@metabase/cli 0.5.8-alpha.bryan-rci-28-lint-stage.198256c → 0.5.9

package/dist/{ci-diZ50wlb.mjs → ci-jYpJfw-b.mjs}

@@ -3,7 +3,7 @@ import { t as defineCommandGroup } from "./group-DxaqX3Gg.mjs";
 var ci_default = defineCommandGroup({
 	name: "ci",
 	description: "Check a branch's transforms the way CI does",
-	subCommands: { run: () => import("./run-DGG0ZqPA.mjs").then((mod) => mod.default) }
+	subCommands: { run: () => import("./run-Ch9KAm3W.mjs").then((mod) => mod.default) }
 });
 //#endregion
 export { ci_default as default };

package/dist/cli.mjs

@@ -527,7 +527,7 @@ function trustSystemCa() {
 //#endregion
 //#region package.json
 var name = "@metabase/cli";
-var version = "0.5.8-alpha.bryan-rci-28-lint-stage.198256c";
+var version = "0.5.9";
 var description = "Metabase CLI";
 //#endregion
 //#region src/runtime/command-augment.ts
@@ -557,7 +557,7 @@ const main = defineCommand({
 		dashboard: () => import("./dashboard-CZTlBLWV.mjs").then((mod) => mod.default),
 		subscription: () => import("./subscription-DfvU-S6P.mjs").then((mod) => mod.default),
 		"data-action": () => import("./data-action-C4wpuM5b.mjs").then((mod) => mod.default),
-		"data-app": () => import("./data-app-D8UNc8dc.mjs").then((mod) => mod.default),
+		"data-app": () => import("./data-app-DLKxuzzt.mjs").then((mod) => mod.default),
 		"api-key": () => import("./api-key-fIfek7nB.mjs").then((mod) => mod.default),
 		alert: () => import("./alert-DzgnuHeD.mjs").then((mod) => mod.default),
 		collection: () => import("./collection-D_GyzwaY.mjs").then((mod) => mod.default),
@@ -568,7 +568,7 @@ const main = defineCommand({
 		"transform-job": () => import("./transform-job-BTM0t8YZ.mjs").then((mod) => mod.default),
 		"transform-tag": () => import("./transform-tag-DcJRURqM.mjs").then((mod) => mod.default),
 		"transform-test": () => import("./transform-test-CSRDJsx3.mjs").then((mod) => mod.default),
-		ci: () => import("./ci-diZ50wlb.mjs").then((mod) => mod.default),
+		ci: () => import("./ci-jYpJfw-b.mjs").then((mod) => mod.default),
 		setting: () => import("./setting-h61KIVKH.mjs").then((mod) => mod.default),
 		search: () => import("./search-oxkqbIhJ.mjs").then((mod) => mod.default),
 		"git-sync": () => import("./git-sync-OiTQkETw.mjs").then((mod) => mod.default),
@@ -976,6 +976,7 @@ const FEATURE_RULES = {
 	},
 	transforms: { since: 59 },
 	transformJobActivation: { since: 61 },
+	builtInTransformJobsStartInactive: { since: 65 },
 	measures: { since: 59 },
 	collectionItemMeasures: { since: 61 },
 	explorations: { since: 65 },

package/dist/{create-BSIevt1L.mjs → create-W6plJIxv.mjs}

@@ -9,7 +9,7 @@ var create_default = defineMetabaseCommand({
 		name: "create",
 		description: "Create a data app and its collection from JSON"
 	},
-	details: "The JSON body needs `name`, the slug. Optional: `display_name` (the slug by default), `description`, `allowed_hosts`, `enabled` (true by default), `bundle_path` and `version`. The app starts with an empty bundle; `mb data-app set-bundle` replaces it. The answer's `resource_collection_id` is the app's collection, where its questions and actions go. `mb data-app scaffold` copies the project template.",
+	details: "The JSON body needs `name`, the slug. Optional: `display_name` (the slug by default), `description`, `allowed_hosts`, `enabled` (true by default), `bundle_path` and `version`. The app starts with an empty bundle; a git-sync import replaces it with the `dist/index.js` committed in `data_apps/<slug>/`. The answer's `resource_collection_id` is the app's collection, where its questions and actions go. `mb data-app scaffold` copies the project template.",
 	skills: [{
 		skill: "data-app",
 		purpose: "how an app is created, built and published"

package/dist/{data-app-D8UNc8dc.mjs → data-app-DLKxuzzt.mjs}

@@ -26,13 +26,12 @@ var data_app_default = defineCommandGroup({
 		}
 	],
 	subCommands: {
-		scaffold: () => import("./scaffold-UalCpCG0.mjs").then((mod) => mod.default),
+		scaffold: () => import("./scaffold-Pr1BC2uw.mjs").then((mod) => mod.default),
 		list: () => import("./list-CSFgvwH_.mjs").then((mod) => mod.default),
 		get: () => import("./get-DDco3nzW.mjs").then((mod) => mod.default),
-		create: () => import("./create-BSIevt1L.mjs").then((mod) => mod.default),
-		update: () => import("./update-C3AnMkS7.mjs").then((mod) => mod.default),
-		"typed-schema": () => import("./typed-schema-MNW93duy.mjs").then((mod) => mod.default),
-		"set-bundle": () => import("./set-bundle-CJed1vO8.mjs").then((mod) => mod.default),
+		create: () => import("./create-W6plJIxv.mjs").then((mod) => mod.default),
+		update: () => import("./update-D32XqpkV.mjs").then((mod) => mod.default),
+		"typed-schema": () => import("./typed-schema-DTL_8ggU.mjs").then((mod) => mod.default),
 		"set-enabled": () => import("./set-enabled-Q7t_Jjev.mjs").then((mod) => mod.default),
 		delete: () => import("./delete-z-gK8iJm.mjs").then((mod) => mod.default)
 	}

package/dist/{data-app-project-CiBHndNR.mjs → data-app-project-tbEA14ZN.mjs}

@@ -4,17 +4,8 @@ import { z } from "zod";
 import { cp, mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 //#region src/runtime/data-app-project.ts
-const DEFAULT_BUNDLE_PATH = "build/index.js";
 const PackageManifest = z.object({}).loose();
 const SHIPPED_GITIGNORE = "gitignore";
-async function readBundle(path) {
-	try {
-		return await readFile(path, "utf8");
-	} catch (error) {
-		if (isFileNotFoundError(error)) throw new ConfigError(`bundle not found: ${path} — build the app first (npm run build)`);
-		throw error;
-	}
-}
 async function writeProjectFile(path, text) {
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, text, "utf8");
@@ -55,4 +46,4 @@ async function scaffoldDataAppProject({ dir, templateDir }) {
 	await renamePackage(dir, packageName);
 }
 //#endregion
-export { writeProjectFile as i, readBundle as n, scaffoldDataAppProject as r, DEFAULT_BUNDLE_PATH as t };
+export { writeProjectFile as n, scaffoldDataAppProject as t };

package/dist/{run-DGG0ZqPA.mjs → run-Ch9KAm3W.mjs}

@@ -1,15 +1,13 @@
-import { c as InternalError, f as ResponseShapeError, g as errorMessage, h as ValidationError, i as AbortError, o as ConfigError, p as TimeoutError, r as isPlainObject, s as FailedResultError, u as NetworkError } from "./predicates-0C0TsWcJ.mjs";
+import { c as InternalError, f as ResponseShapeError, h as ValidationError, i as AbortError, o as ConfigError, p as TimeoutError, r as isPlainObject, s as FailedResultError, u as NetworkError } from "./predicates-0C0TsWcJ.mjs";
 import { R as CapabilityError, Y as HttpError, Z as isHttpNotFound, a as exitCodeFor, c as lineWriter, ct as connectionFlags, lt as formatFlags, m as serializeJson, mt as profileFlag, s as jsonLineWriter, t as interruptSignal, vt as parseInteger } from "./cli.mjs";
 import { i as NotAuthenticatedError, t as defineMetabaseCommand } from "./runtime-fJ-A3m-R.mjs";
 import { i as TransformTestRunResult, o as isTransformTestCode } from "./transform-test-D6QIyu8C.mjs";
 import { a as runProcess, n as ProcessNotFoundError, o as runProcessBinary, r as ProcessTimeoutError, t as ProcessInterruptedError } from "./process-ByKCTa6A.mjs";
 import { t as parseMetabaseYaml } from "./yaml-Ctv1l2-P.mjs";
 import { z } from "zod";
-import { mkdtemp, rename, rm, writeFile } from "node:fs/promises";
+import { rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
-import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
-import { lint } from "@metabase/representations";
 import { isDeepStrictEqual } from "node:util";
 import { performance } from "node:perf_hooks";
 //#region src/core/ci-coverage.ts
@@ -140,163 +138,6 @@ function coverageStage(assessment) {
 		}
 	};
 }
-//#endregion
-//#region src/core/ci-lint.ts
-const LINT_ERROR_RULES = [
-	"schema",
-	"duplicate-entity-id",
-	"dangling-transform-id",
-	"wrong-type-transform-id",
-	"transform-cycle",
-	"missing-input",
-	"unused-input",
-	"untestable-transform",
-	"duplicate-input",
-	"expectation-reads-other-table",
-	"row-columns-mismatch",
-	"duplicate-expectation-name",
-	"transform-collection",
-	"missing-incremental-table-tag",
-	"missing-target-schema"
-];
-const LINT_WARNING_RULES = [
-	"unknown-table",
-	"duplicate-target",
-	"reads-not-checked",
-	"no-expectations",
-	"unsupported-transform-engine",
-	"untestable-engine",
-	"upstream-column-mismatch",
-	"input-missing-read-column",
-	"table-qualified-column",
-	"live-sql-input"
-];
-const LintEntity = z.object({
-	model: z.string().nullable(),
-	entity_id: z.string().nullable(),
-	name: z.string().nullable()
-});
-const LintFindingFields = z.object({
-	file: z.string(),
-	entity: LintEntity,
-	message: z.string(),
-	related: z.array(z.string())
-});
-const LintError = LintFindingFields.extend({
-	rule: z.enum(LINT_ERROR_RULES),
-	severity: z.literal("error")
-});
-const LintWarning = LintFindingFields.extend({
-	rule: z.enum(LINT_WARNING_RULES),
-	severity: z.literal("warning")
-});
-const LintResult = z.object({
-	files: z.number().int().nonnegative(),
-	findings: z.array(z.discriminatedUnion("severity", [LintError, LintWarning]))
-});
-const ERROR_CHECK_KIND = {
-	schema: "yaml",
-	"transform-cycle": "cycles",
-	"duplicate-entity-id": "broken-refs",
-	"dangling-transform-id": "broken-refs",
-	"wrong-type-transform-id": "broken-refs",
-	"missing-input": "broken-refs",
-	"unused-input": "broken-refs",
-	"untestable-transform": "broken-refs",
-	"duplicate-input": "broken-refs",
-	"expectation-reads-other-table": "broken-refs",
-	"row-columns-mismatch": "broken-refs",
-	"duplicate-expectation-name": "broken-refs",
-	"transform-collection": "broken-refs",
-	"missing-incremental-table-tag": "broken-refs",
-	"missing-target-schema": "broken-refs"
-};
-const LINT_RUN_CHECK = {
-	kind: "lint",
-	id: "lint",
-	label: "Representation lint"
-};
-function failedLabel(finding) {
-	if (finding.entity.name === null) return `${finding.file}: ${finding.rule}`;
-	return `${finding.entity.name}: ${finding.rule}`;
-}
-function failedCheck(finding, occurrence) {
-	return {
-		check: {
-			kind: ERROR_CHECK_KIND[finding.rule],
-			id: `${finding.rule}:${finding.file}:${occurrence}`,
-			label: failedLabel(finding)
-		},
-		verdict: "failed",
-		warnings: [],
-		ms: 0,
-		detail: finding
-	};
-}
-function lintWarning(finding) {
-	return {
-		code: finding.rule,
-		message: `${finding.file}: ${finding.message}`
-	};
-}
-function warningsCheck(files, findings) {
-	return {
-		check: LINT_RUN_CHECK,
-		verdict: "passed",
-		warnings: findings.map(lintWarning),
-		ms: 0,
-		detail: {
-			files,
-			findings
-		}
-	};
-}
-function crashedCheck(message) {
-	return {
-		check: LINT_RUN_CHECK,
-		verdict: "error",
-		warnings: [],
-		ms: 0,
-		detail: { message }
-	};
-}
-function lintChecks(result) {
-	const failed = [];
-	const warnings = [];
-	const occurrences = /* @__PURE__ */ new Map();
-	for (const finding of result.findings) if (finding.severity === "error") {
-		const key = `${finding.rule}:${finding.file}`;
-		const previous = occurrences.get(key);
-		const occurrence = previous === void 0 ? 1 : previous + 1;
-		occurrences.set(key, occurrence);
-		failed.push(failedCheck(finding, occurrence));
-	} else warnings.push(finding);
-	return [...failed, warningsCheck(result.files, warnings)];
-}
-async function runLint(lintTree) {
-	let output;
-	try {
-		output = await lintTree();
-	} catch (error) {
-		if (error instanceof AbortError) throw error;
-		return [crashedCheck(`the linter threw: ${errorMessage(error)}`)];
-	}
-	const parsed = LintResult.safeParse(output);
-	if (!parsed.success) return [crashedCheck(`the linter answered an unreadable result: ${z.prettifyError(parsed.error)}`)];
-	return lintChecks(parsed.data);
-}
-function lintStage(coverage, lintTree) {
-	const coverageChecks = coverageStage(coverage);
-	return {
-		name: "lint",
-		run: async (report) => {
-			const stopped = await coverageChecks.run(report);
-			if (stopped !== null) return stopped;
-			for (const check of await runLint(lintTree)) report(check);
-			return null;
-		}
-	};
-}
 const StageName = z.enum(["lint", "unit"]);
 const Verdict = z.enum([
 	"passed",
@@ -328,7 +169,6 @@ const Snapshot = z.object({
 const Check = z.object({
 	kind: z.enum([
 		"coverage",
-		"lint",
 		"yaml",
 		"cycles",
 		"broken-refs",
@@ -456,34 +296,21 @@ const VERDICT_MARK = {
 	error: "!",
 	refused: "!"
 };
-const NO_FAILED_CHECKS = /* @__PURE__ */ new Set();
-const FIX_ORDER = [
-	"transform",
-	"tests",
-	"lint"
-];
-const FIX_TEXT = {
-	transform: "fix the transform",
-	tests: "add or restore transform tests",
-	lint: "fix what the linter flagged"
+const NO_FAILED_CHECKS = "none";
+const FAILED_TEXT = {
+	none: "FAILED  fix the transform",
+	transform: "FAILED  fix the transform",
+	tests: "FAILED  add or restore transform tests",
+	both: "FAILED  fix the transform and add the missing tests"
 };
-function fixFor(kind) {
-	switch (kind) {
-		case "coverage": return "tests";
-		case "transform-test": return "transform";
-		case "lint":
-		case "yaml":
-		case "cycles":
-		case "broken-refs": return "lint";
-		default: throw new InternalError(`check of no known kind: ${JSON.stringify(kind)}`);
-	}
-}
 const ERRORED_TEXT = "ERRORED  fix the test or the setup";
 const CheckMessage = z.object({ message: z.string() });
 const HttpFailureMessage = CheckMessage.extend({ status: z.number().int() });
 function failedChecksAfter(failed, event) {
 	if (event.type !== "check.result" || event.verdict !== "failed") return failed;
-	return /* @__PURE__ */ new Set([...failed, fixFor(event.check.kind)]);
+	const kind = event.check.kind === "coverage" ? "tests" : "transform";
+	if (failed === "none" || failed === kind) return kind;
+	return "both";
 }
 function ciEventLines(event, maxRows, failed) {
 	switch (event.type) {
@@ -508,9 +335,7 @@ function shortSha(sha) {
 }
 function jobEndText(state, failed) {
 	if (state === "passed") return "PASSED";
-	if (state !== "failed") return ERRORED_TEXT;
-	const fixes = FIX_ORDER.filter((fix) => failed.has(fix));
-	return `FAILED  ${(fixes.length === 0 ? [FIX_TEXT.transform] : fixes.map((fix) => FIX_TEXT[fix])).join(" and ")}`;
+	return state === "failed" ? FAILED_TEXT[failed] : ERRORED_TEXT;
 }
 function jobExitCode(state) {
 	return state === "passed" ? PASSED_EXIT_CODE : exitCodeFor("failed");
@@ -594,208 +419,6 @@ function cellText(value) {
 	return value === null ? "null" : String(value);
 }
 //#endregion
-//#region src/runtime/git.ts
-const GIT = "git";
-const TAR = "tar";
-const NO_MATCH_EXIT_CODE = 1;
-const NO_MERGE_BASE_EXIT_CODE = 1;
-const UNKNOWN_REF_EXIT_CODE = 1;
-const GIT_TIMEOUT_MS = 12e4;
-async function withGit(repo, args, spawn) {
-	try {
-		return await spawn();
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) throw new ConfigError("git is not installed or not on PATH");
-		if (error instanceof ProcessInterruptedError) throw new AbortError(`interrupted while git ${args.join(" ")} ran in ${repo}`);
-		if (error instanceof ProcessTimeoutError) throw new ConfigError(`git ${args.join(" ")} did not finish within ${GIT_TIMEOUT_MS / 1e3} s in ${repo}`);
-		throw error;
-	}
-}
-function runGit(repo, args, signal) {
-	return withGit(repo, args, () => runProcess(GIT, [
-		"-C",
-		repo,
-		...args
-	], {
-		signal,
-		timeoutMs: GIT_TIMEOUT_MS
-	}));
-}
-async function git(repo, args, signal) {
-	const result = await runGit(repo, args, signal);
-	if (result.exitCode !== 0) throw new ConfigError(`git ${args.join(" ")} failed in ${repo}: ${result.stderr.trim()}`);
-	return result.stdout;
-}
-async function repositoryRoot(repo, signal) {
-	const result = await runGit(repo, ["rev-parse", "--show-toplevel"], signal);
-	if (result.exitCode !== 0) throw new ConfigError(`--repo ${repo} is not inside a git work tree: ${result.stderr.trim()}`);
-	return result.stdout.trim();
-}
-async function resolveCommit(repo, ref, flag, signal) {
-	const result = await runGit(repo, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		"--end-of-options",
-		`${ref}^{commit}`
-	], signal);
-	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) throw new ConfigError(`${flag} ${ref} is not a commit in ${repo}`);
-	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse failed in ${repo}: ${result.stderr.trim()}`);
-	return result.stdout.trim();
-}
-async function checkedOutCommit(repo, signal) {
-	const result = await runGit(repo, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		"HEAD"
-	], signal);
-	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) return null;
-	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse HEAD failed in ${repo}: ${result.stderr.trim()}`);
-	return result.stdout.trim();
-}
-async function mergeBase(repo, base, head, signal) {
-	const result = await runGit(repo, [
-		"merge-base",
-		base,
-		head
-	], signal);
-	if (result.exitCode === NO_MERGE_BASE_EXIT_CODE) throw new ConfigError(`--base and --head share no history in ${repo}: the clone may be shallow (fetch the full history, e.g. actions/checkout with fetch-depth: 0), or the histories are unrelated`);
-	if (result.exitCode !== 0) throw new ConfigError(`git merge-base failed in ${repo}: ${result.stderr.trim()}`);
-	return result.stdout.trim();
-}
-function diffNameStatus(repo, from, to, signal) {
-	return git(repo, [
-		"diff",
-		"--name-status",
-		"-z",
-		"-M",
-		from,
-		to
-	], signal);
-}
-function statusPorcelain(repo, signal) {
-	return git(repo, [
-		"status",
-		"--porcelain",
-		"-z",
-		"--untracked-files=all"
-	], signal);
-}
-async function fileModesAt(repo, commit, signal) {
-	const output = await git(repo, [
-		"ls-tree",
-		"-r",
-		"-z",
-		"--full-tree",
-		commit
-	], signal);
-	const modes = /* @__PURE__ */ new Map();
-	for (const record of output.split("\0")) {
-		if (record === "") continue;
-		const space = record.indexOf(" ");
-		const tab = record.indexOf("	");
-		if (space === -1 || tab < space) throw new InternalError(`git ls-tree -z: malformed entry "${record}"`);
-		modes.set(record.slice(tab + 1), record.slice(0, space));
-	}
-	return modes;
-}
-async function filesMatching(repo, commit, pattern, pathspecs, signal) {
-	const result = await runGit(repo, [
-		"grep",
-		"--no-color",
-		"-z",
-		"-l",
-		"-E",
-		"-e",
-		pattern,
-		commit,
-		"--",
-		...pathspecs
-	], signal);
-	if (result.exitCode === NO_MATCH_EXIT_CODE) return [];
-	if (result.exitCode !== 0) throw new ConfigError(`git grep failed in ${repo}: ${result.stderr.trim()}`);
-	const prefix = `${commit}:`;
-	return result.stdout.split("\0").filter((entry) => entry !== "").map((entry) => {
-		if (!entry.startsWith(prefix)) throw new InternalError(`git grep printed "${entry}", which does not start with ${prefix}`);
-		return entry.slice(prefix.length);
-	});
-}
-const NEWLINE = 10;
-const utf8 = new TextDecoder("utf-8");
-async function readFilesAt(repo, commit, paths, signal) {
-	const files = /* @__PURE__ */ new Map();
-	if (paths.length === 0) return files;
-	const multiline = paths.find((path) => path.includes("\n"));
-	if (multiline !== void 0) throw new ConfigError(`cannot read ${JSON.stringify(multiline)}: a path with a newline cannot be batched`);
-	const args = ["cat-file", "--batch"];
-	const result = await withGit(repo, args, () => runProcessBinary(GIT, [
-		"-C",
-		repo,
-		...args
-	], {
-		stdin: paths.map((path) => `${commit}:${path}\n`).join(""),
-		signal,
-		timeoutMs: GIT_TIMEOUT_MS
-	}));
-	if (result.exitCode !== 0) throw new ConfigError(`git cat-file --batch failed in ${repo}: ${result.stderr.trim()}`);
-	const output = result.stdout;
-	let offset = 0;
-	for (const path of paths) {
-		const headerEnd = output.indexOf(NEWLINE, offset);
-		if (headerEnd === -1) throw new InternalError(`git cat-file --batch stopped before ${path}`);
-		const header = utf8.decode(output.subarray(offset, headerEnd)).split(" ");
-		const size = Number(header[2]);
-		if (header[1] !== "blob" || !Number.isInteger(size)) throw new InternalError(`${path} is not a file at ${commit}, though git listed it there`);
-		const start = headerEnd + 1;
-		if (output[start + size] !== NEWLINE) throw new InternalError(`git cat-file --batch framed ${path} with ${size} bytes, but no newline follows them`);
-		files.set(path, utf8.decode(output.subarray(start, start + size)));
-		offset = start + size + 1;
-	}
-	if (offset !== output.length) throw new InternalError("git cat-file --batch printed more than the paths it was asked for");
-	return files;
-}
-async function withCommittedTree(repo, commit, signal, use) {
-	const root = await repositoryRoot(repo, signal);
-	const args = [
-		"archive",
-		"--format=tar",
-		commit
-	];
-	const archive = await withGit(root, args, () => runProcessBinary(GIT, [
-		"-C",
-		root,
-		...args
-	], {
-		signal,
-		timeoutMs: GIT_TIMEOUT_MS
-	}));
-	if (archive.exitCode !== 0) throw new ConfigError(`git archive ${commit} failed in ${root}: ${archive.stderr.trim()}`);
-	const folder = await mkdtemp(join(tmpdir(), "mb-ci-tree-"));
-	try {
-		const extract = await runProcess(TAR, [
-			"-x",
-			"-f",
-			"-",
-			"-C",
-			folder
-		], {
-			stdin: archive.stdout,
-			signal
-		}).catch((error) => {
-			if (error instanceof ProcessInterruptedError) throw new AbortError(`interrupted while tar extracted ${commit}`);
-			throw error;
-		});
-		if (extract.exitCode !== 0) throw new ConfigError(`tar could not extract ${commit}: ${extract.stderr.trim()}`);
-		return await use(folder);
-	} finally {
-		await rm(folder, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-//#endregion
 //#region src/core/ci-affected.ts
 const SINGLE_PATH_STATUSES = /* @__PURE__ */ new Map([
 	["A", "added"],
@@ -1034,6 +657,167 @@ function unreadContentWarning(reasons) {
 	};
 }
 //#endregion
+//#region src/runtime/git.ts
+const GIT = "git";
+const NO_MATCH_EXIT_CODE = 1;
+const NO_MERGE_BASE_EXIT_CODE = 1;
+const UNKNOWN_REF_EXIT_CODE = 1;
+const GIT_TIMEOUT_MS = 12e4;
+async function withGit(repo, args, spawn) {
+	try {
+		return await spawn();
+	} catch (error) {
+		if (error instanceof ProcessNotFoundError) throw new ConfigError("git is not installed or not on PATH");
+		if (error instanceof ProcessInterruptedError) throw new AbortError(`interrupted while git ${args.join(" ")} ran in ${repo}`);
+		if (error instanceof ProcessTimeoutError) throw new ConfigError(`git ${args.join(" ")} did not finish within ${GIT_TIMEOUT_MS / 1e3} s in ${repo}`);
+		throw error;
+	}
+}
+function runGit(repo, args, signal) {
+	return withGit(repo, args, () => runProcess(GIT, [
+		"-C",
+		repo,
+		...args
+	], {
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
+}
+async function git(repo, args, signal) {
+	const result = await runGit(repo, args, signal);
+	if (result.exitCode !== 0) throw new ConfigError(`git ${args.join(" ")} failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout;
+}
+async function repositoryRoot(repo, signal) {
+	const result = await runGit(repo, ["rev-parse", "--show-toplevel"], signal);
+	if (result.exitCode !== 0) throw new ConfigError(`--repo ${repo} is not inside a git work tree: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function resolveCommit(repo, ref, flag, signal) {
+	const result = await runGit(repo, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"--end-of-options",
+		`${ref}^{commit}`
+	], signal);
+	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) throw new ConfigError(`${flag} ${ref} is not a commit in ${repo}`);
+	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function checkedOutCommit(repo, signal) {
+	const result = await runGit(repo, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	], signal);
+	if (result.exitCode === UNKNOWN_REF_EXIT_CODE) return null;
+	if (result.exitCode !== 0) throw new ConfigError(`git rev-parse HEAD failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+async function mergeBase(repo, base, head, signal) {
+	const result = await runGit(repo, [
+		"merge-base",
+		base,
+		head
+	], signal);
+	if (result.exitCode === NO_MERGE_BASE_EXIT_CODE) throw new ConfigError(`--base and --head share no history in ${repo}: the clone may be shallow (fetch the full history, e.g. actions/checkout with fetch-depth: 0), or the histories are unrelated`);
+	if (result.exitCode !== 0) throw new ConfigError(`git merge-base failed in ${repo}: ${result.stderr.trim()}`);
+	return result.stdout.trim();
+}
+function diffNameStatus(repo, from, to, signal) {
+	return git(repo, [
+		"diff",
+		"--name-status",
+		"-z",
+		"-M",
+		from,
+		to
+	], signal);
+}
+function statusPorcelain(repo, signal) {
+	return git(repo, [
+		"status",
+		"--porcelain",
+		"-z",
+		"--untracked-files=all"
+	], signal);
+}
+async function fileModesAt(repo, commit, signal) {
+	const output = await git(repo, [
+		"ls-tree",
+		"-r",
+		"-z",
+		"--full-tree",
+		commit
+	], signal);
+	const modes = /* @__PURE__ */ new Map();
+	for (const record of output.split("\0")) {
+		if (record === "") continue;
+		const space = record.indexOf(" ");
+		const tab = record.indexOf("	");
+		if (space === -1 || tab < space) throw new InternalError(`git ls-tree -z: malformed entry "${record}"`);
+		modes.set(record.slice(tab + 1), record.slice(0, space));
+	}
+	return modes;
+}
+async function filesMatching(repo, commit, pattern, pathspecs, signal) {
+	const result = await runGit(repo, [
+		"grep",
+		"--no-color",
+		"-z",
+		"-l",
+		"-E",
+		"-e",
+		pattern,
+		commit,
+		"--",
+		...pathspecs
+	], signal);
+	if (result.exitCode === NO_MATCH_EXIT_CODE) return [];
+	if (result.exitCode !== 0) throw new ConfigError(`git grep failed in ${repo}: ${result.stderr.trim()}`);
+	const prefix = `${commit}:`;
+	return result.stdout.split("\0").filter((entry) => entry !== "").map((entry) => {
+		if (!entry.startsWith(prefix)) throw new InternalError(`git grep printed "${entry}", which does not start with ${prefix}`);
+		return entry.slice(prefix.length);
+	});
+}
+const NEWLINE = 10;
+const utf8 = new TextDecoder("utf-8");
+async function readFilesAt(repo, commit, paths, signal) {
+	const files = /* @__PURE__ */ new Map();
+	if (paths.length === 0) return files;
+	const multiline = paths.find((path) => path.includes("\n"));
+	if (multiline !== void 0) throw new ConfigError(`cannot read ${JSON.stringify(multiline)}: a path with a newline cannot be batched`);
+	const args = ["cat-file", "--batch"];
+	const result = await withGit(repo, args, () => runProcessBinary(GIT, [
+		"-C",
+		repo,
+		...args
+	], {
+		stdin: paths.map((path) => `${commit}:${path}\n`).join(""),
+		signal,
+		timeoutMs: GIT_TIMEOUT_MS
+	}));
+	if (result.exitCode !== 0) throw new ConfigError(`git cat-file --batch failed in ${repo}: ${result.stderr.trim()}`);
+	const output = result.stdout;
+	let offset = 0;
+	for (const path of paths) {
+		const headerEnd = output.indexOf(NEWLINE, offset);
+		if (headerEnd === -1) throw new InternalError(`git cat-file --batch stopped before ${path}`);
+		const header = utf8.decode(output.subarray(offset, headerEnd)).split(" ");
+		const size = Number(header[2]);
+		if (header[1] !== "blob" || !Number.isInteger(size)) throw new InternalError(`${path} is not a file at ${commit}, though git listed it there`);
+		const start = headerEnd + 1;
+		if (output[start + size] !== NEWLINE) throw new InternalError(`git cat-file --batch framed ${path} with ${size} bytes, but no newline follows them`);
+		files.set(path, utf8.decode(output.subarray(start, start + size)));
+		offset = start + size + 1;
+	}
+	if (offset !== output.length) throw new InternalError("git cat-file --batch printed more than the paths it was asked for");
+	return files;
+}
+//#endregion
 //#region src/commands/ci/job-plan.ts
 const CONTENT_PATHSPECS = CONTENT_TOP_LEVEL_FOLDERS.map((folder) => `${folder}/*.yaml`);
 const FILE_MODES = /* @__PURE__ */ new Set(["100644", "100755"]);
@@ -1512,7 +1296,7 @@ var run_default = defineMetabaseCommand({
 		description: "Check the transforms a branch changed, reporting each check as it finishes"
 	},
 	details: [
-		"Compares --head with its merge base with --base and finds the transforms whose files or tests changed. Two stages check them: `lint` fails each transform the branch adds or whose logic (source or target) it edits that has no transform test, fails each transform the branch leaves at head without the last of its transform tests, and warns about untested transforms whose logic the branch did not change. It then runs the representation linter of `@metabase/representations` over every file committed at --head: each error finding fails a check of its own, with the finding as `detail`, and the warnings share one passing `lint` check, whose `detail` holds `files` and `findings`. A linter that cannot run, such as one missing a database's default schema (declare it in `.metabase-lint.json`), errors that check. A transform whose source type is not `query`, such as a Python transform, cannot have transform tests, so `lint` does not fail it: an `untestable-transform` warning lists each such transform the branch adds, edits or strips of its tests. A change to the transform's query text, whitespace included, is an edit; a change to the YAML layout alone is not. A transform test is a TransformTest file at --head whose `transform_id` names the transform and whose `expectations` list is not empty; a test without expectations checks nothing, so it does not count. `unit` runs the instance's tests of the transforms in `job.start.checked`, on the Metabase instance that --url, MB_URL or --profile names, in that order, which must already hold the branch's content; it is absent when `checked` is empty, so a job with nothing to test never connects to Metabase, and it runs even when `lint` fails, so one job reports both stages' findings. A checked transform the branch tests but the instance lists no test for is `refused` with `detail.error_code` `ci.no-tests-on-instance`. Content files are the `.yaml` files Metabase's import reads: not dotfiles, under a top-level serialization folder such as `transforms/` or `collections/`. Only committed content is checked: when --head is the checked-out commit, a content file with uncommitted changes is listed in an `uncommitted-content` warning, and its committed version is checked.",
+		"Compares --head with its merge base with --base and finds the transforms whose files or tests changed. Two stages check them: `lint` fails each transform the branch adds or whose logic (source or target) it edits that has no transform test, fails each transform the branch leaves at head without the last of its transform tests, and warns about untested transforms whose logic the branch did not change. A transform whose source type is not `query`, such as a Python transform, cannot have transform tests, so `lint` does not fail it: an `untestable-transform` warning lists each such transform the branch adds, edits or strips of its tests. A change to the transform's query text, whitespace included, is an edit; a change to the YAML layout alone is not. A transform test is a TransformTest file at --head whose `transform_id` names the transform and whose `expectations` list is not empty; a test without expectations checks nothing, so it does not count. `unit` runs the instance's tests of the transforms in `job.start.checked`, on the Metabase instance that --url, MB_URL or --profile names, in that order, which must already hold the branch's content; it is absent when `checked` is empty, so a job with nothing to test never connects to Metabase, and it runs even when `lint` fails, so one job reports both stages' findings. A checked transform the branch tests but the instance lists no test for is `refused` with `detail.error_code` `ci.no-tests-on-instance`. Content files are the `.yaml` files Metabase's import reads: not dotfiles, under a top-level serialization folder such as `transforms/` or `collections/`. Only committed content is checked: when --head is the checked-out commit, a content file with uncommitted changes is listed in an `uncommitted-content` warning, and its committed version is checked.",
 		"With --format json, the default when stdout is not a terminal, writes one JSON event per line (`job.start`, then each stage and check, then `job.end`); `job.start.checked` lists the transforms the job covered, and a `no-content-changes` warning says when the change touches no content file, so no transform test ran; an `unread-content` warning lists the content files at --head that the change did not touch and this check cannot read, which coverage skips; each transform test's result is passed through as the check's `detail`, with every row the server sent. With --format text, the default on a terminal, writes the same events as lines for a person: each failed expectation with up to --max-rows lines of its missing and extra rows, keyed by the first column, then a count of the rest. The --results file is JSON whatever the format, and holds every row the server sent.",
 		"Exits 0 when the job passes. Exits 1 after `job.end` when it does not: `state` is `failed` when a check failed (fix the transform), and `errored` when no check failed but one could not judge the change (fix the test or the setup); a failure outranks errors, since it is a finding about the change. Exits 2 on a usage or config error: a bad flag, a --repo, --base or --head that git cannot resolve or relate, or, found after `job.start` when the unit stage connects, a configuration it cannot use, such as a browser-login profile bound to another URL; a missing credential is not one, since it ends the unit stage instead.",
 		"A test run that times out, loses its connection or gets an HTTP error is an `error` check whose `detail.error_code` starts with `ci.`, and the next test runs. A failure every later request would repeat ends the unit stage early, `errored` unless a check failed, with the reason in `stage.end.stopped`: no Metabase credential is configured (`ci.no-credential`, before any request), Metabase rejects the credential, the server has no transform testing, the entity-id lookup fails, or Metabase cannot be reached before a test runs. Exits 1 on a crash, such as a content file the change touched that does not parse at --head, and 130 on an interrupt: the stream stops before `job.end`, the error is on stderr, and no --results file is left, not even an earlier run's. When the reader closes stdout early, the job still runs to the end, writes --results and exits by its state."
@@ -1564,10 +1348,10 @@ var run_default = defineMetabaseCommand({
 			base: args.base,
 			head: args.head,
 			stages: async (plan) => {
-				const lint$1 = lintStage(plan.coverage, () => withCommittedTree(args.repo, plan.snapshot.head, interruptSignal, (folder) => lint({ folder })));
-				if (plan.checked.length === 0) return [lint$1];
+				const lint = coverageStage(plan.coverage);
+				if (plan.checked.length === 0) return [lint];
 				const connect = async () => clientPort(await getClient());
-				return [lint$1, unitStage(plan.checked, untestedTransforms(plan.coverage), connect)];
+				return [lint, unitStage(plan.checked, untestedTransforms(plan.coverage), connect)];
 			},
 			job: randomUUID(),
 			now: () => /* @__PURE__ */ new Date(),

package/dist/{scaffold-UalCpCG0.mjs → scaffold-Pr1BC2uw.mjs}

@@ -1,7 +1,7 @@
 import { f as renderSummary, pt as outputFlags } from "./cli.mjs";
 import { t as defineMetabaseCommand } from "./runtime-fJ-A3m-R.mjs";
 import { n as findSkillByName, r as loadAllSkills } from "./skills-Dt95bt39.mjs";
-import { r as scaffoldDataAppProject } from "./data-app-project-CiBHndNR.mjs";
+import { t as scaffoldDataAppProject } from "./data-app-project-tbEA14ZN.mjs";
 import { z } from "zod";
 import { join } from "node:path";
 //#region src/commands/data-app/scaffold.ts

package/dist/{typed-schema-MNW93duy.mjs → typed-schema-DTL_8ggU.mjs}

@@ -1,7 +1,7 @@
 import { ct as connectionFlags, g as writeText, mt as profileFlag } from "./cli.mjs";
 import { t as defineMetabaseCommand } from "./runtime-fJ-A3m-R.mjs";
 import { n as slugArg, t as parseSlug } from "./slug-COdwq63O.mjs";
-import { i as writeProjectFile } from "./data-app-project-CiBHndNR.mjs";
+import { n as writeProjectFile } from "./data-app-project-tbEA14ZN.mjs";
 import { z } from "zod";
 //#region src/commands/data-app/typed-schema.ts
 const TypedSchemaModule = z.string().describe("The generated TypeScript module of the app's queries and actions.");

package/dist/{update-C3AnMkS7.mjs → update-D32XqpkV.mjs}

@@ -10,7 +10,7 @@ var update_default = defineMetabaseCommand({
 		name: "update",
 		description: "Update a data app's fields, or enable or disable it"
 	},
-	details: "The JSON body carries only the fields to change: `display_name`, `description`, `allowed_hosts`, `enabled`, `bundle_path`, `version`. A disabled app opens only in Data Studio (Data apps → the app → Overview). `mb data-app set-bundle` replaces the bundle from a built file.",
+	details: "The JSON body carries only the fields to change: `display_name`, `description`, `allowed_hosts`, `enabled`, `bundle_path`, `version`. A disabled app opens only in Data Studio (Data apps → the app → Overview).",
 	requires: ["dataApp.update"],
 	args: {
 		...outputFlags,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metabase/cli",
-  "version": "0.5.8-alpha.bryan-rci-28-lint-stage.198256c",
+  "version": "0.5.9",
   "description": "Metabase CLI",
   "license": "AGPL-3.0",
   "repository": {
@@ -25,11 +25,10 @@
     "build": "tsdown",
     "dev": "tsdown --watch",
     "start": "node dist/cli.mjs",
-    "prepublishOnly": "tsdown && publint && ! grep -rE \"(from|import|require)[[:space:]]*\\(?['\\\"]@metabase/client\" dist/"
+    "prepublishOnly": "tsdown && publint && ! grep -rE \"(from|import|require)[[:space:]]*\\(?['\\\"]@metabase\" dist/"
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metabase/representations": "1.6.1-alpha.br-galdre-reference-lint.sha-f1106aa",
     "@napi-rs/keyring": "^1.3.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",

package/skill-data/data-app/SKILL.md

@@ -12,17 +12,20 @@ A **data app** is a React app built into one JavaScript bundle, which Metabase r
 The work, in order:
 
 1. Create the app on the instance.
-2. Scaffold the project and install the SDK.
+2. Scaffold the project in the synced git repository and install the SDK.
 3. Give it data: questions over the Library's published tables and metrics in the app's collection, then `src/metabase.ts` (`data-app-data`); writes are `data-app-actions`.
 4. Start the dev preview (_Dev preview_), then write the UI under `src/` (`data-app-ui`; filter controls in `data-app-filters`).
-5. Build and publish (_Build and publish_).
+5. Build, test, and push the source and the bundle together (_Build and publish_).
 
-For every later change: first pass the checks in _An existing project_ (_Scaffold and install_), then regenerate `src/metabase.ts` if the app's collection changed, then build and set the bundle; in a synced repository, then export and commit the source as in _Move to another instance_. Metabase receives only the built bundle; the source stays in the project directory, which is the app's folder in the synced git repository when there is one (_Scaffold and install_).
+For every later change: first pass the checks in _An existing project_ (_Scaffold and install_), then regenerate `src/metabase.ts` if the app's collection changed, then build and publish (_Build and publish_). The bundle reaches Metabase only through git: a git-sync import loads the `dist/index.js` committed in the app's folder.
 
 ## Before you start
 
 - Use an **admin** profile — only admins create apps and write the app's collection. `mb auth status --profile <name> --json | jq .user.isAdmin` prints `true` for one, and every command below takes that `--profile`; otherwise ask the user for an admin profile (`mb auth list`).
 - Run `mb data-app list`. A failure means the instance has no data apps: stop and tell the user.
+- The app ships through the instance's synced git repository. Check both ends first; if either fails, stop and tell the user which, changing nothing:
+  - `mb git-sync status --profile <name> --json` reports `remote_configured: true` and `sync_type: "read-write"`.
+  - The working folder is a clone of it: `git rev-parse --show-toplevel` succeeds, and `git remote -v` lists the repository `mb setting get remote-sync-url --profile <name>` names, in HTTPS or SSH form. That top level is `<repo>` below.
 - Settle the **slug**, the `/apps/<slug>` URL: lowercase letters, digits and single dashes (`sales-overview`), at most 100 characters. If the app's purpose is unclear, ask "what's this app for?" and propose one.
 
 ## Create the app
@@ -39,14 +42,14 @@ mb data-app create --body '{"name":"sales-overview","display_name":"Sales overvi
 mb data-app scaffold <repo>/data_apps/sales-overview && cd <repo>/data_apps/sales-overview
 ```
 
-`scaffold [dir]` takes a **directory**, not the slug: it copies the Vite + React + TypeScript template into a new or empty directory (the current one when omitted) and needs no server. When the instance syncs with a git repository (`mb git-sync status`), the directory is `data_apps/<slug>/` in a local clone of that repository (ask the user for its path, or clone the remote), where an export writes the app's `data_app.yaml` and bundle: an export leaves the source alone and an import ignores it, so the repository keeps the source with the app. `scaffold` needs an empty directory, so scaffold before the app's first export; for an app already in the repository, scaffold into a new directory and copy its files, dotfiles included (`cp -R <dir>/. data_apps/<slug>/`), in beside `data_app.yaml` and `dist/`; check `.gitignore` is there before `npm install`. Without a repository, use any new directory, and once remote sync is set up, move the project (without `node_modules/`, `build/`, `dist/`, `.env.local` and a hand-written `data_app.yaml`) into `data_apps/<slug>/` before committing its source. Then install the SDK, then the rest:
+`scaffold [dir]` takes a **directory**, not the slug: it copies the Vite + React + TypeScript template into a new or empty directory (the current one when omitted) and needs no server. The directory is `data_apps/<slug>/` in `<repo>`, where an export writes the app's `data_app.yaml` and bundle: an export leaves the source alone and an import ignores it, so the repository keeps the source with the app. `scaffold` needs an empty directory, so scaffold before the app's first export; for an app already in the repository, scaffold into a new directory and copy its files, dotfiles included (`cp -R <dir>/. data_apps/<slug>/`), in beside `data_app.yaml` and `dist/`; check `.gitignore` is there before `npm install`. Then install the SDK, then the rest:
 
 ```bash
 npm install @metabase/embedding-sdk-react@<major>-beta   # <major>: 66 for a version tag v1.66.x (`mb auth status --profile <name> --json | jq -r .version.tag`)
-npm install && npm run typecheck && npm run build
+npm install && npm run typecheck
 ```
 
-Skip the SDK line when `package.json` already points it at a local build (`file:` or `link:`), and never install `latest`. A tag without a version number, such as `vLOCAL_DEV`, is a development build: ask the user which SDK build to install. The starter renders "Hello, data app".
+Skip the SDK line when `package.json` already points it at a local build (`file:` or `link:`), and never install `latest`. A tag without a version number, such as `vLOCAL_DEV`, is a development build: ask the user which SDK build to install. The starter renders "Hello, data app". Build only in _Build and publish_, after the export: both write `dist/index.js`.
 
 The template is the bundle contract. Don't edit `package.json` by hand, and never rewrite `vite.config.ts`, `tsconfig.json` or `src/index.tsx`: `vite.config.ts` stays `export default dataAppConfig()` (its only option is `port`), and `src/index.tsx` default-exports the `DataAppFactory` — change it only to add a `providerProps` key. Metabase and the dev preview each wrap the app in a `<MetabaseProvider>`, so the app never renders one.
 
@@ -56,11 +59,11 @@ The template is the bundle contract. Don't edit `package.json` by hand, and neve
 - `src/index.tsx` default-exports a `DataAppFactory` that takes no arguments and returns `{ component, providerProps? }`.
 - `npm ls react react-dom` exits 0 and reports 19.x. A 19.x it marks `invalid` fails. This check applies whatever the instance or SDK version; to skip it, ask the user first.
 
-Fix a failed React check yourself, before any other change: upgrade `react`, `react-dom`, `@types/react` and `@types/react-dom` to 19 until `npm run typecheck && npm run build` passes and the diagnostics feed is clean (_Dev preview_); then publish (_Build and publish_). If either other check fails, stop: tell the user the project differs from the template, and ask whether to scaffold a fresh project and port the code over, or go on at their own risk.
+Fix a failed React check yourself, before any other change: upgrade `react`, `react-dom`, `@types/react` and `@types/react-dom` to 19 until `npm run typecheck` passes and the diagnostics feed is clean (_Dev preview_); then publish (_Build and publish_). If either other check fails, stop: tell the user the project differs from the template, and ask whether to scaffold a fresh project and port the code over, or go on at their own risk.
 
 ## Dev preview
 
-`npm run dev` serves the app at `http://localhost:5174` — or the next free port, in Vite's `Local:` line — through the same sandbox Metabase uses. An edit under `src/` rebuilds the bundle and remounts the app, resetting component state. The preview reads `DATA_APP_MB_URL` and an admin `DATA_APP_MB_API_KEY` from `.env.local` beside `package.json`. Write a new key straight into that file, never into the chat or the terminal:
+`npm run dev` serves the app at `http://localhost:5174` — or the next free port, in Vite's `Local:` line — through the same sandbox Metabase uses. An edit under `src/` rebuilds the bundle and remounts the app, resetting component state. The preview reads `DATA_APP_MB_URL` and an admin `DATA_APP_MB_API_KEY` from `.env.local` beside `package.json`. Create that key only on the user's yes: ask with `AskUserQuestion` ("Create an admin API key `data-app <slug> dev` for the preview? It goes in `.env.local` and is deleted at handoff."). On a no, the user fills in `.env.local` from `.env.local.example`. Write a new key straight into that file, never into the chat or the terminal:
 
 ```bash
 ( umask 077
@@ -102,7 +105,7 @@ curl -s "http://localhost:5174/__data-app/diagnostics?startEventId=0"
 - `clients: 0` means no tab is open, so empty `entries` prove nothing.
 - Before an edit, note `nextEventId`; after it, read again with that value as `startEventId`.
 - The feed answers for the running bundle: entries from replaced builds are counted in `staleEntries`, and anything still broken reports again under the new `buildId` (`?includeStale=true` shows the withheld ones). A failed build doesn't advance `buildId` and doesn't reach the feed — read the `npm run dev` terminal.
-- Quote `summary` as it is when you report it, and follow `hint` when there is one — except that you never add the Metabase URL to `allowed_hosts`, and in a synced repository you set `allowed_hosts` with `mb data-app update`, export, and pull the export branch (_Move to another instance_) instead of editing `data_app.yaml`. A `frame-src` or `form-action` block can't be lifted in the preview (`data-app-ui`). The feed keeps the last 200 entries; `curl -X DELETE …/__data-app/diagnostics` clears it.
+- Quote `summary` as it is when you report it, and follow `hint` when there is one — except that you never add the Metabase URL to `allowed_hosts`, and you set `allowed_hosts` with `mb data-app update`, then export and pull (_Build and publish_, step 1), instead of editing `data_app.yaml`. A `frame-src` or `form-action` block can't be lifted in the preview (`data-app-ui`). The feed keeps the last 200 entries; `curl -X DELETE …/__data-app/diagnostics` clears it.
 
 | `kind`                             | Fix                                                                                                                 |
 | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
@@ -113,12 +116,15 @@ curl -s "http://localhost:5174/__data-app/diagnostics?startEventId=0"
 
 ## Build and publish
 
-```bash
-npm run typecheck && npm run build
-mb data-app set-bundle sales-overview
-```
+Build the bundle last, test it in the dev preview, then push it with the source in one commit:
+
+1. Export the app's `data_app.yaml` and the questions and actions in its collection: `mb git-sync export` (`git-sync`), then in `<repo>` `git fetch`, `git switch <branch>`, `git pull --ff-only`.
+2. `npm run typecheck && npm run build`, which overwrites the exported `dist/index.js`.
+3. With `npm run dev` running and a preview tab open, read the diagnostics feed (_Dev preview_) with every page mounted; fix what it reports and build again.
+4. Commit `data_apps/<slug>/` — the source and `dist/index.js` together — and push.
+5. `mb git-sync import --profile <name>`, whatever a cached `has-remote-changes` says. The new bundle is live at once.
 
-`set-bundle` uploads `build/index.js`, the file `npm run build` writes (`--bundle` for another path), and replaces the app's bundle, live at once. A new app is on from the start; `mb data-app set-enabled <slug> false` turns it off, which only the user decides. An app turned off opens only in Data Studio → Data apps → the app → Overview; `/apps/<slug>` says "not found", for admins too. Give the user `<metabase-url>/apps/<slug>`.
+A new app is on from the start; `mb data-app set-enabled <slug> false` turns it off, which only the user decides. An app turned off opens only in Data Studio → Data apps → the app → Overview; `/apps/<slug>` says "not found", for admins too. Give the user `<metabase-url>/apps/<slug>`.
 
 A viewer needs one of their groups assigned to the app (otherwise "You don't have access"), which only the user can do (Data Studio → Data apps → the app → Permissions). A group reaches the app's collection and nothing more, so a viewer also needs data access to the tables its questions read.
 
@@ -126,7 +132,7 @@ A viewer needs one of their groups assigned to the app (otherwise "You don't hav
 
 | Symptom                                                             | Fix                                                                                                                    |
 | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| `set-bundle`: bundle not found                                      | Run `npm run build` in the project directory first.                                                                    |
+| The app still runs the old bundle                                   | `dist/index.js` was built before the export's pull, or isn't in the pushed commit: build, commit, push, import.        |
 | Blank app, `Bundle did not assign a function to __dataAppFactory__` | `src/index.tsx` must `export default` the factory and nothing else; otherwise the diagnostics feed has the real error. |
 | "Failed to fetch the user, the session might be invalid."           | A bad key in `.env.local`, or CORS (_Dev preview_).                                                                    |
 | A bundle of several MB                                              | `vite.config.ts` no longer uses `dataAppConfig()`, or the SDK isn't the `<major>-beta` tag.                            |
@@ -139,5 +145,5 @@ A viewer needs one of their groups assigned to the app (otherwise "You don't hav
 
 - **Turn off:** `mb data-app set-enabled <slug> false`. **Rename:** `mb data-app update <slug> --body '{"display_name":"…"}'` (also `description`, `allowed_hosts`).
 - **Outdated:** an app Data Studio lists as _Outdated_ targets an older data-app contract: it won't open for anyone, and only admins see it, until it's migrated. Tell the user; don't change its code ad hoc.
-- **Move to another instance:** the app, its collection and what the collection holds are git-synced content. `mb git-sync export` (`git-sync`) writes `data_apps/<slug>/` with the bundle, and the collection under `collections/data_apps/`; importing the repository on the other instance recreates them with the same entity IDs, so the same `src/metabase.ts` works there. The first import there creates the app on, like `create`, open to admins until the user assigns groups; later imports keep its on/off state. The import doesn't check that the questions' tables are published on that instance, so the Library content they read goes in the same export: flag the Library root once (`mb git-sync add-collection <library-id>`, `git-sync`), or its metrics, measures and segments stay out of the repository; a data action needs its database's toggle on there too. Once the app is done, commit its source in `data_apps/<slug>/` on the branch you exported to, after the export. Pull the export branch: `git fetch`, `git switch <branch>`, `git pull --ff-only`. Then `git add data_apps/<slug>`, commit and push, and `mb git-sync import` whatever a cached `has-remote-changes` says, or the next export ends in `conflict`. The export writes `data_app.yaml` and `dist/index.js`, the bundle you uploaded; never edit those two, and leave them out of your commits unless the bundle ships through git (below). The template's `.gitignore` keeps `node_modules/`, `build/` and `.env.local` out. A bundle can instead ship through git, from CI say: `npm run build:ci` writes `dist/index.js`, and once that is committed and pushed, the next import loads it. On a read-only synced instance only `set-enabled` works: creating, bundling, updating and deleting an app answer 403, and so does editing its collection; change it where it was built and export again.
-- **Delete:** confirm with the user, then `mb data-app delete <slug> --yes` — it removes the app, its bundle, its collection and the questions and actions in it. The project directory stays: in a synced repository, the next export removes the app's `data_app.yaml`, bundle and collection files; after that export, switch and pull the same way, delete the source in `data_apps/<slug>/` in a commit of your own, push, and import.
+- **Move to another instance:** the app, its collection and what the collection holds are git-synced content. `mb git-sync export` (`git-sync`) writes `data_apps/<slug>/` with the bundle, and the collection under `collections/data_apps/`; importing the repository on the other instance recreates them with the same entity IDs, so the same `src/metabase.ts` works there. The first import there creates the app on, like `create`, open to admins until the user assigns groups; later imports keep its on/off state. The import doesn't check that the questions' tables are published on that instance, so the Library content they read goes in the same export: flag the Library root once (`mb git-sync add-collection <library-id>`, `git-sync`), or its metrics, measures and segments stay out of the repository; a data action needs its database's toggle on there too. Never edit `data_app.yaml`; `dist/index.js` changes only through `npm run build` (_Build and publish_). The template's `.gitignore` keeps `node_modules/` and `.env.local` out. On a read-only synced instance only `set-enabled` works: creating, updating and deleting an app answer 403, and so does editing its collection; change it where it was built, push, and import there.
+- **Delete:** confirm with the user, then `mb data-app delete <slug> --yes` — it removes the app, its bundle, its collection and the questions and actions in it. The project directory stays: the next export removes the app's `data_app.yaml`, bundle and collection files; after that export, switch and pull the same way, delete the source in `data_apps/<slug>/` in a commit of your own, push, and import.

package/skill-data/data-app/template/README.md

@@ -20,14 +20,13 @@ npm install
 ```bash
 npm run dev         # preview at http://localhost:5174, in the sandbox Metabase runs apps in
 npm run typecheck   # type-checks src/ and vite.config.ts
-npm run build       # builds build/index.js
+npm run build       # builds dist/index.js, the app's bundle
 mb data-app typed-schema <slug> --out src/metabase.ts   # the app's queries and actions
-mb data-app set-bundle <slug>                     # makes build/index.js the app's bundle
 ```
 
-To ship the bundle through git instead, for example from CI, run
-`npm run build:ci` and commit `dist/index.js`, the file the app's
-`data_app.yaml` names; the next git-sync import loads it.
+The bundle ships through git: commit `dist/index.js` (the file
+`data_app.yaml` names) with the source and push; the next git-sync import
+loads it.
 
 `npm run dev` reads `DATA_APP_MB_URL` and `DATA_APP_MB_API_KEY` from
 `.env.local`; `.env.local.example` lists them.

package/skill-data/data-app/template/gitignore

@@ -1,5 +1,4 @@
 node_modules
-build
 .env.local
 .vite
 .idea

package/skill-data/data-app/template/package.json

@@ -5,8 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
-    "build:ci": "vite build --outDir dist",
+    "build": "vite build --outDir dist",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/skill-data/data-app-ui/SKILL.md

@@ -38,7 +38,7 @@ Everything here runs inside the sandbox, the same in the dev preview as in Metab
 | `navigator.geolocation` and other device APIs                                                              | Nothing.                                                                                  |
 | Key, input, composition and clipboard listeners (`keydown`, `paste`, `input`, …) on `window` or `document` | A React handler (`onKeyDown`, `onPaste`, …) on your own element.                          |
 
-**External APIs.** A raw `fetch` reaches only the origins in the app's `allowed_hosts`, exact or with a `*.` subdomain wildcard: `mb data-app update <slug> --body '{"allowed_hosts":["https://api.example.com"]}'`. The preview reads the `allowed_hosts:` list in `data_app.yaml` beside `package.json`: in a synced repository that file is the app's exported manifest, so export again and pull the export branch (`data-app`, _Move to another instance_) to refresh it rather than writing it; without one, write the list there yourself. Then restart `npm run dev`. Never list the Metabase URL. In Metabase the same list governs `<iframe src>` and native `<form action>` submits, and the target must allow framing; the preview blocks both. Use `<form onSubmit>` with `preventDefault`: a native submit navigates the app away.
+**External APIs.** A raw `fetch` reaches only the origins in the app's `allowed_hosts`, exact or with a `*.` subdomain wildcard: `mb data-app update <slug> --body '{"allowed_hosts":["https://api.example.com"]}'`. The preview reads the `allowed_hosts:` list in `data_app.yaml` beside `package.json`, the app's exported manifest: refresh it by exporting and pulling the export branch (`data-app`, _Build and publish_, step 1), never by writing it. Then restart `npm run dev`. Never list the Metabase URL. In Metabase the same list governs `<iframe src>` and native `<form action>` submits, and the target must allow framing; the preview blocks both. Use `<form onSubmit>` with `preventDefault`: a native submit navigates the app away.
 
 ## Layout
 

package/skill-data/transform/SKILL.md

@@ -271,6 +271,6 @@ mb transform-job set-active false --profile <name> --json  # disable every job a
 
 <!-- /requires -->
 
-Every job row carries `active`; it is `null` on a server that cannot switch jobs off, where every job runs on schedule.
+Every job row carries `active`; it is `null` on a server that cannot switch jobs off, where every job runs on schedule. A job with `active: false` never runs on schedule, and a fresh install of a newer server starts the built-in jobs that no transform uses that way: before relying on one, check `active`, and turn it on only with the user's yes (`transform-job update <id> --body '{"active":true}'`, admin only).
 
 `transform-job run` is fire-and-forget — it returns `{message, started, run_id}` immediately (both `null` when the server does not number job runs: the request was accepted and whether a run started is unsaid), with no per-job-run polling (no `--wait`). Most ad-hoc agent work is one-off `transform run`, not job authoring.

package/dist/set-bundle-CJed1vO8.mjs

@@ -1,40 +0,0 @@
-import { ct as connectionFlags, f as renderSummary, mt as profileFlag, pt as outputFlags } from "./cli.mjs";
-import { t as defineMetabaseCommand } from "./runtime-fJ-A3m-R.mjs";
-import { t as DataApp } from "./data-app-BUW-HlUo.mjs";
-import { t as dataAppView } from "./data-app-Blz61mG5.mjs";
-import { n as slugArg, t as parseSlug } from "./slug-COdwq63O.mjs";
-import { n as readBundle, t as DEFAULT_BUNDLE_PATH } from "./data-app-project-CiBHndNR.mjs";
-//#region src/commands/data-app/set-bundle.ts
-var set_bundle_default = defineMetabaseCommand({
-	meta: {
-		name: "set-bundle",
-		description: "Replace a data app's bundle with a built one"
-	},
-	details: "Reads the built bundle (`npm run build` writes `build/index.js`) and makes it the bundle Metabase serves at /apps/<slug>, at once. A new app is enabled; viewers reach it once a group is assigned. A disabled app opens only in Data Studio (Data apps → the app → Overview).",
-	skills: [{
-		skill: "data-app",
-		purpose: "build and publish an app"
-	}],
-	requires: ["dataApp.replaceBundle"],
-	args: {
-		...outputFlags,
-		...profileFlag,
-		...connectionFlags,
-		...slugArg,
-		bundle: {
-			type: "string",
-			description: "Built bundle file",
-			default: DEFAULT_BUNDLE_PATH
-		}
-	},
-	outputSchema: DataApp,
-	examples: ["mb data-app set-bundle sales-overview", "mb data-app set-bundle sales-overview --bundle out/index.js"],
-	async run({ args, ctx, getClient }) {
-		const slug = parseSlug(args.slug);
-		const bundle = await readBundle(args.bundle);
-		const app = await (await getClient()).dataApp.replaceBundle(slug, bundle);
-		renderSummary(app, dataAppView, `Set the bundle of data app ${slug}; it is ${app.enabled ? `served at /apps/${slug}` : "disabled, so it opens only in Data Studio"}.`, ctx);
-	}
-});
-//#endregion
-export { set_bundle_default as default };