
+		if (status.length !== PORCELAIN_STATUS_WIDTH || record.charAt(PORCELAIN_STATUS_WIDTH) !== " " || path === "") throw new InternalError(`git status --porcelain -z: malformed entry "${record}"`);
+		paths.push(path);
+		sourceFollows = [...status].some((letter) => PORCELAIN_SOURCE_STATUSES.has(letter));
+	}
+	return paths;
+}
+const SERDES_META_KEY = "serdes/meta";
+const TransformDocument = z.object({
+	entity_id: z.string().min(1),
+	name: z.string().min(1),
+	source: z.unknown(),
+	target: z.unknown()
+}).loose();
+const TransformTestDocument = z.object({ transform_id: z.string().min(1) }).loose();
+const SerdesMeta = z.array(z.object({ model: z.string() }).loose()).min(1);
+function parseOrRefuse(path, schema, value, rule) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) throw new ValidationError(`${path}: ${rule}`, {
+		source: path,
+		zodIssues: parsed.error.issues
+	});
+	return parsed.data;
+}
+function classifyContentFile(path, document) {
+	if (!isPlainObject(document) || !(SERDES_META_KEY in document)) return { kind: "other" };
+	const last = parseOrRefuse(path, SerdesMeta, document[SERDES_META_KEY], `${SERDES_META_KEY} must be a non-empty list of entries with a model`).at(-1);
+	if (last === void 0) throw new InternalError(`${path}: ${SERDES_META_KEY} passed a non-empty check but has no entries`);
+	if (last.model === "Transform") {
+		const transform = parseOrRefuse(path, TransformDocument, document, "a Transform must have an entity_id, a name, a source and a target");
+		return {
+			kind: "transform",
+			entityId: transform.entity_id,
+			name: transform.name,
+			logic: {
+				source: transform.source,
+				target: transform.target
+			}
+		};
+	}
+	if (last.model === "TransformTest") return {
+		kind: "transform-test",
+		transformId: parseOrRefuse(path, TransformTestDocument, document, "a TransformTest must name its transform_id").transform_id
+	};
+	return { kind: "other" };
+}
+function transformEntityId(file) {
+	return file?.kind === "transform" ? file.entityId : null;
+}
+function affectedTransforms(changes) {
+	const touched = /* @__PURE__ */ new Set();
+	const atHead = /* @__PURE__ */ new Set();
+	const atBase = /* @__PURE__ */ new Set();
+	for (const { path, base, head } of changes) {
+		if (base !== null && base.kind !== "other" && head?.kind === "other") throw new ValidationError(`${path}: a Transform or TransformTest at base no longer reads as one at head`, {
+			source: path,
+			zodIssues: []
+		});
+		const headId = transformEntityId(head);
+		const baseId = transformEntityId(base);
+		if (headId !== null) {
+			touched.add(headId);
+			atHead.add(headId);
+		}
+		if (baseId !== null) atBase.add(baseId);
+		for (const side of [base, head]) if (side?.kind === "transform-test") touched.add(side.transformId);
+	}
+	return [...touched].filter((entityId) => atHead.has(entityId) || !atBase.has(entityId));
+}
+const TRANSFORM_MODEL_PATTERN = `model["']?:[[:space:]]*["']?Transform`;
+function headTransforms(files) {
+	const atHead = {
+		names: /* @__PURE__ */ new Map(),
+		tested: /* @__PURE__ */ new Set()
+	};
+	for (const file of files) if (file?.kind === "transform") atHead.names.set(file.entityId, file.name);
+	else if (file?.kind === "transform-test") atHead.tested.add(file.transformId);
+	return atHead;
+}
+const CONTENT_TOP_LEVEL_FOLDERS = [
+	"actions",
+	"channels",
+	"collections",
+	"custom_viz_plugins",
+	"data_apps",
+	"databases",
+	"embedding_themes",
+	"glossary",
+	"metabots",
+	"python_libraries",
+	"python-libraries",
+	"osi_ai_context",
+	"snippets",
+	"transforms"
+];
+const SHARED_TOP_LEVEL_FILE_NAMES = /* @__PURE__ */ new Map([["data_apps", "data_app.yaml"]]);
+const CONTENT_FOLDERS = new Set(CONTENT_TOP_LEVEL_FOLDERS);
+function isContentPath(path) {
+	const slash = path.indexOf("/");
+	if (slash === -1) return false;
+	const top = path.slice(0, slash);
+	const fileName = path.slice(path.lastIndexOf("/") + 1);
+	if (!fileName.endsWith(".yaml") || fileName.startsWith(".") || !CONTENT_FOLDERS.has(top)) return false;
+	const entityFileName = SHARED_TOP_LEVEL_FILE_NAMES.get(top);
+	return entityFileName === void 0 || entityFileName === fileName;
+}
+function noContentChangesWarning(entries) {
+	if (entries.some((entry) => isContentPath(entry.path) || entry.status === "renamed" && isContentPath(entry.oldPath))) return null;
+	return {
+		code: "no-content-changes",
+		message: "the change touches no Metabase content files, so CI checked nothing"
+	};
+}
+function uncommittedContentWarning(paths) {
+	const content = paths.filter(isContentPath);
+	if (content.length === 0) return null;
+	return {
+		code: "uncommitted-content",
+		message: `${content.length === 1 ? "1 content file has uncommitted changes" : `${content.length} content files have uncommitted changes`}, which CI does not see; it checks the committed version: ${content.join(", ")}`
+	};
+}
+//#endregion
+//#region src/runtime/git.ts
+const GIT = "git";
+const NO_MATCH_EXIT_CODE = 1;
+const NO_MERGE_BASE_EXIT_CODE = 1;
+const UNKNOWN_REF_EXIT_CODE = 1;
+const GIT_TIMEOUT_MS = 12e4;
+async function withGit(repo, args, spawn) {
+	try {
+		return await spawn();
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError) throw new ConfigError("git is not installed or not on PATH");
+		if (error instanceof ProcessInterruptedError) throw new AbortError(`interrupted while git ${args.join(" ")} ran in ${repo}`);
+		if (error instanceof ProcessTimeoutError) throw new ConfigError(`git ${args.join(" ")} did not finish within ${GIT_TIMEOUT_MS / 1e3} s in ${repo}`);
+		throw error;
+	}
+}
+function runGit(repo, args, signal) {
+	return withGit(repo, args, () => runProcess(GIT, [
+		"-C",
+		repo,
+		...args
+	], {
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
+}
+async function git(repo, args, signal) {
+	const result = await runGit(repo, args, signal);
+	if (result.exitCode !== 0) throw new ConfigError(`git ${args.join(" ")} failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout;
+}
+async function repositoryRoot(repo, signal) {
+	const result = await runGit(repo, ["rev-parse", "--show-toplevel"], signal);
+	if (result.exitCode !== 0) throw new ConfigError(`--repo ${repo} is not inside a git work tree: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function resolveCommit(repo, ref, flag, signal) {
+	const result = await runGit(repo, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"--end-of-options",
+		`${ref}^{commit}`
+	], signal);
+	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) throw new ConfigError(`${flag} ${ref} is not a commit in ${repo}`);
+	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function checkedOutCommit(repo, signal) {
+	const result = await runGit(repo, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	], signal);
+	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) return null;
+	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse HEAD failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function mergeBase(repo, base, head, signal) {
+	const result = await runGit(repo, [
+		"merge-base",
+		base,
+		head
+	], signal);
+	if (result.exitCode === NO_MERGE_BASE_EXIT_CODE) throw new ConfigError(`--base and --head share no history in ${repo}: the clone may be shallow (fetch the full history, e.g. actions/checkout with fetch-depth: 0), or the histories are unrelated`);
+	if (result.exitCode !== 0) throw new ConfigError(`git merge-base failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+function diffNameStatus(repo, from, to, signal) {
+	return git(repo, [
+		"diff",
+		"--name-status",
+		"-z",
+		"-M",
+		from,
+		to
+	], signal);
+}
+function statusPorcelain(repo, signal) {
+	return git(repo, [
+		"status",
+		"--porcelain",
+		"-z",
+		"--untracked-files=all"
+	], signal);
+}
+async function fileModesAt(repo, commit, signal) {
+	const output = await git(repo, [
+		"ls-tree",
+		"-r",
+		"-z",
+		"--full-tree",
+		commit
+	], signal);
+	const modes = /* @__PURE__ */ new Map();
+	for (const record of output.split("\0")) {
+		if (record === "") continue;
+		const space = record.indexOf(" ");
+		const tab = record.indexOf("	");
+		if (space === -1 || tab < space) throw new InternalError(`git ls-tree -z: malformed entry "${record}"`);
+		modes.set(record.slice(tab + 1), record.slice(0, space));
+	}
+	return modes;
+}
+async function filesMatching(repo, commit, pattern, pathspecs, signal) {
+	const result = await runGit(repo, [
+		"grep",
+		"--no-color",
+		"-z",
+		"-l",
+		"-E",
+		"-e",
+		pattern,
+		commit,
+		"--",
+		...pathspecs
+	], signal);
+	if (result.exitCode === NO_MATCH_EXIT_CODE) return [];
+	if (result.exitCode !== 0) throw new ConfigError(`git grep failed in ${repo}: ${result.stderr.trim()}`);
+	const prefix = `${commit}:`;
+	return result.stdout.split("\0").filter((entry) => entry !== "").map((entry) => {
+		if (!entry.startsWith(prefix)) throw new InternalError(`git grep printed "${entry}", which does not start with ${prefix}`);
+		return entry.slice(prefix.length);
+	});
+}
+const NEWLINE = 10;
+const utf8 = new TextDecoder("utf-8");
+async function readFilesAt(repo, commit, paths, signal) {
+	const files = /* @__PURE__ */ new Map();
+	if (paths.length === 0) return files;
+	const multiline = paths.find((path) => path.includes("\n"));
+	if (multiline !== void 0) throw new ConfigError(`cannot read ${JSON.stringify(multiline)}: a path with a newline cannot be batched`);
+	const args = ["cat-file", "--batch"];
+	const result = await withGit(repo, args, () => runProcessBinary(GIT, [
+		"-C",
+		repo,
+		...args
+	], {
+		stdin: paths.map((path) => `${commit}:${path}\n`).join(""),
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
+	if (result.exitCode !== 0) throw new ConfigError(`git cat-file --batch failed in ${repo}: ${result.stderr.trim()}`);
+	const output = result.stdout;
+	let offset = 0;
+	for (const path of paths) {
+		const headerEnd = output.indexOf(NEWLINE, offset);
+		if (headerEnd === -1) throw new InternalError(`git cat-file --batch stopped before ${path}`);
+		const header = utf8.decode(output.subarray(offset, headerEnd)).split(" ");
+		const size = Number(header[2]);
+		if (header[1] !== "blob" || !Number.isInteger(size)) throw new InternalError(`${path} is not a file at ${commit}, though git listed it there`);
+		const start = headerEnd + 1;
+		if (output[start + size] !== NEWLINE) throw new InternalError(`git cat-file --batch framed ${path} with ${size} bytes, but no newline follows them`);
+		files.set(path, utf8.decode(output.subarray(start, start + size)));
+		offset = start + size + 1;
+	}
+	if (offset !== output.length) throw new InternalError("git cat-file --batch printed more than the paths it was asked for");
+	return files;
+}
+//#endregion
+//#region src/commands/ci/job-plan.ts
+const CONTENT_PATHSPECS = CONTENT_TOP_LEVEL_FOLDERS.map((folder) => `${folder}/*.yaml`);
+const FILE_MODES = /* @__PURE__ */ new Set(["100644", "100755"]);
+async function classifyAt(repo, commit, paths, signal) {
+	const content = paths.filter(isContentPath);
+	if (content.length === 0) return /* @__PURE__ */ new Map();
+	const modes = await fileModesAt(repo, commit, signal);
+	for (const path of content) {
+		const mode = modes.get(path);
+		if (mode === void 0) throw new InternalError(`git listed ${path} at ${commit}, but its tree does not hold it`);
+		if (!FILE_MODES.has(mode)) throw new ValidationError(`${commit}:${path} is not a regular file (git mode ${mode}): Metabase would import what it points to, which this check cannot read; commit the file itself`, {
+			source: `${commit}:${path}`,
+			zodIssues: []
+		});
+	}
+	const classified = /* @__PURE__ */ new Map();
+	for (const [path, text] of await readFilesAt(repo, commit, content, signal)) classified.set(path, classifyContentFile(path, parseMetabaseYaml(text, `${commit}:${path}`)));
+	return classified;
+}
+function basePath(entry) {
+	if (entry.status === "added") return null;
+	return entry.status === "renamed" ? entry.oldPath : entry.path;
+}
+function headPath(entry) {
+	return entry.status === "deleted" ? null : entry.path;
+}
+function present(paths) {
+	return paths.filter((path) => path !== null);
+}
+function sideOf(files, path) {
+	if (path === null || !isContentPath(path)) return null;
+	const file = files.get(path);
+	if (file === void 0) throw new InternalError(`${path} was not read, though the diff names it`);
+	return file;
+}
+async function classifyChanges(repo, forkPoint, head, entries, signal) {
+	const [baseFiles, headFiles] = await Promise.all([classifyAt(repo, forkPoint, present(entries.map(basePath)), signal), classifyAt(repo, head, present(entries.map(headPath)), signal)]);
+	return entries.map((entry) => ({
+		path: entry.path,
+		base: sideOf(baseFiles, basePath(entry)),
+		head: sideOf(headFiles, headPath(entry))
+	}));
+}
+async function scanHead(repo, head, changes, changedPaths, signal) {
+	const unchangedFiles = (await classifyAt(repo, head, (await filesMatching(repo, head, TRANSFORM_MODEL_PATTERN, CONTENT_PATHSPECS, signal)).filter((path) => !changedPaths.has(path)), signal)).values();
+	return headTransforms([...changes.map((change) => change.head), ...unchangedFiles]);
+}
+async function planJob(repoPath, baseRef, headRef, signal) {
+	const repo = await repositoryRoot(repoPath, signal);
+	const [base, head, checkout] = await Promise.all([
+		resolveCommit(repo, baseRef, "--base", signal),
+		resolveCommit(repo, headRef, "--head", signal),
+		checkedOutCommit(repo, signal)
+	]);
+	const forkPoint = await mergeBase(repo, base, head, signal);
+	const entries = parseNameStatus(await diffNameStatus(repo, forkPoint, head, signal));
+	const changes = await classifyChanges(repo, forkPoint, head, entries, signal);
+	const atHead = await scanHead(repo, head, changes, new Set(entries.map((entry) => entry.path)), signal);
+	const checked = [];
+	const warnings = [];
+	const noContent = noContentChangesWarning(entries);
+	if (noContent !== null) warnings.push(noContent);
+	for (const entityId of affectedTransforms(changes)) {
+		const name = atHead.names.get(entityId);
+		if (name === void 0) {
+			warnings.push({
+				code: "missing-transform",
+				message: `a changed transform test covers transform ${entityId}, which is not in the repo at ${head}`
+			});
+			continue;
+		}
+		checked.push({
+			entity_id: entityId,
+			name
+		});
+	}
+	const coverage = assessCoverage({
+		changes,
+		transformsAtHead: atHead.names,
+		testedAtHead: atHead.tested
+	});
+	if (head === checkout) {
+		const uncommitted = uncommittedContentWarning(parseStatusPorcelain(await statusPorcelain(repo, signal)));
+		if (uncommitted !== null) warnings.push(uncommitted);
+	}
+	return {
+		snapshot: {
+			base,
+			head
+		},
+		checked,
+		warnings,
+		coverage
+	};
+}
+//#endregion
+//#region src/commands/ci/job.ts
+async function writeResults(path, events) {
+	const temporary = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`);
+	await writeFile(temporary, serializeJson(events, false) + "\n", {
+		encoding: "utf8",
+		flag: "wx"
+	});
+	try {
+		await rename(temporary, path);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+async function runJob(options) {
+	if (options.resultsPath !== null) await rm(options.resultsPath, { force: true });
+	const events = [];
+	const emit = createEmitter({
+		job: options.job,
+		now: options.now,
+		write: (event) => {
+			events.push(event);
+			if (event.type !== "job.end") options.write(event);
+		}
+	});
+	const plan = await planJob(options.repo, options.base, options.head, options.signal);
+	emit({
+		type: "job.start",
+		v: 1,
+		snapshot: plan.snapshot,
+		checked: plan.checked,
+		warnings: plan.warnings
+	});
+	const outcome = await runStages(await options.stages(plan), emit);
+	const end = emit({
+		type: "job.end",
+		state: outcome.state,
+		counts: {
+			checks: outcome.checks,
+			warnings: outcome.warnings + plan.warnings.length
+		}
+	});
+	if (options.resultsPath !== null) await writeResults(options.resultsPath, events);
+	options.write(end);
+	return outcome.state;
+}
+//#endregion
+//#region src/core/ci-unit.ts
+function testVerdict(result) {
+	const statuses = new Set(result.expectations.map((expectation) => expectation.status));
+	if (statuses.has("failed")) return "failed";
+	if (statuses.has("error")) return "error";
+	return result.status;
+}
+function testRefusal(error) {
+	if (!(error instanceof HttpError) || error.errorCode === null || !isTransformTestCode(error.errorCode)) return null;
+	return {
+		error_code: error.errorCode,
+		message: error.serverMessage ?? error.message,
+		tables: error.tables
+	};
+}
+const CHANGE_FAILURE_CODES = /* @__PURE__ */ new Set(["transform-test.transform-failed", "transform-test.unparseable-source"]);
+function refusalVerdict(refusal) {
+	return CHANGE_FAILURE_CODES.has(refusal.error_code) ? "failed" : "refused";
+}
+const TRANSFORM_NOT_ON_INSTANCE = {
+	error_code: "ci.transform-not-on-instance",
+	message: "the transform is in the branch but not on the Metabase instance; load the branch into it first"
+};
+const INVALID_ENTITY_ID = {
+	error_code: "ci.invalid-entity-id",
+	message: "the transform's entity_id in the branch is not a valid entity id"
+};
+const TRANSFORM_UNREADABLE = {
+	error_code: "ci.transform-unreadable",
+	message: "the CI identity cannot read this transform, so Metabase hides its tests: reading it needs query permission on every table it reads"
+};
+const TEST_RUN_FORBIDDEN = {
+	error_code: "ci.test-run-forbidden",
+	message: "Metabase did not let the CI identity run this test: running a test needs write access to it, and a read-only remote-synced instance refuses everyone"
+};
+function requestFailure(error) {
+	if (error instanceof HttpError) return {
+		error_code: "ci.http-error",
+		status: error.status,
+		message: error.message
+	};
+	if (error instanceof TimeoutError) return {
+		error_code: "ci.timeout",
+		status: null,
+		message: error.message
+	};
+	if (error instanceof NetworkError) return {
+		error_code: "ci.network-error",
+		status: null,
+		message: error.message
+	};
+	if (error instanceof ResponseShapeError) return {
+		error_code: "ci.unreadable-answer",
+		status: null,
+		message: error.message
+	};
+	return null;
+}
+function sessionStop(error) {
+	if (error instanceof CapabilityError) return {
+		code: "ci.unsupported-server",
+		message: error.message
+	};
+	if (error instanceof HttpError && error.kind === "auth") return {
+		code: "ci.unauthorized",
+		message: error.message
+	};
+	return null;
+}
+function lookupStop(error) {
+	const stop = sessionStop(error);
+	if (stop !== null) return stop;
+	const failure = requestFailure(error);
+	return failure === null ? null : {
+		code: failure.error_code,
+		message: failure.message
+	};
+}
+const REFUSAL_FOR_FORBIDDEN = {
+	read: TRANSFORM_UNREADABLE,
+	list: null,
+	run: TEST_RUN_FORBIDDEN
+};
+function transformFailure(error, request) {
+	const stop = sessionStop(error);
+	if (stop !== null) return {
+		kind: "stop",
+		stop
+	};
+	const refusal = request === "run" ? testRefusal(error) : null;
+	if (refusal !== null) return {
+		kind: "check",
+		verdict: refusalVerdict(refusal),
+		detail: refusal
+	};
+	const forbiddenRefusal = error instanceof HttpError && error.kind === "forbidden" ? REFUSAL_FOR_FORBIDDEN[request] : null;
+	if (forbiddenRefusal !== null) return {
+		kind: "check",
+		verdict: "refused",
+		detail: forbiddenRefusal
+	};
+	if (request === "read" && isHttpNotFound(error)) return {
+		kind: "check",
+		verdict: "refused",
+		detail: TRANSFORM_NOT_ON_INSTANCE
+	};
+	const failure = requestFailure(error);
+	if (failure === null) return null;
+	if (error instanceof NetworkError && request !== "run") return {
+		kind: "stop",
+		stop: {
+			code: failure.error_code,
+			message: failure.message
+		}
+	};
+	return {
+		kind: "check",
+		verdict: "error",
+		detail: failure
+	};
+}
+//#endregion
+//#region src/commands/ci/unit-stage.ts
+const TEST_TIMEOUT_MS = 12e4;
+const OK_STATUS = "ok";
+const LOOKUP_KIND_BY_STATUS = /* @__PURE__ */ new Map([["not-found", "not-found"], ["invalid-format", "invalid-entity-id"]]);
+function transformLookup(entityId, entry) {
+	if (entry?.status === OK_STATUS && entry.id !== void 0) return {
+		kind: "found",
+		id: entry.id
+	};
+	const kind = entry === void 0 ? void 0 : LOOKUP_KIND_BY_STATUS.get(entry.status);
+	if (kind === void 0) throw new InternalError(`eid translation answered ${entityId} with ${JSON.stringify(entry ?? null)}`);
+	return { kind };
+}
+function clientPort(client) {
+	return {
+		lookUpTransforms: async (entityIds) => {
+			const result = await client.eidTranslation.translate({ entity_ids: { transform: [...entityIds] } }, { signal: interruptSignal });
+			const lookups = /* @__PURE__ */ new Map();
+			for (const entityId of entityIds) lookups.set(entityId, transformLookup(entityId, result.entity_ids[entityId]));
+			return lookups;
+		},
+		readTransform: async (transformId) => {
+			await client.transform.get(transformId, { signal: interruptSignal });
+		},
+		listTests: async (transformId) => {
+			return (await client.transformTest.list({ "transform-id": transformId }, { signal: interruptSignal })).data;
+		},
+		runTest: (testId) => client.transformTest.run(testId, {
+			timeoutMs: TEST_TIMEOUT_MS,
+			signal: interruptSignal
+		}),
+		nowMs: () => performance.now()
+	};
+}
+const MISSING_TRANSFORM_DETAIL = {
+	"not-found": TRANSFORM_NOT_ON_INSTANCE,
+	"invalid-entity-id": INVALID_ENTITY_ID
+};
+async function attempt(request, call) {
+	try {
+		return {
+			kind: "settled",
+			value: await call()
+		};
+	} catch (error) {
+		const failure = transformFailure(error, request);
+		if (failure === null) throw error;
+		return failure;
+	}
+}
+function reportFailure(failure, check, ms, report) {
+	if (failure.kind === "stop") return failure.stop;
+	report({
+		check,
+		verdict: failure.verdict,
+		warnings: [],
+		ms,
+		detail: failure.detail
+	});
+	return null;
+}
+async function checkTransform(transform, transformId, port, report) {
+	const transformCheck = {
+		kind: "transform-test",
+		id: transform.entity_id,
+		label: transform.name
+	};
+	const started = port.nowMs();
+	const read = await attempt("read", () => port.readTransform(transformId));
+	if (read.kind !== "settled") return reportFailure(read, transformCheck, port.nowMs() - started, report);
+	const tests = await attempt("list", () => port.listTests(transformId));
+	if (tests.kind !== "settled") return reportFailure(tests, transformCheck, port.nowMs() - started, report);
+	for (const test of tests.value.toSorted((a, b) => a.id - b.id)) {
+		const check = {
+			kind: "transform-test",
+			id: String(test.id),
+			label: `${transform.name}: ${test.name}`
+		};
+		const runStarted = port.nowMs();
+		const run = await attempt("run", () => port.runTest(test.id));
+		const ms = port.nowMs() - runStarted;
+		if (run.kind === "settled") {
+			report({
+				check,
+				verdict: testVerdict(run.value),
+				warnings: [],
+				ms,
+				detail: run.value
+			});
+			continue;
+		}
+		const stop = reportFailure(run, check, ms, report);
+		if (stop !== null) return stop;
+	}
+	return null;
+}
+function unitStage(checked, connect) {
+	return {
+		name: "unit",
+		run: async (report) => {
+			const port = await connect();
+			let lookups;
+			try {
+				lookups = await port.lookUpTransforms(checked.map((transform) => transform.entity_id));
+			} catch (error) {
+				const stop = lookupStop(error);
+				if (stop === null) throw error;
+				return stop;
+			}
+			for (const transform of checked) {
+				const lookup = lookups.get(transform.entity_id);
+				if (lookup === void 0) throw new InternalError(`no lookup for transform ${transform.entity_id}`);
+				if (lookup.kind !== "found") {
+					report({
+						check: {
+							kind: "transform-test",
+							id: transform.entity_id,
+							label: transform.name
+						},
+						verdict: "refused",
+						warnings: [],
+						ms: 0,
+						detail: MISSING_TRANSFORM_DETAIL[lookup.kind]
+					});
+					continue;
+				}
+				const stop = await checkTransform(transform, lookup.id, port, report);
+				if (stop !== null) return stop;
+			}
+			return null;
+		}
+	};
+}
+//#endregion
+//#region src/commands/ci/run.ts
+var run_default = defineMetabaseCommand({
+	meta: {
+		name: "run",
+		description: "Check the transforms a branch changed, writing one JSON event per line"
+	},
+	details: "Compares --head with its merge base with --base and finds the transforms whose files or tests changed. Two stages check them: `lint` fails each transform the branch adds or whose logic (source or target) it edits that has no transform test, and warns about untested transforms the branch did not touch; `unit` runs the changed transforms' tests on the Metabase instance that --url, MB_URL or --profile names, in that order, which must already hold the branch's content, and is skipped when no transform changed. Content files are the `.yaml` files Metabase's import reads: not dotfiles, under a top-level serialization folder such as `transforms/` or `collections/`. Only committed content is checked: when --head is the checked-out commit, a content file with uncommitted changes is listed in an `uncommitted-content` warning, and its committed version is checked. Writes one JSON event per line (`job.start`, then each stage and check, then `job.end`); `job.start.checked` lists the transforms the job covered, and a `no-content-changes` warning says when the change touches no content file, so nothing was checked; each transform test's result is passed through as the check's `detail`. Exits 0 when the job passes. Exits 1 after `job.end` when it does not: `state` is `failed` when a check failed (fix the transform), and `errored` when no check failed but one could not judge the change (fix the test or the setup); a failure outranks errors, since it is a finding about the change. A test run that times out, loses its connection or gets an HTTP error is an `error` check whose `detail.error_code` starts with `ci.`, and the next test runs. A failure every later request would repeat ends the unit stage early, `errored` unless a check failed, with the reason in `stage.end.stopped`: Metabase rejects the credential, the server has no transform testing, the entity-id lookup fails, or Metabase cannot be reached before a test runs. Exits 2 on a usage or config error: a bad flag, a --repo, --base or --head that git cannot resolve or relate, or no Metabase credential when a transform needs testing, which is found after `job.start`. Exits 1 on a crash, such as a changed content file that does not parse, and 130 on an interrupt: the stream stops before `job.end`, the error is on stderr, and no --results file is left, not even an earlier run's. When the reader closes stdout early, the job still runs to the end, writes --results and exits by its state.",
+	requires: [
+		"eidTranslation.translate",
+		"transform.get",
+		"transformTest.list",
+		"transformTest.run"
+	],
+	args: {
+		...profileFlag,
+		...connectionFlags,
+		base: {
+			type: "string",
+			description: "Ref the branch is compared against",
+			required: true
+		},
+		head: {
+			type: "string",
+			description: "Ref to check",
+			default: "HEAD"
+		},
+		repo: {
+			type: "string",
+			description: "Path inside the git work tree to check",
+			default: "."
+		},
+		results: {
+			type: "string",
+			description: "Also write every event to this file, as one JSON array"
+		}
+	},
+	outputSchema: CiEvent,
+	examples: ["mb ci run --base origin/main", "mb ci run --base origin/main --results results.json"],
+	async run({ args, getClient }) {
+		const state = await runJob({
+			repo: args.repo,
+			base: args.base,
+			head: args.head,
+			stages: async (plan) => {
+				const lint = coverageStage(plan.coverage);
+				if (plan.checked.length === 0) return [lint];
+				return [lint, unitStage(plan.checked, async () => clientPort(await getClient()))];
+			},
+			job: randomUUID(),
+			now: () => /* @__PURE__ */ new Date(),
+			write: jsonLineWriter(process.stdout),
+			resultsPath: args.results ?? null,
+			signal: interruptSignal
+		});
+		if (state !== "passed") throw new FailedResultError(`ci job ${state}`);
+	}
+});
+//#endregion
+export { run_default as default };