Break out getCollection from entity framework and remove objectSelectors

* add remap for `embedding-iframe` -> "Embedding Unknown"

* add is_top_level filter to other charts

.claude/commands/ci-report.md

@@ -0,0 +1,12 @@
+Generate a CI failure report for PR $PR_NUM_OR_URL (or current branch if no argument given).
+
+Run `./bin/mage ci-report $PR_NUM_OR_URL` to generate the report, then:
+
+1. **Summarize the failures** - What tests failed and in which jobs?
+2. **Categorize** - Are these real failures, flaky tests, or infrastructure issues?
+3. **Recommend next steps**:
+   - If flaky: suggest rerunning with `gh run rerun <run-id> --failed -R metabase/metabase`
+   - If real: identify the root cause and suggest fixes
+   - If infrastructure: note the issue type (timeout, OOM, network)
+
+Focus on actionable insights. If all checks are passing, confirm that briefly.

.claude/commands/mutation-testing.md

@@ -0,0 +1 @@
+Run mutation testing for $ARGUMENTS

.claude/skills/_shared/clojure-commands.md

@@ -0,0 +1,79 @@
+## Linting and Formatting
+
+- **Lint PR:** `./bin/mage kondo-updated master` (or whatever target branch)
+  - Call the command one time at the beginning, record the results, then work through the problems one at a time.
+  - If the solution is obvious, then please apply the fix. Otherwise skip it.
+  - If you fix all the issues (and verify by rerunning the kondo-updated command):
+    - commit the change with a succinct and descriptive commit message
+- **Lint File:** `./bin/mage kondo <file or files>`
+  - Use the linter as a way to know that you are adhering to conventions in place in the codebase
+- **Lint Changes:** `./bin/mage kondo-updated HEAD`
+- **Format:** `./bin/mage cljfmt-files [path]`
+
+## Testing
+
+Use `./bin/test-agent` to run backend tests. See the top-level CLAUDE.md for usage.
+
+## Code Readability
+
+- **Check Code Readability:** `./bin/mage -check-readable <file> [line-number]`
+  - Run after every change to Clojure code
+  - Check specific line first, then entire file if readable
+
+## REPL Usage
+
+> **Note:** If you have `clojure-mcp` tools available (check for tools like `clojure_eval`),
+> **always prefer those over `./bin/mage -repl`**. The MCP tools provide better integration,
+> richer feedback, and avoid shell escaping issues. Only use `./bin/mage -repl` as a fallback
+> when clojure-mcp is not available.
+
+- **Evaluating Clojure Code:** `./bin/mage -repl '<code>'`
+  - See "Sending Code to the REPL" section for more details
+
+### Sending Code to the REPL
+
+- Send code to the metabase process REPL using: `./bin/mage -repl '(+ 1 1)'` where `(+ 1 1)` is your Clojure code.
+  - See `./bin/mage -repl -h` for more details.
+  - If the Metabase backend is not running, you'll see an error message with instructions on how to start it.
+
+#### Working with Files and Namespaces
+
+1. **Load a file and call functions with fully qualified names**:
+
+To call `your.namespace/your-function` on `arg1` and `arg2`:
+
+```
+./bin/mage -repl --namespace your.namespace '(your-function arg1 arg2)'
+```
+
+DO NOT use "require", "load-file" etc in the code string argument.
+
+#### Understanding the Response
+
+The `./bin/mage -repl` command returns three separate, independent outputs:
+
+- `value`: The return value of the last expression (best for data structures)
+- `stdout`: Any printed output from `println` etc. (best for messages)
+- `stderr`: Any error messages (best for warnings and errors)
+
+Example call:
+
+```bash
+./bin/mage -repl '(println "Hello, world!") '\''({0 1, 1 3, 2 0, 3 2} {0 2, 1 0, 2 3, 3 1})'
+```
+
+Example response:
+
+```
+ns: user
+session: 32a35206-871c-4553-9bc9-f49491173d1c
+value:  ({0 1, 1 3, 2 0, 3 2} {0 2, 1 0, 2 3, 3 1})
+stdout:  Hello, world!
+stderr:
+```
+
+For effective REPL usage:
+
+- Return data structures as function return values
+- Use `println` for human-readable messages
+- Print errors to stderr

.claude/skills/_shared/clojure-style-guide.md

@@ -0,0 +1,153 @@
+# Metabase Clojure Style Guide
+
+This guide covers Clojure and ClojureScript coding conventions for Metabase. See also: `CLOJURE_STYLE_GUIDE.adoc` for the Community Clojure Style Guide.
+
+## Naming Conventions
+
+**General Naming:**
+
+- Acceptable abbreviations: `acc`, `i`, `pred`, `coll`, `n`, `s`, `k`, `f`
+- Use `kebab-case` for all variables, functions, and constants
+
+**Function Naming:**
+
+- Pure functions should be nouns describing the value they return (e.g., `age` not `calculate-age` or `get-age`)
+- Functions with side effects must end with `!`
+- Don't repeat namespace alias in function names
+
+**Destructuring:**
+
+- Map destructuring should use kebab-case local bindings even if the map uses `snake_case` keys
+
+## Documentation Standards
+
+**Docstrings:**
+
+- Every public var in `src` or `enterprise/backend/src` must have docstring
+- Format using Markdown conventions
+- Reference other vars with `[[other-var]]` not backticks
+
+**Comments:**
+
+- `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
+
+## Code Organization
+
+**Visibility:**
+
+- Make everything `^:private` unless it is used elsewhere
+- Try to organize namespaces to avoid `declare` (put public functions near the end)
+
+**Size and Structure:**
+
+- Break up functions > 20 lines
+- Lines ≤ 120 characters
+- No blank non-comment lines within definition forms (except pairwise `let`/`cond`)
+
+## Style Conventions
+
+**Keywords and Metadata:**
+
+- Prefer namespaced keywords for internal use: `:query-type/normal` not `:normal`
+- Tag variables with `:arglists` metadata if they're functions but wouldn't otherwise have it
+
+## Tests
+
+**Organization:**
+
+- Break large tests into separate `deftest` forms for logically separate test cases
+- Test names should end in `-test` or `-test-<number>`
+
+**Performance:**
+
+- Mark pure function tests `^:parallel`
+
+## Modules
+
+**OSS Modules:**
+
+- Follow `metabase.<module>.*` pattern
+- Source in `src/metabase/<module>/`
+
+**Enterprise Modules:**
+
+- Follow `metabase-enterprise.<module>.*` pattern
+- Source in `enterprise/backend/src/metabase_enterprise/<module>/`
+
+**Module Structure:**
+
+- REST API endpoints go in `<module>.api` or `<module>.api.*` namespaces
+- Put module public API in `<module>.core` using Potemkin imports
+- Put Toucan models in `<module>.models.*`
+- Put settings in `<module>.settings`
+- Put schemas in `<module>.schema`
+
+**Module Linters:**
+
+- Do not cheat module linters with `:clj-kondo/ignore [:metabase/modules]`
+
+## REST API Endpoints
+
+**Required Elements:**
+
+- All new endpoints must have response schemas (`:- <schema>` after route string)
+- All endpoints need Malli schemas for parameters (detailed and complete)
+- All new REST API endpoints MUST HAVE TESTS
+
+**Naming Conventions:**
+
+- Query parameters use kebab-case
+- Request bodies use `snake_case`
+- Routes use singular nouns (e.g., `/api/dashboard/:id`)
+
+**Behavior:**
+
+- `GET` endpoints should not have side effects (except analytics)
+- `defendpoint` forms should be small wrappers around Toucan model code
+
+## MBQL (Metabase Query Language)
+
+**Restrictions:**
+
+- No raw MBQL introspection outside of `lib`, `lib-be`, or `query-processor` modules
+- Use Lib and MBQL 5 in new source code; avoid legacy MBQL
+
+## Database and Models
+
+**Naming:**
+
+- Model names and table names should be singular nouns
+- Application database uses `snake_case` identifiers
+
+**Best Practices:**
+
+- Use `t2/select-one-fn` instead of fetching entire rows for one column
+- Put correct behavior in Toucan methods, not separate helper functions
+
+## Drivers
+
+**Documentation:**
+
+- New driver multimethods must be mentioned in `docs/developers-guide/driver-changelog.md`
+
+**Implementation:**
+
+- Driver implementations should pass `driver` argument to other driver multimethods
+- Don't hardcode driver names in implementations
+- Minimize logic inside `read-column-thunk` in JDBC-based drivers
+
+## Miscellaneous
+
+**Examples:**
+
+- Example data should be bird-themed if possible
+
+**Linter Suppressions:**
+
+- Use proper format for kondo suppressions
+- No `#_:clj-kondo/ignore` (keyword form)
+
+**Configurable Options:**
+
+- Don't define configurable options that can only be set with environment variables
+- Use `:internal` `defsetting` instead

.claude/skills/_shared/development-workflow.md

@@ -0,0 +1,8 @@
+# Autonomous Development Workflow
+
+- Do not attempt to read or edit files outside the project folder
+- Add failing tests first, then fix them
+- Work autonomously in small, testable increments
+- Run targeted tests, and lint continuously during development
+- Prioritize understanding existing patterns before implementing
+- Don't commit changes, leave it for the user to review and make commits

.claude/skills/_shared/metabase-style-guide.md

@@ -0,0 +1,84 @@
+# Metabase Writing Style Guide
+
+## Core Principles
+
+Write like you're talking to a colleague. Be conversational, not formal. Get people what they need quickly. Know your audience and match the complexity.
+
+## Tone and Voice
+
+**Do:**
+
+- Use contractions ("can't" not "cannot")
+- Say "people" or "companies" instead of "users"
+- Be friendly but not peppy
+- Acknowledge limitations honestly ("that's on us, not them")
+- Jokes and Easter eggs are okay (permit them, don't suggest them)
+
+**Don't:**
+
+- Use exclamation points excessively
+- Rely on tired tropes about nerdiness
+- Use corporate jargon ("utilize", "offerings", "actionable insights")
+- Tell people something is cool (show them instead)
+
+## Structure and Clarity
+
+**Lead with the important stuff:**
+
+- Most important information first
+- Lead with the ask, then provide context
+- Cut text that adds little value (when in doubt, cut it)
+- Each paragraph should have one clear purpose
+
+**Make headings do the work:**
+
+- Convey your actual point, not just the topic
+- "Use headings to highlight key points" not "How to write a good heading"
+- Use sentence case, no punctuation except question marks
+- No links in headings unless entire heading is a link
+
+## Instructions and Examples
+
+**Tell people what to do:**
+
+- Give the action before explaining why
+- Put commands in execution order
+- Provide context, steps, and reasoning
+- Don't describe tasks as "easy" or "simple"
+
+**Answer unasked questions:**
+
+- Include answers to "dumb" questions you had when learning
+- Don't literally include the question, just give the answer
+
+## Formatting
+
+**Code vs. UI elements:**
+
+- Backticks for code, variable names, parameters only
+- **Bold** for UI elements and labels (e.g., "Click the **Save** button")
+- Don't use backticks or quotes for UI elements
+
+## Writing Mechanics
+
+- Limit pronouns when introducing new terms (repeat the term to reinforce it)
+- Ampersands only in proper nouns, never as substitute for "and"
+
+## Terminology Preferences
+
+Use familiar terms from tools people already know:
+
+- "Summarize" (like Excel) instead of "aggregate"
+- "Take a look at" instead of "reference"
+- "Filter" instead of technical database terms when appropriate
+
+## Red Flags
+
+Avoid these patterns:
+
+- Multiple exclamation points
+- Linking "here"
+- Bullet lists to explain (use prose)
+- Numbers that will change (guard against change)
+- Describing things as "easy" or "simple"
+- Stock photography-worthy content

.claude/skills/_shared/typescript-commands.md

@@ -0,0 +1,21 @@
+## Linting and Formatting
+
+- **Lint:** `bun run lint-eslint-pure`
+  - Run ESLint on the codebase
+- **Format:** `bun run prettier`
+  - Format code using Prettier
+- **Type Check:** `bun run type-check-pure`
+  - Run TypeScript type checking
+
+## Testing
+
+### JavaScript/TypeScript Tests
+
+- **Test a specific file:** `bun run test-unit-keep-cljs path/to/file.unit.spec.js`
+- **Test by pattern:** `bun run test-unit-keep-cljs -t "pattern"`
+  - Runs tests matching the given pattern
+
+### ClojureScript Tests
+
+- **Test ClojureScript:** `bun run test-cljs`
+  - Run ClojureScript tests

.claude/skills/add-malli-schemas/SKILL.md

@@ -0,0 +1,420 @@
+---
+name: add-malli-schemas
+description: Efficiently add Malli schemas to API endpoints in the Metabase codebase with proper patterns, validation timing, and error handling
+---
+
+# Add Malli Schemas to API Endpoints
+
+This skill helps you efficiently and uniformly add Malli schemas to API endpoints in the Metabase codebase.
+
+## Reference Files (Best Examples)
+
+- `src/metabase/warehouses/api.clj` - Most comprehensive schemas, custom error messages
+- `src/metabase/api_keys/api.clj` - Excellent response schemas
+- `src/metabase/collections/api.clj` - Great named schema patterns
+- `src/metabase/timeline/api/timeline.clj` - Clean, simple examples
+
+## Quick Checklist
+
+When adding Malli schemas to an endpoint:
+
+- [ ] Route params have schemas
+- [ ] Query params have schemas with `:optional true` and `:default` where appropriate
+- [ ] Request body has a schema (for POST/PUT)
+- [ ] Response schema is defined (using `:-` after route string)
+- [ ] Use existing schema types from `ms` namespace when possible
+- [ ] Consider creating named schemas for reusable or complex types
+- [ ] Add contextual error messages for validation failures
+
+## Basic Structure
+
+### Complete Endpoint Example
+
+```clojure
+(mr/def ::Color [:enum "red" "blue" "green"])
+
+(mr/def ::ResponseSchema
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:color ::Color]
+   [:created_at ms/TemporalString]])
+
+(api.macros/defendpoint :post "/:name" :- ::ResponseSchema
+  "Create a resource with a given name."
+  [;; Route Params:
+   {:keys [name]} :- [:map [:name ms/NonBlankString]]
+   ;; Query Params:
+   {:keys [include archived]} :- [:map
+                                   [:include  {:optional true} [:maybe [:= "details"]]]
+                                   [:archived {:default false} [:maybe ms/BooleanValue]]]
+   ;; Body Params:
+   {:keys [color]} :- [:map [:color ::Color]]
+   ]
+  ;; endpoint implementation, ex:
+  {:id 99
+   :name (str "mr or mrs " name)
+   :color ({"red" "blue" "blue" "green" "green" "red"} color)
+   :created_at (t/format (t/formatter "yyyy-MM-dd'T'HH:mm:ssXXX") (t/zoned-date-time))}
+  )
+```
+
+## Common Schema Patterns
+
+1. Route Params (the 5 in `api/user/id/5`)
+2. Query Params (the sort+asc pair in `api/users?sort=asc`)
+3. Body Params (the contents of a request body. Almost always decoded from json into edn)
+4. The Raw Request map
+
+Of the 4 arguments, deprioritize usage of the raw request unless necessary.
+
+### Route Params
+
+Always required, typically just a map with an ID:
+
+```clojure
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+```
+
+For multiple route params:
+
+```clojure
+[{:keys [id field-id]} :- [:map
+                           [:id ms/PositiveInt]
+                           [:field-id ms/PositiveInt]]]
+```
+
+### Query Params
+
+Add properties for `{:optional true ...}` and `:default` values:
+
+```clojure
+{:keys [archived include limit offset]} :- [:map
+                                            [:archived {:default false} [:maybe ms/BooleanValue]]
+                                            [:include  {:optional true}   [:maybe [:= "tables"]]]
+                                            [:limit    {:optional true} [:maybe ms/PositiveInt]]
+                                            [:offset   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Request Body (POST/PUT)
+
+```clojure
+{:keys [name description parent_id]} :- [:map
+                                         [:name        ms/NonBlankString]
+                                         [:description {:optional true} [:maybe ms/NonBlankString]]
+                                         [:parent_id   {:optional true} [:maybe ms/PositiveInt]]]
+```
+
+### Response Schemas
+
+#### Simple inline response:
+
+```clojure
+(api.macros/defendpoint :get "/:id" :- [:map
+                                        [:id pos-int?]
+                                        [:name string?]]
+  "Get a thing"
+  ...)
+```
+
+#### Named schema for reuse:
+
+```clojure
+(mr/def ::Thing
+  [:map
+   [:id pos-int?]
+   [:name string?]
+   [:description [:maybe string?]]])
+
+(api.macros/defendpoint :get "/:id" :- ::Thing
+  "Get a thing"
+  ...)
+
+(api.macros/defendpoint :get "/" :- [:sequential ::Thing]
+  "Get all things"
+  ...)
+```
+
+## Common Schema Types
+
+### From `metabase.util.malli.schema` (aliased as `ms`)
+
+Prefer the schemas in the ms/* namespace, since they work better with our api infrastructure. 
+
+For example use `ms/PositiveInt` instead of `pos-int?`.
+
+```clojure
+ms/PositiveInt                  ;; Positive integer
+ms/NonBlankString               ;; Non-empty string
+ms/BooleanValue                 ;; String "true"/"false" or boolean
+ms/MaybeBooleanValue            ;; BooleanValue or nil
+ms/TemporalString               ;; ISO-8601 date/time string (for REQUEST params only!)
+ms/Map                          ;; Any map
+ms/JSONString                   ;; JSON-encoded string
+ms/PositiveNum                  ;; Positive number
+ms/IntGreaterThanOrEqualToZero  ;; 0 or positive
+```
+
+**IMPORTANT:** For response schemas, use `:any` for temporal fields, not `ms/TemporalString`!
+Response schemas validate BEFORE JSON serialization, so they see Java Time objects.
+
+### Built-in Malli Types
+
+```clojure
+:string                     ;; Any string
+:boolean                    ;; true/false
+:int                        ;; Any integer
+:keyword                    ;; Clojure keyword
+pos-int?                    ;; Positive integer predicate
+[:maybe X]                  ;; X or nil
+[:enum "a" "b" "c"]         ;; One of these values
+[:or X Y]                   ;; Schema that satisfies X or Y
+[:and X Y]                  ;; Schema that satisfies X and Y
+[:sequential X]             ;; Sequential of Xs
+[:set X]                    ;; Set of Xs
+[:map-of K V]               ;; Map with keys w/ schema K and values w/ schema V
+[:tuple X Y Z]              ;; Fixed-length tuple of schemas X Y Z
+```
+
+Avoid using sequence schemas unless completely necessary.
+
+## Step-by-Step: Adding Schemas to an Endpoint
+
+### Example: Adding return schema to `GET /api/field/:id/related`
+
+**Before:**
+```clojure
+(api.macros/defendpoint :get "/:id/related"
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+**Step 1:** Check what the function returns (look at `xrays/related`)
+
+**Step 2:** Define response schema based on return type:
+
+```clojure
+(mr/def ::RelatedEntity
+  [:map
+   [:tables [:sequential [:map [:id pos-int?] [:name string?]]]]
+   [:fields [:sequential [:map [:id pos-int?] [:name string?]]]]])
+```
+
+**Step 3:** Add response schema to endpoint:
+
+```clojure
+(api.macros/defendpoint :get "/:id/related" :- ::RelatedEntity
+  "Return related entities."
+  [{:keys [id]} :- [:map [:id ms/PositiveInt]]]
+  (-> (t2/select-one :model/Field :id id) api/read-check xrays/related))
+```
+
+## Advanced Patterns
+
+### Custom Error Messages
+
+```clojure
+(def DBEngineString
+  "Schema for a valid database engine name."
+  (mu/with-api-error-message
+   [:and
+    ms/NonBlankString
+    [:fn
+     {:error/message "Valid database engine"}
+     #(u/ignore-exceptions (driver/the-driver %))]]
+   (deferred-tru "value must be a valid database engine.")))
+```
+
+### Enum with Documentation
+
+```clojure
+(def PinnedState
+  (into [:enum {:error/message "pinned state must be 'all', 'is_pinned', or 'is_not_pinned'"}]
+        #{"all" "is_pinned" "is_not_pinned"}))
+```
+
+### Complex Nested Response
+
+```clojure
+(mr/def ::DashboardQuestionCandidate
+  [:map
+   [:id ms/PositiveInt]
+   [:name ms/NonBlankString]
+   [:description [:maybe string?]]
+   [:sole_dashboard_info
+    [:map
+     [:id ms/PositiveInt]
+     [:name ms/NonBlankString]
+     [:description [:maybe string?]]]]])
+
+(mr/def ::DashboardQuestionCandidatesResponse
+  [:map
+   [:data [:sequential ::DashboardQuestionCandidate]]
+   [:total ms/PositiveInt]])
+```
+
+### Paginated Response Pattern
+
+```clojure
+(mr/def ::PaginatedResponse
+  [:map
+   [:data [:sequential ::Item]]
+   [:total integer?]
+   [:limit {:optional true} [:maybe integer?]]
+   [:offset {:optional true} [:maybe integer?]]])
+```
+
+## Common Pitfalls
+
+### Don't: Forget `:maybe` for nullable fields
+
+```clojure
+[:description ms/NonBlankString]  ;; WRONG - fails if nil
+[:description [:maybe ms/NonBlankString]]  ;; RIGHT - allows nil
+```
+
+### Don't: Forget `:optional true` for optional query params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+### Don't: Forget `:default` values for known params
+
+```clojure
+[:limit ms/PositiveInt]  ;; WRONG - required but shouldn't be
+[:limit {:optional true :default 0} [:maybe ms/PositiveInt]]  ;; RIGHT
+```
+
+
+### Don't: Mix up route params, query params, and body
+
+```clojure
+;; WRONG - all in one map
+[{:keys [id name archived]} :- [:map ...]]
+
+;; RIGHT - separate destructuring
+[{:keys [id]} :- [:map [:id ms/PositiveInt]]
+ {:keys [archived]} :- [:map [:archived {:default false} ms/BooleanValue]]
+ {:keys [name]} :- [:map [:name ms/NonBlankString]]]
+```
+
+### Don't: Use `ms/TemporalString` for Java Time objects in response schemas
+
+```clojure
+;; WRONG - Java Time objects aren't strings yet
+[:date_joined ms/TemporalString]
+
+;; RIGHT - schemas validate BEFORE JSON serialization
+[:date_joined :any]  ;; Java Time object, serialized to string by middleware
+[:last_login [:maybe :any]]  ;; Java Time object or nil
+```
+
+**Why:** Response schemas validate the internal Clojure data structures BEFORE they are serialized to JSON. Java Time objects like `OffsetDateTime` get converted to ISO-8601 strings by the JSON middleware, so the schema needs to accept the raw Java objects.
+
+### Don't: Use `[:sequential X]` when the data is actually a set
+
+```clojure
+;; WRONG - group_ids is actually a set
+[:group_ids {:optional true} [:sequential pos-int?]]
+
+;; RIGHT - matches the actual data structure
+[:group_ids {:optional true} [:maybe [:set pos-int?]]]
+```
+
+**Why:** Toucan hydration methods often return sets. The JSON middleware will serialize sets to arrays, but the schema validates before serialization.
+
+### Don't: Create anonymous schemas for reused structures
+
+Use `mr/def` for schemas used in multiple places:
+
+```clojure
+(mr/def ::User
+  [:map
+   [:id pos-int?]
+   [:email string?]
+   [:name string?]])
+```
+
+## Finding Return Types
+
+1. **Look at the function being called**
+
+```clojure
+(api.macros/defendpoint :get "/:id"
+  [{:keys [id]}]
+  (t2/select-one :model/Field :id id))  ;; Returns a Field instance
+```
+
+2. **Check Toucan models for structure**
+
+Look in `src/metabase/*/models/*.clj` for model definitions.
+
+3. **Use clojure-mcp or REPL to inspect**
+
+```bash
+./bin/mage -repl '(require '\''metabase.xrays.core) (doc metabase.xrays.core/related)'
+```
+
+4. **Check tests**
+
+Tests often show the expected response structure.
+
+## Understanding Schema Validation Timing
+
+**CRITICAL CONCEPT:** Schemas validate at different points in the request/response lifecycle:
+
+### Request Parameter Schemas (Query/Body/Route)
+- Validate AFTER JSON parsing
+- Data is already deserialized (strings, numbers, booleans)
+- Use `ms/TemporalString` for date/time inputs
+- Use `ms/BooleanValue` for boolean query params
+
+### Response Schemas
+- Validate BEFORE JSON serialization
+- Data is still in Clojure format (Java Time objects, sets, keywords)
+- Use `:any` for Java Time objects
+- Use `[:set X]` for sets
+- Use `[:enum :keyword]` for keyword enums
+
+### Serialization Flow
+
+```
+Request:  JSON string → Parse → Coerce → Handler
+Response: Handler → Schema Check → Encode → Serialize → JSON string
+```
+
+## Workflow Summary
+
+1. **Read the endpoint** - understand what it does
+2. **Identify params** - route, query, body
+3. **Add parameter schemas** - use existing types from `ms`
+4. **Determine return type** - check the implementation
+5. **Define response schema** - inline or named with `mr/def`
+6. **Test** - ensure the endpoint works and validates correctly
+
+## Testing Your Schemas
+
+After adding schemas, verify:
+
+1. **Valid requests work** - test with correct data
+2. **Invalid requests fail gracefully** - test with wrong types
+3. **Optional params work** - test with/without optional params
+4. **Error messages are clear** - check validation error responses
+
+## Tips
+
+- **Start simple** - begin with basic types, refine later
+- **Reuse schemas** - if you see the same structure twice, make it a named schema
+- **Be specific** - use `ms/PositiveInt` instead of `pos-int?`
+- **Document intent** - add docstrings to named schemas
+- **Follow conventions** - look at similar endpoints in the same namespace
+- **Check the actual data** - use REPL to inspect what's actually returned before serialization
+
+## Additional Resources
+
+- [Malli Documentation](https://github.com/metosin/malli)
+- Metabase Malli utilities: `src/metabase/util/malli/schema.clj`
+- Metabase schema registry: `src/metabase/util/malli/registry.clj`

.claude/skills/add-tracing/SKILL.md

@@ -0,0 +1,357 @@
+---
+name: add-tracing
+description: Add OpenTelemetry tracing spans to Clojure code following Metabase tracing conventions. Use when instrumenting backend code with trace coverage.
+---
+
+# Add Tracing Spans to Clojure Code
+
+This skill helps you add OpenTelemetry (OTel) tracing spans to the Metabase backend codebase using the custom `tracing/with-span` macro.
+
+## Reference Files
+
+- `src/metabase/tracing/core.clj` - `with-span` macro, group registry, SDK lifecycle, `best-effort-sanitize-sql`, Pyroscope integration
+- `src/metabase/task/impl.clj` - `defjob` macro that wraps Quartz jobs with root spans
+- `.clj-kondo/config/modules/config.edn` - Module boundary configuration
+
+## Module Architecture
+
+The tracing module has a deliberately minimal API surface. **Only 2 namespaces are public** (listed in `:api` in the module config):
+
+| Namespace | Role | Status |
+|---|---|---|
+| `tracing.core` | Primary API: `with-span`, groups, SDK lifecycle, Pyroscope, MDC, `best-effort-sanitize-sql` | **Public API** |
+| `tracing.init` | Side-effect loader for `quartz` and `settings` | **Public API** (init convention) |
+| `tracing.attributes` | `best-effort-sanitize-sql` implementation (re-exported via `tracing.core`) | Internal |
+| `tracing.settings` | Setting definitions (`MB_TRACING_*` env vars) | Internal |
+| `tracing.quartz` | Quartz JDBC proxy + JobListener | Internal |
+
+**Rules:**
+- Only require `[metabase.tracing.core :as tracing]` from outside the module. `tracing/best-effort-sanitize-sql` and all other public functions are available from this single namespace.
+- Do not add new API namespaces. Add new public functions to `tracing.core` instead.
+- Do not require internal namespaces (`tracing.attributes`, `tracing.settings`, `tracing.quartz`) from outside the module.
+- `:uses :any` on the `core` module does NOT bypass the target module's `:api` check — internal namespaces are still enforced.
+
+### Cyclic Dependency Avoidance
+
+`tracing/core.clj` is required by many modules across the codebase. It **must NOT** compile-time require `tracing.settings`, as this creates transitive cyclic load dependencies (e.g., `settings/core -> tracing/settings -> tracing/core -> events/impl -> events/core`).
+
+Instead, `tracing/core.clj` uses `requiring-resolve` for settings access:
+
+```clojure
+;; CORRECT — lazy runtime resolution, no compile-time dependency
+((requiring-resolve 'metabase.tracing.settings/tracing-enabled))
+
+;; WRONG — creates cyclic load dependency
+(require '[metabase.tracing.settings :as settings])
+(settings/tracing-enabled)
+```
+
+External library namespaces (clj-otel API, SDK, exporters) are safe to require normally — they don't participate in Metabase namespace cycles.
+
+**Important:** `requiring-resolve` must use **literal quoted symbols**. Kondo hooks validate that `required-namespaces` are all simple symbols, so dynamic construction fails:
+
+```clojure
+;; CORRECT — literal quoted symbol
+(requiring-resolve 'metabase.tracing.settings/tracing-endpoint)
+
+;; WRONG — kondo hook rejects this: "Assert failed: (every? simple-symbol? required-namespaces)"
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-endpoint"))
+```
+
+## Quick Checklist
+
+When adding tracing spans:
+
+- [ ] Module has `tracing` in its `:uses` set in `.clj-kondo/config/modules/config.edn`
+- [ ] Added `[metabase.tracing.core :as tracing]` to ns requires (alphabetically sorted)
+- [ ] Span wraps a meaningful I/O boundary (not pure computation)
+- [ ] Group matches the domain (check `src/metabase/tracing/core.clj` for registered groups; add a new one if none fit)
+- [ ] Span name follows dot-notation convention (`"domain.subsystem.operation"`)
+- [ ] Attributes use namespaced keywords (`:search/query-length`, `:db/id`)
+- [ ] No sensitive data in attributes (use `best-effort-sanitize-sql` for HoneySQL, never raw SQL)
+- [ ] No new tracing namespaces created (add to `tracing.core` instead)
+- [ ] No `DO_NOT_ADD_NEW_FILES_HERE.txt` violations in the target directory
+- [ ] Run `clj-kondo --lint <files>` to verify 0 errors, 0 warnings
+- [ ] Add or update tests in the corresponding `test/` path (see Testing section below)
+- [ ] Run tests: `clojure -X:dev:test :only <test-ns>`
+
+## The `with-span` Macro
+
+```clojure
+(tracing/with-span group span-name attrs & body)
+```
+
+- **group** - A keyword selecting which trace group this span belongs to (e.g., `:tasks`, `:sync`)
+- **span-name** - A string identifying the span in traces (e.g., `"search.execute"`)
+- **attrs** - A map of span attributes (e.g., `{:db/id 42}`)
+- **body** - The code to execute inside the span
+
+**When disabled:** zero overhead -- single atom deref + boolean check, body runs directly.
+**When enabled:** creates OTel span AND injects `trace_id`/`span_id` into Log4j2 MDC for log-to-trace correlation.
+
+## Trace Groups
+
+Groups are registered in `src/metabase/tracing/core.clj`. Check that file for the current list. The general rule: **match the group to the domain, not the call site.** If code runs inside a Quartz job but is logically search work, use `:search`, not `:tasks`.
+
+To add a new group:
+
+```clojure
+;; In src/metabase/tracing/core.clj
+(register-group! :my-domain "Description of what this covers")
+```
+
+Users enable groups via `MB_TRACING_GROUPS=tasks,search,sync` (comma-separated, or `"all"`).
+
+## Naming Conventions
+
+### Span Names
+
+Use dot-separated hierarchical names: `"domain.subsystem.operation"`. The domain prefix should match the group name:
+
+```
+search.execute              -- `:search` group
+sync.fingerprint.table      -- `:sync` group
+task.session-cleanup.delete -- `:tasks` group
+db-app.collection-items     -- `:db-app` group
+```
+
+### Attributes
+
+Use namespaced keywords. The namespace groups related attributes:
+
+```clojure
+:db/id              -- Database ID (integer)
+:db/engine          -- Database engine name (string)
+:db/statement       -- Sanitized SQL (string, via best-effort-sanitize-sql)
+:search/engine      -- Search engine name (string)
+:search/query-length -- Query string length (integer)
+:sync/table         -- Table name (string)
+:sync/step          -- Sync step name (string)
+:task/name          -- Task name (string)
+:http/method        -- HTTP method (string)
+:http/url           -- Request URL (string)
+```
+
+Invent new namespaced attributes as needed (e.g., `:pulse/id`, `:transform/count`). Keep values as primitives (strings, numbers, booleans) -- no maps or collections.
+
+## Step-by-Step: Adding a Span
+
+### 1. Check module boundaries
+
+Look up the module for your namespace in `.clj-kondo/config/modules/config.edn`. If `tracing` is not in the module's `:uses` set, add it (keep alphabetically sorted):
+
+```edn
+my-module
+{:team "MyTeam"
+ :uses #{analytics config tracing util}}
+```
+
+### 2. Add the require
+
+```clojure
+(ns metabase.my-module.thing
+  (:require
+   [metabase.tracing.core :as tracing]
+   [metabase.util :as u]))
+```
+
+`best-effort-sanitize-sql` is available from `tracing.core` — no additional require needed.
+
+### 3. Identify the I/O boundary
+
+Only wrap code at **meaningful I/O boundaries**:
+
+**DO trace:**
+- External API calls (embedding APIs, metabot, webhooks)
+- Database queries (both app DB and user DB)
+- Network requests (HTTP calls to external services)
+- Heavy batch processing (batch indexing, batch embedding)
+- Top-level orchestration functions that coordinate multiple sub-operations
+
+**DO NOT trace:**
+- Pure computation (sorting, filtering, mapping)
+- Simple single-row lookups (`t2/select-one :model/Setting :key k`)
+- Every function in a call chain (only boundaries matter)
+- Trivial operations (string formatting, hash calculations)
+
+### 4. Wrap with `with-span`
+
+```clojure
+;; Simple span (no attributes needed)
+(tracing/with-span :search "search.init-index" {}
+  (do-expensive-thing))
+
+;; Span with static attributes
+(tracing/with-span :sync "sync.fingerprint.table"
+                   {:db/id (:db_id table)
+                    :sync/table (:name table)}
+  (fingerprint-fields! table fields))
+
+;; Span with computed attributes
+(tracing/with-span :search "search.execute"
+                   {:search/engine       (name (:search-engine ctx))
+                    :search/query-length (count (:search-string ctx))}
+  (search.engine/results ctx))
+
+;; Span with sanitized SQL (for dynamic HoneySQL queries)
+(let [hsql {:delete-from [(t2/table-name :model/Session)]
+            :where [:< :created_at oldest-allowed]}]
+  (tracing/with-span :tasks "task.session-cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+
+;; Sub-spans breaking a function into I/O phases
+(let [embedding (tracing/with-span :search "search.semantic.embedding"
+                                   {:search.semantic/provider (:provider model)}
+                  (get-embedding model search-string))
+      results   (tracing/with-span :search "search.semantic.db-query" {}
+                  (into [] xform reducible))]
+  (process results))
+
+;; Per-item iteration spans
+(doseq [e (search.engine/active-engines)]
+  (tracing/with-span :search "search.ingestion.update" {:search/engine (name e)}
+    (search.engine/update! e batch)))
+```
+
+### 5. Add tests
+
+Create or update tests in the corresponding `test/` path. Follow the patterns in existing tracing tests:
+
+- **Reference tests:** `test/metabase/tracing/quartz_test.clj`, `test/metabase/server/middleware/trace_test.clj`
+- Use `tracing/init-enabled-groups!` / `tracing/shutdown-groups!` with `try`/`finally` to manage group lifecycle
+- Test both enabled and disabled paths (verify zero overhead when group is off)
+- Use `reify` mocks for Java interfaces (Connection, PreparedStatement, JobListener, etc.)
+- Add `(set! *warn-on-reflection* true)` and type-hint proxy/reify calls to avoid reflection warnings
+
+```clojure
+(deftest my-span-enabled-test
+  (testing "when group is enabled, span is created"
+    (try
+      (tracing/init-enabled-groups! "my-group" "INFO")
+      ;; ... test that span behavior occurs ...
+      (finally
+        (tracing/shutdown-groups!)))))
+
+(deftest my-span-disabled-test
+  (testing "when group is disabled, code runs without tracing"
+    (tracing/shutdown-groups!)
+    ;; ... test that code still works, no wrapping applied ...
+    ))
+```
+
+### 6. Lint and run tests
+
+```bash
+# Lint modified source and test files — expect 0 errors, 0 warnings
+clj-kondo --lint path/to/modified/file.clj path/to/test/file.clj
+
+# Run tests (requires Java 21+)
+  clojure -X:dev:test :only my-ns.test-ns
+```
+
+Expect: all tests pass, 0 failures, 0 errors, no reflection warnings from your files.
+
+## Sanitizing SQL for Attributes
+
+When including SQL in span attributes, **always** use `tracing/best-effort-sanitize-sql`. This converts HoneySQL maps to parameterized SQL strings where values become `?` placeholders -- no data leaks.
+
+```clojure
+(let [hsql {:delete-from [:core_session]
+            :where [:< :created_at some-timestamp]}]
+  (tracing/with-span :tasks "task.cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+;; Trace attribute: db/statement = "DELETE FROM core_session WHERE created_at < ?"
+```
+
+**Rules:**
+- Never put raw SQL strings or user-provided values in attributes
+- Use `best-effort-sanitize-sql` only for app DB (HoneySQL) queries
+- For external/user DB queries, trace only timing and counts, not SQL content
+
+## Defjob and Root Spans
+
+The `defjob` macro in `metabase.task.impl` automatically wraps every Quartz job with a `:tasks` root span:
+
+```clojure
+(task/defjob ^{DisallowConcurrentExecution true} SessionCleanup [_]
+  (cleanup-sessions!))
+;; Automatically creates span: "task.SessionCleanup" {:task/name "SessionCleanup"}
+```
+
+You do NOT need a root span inside `defjob` bodies. Add **child spans** for I/O inside the job.
+
+For code on plain `Thread`s (not Quartz), add the root span manually:
+
+```clojure
+(defn init! []
+  (tracing/with-span :search "search.task.init" {}
+    (search/init-index!)))
+```
+
+## What NOT to Do
+
+### Span Usage Mistakes
+
+```clojure
+;; WRONG - pure computation, no I/O
+(tracing/with-span :search "search.format-results" {}
+  (map format-result results))
+
+;; WRONG - trivial single-row lookup
+(tracing/with-span :db-app "db-app.get-setting" {}
+  (t2/select-one :model/Setting :key "my-setting"))
+
+;; WRONG - raw SQL in attributes (data leak)
+(tracing/with-span :tasks "task.cleanup" {:db/statement raw-sql-string}
+  (execute! raw-sql-string))
+
+;; WRONG - wrong group (search work should use :search, not :tasks)
+(tracing/with-span :tasks "search.execute" {} ...)
+
+;; WRONG - redundant nesting (do-search already has a span)
+(tracing/with-span :search "search.process" {}
+  (let [results (do-search ctx)]
+    (tracing/with-span :search "search.format" {}
+      (format-results results))))
+```
+
+### Architecture Mistakes
+
+```clojure
+;; WRONG - creating a new tracing namespace
+(ns metabase.tracing.my-feature ...)
+
+;; WRONG - requiring internal tracing namespaces from outside the module
+(ns metabase.my-module.thing
+  (:require [metabase.tracing.attributes :as trace-attrs]      ;; internal!
+            [metabase.tracing.settings :as tracing.settings]   ;; internal!
+            [metabase.tracing.quartz :as tracing.quartz]))     ;; internal!
+
+;; WRONG - adding compile-time requires to tracing/core.clj for settings or SDK
+;; This creates cyclic load dependencies because tracing/core is widely required
+(ns metabase.tracing.core
+  (:require [metabase.tracing.settings :as settings]))  ;; causes cycle!
+
+;; WRONG - dynamic symbol construction with requiring-resolve (kondo rejects it)
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-enabled"))
+```
+
+## Configuration
+
+All settings are env-var-only (defined in `src/metabase/tracing/settings.clj`):
+
+```bash
+# Core
+MB_TRACING_ENABLED=true              # Enable tracing (default: false)
+MB_TRACING_ENDPOINT=host:4317        # OTLP collector endpoint (default: http://localhost:4317)
+MB_TRACING_GROUPS=tasks,search,sync  # Comma-separated groups or "all" (default: all)
+MB_TRACING_SERVICE_NAME=metabase     # Service name in traces (default: hostname)
+MB_TRACING_LOG_LEVEL=DEBUG           # Log threshold for traced threads: TRACE/DEBUG/INFO (default: INFO)
+
+# Batch span processor tuning
+MB_TRACING_MAX_QUEUE_SIZE=2048       # Max spans queued for export; drops when full (default: 2048)
+MB_TRACING_EXPORT_TIMEOUT_MS=10000   # Max wait for batch export to complete (default: 10000)
+MB_TRACING_SCHEDULE_DELAY_MS=5000    # Delay between consecutive batch exports (default: 5000)
+```

.claude/skills/analytics-events/SKILL.md

@@ -0,0 +1,504 @@
+---
+name: analytics-events
+description: Add product analytics events to track user interactions in the Metabase frontend
+allowed-tools: Read, Write, Edit, Grep, Glob
+---
+
+# Frontend Analytics Events Skill
+
+This skill helps you add product analytics (Snowplow) events to track user interactions in the Metabase frontend codebase.
+
+## Quick Reference
+
+Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+
+**Key Files:**
+- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
+- `frontend/src/metabase/analytics/` - Core tracking functions (import from `metabase/analytics`)
+- Feature-specific `analytics.ts` files - Tracking function wrappers
+
+## Quick Checklist
+
+When adding a new analytics event:
+
+- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
+- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
+- [ ] Create tracking function in feature's `analytics.ts` file
+- [ ] Import and call tracking function at the interaction point
+- [ ] Use `trackSimpleEvent()` for basic events (most common)
+
+## Event Schema Types
+
+### 1. Simple Events (Most Common)
+
+Use `SimpleEventSchema` for straightforward tracking. It supports these standard fields:
+
+```typescript
+type SimpleEventSchema = {
+  event: string;                    // Required: Event name (snake_case)
+  target_id?: number | null;        // Optional: ID of affected entity
+  triggered_from?: string | null;   // Optional: UI location/context
+  duration_ms?: number | null;      // Optional: Duration in milliseconds
+  result?: string | null;           // Optional: Outcome (e.g., "success", "failure")
+  event_detail?: string | null;     // Optional: Additional detail/variant
+};
+```
+
+**When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
+
+### 2. Custom Schemas (legacy, no events are being added)
+
+Consider adding new event schema only in very special cases.
+
+**Examples:** `DashboardEventSchema`, `CleanupEventSchema`, `QuestionEventSchema`
+
+## Step-by-Step: Adding a Simple Event
+
+### Example: Track when a user applies filters in a table picker
+
+#### Step 1: Define Event Types
+
+Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
+
+```typescript
+export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_applied";
+}>;
+
+export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_cleared";
+}>;
+```
+
+#### Step 2: Add to Union Type
+
+Find or create the appropriate union type and add your events:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent
+  | DataStudioGlossaryEditedEvent
+  | DataStudioGlossaryDeletedEvent
+  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
+  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
+```
+
+#### Step 3: Create Tracking Functions
+
+In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
+
+```typescript
+import { trackSimpleEvent } from "metabase/analytics";
+
+export const trackDataStudioTablePickerFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_applied",
+  });
+};
+
+export const trackDataStudioTablePickerFiltersCleared = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_cleared",
+  });
+};
+```
+
+#### Step 4: Use in Components
+
+Import and call the tracking function at the interaction point:
+
+```typescript
+import {
+  trackDataStudioTablePickerFiltersApplied,
+  trackDataStudioTablePickerFiltersCleared,
+} from "metabase-enterprise/data-studio/analytics";
+
+function FilterPopover({ filters, onSubmit }) {
+  const handleReset = () => {
+    trackDataStudioTablePickerFiltersCleared(); // <- Track here
+    onSubmit(emptyFilters);
+  };
+
+  return (
+    <form
+      onSubmit={(event) => {
+        event.preventDefault();
+        trackDataStudioTablePickerFiltersApplied(); // <- Track here
+        onSubmit(form);
+      }}
+    >
+      {/* form content */}
+    </form>
+  );
+}
+```
+
+## Using SimpleEventSchema Fields
+
+### Example: Event with target_id
+
+```typescript
+// Type definition
+export type DataStudioLibraryCreatedEvent = ValidateEvent<{
+  event: "data_studio_library_created";
+  target_id: number | null;
+}>;
+
+// Tracking function
+export const trackDataStudioLibraryCreated = (id: CollectionId) => {
+  trackSimpleEvent({
+    event: "data_studio_library_created",
+    target_id: Number(id),
+  });
+};
+
+// Usage
+trackDataStudioLibraryCreated(newLibrary.id);
+```
+
+### Example: Event with triggered_from
+
+```typescript
+// Type definition
+export type NewButtonClickedEvent = ValidateEvent<{
+  event: "new_button_clicked";
+  triggered_from: "app-bar" | "empty-collection";
+}>;
+
+// Tracking function
+export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+  trackSimpleEvent({
+    event: "new_button_clicked",
+    triggered_from: location,
+  });
+};
+
+// Usage
+<Button onClick={() => {
+  trackNewButtonClicked("app-bar");
+  handleCreate();
+}}>
+  New
+</Button>
+```
+
+### Example: Event with event_detail
+
+```typescript
+// Type definition
+export type MetadataEditEvent = ValidateEvent<{
+  event: "metadata_edited";
+  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
+  triggered_from: "admin" | "data_studio";
+}>;
+
+// Tracking function
+export const trackMetadataChange = (
+  detail: "type_casting" | "semantic_type_change" | "visibility_change",
+  location: "admin" | "data_studio"
+) => {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: location,
+  });
+};
+
+// Usage
+trackMetadataChange("semantic_type_change", "data_studio");
+```
+
+### Example: Event with result and duration
+
+```typescript
+// Type definition
+export type MoveToTrashEvent = ValidateEvent<{
+  event: "moved-to-trash";
+  target_id: number | null;
+  triggered_from: "collection" | "detail_page" | "cleanup_modal";
+  duration_ms: number | null;
+  result: "success" | "failure";
+  event_detail: "question" | "model" | "metric" | "dashboard";
+}>;
+
+// Tracking function
+export const trackMoveToTrash = (params: {
+  targetId: number | null;
+  triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
+  durationMs: number | null;
+  result: "success" | "failure";
+  itemType: "question" | "model" | "metric" | "dashboard";
+}) => {
+  trackSimpleEvent({
+    event: "moved-to-trash",
+    target_id: params.targetId,
+    triggered_from: params.triggeredFrom,
+    duration_ms: params.durationMs,
+    result: params.result,
+    event_detail: params.itemType,
+  });
+};
+
+// Usage with timing
+const startTime = Date.now();
+try {
+  await moveToTrash(item);
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "success",
+    itemType: "question",
+  });
+} catch (error) {
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "failure",
+    itemType: "question",
+  });
+}
+```
+
+## Naming Conventions
+
+### Event Names (snake_case)
+
+```typescript
+// Good
+"data_studio_library_created"
+"table_picker_filters_applied"
+"metabot_chat_opened"
+
+// Bad
+"DataStudioLibraryCreated"  // Wrong case
+"tablePickerFiltersApplied" // Wrong case
+"filters-applied"            // Use underscore, not hyphen
+```
+
+### Event Type Names (PascalCase with "Event" suffix)
+
+```typescript
+// Good
+DataStudioLibraryCreatedEvent
+TablePickerFiltersAppliedEvent
+MetabotChatOpenedEvent
+
+// Bad
+dataStudioLibraryCreated      // Wrong case
+DataStudioLibraryCreated      // Missing "Event" suffix
+```
+
+### Tracking Function Names (camelCase with "track" prefix)
+
+```typescript
+// Good
+trackDataStudioLibraryCreated
+trackTablePickerFiltersApplied
+trackMetabotChatOpened
+
+// Bad
+DataStudioLibraryCreated      // Missing "track" prefix
+track_library_created         // Wrong case
+logLibraryCreated             // Use "track" prefix
+```
+
+## Common Patterns
+
+### Pattern 1: Feature-Specific Union Types
+
+Group related events together:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent;
+
+export type MetabotEvent =
+  | MetabotChatOpenedEvent
+  | MetabotRequestSentEvent
+  | MetabotFixQueryClickedEvent;
+
+// Then add to SimpleEvent union
+export type SimpleEvent =
+  | /* other events */
+  | DataStudioEvent
+  | MetabotEvent
+  | /* more events */;
+```
+
+### Pattern 2: Conditional Tracking
+
+Track different events based on user action:
+
+```typescript
+const handleSave = async () => {
+  if (isNewItem) {
+    await createItem(data);
+    trackItemCreated(newItem.id);
+  } else {
+    await updateItem(id, data);
+    trackItemUpdated(id);
+  }
+};
+```
+
+## Common Pitfalls
+
+### Don't: Add custom fields to SimpleEvent
+
+```typescript
+// WRONG - SimpleEvent doesn't support custom fields
+export const trackFiltersApplied = (filters: FilterState) => {
+  trackSimpleEvent({
+    event: "filters_applied",
+    data_layer: filters.dataLayer,      // ❌ Not in SimpleEventSchema
+    data_source: filters.dataSource,    // ❌ Not in SimpleEventSchema
+    with_owner: filters.hasOwner,       // ❌ Not in SimpleEventSchema
+  });
+};
+
+// RIGHT - Use only standard SimpleEventSchema fields
+export const trackFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "filters_applied",
+  });
+};
+
+// Or use event_detail for a single variant
+export const trackFilterApplied = (filterType: string) => {
+  trackSimpleEvent({
+    event: "filter_applied",
+    event_detail: filterType,  // ✓ "data_layer", "data_source", etc.
+  });
+};
+```
+
+### Don't: Forget to add event to union type
+
+```typescript
+// Define the event
+export type NewFeatureClickedEvent = ValidateEvent<{
+  event: "new_feature_clicked";
+}>;
+
+// ❌ WRONG - Forgot to add to SimpleEvent union
+// Event won't be recognized by TypeScript
+
+// ✓ RIGHT - Add to appropriate union
+export type SimpleEvent =
+  | /* other events */
+  | NewFeatureClickedEvent;
+```
+
+### Don't: Mix up event name formats
+
+```typescript
+// WRONG
+event: "dataStudioLibraryCreated"  // camelCase
+event: "data-studio-library-created"  // kebab-case
+event: "Data_Studio_Library_Created"  // Mixed case
+
+// RIGHT
+event: "data_studio_library_created"  // snake_case
+```
+
+### Don't: Track PII or sensitive data
+
+```typescript
+// WRONG - Don't track user emails, names, or sensitive data
+trackSimpleEvent({
+  event: "user_logged_in",
+  event_detail: user.email,  // ❌ PII
+});
+
+// RIGHT - Track non-sensitive identifiers only
+trackSimpleEvent({
+  event: "user_logged_in",
+  target_id: user.id,  // ✓ Just the ID
+});
+```
+
+### Don't: Forget to track both success and failure
+
+```typescript
+// WRONG - Only tracking success
+try {
+  await saveData();
+  trackDataSaved();
+} catch (error) {
+  // ❌ No tracking for failure case
+}
+
+// RIGHT - Track both outcomes
+try {
+  await saveData();
+  trackDataSaved({ result: "success" });
+} catch (error) {
+  trackDataSaved({ result: "failure" });
+}
+```
+
+## Testing Analytics Events
+
+While developing, you can verify events are firing:
+
+1. **Check browser console** - When `SNOWPLOW_ENABLED=true` in dev, events are logged
+2. **Use shouldLogAnalytics** - Set in `metabase/env` to see all analytics in console
+3. **Check Snowplow debugger** - Browser extension for Snowplow events
+
+Example console output:
+
+```
+[SNOWPLOW EVENT | event sent:true], data_studio_table_picker_filters_applied
+```
+
+## File Organization
+
+### Where to put tracking functions:
+
+```
+Feature-specific analytics functions:
+frontend/src/metabase/{feature}/analytics.ts
+enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
+
+Event type definitions (all in one place):
+frontend/src/metabase-types/analytics/event.ts
+
+Core tracking utilities:
+frontend/src/metabase/analytics/ (import from `metabase/analytics`)
+```
+
+## Real-World Examples
+
+See these files for reference:
+
+- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
+- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
+- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
+- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+
+## Workflow Summary
+
+1. **Identify the user interaction** to track
+2. **Decide on event name** (snake_case, descriptive)
+3. **Define event type** in `event.ts` using `ValidateEvent`
+4. **Add to union type** (create feature union if needed)
+5. **Create tracking function** in feature's `analytics.ts`
+6. **Import and call** at the interaction point
+7. **Test** that events fire correctly
+
+## Tips
+
+- **Be specific** - `filters_applied` is better than `action_performed`
+- **Use past tense** - `library_created` not `create_library`
+- **Group related events** - Create feature-specific event union types
+- **Track meaningful actions** - Not every click needs tracking
+- **Consider the data** - What would you want to analyze later?
+- **Stay consistent** - Follow existing naming patterns in the codebase
+- **Document context** - Use `triggered_from` to track where the action happened

.claude/skills/clojure-eval/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: clojure-eval
+description: Evaluate Clojure code via nREPL using clj-nrepl-eval. Use this when you need to test code, check if edited files compile, verify function behavior, or interact with a running REPL session.
+---
+
+# Clojure REPL Evaluation
+
+## When to Use This Skill
+
+Use this skill when you need to:
+- **Verify that edited Clojure files compile and load correctly**
+- Test function behavior interactively
+- Check the current state of the REPL
+- Debug code by evaluating expressions
+- Require or load namespaces for testing
+- Validate that code changes work before committing
+
+## How It Works
+
+The `clj-nrepl-eval` command evaluates Clojure code against an nREPL server. **Session state persists between evaluations**, so you can require a namespace in one evaluation and use it in subsequent calls. Each host:port combination maintains its own session file.
+
+## Instructions
+
+### 0. Discover and select nREPL server
+
+First, discover what nREPL servers are running in the current directory:
+
+```bash
+clj-nrepl-eval --discover-ports
+```
+
+This will show all nREPL servers (Clojure, Babashka, shadow-cljs, etc.) running in the current project directory.
+
+**Then use the AskUserQuestion tool:**
+
+- **If ports are discovered:** Prompt user to select which nREPL port to use:
+  - **question:** "Which nREPL port would you like to use?"
+  - **header:** "nREPL Port"
+  - **options:** Present each discovered port as an option with:
+    - **label:** The port number
+    - **description:** The server type and status (e.g., "Clojure nREPL server in current directory")
+  - Include up to 4 discovered ports as options
+  - The user can select "Other" to enter a custom port number
+
+- **If no ports are discovered:** Prompt user how to start an nREPL server:
+  - **question:** "No nREPL servers found. How would you like to start one?"
+  - **header:** "Start nREPL"
+  - **options:**
+    - **label:** "deps.edn alias", **description:** "Find and use an nREPL alias in deps.edn"
+    - **label:** "Leiningen", **description:** "Start nREPL using 'lein repl'"
+  - The user can select "Other" for alternative methods or if they already have a server running on a specific port
+
+IMPORTANT: IF you start a REPL do not supply a port let the nREPL start and return the port that it was started on.
+
+### 1. Evaluate Clojure Code
+
+> Evaluation automatically connects to the given port
+
+Use the `-p` flag to specify the port and pass your Clojure code.
+
+**Recommended: Pass code as a command-line argument:**
+```bash
+clj-nrepl-eval -p <PORT> "(+ 1 2 3)"
+```
+
+**For multiple expressions (single line):**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (+ x 20)"
+```
+
+**Alternative: Using heredoc (may require permission approval for multiline commands):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(+ x 20)
+EOF
+```
+
+**Alternative: Via stdin pipe:**
+```bash
+echo "(+ 1 2 3)" | clj-nrepl-eval -p <PORT>
+```
+
+### 2. Display nREPL Sessions
+
+**Discover all nREPL servers in current directory:**
+```bash
+clj-nrepl-eval --discover-ports
+```
+Shows all running nREPL servers in the current project directory, including their type (clj/bb/basilisp) and whether they match the current working directory.
+
+**Check previously connected sessions:**
+```bash
+clj-nrepl-eval --connected-ports
+```
+Shows only connections you have made before (appears after first evaluation on a port).
+
+### 3. Common Patterns
+
+**Require a namespace (always use :reload to pick up changes):**
+```bash
+clj-nrepl-eval -p <PORT> "(require '[my.namespace :as ns] :reload)"
+```
+
+**Test a function after requiring:**
+```bash
+clj-nrepl-eval -p <PORT> "(ns/my-function arg1 arg2)"
+```
+
+**Check if a file compiles:**
+```bash
+clj-nrepl-eval -p <PORT> "(require 'my.namespace :reload)"
+```
+
+**Multiple expressions:**
+```bash
+clj-nrepl-eval -p <PORT> "(def x 10) (* x 2) (+ x 5)"
+```
+
+**Complex multiline code (using heredoc):**
+```bash
+clj-nrepl-eval -p <PORT> <<'EOF'
+(def x 10)
+(* x 2)
+(+ x 5)
+EOF
+```
+*Note: Heredoc syntax may require permission approval.*
+
+**With custom timeout (in milliseconds):**
+```bash
+clj-nrepl-eval -p <PORT> --timeout 5000 "(long-running-fn)"
+```
+
+**Reset the session (clears all state):**
+```bash
+clj-nrepl-eval -p <PORT> --reset-session
+clj-nrepl-eval -p <PORT> --reset-session "(def x 1)"
+```
+
+## Available Options
+
+- `-p, --port PORT` - nREPL port (required)
+- `-H, --host HOST` - nREPL host (default: 127.0.0.1)
+- `-t, --timeout MILLISECONDS` - Timeout (default: 120000 = 2 minutes)
+- `-r, --reset-session` - Reset the persistent nREPL session
+- `-c, --connected-ports` - List previously connected nREPL sessions
+- `-d, --discover-ports` - Discover nREPL servers in current directory
+- `-h, --help` - Show help message
+
+## Important Notes
+
+- **Prefer command-line arguments:** Pass code as quoted strings: `clj-nrepl-eval -p <PORT> "(+ 1 2 3)"` - works with existing permissions
+- **Heredoc for complex code:** Use heredoc (`<<'EOF' ... EOF`) for truly multiline code, but note it may require permission approval
+- **Sessions persist:** State (vars, namespaces, loaded libraries) persists across invocations until the nREPL server restarts or `--reset-session` is used
+- **Automatic delimiter repair:** The tool automatically repairs missing or mismatched parentheses
+- **Always use :reload:** When requiring namespaces, use `:reload` to pick up recent changes
+- **Default timeout:** 2 minutes (120000ms) - increase for long-running operations
+- **Input precedence:** Command-line arguments take precedence over stdin
+
+## Typical Workflow
+
+1. Discover nREPL servers: `clj-nrepl-eval --discover-ports`
+2. Use **AskUserQuestion** tool to prompt user to select a port
+3. Require namespace:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(require '[my.ns :as ns] :reload)"
+   ```
+4. Test function:
+   ```bash
+   clj-nrepl-eval -p <PORT> "(ns/my-fn ...)"
+   ```
+5. Iterate: Make changes, re-require with `:reload`, test again

.claude/skills/clojure-review/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: clojure-review
+description: Review Clojure and ClojureScript code changes for compliance with Metabase coding standards, style violations, and code quality issues. Use when reviewing pull requests or diffs containing Clojure/ClojureScript code.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# Clojure Code Review Skill
+
+@./../_shared/clojure-style-guide.md
+@./../_shared/clojure-commands.md
+
+## Review guidelines
+
+**What to flag:**
+
+- Check compliance with the Metabase Clojure style guide (included above)
+- If `CLOJURE_STYLE_GUIDE.adoc` exists in the working directory, also check compliance with the community Clojure style guide
+- Flag all style guide violations
+
+**What NOT to post:**
+
+- Do not post comments congratulating someone for trivial changes or for following style guidelines
+- Do not post comments confirming things "look good" or telling them they did something correctly
+- Only post comments about style violations or potential issues
+
+Example bad code review comments to avoid:
+
+> This TODO comment is properly formatted with author and date - nice work!
+
+> Good addition of limit 1 to the query - this makes the test more efficient without changing its behavior.
+
+> The kondo ignore comment is appropriately placed here
+
+> Test name properly ends with -test as required by the style guide.
+
+**Special cases:**
+
+- Do not post comments about missing parentheses (these will be caught by the linter)
+
+## Quick review checklist
+
+Use this to scan through changes efficiently:
+
+### Naming
+
+- [ ] Descriptive names (no `tbl`, `zs'`)
+- [ ] Pure functions named as nouns describing their return value
+- [ ] `kebab-case` for all variables and functions
+- [ ] Side-effect functions end with `!`
+- [ ] No namespace-alias repetition in function names
+
+### Documentation
+
+- [ ] Public vars in `src` or `enterprise/backend/src` have useful docstrings
+- [ ] Docstrings use Markdown conventions
+- [ ] References use `[[other-var]]` not backticks
+- [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
+
+### Code Organization
+
+- [ ] Everything `^:private` unless used elsewhere
+- [ ] No `declare` when avoidable (public functions near end)
+- [ ] Functions under 20 lines when possible
+- [ ] No blank, non-comment lines within definition forms (except pairwise constructs in `let`/`cond`)
+- [ ] Lines ≤ 120 characters
+
+### Tests
+
+- [ ] Separate `deftest` forms for distinct test cases
+- [ ] Pure tests marked `^:parallel`
+- [ ] Test names end in `-test` or `-test-<number>`
+
+### Modules
+
+- [ ] Correct module patterns (OSS: `metabase.<module>.*`, EE: `metabase-enterprise.<module>.*`)
+- [ ] API endpoints in `<module>.api` namespaces
+- [ ] Public API in `<module>.core` with Potemkin
+- [ ] No cheating module linters with `:clj-kondo/ignore [:metabase/modules]`
+
+### REST API
+
+- [ ] Response schemas present (`:- <schema>`)
+- [ ] Query params use kebab-case, bodies use `snake_case`
+- [ ] Routes use singular nouns (e.g., `/api/dashboard/:id`)
+- [ ] `GET` has no side effects (except analytics)
+- [ ] Malli schemas detailed and complete
+- [ ] All new endpoints have tests
+
+### MBQL
+
+- [ ] No raw MBQL manipulation outside `lib`, `lib-be`, or `query-processor` modules
+- [ ] Uses Lib and MBQL 5, not legacy MBQL
+
+### Database
+
+- [ ] Model and table names are singular nouns
+- [ ] Uses `t2/select-one-fn` instead of selecting full rows for one column
+- [ ] Logic in Toucan methods, not helper functions
+
+### Drivers
+
+- [ ] New multimethods documented in `docs/developers-guide/driver-changelog.md`
+- [ ] Passes `driver` argument to other driver methods (no hardcoded driver names)
+- [ ] Minimal logic in `read-column-thunk`
+
+### Miscellaneous
+
+- [ ] Example data is bird-themed when possible
+- [ ] Kondo linter suppressions use proper format (not `#_:clj-kondo/ignore` keyword form)
+
+## Pattern matching table
+
+Quick scan for common issues:
+
+| Pattern                                      | Issue                                                       |
+| -------------------------------------------- | ----------------------------------------------------------- |
+| `calculate-age`, `get-user`                  | Pure functions should be nouns: `age`, `user`               |
+| `update-db`, `save-model`                    | Missing `!` for side effects: `update-db!`, `save-model!`   |
+| `snake_case_var`                             | Should use kebab-case                                       |
+| Public var without docstring                 | Add docstring explaining purpose                            |
+| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 2025-01-01) -- description` |
+| `(defn foo ...)` in namespace used elsewhere | Should be `(defn ^:private foo ...)`                        |
+| Function > 20 lines                          | Consider breaking up into smaller functions                 |
+| `/api/dashboards/:id`                        | Use singular: `/api/dashboard/:id`                          |
+| Query params with `snake_case`               | Use kebab-case for query params                             |
+| New API endpoint without tests               | Add tests for the endpoint                                  |
+
+## Feedback format examples
+
+**For style violations:**
+
+> This pure function should be named as a noun describing its return value. Consider `user` instead of `get-user`.
+
+**For missing documentation:**
+
+> This public var needs a docstring explaining its purpose, inputs, and outputs.
+
+**For organization issues:**
+
+> This function is only used in this namespace, so it should be marked `^:private`.
+
+**For API conventions:**
+
+> Query parameters should use kebab-case. Change `user_id` to `user-id`.

.claude/skills/clojure-write/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: clojure-write
+description: Guide Clojure and ClojureScript development using REPL-driven workflow, coding conventions, and best practices. Use when writing, developing, or refactoring Clojure/ClojureScript code.
+---
+
+# Clojure Development Skill
+
+## Tool Preference
+
+When `clojure-mcp` tools are available (e.g., `clojure_eval`, `clojure_edit`), **always use them**
+instead of shell commands like `./bin/mage -repl`. The MCP tools provide:
+- Direct REPL integration without shell escaping issues
+- Better error messages and feedback
+- Structural Clojure editing that prevents syntax errors
+
+Only fall back to `./bin/mage` commands when clojure-mcp is not available.
+
+@./../_shared/development-workflow.md
+@./../_shared/clojure-style-guide.md
+@./../_shared/clojure-commands.md
+
+## REPL-Driven Development Workflow
+
+- Start with small, fundamental functions:
+- Identify the core features or functionalities required for your task.
+- Break each feature down into the smallest, most basic functions that can be developed and tested independently.
+- Write and test in the REPL:
+  - Write the code for each small function directly in the REPL (Read-Eval-Print Loop).
+  - Test it thoroughly with a variety of inputs, including typical use cases and relevant edge cases, to ensure it
+    behaves as expected.
+- Integrate into source code:
+  - Once a function works correctly in the REPL, move it from the REPL environment into your source code files (e.g.,
+    within appropriate namespaces).
+- Gradually increase complexity:
+  - Build upon tested, basic functions to create more complex functions or components.
+  - Compose smaller functions together, testing each new composition in the REPL to verify correctness step by step.
+- Ensure dependency testing:
+  - Make sure every function is fully tested in the REPL before it is depended upon by other functions.
+  - This ensures that each layer of your application is reliable before you build on it.
+- Use the REPL fully:
+  - Use the REPL as your primary tool to experiment with different approaches, iterate quickly, and get immediate
+    feedback on your code.
+- Follow functional programming principles:
+  - Keep functions small, focused, and composable.
+  - Use Clojure's functional programming features—like immutability, higher-order functions, and the standard
+    library—to write concise, effective code.
+
+## How to Evaluate Code
+
+### Bottom-up Dev Loop
+
+1. Write code into a file.
+2. Evaluate the file's namespace and make sure it loads correctly with:
+
+```
+./bin/mage -repl --namespace metabase.app-db.connection
+```
+
+3. Call functions in the namespace with test inputs, and observe that the outputs are correct
+   Feel free to copy these REPL session trials into actual test cases using `deftest` and `is`.
+4. Once you know these functions are good, return to 1, and compose them into the task that you need to build.
+
+## Critical Rules for Editing
+
+- Be careful with parentheses counts when editing Clojure code
+- After EVERY change to Clojure code, verify readability with `-check-readable`
+- End all files with a newline
+- When editing tabular code, where the columns line up, try to keep them aligned
+- Spaces on a line with nothing after it is not allowed

.claude/skills/docs-review/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: docs-review
+description: Review documentation changes for compliance with the Metabase writing style guide. Use when reviewing pull requests, files, or diffs containing documentation markdown files.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# Documentation Review Skill
+
+@./../_shared/metabase-style-guide.md
+
+## Review mode detection
+
+**IMPORTANT: Before starting the review, determine which mode to use:**
+
+1. **PR review mode**: If the `mcp__github__create_pending_pull_request_review` tool is available, you are reviewing a GitHub PR
+   - Use the pending review workflow to post all issues as one cohesive review
+   - Follow the workflow steps in "PR review mode format" below
+
+2. **Local review mode**: If the MCP tool is NOT available, output issues in the conversation
+   - Format all issues in a numbered markdown list (as described in "Feedback format" below)
+
+## Review process
+
+1. **Detect review mode** - Check if `mcp__github__create_pending_pull_request_review` is available
+2. Read the changes through once to understand intent
+3. Check all issues that violate style guide or significantly impact readability
+4. Only flag issues worth mentioning - if it won't make a material difference to the reader, skip it
+5. **REQUIRED: Number ALL feedback sequentially** - Start from Issue 1 and increment for each issue found
+
+## Review checklist
+
+Run through the diff looking for these issues:
+
+**Tone and voice:**
+
+- [ ] Formal/corporate language ("utilize" not "use", "offerings", etc.)
+- [ ] "Users" instead of "people" or "companies"
+- [ ] Excessive exclamation points or overly peppy tone
+- [ ] Telling readers something is cool instead of showing them
+
+**Structure and clarity:**
+
+- [ ] Important information buried instead of leading
+- [ ] Verbose text that adds little value
+- [ ] Paragraphs without clear purpose
+- [ ] Vague headings that don't convey the point
+- [ ] Instructions explain "why" before telling "what to do"
+- [ ] Tasks described as "easy" or "simple"
+
+**Links and references:**
+
+- [ ] Linking the word "here" instead of descriptive text
+- [ ] Links in headings (unless entire heading is a link)
+
+**Formatting:**
+
+- [ ] Ampersands as "and" substitute (except proper nouns)
+- [ ] Inconsistent list formatting
+
+**Code and examples:**
+
+- [ ] Code examples that don't work or would error
+- [ ] Commands not in execution order
+- [ ] Full-width screenshots instead of scoped UI elements
+- [ ] Excessive or unnecessary images
+
+**Sentence construction:**
+
+- [ ] Overuse of pronouns when introducing new terms
+
+## Quick scan table
+
+| Pattern                       | Issue                                         |
+| ----------------------------- | --------------------------------------------- |
+| we can do X, our feature      | Should be "Metabase" or "it"                  |
+| click here, read more here    | Need descriptive link text                    |
+| easy, simple, just            | Remove condescending qualifiers               |
+| users                         | Should be "people" or "companies" if possible |
+
+## Feedback format
+
+**MANDATORY REQUIREMENT: Every single issue MUST be numbered sequentially starting from Issue 1.**
+
+This numbered format is NON-NEGOTIABLE. It allows users to efficiently reference specific issues (e.g., "fix issues 1, 3, and 5") and track which feedback has been addressed.
+
+### Local review mode format
+
+When outputting issues in the conversation (local mode), use this format:
+
+```markdown
+## Issues
+
+**Issue 1: [Brief title]**
+Line X: Succinct description of the issue
+[code or example]
+Suggested fix or succinct explanation
+
+**Issue 2: [Brief title]**
+Line Y: Description of the issue
+Suggested fix or explanation
+
+**Issue 3: [Brief title]**
+...
+```
+
+**Examples:**
+
+> **Issue 1: Formal tone**
+> Line 15: This could be more conversational. Consider: "You can't..." instead of "You cannot..."
+
+> **Issue 2: Vague heading**
+> Line 8: The heading could be more specific. Try stating the point directly: "Run migrations before upgrading" vs "Upgrade process"
+
+### PR review mode format
+
+When posting to GitHub (PR mode), use the **pending review workflow**:
+
+**Workflow steps:**
+
+1. **Start a review**: Use `mcp__github__create_pending_pull_request_review` to begin a pending review
+   - This creates a draft review that won't be visible until submitted
+
+2. **Get diff information**: Use `mcp__github__get_pull_request_diff` to understand the code changes and line numbers
+   - This helps you determine the correct file paths and line numbers for comments
+
+3. **Identify ALL issues**: Read through all changes and identify every issue worth mentioning
+   - Collect all issues before posting any comments
+   - Number them sequentially (Issue 1, Issue 2, Issue 3, etc.)
+
+4. **Add review comments**: Use `mcp__github__add_pull_request_review_comment_to_pending_review` for each issue
+   - **CRITICAL**: Post ALL comments in a SINGLE response using multiple tool calls in parallel
+   - Each comment should reference a specific file path and line number from the diff
+   - Start each comment body with `**Issue N: [Brief title]**`
+   - Include the description and suggested fix
+
+5. **Submit the review**: Use `mcp__github__submit_pending_pull_request_review` to publish all comments at once
+   - Use event type `"COMMENT"` (NOT "REQUEST_CHANGES") to make it non-blocking
+   - **Do NOT include a body message** - Leave the body empty or omit it entirely
+   - All comments will appear together as one cohesive review
+
+**Comment format example:**
+
+```
+**Issue 1: Formal tone**
+
+This could be more conversational. Consider: "You can't..." instead of "You cannot..."
+```
+
+**IMPORTANT**:
+- Each issue gets its own review comment attached to the pending review
+- Number ALL comments sequentially (Issue 1, Issue 2, Issue 3, etc.)
+- Always start the comment body with `**Issue N: [Brief title]**`
+- **MUST add all comments in parallel in a single response** - Do NOT add them one after another in separate responses
+- Do NOT output a summary message to the conversation - only post GitHub review comments
+- When submitting the review, do NOT include a body parameter (or leave it empty) to avoid cluttering the PR with summary text
+- The review will appear as a single review with multiple comments when submitted
+
+## Final check
+
+1. Remove any issues from your assessment that won't make a material difference to the reader if addressed. Only flag issues worth the author's time to fix.
+2. **Verify all issues are numbered sequentially** starting from Issue 1 with no gaps in numbering.
+3. Confirm the format exactly matches: `**Issue N: [Brief title]**` where N is the issue number.
+4. **In PR mode**: Verify each issue was posted as a separate GitHub comment (not output to conversation).

.claude/skills/docs-write/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: docs-write
+description: Write documentation following Metabase's conversational, clear, and user-focused style. Use when creating or editing documentation files (markdown, MDX, etc.).
+allowed-tools: Read, Write, Grep, Bash, Glob
+---
+
+# Documentation Writing Skill
+
+@./../_shared/metabase-style-guide.md
+
+## When writing documentation
+
+### Start here
+
+1. **Who is this for?** Match complexity to audience. Don't oversimplify hard things or overcomplicate simple ones.
+2. **What do they need?** Get them to the answer fast. Nobody wants to be in docs longer than necessary.
+3. **What did you struggle with?** Those common questions you had when learning? Answer them (without literally including the question).
+
+### Writing process
+
+**Draft:**
+
+- Write out the steps/explanation as you'd tell a colleague
+- Lead with what to do, then explain why
+- Use headings that state your point: "Set SAML before adding users" not "SAML configuration timing"
+
+**Edit:**
+
+- Read aloud. Does it sound like you talking? If it's too formal, simplify.
+- Cut anything that doesn't directly help the reader
+- Check each paragraph has one clear purpose
+- Verify examples actually work (don't give examples that error)
+
+**Polish:**
+
+- Make links descriptive (never "here")
+- Backticks only for code/variables, **bold** for UI elements
+- American spelling, serial commas
+- Keep images minimal and scoped tight
+
+**Format:**
+
+- Run prettier on the file after making edits: `bun run prettier --write <file-path>`
+- This ensures consistent formatting across all documentation
+
+### Common patterns
+
+**Instructions:**
+
+```markdown
+Run:
+\`\`\`
+command-to-run
+\`\`\`
+
+Then:
+\`\`\`
+next-command
+\`\`\`
+
+This ensures you're getting the latest changes.
+```
+
+Not: "(remember to run X before Y...)" buried in a paragraph.
+
+**Headings:**
+
+- "Use environment variables for configuration" ✅
+- "Environment variables" ❌ (too vague)
+- "How to use environment variables for configuration" ❌ (too wordy)
+
+**Links:**
+
+- "Check out the [SAML documentation](link)" ✅
+- "Read the docs [here](link)" ❌
+
+### Watch out for
+
+- Describing tasks as "easy" (you don't know the reader's context)
+- Using "we" when talking about Metabase features (use "Metabase" or "it")
+- Formal language: "utilize", "reference", "offerings"
+- Too peppy: multiple exclamation points
+- Burying the action in explanation
+- Code examples that don't work
+- Numbers that will become outdated
+
+### Quick reference
+
+| Write This                 | Not This           |
+| -------------------------- | ------------------ |
+| people, companies          | users              |
+| summarize                  | aggregate          |
+| take a look at             | reference          |
+| can't, don't               | cannot, do not     |
+| **Filter** button          | \`Filter\` button  |
+| Check out [the docs](link) | Click [here](link) |

.claude/skills/e2e-test-create/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: e2e-test-create
+description: >
+  Analyze React component source code to understand UI structure,
+  then generate idiomatic Cypress E2E tests following Metabase conventions.
+  Falls back to Playwright MCP browser exploration only when code reading
+  and screenshot debugging are insufficient.
+disable-model-invocation: true
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - Skill
+  - "mcp__playwright__*"
+---
+
+# Code-Reading-First → Generate Cypress Tests (Metabase)
+
+You are writing Cypress E2E tests for the **Metabase** codebase.
+Before generating ANY test code, you MUST analyze React component source code
+to understand DOM structure, selectors, and user flows.
+
+## Phase 0 — Research
+
+1. Read existing helpers before writing anything:
+   - `e2e/support/helpers/` — all shared helpers (restore, signInAs, openOrdersTable, etc.)
+   - `e2e/support/cypress_sample_database.ts` — table/field schema constants (ORDERS, PRODUCTS, etc.)
+   - `e2e/support/cypress_sample_instance_data.ts` — instance-specific IDs (ORDERS_DASHBOARD_ID, NORMAL_USER_ID, etc.)
+2. Glob `e2e/test/scenarios/` to find the closest existing spec to the area under test.
+   Study its patterns — match them exactly.
+3. Glob `frontend/src/metabase/` to find React components for the feature area.
+
+## Phase 1 — Code Analysis
+
+Read React component source to understand DOM structure. No browser needed — source code has everything.
+
+1. **Find relevant components**: Glob and grep `frontend/src/metabase/` for the feature area.
+2. **Extract selectors**: Grep for `data-testid` in relevant components.
+3. **Note visible text**: Read component JSX for button labels, headings, placeholders.
+4. **Note aria attributes**: Grep for `aria-label` in relevant components.
+5. **Understand user flows**: Read event handlers (onClick, onSubmit, onChange) to understand interactions.
+6. **Find API calls**: Grep for `Api.use`, `fetch`, `useQuery`, endpoint definitions to identify API calls to intercept.
+7. **Cross-reference with existing specs**: Find specs in the same area and reuse their proven selectors and `cy.intercept` patterns.
+
+## Phase 2 — Start Backend
+
+Use `MB_EDITION=oss` by default. Only use `MB_EDITION=ee` when the user explicitly asks to write an enterprise test.
+
+Start the backend using `run_in_background: true` (NOT `&`).
+`bin/e2e-backend` automatically detects if a backend is already running and reuses it.
+```bash
+MB_EDITION=oss bin/e2e-backend
+```
+
+Do NOT manually generate snapshots by running unrelated test specs.
+The `bun test-cypress` runner has `GENERATE_SNAPSHOTS: true` by default and automatically
+generates snapshots before running any spec. When running tests in Phase 4 via the `/e2e-test` skill,
+snapshots will be generated on the first run if they don't already exist.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+## Phase 3 — Generate Cypress Spec
+
+### File location & naming
+
+Place specs in `e2e/test/scenarios/<area>/` mirroring the URL structure.
+Name: `<feature>.cy.spec.js` (NOT `.cy.spec.ts`).
+
+### Metabase conventions (mandatory)
+
+- **Helpers via `cy.H`**: All helpers are accessed via `const { H } = cy;` — NOT via direct imports from `e2e/support/helpers`.
+
+```js
+const { H } = cy;
+
+describe("feature name", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+});
+```
+
+- **Sample Database schema** (table/field definitions): Import from `cypress_sample_database`.
+
+```js
+import { ORDERS, ORDERS_ID, PRODUCTS } from "e2e/support/cypress_sample_database";
+```
+
+- **Instance data** (dashboard IDs, user IDs, etc.): Import from `cypress_sample_instance_data`.
+
+```js
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+```
+
+- **Selectors** (priority order):
+  1. `cy.findByText()` / `cy.findByLabelText()` / `cy.findByRole()` — from `@testing-library/cypress`
+  2. `cy.findByTestId()` — for `data-testid` attributes
+  3. `cy.get("[data-testid='...']")` — fallback
+  4. NEVER use positional selectors, CSS class names, or XPaths.
+
+- **Navigation helpers**: Use existing helpers like `H.openOrdersTable()`, `H.openNativeEditor()`,
+  `H.visitDashboard(id)`, `H.visitQuestion(id)` instead of raw `cy.visit()` chains.
+  Grep `e2e/support/helpers/` to discover what's available for your area.
+
+- **API setup over UI setup**: Use `cy.request()` or existing API helpers to set up state.
+  Only use the UI for the flow you're actually testing.
+
+- **Assertions**: Assert on visible text, URL, aria state — not DOM structure.
+
+- **Waits**: Never use `cy.wait(ms)`. Use `cy.intercept()` + `cy.wait("@alias")` for API calls,
+  or `cy.findByText().should("be.visible")` for DOM readiness.
+
+- **Isolation**: Each `it()` block must be independently runnable.
+  Don't depend on state from a previous `it()`.
+
+### Spec structure template
+
+```js
+const { H } = cy;
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+import { ORDERS, ORDERS_ID } from "e2e/support/cypress_sample_database";
+
+describe("area > sub-area > feature (#issue-number)", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+
+  it("should do the primary happy-path thing", () => {
+    // test
+  });
+
+  it("should handle the edge case", () => {
+    // test
+  });
+});
+```
+
+### Intercepts
+
+When you identified API calls during code analysis, stub or wait on them:
+
+```js
+cy.intercept("POST", "/api/dataset").as("dataset");
+// ... trigger action ...
+cy.wait("@dataset");
+```
+
+## Phase 4 — Validate
+
+After generating specs:
+1. Check that all imported helpers exist (Grep `e2e/support/helpers/`).
+2. **You MUST use the `/e2e-test` skill** to run tests — do NOT run `bun test-cypress` directly.
+   The `/e2e-test` skill handles edition selection, snapshot management, and correct env vars.
+   `/e2e-test GREP="should do the thing" --spec e2e/test/scenarios/<path>`
+   If you created multiple `it()` blocks, run each one individually to isolate failures.
+
+## Phase 5 — Fix Failures (up to 2 attempts)
+
+When a test fails, **try to fix it from Cypress output first**:
+1. Read the failure screenshot (path printed under `(Screenshots)`).
+2. Read the error message and code frame from the console output.
+3. Fix the test and re-run (back to Phase 4, step 2).
+
+If you cannot diagnose the issue after 2 attempts, proceed to Phase 6.
+
+## Phase 6 — Playwright Fallback
+
+Only reach this phase after 2 failed fix attempts from Phase 5. The backend is already running.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+**Bypass CSP** headers before navigating (Metabase serves strict CSP that blocks dev server scripts).
+Use `browser_run_code` to set this up:
+
+```js
+async (page) => {
+  // Strip CSP headers so the page loads (mirrors Cypress chromeWebSecurity: false)
+  await page.context().route('**/*', async (route) => {
+    const response = await route.fetch();
+    const headers = { ...response.headers() };
+    delete headers['content-security-policy'];
+    delete headers['content-security-policy-report-only'];
+    await route.fulfill({ response, headers });
+  });
+
+  // Sign in via API
+  const response = await page.request.post('http://localhost:4000/api/session', {
+    data: { username: 'admin@metabase.test', password: '12341234' }
+  });
+  const session = await response.json();
+  await page.context().addCookies([{
+    name: 'metabase.DEVICE',
+    value: session.id,
+    domain: 'localhost',
+    path: '/'
+  }]);
+
+  await page.goto('http://localhost:4000');
+  await page.waitForLoadState('networkidle');
+  return 'signed in';
+}
+```
+
+**Maintain an observation log incrementally.** After EVERY significant Playwright interaction,
+IMMEDIATELY append what you observed to the scratch file BEFORE performing the next interaction:
+
+```bash
+cat >> /tmp/e2e-observations.md << 'OBSERVATION'
+## [Page/Flow name]
+- URL: /question/notebook#...
+- Clicked: "Box plot" button → visible text "Box plot", role: radio
+- Selectors: data-testid="viz-type-button", findByText("Box plot")
+- API call: POST /api/dataset (triggered on viz change)
+- Key state: after selecting viz type, summary sidebar shows metric picker
+OBSERVATION
+```
+
+For each page/flow:
+- Take an accessibility snapshot (`browser_snapshot`).
+- Click through interactive elements, fill forms, trigger modals.
+- **Append to the observation log immediately after each step**: URLs, visible text, aria labels, `data-testid` attrs, API calls.
+- Screenshot key states.
+
+After exploration:
+1. Read back your observation log: `cat /tmp/e2e-observations.md`
+2. Fix the test using observed selectors and behavior.
+3. Re-run the test (back to Phase 4).
+4. Clean up: `rm -f /tmp/e2e-observations.md`
+
+## Phase 7 — Cleanup
+
+After all tests pass (or after giving up on fixing failures), **always kill the backend on port 4000**:
+```bash
+lsof -ti:4000 | xargs kill 2>/dev/null || true
+```
+
+Do NOT use broad `pkill` patterns — there may be other Metabase instances on different ports.
+The backend process started in Phase 2 will NOT be killed automatically when the Claude session ends.
+Leaving it running wastes resources and can interfere with future sessions. Always clean up.
+
+## What NOT to do
+
+- Do NOT use Playwright as the first step — always analyze source code first.
+- Do NOT kill the backend between phases — it stays running throughout.
+- Do NOT invent selectors you didn't find in source code or observe in the browser.
+- Do NOT hardcode database IDs — import from `cypress_sample_database` or `cypress_sample_instance_data`.
+- Do NOT use `cy.wait(1000)` or any numeric wait.
+- Do NOT create setup flows through the UI when an API helper exists.
+- Do NOT put tests in `cypress/e2e/` — Metabase uses `e2e/test/scenarios/`.
+- Do NOT import helpers directly from `e2e/support/helpers` — use `const { H } = cy;`.

.claude/skills/e2e-test/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: e2e-test
+description: Run Cypress E2E tests, analyze failures including screenshots, and stress test for flakiness
+disable-model-invocation: false
+---
+
+Run Cypress E2E test: $ARGUMENTS
+
+## Edition selection
+
+**Default: `MB_EDITION=oss`** — runs without enterprise tokens, simpler and faster.
+
+Only use `MB_EDITION=ee` when the user explicitly asks to write or run an enterprise test.
+
+**For `MB_EDITION=ee`:**
+These tokens must be exported in the shell before starting Claude Code:
+- `CYPRESS_MB_ALL_FEATURES_TOKEN` — all features (most EE tests need this)
+- `CYPRESS_MB_PRO_SELF_HOSTED_TOKEN` — pro self-hosted (permissions, SSO, sandboxing)
+- `CYPRESS_MB_STARTER_CLOUD_TOKEN` — starter plan (rarely needed)
+- `CYPRESS_MB_PRO_CLOUD_TOKEN` — pro cloud (rarely needed)
+
+**NEVER echo, print, or log token values. Only check if they are set:**
+```bash
+echo "ALL_FEATURES: ${CYPRESS_MB_ALL_FEATURES_TOKEN:+set}" && echo "PRO_SELF_HOSTED: ${CYPRESS_MB_PRO_SELF_HOSTED_TOKEN:+set}" && echo "STARTER: ${CYPRESS_MB_STARTER_CLOUD_TOKEN:+set}" && echo "PRO_CLOUD: ${CYPRESS_MB_PRO_CLOUD_TOKEN:+set}"
+```
+
+If tokens are missing, tell the user: "EE tokens are not set. Either export them and restart Claude Code, or add `MB_EDITION=oss` to run OSS-only tests."
+
+## Running
+
+First check if snapshots exist:
+```bash
+ls e2e/snapshots/default.sql 2>/dev/null && echo "snapshots exist" || echo "snapshots missing"
+```
+
+If snapshots exist, skip regeneration for speed:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress $ARGUMENTS
+```
+
+If snapshots are missing (first run), let the runner generate them:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress $ARGUMENTS
+```
+
+When running enterprise tests, replace `MB_EDITION=oss` with `MB_EDITION=ee` in the commands above.
+
+If `$ARGUMENTS` is empty, ask the user which spec to run.
+
+If the user provides a test name or fuzzy name instead of a spec path, find the spec file:
+```bash
+find e2e/test/scenarios -name "*FUZZY_NAME*.cy.spec.*" -type f
+```
+Then run with `--spec "path/to/matched.cy.spec.js"`.
+
+To filter by test name, use the `GREP` env var (not `--env grep=`, which breaks on commas):
+```bash
+GREP="test name here" MB_EDITION=oss bun test-cypress --spec path/to/spec.js
+```
+
+## Stress test (flaky detection)
+
+When the user asks to verify a test is not flaky:
+
+```bash
+MB_EDITION=oss bin/e2e-stress-test $ARGUMENTS
+```
+
+Set `E2E_STRESS_RUNS=N` for more iterations (default: 5). Stops on first failure and prints screenshot paths. Read those screenshots to analyze the failure.
+
+## Analyzing failures
+
+When tests fail:
+
+1. Read the **screenshot** for each failure — paths are printed in Cypress output under `(Screenshots)`, typically at `cypress/screenshots/<spec-name>/<test-name> (failed).png`
+2. Read the error message and code frame from the console output
+3. Identify the root cause: is it a test bug, a product bug, or a timing issue?
+4. Suggest a fix with specific code changes

.claude/skills/emotion-migrate/SKILL.md

@@ -0,0 +1,834 @@
+---
+name: emotion-migrate
+description: Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports from components.
+---
+
+# Emotion → Mantine + CSS Modules Migration Skill
+
+Migrate Emotion styled-components (`@emotion/styled`, `@emotion/react`) to Mantine layout components with style props and CSS modules. The goal is zero Emotion imports, zero inline styles, and maximum use of design system tokens.
+
+## Priority Order (Strict)
+
+1. **Mantine components + style props** — `Box`, `Flex`, `Stack`, `Group`, `Text`, `Title`, `Card`. This is the DEFAULT. Every CSS property must be checked against style props FIRST.
+2. **CSS modules** (`.module.css`) — ONLY for properties that Mantine style props genuinely cannot express: pseudo-selectors (`:hover`, `:focus`, `::before`), `box-shadow`, `border` shorthand, `animation`/`@keyframes`, complex selectors, `cursor`, `pointer-events`, `overflow`, `text-overflow`, `white-space`, `transition`.
+3. **Inline styles ONLY for dynamic values** — `style={{ }}` is allowed only for truly dynamic runtime values (e.g., computed widths, positions, data-driven colors). All static styles must use Mantine props or CSS modules.
+
+### Mantine-First Decision Gate (CRITICAL)
+
+For EACH styled component, go through every CSS property and ask: "Can this be a Mantine style prop?" If yes → style prop. If no → CSS module. Do NOT dump an entire component into a CSS module just because one property needs it — split them.
+
+**Properties that ARE style props** (use these, not CSS modules):
+
+- `display` → `display` prop
+- `color` → `c` prop (`c="brand"`, `c="text-primary"`)
+- `background-color` → `bg` prop (`bg="background-primary"`)
+- `font-size` → `fz` prop (`fz="md"`)
+- `font-weight` → `fw` prop (`fw="bold"`)
+- `line-height` → `lh` prop (`lh="md"`)
+- `text-align` → `ta` prop (`ta="center"`)
+- `padding` (all variants) → `p`, `px`, `py`, `pt`, `pb`, `pl`, `pr`
+- `margin` (all variants) → `m`, `mx`, `my`, `mt`, `mb`, `ml`, `mr`
+- `width` → `w`, `min-width` → `miw`, `max-width` → `maw`
+- `height` → `h`, `min-height` → `mih`, `max-height` → `mah`
+- `flex` → `flex` prop (`flex="0 0 auto"`, `flex={1}`)
+- `gap` → `gap` prop (on Flex/Stack/Group)
+- `align-items` → `align` prop (on Flex/Stack/Group)
+- `justify-content` → `justify` prop (on Flex/Stack/Group)
+- `flex-direction` → `direction` prop (on Flex)
+- `flex-wrap` → `wrap` prop (on Flex)
+- `position` → `pos` prop
+- `top/right/bottom/left` → `top`, `right`, `bottom`, `left` props
+- `opacity` → `opacity` prop
+
+**Properties that NEED CSS modules** (no style prop equivalent):
+
+- `:hover`, `:focus`, `:active`, `::before`, `::after` (pseudo-selectors)
+- `box-shadow`, `border` (shorthand with color), `outline`
+- `cursor`, `pointer-events`
+- `overflow`, `text-overflow`, `white-space`
+- `animation`, `transition`, `transform`
+- `@media` queries (UNLESS it's simple responsive spacing/sizing — then use responsive syntax: `p={{ base: "md", lg: "xl" }}`)
+
+**Hybrid approach** — when a component needs BOTH, put style props on the Mantine component AND add a CSS module class for the rest:
+
+```tsx
+<Flex
+  className={S.root}       /* for :hover, box-shadow, border */
+  align="center"            /* style prop */
+  gap="sm"                  /* style prop */
+  p="md"                    /* style prop */
+  bg="background-primary"   /* style prop */
+>
+```
+
+## CSS Module Conventions (Strict)
+
+### Class Naming: camelCase
+
+All CSS module class names MUST use **camelCase**. This is the dominant convention across the codebase (~830 camelCase vs ~620 PascalCase classes), used consistently in Mantine UI components, and matches standard CSS module conventions.
+
+```css
+/* CORRECT */
+.root {
+}
+.settingsSection {
+}
+.dragHandle {
+}
+.closeIcon {
+}
+
+/* WRONG — do not use PascalCase or kebab-case */
+.ItemRoot {
+}
+.settings-section {
+}
+```
+
+Modifier/state classes also use camelCase:
+
+```css
+.selected {
+}
+.disabled {
+}
+.interactive {
+}
+.draggable {
+}
+```
+
+### No Cascading — Direct Class Assignment
+
+Cascading selectors are **discouraged**. Instead of styling through parent-child relationships, assign a class directly to the element that needs styling.
+
+```css
+/* WRONG — cascading/descendant selectors */
+.root > input {
+}
+.root .label {
+}
+.container > div > span {
+}
+
+/* CORRECT — direct class on the target element */
+.input {
+}
+.label {
+}
+.title {
+}
+```
+
+The only acceptable nesting patterns are:
+
+- **Pseudo-selectors on the same element**: `.item { &:hover { } }`
+- **Modifier composition**: `.item { &.selected { } }`
+- **Hover-reveal patterns** where a parent hover affects a child: `.root:hover .showOnHover { opacity: 1; }` — but only when structurally necessary (the child has no way to know about the parent's hover state)
+
+### Import Alias
+
+Always import the CSS module as `S`:
+
+```tsx
+import S from "./ComponentName.module.css";
+```
+
+## Step-by-Step Migration Process
+
+### Step 1: Read and Understand
+
+Read the `.styled.tsx` file AND every component that imports from it. Understand:
+
+- Which styled components are used and where
+- Which props drive dynamic styles
+- Which styles are static vs conditional
+- Which styles can map directly to Mantine style props
+
+### Step 2: Classify Each Styled Component
+
+For each styled component, apply the Mantine-First Decision Gate above. Then determine the migration target:
+
+| Emotion Pattern                                              | Migration Target                                                                                                                                                           |
+| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `styled.div` with only layout/spacing/color                  | `Box`, `Flex`, `Stack`, or `Group` with style props. **NO CSS module needed.**                                                                                             |
+| `styled.div` with flexbox column                             | `Stack` component with style props                                                                                                                                         |
+| `styled.div` with flexbox row                                | `Flex` or `Group` component with style props                                                                                                                               |
+| `styled.span` / `styled.p` with color/weight/size            | **`Text component="span"` with style props** (`c`, `fw`, `fz`). NO CSS module.                                                                                             |
+| `styled.div` with hover/focus/pseudo-selectors               | **Hybrid**: Mantine component with style props for expressible properties + CSS module class for pseudo-selectors only                                                     |
+| `styled.div` with media queries (simple spacing/sizing)      | **Responsive style props**: `p={{ base: "md", lg: "xl" }}`. NO CSS module.                                                                                                 |
+| `styled.div` with media queries (complex/non-spacing)        | CSS module for the media query parts, style props for the rest                                                                                                             |
+| `styled.div` with animations/keyframes                       | CSS module for animation, style props for layout                                                                                                                           |
+| `styled(SomeComponent)` with only color/spacing/flex         | **Wrap in Mantine component** with style props: `<Box c="brand" flex="0 0 auto"><Icon /></Box>`, or pass style props if the component accepts them                         |
+| `styled(SomeComponent)` with pseudo-selectors/complex styles | CSS module `className` on the component                                                                                                                                    |
+| Dynamic props `styled.div<{ isActive: boolean }>`            | Mantine style props for simple toggles (`c={active ? "brand" : "text-primary"}`), `cx()` with CSS module classes for complex state combinations involving pseudo-selectors |
+
+### Step 3: Create CSS Module (if needed)
+
+Create `ComponentName.module.css` alongside the component file:
+
+```css
+/* Use design system tokens — NEVER raw color/spacing values */
+.root {
+  border: 1px solid var(--mb-color-border);
+  border-radius: var(--mantine-radius-md);
+  background-color: var(--mb-color-background-primary);
+}
+
+/* Conditional states as separate classes, combined with cx() */
+.active {
+  background-color: var(--mb-color-brand);
+  color: var(--mb-color-text-primary-inverse);
+}
+
+.disabled {
+  color: var(--mb-color-text-tertiary);
+  pointer-events: none;
+}
+
+/* Hover/focus/pseudo-selectors — nest with & */
+.interactive {
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand);
+    background-color: var(--mb-color-background-hover);
+  }
+}
+
+/* Hover-reveal: acceptable parent→child nesting */
+.root:hover .showOnHover {
+  opacity: 1;
+}
+
+/* Responsive styles */
+@media (--breakpoint-min-md) {
+  .root {
+    padding: var(--mantine-spacing-lg);
+  }
+}
+```
+
+### Step 4: Update the Component TSX
+
+```tsx
+import cx from "classnames";
+import CS from "metabase/css/core/index.css";
+import { Box, Flex, Group, Stack, Text } from "metabase/ui";
+import S from "./ComponentName.module.css";
+
+// Dynamic props → cx() with conditional classes
+<Flex
+  className={cx(S.root, {
+    [S.active]: isActive,
+    [S.disabled]: disabled,
+  })}
+  align="center"
+  gap="sm"
+  p="md"
+  w="100%"
+>
+```
+
+### Step 5: Delete the `.styled.tsx` File
+
+Remove the old styled file entirely. Remove all imports of it from other files.
+
+### Step 6: Verify
+
+- Confirm zero `@emotion/styled` or `@emotion/react` imports remain in the migrated files
+- Confirm no static inline styles (dynamic runtime values are fine)
+- Confirm all colors use tokens, not raw hex/rgb values
+
+## Design System Token Reference
+
+### Mantine Style Props (use directly on components)
+
+**Spacing** (`p`, `px`, `py`, `pt`, `pb`, `pl`, `pr`, `m`, `mx`, `my`, `mt`, `mb`, `ml`, `mr`):
+
+- `"xs"` = 4px, `"sm"` = 8px, `"md"` = 16px, `"lg"` = 24px, `"xl"` = 32px
+- Custom: `rem(48)` for non-standard values (import `rem` from `metabase/ui`)
+
+**Dimensions** (`w`, `h`, `maw`, `mah`, `miw`, `mih`):
+
+- `"100%"`, `"100vh"`, `rem(400)`, etc.
+
+**Colors** (`c`, `bg`):
+
+- Text: `"text-primary"`, `"text-secondary"`, `"text-tertiary"`
+- Background: `"background-primary"`, `"background-secondary"`, `"background-hover"`
+- Brand: `"brand"`, `"error"`, `"success"`, `"warning"`
+
+**Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
+
+- Font size: `"xs"` = 11px, `"sm"` = 12px, `"md"` = 14px, `"lg"` = 17px, `"xl"` = 21px
+- Font weight: `"bold"`, `"normal"`, or numeric `700`
+- Line height: `"xs"` = 100%, `"sm"` = 115%, `"md"` = 122%, `"lg"` = 138%, `"xl"` = 150%
+- Text align: `"center"`, `"left"`, `"right"`
+
+**Flexbox** (`align`, `justify`, `gap`, `direction`, `wrap`, `flex`):
+
+- `align="center"`, `justify="space-between"`, `gap="sm"`, `direction="column"`, `wrap="nowrap"`
+- `flex={1}`, `flex="0 0 auto"`
+
+**Other**: `pos` (position), `display`
+
+**Responsive syntax**: `px={{ base: "md", md: "lg", lg: rem(48) }}`
+
+### CSS Variable Tokens (use in `.module.css` files)
+
+**Colors** — `var(--mb-color-<name>)`:
+
+- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-tertiary`
+- `--mb-color-background-primary`, `--mb-color-background-secondary`, `--mb-color-background-hover`
+- `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
+- `--mb-color-brand`, `--mb-color-brand-hover`
+- `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
+- `--mb-color-shadow`, `--mb-color-focus`
+- `--mb-color-accent0` through `--mb-color-accent7`
+
+**Mantine spacing** — `var(--mantine-spacing-<size>)`:
+
+- `--mantine-spacing-xs` (4px), `--mantine-spacing-sm` (8px), `--mantine-spacing-md` (16px), `--mantine-spacing-lg` (24px), `--mantine-spacing-xl` (32px)
+
+**Mantine radius** — `var(--mantine-radius-<size>)`:
+
+- `--mantine-radius-xs` (4px), `--mantine-radius-sm` (6px), `--mantine-radius-md` (8px), `--mantine-radius-xl` (40px)
+
+**Mantine font sizes** — `var(--mantine-font-size-<size>)`:
+
+- `--mantine-font-size-xs` (11px), `--mantine-font-size-sm` (12px), `--mantine-font-size-md` (14px), `--mantine-font-size-lg` (17px), `--mantine-font-size-xl` (21px)
+
+**Breakpoints** (in `.module.css` files):
+
+- `@media (--breakpoint-min-sm)` (40em / 640px)
+- `@media (--breakpoint-min-md)` (60em / 960px)
+- `@media (--breakpoint-min-lg)` (80em / 1280px)
+- `@media (--breakpoint-min-xl)` (120em / 1920px)
+- Also available: `--breakpoint-max-*` variants
+
+### Snap Hardcoded Literals to Nearest Design Token (CRITICAL)
+
+When migrating, **never carry over hardcoded `rem`/`px` values** from the original Emotion code. Instead, snap them to the nearest design system token. The original values were often arbitrary — the migration is an opportunity to align with the design system.
+
+**Spacing** — snap to the nearest Mantine spacing token:
+
+| Hardcoded value                   | Nearest token | Style prop   | CSS variable                   |
+| --------------------------------- | ------------- | ------------ | ------------------------------ |
+| `0.125rem` (2px)                  | `2px`         | `2` (number) | `2px` (keep literal, no token) |
+| `0.2rem` (3.2px), `0.25rem` (4px) | **xs** (4px)  | `"xs"`       | `var(--mantine-spacing-xs)`    |
+| `0.5rem` (8px)                    | **sm** (8px)  | `"sm"`       | `var(--mantine-spacing-sm)`    |
+| `0.75rem` (12px)                  | between sm/md | `rem(12)`    | `0.75rem` (no exact token)     |
+| `1rem` (16px)                     | **md** (16px) | `"md"`       | `var(--mantine-spacing-md)`    |
+| `1.5rem` (24px)                   | **lg** (24px) | `"lg"`       | `var(--mantine-spacing-lg)`    |
+| `2rem` (32px)                     | **xl** (32px) | `"xl"`       | `var(--mantine-spacing-xl)`    |
+
+**Border radius** — snap to the nearest Mantine radius token:
+
+| Hardcoded value  | Nearest token                 | CSS variable               |
+| ---------------- | ----------------------------- | -------------------------- |
+| `0.25rem` (4px)  | **xs** (4px)                  | `var(--mantine-radius-xs)` |
+| `0.375rem` (6px) | **sm** (6px)                  | `var(--mantine-radius-sm)` |
+| `0.5rem` (8px)   | **md** (8px)                  | `var(--mantine-radius-md)` |
+| `1rem`+ (16px+)  | **xl** (40px) or keep literal | `var(--mantine-radius-xl)` |
+
+**Font sizes** — snap to the nearest Mantine font size token:
+
+| Hardcoded value                  | Nearest token | Style prop | CSS variable                  |
+| -------------------------------- | ------------- | ---------- | ----------------------------- |
+| `0.6875rem` (11px)               | **xs** (11px) | `fz="xs"`  | `var(--mantine-font-size-xs)` |
+| `0.75rem` (12px)                 | **sm** (12px) | `fz="sm"`  | `var(--mantine-font-size-sm)` |
+| `0.875rem` (14px), `1rem` (16px) | **md** (14px) | `fz="md"`  | `var(--mantine-font-size-md)` |
+| `1.063rem` (17px)                | **lg** (17px) | `fz="lg"`  | `var(--mantine-font-size-lg)` |
+| `1.3rem` (21px)                  | **xl** (21px) | `fz="xl"`  | `var(--mantine-font-size-xl)` |
+
+**Rules:**
+
+- If the hardcoded value is within ~2px of a token, use the token
+- If it falls exactly between two tokens, prefer the smaller one (tighter is safer)
+- If no token is close (e.g., `48px` spacing), use `rem(48)` for style props or the literal value in CSS modules
+- This applies everywhere: style props, CSS module values, Icon `size` props, etc.
+
+## Common Migration Patterns
+
+### Pattern 1: Static Layout Container → Mantine Component
+
+**Before:**
+
+```tsx
+// Component.styled.tsx
+export const Container = styled.div`
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 1rem;
+  width: 100%;
+`;
+```
+
+**After:**
+
+```tsx
+<Flex align="center" gap="sm" p="md" w="100%">
+```
+
+### Pattern 2: Vertical Stack → Stack Component
+
+**Before:**
+
+```tsx
+export const Wrapper = styled.div`
+  display: flex;
+  flex-direction: column;
+  gap: 1.5rem;
+  padding: 2rem;
+`;
+```
+
+**After:**
+
+```tsx
+<Stack gap="lg" p="xl">
+```
+
+### Pattern 3: Dynamic Props → cx() with CSS Module Classes
+
+**Before:**
+
+```tsx
+export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
+  color: ${(props) =>
+    props.disabled ? color("text-tertiary") : color("text-primary")};
+  background-color: ${(props) =>
+    props.isSelected ? color("brand") : "transparent"};
+  cursor: ${(props) => (props.disabled ? "default" : "pointer")};
+
+  &:hover {
+    color: ${(props) => !props.disabled && color("brand")};
+  }
+`;
+```
+
+**After (CSS module):**
+
+```css
+/* Item.module.css */
+.itemRoot {
+  color: var(--mb-color-text-primary);
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand);
+  }
+}
+
+.selected {
+  background-color: var(--mb-color-brand);
+}
+
+.disabled {
+  color: var(--mb-color-text-tertiary);
+  cursor: default;
+
+  &:hover {
+    color: var(--mb-color-text-tertiary);
+  }
+}
+```
+
+**After (TSX):**
+
+```tsx
+<Box
+  className={cx(S.itemRoot, {
+    [S.selected]: isSelected,
+    [S.disabled]: disabled,
+  })}
+>
+```
+
+### Pattern 4: Extending a Component → Style Props First, CSS Module Only If Needed
+
+When a styled component wraps another component, first check if the styles can be expressed as style props on a Mantine wrapper or on the component itself. Only use a CSS module when properties genuinely need it.
+
+**Before:**
+
+```tsx
+export const CardIcon = styled(Icon)`
+  display: block;
+  flex: 0 0 auto;
+  color: var(--mb-color-brand);
+`;
+
+export const CardTitle = styled(Ellipsified)`
+  color: var(--mb-color-text-primary);
+  font-size: 1rem;
+  font-weight: bold;
+  margin-left: 1rem;
+`;
+```
+
+**After — style props on Mantine wrapper (preferred when ALL properties are expressible):**
+
+```tsx
+<Box display="block" flex="0 0 auto" c="brand">
+  <Icon {...icon} />
+</Box>
+<Box c="text-primary" fz="md" fw="bold" ml="md">
+  <Ellipsified>{title}</Ellipsified>
+</Box>
+```
+
+**After — CSS module (use only when component has pseudo-selectors or non-expressible styles):**
+
+```css
+.icon {
+  color: var(--mb-color-brand);
+  width: 1.5rem;
+  height: 1.5rem;
+  cursor: pointer;
+
+  &:hover {
+    color: var(--mb-color-brand-hover);
+  }
+}
+```
+
+```tsx
+<Icon className={S.icon} name="warning" />
+```
+
+### Pattern 4b: `styled.span` / `styled.p` with Text Styles → `Text` Component
+
+**Before:**
+
+```tsx
+export const Label = styled.span`
+  color: var(--mb-color-text-secondary);
+  font-weight: bold;
+`;
+
+export const Title = styled.span`
+  color: var(--mb-color-text-primary);
+  font-size: 1rem;
+  font-weight: bold;
+  margin-left: 0.5rem;
+`;
+```
+
+**After — `Text` component with style props (NO CSS module needed):**
+
+```tsx
+<Text component="span" c="text-secondary" fw="bold">
+  {label}
+</Text>
+
+<Text component="span" c="text-primary" fz="md" fw="bold" ml="sm">
+  {title}
+</Text>
+```
+
+`Text` renders as `<p>` by default. Use `component="span"` to render inline. All color, typography, and spacing props work directly — no CSS module needed for pure text styling.
+
+### Pattern 5: Keyframes Animation → CSS Module
+
+**Before:**
+
+```tsx
+const spin = keyframes`
+  from { transform: rotate(0deg); }
+  to { transform: rotate(360deg); }
+`;
+
+export const Spinner = styled.div`
+  animation: ${spin} 1s infinite linear;
+`;
+```
+
+**After (CSS module):**
+
+```css
+@keyframes spin {
+  from {
+    transform: rotate(0deg);
+  }
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.spinner {
+  animation: spin 1s infinite linear;
+}
+```
+
+**After (TSX):**
+
+```tsx
+<Box className={S.spinner} />
+```
+
+### Pattern 6: color() Function → CSS Variables
+
+| Emotion (JS)            | CSS Module                                                   | Mantine Style Prop          |
+| ----------------------- | ------------------------------------------------------------ | --------------------------- |
+| `color("brand")`        | `var(--mb-color-brand)`                                      | `c="brand"` or `bg="brand"` |
+| `color("text-primary")` | `var(--mb-color-text-primary)`                               | `c="text-primary"`          |
+| `color("border")`       | `var(--mb-color-border)`                                     | N/A (use CSS module)        |
+| `alpha("brand", 0.2)`   | `color-mix(in srgb, var(--mb-color-brand), transparent 80%)` | N/A (use CSS module)        |
+
+### Pattern 7: Responsive Spacing/Sizing → Responsive Style Props (NOT CSS Media Queries)
+
+When a styled component only changes spacing, sizing, or other style-prop-expressible values at breakpoints, use Mantine's responsive syntax instead of CSS module media queries.
+
+**Before:**
+
+```tsx
+export const CaptionRoot = styled.div`
+  margin-bottom: 1.5rem;
+
+  ${breakpointMinExtraLarge} {
+    margin-bottom: 2rem;
+  }
+`;
+```
+
+**After — responsive style prop (NO CSS module needed):**
+
+```tsx
+<Flex mb={{ base: "lg", xl: "xl" }}>
+```
+
+Breakpoint keys: `base` (default), `xs` (40em), `sm` (48em), `md` (60em), `lg` (80em), `xl` (120em).
+
+Only use CSS module `@media` queries when the responsive change involves non-style-prop properties (e.g., `box-shadow`, `border`, `cursor` changes at breakpoints).
+
+### Pattern 8: Dynamic Computed Styles → Inline Styles
+
+Inline styles are allowed **only** for truly dynamic values computed at runtime (e.g., widths, positions, colors from data). Everything else must use Mantine style props or CSS modules.
+
+**Before:**
+
+```tsx
+export const Bar = styled.div<{ width: number }>`
+  width: ${(props) => props.width}%;
+`;
+```
+
+**After:**
+
+```tsx
+<Box style={{ width: `${width}%` }} />
+```
+
+### Pattern 9: Core CSS Utility Classes (Discouraged)
+
+**Do NOT introduce new `CS` utility class usage.** Core CSS utilities (`CS` from `metabase/css/core/index.css`) are legacy and discouraged for new code. Prefer Mantine style props or CSS modules instead.
+
+If existing code already uses `CS` classes and you're not migrating that specific code, leave them alone. But when migrating Emotion → Mantine, replace with the proper alternative:
+
+| Instead of `CS.*`   | Use                                                     |
+| ------------------- | ------------------------------------------------------- |
+| `CS.overflowHidden` | CSS module: `overflow: hidden`                          |
+| `CS.cursorPointer`  | CSS module: `cursor: pointer`                           |
+| `CS.flex1`          | Style prop: `flex={1}`                                  |
+| `CS.flexNoShrink`   | Style prop: `flex="0 0 auto"`                           |
+| `CS.textBrandHover` | CSS module: `&:hover { color: var(--mb-color-brand); }` |
+
+### Pattern 10: Shared Emotion Styles Across Files → Shared CSS Module + cx()
+
+When Emotion exports a shared `css` block (like `animationStyles`) imported by many files, create ONE CSS module with the shared keyframe and a reusable class, then compose via `cx()`.
+
+**Before (Emotion — shared animation used by 13+ skeleton files):**
+
+```tsx
+// ChartSkeleton.styled.tsx — defines shared animation
+const fadingKeyframes = keyframes`
+  0% { opacity: 0.0625; }
+  50% { opacity: 0.125; }
+  100% { opacity: 0.0625; }
+`;
+export const animationStyles = css`
+  opacity: 0.1;
+  animation: ${fadingKeyframes} 1.5s infinite;
+`;
+
+// AreaSkeleton.styled.tsx — consumes it
+import { animationStyles } from ".../ChartSkeleton.styled";
+export const SkeletonImage = styled.svg`
+  ${animationStyles};
+  flex: 1 1 0;
+  margin-top: 1rem;
+  border-bottom: 1px solid currentColor;
+`;
+
+// BarSkeleton.styled.tsx — also consumes it
+import { animationStyles } from ".../ChartSkeleton.styled";
+export const SkeletonImage = styled.svg`
+  ${animationStyles};
+  flex: 1 1 0;
+  margin-top: 1rem;
+`;
+```
+
+**After — shared CSS module:**
+
+```css
+/* ChartSkeleton.module.css */
+@keyframes fading {
+  0% {
+    opacity: 0.0625;
+  }
+
+  50% {
+    opacity: 0.125;
+  }
+
+  100% {
+    opacity: 0.0625;
+  }
+}
+
+.animated {
+  opacity: 0.1;
+  animation: fading 1.5s infinite;
+}
+```
+
+**After — per-component CSS modules with own styles only:**
+
+```css
+/* AreaSkeleton.module.css */
+.skeletonImage {
+  flex: 1 1 0;
+  margin-top: 1rem;
+  border-bottom: 1px solid currentColor;
+}
+```
+
+```css
+/* BarSkeleton.module.css */
+.skeletonImage {
+  flex: 1 1 0;
+  margin-top: 1rem;
+}
+```
+
+**After — component TSX uses cx() to compose:**
+
+```tsx
+// AreaSkeleton.tsx
+import cx from "classnames";
+import ChartSkeletonS from "../ChartSkeleton/ChartSkeleton.module.css";
+import S from "./AreaSkeleton.module.css";
+
+const AreaSkeleton = (): JSX.Element => {
+  return (
+    <svg
+      className={cx(ChartSkeletonS.animated, S.skeletonImage)}
+      xmlns="http://www.w3.org/2000/svg"
+      viewBox="0 0 371 113"
+      preserveAspectRatio="none"
+    >
+      <path d="..." fill="currentColor" />
+    </svg>
+  );
+};
+```
+
+The shared module owns the `@keyframes` and the `.animated` class. Each consumer composes it with its own module class via `cx()`. No duplication of the keyframe definition.
+
+## Import Template
+
+```tsx
+import cx from "classnames"; // only if needed for conditional classes
+
+import { Box, Flex, Group, Stack, Text, rem } from "metabase/ui";
+
+import S from "./ComponentName.module.css"; // only if CSS module is needed
+```
+
+## Checklist Before Finishing
+
+- [ ] **MANTINE-FIRST CHECK**: Every CSS property that has a style prop equivalent (`c`, `bg`, `p`, `m`, `fw`, `fz`, `flex`, `gap`, `align`, `w`, `h`, etc.) is expressed as a style prop, NOT in a CSS module
+- [ ] `styled.span`/`styled.p` with only color/weight/size are replaced with `Text component="span"` + style props, NOT CSS module classes
+- [ ] `styled.div` with only layout props are replaced with `Flex`/`Stack`/`Group`/`Box` + style props, NOT CSS module classes
+- [ ] Responsive spacing/sizing uses responsive style props (`mb={{ base: "lg", xl: "xl" }}`), NOT CSS module `@media` queries
+- [ ] CSS modules are used ONLY for: pseudo-selectors, box-shadow, border, cursor, overflow, animation, transition, transform, or complex selectors
+- [ ] All `@emotion/styled` and `@emotion/react` imports removed from migrated files
+- [ ] The `.styled.tsx` file is deleted
+- [ ] All imports of the deleted styled file are updated
+- [ ] No static inline styles — `style={{ }}` used only for truly dynamic runtime values
+- [ ] All colors use design tokens (`c="brand"`, `var(--mb-color-brand)`), not raw hex/rgb
+- [ ] All spacing uses design tokens (`p="md"`, `var(--mantine-spacing-md)`), not arbitrary px values — hardcoded `rem`/`px` literals snapped to the nearest token (see mapping table above)
+- [ ] All border-radius values use radius tokens (`var(--mantine-radius-md)`), not hardcoded `0.5rem`
+- [ ] All font sizes use font-size tokens (`fz="md"`, `var(--mantine-font-size-md)`), not hardcoded `1rem`
+- [ ] Layout uses Mantine components (`Flex`, `Stack`, `Group`, `Box`, `Text`) not raw divs/spans with CSS
+- [ ] All CSS module class names use camelCase
+- [ ] No cascading/descendant selectors targeting raw elements — use direct class assignment instead
+- [ ] Component renders identically to the original (visually verify if possible)
+
+## Visual Verification with Screenshots (Optional — Only When Explicitly Asked)
+
+When the user explicitly asks to create before/after screenshots, use the Playwright MCP tools to capture them. This is NOT done by default — only when requested.
+
+Screenshots must be taken in **both light and dark mode** to verify token usage is correct in both themes.
+
+### Switching Color Scheme via API
+
+Toggle between light and dark mode using the Metabase settings API. Use Playwright's `browser_evaluate` or `browser_navigate` with fetch:
+
+```js
+// Switch to dark mode
+await fetch("/api/setting/color-scheme", {
+  method: "PUT",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ value: "dark" }),
+});
+
+// Switch to light mode
+await fetch("/api/setting/color-scheme", {
+  method: "PUT",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ value: "light" }),
+});
+```
+
+After switching, reload the page for the theme to take effect.
+
+### Process
+
+For each state (**after** = migrated code, **before** = stashed original), capture screenshots in both themes at both viewport widths. This produces **8 screenshots total**.
+
+1. **Take "after" screenshots first** (migrated code is already in place):
+
+   - Navigate to the page that renders the migrated components (`browser_navigate`)
+   - Wait for content to load (`browser_wait_for` with key text, or `textGone: "Loading..."`)
+   - Close the sidebar if it overlaps content on narrow viewports (`browser_click` the toggle button)
+   - **Light mode** (set `color-scheme` to `"light"` via API, reload):
+     - Desktop (1280x900): `after-light-desktop.png`
+     - Narrow (640x900), close sidebar: `after-light-narrow.png`
+   - **Dark mode** (set `color-scheme` to `"dark"` via API, reload):
+     - Desktop (1280x900): `after-dark-desktop.png`
+     - Narrow (640x900), close sidebar: `after-dark-narrow.png`
+
+2. **Stash changes to capture "before" screenshots**:
+
+   - Run `git stash --include-untracked` to temporarily revert to the Emotion version
+   - Repeat the same 4 screenshots with `before-` prefix:
+     - `before-light-desktop.png`, `before-light-narrow.png`
+     - `before-dark-desktop.png`, `before-dark-narrow.png`
+   - Run `git stash pop` to restore the migrated code
+
+3. **Restore the user's original color scheme** (set back to `"auto"` or whatever it was before).
+
+4. **Display all 8 screenshots** using the `Read` tool so the user can visually compare before/after in both themes at both viewport sizes.
+
+### Key Details
+
+- Save screenshots in the repo root (they will be untracked — user can delete after review)
+- The dev server must be running (typically `http://localhost:3000`)
+- Use `browser_snapshot` to find element refs when you need to click buttons (e.g., sidebar toggle)
+- The greeting text on the home page changes randomly on each load — this is expected, not a regression
+- If the page being tested is not the home page, navigate to the correct URL that exercises the migrated components
+- Dark mode screenshots are critical for verifying that CSS variable tokens (`var(--mb-color-*)`) are used correctly — hardcoded colors will look wrong in dark mode

.claude/skills/mutation-testing/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: mutation-testing
+description: Run mutation testing on a Clojure namespace, generate tests to kill surviving mutations, and open draft PRs with Linear issue tracking.
+---
+
+# Mutation Testing Skill
+
+This skill runs mutation testing end-to-end: generates a coverage report, groups functions, shells out to `claude -p` to write tests, verifies mutations are killed, and creates draft PRs with Linear issues.
+
+## Prerequisites
+
+- A running nREPL connected to the Metabase dev environment
+- `LINEAR_API_KEY` environment variable set with a valid Linear personal API key
+- `gh` CLI authenticated with GitHub
+- `claude` CLI available on PATH
+
+## Reference Files
+
+- `dev/src/dev/coverage.clj` — mutation testing engine (generates reports, runs mutations)
+- `dev/src/dev/mutation_testing.clj` — orchestration, Linear API, PR helpers
+
+## Invocation
+
+The argument is a Clojure namespace, optionally followed by a base branch:
+
+```
+/mutation-testing metabase.lib.order-by
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x
+/mutation-testing metabase.lib.order-by --project-id abc-123
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x --project-id abc-123
+```
+
+- `--base-branch`: defaults to the value in config (set via `set-config!`), or `"master"` if not configured.
+- `--project-id`: if provided, issues are added to this existing Linear project instead of creating a new one.
+
+## Steps
+
+### 1. Parse arguments
+
+Parse `$ARGUMENTS` to extract:
+- **namespace** (required) — the first positional argument
+- **`--base-branch`** (optional) — if present, the next argument is the base branch name
+- **`--project-id`** (optional) — if present, the next argument is an existing Linear project ID
+
+### 2. Load and configure
+
+```clojure
+(require '[dev.mutation-testing :as mut-test] :reload)
+(require '[dev.coverage :as cov] :reload)
+```
+
+If this is the first invocation (or the REPL was restarted), set up the Linear team:
+
+```clojure
+(mut-test/list-teams!)
+(mut-test/set-config! {:team-id "<id>"})
+```
+
+### 3. Run
+
+```clojure
+(mut-test/run! '<target-ns>)
+;; Or with options:
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x"})
+(mut-test/run! '<target-ns> {:project-id "abc-123"})
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x" :project-id "abc-123"})
+```
+
+Pass the opts map with `:base-branch` and/or `:project-id` if those flags were provided in the arguments.
+
+This will:
+1. Generate a baseline mutation testing report
+2. Create a Linear project for the namespace
+3. Group functions by coverage relationships
+4. For each group: create branch → invoke Claude to write tests → verify → retry if needed → commit & push → create Linear issue → create draft PR
+5. Print a summary with PR links
+
+### 4. Handle failures
+
+If a group fails mid-processing, `run!` catches the error and continues to the next group. To retry a single group manually:
+
+```clojure
+;; Get the parsed namespace info
+(def parsed (mut-test/parse-namespace '<target-ns>))
+
+;; Run coverage to get the data
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+
+;; Group and find the one you want
+(def groups (mut-test/group-functions coverage-results))
+
+;; Process just that group
+(mut-test/process-group! parsed (nth groups <index>))
+```
+
+### 5. Verify the prompt (dry run)
+
+To inspect what Claude will see without invoking it:
+
+```clojure
+(def parsed (mut-test/parse-namespace '<target-ns>))
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+(def groups (mut-test/group-functions coverage-results))
+(println (mut-test/build-test-prompt
+           (merge (select-keys parsed [:target-ns :test-ns :source-path :test-path])
+                  (select-keys (first groups) [:fn-names :mutations]))))
+```
+
+## Configuration
+
+- **Team ID**: Set once per REPL session via `(mut-test/list-teams!)` and `(mut-test/set-config! {:team-id "..."})`
+- **Project ID**: Set automatically when `run!` calls `create-project-for-namespace!`
+- **Base Branch**: Defaults to `"master"`. Override via `(mut-test/set-config! {:base-branch "release-x.52.x"})` or pass `{:base-branch "..."}` as the second arg to `run!`
+- **Project ID**: If set (via `set-config!` or `run!` opts), `run!` reuses the existing Linear project instead of creating a new one

.claude/skills/serdes-workflow/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: serdes-workflow
+description: Export content from a running Metabase instance, validate with checkers, edit YAML, and import back. Use when the user wants to export, import, or run the full serdes round-trip workflow.
+---
+
+# Serdes Workflow Skill
+
+End-to-end workflow for exporting Metabase content as YAML, validating it, editing it, and importing it back.
+
+## Prerequisites
+
+All commands require the `:ee` alias since export, import, and checkers live in enterprise code.
+
+You need `MB_DB_CONNECTION_URI` set to point at the target Metabase Postgres database when importing. The running dev instance's connection string is in the worktree environment (check the nREPL or startup output).
+
+## Export
+
+```bash
+clojure -M:run:ee export /path/to/export-dir
+```
+
+Flags:
+- `-c 123,456` - export only specific collection IDs
+- `-f` - include field values
+- `-e` - continue on error
+
+This writes YAML files in the serdes directory layout:
+```
+databases/<db-name>/<db-name>.yaml
+databases/<db-name>/schemas/<schema>/tables/<table>/<table>.yaml
+databases/<db-name>/schemas/<schema>/tables/<table>/fields/<field>.yaml
+collections/<eid>_<slug>/cards/<eid>_<slug>.yaml
+```
+
+## Validate
+
+Always run both checkers after any modification. They skip full Metabase startup (~8s each).
+
+### Structural checker (fast, schema-based)
+```bash
+clojure -M:run:ee --mode checker --checker structural --export /path/to/export-dir
+```
+Validates YAML shapes against Malli schemas. Catches typos, missing required fields, wrong types.
+
+### Cards checker (query validation)
+```bash
+clojure -M:run:ee --mode checker --checker cards --export /path/to/export-dir
+```
+Validates that card queries resolve correctly against exported metadata (tables, fields, FKs). Uses MLv2 under the hood.
+
+Additional cards checker flags:
+- `--lenient` - fabricate metadata on demand (when no database schema files exist)
+- `--manifest /path/to/manifest.yaml` - write manifest of all referenced entities (lenient mode only)
+- `--output /path/to/results.edn` - write detailed results to file
+
+## Edit YAML
+
+See the **serdes-yaml-edit** skill for guidance on editing YAML files. The critical rule: **run both checkers after every edit before proceeding**.
+
+## Import
+
+```bash
+MB_DB_CONNECTION_URI="postgres://user:pass@localhost:5432/metabase_dbname" \
+  clojure -M:run:ee import /path/to/export-dir -e
+```
+
+The `-e` flag continues on error. The `MB_DB_CONNECTION_URI` must point at the same Postgres database the running Metabase instance uses - without it, import defaults to H2 which is wrong.
+
+## Full Demo Sequence
+
+1. Export: `clojure -M:run:ee export /tmp/metabase-export`
+2. Validate baseline: run both checkers
+3. Edit YAML files (see serdes-yaml-edit skill)
+4. Re-validate: run both checkers again
+5. Import: `MB_DB_CONNECTION_URI=... clojure -M:run:ee import /tmp/metabase-export -e`
+6. Verify in browser

.claude/skills/serdes-yaml-edit/SKILL.md

@@ -0,0 +1,243 @@
+---
+name: serdes-yaml-edit
+description: Edit Metabase serdes YAML files (cards, dashboards, databases) with correct portable references and structural conventions. Use when modifying exported YAML content.
+---
+
+# Serdes YAML Edit Skill
+
+## Golden Rule
+
+**Run both checkers after every edit.** No exceptions. Do not batch multiple edits before validating.
+
+```bash
+clojure -M:run:ee --mode checker --checker structural --export /path/to/export-dir
+clojure -M:run:ee --mode checker --checker cards --export /path/to/export-dir
+```
+
+If either checker fails, fix the issue before making further edits.
+
+## Portable References
+
+Serdes YAML uses portable references instead of integer IDs. This is the most important concept for editing.
+
+### Database references
+String name: `"Sample Database"`
+
+### Table references
+Array of `[database, schema, table]`:
+```yaml
+table_id:
+- Sample Database
+- PUBLIC
+- ACCOUNTS
+```
+
+### Field references
+Array of `[database, schema, table, field]`:
+```yaml
+id:
+- Sample Database
+- PUBLIC
+- ACCOUNTS
+- EMAIL
+```
+
+### Field refs in queries
+```yaml
+field_ref:
+- field
+- - Sample Database
+  - PUBLIC
+  - ACCOUNTS
+  - EMAIL
+- null
+```
+The outer array is `[field, <field-path>, <options>]`. The options are usually `null`.
+
+### Card references
+Entity ID string (21 characters): `"Qk5TgsNx4ubXIUtsQmT8G"`
+
+### Source table in queries
+```yaml
+dataset_query:
+  database: Sample Database
+  query:
+    source-table:
+    - Sample Database
+    - PUBLIC
+    - ACCOUNTS
+  type: query
+```
+
+## Safe Edits (low risk)
+
+These rarely break validation:
+- `name` - card/dashboard display name
+- `description` - card/dashboard description
+- `display` - visualization type (table, bar, line, pie, etc.)
+- `visualization_settings` - chart configuration
+- `archived` - true/false
+- `collection_id` - move to a different collection (use entity_id of target collection, or null for root)
+
+## Structural Edits (must match schema)
+
+These must use valid portable refs and will be caught by the cards checker if wrong:
+- `dataset_query` - the query definition
+- `result_metadata` - column metadata (must match the query's output columns)
+- `table_id` - must reference a table that exists in the export
+- `database_id` - must reference a database that exists in the export
+
+## Editing result_metadata
+
+Each entry in `result_metadata` describes an output column. When changing a query's source table or fields, you must update result_metadata to match. Each field entry needs at minimum:
+- `name` - column name (e.g., `EMAIL`)
+- `base_type` - Metabase type (e.g., `type/Text`, `type/Integer`, `type/DateTime`)
+- `display_name` - human-readable name
+- `field_ref` - portable field reference
+- `id` - portable field path
+- `table_id` - portable table path
+- `source` - usually `fields`
+
+## Common Operations
+
+### Rename a card
+Change `name:` at the top level. Safe, no ref changes needed.
+
+### Change a card's source table
+Update all of these consistently:
+1. `table_id` - top-level
+2. `dataset_query.query.source-table` - in the query
+3. `result_metadata` - every field entry's `id`, `field_ref`, and `table_id`
+
+### Add a filter to a structured query
+```yaml
+dataset_query:
+  database: Sample Database
+  query:
+    source-table:
+    - Sample Database
+    - PUBLIC
+    - ORDERS
+    filter:
+    - ">"
+    - - field
+      - - Sample Database
+        - PUBLIC
+        - ORDERS
+        - TOTAL
+      - null
+    - 100
+  type: query
+```
+
+### Change visualization type
+```yaml
+display: bar    # was: table
+```
+Valid types: `table`, `bar`, `line`, `pie`, `scalar`, `row`, `area`, `combo`, `scatter`, `funnel`, `map`, `pivot`, `progress`, `gauge`, `waterfall`
+
+## Looking Up Valid References
+
+The export directory IS the reference catalog. When you need to find the correct name for a database, table, or field, look it up directly from the export.
+
+### List valid databases
+```bash
+ls databases/
+```
+Each entry is a database name (directory for serdes format, .yaml for concise format).
+
+### List valid tables for a database
+```bash
+ls databases/<db-name>/schemas/<schema>/tables/
+```
+Example: `ls databases/Sample\ Database/schemas/PUBLIC/tables/` shows `ACCOUNTS`, `ORDERS`, `PRODUCTS`, etc.
+
+### List valid fields for a table
+```bash
+ls databases/<db-name>/schemas/<schema>/tables/<table>/fields/
+```
+Example: `ls databases/Sample\ Database/schemas/PUBLIC/tables/PRODUCTS/fields/` shows `CATEGORY.yaml`, `TITLE.yaml`, `PRICE.yaml`, etc. The filename (minus `.yaml`) is the field name.
+
+### Find card entity IDs
+Card filenames encode the entity ID: `<entity-id>_<slug>.yaml`. The entity ID is the part before the first underscore (21 characters).
+
+## Self-Healing Loop
+
+When a checker reports errors, follow this loop:
+
+1. **Read the error message** - it tells you what's wrong and often suggests the fix
+2. **Look up the correct value** from the export directory (see "Looking Up Valid References" above)
+3. **Fix the YAML**
+4. **Re-run both checkers**
+5. **Repeat until clean**
+
+Do not guess at fixes. Always look up the correct value from the export.
+
+## Understanding Checker Errors
+
+### Structural checker errors
+
+The structural checker validates YAML shape against Malli schemas. Common errors:
+
+**Missing required key with typo suggestion:**
+```
+Missing required key 'name' - found 'nameee' which may be a typo
+```
+Fix: rename the typo'd key back to the correct name. The checker tells you what it expected and what it found.
+
+**Wrong type:**
+```
+'archived' should be a boolean, got: "yes"
+```
+Fix: use `true`/`false`, not strings.
+
+**Unknown key:**
+```
+Unknown key 'foobar' in card
+```
+Fix: remove the key, or check if it's a typo of a known key.
+
+### Cards checker errors
+
+The cards checker validates that queries resolve against exported metadata. Error types:
+
+**UNRESOLVED REFERENCES:**
+```
+UNRESOLVED REFERENCES:
+  - field: Sample Database.PUBLIC.PRODUCTS.CATEGORYYY
+```
+The dotted path tells you exactly which reference failed. Look up the correct value:
+- Last segment is the field name - check `databases/.../tables/<table>/fields/`
+- Third segment is the table name - check `databases/.../schemas/<schema>/tables/`
+- First segment is the database name - check `databases/`
+
+**ERROR (query construction failed):**
+```
+ERROR: Error creating query from legacy query: Invalid output: ...
+```
+Usually means the query structure is malformed. This often follows unresolved references - fix the refs first, then re-check.
+
+**ERROR (nil name):**
+```
+ERROR: Invalid output: {:name ["should be a string, got: nil"]}
+```
+The card is missing its `name` field (likely a structural issue that also affects the cards checker).
+
+### Exit codes
+
+- Exit 0: all checks passed
+- Exit 1: one or more failures
+
+## File Naming Convention
+
+Card files: `collections/<collection-path>/cards/<entity-id>_<slug>.yaml`
+
+The filename slug should match the card name (lowercase, underscored). If you rename a card, consider renaming the file to match, though import works on entity_id not filename.
+
+## What NOT to Edit
+
+- `entity_id` - this is the identity of the object, changing it creates a new object on import
+- `serdes/meta` - internal serdes metadata, leave it alone
+- `created_at` - timestamp, no reason to change
+- `creator_id` - email reference, leave it
+- `metabase_version` - informational, leave it

.claude/skills/typescript-review/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: typescript-review
+description: Review TypeScript and JavaScript code changes for compliance with Metabase coding standards, style violations, and code quality issues. Use when reviewing pull requests or diffs containing TypeScript/JavaScript code.
+allowed-tools: Read, Grep, Bash, Glob
+---
+
+# TypeScript/JavaScript Code Review Skill
+
+@./../_shared/typescript-commands.md
+
+## Code Review Guidelines
+
+Review pull requests with a focus on:
+
+- Readability and maintainability
+- Appropriate test coverage
+- Compliance with project coding standards and conventions
+- Code quality and best practices
+- Type safety and proper TypeScript usage
+- React best practices (when applicable)

.claude/skills/typescript-write/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: typescript-write
+description: Write TypeScript and JavaScript code following Metabase coding standards and best practices. Use when developing or refactoring TypeScript/JavaScript code.
+---
+
+# TypeScript/JavaScript Development Skill
+
+@./../_shared/development-workflow.md
+@./../_shared/typescript-commands.md

.clj-kondo/config.edn

@@ -1,7 +1,7 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src" "config"]
  :linters
- { ;;
+ {;;
   ;; enabled optional linters (these are disabled by default)
   ;;
 
@@ -25,6 +25,7 @@
   :reduce-without-init          {:level :warning}
   :redundant-call               {:level :warning}
   :redundant-fn-wrapper         {:level :warning}
+  :redundant-str-call           {:level :warning}
   :self-requiring-namespace     {:level :warning}
   :single-key-in                {:level :warning}
   :unsorted-imports             {:level :warning}
@@ -49,26 +50,33 @@
   ;; disabled linters
   ;;
 
-  :redundant-ignore {:level :off}    ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
+  :redundant-primitive-coercion {:level :off} ; there are many defensive boolean coercions, kondo looks too much into it
 
   ;;
   ;; globally-enabled custom linters
   ;;
-  :metabase/check-defmulti-arglists                    {:level :warning}
-  :metabase/check-me-humanize                          {:level :warning}
-  :metabase/defsetting-must-specify-export             {:level :warning}
-  :metabase/defsetting-namespace                       {:level :warning}
-  :metabase/mbql-query-first-arg                       {:level :warning}
-  :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
-  :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
-  :metabase/namespace-name                             {:level :warning}
-  :metabase/require-shape-checker                      {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
-  :metabase/validate-logging                           {:level :warning}
-  :metabase/validate-mb-driver-tests                   {:level :warning}
-  :metabase/validate-mb-once                           {:level :warning}
-  :metabase/discourage-millis-duration                 {:level :warning}
+  :metabase/check-defmulti-arglists                          {:level :warning}
+  :metabase/check-def-check-not-uppercase-name               {:level :warning}
+  :metabase/check-def-no-underscores                         {:level :warning}
+  :metabase/check-me-humanize                                {:level :warning}
+  :metabase/defsetting-must-specify-export                   {:level :warning}
+  :metabase/defsetting-namespace                             {:level :warning}
+  :metabase/discourage-millis-duration                       {:level :warning}
+  :metabase/mbql-query-first-arg                             {:level :warning}
+  :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
+  :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
+  :metabase/namespace-name                                   {:level :warning}
+  :metabase/no-jsqlparser-imports                            {:level :warning}
+  :metabase/toucan-model-ns                                  {:level :warning}
+  :metabase/require-shape-checker                            {:level :warning}
+  :metabase/tests-must-live-in-known-modules                 {:level :warning}
+  :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
+  :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
+  :metabase/validate-logging                                 {:level :warning}
+  :metabase/validate-mb-driver-tests                         {:level :warning}
+  :metabase/validate-mb-once                                 {:level :warning}
 
   :metabase/validate-deftest
   {:level :warning
@@ -170,10 +178,18 @@
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
      metabase.channel.core/send!
+     metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
      metabase.notification.models/create-notification!
+     metabase.oauth-server.core/reset-provider!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; Workspace isolation functions are safe in parallel tests because they operate on
+     ;; isolated, test-specific workspaces and databases that don't affect other tests
+     metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
+     metabase.lib-metric.ast.plan/validate-arithmetic-ast!
+     metabase-enterprise.workspaces.isolation/ensure-database-isolation!
+     metabase-enterprise.workspaces.test-util/create-ready-ws!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -187,7 +203,7 @@
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
   ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
               #_:h2
               :postgres
               :mysql
@@ -215,7 +231,10 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match
+                                    metabase.lib.util.match/match-lite
+                                    metabase.lib.util.match/match-many
+                                    metabase.lib.util.match/replace-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -226,9 +245,6 @@
   {:exclude
    [(build.uberjar/with-duration-ms)
     (cljs.test/is [=? malli=])
-    (clojure.core.logic/fresh)
-    (clojure.core.logic/matcha)
-    (clojure.core.logic/run)
     (clojure.test/is [=? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
@@ -237,13 +253,17 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-lite-recursive)
+    (metabase.lib.util.match/match-many)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
+    (metabase.lib.util.match/replace-lite)
     (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/match-lite)
+    (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
+    (metabase.driver-api.core/replace-lite)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
     (metabase.util/prog1 [<>])
@@ -273,6 +293,7 @@
    clojure.java.jdbc/with-db-connection               {:message "Use sql-jdbc.execute/do-with-connection-with-options (for drivers) or t2/with-connection (for the app DB) instead of jdbc/with-db-connection"}
    clojure.java.jdbc/with-db-metadata                 {:message "Use sql-jdbc.execute/do-with-connection-with-options + .getMetaData instead of jdbc/with-db-metadata"}
    clojure.pprint/pprint                              {:message "Use metabase.util.log instead of clojure.pprint/pprint"}
+   clojure.pprint/print-table                         {:message "Use metabase.util.log instead of printing directly to the console"}
    clojure.string/lower-case                          {:message "Use metabase.util/lower-case-en instead of clojure.string/lower-case"}
    clojure.string/upper-case                          {:message "Use metabase.util/upper-case-en instead of clojure.string/upper-case"}
    compojure.core/context                             {:message "Use metabase.api.util.handlers/route-map-handler instead of compojure.core/context, it is much faster and supports OpenAPI spec generation"}
@@ -294,9 +315,14 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase.lib.util.match/match                      {:message "Use lib.util.match/match-many instead of lib.util.match/match."}
+   metabase.lib.util.match/match-one                  {:message "Use lib.util.match/match-lite instead of lib.util.match/match-one."}
+   metabase.lib.util.match/replace                    {:message "Use lib.util.match/replace-lite instead of lib.util.match/replace."}
+   metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
-   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}}
+   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}
+   }
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -401,12 +427,13 @@
     ring.util.codec                           codec
     ring.util.response                        response
     saml20-clj.core                           saml
+    metabase.transforms-base.util              transforms-base.u
+    metabase.transforms.util                   transforms.u
     toucan2.core                              t2}}}
 
  :lint-as
  {cljs.cache/defcache                                                                   clojure.core/deftype
   clojure.core.cache/defcache                                                           clojure.core/deftype
-  clojure.core.logic/defne                                                              clj-kondo.lint-as/def-catch-all
   clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
   clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
@@ -416,11 +443,10 @@
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-  metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
-  metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
-  metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
-  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-workspaces!                             clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
+  metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
@@ -448,14 +474,15 @@
   metabase.premium-features.settings/define-premium-feature                             clojure.core/def
   metabase.pulse.dashboard-subscription-test/with-dashboard-sub-for-card                clojure.core/let
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
+  metabase.query-processor.pipeline-queries-test/mbql5-query                            clojure.core/->
+  metabase.query-processor.pipeline-queries-test/run-mbql5-query                        clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
   metabase.settings.core/define-multi-setting                                           clojure.core/def
+  metabase.api-scope.core/defscope                                                      clj-kondo.lint-as/def-catch-all
   metabase.settings.core/defsetting                                                     clj-kondo.lint-as/def-catch-all
   metabase.settings.models.setting.multi-setting/define-multi-setting                   clojure.core/def
   metabase.settings.models.setting/defsetting                                           clj-kondo.lint-as/def-catch-all
@@ -466,6 +493,7 @@
   metabase.task.impl/defjob                                                             clojure.core/defn
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
+  metabase.test.embedded-postgres.core/with-system                                      clojure.core/let
   metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
@@ -488,8 +516,9 @@
   metabase.util.malli/defn-                                                             schema.core/defn
   metabase.util.malli/fn                                                                schema.core/fn
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
+  metabase.util.performance/doseq                                                       clojure.core/doseq
+  metabase.util.performance/for                                                         clojure.core/for
   metabase.util/with-timer-ms                                                           clojure.core/fn
-  metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
   metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
   metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
   monger.operators/defoperator                                                          clojure.core/def
@@ -507,7 +536,16 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/def                                                                                                          hooks.clojure.core.def/lint-def
+   clojure.core/definterface                                                                                                 hooks.clojure.core.def/lint-def
+   clojure.core/defmacro                                                                                                     hooks.clojure.core.defmacro/lint-defmacro
    clojure.core/defmulti                                                                                                     hooks.clojure.core.defmulti/lint-defmulti
+   clojure.core/defn                                                                                                         hooks.clojure.core.defn/lint-defn
+   clojure.core/defn-                                                                                                        hooks.clojure.core.defn/lint-defn
+   clojure.core/defonce                                                                                                      hooks.clojure.core.def/lint-def
+   clojure.core/defprotocol                                                                                                  hooks.clojure.core.def/lint-def
+   clojure.core/defrecord                                                                                                    hooks.clojure.core.def/lint-def
+   clojure.core/deftype                                                                                                      hooks.clojure.core.def/lint-def
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
@@ -519,7 +557,11 @@
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
+   metabase-enterprise.dependencies.api-test/with-dependents-test!                                                           hooks.common/with-two-bindings
+   metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
+   metabase-enterprise.metabot.tools.dependencies-test/with-dependent-transforms!                                            hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
+   metabase-enterprise.serialization.api-test/with-serialization-test-data!                                                  hooks.common/with-three-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
    metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
@@ -530,26 +572,30 @@
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
    metabase.classloader.impl/require                                                                                         hooks.clojure.core.require/lint-require
-   metabase.collections.api-test/with-french-user-and-personal-collection!                                                   hooks.common/with-two-top-level-bindings
+   metabase.collections-rest.api-test/with-french-user-and-personal-collection!                                              hooks.common/with-two-top-level-bindings
    metabase.collections.models.collection-test/with-collection-hierarchy!                                                    hooks.common/let-one-with-optional-value
    metabase.collections.models.collection-test/with-personal-and-impersonal-collections                                      hooks.common/with-two-bindings
-   metabase.dashboards.api-test/with-chain-filter-fixtures                                                                   hooks.common/let-one-with-optional-value
-   metabase.dashboards.api-test/with-simple-dashboard-with-tabs                                                              hooks.common/with-one-binding
+   metabase.dashboards-rest.api-test/with-chain-filter-fixtures                                                              hooks.common/let-one-with-optional-value
+   metabase.dashboards-rest.api-test/with-simple-dashboard-with-tabs                                                         hooks.common/with-one-binding
    metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
    metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
-   metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
+   metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor.expressions-test/calculate-bird-scarcity
    metabase.driver.mongo-test/with-describe-table-for-sample                                                                 hooks.metabase.driver.mongo-test/with-describe-table-for-sample
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
    metabase.driver-api/defenterprise                                                                                         hooks.metabase.premium-features.defenterprise/defenterprise
-   metabase.embedding.api.embed-test/do-response-formats                                                                     hooks.common/with-two-bindings
-   metabase.embedding.api.embed-test/with-chain-filter-fixtures!                                                             hooks.common/let-one-with-optional-value
-   metabase.embedding.api.embed-test/with-temp-card                                                                          hooks.common/let-one-with-optional-value
-   metabase.embedding.api.embed-test/with-temp-dashcard                                                                      hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/do-response-formats                                                                hooks.common/with-two-bindings
+   metabase.embedding-rest.api.embed-test/with-chain-filter-fixtures!                                                        hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/with-temp-card                                                                     hooks.common/let-one-with-optional-value
+   metabase.embedding-rest.api.embed-test/with-temp-dashcard                                                                 hooks.common/let-one-with-optional-value
    metabase.legacy-mbql.schema.macros/defclause                                                                              hooks.metabase.legacy-mbql.schemas.macros/defclause
+   metabase.legacy-mbql.schema.macros/defclause*                                                                             hooks.metabase.legacy-mbql.schemas.macros/defclause*
+   metabase.legacy-mbql.schema.macros/one-of                                                                                 hooks.metabase.legacy-mbql.schemas.macros/one-of
    metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
+   methodical.core/defmethod                                                                                                 hooks.metabase.toucan.table-name/lint-defmethod
+   methodical.macros/defmethod                                                                                               hooks.metabase.toucan.table-name/lint-defmethod
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
@@ -563,20 +609,20 @@
    metabase.permissions.core/disable-perms-cache                                                                             hooks.common/do*
    metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
-   metabase.public-sharing.api-test/with-required-param-card!                                                                hooks.common/with-one-binding
-   metabase.public-sharing.api-test/with-temp-public-card                                                                    hooks.common/let-one-with-optional-value
-   metabase.public-sharing.api-test/with-temp-public-dashboard                                                               hooks.common/let-one-with-optional-value
-   metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                                                      hooks.common/with-three-bindings
+   metabase.public-sharing-rest.api-test/with-required-param-card!                                                           hooks.common/with-one-binding
+   metabase.public-sharing-rest.api-test/with-temp-public-card                                                               hooks.common/let-one-with-optional-value
+   metabase.public-sharing-rest.api-test/with-temp-public-dashboard                                                          hooks.common/let-one-with-optional-value
+   metabase.public-sharing-rest.api-test/with-temp-public-dashboard-and-card                                                 hooks.common/with-three-bindings
    metabase.pulse.api.alert-test/with-alert-in-collection!                                                                   hooks.common/with-four-bindings
    metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                           hooks.common/let-second
    metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
    metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
-   metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
-   metabase.queries.api.card-test/with-temp-native-card!                                                                     hooks.common/with-two-bindings
-   metabase.queries.api.card-test/with-temp-native-card-with-params!                                                         hooks.common/with-two-bindings
-   metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
-   metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
+   metabase.queries-rest.api.card-test/with-card-param-values-fixtures                                                       hooks.common/let-one-with-optional-value
+   metabase.queries-rest.api.card-test/with-temp-native-card                                                                 hooks.common/with-two-bindings
+   metabase.queries-rest.api.card-test/with-temp-native-card-with-params                                                     hooks.common/with-two-bindings
+   metabase.query-processor.expressions-test/calculate-bird-scarcity                                                         hooks.metabase.query-processor.expressions-test/calculate-bird-scarcity
+   metabase.query-processor.filter-test/count-with-filter-clause                                                             hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
    metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
    metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
@@ -624,10 +670,11 @@
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
    metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
+   metabase.test/with-random-premium-token!                                                                                  hooks.common/with-one-binding
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   metabase.users.api-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.users-rest.api-test/with-temp-user-email!                                                                        hooks.common/with-one-binding
    metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
    metabase.util.i18n/deferred-tru                                                                                           hooks.metabase.util.i18n/deferred-tru
    metabase.util.i18n/trs                                                                                                    hooks.metabase.util.i18n/trs
@@ -651,44 +698,43 @@
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!}
 
   :macroexpand
-  {clojurewerkz.quartzite.jobs/build                                                       macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.calendar-interval/build                                 macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.cron/schedule                                           macros.quartz/schedule
-   clojurewerkz.quartzite.schedule.simple/schedule                                         macros.quartz/simple-schedule
-   clojurewerkz.quartzite.triggers/build                                                   macros.quartz/build-trigger
-   metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                            macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
-   metabase-enterprise.impersonation.util-test/with-impersonations!                        macros.metabase-enterprise.impersonation.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup!                macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
-   metabase-enterprise.sandbox.test-util/with-gtaps!                                       macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                              macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.serialization.test-util/with-world                                  macros.metabase-enterprise.serialization.test-util/with-world
-   metabase-enterprise.test/with-gtaps!                                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.test/with-gtaps-for-user!                                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase.collections.api-test/with-collection-hierarchy!                                macros.metabase.collections.api-test/with-collection-hierarchy!
-   metabase.collections.api-test/with-some-children-of-collection!                         macros.metabase.collections.api-test/with-some-children-of-collection!
-   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
-   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
-   metabase.lib.common/defop                                                               macros.metabase.lib.common/defop
-   metabase.lib.filter/deffilter                                                           macros.metabase.lib.filter/deffilter
-   metabase.parameters.chain-filter-test/chain-filter                                      macros.metabase.parameters.chain-filter-test/chain-filter
-   metabase.parameters.chain-filter-test/chain-filter-search                               macros.metabase.parameters.chain-filter-test/chain-filter
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.queries.api.card-test/with-ordered-items                                       macros.metabase.queries.api.card-test/with-ordered-items
-   metabase.query-analysis.models.query-analysis-test/with-test-setup                      macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
-   metabase.query-analysis.task.test-setup/with-test-setup!                                macros.metabase.query-analysis.task.test-setup/with-test-setup!
-   metabase.query-processor.streaming/streaming-response                                   macros.metabase.query-processor.streaming/streaming-response
-   metabase.server.statistics-handler-test/with-server                                     macros.metabase.server.statistics-handler-test/with-server
-   metabase.test.data.users/with-group-for-user                                            macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value!                                             macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test.util/with-temporary-raw-setting-values                                    macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.test/with-group-for-user                                                       macros.metabase.test.data.users/with-group-for-user
-   metabase.test/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.users.models.user-test/with-groups!                                            macros.metabase.users.models.user-test/with-groups!
-   metabase.util.namespaces/import-fn                                                      macros.metabase.util.namespaces/import-fn
-   metabase.xrays.domain-entities.malli/define-getters-and-setters                         macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
-   metabase.xrays.related-test/with-world                                                  macros.metabase.xrays.related-test/with-world}}
+  {clojurewerkz.quartzite.jobs/build                                                            macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.calendar-interval/build                                      macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.cron/schedule                                                macros.quartz/schedule
+   clojurewerkz.quartzite.schedule.simple/schedule                                              macros.quartz/simple-schedule
+   clojurewerkz.quartzite.triggers/build                                                        macros.quartz/build-trigger
+   metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                                 macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
+   metabase-enterprise.impersonation.util-test/with-impersonations!                             macros.metabase-enterprise.impersonation.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!                     macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
+   metabase-enterprise.sandbox.test-util/with-gtaps!                                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                                   macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.serialization.test-util/with-world                                       macros.metabase-enterprise.serialization.test-util/with-world
+   metabase-enterprise.test/with-gtaps!                                                         macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                                macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase.collections-rest.api-test/with-collection-hierarchy!                                macros.metabase.collections-rest.api-test/with-collection-hierarchy!
+   metabase.collections-rest.api-test/with-some-children-of-collection!                         macros.metabase.collections-rest.api-test/with-some-children-of-collection!
+   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
+   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
+   metabase.lib.common/defop                                                                    macros.metabase.lib.common/defop
+   metabase.lib.filter/deffilter                                                                macros.metabase.lib.filter/deffilter
+   metabase.parameters.chain-filter-test/chain-filter                                           macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.parameters.chain-filter-test/chain-filter-search                                    macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing!
+   metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.queries-rest.api.card-test/with-ordered-items                                       macros.metabase.queries-rest.api.card-test/with-ordered-items
+   metabase.query-analysis.models.query-analysis-test/with-test-setup                           macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
+   metabase.query-analysis.task.test-setup/with-test-setup!                                     macros.metabase.query-analysis.task.test-setup/with-test-setup!
+   metabase.query-processor.streaming/streaming-response                                        macros.metabase.query-processor.streaming/streaming-response
+   metabase.server.statistics-handler-test/with-server                                          macros.metabase.server.statistics-handler-test/with-server
+   metabase.test.data.users/with-group-for-user                                                 macros.metabase.test.data.users/with-group-for-user
+   metabase.test.util/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test.util/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.test/with-group-for-user                                                            macros.metabase.test.data.users/with-group-for-user
+   metabase.test/with-temp-env-var-value!                                                       macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
+   metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
+   metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}
@@ -715,6 +761,8 @@
    :name    metabase-lib}
   {:pattern "^metabase\\.lib\\..*"
    :name    metabase-lib-excluding-legacy-mbql}
+  {:pattern "^metabase\\.legacy-mbql\\..*"
+   :name    legacy-mbql-namespaces}
   ;;
   ;; QP and driver source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`,
   ;; and `metabase.driver.*`, excluding `-test` namespaces.
@@ -729,7 +777,7 @@
   ;;
   ;; driver namespaces, including tests
   ;;
-  {:pattern "metabase\\.driver.*$"
+  {:pattern "metabase\\.driver(?:-api)?.*$"
    :name    driver-namespaces}
   ;;
   ;; Perf-sensitive namespaces are currently the union of metabase.lib.*, driver namespaces, and QP (without tests).
@@ -742,40 +790,46 @@
   ;; `metabase-enterprise.sandbox.query-processor*-test`
   ;;
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
-   :name    general-qp-and-driver-test-namespaces}]
+   :name    general-qp-and-driver-test-namespaces}
+
+  {:pattern "(?:^mage.*)"
+   :name    mage-namespaces}]
 
  :config-in-ns
  {test-namespaces
   {:linters
-   {:inline-def                              {:level :off}
-    :missing-docstring                       {:level :off}
-    :private-call                            {:level :off}
-    :metabase/defsetting-must-specify-export {:level :off}
-    :metabase/defsetting-namespace           {:level :off}
+   {:inline-def                                          {:level :off}
+    :missing-docstring                                   {:level :off}
+    :private-call                                        {:level :off}
+    :metabase/defsetting-must-specify-export             {:level :off}
+    :metabase/defsetting-namespace                       {:level :off}
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}
      metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}}}
-
-   :hooks
-   {:analyze-call
-    {clojure.core/defmacro hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn     hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn-    hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation}}}
+     metabase.lib.core/->legacy-MBQL    {:level :off}}}}
 
   source-namespaces
   {:linters
-   {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
-    :metabase/validate-string-or-str-args-to-i18n {:level :warning}
-    :metabase/discourage-millis-duration {:level :warning}
+   {:metabase/discourage-millis-duration               {:level :warning}
+    :metabase/validate-defendpoint-has-response-schema {:level :warning}
+    :metabase/validate-escaped-single-quotes-in-i18n   {:level :warning}
+    :metabase/validate-string-or-str-args-to-i18n      {:level :warning}
 
     :discouraged-var
     {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
      clojure.core/eval        {:message "Don't use eval outside of tests"}}
 
     :discouraged-namespace
-    {metabase.query-processor.store {:message "Please do not use the QP Store outside of legacy QP or driver code. Use MBQL 5/Lib or lib.metadata.jvm/applicaton-database-metadata-provider instead."}}}}
+    {metabase.legacy-mbql.jvm-util       {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.legacy-mbql.normalize      {:message "Avoid legacy MBQL normalization, use MBQL 5 + lib/normalize instead"}
+     metabase.legacy-mbql.predicates     {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.legacy-mbql.schema         {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.schema.helpers {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.schema.macros  {:message "Avoid the legacy MBQL schema, use MBQL 5 + lib.schema instead"}
+     metabase.legacy-mbql.util           {:message "Avoid legacy MBQL utils, use Lib instead"}
+     metabase.query-processor.store      {:message "Please do not use the QP Store outside of legacy QP or driver code. Use MBQL 5/Lib or lib.metadata.jvm/applicaton-database-metadata-provider instead."}}}}
 
   printable-namespaces
   {:linters
@@ -817,34 +871,89 @@
      toucan2.core               {:message "Don't use application database inside Lib code"}}}}
 
   metabase-lib-excluding-legacy-mbql
-  {:linters
-   {:discouraged-var
-    {metabase.legacy-mbql.util/unique-name-generator {:message "Use metabase.lib.util/unique-name-generator or non-truncating-unique-name-generator"}}}
+  {}
 
-   :discouraged-namespace
-   {metabase.legacy-mbql.js         {:message "Avoid legacy MBQL utils in Lib; move things into Lib if needded."}
-    metabase.legacy-mbql.jvm-util   {:message "Avoid legacy MBQL utils in Lib; move things into Lib if needded."}
-    metabase.legacy-mbql.predicates {:message "Avoid legacy MBQL utils in Lib; move things into Lib if needded."}
-    metabase.legacy-mbql.util       {:message "Avoid legacy MBQL utils in Lib; move things into Lib if needded."}}}
+  legacy-mbql-namespaces
+  {:linters
+   {:discouraged-namespace
+    {metabase.legacy-mbql.jvm-util       {:level :off}
+     metabase.legacy-mbql.normalize      {:level :off}
+     metabase.legacy-mbql.predicates     {:level :off}
+     metabase.legacy-mbql.schema         {:level :off}
+     metabase.legacy-mbql.schema.helpers {:level :off}
+     metabase.legacy-mbql.schema.macros  {:level :off}
+     metabase.legacy-mbql.util           {:level :off}
+     metabase.query-processor.store      {:level :off}}
+
+    ;; the `metabase.legacy-mbql` stuff is all deprecated, so we don't need to warn inside the module about other stuff
+    ;; in the module being marked deprecated or discouraged.
+    :deprecated-namespace {:level :off}
+    :deprecated-var       {:level :off}}}
 
   driver-namespaces
   {:linters
    {:discouraged-var
-    {metabase.driver/database-supports? {:level :off}}}}
+    {metabase.driver/database-supports? {:level :off}}
+
+    ;; don't warn about the legacy MBQL namespaces being deprecated or discouraged in driver code now, we don't have a
+    ;; real alternative YET so it's not a helpful warning.
+    :discouraged-namespace
+    {metabase.legacy-mbql.jvm-util       {:level :off}
+     metabase.legacy-mbql.normalize      {:level :off}
+     metabase.legacy-mbql.predicates     {:level :off}
+     metabase.legacy-mbql.schema         {:level :off}
+     metabase.legacy-mbql.schema.helpers {:level :off}
+     metabase.legacy-mbql.schema.macros  {:level :off}
+     metabase.legacy-mbql.util           {:level :off}
+     metabase.query-processor.store      {:level :off}}
+
+    :deprecated-namespace
+    {:exclude
+     [metabase.driver.common.parameters
+      metabase.driver.common.parameters.dates
+      metabase.driver.common.parameters.operators
+      metabase.driver.common.parameters.parse
+      metabase.driver.common.parameters.values
+      metabase.legacy-mbql.jvm-util
+      metabase.legacy-mbql.normalize
+      metabase.legacy-mbql.predicates
+      metabase.legacy-mbql.schema
+      metabase.legacy-mbql.schema.helpers
+      metabase.legacy-mbql.schema.macros
+      metabase.legacy-mbql.util
+      metabase.query-processor.store]}
+
+    :deprecated-var
+    {:exclude
+     {metabase.legacy-mbql.schema.helpers/is-clause?   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.schema.helpers/mbql-clause? {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/query->source-table-id {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/aggregation-at-index   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/assoc-field-options    {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/expression-with-name   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/field-options          {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/negate-filter-clause   {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/normalize-token        {:namespaces ["metabase\\.driver.*"]}
+      metabase.legacy-mbql.util/update-field-options   {:namespaces ["metabase\\.driver.*"]}}}}}
 
   performance-sensitive
   {:linters
    {:discouraged-var
-    {clojure.core/every?          {:message "Use metabase.util.performance/every?"}
+    {clojure.core/empty?          {:message "Use metabase.util.performance/empty?"}
+     clojure.core/not-empty       {:message "Use metabase.util.performance/not-empty"}
+     clojure.core/every?          {:message "Use metabase.util.performance/every?"}
      clojure.core/mapv            {:message "Use metabase.util.performance/mapv"}
      clojure.core/run!            {:message "Use metabase.util.performance/run!"}
+     clojure.core/get-in          {:message "Use metabase.util.performance/get-in"}
      clojure.core/select-keys     {:message "Use metabase.util.performance/select-keys"}
      clojure.core/some            {:message "Use metabase.util.performance/some"}
      clojure.core/update-keys     {:message "Use metabase.util.performance/update-keys"}
      clojure.walk/keywordize-keys {:message "Use metabase.util.performance/keywordize-keys"}
      clojure.walk/postwalk        {:message "Use metabase.util.performance/postwalk"}
      clojure.walk/prewalk         {:message "Use metabase.util.performance/prewalk"}
-     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}}}}
+     clojure.walk/walk            {:message "Use metabase.util.performance/walk"}
+     clojure.walk/for             {:message "Use metabase.util.performance/for"}
+     clojure.walk/doseq           {:message "Use metabase.util.performance/doseq"}}}}
 
   qp-and-driver-source-namespaces
   {:linters
@@ -865,16 +974,7 @@
      metabase.lib.core/->legacy-MBQL      {:level :off}}}}
 
   qp-source-namespaces
-  {:linters
-   {:discouraged-namespace
-    {metabase.legacy-mbql.js             {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.jvm-util       {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.normalize      {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.predicates     {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.schema         {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.schema.helpers {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.schema.macros  {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}
-     metabase.legacy-mbql.util           {:message "Avoid legacy MBQL namespaces in the QP, use Lib instead"}}}}
+  {}
 
   general-qp-and-driver-test-namespaces
   {:linters
@@ -885,4 +985,11 @@
      toucan2.tools.with-temp/with-temp         {:message "Use lib.tu/mock-metadata-provider in QP tests. Exceptions: tests for code that doesn't use MPs or models not supported by MPs"}}
 
     :metabase/disallow-hardcoded-driver-names-in-tests
-    {:level :warning}}}}}
+    {:level :warning}}}
+
+  mage-namespaces
+  {:linters
+   {:discouraged-java-method
+    {java.lang.System {exit
+                       {:level :error
+                        :message "Don't use System/exit directly. Instead use mage.util/exit and let mage handle exiting the process"}}}}}}}

.clj-kondo/config/test-helpers/config.edn

@@ -3,7 +3,7 @@
   ;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
   ;; checker...
   {:explicitly-safe
-   #{ ;; these toucan methods might actually set global values if it's used outside of a transaction,
+   #{;; these toucan methods might actually set global values if it's used outside of a transaction,
      ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
      toucan2.core/delete!
      toucan2.core/update!
@@ -100,7 +100,7 @@
      metabase.permissions.models.permissions/update-data-perms-graph!
      metabase.permissions.models.permissions/update-group-permissions!
      metabase.permissions.test-util/with-restored-perms!
-     metabase.public-sharing.api-test/add-card-to-dashboard!
+     metabase.public-sharing-rest.api-test/add-card-to-dashboard!
      metabase.pulse.send/send-notifications!
      metabase.pulse.send/send-pulse!
      metabase.query-processor.streaming.interface/begin!
@@ -110,6 +110,7 @@
      metabase.settings.models.setting-test/test-user-local-allowed-setting!
      metabase.settings.models.setting-test/test-user-local-only-setting!
      metabase.settings.models.setting.cache/restore-cache!
+     metabase.settings.models.setting/log-deprecated-env-var-usage!
      metabase.settings.models.setting/set!
      metabase.settings.models.setting/validate-settings-formatting!
      metabase.setup.core/create-token!

.clj-kondo/macros/metabase/collections/api_test.clj

@@ -1,24 +0,0 @@
-(ns macros.metabase.collections.api-test)
-
-(defmacro with-collection-hierarchy! [bindings & body]
-  `(let [~'a nil
-         ~'b nil
-         ~'c nil
-         ~'d nil
-         ~'e nil
-         ~'f nil
-         ~'g nil]
-     ~'a
-     ~'b
-     ~'c
-     ~'d
-     ~'e
-     ~'f
-     ~'g
-     ~bindings
-     ~@body))
-
-(defmacro with-some-children-of-collection! [collection-or-id-or-nil & body]
-  `(let [~'&ids ~collection-or-id-or-nil]
-     ~'&ids
-     ~@body))

.clj-kondo/macros/metabase/collections_rest/api_test.clj

@@ -0,0 +1,24 @@
+(ns macros.metabase.collections-rest.api-test)
+
+(defmacro with-collection-hierarchy! [bindings & body]
+  `(let [~'a nil
+         ~'b nil
+         ~'c nil
+         ~'d nil
+         ~'e nil
+         ~'f nil
+         ~'g nil]
+     ~'a
+     ~'b
+     ~'c
+     ~'d
+     ~'e
+     ~'f
+     ~'g
+     ~bindings
+     ~@body))
+
+(defmacro with-some-children-of-collection! [collection-or-id-or-nil & body]
+  `(let [~'&ids ~collection-or-id-or-nil]
+     ~'&ids
+     ~@body))

.clj-kondo/macros/metabase/embedding/api/embed_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.embedding.api.embed-test)
-
-(defmacro with-embedding-enabled-and-temp-card-referencing!
-  [table-kw field-kw [card-binding] & body]
-  `(let [~card-binding [~table-kw ~field-kw]]
-     ~@body))
-
-(defmacro with-embedding-enabled-and-temp-dashcard-referencing!
-  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
-  `(let [~dash-binding             [~table-kw ~field-kw]
-         ~(or card-binding '_)     nil
-         ~(or dashcard-binding '_) nil]
-     ~@body))

.clj-kondo/macros/metabase/embedding/embedding_rest/embed_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.embedding-rest.api.embed-test)
+
+(defmacro with-embedding-enabled-and-temp-card-referencing!
+  [table-kw field-kw [card-binding] & body]
+  `(let [~card-binding [~table-kw ~field-kw]]
+     ~@body))
+
+(defmacro with-embedding-enabled-and-temp-dashcard-referencing!
+  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
+  `(let [~dash-binding             [~table-kw ~field-kw]
+         ~(or card-binding '_)     nil
+         ~(or dashcard-binding '_) nil]
+     ~@body))

.clj-kondo/macros/metabase/public_sharing/api_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.public-sharing.api-test)
-
-(defmacro with-sharing-enabled-and-temp-card-referencing!
-  [table-kw field-kw [card-binding] & body]
-  `(let [~card-binding [~table-kw ~field-kw]]
-     ~@body))
-
-(defmacro with-sharing-enabled-and-temp-dashcard-referencing!
-  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
-  `(let [~dash-binding             [~table-kw ~field-kw]
-         ~(or card-binding '_)     nil
-         ~(or dashcard-binding '_) nil]
-     ~@body))

.clj-kondo/macros/metabase/public_sharing_rest/api_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.public-sharing-rest.api-test)
+
+(defmacro with-sharing-enabled-and-temp-card-referencing!
+  [table-kw field-kw [card-binding] & body]
+  `(let [~card-binding [~table-kw ~field-kw]]
+     ~@body))
+
+(defmacro with-sharing-enabled-and-temp-dashcard-referencing!
+  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
+  `(let [~dash-binding             [~table-kw ~field-kw]
+         ~(or card-binding '_)     nil
+         ~(or dashcard-binding '_) nil]
+     ~@body))

.clj-kondo/macros/metabase/queries/api/card_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.queries.api.card-test)
-
-(defmacro with-ordered-items
-  [collection model-and-name-syms & body]
-  `(let ~(into []
-               (comp (partition-all 2)
-                     (mapcat (fn [[model binding]]
-                               [binding model])))
-               model-and-name-syms)
-     ~collection
-     ~@(->> (partition-all 2 model-and-name-syms)
-            (map second))
-     ~@body))

.clj-kondo/macros/metabase/queries_rest/api/card_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.queries-rest.api.card-test)
+
+(defmacro with-ordered-items
+  [collection model-and-name-syms & body]
+  `(let ~(into []
+               (comp (partition-all 2)
+                     (mapcat (fn [[model binding]]
+                               [binding model])))
+               model-and-name-syms)
+     ~collection
+     ~@(->> (partition-all 2 model-and-name-syms)
+            (map second))
+     ~@body))

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.server.statistics-handler-test)
-
-(defmacro with-server
-  [_ _ [connector chan-start-handle chan-finish-handle chan-done-request] & body]
-  `(let [~connector          nil
-         ~chan-start-handle  nil
-         ~chan-finish-handle nil
-         ~chan-done-request  nil]
-     ~@body))

.clj-kondo/macros/metabase/xrays/domain_entities/malli.clj

@@ -1,16 +0,0 @@
-(ns macros.metabase.xrays.domain-entities.malli)
-
-(defmacro define-getters-and-setters [schema & defs]
-  `(do
-     (comment ~schema) ;; Reference the schema
-     ~@(for [[sym _path] (partition 2 defs)]
-         `(do
-            (defn ~(vary-meta sym
-                              assoc :export true)
-              "docs" [_x#] nil)
-            (defn ~(vary-meta (symbol (str "with-" (name sym)))
-                              assoc :export true)
-              "docs" [x# _new#] x#)
-            (defn ~(vary-meta (symbol (str (name sym) "-js"))
-                              assoc :export true)
-              "docs" [x#] x#)))))

.clj-kondo/src/hooks/clojure/core.clj

@@ -0,0 +1,38 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- all-uppercase? [symb]
+  (let [s (str symb)]
+    (= s #_{:clj-kondo/ignore [:discouraged-var]} (str/upper-case s))))
+
+(defn- has-underscores? [symb]
+  (str/includes? (str symb) "_"))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)]
+    (when (or (all-uppercase? symb)
+              (has-underscores? symb))
+      (hooks/reg-finding! (assoc (meta symbol-node)
+                                 :message "Use kebab-case for function and variable names; don't use special notation for constants."
+                                 :type    :metabase/check-def-kebab-case)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/def.clj

@@ -0,0 +1,52 @@
+(ns hooks.clojure.core.def
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- uppercase-name?
+  "Whether the symbol is clearly an uppercase name like `TYPE-CONSTANTS` or `SOME_CONSTANT` or `TYPE->MODEL`."
+  [s]
+  (and (re-find #"[A-Z0-9]+(?:[-_]>?[A-Z0-9]+)+" s)
+       ;; ignore stuff like `->SCREAMING_SNAKE_CASE`... this is ok
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn- has-underscores? [s]
+  (and (str/includes? s "_")
+       ;; ignore stuff like `->snake_case` and `->SCREAMING_SNAKE_CASE`
+       (not (str/includes? s "snake_case"))
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)
+        s    (str symb)]
+    (cond
+      (uppercase-name? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use lower-case names for functions and variables; don't use special notation for constants. [:metabase/check-def-check-not-all-uppercase]"
+              :type    :metabase/check-def-check-not-uppercase-name))
+
+      (has-underscores? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use kebab-case names for functions and variables. [:metabase/check-def-no-underscores]"
+              :type    :metabase/check-def-no-underscores)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/defmacro.clj

@@ -0,0 +1,7 @@
+(ns hooks.clojure.core.defmacro
+  (:require
+   [hooks.clojure.core.def]))
+
+(defn lint-defmacro [x]
+  (hooks.clojure.core.def/lint-def* x)
+  x)

.clj-kondo/src/hooks/clojure/core/defmulti.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- check-arglists [report-node arglists]
@@ -49,4 +50,5 @@
 
 (defn lint-defmulti [x]
   (defmulti-check-for-arglists-metadata (:node x))
+  (hooks.clojure.core.def/lint-def* x)
   x)

.clj-kondo/src/hooks/clojure/core/defn.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- end-with-exclamation?
@@ -50,6 +51,11 @@
     (non-thread-safe-form-should-end-with-exclamation* node config))
   {:node node})
 
+(defn lint-defn [x]
+  (non-thread-safe-form-should-end-with-exclamation x)
+  (hooks.clojure.core.def/lint-def* x)
+  x)
+
 (comment
   (require '[clj-kondo.core :as clj-kondo])
   (def form (str '(defmacro a

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -99,12 +99,48 @@
                                      :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
                                      :type    :metabase/namespace-name)))))))
 
+(defn- ns-form-node->import-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :import))))
+            node))
+        (:children ns-form-node)))
+
+(defn- jsqlparser-import?
+  "Check if a symbol or string represents a jsqlparser import."
+  [s]
+  (str/starts-with? (str s) "net.sf.jsqlparser"))
+
+(defn- lint-jsqlparser-imports [ns-form-node]
+  (when-let [import-node (ns-form-node->import-node ns-form-node)]
+    (doseq [node (rest (:children import-node))
+            :when (not (contains? (hooks.common/ignored-linters node) :metabase/no-jsqlparser-imports))]
+      (cond
+        ;; Handle (net.sf.jsqlparser.foo Bar Baz) form
+        (hooks/list-node? node)
+        (let [package-node (first (:children node))
+              package-name (when package-node (str (hooks/sexpr package-node)))]
+          (when (jsqlparser-import? package-name)
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                       :type    :metabase/no-jsqlparser-imports))))
+
+        ;; Handle net.sf.jsqlparser.foo.Bar form (single class import)
+        (hooks/token-node? node)
+        (when (jsqlparser-import? (hooks/sexpr node))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                     :type    :metabase/no-jsqlparser-imports)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
-    lint-namespace-name)
+    lint-namespace-name
+    lint-jsqlparser-imports)
   x)
 
 (comment

.clj-kondo/src/hooks/clojure/test.clj

@@ -2,7 +2,8 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
-   [hooks.common]))
+   [hooks.common]
+   [hooks.common.modules :as modules]))
 
 (defn- warn-about-disallowed-parallel-forms [form config]
   (letfn [(error! [form message]
@@ -102,7 +103,39 @@
                (:children node))))]
     (walk node)))
 
-(defn deftest [{:keys [node cljc lang config]}]
+(defn- test-namespace-lives-outside-of-module-system? [ns-symb]
+  (some (fn [prefix]
+          (str/starts-with? (name ns-symb) prefix))
+        ["build-drivers."
+         "build."
+         "i18n." ; bin/i18n
+         "lint-migrations-file-test"
+         "main-test" ; bin/release-list
+         "metabase.deps-edn-test"
+         "metabase.driver."
+         "metabase.test."
+         "metabase.test.data."
+         "metabuild-common."])) ; utils for build scripts
+
+(let [warned-namespaces (atom #{})]
+  (defn deftest-check-in-valid-module
+    "Check whether a `deftest` lives in a known module -- important so our system to only run a subset of tests based on
+  which modules have changes picks them up correctly. (DEV-1125)"
+    [{:keys [node], ns-symb :ns, :as input}]
+    (when (and ns-symb
+               (not (test-namespace-lives-outside-of-module-system? ns-symb))
+               ;; only warn once per namespace
+               (not (contains? @warned-namespaces ns-symb)))
+      (swap! warned-namespaces conj ns-symb)
+      (let [known-modules  (set (keys (:metabase/modules (modules/config input))))
+            current-module (modules/module ns-symb)]
+        (when (or (not current-module)
+                  (not (contains? known-modules current-module)))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message (format "All tests must live in a known module; %s is not a known module" (pr-str current-module))
+                                     :type    :metabase/tests-must-live-in-known-modules)))))))
+
+(defn deftest [{:keys [node cljc lang config], :as input}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
   (when (or (not cljc)
@@ -110,7 +143,8 @@
     (deftest-check-parallel node (get-in config [:linters :metabase/validate-deftest])))
   (deftest-check-not-horrifically-long node (get-in config [:linters :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests]))
   (deftest-check-no-driver-keywords node (get-in config [:linters :metabase/disallow-hardcoded-driver-names-in-tests]))
-  {:node node})
+  (deftest-check-in-valid-module input)
+  input)
 
 ;;; this is a hacky way to determine whether these namespaces are required in the `ns` form or not... basically `:ns`
 ;;; will come back as `nil` if they are not.

.clj-kondo/src/hooks/common/modules.clj

@@ -1,4 +1,6 @@
-(ns hooks.common.modules)
+(ns hooks.common.modules
+  (:require
+   [clojure.string :as str]))
 
 (defn ignored-namespace? [config ns-symb]
   (some
@@ -17,14 +19,19 @@
     (module 'metabase-enterprise.whatever.core) => enterprise/whatever"
   [ns-symb]
   {:pre [(simple-symbol? ns-symb)]}
-  (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
-               second
-               (symbol "enterprise"))
-      (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
-              second
-              symbol)))
+  ;; treat something like `metabase.driver-test` (for a module that hasn't fully been updated to use `.core`
+  ;; namespaces) as being in the `driver` module
+  (let [ns-symb (if (str/ends-with? (name ns-symb) "-test")
+                  (symbol (str/replace (name ns-symb) #"-test$" ""))
+                  ns-symb)]
+    (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
+                 second
+                 (symbol "enterprise"))
+        (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
+                second
+                symbol))))
 
-(defn module-api-namespaces
+(defn- module-api-namespaces
   "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
   this module (yet). If unspecified, the default is just the `<module>.core` namespace."
   [config module]
@@ -44,6 +51,12 @@
           (symbol (str ns-prefix ".core"))
           (symbol (str ns-prefix ".init"))}))))
 
+(defn- module-friends
+  [config module]
+  "Set of modules that are `:friends` of `module`, i.e. allowed to use *any* namespace from the module, not just the
+  designated [[module-api-namespaces]]."
+  (set (get-in config [:metabase/modules module :friends])))
+
 (defn allowed-modules
   "Set of namespace symbols that `module` is allowed to use. `:any` means it's allowed to use anything."
   [config module]
@@ -54,11 +67,22 @@
     (or (= allowed-modules :any)
         (contains? (set allowed-modules) required-module))))
 
-(defn allowed-module-namespace? [config ns-symb]
+(defn- allowed-module-namespace? [config current-module ns-symb]
   (let [module                (module ns-symb)
-        module-api-namespaces (module-api-namespaces config module)]
+        module-api-namespaces (module-api-namespaces config module)
+        module-friends        (module-friends config module)]
     (or (empty? module-api-namespaces)
-        (contains? module-api-namespaces ns-symb))))
+        (contains? module-api-namespaces ns-symb)
+        (contains? module-friends current-module))))
+
+(defn- rest-module? [module]
+  (str/ends-with? module "-rest"))
+
+(defn- routes-module? [module]
+  (str/ends-with? module "-routes"))
+
+(defn- core-module? [module]
+  (str/ends-with? module "core"))
 
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
@@ -74,8 +98,19 @@
                 current-module
                 current-module)
 
-        (not (allowed-module-namespace? config required-namespace))
+        (not (allowed-module-namespace? config current-module required-namespace))
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module
-                required-module)))))
+                required-module)
+
+        ;; (for now) rest modules are allowed to use one another; `routes` is ok because it collects routes together
+        ;; and `core` is ok because [[metabase.core.init]] might need to init some of the `-routes` modules'
+        ;; namespaces
+        (and (not ((some-fn rest-module? routes-module? core-module?) current-module))
+             (rest-module? required-module))
+        (format "Do not use -rest modules (%s) in non-rest modules (%s) -- move things from %s to %s if needed"
+                required-module
+                current-module
+                required-module
+                (symbol (str/replace required-module #"-rest$" "")))))))

.clj-kondo/src/hooks/metabase/api/macros.clj

@@ -1,7 +1,67 @@
 (ns hooks.metabase.api.macros
   (:require
    [clj-kondo.hooks-api :as api]
-   [hooks.common]))
+   [clojure.string :as str]))
+
+(defn- validate-route!
+  "Make sure the route uses kebab-case rather than snake_case."
+  [route]
+  (letfn [(validate-route-string! [route-string]
+            (when (and (api/string-node? route-string)
+                       (str/includes? (api/sexpr route-string) "_"))
+              (api/reg-finding! (assoc (meta route-string)
+                                       :message "REST API routes and query params should use kebab-case, not snake_case"
+                                       :type    :metabase/validate-defendpoint-route-uses-kebab-case))))]
+    (cond
+      (api/string-node? route)
+      (validate-route-string! route)
+      ;; otherwise route is a vector like ["/abc/:d/" :d <regex>]
+      (api/vector-node? route)
+      (validate-route-string! (first (:children route))))))
+
+(defn- validate-query-params!
+  "Make sure query params use kebab-case rather than snake_case.
+
+  This only works on inline schemas for now. If you define the schema elsewhere then we'd have to implement this
+  validation in Clojure-land since we can't resolve the schemas in Kondo. It should however still work on complicated
+  schemas like
+
+    [:merge <map-1> <map-2>]"
+  [query-param-schema-node]
+  (letfn [(map-schema? [node]
+            (and (api/vector-node? node)
+                 (when-let [first-child (first (:children node))]
+                   (and (api/keyword-node? first-child)
+                        (= (api/sexpr first-child) :map)))))
+          (map-schema-keys [{:keys [children], :as _node}]
+            (let [child-schemas (if (api/map-node? (second children))
+                                  (drop 2 children)
+                                  (drop 1 children))]
+              (keep (fn [child-schema]
+                      (when (api/vector-node? child-schema)
+                        (when-let [k (first (:children child-schema))]
+                          (when (api/keyword-node? k)
+                            k))))
+                    child-schemas)))
+          (validate-map-schema! [form]
+            ;; only warn once per endpoint -- just once on the first bad node
+            (when-let [bad-node (some (fn [key-node]
+                                        (when (str/includes? (str (api/sexpr key-node)) "_")
+                                          key-node))
+                                      (map-schema-keys form))]
+              (api/reg-finding! (assoc (meta bad-node)
+                                       :message "REST API routes and query params should use kebab-case, not snake_case"
+                                       :type    :metabase/validate-defendpoint-query-params-use-kebab-case))))
+          (validate! [node]
+            (cond
+              (and (api/vector-node? node)
+                   (map-schema? node))
+              (validate-map-schema! node)
+
+              (api/vector-node? node)
+              (doseq [child (:children node)]
+                (validate! child))))]
+    (validate! query-param-schema-node)))
 
 (defn defendpoint
   [arg]
@@ -18,16 +78,25 @@
                                       (cons nil more))
                   [params & body] more
                   [bindings schemas] (when (api/vector-node? params)
-                                       (loop [bindings [], schemas [], [x y & more] (:children params)]
+                                       (loop [bindings [], schemas [], [x y z & more] (:children params)]
                                          (cond
                                            (not x)
                                            [bindings schemas]
 
-                                           (= (api/sexpr x) :-)
-                                           (recur bindings (conj schemas y) more)
+                                           (and (api/keyword-node? y)
+                                                (= (api/sexpr y) :-))
+                                           (recur (conj bindings x) (conj schemas z) more)
 
                                            :else
-                                           (recur (conj bindings x) schemas (cons y more)))))]
+                                           (recur (conj bindings x) (conj schemas nil) (list* y z more)))))]
+              (validate-route! route)
+              (when-not result-schema
+                (api/reg-finding! (assoc (meta node)
+                                         :message "All REST API endpoints should have a detailed response schema"
+                                         :type    :metabase/validate-defendpoint-has-response-schema)))
+              (let [[_route-param-schema query-param-schema _body-param-schema] schemas]
+                (when query-param-schema
+                  (validate-query-params! query-param-schema)))
               (-> (api/list-node
                    (list
                     (api/token-node 'do)
@@ -54,3 +123,27 @@
                       body))))
                   (with-meta (meta node)))))]
     (update arg :node update-defendpoint)))
+
+(comment
+  (defn -defendpoint [form]
+    (-> {:node (-> form pr-str api/parse-string)}
+        defendpoint
+        :node
+        api/sexpr))
+
+  (defn x []
+    (-defendpoint '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
+                     "Returns a list of all syncable schemas found for the database `id`."
+                     [{:keys [id]} :- [:map
+                                       [:id ms/PositiveInt]]
+                      ;; snake_case query parameter, should trigger a warning
+                      {:keys [filter_by]} :- [:map
+                                              [:filter_by {:optional true} :string]]]
+                     (let [db (get-database id)]
+                       (api/check-403 (or (:is_attached_dwh db)
+                                          (and (mi/can-write? db)
+                                               (mi/can-read? db))))
+                       (->> db
+                            (driver/syncable-schemas (:engine db))
+                            (vec)
+                            (sort)))))))

.clj-kondo/src/hooks/metabase/legacy_mbql/schemas/macros.clj

@@ -33,18 +33,36 @@
     (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
     =>
     (def ag:var [FieldOrExpressionDef])"
-  [{:keys [node]}]
-  (let [[_defclause clause-name-form & arg-specs] (:children node)]
-    {:node (-> (hooks/list-node
-                (list
-                 (hooks/token-node 'def)
-                 (unwrap-defclause-clause-name clause-name-form)
-                 (hooks/string-node "Docstring.")
-                 (collect-defclause-body-schemas arg-specs)))
-               (with-meta (meta node)))}))
+  [{:keys [node], :as x}]
+  (let [[_defclause clause-name & arg-specs] (:children node)]
+    (assoc x :node (-> (hooks/list-node
+                        (list
+                         (hooks/token-node 'do)
+                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
+                             (with-meta (meta clause-name))
+                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause))
+                         (collect-defclause-body-schemas arg-specs)))
+                       (with-meta (meta node))))))
+
+(defn defclause*
+  "e.g.
+
+    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
+    =>
+    (def ag:var [FieldOrExpressionDef])"
+  [{:keys [node], :as x}]
+  (let [[_defclause clause-name schema] (:children node)]
+    (assoc x :node (-> (hooks/list-node
+                        (list
+                         (hooks/token-node 'do)
+                         (-> (hooks/keyword-node (keyword "metabase.legacy-mbql.schema" (name (hooks/sexpr clause-name))))
+                             (with-meta (meta clause-name))
+                             (hooks/reg-keyword! 'metabase.legacy-mbql.schemas.macros/defclause*))
+                         schema))
+                       (with-meta (meta node))))))
 
 (comment
-  (defn- defclause* [form]
+  (defn- expand-defclause [form]
     (hooks/sexpr
      (:node
       (defclause
@@ -55,15 +73,35 @@
              form)))}))))
 
   (defn- x []
-    (defclause* '(defclause [ag:var var]
-                   field-or-expression FieldOrExpressionDef)))
+    (expand-defclause '(defclause var
+                         field-or-expression FieldOrExpressionDef)))
   ;; =>
-  (def ag:var "Docstring." [FieldOrExpressionDef])
+  (do :metabase.legacy-mbql.schema/var [FieldOrExpressionDef])
 
   (defn- y []
-    (defclause* '(defclause var
-                   x (some-list-schema)
-                   y (optional FieldOrExpressionDef)
-                   z (rest (some-other-schema)))))
+    (expand-defclause '(defclause var
+                         x (some-list-schema)
+                         y (optional FieldOrExpressionDef)
+                         z (rest (some-other-schema)))))
   ;; =>
-  (def var "Docstring." [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
+  (do :metabase.legacy-mbql.schema/var [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))
+
+(defn one-of [{:keys [node], :as x}]
+  (let [[_one-of & schema-nodes] (:children node)
+        node' (-> (hooks/vector-node
+                   (mapv (fn [schema-node]
+                           (if (and (hooks/token-node? schema-node)
+                                    (simple-symbol? (hooks/sexpr schema-node)))
+                             (-> (hooks/keyword-node (keyword "mteabase.legacy-mbql.schema" (name (hooks/sexpr schema-node))))
+                                 (with-meta (meta schema-node)))
+                             schema-node))
+                         schema-nodes))
+                  (with-meta (meta node)))]
+    (assoc x :node node')))
+
+(comment
+  (defn- expand-one-of [form]
+    (hooks/sexpr (:node (one-of {:node (hooks/parse-string (with-out-str (clojure.pprint/pprint form)))}))))
+
+  (defn- z []
+    (expand-one-of '(one-of absolute-datetime relative-datetime time))))

.clj-kondo/src/hooks/metabase/query_processor/expressions_test.clj

@@ -0,0 +1,16 @@
+(ns hooks.metabase.query-processor.expressions-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.metabase.test.data :as data]))
+
+(defn calculate-bird-scarcity
+  [{{[_ formula filter-clause] :children} :node}]
+  (let [formula*       (data/replace-$id-special-tokens formula)
+        filter-clause* (or (some-> filter-clause data/replace-$id-special-tokens)
+                           (hooks/token-node 'nil))
+        node*          (hooks/list-node
+                        (list
+                         (hooks/token-node 'do)
+                         formula*
+                         filter-clause*))]
+    {:node node*}))

.clj-kondo/src/hooks/metabase/query_processor_test/expressions_test.clj

@@ -1,16 +0,0 @@
-(ns hooks.metabase.query-processor-test.expressions-test
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [hooks.metabase.test.data :as data]))
-
-(defn calculate-bird-scarcity
-  [{{[_ formula filter-clause] :children} :node}]
-  (let [formula*       (data/replace-$id-special-tokens formula)
-        filter-clause* (or (some-> filter-clause data/replace-$id-special-tokens)
-                           (hooks/token-node 'nil))
-        node*          (hooks/list-node
-                        (list
-                         (hooks/token-node 'do)
-                         formula*
-                         filter-clause*))]
-    {:node node*}))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -55,7 +55,6 @@
      help-link-custom-destination
      instance-creation
      is-hosted?
-     is-metabot-enabled
      jdbc-data-warehouse-max-connection-pool-size
      jdbc-data-warehouse-unreturned-connection-timeout-seconds
      jwt-attribute-email
@@ -97,7 +96,6 @@
      metabot-get-prompt-templates-url
      metabot-prompt-generator-token-limit
      multi-setting-read-only
-     notebook-native-preview-shown
      notebook-native-preview-sidebar-width
      notification-link-base-url
      num-metabot-choices
@@ -119,10 +117,10 @@
      reset-token-ttl-hours
      retired-setting
      retry-initial-interval
-     retry-max-attempts
+     retry-max-retries
      retry-max-interval-millis
      retry-multiplier
-     retry-randomization-factor
+     retry-jitter-factor
      saml-application-name
      saml-attribute-email
      saml-attribute-firstname

.clj-kondo/src/hooks/metabase/test/util.clj

@@ -1,6 +1,6 @@
 (ns hooks.metabase.test.util
-  (:require [clj-kondo.hooks-api :as hooks]
-            [hooks.common :as common]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
 
 (defn- namespaced-symbol-node? [node]
   (when (hooks/token-node? node)

.clj-kondo/src/hooks/metabase/toucan/table_name.clj

@@ -0,0 +1,43 @@
+(ns hooks.metabase.toucan.table-name
+  "Lint that toucan2 model namespaces (those defining `t2/table-name`) live
+  under `metabase[-enterprise]/<module>/models[/…]`.
+
+  This wraps the methodical `defmethod` hook: we delegate to
+  `hooks.methodical.macros/defmethod` for the actual analysis (so arg bindings
+  etc. still work), and additionally check the file location when the
+  multimethod being defined is `t2/table-name`."
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn- models-file? [filename]
+  (boolean
+   (and filename
+        (re-find #"/(?:metabase|metabase_enterprise)/[^/]+/models(?:/|\.clj[cs]?$)"
+                 filename))))
+
+(defn- table-name-dispatch? [sym]
+  (and (symbol? sym)
+       (= (name sym) "table-name")
+       (#{"t2" "toucan2.core"} (namespace sym))))
+
+(defn lint-defmethod
+  "Hook registered at the project level on `methodical.core/defmethod` (and
+  `methodical.macros/defmethod`). Performs the table-name check, then
+  delegates to the vendored methodical hook so kondo's normal analysis of the
+  defmethod body still runs."
+  [{:keys [filename node] :as input}]
+  (let [[_defmethod multimethod & _args] (:children node)
+        dispatch (when multimethod
+                   (try (hooks/sexpr multimethod) (catch Exception _ nil)))]
+    (when (and (table-name-dispatch? dispatch)
+               (not (models-file? filename)))
+      (hooks/reg-finding!
+       (assoc (meta multimethod)
+              :message (format "Toucan2 `table-name` defmethods must live under `<module>/models[/…]` (got %s)"
+                               filename)
+              :type :metabase/toucan-model-ns))))
+  ;; Delegate to the vendored methodical defmethod hook so kondo's normal
+  ;; analysis of the defmethod body still runs. Resolved lazily because
+  ;; `hooks.methodical.macros` isn't on the classpath during `.clj-kondo/test`
+  ;; unit-test runs.
+  ((requiring-resolve 'hooks.methodical.macros/defmethod) input))

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -43,6 +43,17 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-friends-test
+  (is (= []
+         (lint-modules
+          '(ns metabase.search-rest.api
+             (:require
+              [metabase.search.config :as search.config]
+              [metabase.search.core :as search]))
+          '{:metabase/modules {search      {:api     #{metabase.search.core}
+                                            :friends #{search-rest}}
+                               search-rest {:uses #{search}}}}))))
+
 (deftest ^:parallel module-checker-api-namespaces-ignore-test
   (is (empty? (lint-modules
                '(ns metabase.api.search

.clj-kondo/test/hooks/metabase/api/macros_test.clj

@@ -1,6 +1,7 @@
 (ns hooks.metabase.api.macros-test
   (:require
    [clj-kondo.hooks-api :as api]
+   [clj-kondo.impl.utils]
    [clojure.test :refer :all]
    [hooks.metabase.api.macros]))
 
@@ -69,3 +70,41 @@
              (respond :x)
              (catch Throwable e
                (raise e))))))))
+
+(defn- defendpoint [form]
+  (hooks.metabase.api.macros/defendpoint
+    {:node (-> form pr-str api/parse-string)}))
+
+(defn- defendpoint-warnings
+  [form]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
+                                                               :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (defendpoint form)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest ^:parallel validate-route-kebab-case-test
+  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case"
+            :type    :metabase/validate-defendpoint-route-uses-kebab-case
+            :row     pos-int?
+            :col     pos-int?}]
+          (defendpoint-warnings
+            '(api.macros/defendpoint :get "/:id/syncable_schemas" ; snake_case route should trigger a warning
+               "Returns a list of all syncable schemas found for the database `id`."
+               [{:keys [id]}]
+               id)))))
+
+(deftest ^:parallel validate-query-params-kebab-case-test
+  (is (=? [{:message "REST API routes and query params should use kebab-case, not snake_case",
+            :type    :metabase/validate-defendpoint-query-params-use-kebab-case
+            :row     pos-int?
+            :col     pos-int?}]
+          (defendpoint-warnings
+            '(api.macros/defendpoint :get "/:id/syncable-schemas"
+               "Returns a list of all syncable schemas found for the database `id`."
+               [{:keys [id]}
+                {:keys [filter_by]} :- [:map
+                                        [:filter_by {:optional true} :string]]]
+               id)))))

.clj-kondo/test/hooks/metabase/toucan/table_name_test.clj

@@ -0,0 +1,46 @@
+(ns hooks.metabase.toucan.table-name-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.toucan.table-name :as toucan.table-name]))
+
+;; `hooks.methodical.macros` isn't on the classpath under `.clj-kondo/test`,
+;; so stub it out — `lint-defmethod` delegates to it via `requiring-resolve`.
+;; If it ever becomes available, warn so we remember to delete this stub.
+(if (find-ns 'hooks.methodical.macros)
+  (println (str "WARNING: hooks.methodical.macros is now on the test classpath; "
+                "the stub in " *ns* " is no longer needed and can be removed."))
+  (do (create-ns 'hooks.methodical.macros)
+      (intern 'hooks.methodical.macros 'defmethod (fn [input] input))))
+
+(defn- lint-defmethod [form filename]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/toucan-model-ns {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (toucan.table-name/lint-defmethod {:node     (hooks/parse-string (pr-str form))
+                                       :filename filename})
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest ^:parallel table-name-must-live-in-models-namespace-test
+  (testing "defmethod t2/table-name outside a models namespace is flagged"
+    (is (=? [{:type :metabase/toucan-model-ns}]
+            (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                            "/repo/src/metabase/foo/core.clj"))))
+  (testing "defmethod t2/table-name inside <module>/models.clj is allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/src/metabase/foo/models.clj"))))
+  (testing "defmethod t2/table-name inside <module>/models/<model>.clj is allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/src/metabase/foo/models/bar.clj"))))
+  (testing "enterprise modules are also allowed"
+    (is (empty? (lint-defmethod '(defmethod t2/table-name :model/Foo [_] :foo)
+                                "/repo/enterprise/backend/src/metabase_enterprise/foo/models.clj"))))
+  (testing "toucan2.core/table-name is also recognized"
+    (is (=? [{:type :metabase/toucan-model-ns}]
+            (lint-defmethod '(defmethod toucan2.core/table-name :model/Foo [_] :foo)
+                            "/repo/src/metabase/foo/core.clj"))))
+  (testing "unrelated defmethods are ignored"
+    (is (empty? (lint-defmethod '(defmethod t2/primary-keys :model/Foo [_] [:id])
+                                "/repo/src/metabase/foo/core.clj")))))

.cljfmt.edn

@@ -38,323 +38,324 @@
  ;; zero get indented 2 spaces if not on the first line regardless of number of elements on the first line.
  :extra-indents
  {;; clojure.core stuff
-  fn*                                                                                  [[:inner 0]]
-  let*                                                                                 [[:block 1]]
-  with-meta                                                                            [[:default]]
+  fn*                                                                                         [[:inner 0]]
+  let*                                                                                        [[:block 1]]
+  with-meta                                                                                   [[:default]]
   ;; library stuff. Libraries that specify their own `:style/indent` specs are included in the section after this
   ;; since it is generated automatically.
-  clojure.core.logic/fresh                                                             [[:block 1]]
-  clojure.core.logic/matcha                                                            [[:block 1]]
-  clojure.core.logic/run                                                               [[:block 2]]
-  clojure.core.match/match                                                             [[:block 1]]
-  clojure.test.check.properties/for-all                                                [[:block 1]]
-  clojure.test.check.properties/for-all*                                               [[:block 1]]
-  clojure.test.check/quick-check                                                       [[:block 1]]
-  clojure.tools.macro/macrolet                                                         [[:block 1] [:inner 2 0]]
-  clojurewerkz.quartzite.jobs/build                                                    [[:default]]
-  clojurewerkz.quartzite.jobs/with-description                                         [[:default]]
-  clojurewerkz.quartzite.jobs/with-identity                                            [[:default]]
-  clojurewerkz.quartzite.schedule.cron/schedule                                        [[:default]]
-  clojurewerkz.quartzite.schedule.cron/with-misfire-handling-instruction-do-nothing    [[:default]]
-  clojurewerkz.quartzite.triggers/build                                                [[:default]]
-  clojurewerkz.quartzite.triggers/with-description                                     [[:default]]
-  clojurewerkz.quartzite.triggers/with-identity                                        [[:default]]
-  clojurewerkz.quartzite.triggers/with-priority                                        [[:default]]
-  clojurewerkz.quartzite.triggers/with-schedule                                        [[:default]]
-  def-map-type                                                                         [[:block 2] [:inner 1]]
-  defprotocol+                                                                         [[:block 1] [:inner 1]]
-  defrecord+                                                                           [[:block 2] [:inner 1]]
-  deftype+                                                                             [[:block 2] [:inner 1]]
-  net.cgrand.macrovich/case                                                            [[:block 0]]
-  potemkin.namespaces/import-vars                                                      [[:default]]
-  potemkin.types/def-map-type                                                          [[:block 2] [:inner 1]]
-  potemkin.types/defprotocol+                                                          [[:block 1] [:inner 1]]
-  potemkin.types/defrecord+                                                            [[:block 2] [:inner 1]]
-  potemkin.types/deftype+                                                              [[:block 2] [:inner 1]]
-  potemkin/def-map-type                                                                [[:block 2] [:inner 1]]
-  potemkin/defprotocol+                                                                [[:block 1] [:inner 1]]
-  potemkin/defrecord+                                                                  [[:block 2] [:inner 1]]
-  potemkin/deftype+                                                                    [[:block 2] [:inner 1]]
-  potemkin/import-vars                                                                 [[:default]]
-  taoensso.nippy/extend-freeze                                                         [[:inner 0]]
-  taoensso.nippy/extend-thaw                                                           [[:inner 0]]
-  throttle.core/with-throttling                                                        [[:block 1]]
+  clojure.core.match/match                                                                    [[:block 1]]
+  clojure.test.check.properties/for-all                                                       [[:block 1]]
+  clojure.test.check.properties/for-all*                                                      [[:block 1]]
+  clojure.test.check/quick-check                                                              [[:block 1]]
+  clojure.tools.macro/macrolet                                                                [[:block 1] [:inner 2 0]]
+  clojurewerkz.quartzite.jobs/build                                                           [[:default]]
+  clojurewerkz.quartzite.jobs/with-description                                                [[:default]]
+  clojurewerkz.quartzite.jobs/with-identity                                                   [[:default]]
+  clojurewerkz.quartzite.schedule.cron/schedule                                               [[:default]]
+  clojurewerkz.quartzite.schedule.cron/with-misfire-handling-instruction-do-nothing           [[:default]]
+  clojurewerkz.quartzite.triggers/build                                                       [[:default]]
+  clojurewerkz.quartzite.triggers/with-description                                            [[:default]]
+  clojurewerkz.quartzite.triggers/with-identity                                               [[:default]]
+  clojurewerkz.quartzite.triggers/with-priority                                               [[:default]]
+  clojurewerkz.quartzite.triggers/with-schedule                                               [[:default]]
+  def-map-type                                                                                [[:block 2] [:inner 1]]
+  defprotocol+                                                                                [[:block 1] [:inner 1]]
+  defrecord+                                                                                  [[:block 2] [:inner 1]]
+  deftype+                                                                                    [[:block 2] [:inner 1]]
+  net.cgrand.macrovich/case                                                                   [[:block 0]]
+  potemkin.namespaces/import-vars                                                             [[:default]]
+  potemkin.types/def-map-type                                                                 [[:block 2] [:inner 1]]
+  potemkin.types/defprotocol+                                                                 [[:block 1] [:inner 1]]
+  potemkin.types/defrecord+                                                                   [[:block 2] [:inner 1]]
+  potemkin.types/deftype+                                                                     [[:block 2] [:inner 1]]
+  potemkin/def-map-type                                                                       [[:block 2] [:inner 1]]
+  potemkin/defprotocol+                                                                       [[:block 1] [:inner 1]]
+  potemkin/defrecord+                                                                         [[:block 2] [:inner 1]]
+  potemkin/deftype+                                                                           [[:block 2] [:inner 1]]
+  potemkin/import-vars                                                                        [[:default]]
+  taoensso.nippy/extend-freeze                                                                [[:inner 0]]
+  taoensso.nippy/extend-thaw                                                                  [[:inner 0]]
+  throttle.core/with-throttling                                                               [[:block 1]]
   ;; the rest of the stuff in this list is generated automatically based on `:style/indent` specs
   ;; by running [[dev.generate-cljfmt-config/specs]]... use that code to update this list
-  metabase-enterprise.cache.config-test/with-temp-persist-models                         [[:block 1]]
-  metabase-enterprise.impersonation.util-test/with-impersonations!                       [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-gtaps!                                      [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                             [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-user-attributes                             [[:block 2]]
-  metabase-enterprise.serialization.test-util/with-dbs                                   [[:inner 0]]
-  metabase-enterprise.serialization.test-util/with-random-dump-dir                       [[:block 1]]
-  metabase-enterprise.serialization.test-util/with-world                                 [[:block 0]]
-  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted            [[:block 1]]
-  metabase-enterprise.test/with-gtaps!                                                   [[:inner 0]]
-  metabase-enterprise.test/with-gtaps-for-user!                                          [[:inner 0]]
-  metabase-enterprise.test/with-user-attributes                                          [[:block 2]]
-  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled  [[:block 0]]
-  metabase.actions.test-util/with-actions                                                [[:block 1]]
-  metabase.actions.test-util/with-actions-disabled                                       [[:block 0]]
-  metabase.actions.test-util/with-actions-enabled                                        [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data                                      [[:inner 0]]
-  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                  [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data-tables                               [[:block 1]]
-  metabase.actions.test-util/with-empty-db                                               [[:inner 0]]
-  metabase.actions.test-util/with-temp-test-data                                         [[:inner 0]]
-  metabase.api.common/check                                                              [[:default]]
-  metabase.api.common/define-routes                                                      [[:block 0]]
-  metabase.api.common/let-404                                                            [[:block 1]]
-  metabase.app-db.core/with-application-db                                               [[:inner 0]]
-  metabase.app-db.liquibase/with-liquibase                                               [[:block 1]]
-  metabase.app-db.liquibase/with-scope-locked                                            [[:block 1]]
-  metabase.app-db.schema-migrations-test.impl/test-migrations                            [[:block 2]]
-  metabase.cmd.copy/step                                                                 [[:block 1]]
-  metabase.cmd.copy/with-connection-rollback-only                                        [[:block 1]]
-  metabase.cmd.copy/with-disabled-db-constraints                                         [[:block 2]]
-  metabase.collections.api-test/with-collection-hierarchy                                [[:block 1]]
-  metabase.collections.api-test/with-french-user-and-personal-collection                 [[:block 2]]
-  metabase.collections.api-test/with-some-children-of-collection                         [[:block 1]]
-  metabase.collections.models.collection-test/with-collection-hierarchy                  [[:block 1]]
-  metabase.collections.models.collection-test/with-current-user-perms-for-collections    [[:block 1]]
-  metabase.collections.models.collection-test/with-personal-and-impersonal-collections   [[:block 1]]
-  metabase.config/build-type-case                                                        [[:block 0]]
-  metabase.dashboards.models.dashboard-test/with-dash-in-collection                      [[:inner 0]]
-  metabase.driver-api.core/match                                                         [[:inner 0]]
-  metabase.driver-api.core/match-one                                                     [[:inner 0]]
-  metabase.driver-api.core/replace                                                       [[:inner 0]]
-  metabase.driver-api.core/replace-in                                                    [[:inner 0]]
-  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                  [[:default]]
-  metabase.driver.druid.client/DELETE                                                    [[:default]]
-  metabase.driver.druid.client/GET                                                       [[:default]]
-  metabase.driver.druid.client/POST                                                      [[:default]]
-  metabase.driver.druid.query-processor-test/druid-query                                 [[:block 0]]
-  metabase.driver.druid.query-processor-test/druid-query-returning-rows                  [[:block 0]]
-  metabase.driver.mongo.query-processor/mongo-let                                        [[:block 1]]
-  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                 [[:block 1]]
-  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection        [[:block 1]]
-  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                  [[:block 1]]
-  metabase.driver.sql.query-processor/apply-top-level-clause                             [[:default]]
-  metabase.driver/with-driver                                                            [[:block 1]]
-  metabase.embedding.api.embed-test/do-response-formats                                  [[:block 1]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
-  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing [[:block 3]]
-  metabase.embedding.api.embed-test/with-new-secret-key                                  [[:block 0]]
-  metabase.embedding.api.embed-test/with-temp-card                                       [[:block 1]]
-  metabase.embedding.api.embed-test/with-temp-dashcard                                   [[:block 1]]
-  metabase.embedding.api.preview-embed-test/with-embedding-enabled-and-new-secret-key    [[:block 0]]
-  metabase.embedding.api.preview-embed-test/with-new-secret-key                          [[:block 0]]
-  metabase.lib.binning/with-binning                                                      [[:default]]
-  metabase.lib.core/with-binning                                                         [[:default]]
-  metabase.lib.core/with-join-alias                                                      [[:default]]
-  metabase.lib.core/with-join-conditions                                                 [[:default]]
-  metabase.lib.join/with-join-alias                                                      [[:default]]
-  metabase.lib.join/with-join-conditions                                                 [[:default]]
-  metabase.lib.test-util.macros/$ids                                                     [[:inner 0]]
-  metabase.lib.test-util.macros/mbql-5-query                                             [[:inner 0]]
-  metabase.lib.test-util.macros/mbql-query                                               [[:inner 0]]
-  metabase.lib.util.match/match                                                          [[:inner 0]]
-  metabase.lib.util.match/match-one                                                      [[:inner 0]]
-  metabase.lib.util.match/match-lite                                                     [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                           [[:inner 0]]
-  metabase.lib.util.match/replace                                                        [[:inner 0]]
-  metabase.lib.util.match/replace-in                                                     [[:inner 0]]
-  metabase.models.interface/define-batched-hydration-method                              [[:inner 0]]
-  metabase.models.interface/define-simple-hydration-method                               [[:inner 0]]
-  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                [[:block 1]]
-  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping                 [[:block 0]]
-  metabase.parameters.chain-filter-test/with-human-readable-values-remapping             [[:block 0]]
-  metabase.permissions.core/allow-changing-all-users-group-members                       [[:block 0]]
-  metabase.permissions.core/disable-perms-cache                                          [[:block 0]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing    [[:block 3]]
-  metabase.public-sharing.api-test/with-temp-public-card                                 [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard                            [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
-  metabase.pulse.api.alert-test/with-alert-in-collection                                 [[:block 1]]
-  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard        [[:block 2]]
-  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection             [[:block 1]]
-  metabase.pulse.models.pulse-test/with-pulse-in-collection                              [[:inner 0]]
-  metabase.queries.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
-  metabase.queries.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
-  metabase.queries.api.card-test/with-ordered-items                                      [[:inner 0]]
-  metabase.queries.api.card-test/with-temp-native-card!                                  [[:block 1]]
-  metabase.queries.api.card-test/with-temp-native-card-with-params!                      [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                        [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                    [[:block 1]]
-  metabase.query-processor.debug/debug>                                                  [[:block 0]]
-  metabase.query-processor.error-type/deferror                                           [[:block 1]]
-  metabase.query-processor.middleware.cache-backend.interface/with-cached-results        [[:block 4]]
-  metabase.query-processor.middleware.process-userland-query-test/with-query-execution   [[:block 1]]
-  metabase.query-processor.store/cached                                                  [[:block 1]]
-  metabase.query-processor.store/with-metadata-provider                                  [[:inner 0]]
-  metabase.query-processor.streaming/streaming-response                                  [[:block 1]]
-  metabase.query-processor.test-util/format-rows-by                                      [[:default]]
-  metabase.request.core/as-admin                                                         [[:block 0]]
-  metabase.request.core/with-current-request                                             [[:inner 0]]
-  metabase.request.core/with-current-user                                                [[:inner 0]]
-  metabase.request.core/with-limit-and-offset                                            [[:inner 0]]
-  metabase.request.session/as-admin                                                      [[:block 0]]
-  metabase.request.session/with-current-user                                             [[:inner 0]]
-  metabase.sample-data.impl-test/with-temp-sample-database-db                            [[:block 1]]
-  metabase.search.api-test/do-test-users                                                 [[:block 1]]
-  metabase.server.middleware.session/as-admin                                            [[:block 0]]
-  metabase.server.middleware.session/with-current-user                                   [[:inner 0]]
-  metabase.server.streaming-response-test/with-streaming-response-thread-pool            [[:block 0]]
-  metabase.server.streaming-response-test/with-test-driver-db!                           [[:block 0]]
-  metabase.server.streaming-response/streaming-response                                  [[:block 2]]
-  metabase.session.api/http-401-on-error                                                 [[:block 0]]
-  metabase.settings.core/define-multi-setting                                            [[:inner 0]]
-  metabase.settings.core/defsetting                                                      [[:block 1]]
-  metabase.settings.models.setting.multi-setting/define-multi-setting                    [[:inner 0]]
-  metabase.settings.models.setting/defsetting                                            [[:block 1]]
-  metabase.sync.fetch-metadata/log-if-error                                              [[:block 1]]
-  metabase.sync.sync-metadata.fields-test/with-test-db                                   [[:block 0]]
-  metabase.sync.util/do-with-start-and-finish-debug-logging                              [[:default]]
-  metabase.sync.util/sum-for                                                             [[:block 1]]
-  metabase.sync.util/sync-operation                                                      [[:block 3]]
-  metabase.sync.util/with-db-logging-disabled                                            [[:default]]
-  metabase.sync.util/with-duplicate-ops-prevented                                        [[:default]]
-  metabase.sync.util/with-emoji-progress-bar                                             [[:block 1]]
-  metabase.sync.util/with-error-handling                                                 [[:block 1]]
-  metabase.sync.util/with-start-and-finish-logging                                       [[:default]]
-  metabase.sync.util/with-start-and-finish-logging*                                      [[:default]]
-  metabase.sync.util/with-sync-events                                                    [[:default]]
-  metabase.task-history.models.task-history/with-task-history                            [[:block 1]]
-  metabase.task.core/rerun-on-error                                                      [[:block 1]]
-  metabase.task.impl/rerun-on-error                                                      [[:block 1]]
-  metabase.test.data.datasets/test-driver                                                [[:inner 0]]
-  metabase.test.data.datasets/test-drivers                                               [[:inner 0]]
-  metabase.test.data.one-off-dbs/with-blank-db                                           [[:block 0]]
-  metabase.test.data.one-off-dbs/with-blueberries-db                                     [[:block 0]]
-  metabase.test.data.users/with-test-user                                                [[:inner 0]]
-  metabase.test.data/$ids                                                                [[:inner 0]]
-  metabase.test.data/dataset                                                             [[:inner 0]]
-  metabase.test.data/mbql-query                                                          [[:inner 0]]
-  metabase.test.data/native-query                                                        [[:block 0]]
-  metabase.test.data/query                                                               [[:block 1]]
-  metabase.test.data/run-mbql-query                                                      [[:inner 0]]
-  metabase.test.data/with-empty-h2-app-db!                                               [[:block 0]]
-  metabase.test.data/with-temp-copy-of-db                                                [[:block 0]]
-  metabase.test.util.public-settings/with-additional-premium-features                    [[:block 1]]
-  metabase.test.util.public-settings/with-premium-features                               [[:block 1]]
-  metabase.test.util.thread-local/test-helpers-set-global-values!                        [[:block 0]]
-  metabase.test.util/discard-setting-changes                                             [[:block 1]]
-  metabase.test.util/let-url                                                             [[:block 1]]
-  metabase.test.util/throw-if-called!                                                    [[:block 1]]
-  metabase.test.util/with-temp-scheduler                                                 [[:block 0]]
-  metabase.test.util/with-temp-vals-in-db                                                [[:block 3]]
-  metabase.test.util/with-user-in-groups                                                 [[:inner 0]]
-  metabase.test/$ids                                                                     [[:inner 0]]
-  metabase.test/as-admin                                                                 [[:inner 0]]
-  metabase.test/dataset                                                                  [[:inner 0]]
-  metabase.test/discard-setting-changes                                                  [[:block 1]]
-  metabase.test/format-rows-by                                                           [[:default]]
-  metabase.test/let-url                                                                  [[:block 1]]
-  metabase.test/mbql-query                                                               [[:inner 0]]
-  metabase.test/native-query                                                             [[:block 0]]
-  metabase.test/query                                                                    [[:block 1]]
-  metabase.test/run-mbql-query                                                           [[:inner 0]]
-  metabase.test/test-driver                                                              [[:inner 0]]
-  metabase.test/test-drivers                                                             [[:inner 0]]
-  metabase.test/test-helpers-set-global-values!                                          [[:block 0]]
-  metabase.test/throw-if-called!                                                         [[:block 1]]
-  metabase.test/with-actions                                                             [[:block 1]]
-  metabase.test/with-actions-disabled                                                    [[:block 0]]
-  metabase.test/with-actions-enabled                                                     [[:block 0]]
-  metabase.test/with-actions-test-data                                                   [[:inner 0]]
-  metabase.test/with-actions-test-data-and-actions-enabled                               [[:block 0]]
-  metabase.test/with-actions-test-data-tables                                            [[:block 1]]
-  metabase.test/with-additional-premium-features                                         [[:block 1]]
-  metabase.test/with-current-user                                                        [[:inner 0]]
-  metabase.test/with-driver                                                              [[:block 1]]
-  metabase.test/with-empty-db                                                            [[:inner 0]]
-  metabase.test/with-empty-h2-app-db!                                                    [[:block 0]]
-  metabase.test/with-metadata-provider                                                   [[:inner 0]]
-  metabase.test/with-premium-features                                                    [[:block 1]]
-  metabase.test/with-temp                                                                [[:inner 0]]
-  metabase.test/with-temp-copy-of-db                                                     [[:block 0]]
-  metabase.test/with-temp-scheduler                                                      [[:block 0]]
-  metabase.test/with-temp-test-data                                                      [[:inner 0]]
-  metabase.test/with-temp-vals-in-db                                                     [[:block 3]]
-  metabase.test/with-test-user                                                           [[:inner 0]]
-  metabase.test/with-user-in-groups                                                      [[:inner 0]]
-  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                  [[:block 0]]
-  metabase.timeseries-query-processor-test/run-mbql-query                                [[:inner 0]]
-  metabase.upload.impl-test/with-upload-table!                                           [[:inner 0]]
-  metabase.upload.types/with-currency                                                    [[:default]]
-  metabase.upload.types/with-parens                                                      [[:default]]
-  metabase.util/for-map                                                                  [[:block 1]]
-  metabase.util.async/cancelable-thread                                                  [[:block 0]]
-  metabase.util.date-2/with-time-zone-same-instant                                       [[:default]]
-  metabase.util.encryption-test/with-secret-key                                          [[:block 1]]
-  metabase.util.honey-sql-2/with-database-type-info                                      [[:default]]
-  metabase.util.i18n/deferred-trs                                                        [[:default]]
-  metabase.util.i18n/deferred-tru                                                        [[:default]]
-  metabase.util.i18n/trs                                                                 [[:default]]
-  metabase.util.i18n/trsn                                                                [[:default]]
-  metabase.util.i18n/tru                                                                 [[:default]]
-  metabase.util.i18n/trun                                                                [[:default]]
-  metabase.util.jvm/auto-retry                                                           [[:block 1]]
-  metabase.util.jvm/varargs                                                              [[:block 1]]
-  metabase.util.jvm/with-us-locale                                                       [[:block 0]]
-  metabase.util.malli/disable-enforcement                                                [[:block 0]]
-  metabase.util.malli/with                                                               [[:default]]
-  metabase.util.malli/with-api-error-message                                             [[:default]]
-  metabase.util.namespaces/import-fns                                                    [[:default]]
-  metabase.util.queue-test/await-test-while                                              [[:block 1]]
-  metabase.util/auto-retry                                                               [[:block 1]]
-  metabase.util/case-enum                                                                [[:block 1]]
-  metabase.util/ignore-exceptions                                                        [[:block 0]]
-  metabase.util/or-with                                                                  [[:block 1]]
-  metabase.util/profile                                                                  [[:block 1]]
-  metabase.util/prog1                                                                    [[:inner 0]]
-  metabase.util/varargs                                                                  [[:inner 0]]
-  metabase.util/with-us-locale                                                           [[:block 0]]
-  metabuild-common.core/exit-when-finished-nonzero-on-exception                          [[:block 0]]
-  metabuild-common.core/step                                                             [[:block 1]]
-  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                    [[:block 0]]
-  metabuild-common.steps/step                                                            [[:block 1]]
-  methodical.core/defmethod                                                              [[:inner 0]]
-  methodical.core/defmulti                                                               [[:inner 0]]
-  methodical.core/with-dispatcher                                                        [[:default]]
-  methodical.core/with-method-table                                                      [[:default]]
-  methodical.core/with-prefers                                                           [[:default]]
-  methodical.interface/with-dispatcher                                                   [[:default]]
-  methodical.interface/with-method-table                                                 [[:default]]
-  methodical.interface/with-prefers                                                      [[:default]]
-  methodical.macros/defmethod                                                            [[:inner 0]]
-  methodical.macros/defmulti                                                             [[:inner 0]]
-  saml20-clj.sp.response/validate-confirmation-datas                                     [[:block 1]]
-  toucan2.connection/with-transaction                                                    [[:block 1]]
-  toucan2.core/build                                                                     [[:block 0]]
-  toucan2.core/compile                                                                   [[:block 0]]
-  toucan2.core/debug                                                                     [[:block 0]]
-  toucan2.core/define-after-insert                                                       [[:inner 0]]
-  toucan2.core/define-after-select                                                       [[:inner 0]]
-  toucan2.core/define-after-update                                                       [[:inner 0]]
-  toucan2.core/define-before-delete                                                      [[:inner 0]]
-  toucan2.core/define-before-insert                                                      [[:inner 0]]
-  toucan2.core/define-before-select                                                      [[:inner 0]]
-  toucan2.core/define-default-fields                                                     [[:inner 0]]
-  toucan2.core/define-named-query                                                        [[:block 1]]
-  toucan2.core/deftransforms                                                             [[:block 1]]
-  toucan2.core/with-transaction                                                          [[:block 1]]
-  toucan2.tools.after-insert/define-after-insert                                         [[:inner 0]]
-  toucan2.tools.after-select/define-after-select                                         [[:inner 0]]
-  toucan2.tools.after-update/define-after-update                                         [[:inner 0]]
-  toucan2.tools.after/define-after-impl                                                  [[:default]]
-  toucan2.tools.before-delete/define-before-delete                                       [[:inner 0]]
-  toucan2.tools.before-insert/define-before-insert                                       [[:inner 0]]
-  toucan2.tools.before-select/define-before-select                                       [[:inner 0]]
-  toucan2.tools.compile/build                                                            [[:block 0]]
-  toucan2.tools.compile/compile                                                          [[:block 0]]
-  toucan2.tools.compile/resolved                                                         [[:block 0]]
-  toucan2.tools.debug/debug                                                              [[:block 0]]
-  toucan2.tools.default-fields/define-default-fields                                     [[:inner 0]]
-  toucan2.tools.named-query/define-named-query                                           [[:block 1]]
-  toucan2.tools.simple-out-transform/define-out-transform                                [[:inner 0]]
-  toucan2.tools.transformed/deftransforms                                                [[:block 1]]
-  toucan2.tools.with-temp/with-temp                                                      [[:inner 0]]
-  toucan2.util/try-with-error-context                                                    [[:inner 0]]}}
+  metabase-enterprise.cache.config-test/with-temp-persist-models                              [[:block 1]]
+  metabase-enterprise.impersonation.util-test/with-impersonations!                            [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps!                                           [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                                  [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-user-attributes                                  [[:block 2]]
+  metabase-enterprise.serialization.test-util/with-dbs                                        [[:inner 0]]
+  metabase-enterprise.serialization.test-util/with-random-dump-dir                            [[:block 1]]
+  metabase-enterprise.serialization.test-util/with-world                                      [[:block 0]]
+  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted                 [[:block 1]]
+  metabase-enterprise.test/with-gtaps!                                                        [[:inner 0]]
+  metabase-enterprise.test/with-gtaps-for-user!                                               [[:inner 0]]
+  metabase-enterprise.test/with-user-attributes                                               [[:block 2]]
+  metabase-enterprise.workspaces.models.workspace-log/track!                                  [[:block 2]]
+  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled       [[:block 0]]
+  metabase.actions.test-util/with-actions                                                     [[:block 1]]
+  metabase.actions.test-util/with-actions-disabled                                            [[:block 0]]
+  metabase.actions.test-util/with-actions-enabled                                             [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data                                           [[:inner 0]]
+  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                       [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data-tables                                    [[:block 1]]
+  metabase.actions.test-util/with-empty-db                                                    [[:inner 0]]
+  metabase.actions.test-util/with-temp-test-data                                              [[:inner 0]]
+  metabase.api.common/check                                                                   [[:default]]
+  metabase.api.common/define-routes                                                           [[:block 0]]
+  metabase.api.common/let-404                                                                 [[:block 1]]
+  metabase.app-db.core/with-application-db                                                    [[:inner 0]]
+  metabase.app-db.liquibase/with-liquibase                                                    [[:block 1]]
+  metabase.app-db.liquibase/with-scope-locked                                                 [[:block 1]]
+  metabase.app-db.schema-migrations-test.impl/test-migrations                                 [[:block 2]]
+  metabase.cmd.copy/step                                                                      [[:block 1]]
+  metabase.cmd.copy/with-connection-rollback-only                                             [[:block 1]]
+  metabase.cmd.copy/with-disabled-db-constraints                                              [[:block 2]]
+  metabase.collections-rest.api-test/with-collection-hierarchy                                [[:block 1]]
+  metabase.collections-rest.api-test/with-french-user-and-personal-collection                 [[:block 2]]
+  metabase.collections-rest.api-test/with-some-children-of-collection                         [[:block 1]]
+  metabase.collections.models.collection-test/with-collection-hierarchy                       [[:block 1]]
+  metabase.collections.models.collection-test/with-current-user-perms-for-collections         [[:block 1]]
+  metabase.collections.models.collection-test/with-personal-and-impersonal-collections        [[:block 1]]
+  metabase.config/build-type-case                                                             [[:block 0]]
+  metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
+  metabase.driver-api.core/match                                                              [[:inner 0]]
+  metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
+  metabase.driver-api.core/match-many                                                         [[:inner 0]]
+  metabase.driver-api.core/replace                                                            [[:inner 0]]
+  metabase.driver-api.core/replace-lite                                                       [[:inner 0]]
+  metabase.driver-api.core/replace-in                                                         [[:inner 0]]
+  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
+  metabase.driver.druid.client/DELETE                                                         [[:default]]
+  metabase.driver.druid.client/GET                                                            [[:default]]
+  metabase.driver.druid.client/POST                                                           [[:default]]
+  metabase.driver.druid.query-processor-test/druid-query                                      [[:block 0]]
+  metabase.driver.druid.query-processor-test/druid-query-returning-rows                       [[:block 0]]
+  metabase.driver.mongo.query-processor/mongo-let                                             [[:block 1]]
+  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                      [[:block 1]]
+  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection             [[:block 1]]
+  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                       [[:block 1]]
+  metabase.driver.sql.query-processor/apply-top-level-clause                                  [[:default]]
+  metabase.driver/with-driver                                                                 [[:block 1]]
+  metabase.driver/with-swapped-connection-details                                             [[:block 2]]
+  metabase.embedding-rest.api.embed-test/do-response-formats                                  [[:block 1]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
+  metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing [[:block 3]]
+  metabase.embedding-rest.api.embed-test/with-new-secret-key                                  [[:block 0]]
+  metabase.embedding-rest.api.embed-test/with-temp-card                                       [[:block 1]]
+  metabase.embedding-rest.api.embed-test/with-temp-dashcard                                   [[:block 1]]
+  metabase.embedding-rest.api.preview-embed-test/with-embedding-enabled-and-new-secret-key    [[:block 0]]
+  metabase.embedding-rest.api.preview-embed-test/with-new-secret-key                          [[:block 0]]
+  metabase.lib.binning/with-binning                                                           [[:default]]
+  metabase.lib.core/with-binning                                                              [[:default]]
+  metabase.lib.core/with-join-alias                                                           [[:default]]
+  metabase.lib.core/with-join-conditions                                                      [[:default]]
+  metabase.lib.join/with-join-alias                                                           [[:default]]
+  metabase.lib.join/with-join-conditions                                                      [[:default]]
+  metabase.lib.test-util.macros/$ids                                                          [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-5-query                                                  [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-query                                                    [[:inner 0]]
+  metabase.lib.util.match/match                                                               [[:inner 0]]
+  metabase.lib.util.match/match-one                                                           [[:inner 0]]
+  metabase.lib.util.match/match-lite                                                          [[:inner 0]]
+  metabase.lib.util.match/match-many                                                          [[:inner 0]]
+  metabase.lib.util.match/replace                                                             [[:inner 0]]
+  metabase.lib.util.match/replace-lite                                                        [[:inner 0]]
+  metabase.lib.util.match/replace-in                                                          [[:inner 0]]
+  metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
+  metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]
+  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                     [[:block 1]]
+  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping!                     [[:block 0]]
+  metabase.parameters.chain-filter-test/with-human-readable-values-remapping!                 [[:block 0]]
+  metabase.permissions.core/allow-changing-all-users-group-members                            [[:block 0]]
+  metabase.permissions.core/disable-perms-cache                                               [[:block 0]]
+  metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
+  metabase.public-sharing-rest.api-test/with-sharing-enabled-and-temp-dashcard-referencing    [[:block 3]]
+  metabase.public-sharing-rest.api-test/with-temp-public-card                                 [[:block 1]]
+  metabase.public-sharing-rest.api-test/with-temp-public-dashboard                            [[:block 1]]
+  metabase.public-sharing-rest.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
+  metabase.pulse.api.alert-test/with-alert-in-collection                                      [[:block 1]]
+  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard             [[:block 2]]
+  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection                  [[:block 1]]
+  metabase.pulse.models.pulse-test/with-pulse-in-collection                                   [[:inner 0]]
+  metabase.queries-rest.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
+  metabase.queries-rest.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
+  metabase.queries-rest.api.card-test/with-ordered-items                                      [[:inner 0]]
+  metabase.queries-rest.api.card-test/with-temp-native-card                                   [[:block 1]]
+  metabase.queries-rest.api.card-test/with-temp-native-card-with-params                       [[:block 1]]
+  metabase.query-processor.debug/debug>                                                       [[:block 0]]
+  metabase.query-processor.error-type/deferror                                                [[:block 1]]
+  metabase.query-processor.middleware.cache-backend.interface/with-cached-results             [[:block 4]]
+  metabase.query-processor.middleware.process-userland-query-test/with-query-execution        [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/mbql5-query                                  [[:block 1]]
+  metabase.query-processor.pipeline-queries-test/run-mbql5-query                              [[:block 1]]
+  metabase.query-processor.store/cached                                                       [[:block 1]]
+  metabase.query-processor.store/with-metadata-provider                                       [[:inner 0]]
+  metabase.query-processor.streaming/streaming-response                                       [[:block 1]]
+  metabase.query-processor.test-util/format-rows-by                                           [[:default]]
+  metabase.query-processor.timeseries-test.util/test-timeseries-drivers                       [[:block 0]]
+  metabase.query-processor.timeseries-test/run-mbql-query                                     [[:inner 0]]
+  metabase.request.core/as-admin                                                              [[:block 0]]
+  metabase.request.core/with-current-request                                                  [[:inner 0]]
+  metabase.request.core/with-current-user                                                     [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                                 [[:inner 0]]
+  metabase.request.session/as-admin                                                           [[:block 0]]
+  metabase.request.session/with-current-user                                                  [[:inner 0]]
+  metabase.sample-data.impl-test/with-temp-sample-database-db                                 [[:block 1]]
+  metabase.search.api-test/do-test-users                                                      [[:block 1]]
+  metabase.server.middleware.session/as-admin                                                 [[:block 0]]
+  metabase.server.middleware.session/with-current-user                                        [[:inner 0]]
+  metabase.server.streaming-response-test/with-streaming-response-thread-pool                 [[:block 0]]
+  metabase.server.streaming-response-test/with-test-driver-db!                                [[:block 0]]
+  metabase.server.streaming-response/streaming-response                                       [[:block 2]]
+  metabase.session.api/http-401-on-error                                                      [[:block 0]]
+  metabase.settings.core/define-multi-setting                                                 [[:inner 0]]
+  metabase.settings.core/defsetting                                                           [[:block 1]]
+  metabase.settings.models.setting.multi-setting/define-multi-setting                         [[:inner 0]]
+  metabase.settings.models.setting/defsetting                                                 [[:block 1]]
+  metabase.sync.fetch-metadata/log-if-error                                                   [[:block 1]]
+  metabase.sync.sync-metadata.fields-test/with-test-db                                        [[:block 0]]
+  metabase.sync.util/do-with-start-and-finish-debug-logging                                   [[:default]]
+  metabase.sync.util/sum-for                                                                  [[:block 1]]
+  metabase.sync.util/sync-operation                                                           [[:block 3]]
+  metabase.sync.util/with-db-logging-disabled                                                 [[:default]]
+  metabase.sync.util/with-duplicate-ops-prevented                                             [[:default]]
+  metabase.sync.util/with-emoji-progress-bar                                                  [[:block 1]]
+  metabase.sync.util/with-error-handling                                                      [[:block 1]]
+  metabase.sync.util/with-start-and-finish-logging                                            [[:default]]
+  metabase.sync.util/with-start-and-finish-logging*                                           [[:default]]
+  metabase.sync.util/with-sync-events                                                         [[:default]]
+  metabase.task-history.models.task-history/with-task-history                                 [[:block 1]]
+  metabase.task.core/rerun-on-error                                                           [[:block 1]]
+  metabase.task.impl/rerun-on-error                                                           [[:block 1]]
+  metabase.test.data.datasets/test-driver                                                     [[:inner 0]]
+  metabase.test.data.datasets/test-drivers                                                    [[:inner 0]]
+  metabase.test.data.one-off-dbs/with-blank-db                                                [[:block 0]]
+  metabase.test.data.one-off-dbs/with-blueberries-db                                          [[:block 0]]
+  metabase.test.data.users/with-test-user                                                     [[:inner 0]]
+  metabase.test.data/$ids                                                                     [[:inner 0]]
+  metabase.test.data/dataset                                                                  [[:inner 0]]
+  metabase.test.data/mbql-query                                                               [[:inner 0]]
+  metabase.test.data/query                                                                    [[:block 1]]
+  metabase.test.data/run-mbql-query                                                           [[:inner 0]]
+  metabase.test.data/with-empty-h2-app-db!                                                    [[:block 0]]
+  metabase.test.data/with-temp-copy-of-db                                                     [[:block 0]]
+  metabase.test.util.public-settings/with-additional-premium-features                         [[:block 1]]
+  metabase.test.util.public-settings/with-premium-features                                    [[:block 1]]
+  metabase.test.util.thread-local/test-helpers-set-global-values!                             [[:block 0]]
+  metabase.test.util/discard-setting-changes                                                  [[:block 1]]
+  metabase.test.util/let-url                                                                  [[:block 1]]
+  metabase.test.util/throw-if-called!                                                         [[:block 1]]
+  metabase.test.util/with-temp-scheduler                                                      [[:block 0]]
+  metabase.test.util/with-temp-vals-in-db                                                     [[:block 3]]
+  metabase.test.util/with-user-in-groups                                                      [[:inner 0]]
+  metabase.test/$ids                                                                          [[:inner 0]]
+  metabase.test/as-admin                                                                      [[:inner 0]]
+  metabase.test/dataset                                                                       [[:inner 0]]
+  metabase.test/discard-setting-changes                                                       [[:block 1]]
+  metabase.test/format-rows-by                                                                [[:default]]
+  metabase.test/let-url                                                                       [[:block 1]]
+  metabase.test/mbql-query                                                                    [[:inner 0]]
+  metabase.test/query                                                                         [[:block 1]]
+  metabase.test/run-mbql-query                                                                [[:inner 0]]
+  metabase.test/test-driver                                                                   [[:inner 0]]
+  metabase.test/test-drivers                                                                  [[:inner 0]]
+  metabase.test/test-helpers-set-global-values!                                               [[:block 0]]
+  metabase.test/throw-if-called!                                                              [[:block 1]]
+  metabase.test/with-actions                                                                  [[:block 1]]
+  metabase.test/with-actions-disabled                                                         [[:block 0]]
+  metabase.test/with-actions-enabled                                                          [[:block 0]]
+  metabase.test/with-actions-test-data                                                        [[:inner 0]]
+  metabase.test/with-actions-test-data-and-actions-enabled                                    [[:block 0]]
+  metabase.test/with-actions-test-data-tables                                                 [[:block 1]]
+  metabase.test/with-additional-premium-features                                              [[:block 1]]
+  metabase.test/with-current-user                                                             [[:inner 0]]
+  metabase.test/with-driver                                                                   [[:block 1]]
+  metabase.test/with-empty-db                                                                 [[:inner 0]]
+  metabase.test/with-empty-h2-app-db!                                                         [[:block 0]]
+  metabase.test/with-metadata-provider                                                        [[:inner 0]]
+  metabase.test/with-premium-features                                                         [[:block 1]]
+  metabase.test/with-temp                                                                     [[:inner 0]]
+  metabase.test/with-temp-copy-of-db                                                          [[:block 0]]
+  metabase.test/with-temp-scheduler                                                           [[:block 0]]
+  metabase.test/with-temp-test-data                                                           [[:inner 0]]
+  metabase.test/with-temp-vals-in-db                                                          [[:block 3]]
+  metabase.test/with-test-user                                                                [[:inner 0]]
+  metabase.test/with-user-in-groups                                                           [[:inner 0]]
+  metabase.upload.impl-test/with-upload-table!                                                [[:inner 0]]
+  metabase.upload.types/with-currency                                                         [[:default]]
+  metabase.upload.types/with-parens                                                           [[:default]]
+  metabase.util.async/cancelable-thread                                                       [[:block 0]]
+  metabase.util.date-2/with-time-zone-same-instant                                            [[:default]]
+  metabase.util.encryption-test/with-secret-key                                               [[:block 1]]
+  metabase.util.honey-sql-2/with-database-type-info                                           [[:default]]
+  metabase.util.i18n/deferred-trs                                                             [[:default]]
+  metabase.util.i18n/deferred-tru                                                             [[:default]]
+  metabase.util.i18n/trs                                                                      [[:default]]
+  metabase.util.i18n/trsn                                                                     [[:default]]
+  metabase.util.i18n/tru                                                                      [[:default]]
+  metabase.util.i18n/trun                                                                     [[:default]]
+  metabase.util.jvm/auto-retry                                                                [[:block 1]]
+  metabase.util.jvm/varargs                                                                   [[:block 1]]
+  metabase.util.jvm/with-us-locale                                                            [[:block 0]]
+  metabase.util.malli/disable-enforcement                                                     [[:block 0]]
+  metabase.util.malli/with                                                                    [[:default]]
+  metabase.util.malli/with-api-error-message                                                  [[:default]]
+  metabase.util.namespaces/import-fns                                                         [[:default]]
+  metabase.util.queue-test/await-test-while                                                   [[:block 1]]
+  metabase.util/auto-retry                                                                    [[:block 1]]
+  metabase.util/case-enum                                                                     [[:block 1]]
+  metabase.util/for-map                                                                       [[:block 1]]
+  metabase.util/ignore-exceptions                                                             [[:block 0]]
+  metabase.util/or-with                                                                       [[:block 1]]
+  metabase.util/profile                                                                       [[:block 1]]
+  metabase.util/prog1                                                                         [[:inner 0]]
+  metabase.util/varargs                                                                       [[:inner 0]]
+  metabase.util/with-us-locale                                                                [[:block 0]]
+  metabuild-common.core/exit-when-finished-nonzero-on-exception                               [[:block 0]]
+  metabuild-common.core/step                                                                  [[:block 1]]
+  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                         [[:block 0]]
+  metabuild-common.steps/step                                                                 [[:block 1]]
+  methodical.core/defmethod                                                                   [[:inner 0]]
+  methodical.core/defmulti                                                                    [[:inner 0]]
+  methodical.core/with-dispatcher                                                             [[:default]]
+  methodical.core/with-method-table                                                           [[:default]]
+  methodical.core/with-prefers                                                                [[:default]]
+  methodical.interface/with-dispatcher                                                        [[:default]]
+  methodical.interface/with-method-table                                                      [[:default]]
+  methodical.interface/with-prefers                                                           [[:default]]
+  methodical.macros/defmethod                                                                 [[:inner 0]]
+  methodical.macros/defmulti                                                                  [[:inner 0]]
+  saml20-clj.sp.response/validate-confirmation-datas                                          [[:block 1]]
+  toucan2.connection/with-transaction                                                         [[:block 1]]
+  toucan2.core/build                                                                          [[:block 0]]
+  toucan2.core/compile                                                                        [[:block 0]]
+  toucan2.core/debug                                                                          [[:block 0]]
+  toucan2.core/define-after-insert                                                            [[:inner 0]]
+  toucan2.core/define-after-select                                                            [[:inner 0]]
+  toucan2.core/define-after-update                                                            [[:inner 0]]
+  toucan2.core/define-before-delete                                                           [[:inner 0]]
+  toucan2.core/define-before-insert                                                           [[:inner 0]]
+  toucan2.core/define-before-select                                                           [[:inner 0]]
+  toucan2.core/define-default-fields                                                          [[:inner 0]]
+  toucan2.core/define-named-query                                                             [[:block 1]]
+  toucan2.core/deftransforms                                                                  [[:block 1]]
+  toucan2.core/with-transaction                                                               [[:block 1]]
+  toucan2.tools.after-insert/define-after-insert                                              [[:inner 0]]
+  toucan2.tools.after-select/define-after-select                                              [[:inner 0]]
+  toucan2.tools.after-update/define-after-update                                              [[:inner 0]]
+  toucan2.tools.after/define-after-impl                                                       [[:default]]
+  toucan2.tools.before-delete/define-before-delete                                            [[:inner 0]]
+  toucan2.tools.before-insert/define-before-insert                                            [[:inner 0]]
+  toucan2.tools.before-select/define-before-select                                            [[:inner 0]]
+  toucan2.tools.compile/build                                                                 [[:block 0]]
+  toucan2.tools.compile/compile                                                               [[:block 0]]
+  toucan2.tools.compile/resolved                                                              [[:block 0]]
+  toucan2.tools.debug/debug                                                                   [[:block 0]]
+  toucan2.tools.default-fields/define-default-fields                                          [[:inner 0]]
+  toucan2.tools.named-query/define-named-query                                                [[:block 1]]
+  toucan2.tools.simple-out-transform/define-out-transform                                     [[:inner 0]]
+  toucan2.tools.transformed/deftransforms                                                     [[:block 1]]
+  toucan2.tools.with-temp/with-temp                                                           [[:inner 0]]
+  toucan2.util/try-with-error-context                                                         [[:inner 0]]}}

.codespellignore

@@ -0,0 +1,35 @@
+afterAll
+ags
+altho
+Brite
+cancelation
+cancelations
+caracteres
+copyin
+datas
+edn
+eduction
+hasTable
+hasTables
+horizontalX
+horizontalY
+juxt
+methodd
+nd
+notIn
+optionA
+ot
+pass-thru
+requestor
+re-use
+re-used
+ser
+serieses
+sortings
+titel
+trs
+trsn
+tru
+trun
+unparseable
+withs

.codespellrc

@@ -0,0 +1,24 @@
+[codespell]
+skip =
+    *.csv,
+    *.edn,
+    *.geojson,
+    *.json,
+    *.tsv,
+    *.unit.spec.*,
+    *.xml,
+    docs/developers-guide/drivers/driver-tests.md,
+    docs/developers-guide/e2e-tests.md,
+    docs/questions/query-builder/expressions-list.md,
+    docs/questions/visualizations/country-codes.md,
+    e2e/test/scenarios/admin/i18n/content-translation/constants.ts,
+    frontend/src/cljs,
+    frontend/src/metabase/querying/expressions/tokenizer/lezer.js,
+    frontend/src/metabase/query_builder/components/NativeQueryEditor/CodeMirrorEditor/language.ts,
+    frontend/src/metabase/static-viz/constants/char-sizes.ts,
+    frontend/src/metabase/visualizations/lib/mapping_codes.ts,
+    frontend/*/mocks/*,
+    modules/drivers/mongo/src/metabase/driver/mongo/operators.clj,
+    src/metabase/analyze/classifiers/name.clj,
+    src/metabase/util/currency.cljc,
+ignore-words = .codespellignore

.config/wt.toml

@@ -0,0 +1,10 @@
+# worktrunk project config — https://worktrunk.dev
+# Hooks run when switching, creating, merging, or removing worktrees.
+
+# Setup tasks for newly-created worktrees. Run once, blocking, in the
+# new worktree's cwd before post-start background tasks kick off.
+[pre-start]
+# Trust mise config so it loads the project's tool versions without prompting.
+trust-mise = "mise trust"
+# Install JS deps so husky git hooks get wired up in the new worktree.
+bun-install = "bun install"

.devcontainer/Dockerfile

@@ -1,11 +1,11 @@
 FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
-# Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
+# Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 
 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
-  && apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com \
-  && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
+  && apt-get update && apt-get -y install --no-install-recommends nodejs rlwrap fontconfig \
+  && npm install -g bun
 
 # install Clojure
 RUN curl https://download.clojure.org/install/linux-install-1.12.0.1488.sh | bash

.dir-locals.el

@@ -61,6 +61,7 @@
   (eval . (put-clojure-indent 'u/prog1                         1))
   (eval . (put-clojure-indent 'u/select-keys-when              '(:form)))
   (eval . (put-clojure-indent 'with-meta                       '(:form)))
+  (eval . (put-clojure-indent 'ws.log/track!                   2))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'

.dockerignore

@@ -1,5 +1,4 @@
 .babel_cache
-docs/*
 target/*
 .circleci
 .cpcache

.env.example

@@ -0,0 +1,163 @@
+# ==============================================================================
+# 0. METABASE DEVELOPMENT ENVIRONMENT
+# ==============================================================================
+#
+# Central configuration for local Metabase development.
+# Copy to .env and uncomment/modify values as needed.
+#
+# Usage:
+#   op inject --in-file .env.example --out-file .env    (populate using CLI)
+#   cp .env.example .env                                (populate manually)
+#
+# Hint: Auto-load environment variables with mise or direnv:
+#   mise    - mise.toml: [settings] env_file = ".env"   (https://mise.jdx.dev)
+#   direnv  - Create .envrc with: dotenv .env           (https://direnv.net)
+#
+# Full Metabase environment configuration reference:
+# https://www.metabase.com/docs/latest/configuring-metabase/environment-variables
+#
+# ⚠️ Make sure the same var is not exported multiple times in different contexts.
+
+
+# ==============================================================================
+# 1. GLOBAL CONTEXT
+# ==============================================================================
+#
+# Shared credentials and tokens used across multiple dev workflows.
+
+# GitHub - For gh CLI, API access, and CI integrations
+# https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
+# GITHUB_TOKEN=your-PAT
+
+# AWS - For S3, Athena, Redshift, and other AWS services
+# https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+# AWS_ACCESS_KEY_ID=your-access-key
+# AWS_SECRET_ACCESS_KEY=your-secret-key
+# AWS_REGION=us-east-1
+
+# Docker Hub - Avoid rate limits when pulling images
+# https://docs.docker.com/security/for-developers/access-tokens/
+# DOCKER_USERNAME=your-username
+# DOCKER_PASSWORD=your-access-token
+
+# ==============================================================================
+# 2. LOCAL METABASE DEVELOPMENT
+# ==============================================================================
+#
+# Settings for running Metabase locally. Most have sensible defaults—only
+# configure what you need.
+
+# 2.1 Application Database
+# ------------------------------------------------------------------------------
+# Where Metabase stores its own data (dashboards, users, settings, etc.).
+# https://www.metabase.com/docs/latest/installation-and-operation/configuring-application-database
+
+# Option A: Individual connection parameters
+# MB_DB_TYPE="postgres"
+# MB_DB_HOST="localhost"
+# MB_DB_PORT=5432
+# MB_DB_DBNAME="metabase"
+# MB_DB_USER="<username>"
+# MB_DB_PASS="<password>"
+
+# Option B: Single connection URI (overrides individual params)
+# MB_DB_CONNECTION_URI="jdbc:postgresql://localhost:5432/metabase?user=<username>&password=<password>"
+
+# 2.2 Server & Integrations
+# ------------------------------------------------------------------------------
+# https://www.metabase.com/docs/latest/configuring-metabase/customizing-jetty-webserver
+
+# Jetty server (defaults: localhost:3000)
+# MB_JETTY_HOST="localhost"
+# MB_JETTY_PORT=3000
+
+# SMTP for testing email notifications (use with maildev/maildev container)
+MB_EMAIL_SMTP_HOST="localhost"
+MB_EMAIL_SMTP_PORT=1025
+MB_EMAIL_SMTP_USERNAME="admin"
+MB_EMAIL_SMTP_PASSWORD="admin"
+
+# 2.3 Feature Flags & Tokens
+# ------------------------------------------------------------------------------
+
+# Use staging server for license validation (avoids hitting production)
+METASTORE_DEV_SERVER_URL="https://token-check.staging.metabase.com"
+
+# Metabase license token
+# Uncomment this line only when running local dev and NEVER when running Cypress
+# Tests need to start from zero, and set different tokens programmatically (on-demand)
+# MB_PREMIUM_EMBEDDING_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_ALL_FEATURES_TOKEN"
+
+# Skip embedding SDK build for faster frontend compilation
+# SKIP_EMBEDDING_SDK="true"
+
+
+# ==============================================================================
+# 3. E2E / CYPRESS TESTING
+# ==============================================================================
+#
+# Configuration for running Cypress end-to-end tests locally.
+#
+# The whole environment is already orchestrated via deps.edn using :e2e alias.
+# Treat it as a source of truth for JVM flags and ENVs whether you decide to run
+# backend on your own, or using `bun run test-cypress` (local test runner).
+#
+# You don't _have to_ export any of these vars (except for the tokens below).
+# Things will still work.
+
+# 3.1. E2E Application Database (H2 required)
+# ------------------------------------------------------------------------------
+
+# Whether to run the enterprise or the open-source Metabase version
+MB_EDITION="ee"
+
+# Which file to use for the ephemeral testing application database?
+# MB_DB_FILE="./e2e/tmp/cypress-test.db"
+
+# Where does Cypress go to look for the application? (defaults: localhost:4000)
+# MB_JETTY_HOST="localhost"
+# MB_JETTY_PORT=4000
+
+# Frontend dev server port (for hot reload). Must match the port used by `yarn build-hot`.
+# MB_FRONTEND_DEV_PORT=8080
+
+# 3.2 E2E Local Runner Setup
+# ------------------------------------------------------------------------------
+
+# Whether to run true e2e test suite, or SDK component tests (e2e | component)
+CYPRESS_TESTING_TYPE="e2e"
+
+# Whether to start Cypress in an interactive (open) mode with full GUI
+CYPRESS_GUI="true"
+
+# Whether to generate application database dumps (colloquially "snapshots")
+# Keep this enabled unless you're experimenting, or know what you're doing.
+GENERATE_SNAPSHOTS="true"
+
+# E2E tests run the backend from source by default.
+# To run tests against a JAR instead, set the JAR_PATH variable.
+#
+# Hint: build the JAR with ./bin/build.sh
+# JAR_PATH="target/uberjar/metabase.jar"
+
+# 3.3 E2E Tokens
+# ------------------------------------------------------------------------------
+#
+# These make sense for Metabase core devs only
+# op inject --in-file .env.example --out-file .env
+
+CYPRESS_MB_ALL_FEATURES_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_ALL_FEATURES_TOKEN"
+CYPRESS_MB_STARTER_CLOUD_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_STARTER_CLOUD_TOKEN"
+CYPRESS_MB_PRO_CLOUD_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_PRO_CLOUD_TOKEN"
+CYPRESS_MB_PRO_SELF_HOSTED_TOKEN="op://Shared/Metabase License Dev Tokens/Licenses/MB_PRO_SELF_HOSTED_TOKEN"
+
+# 3.4 E2E Misc.
+# ------------------------------------------------------------------------------
+
+# To make Node.js match the instance tz
+TZ="US/Pacific"
+
+# Export this environment variable when running tests on Apple Silicon.
+# DO NOT USE Docker Desktop. Use Orbstack instead. Metabase will fail to connect
+# to the dockerized Mongo QA database otherwise.
+EXPERIMENTAL_DOCKER_DESKTOP_FORCE_QEMU=1

.eslintignore

@@ -1,4 +0,0 @@
-frontend/src/cljs
-frontend/src/cljs_release
-e2e/support/cypress_sample_database.js
-e2e/support/cypress_sample_instance_data.js

.eslintrc.js

@@ -1,351 +0,0 @@
-/* eslint-disable import/no-commonjs */
-/* eslint-disable no-undef */
-
-const path = require("path");
-
-// `postcss-modules` lints css modules class names, but it currently crashes
-// eslint on vscode. If you use webstorm or want to run the lint for the cli, you
-// can use this flag to enable it. This is set to true in CI
-const shouldLintCssModules =
-  process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests", "ttag", "i18next"];
-if (shouldLintCssModules) {
-  plugins.push("postcss-modules");
-}
-
-module.exports = {
-  ignorePatterns: ["!.storybook"],
-  rules: {
-    strict: [2, "never"],
-    "no-undef": 2,
-    "no-var": 1,
-    "no-unused-vars": [
-      "error",
-      {
-        vars: "all",
-        args: "none",
-        varsIgnorePattern: "^_.+$",
-        ignoreRestSiblings: true,
-      },
-    ],
-    "no-empty": [1, { allowEmptyCatch: true }],
-    // Note: adding this rule to a eslint config file in a subfolder will remove
-    // *not* carry over the restricted imports from parent folders, you will
-    // need to copy them over
-    "no-restricted-imports": [
-      "error",
-      {
-        paths: [
-          {
-            name: "moment",
-            message: "Moment is deprecated, please use dayjs",
-          },
-          {
-            name: "moment-timezone",
-            message: "Moment is deprecated, please use dayjs",
-          },
-        ],
-      },
-    ],
-    curly: [1, "all"],
-    eqeqeq: [1, "smart"],
-    "import/no-duplicates": ["warn", { considerQueryString: true }],
-    "import/no-default-export": 2,
-    "import/no-named-as-default": 0,
-    "import/no-commonjs": 1,
-    "import/order": [
-      "error",
-      {
-        "newlines-between": "always",
-        alphabetize: {
-          order: "asc",
-          orderImportKind: "asc",
-          caseInsensitive: false,
-        },
-        groups: [
-          "builtin",
-          "external",
-          "internal",
-          "parent",
-          "sibling",
-          "index",
-        ],
-        warnOnUnassignedImports: false,
-      },
-    ],
-    "sort-imports": [
-      "error",
-      {
-        // allows this rule to work with import/order
-        ignoreDeclarationSort: true,
-      },
-    ],
-    "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
-    "react/no-is-mounted": 2,
-    "react/prefer-es6-class": 2,
-    "react/display-name": 1,
-    "react/prop-types": 2,
-    "react/no-did-mount-set-state": 0,
-    "react/no-did-update-set-state": 0,
-    "react/no-find-dom-node": 0,
-    "react/no-children-prop": 2,
-    "react/no-string-refs": 2,
-    "react/no-unescaped-entities": 2,
-    "react/jsx-no-target-blank": 2,
-    "react/jsx-key": 2,
-    "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": [
-      "warn",
-      { additionalHooks: "(useSafeAsyncFunction)" },
-    ],
-    "prefer-const": [1, { destructuring: "all" }],
-    "no-restricted-globals": ["error", "close"],
-    "no-useless-escape": 0,
-    "no-only-tests/no-only-tests": [
-      "error",
-      {
-        block: [
-          "describe",
-          "it",
-          "context",
-          "test",
-          "tape",
-          "fixture",
-          "serial",
-          "Feature",
-          "Scenario",
-          "Given",
-          "And",
-          "When",
-          "Then",
-          "describeWithSnowplow",
-        ],
-      },
-    ],
-    complexity: ["error", { max: 55 }],
-    ...(shouldLintCssModules
-      ? {
-          "postcss-modules/no-undef-class": "error",
-        }
-      : {}),
-  },
-  globals: {
-    before: true,
-    cy: true,
-    Cypress: true,
-  },
-  env: {
-    browser: true,
-    es6: true,
-    commonjs: true,
-    jest: true,
-    "jest/globals": true,
-  },
-  parser: "babel-eslint",
-  plugins,
-  extends: [
-    "eslint:recommended",
-    "plugin:react/recommended",
-    "plugin:react/jsx-runtime",
-    "plugin:react-hooks/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript",
-    "plugin:depend/recommended",
-    "plugin:storybook/recommended",
-    "plugin:i18next/recommended",
-  ],
-  settings: {
-    "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": {
-      webpack: {
-        config: path.resolve(__dirname, "./rspack.main.config.js"),
-        typescript: true,
-      },
-    },
-    "import/ignore": ["\\.css$"],
-    react: {
-      version: "detect",
-    },
-    "postcss-modules": {
-      baseDir: "./frontend/src",
-    },
-  },
-  parserOptions: {
-    ecmaFeatures: {
-      legacyDecorators: true,
-    },
-  },
-  overrides: [
-    {
-      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
-      rules: {
-        "jtag-missing-key": "error",
-        "no-unconditional-metabase-links-render": "error",
-        "no-color-literals": "error",
-        "no-literal-metabase-strings": "error",
-        "depend/ban-dependencies": [
-          "error",
-          {
-            allowed: [
-              "underscore",
-              "moment",
-              "lodash.orderby",
-              "lodash.debounce",
-            ],
-          },
-        ],
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/src/metabase/admin/**/*",
-        "frontend/src/metabase/setup/**/*",
-        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "**/.storybook/*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.config.js",
-        "rspack.main.config.js",
-        "rspack.embedding-sdk-package.config.js",
-        "rspack.embedding-sdk-bundle.config.js",
-      ],
-      rules: {
-        "no-color-literals": "off",
-        "no-unconditional-metabase-links-render": "off",
-        "no-literal-metabase-strings": "off",
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.main.config.js",
-      ],
-      rules: {
-        "i18next/no-literal-string": "off",
-      },
-    },
-    {
-      extends: ["plugin:@typescript-eslint/recommended"],
-      files: ["*.ts", "*.tsx"],
-      parser: "@typescript-eslint/parser",
-      plugins: ["@typescript-eslint"],
-      rules: {
-        "prefer-rest-params": "off",
-        "@typescript-eslint/explicit-module-boundary-types": "off",
-        "@typescript-eslint/no-inferrable-types": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": [
-          "error",
-          {
-            fixStyle: "inline-type-imports",
-          },
-        ],
-        "@typescript-eslint/no-import-type-side-effects": "error",
-        "@typescript-eslint/no-unused-vars": [
-          "error",
-          {
-            argsIgnorePattern: "^_.+$",
-            varsIgnorePattern: "^_.+$",
-            ignoreRestSiblings: true,
-            destructuredArrayIgnorePattern: "^_.+$",
-          },
-        ],
-        // This was introduced in 6.0.0
-        "@typescript-eslint/no-unsafe-declaration-merging": "off",
-      },
-    },
-    {
-      extends: [
-        "plugin:jest/recommended",
-        "plugin:jest-dom/recommended",
-        "plugin:testing-library/react",
-        "plugin:jest-formatting/recommended",
-      ],
-      plugins: ["jest", "jest-dom", "testing-library", "jest-formatting"],
-      files: [
-        "*.unit.spec.ts",
-        "*.unit.spec.tsx",
-        "*.unit.spec.js",
-        "*.unit.spec.jsx",
-      ],
-      rules: {
-        "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
-        "jest/expect-expect": [
-          "error",
-          {
-            assertFunctionNames: ["expect*", "assert*"],
-            additionalTestBlockFunctions: [],
-          },
-        ],
-      },
-    },
-    {
-      // Enable jest formatting for cypress tests too, the plugin logic just works
-      extends: ["plugin:jest-formatting/recommended"],
-      files: ["*.cy.spec.ts", "*.cy.spec.js"],
-    },
-    {
-      files: ["frontend/src/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/query_builder/**/*"],
-      rules: {
-        "import/no-cycle": "error",
-      },
-    },
-    {
-      files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "@typescript-eslint/no-unused-vars": "off",
-        "@typescript-eslint/no-var-requires": "off",
-        "import/no-commonjs": "off",
-        "import/no-default-export": "off",
-        "import/order": "off",
-        "import/no-unresolved": "off",
-        "no-color-literals": "off",
-      },
-    },
-    {
-      files: ["frontend/build/**/*.js"],
-      rules: {
-        "import/no-commonjs": "off",
-      },
-    },
-  ],
-};

.gitattributes

@@ -0,0 +1,9 @@
+# Custom merge driver for per-release YAML migration files.
+# Treats each changeset as an atomic unit to avoid conflicts within changesets.
+# Only applies to per-release *_update_migrations.yaml files — directory-based
+# migrations (e.g. 060/*.yaml) have one file per migration and don't need this.
+# Execute this in your shell to enable custom merge driver:
+# echo '\n[include]\npath=../.gitconfig' >> .git/config
+#
+# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
+# resources/migrations/*_update_migrations.yaml merge=yaml-migrations

.gitconfig

@@ -0,0 +1,5 @@
+# execute this in your shell to enable custom merge driver:
+# echo '\n[include]\npath=../.gitconfig' >> .git/config
+[merge "yaml-migrations"]
+    name = Per-release YAML migration changeset-aware merge
+    driver = bin/mage -merge-yaml-migrations %O %A %B %L %P

.github/CODEOWNERS

@@ -1,266 +1,30 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
 
+# @metabase/core-backend-querying-platform
+src/metabase/lib @metabase/core-backend-querying-platform
+src/metabase/lib_be @metabase/core-backend-querying-platform
+src/metabase/query_processor @metabase/core-backend-querying-platform
+
+# @metabase/graphy
+src/metabase/graph @metabase/graphy
+enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+
+# @metabase/embedding
 enterprise/frontend/src/embedding-sdk-package @metabase/embedding
 enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
 enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
-frontend/src/metabase/ui @metabase/core-frontend-ux-west
-# snowplow/* @metabase/data
-src/metabase/analytics/prometheus.clj @metabase/cloud-ops
-.github @metabase/devexp
-.clj-kondo @metabase/devexp
-deps.edn @metabase/backend-developers
 
+# @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership
 
-#
-# Backend modules <=> teams that own them
-#
+# @metabase/devexp
+.github @metabase/devexp
 
-# modules/drivers @metabase/drivers
-src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-ux-east
-test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/api @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/api @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/core @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/core @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-
-# # enterprise/backend/src/metabase_enterprise/llm
-# # enterprise/backend/test/metabase_enterprise/llm
-
-# enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/search ...
-# enterprise/backend/test/metabase_enterprise/search ...
-
-# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-
-src/metabase/actions @metabase/core-ux-east
-test/metabase/actions @metabase/core-ux-east
-
-# src/metabase/activity_feed @metabase/core-backend-admin-webapp
-# test/metabase/activity_feed @metabase/core-backend-admin-webapp
-
-# src/metabase/analytics @metabase/core-backend-admin-webapp
-# test/metabase/analytics @metabase/core-backend-admin-webapp
-
-# src/metabase/analyze @metabase/drivers
-# test/metabase/analyze @metabase/drivers
-
-# src/metabase/api @metabase/devexp
-# test/metabase/api @metabase/devexp
-
-# src/metabase/audit @metabase/core-backend-admin-webapp
-# test/metabase/audit @metabase/core-backend-admin-webapp
-
-# src/metabase/auth_provider @metabase/core-backend-admin-webapp
-# test/metabase/auth_provider @metabase/core-backend-admin-webapp
-
-# src/metabase/bookmarks @metabase/core-backend-admin-webapp
-# test/metabase/bookmarks @metabase/core-backend-admin-webapp
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/channel @metabase/core-ux-east
-# test/metabase/channel @metabase/core-ux-east
-
-# src/metabase/cloud_migration ...
-# test/metabase/cloud_migration ...
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/config @metabase/devexp
-# test/metabase/config @metabase/devexp
-
-# src/metabase/core @metabase/devexp
-# test/metabase/core @metabase/devexp
-
-# src/metabase/db @metabase/core-backend-admin-webapp
-# test/metabase/db @metabase/core-backend-admin-webapp
-
-# src/metabase/driver @metabase/drivers
-# test/metabase/driver @metabase/drivers
-
-# src/metabase/eid_translation @metabase/core-backend-admin-webapp
-# test/metabase/eid_translation @metabase/core-backend-admin-webapp
-
-# src/metabase/embed @metabase/embedding
-# test/metabase/embed @metabase/embedding
-
-# src/metabase/events @metabase/devexp
-# test/metabase/events @metabase/devexp
-
-# src/metabase/formatter @metabase/core-backend-querying
-# test/metabase/formatter @metabase/core-backend-querying
-
-# src/metabase/indexed_entities @metabase/core-backend-querying
-# test/metabase/indexed_entities @metabase/core-backend-querying
-
-# src/metabase/integrations ...
-# test/metabase/integrations ...
-
-# src/metabase/legacy_mbql @metabase/core-backend-querying
-# test/metabase/legacy_mbql @metabase/core-backend-querying
-
-# src/metabase/lib @metabase/core-backend-querying
-# test/metabase/lib @metabase/core-backend-querying
-
-# src/metabase/logger @metabase/devexp
-# test/metabase/logger @metabase/devexp
-
-# src/metabase/login_history @metabase/core-backend-admin-webapp
-# test/metabase/login_history @metabase/core-backend-admin-webapp
-
-# src/metabase/model_persistence @metabase/core-backend-querying
-# test/metabase/model_persistence @metabase/core-backend-querying
-
-# src/metabase/models @metabase/devexp
-# test/metabase/models @metabase/devexp
-
-# src/metabase/moderation @metabase/core-backend-admin-webapp
-# test/metabase/moderation @metabase/core-backend-admin-webapp
-
-# src/metabase/notification @metabase/core-ux-east
-# test/metabase/notification @metabase/core-ux-east
-
-# src/metabase/permissions @metabase/core-backend-admin-webapp
-# test/metabase/permissions @metabase/core-backend-admin-webapp
-
-# src/metabase/plugins @metabase/devexp
-# test/metabase/plugins @metabase/devexp
-
-# src/metabase/premium_features @metabase/core-backend-admin-webapp
-# test/metabase/premium_features @metabase/core-backend-admin-webapp
-
-# src/metabase/public_settings @metabase/core-backend-admin-webapp
-# test/metabase/public_settings @metabase/core-backend-admin-webapp
-
-# src/metabase/public_sharing @metabase/core-backend-admin-webapp
-# test/metabase/public_sharing @metabase/core-backend-admin-webapp
-
-# src/metabase/pulse @metabase/core-ux-east
-# test/metabase/pulse @metabase/core-ux-east
-
-# src/metabase/query_analysis @metabase/core-backend-querying
-# test/metabase/query_analysis @metabase/core-backend-querying
-
-# src/metabase/query_processor @metabase/core-backend-querying
-# test/metabase/query_processor @metabase/core-backend-querying
-
-# src/metabase/request @metabase/devexp
-# test/metabase/request @metabase/devexp
-
-# src/metabase/revisions @metabase/core-backend-admin-webapp
-# test/metabase/revisions @metabase/core-backend-admin-webapp
-
-# src/metabase/sample_data @metabase/core-backend-admin-webapp
-# test/metabase/sample_data @metabase/core-backend-admin-webapp
-
-# src/metabase/search ...
-# test/metabase/search ...
-
-# src/metabase/segments @metabase/core-backend-querying
-# test/metabase/segments @metabase/core-backend-querying
-
-# src/metabase/server @metabase/devexp
-# test/metabase/server @metabase/devexp
-
-# src/metabase/session @metabase/core-backend-admin-webapp
-# test/metabase/session @metabase/core-backend-admin-webapp
-
-# src/metabase/setup @metabase/core-backend-admin-webapp
-# test/metabase/setup @metabase/core-backend-admin-webapp
-
-# src/metabase/sso @metabase/core-backend-admin-webapp
-# test/metabase/sso @metabase/core-backend-admin-webapp
-
-# src/metabase/sync @metabase/drivers
-# test/metabase/sync @metabase/drivers
-
-# src/metabase/task @metabase/devexp
-# test/metabase/task @metabase/devexp
-
-# src/metabase/tiles @metabase/core-backend-dashviz
-# test/metabase/tiles @metabase/core-backend-dashviz
-
-# src/metabase/timeline @metabase/core-backend-dashviz
-# test/metabase/timeline @metabase/core-backend-dashviz
-
-# src/metabase/types @metabase/core-backend-querying
-# test/metabase/types @metabase/core-backend-querying
-
-# src/metabase/upload @metabase/core-backend-admin-webapp
-# test/metabase/upload @metabase/core-backend-admin-webapp
-
-# src/metabase/user_key_value @metabase/core-backend-admin-webapp
-# test/metabase/user_key_value @metabase/core-backend-admin-webapp
-
-# src/metabase/util @metabase/devexp
-# test/metabase/util @metabase/devexp
-
-# src/metabase/xrays @metabase/core-backend-querying
-# test/metabase/xrays @metabase/core-backend-querying
+# @metabase/cloud-ops
+src/metabase/analytics/prometheus.clj @metabase/cloud-ops

.github/ISSUE_TEMPLATE/epic.md

@@ -1,23 +0,0 @@
----
-name: Epic (Internal Use)
-about: This issue is used to track a feature/project that may span several days
-  to weeks to implement. This is used by the core Metabase team to project plan
-  and manage work.
-title: "[Epic] Title"
-labels: ".Epic"
----
-
-### Links
-
-- [product doc](LINK_TO_PRODUCT_DOC)
-- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
-- [testing plan](LINK_TO_TESTING_PLAN)
-- feature branch: `BRANCH_NAME`
-- issue links: _related issues, if any_
-
-### Implementation Plan
-
-```[tasklist]
-#### Milestone 1
-- [ ] _Add tasks here_
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,16 +7,13 @@ assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+**What problem will this feature request solve?**
 
-**Describe the solution you'd like**
+**Describe the solution you'd like.**
 A clear and concise description of what you want to happen.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
+**How does this feature request impact you?**
+For example, is it a minor inconvenience, or does it block important work?
 
-**How important is this feature to you?**
-
-**Additional context**
+**Additional information**
 Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/task.md

@@ -1,14 +0,0 @@
----
-name: Task (Internal Use)
-about: This issue is used to track a smaller feature/task that does not require
-  being broken down to milestones. This is used by the core Metabase team to
-  project plan and manage work.
-labels: ".Task"
-
----
-
-**Context**
-
-
-- issue links: _related issues if any_
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,3 +25,4 @@ _Upload a demo video or before/after screenshots if sensible or remove the secti
 ### Checklist
 
 - [ ] Tests have been added/updated to cover changes in this PR
+- [ ] If adding new Loki tests: they pass [stress testing](https://github.com/metabase/metabase/actions/workflows/loki-stress-test-flake-fix.yml)

.github/PULL_REQUEST_TEMPLATE/cypress_repro.md

@@ -5,7 +5,7 @@ PENDING CI / PENDING REVIEW / READY _(choose one and update accordingly)_
 - Reproduces #XXXXX
 
 ### How to test this manually?
-- `yarn test-cypress`
+- `bun run test-cypress`
 - `relative/path/to/the/file`
 > _(For still unfixed bug)_
 - Replace `it.skip()` with `it.only()` to run the test in isolation

.github/actions/cleanup-python-runner/action.yml

@@ -0,0 +1,36 @@
+name: Cleanup Python Runner
+description: Cleanup python-runner services and upload logs as artifacts
+
+inputs:
+  upload-logs:
+    description: 'Whether to upload logs (typically on failure)'
+    required: false
+    default: 'false'
+  logs-artifact-suffix:
+    description: 'The unique name of the .zip artifact containing the logs'
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Cleanup python-runner services
+      if: always()
+      run: |
+        echo "Stopping python-runner services..."
+        if [ -d "python-runner" ]; then
+          cd python-runner
+          make stop || echo "WARNING: Failed to stop python runner"
+        fi
+      shell: bash
+
+    - name: Upload python-runner logs
+      if: ${{inputs.upload-logs == 'true' && inputs.logs-artifact-suffix != ''}}
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-runner-logs-${{inputs.logs-artifact-suffix}}
+        path: |
+          python-runner.out.log
+          python-runner.err.log
+        retention-days: 1
+        if-no-files-found: warn

.github/actions/cross-branch-migration-test/action.yml

@@ -17,8 +17,6 @@ runs:
 
     - name: Prepare backend environment
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: cross-branch-migrations
 
     - name: Run backend on base branch
       run: |

.github/actions/fetch-artifact/action.yml

@@ -2,9 +2,16 @@ name: Fetch artifact
 description: Fetches a specific artifact and downloads it to the current directory
 
 inputs:
-  name:
-    description: The name of the artifact to fetch
+  commit:
+    description: Commit SHA for the artifact
     required: true
+  edition:
+    description: Metabase edition (ee or oss)
+    required: true
+  release:
+    description: Whether this is a release artifact (uses metabase-release- prefix)
+    required: false
+    default: "false"
   output-name:
     description: Optional custom name for the output jar file (defaults to metabase.jar)
     required: false
@@ -25,25 +32,44 @@ runs:
         script: | # js
           const fs = require('fs');
 
+          const isRelease = "${{ inputs.release }}" === "true";
+          const prefix = isRelease ? "metabase-release" : "metabase";
+          const artifactName = `${prefix}-${{ inputs.edition }}-${{ inputs.commit }}-uberjar`;
+          console.log(`Looking for artifact: ${artifactName}`);
+
           const artifacts = await github.rest.actions.listArtifactsForRepo({
             owner: context.repo.owner,
             repo: context.repo.repo,
-            name: "${{ inputs.name }}",
+            name: artifactName,
             per_page: 1,
           });
 
           if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.name }}`);
+            core.setFailed(`No artifacts found for ${artifactName}`);
+            return;
           }
 
           const artifact_id = artifacts.data.artifacts[0].id;
 
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
+          let download;
+          const maxAttempts = 3;
+          for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+              download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact_id,
+                archive_format: 'zip',
+              });
+              break;
+            } catch (err) {
+              console.log(`Attempt ${attempt}/${maxAttempts} failed: ${err.message}`);
+              if (attempt === maxAttempts) throw err;
+              const delay = attempt * 15000; // 15s, 30s
+              console.log(`Retrying in ${delay / 1000}s...`);
+              await new Promise(r => setTimeout(r, delay));
+            }
+          }
 
           fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
 

.github/actions/get-cache-keys/action.yml

@@ -0,0 +1,45 @@
+name: Get cache keys
+description: |
+  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
+  and the suffix based on the runner OS and the current week of the year.
+
+outputs:
+  m2-cache-key:
+    description: "The cache key for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
+  m2-restore-key:
+    description: "The fallback restore key prefix for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
+  node-cache-key:
+    description: "The cache key for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  node-restore-key:
+    description: "The fallback restore key prefix for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-restore-key }}
+  eslint-cache-key:
+    description: "The cache key for Eslint cache"
+    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
+  cypress-cache-key:
+    description: "The cache key for Cypress cache"
+    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate and output cache keys
+      id: keys-factory
+      run: |
+        M2_CACHE_PREFIX='M2'
+        NODE_CACHE_PREFIX='node-modules'
+        ESLINT_CACHE_PREFIX='eslint'
+        CYPRESS_CACHE_PREFIX='cypress'
+        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
+        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
+
+        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
+        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
+        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+      shell: bash

.github/actions/maximize-disk-space/action.yml

@@ -0,0 +1,19 @@
+name: Maximize disk space
+description: Removes unused stuff from GH runner
+
+runs:
+  using: "composite"
+  steps:
+    - name: Maximize build space
+      shell: bash
+      run: |
+        echo "-- Dotnet"
+        sudo rm -rf /usr/share/dotnet
+        echo "-- Android"
+        sudo rm -rf /usr/local/lib/android
+        echo "-- Haskell"
+        sudo rm -rf /opt/ghc
+        echo "-- CodeQL"
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+
+        df -h

.github/actions/prepare-backend/action.yml

@@ -1,18 +1,13 @@
 name: Prepare back-end environment
 description: |
-  Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2. The CI config fetchs `ci-test-config.json`
-  from master and lets us ignore tests at the var level if they are flaking.
+  Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2.
 inputs:
   java-version:
     required: true
-    default: '21'
+    default: "21"
   clojure-version:
     required: true
-    default: '1.12.0.1488'
-  m2-cache-key:
-    description: 'Key to cache M2 packages from Maven Central'
-    required: true
-    default: 'm2'
+    default: "1.12.0.1488"
 
 runs:
   using: "composite"
@@ -21,28 +16,39 @@ runs:
       uses: actions/setup-java@v4
       with:
         java-version: ${{ inputs.java-version }}
-        distribution: 'temurin'
+        distribution: "temurin"
     - name: Install Clojure CLI
       shell: bash
-      continue-on-error: true
       run: |
-        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
-        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
-    - name: Fetch CI config
-      shell: bash
-      run: |
-        curl -o ci-test-config.json https://raw.githubusercontent.com/metabase/metabase/refs/heads/master/ci-test-config.json
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
-      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-      shell: bash
-    - name: Get M2 cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
+        for attempt in 1 2 3; do
+          curl --retry 3 --retry-delay 5 --fail -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh \
+            && sudo bash ./linux-install-${{ inputs.clojure-version }}.sh \
+            && break
+          echo "::warning::Clojure install attempt $attempt failed, retrying in 10s..."
+          sleep 10
+        done
+        if ! clojure --version; then
+          echo "::error::Clojure CLI installation failed after 3 attempts"
+          exit 1
+        fi
+
+    - name: Get M2 cache key
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
+    - name: Install uv (for Python package installation)
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: false
+        version: "0.10.2" # keep in sync with mise.toml
+        github-token: ${{ github.token }}
+
+    - name: Restore M2 cache
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/.m2
           ~/.gitlibs
-        key: ${{ runner.os }}-${{ inputs.m2-cache-key }}-${{ hashFiles('**/deps.edn') }}
+        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
         restore-keys: |
-          ${{ runner.os }}-${{ inputs.m2-cache-key }}-
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -3,7 +3,7 @@ description: Cypress preparation steps
 
 inputs:
   working-directory:
-    description: "Optional working directory for yarn commands"
+    description: "Optional working directory for bun commands"
     required: false
     default: "."
 
@@ -15,28 +15,27 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Chrome v111
-      uses: browser-actions/setup-chrome@v1
+    - name: Install Chrome v144
+      uses: browser-actions/setup-chrome@v2
       with:
-        # https://chromium.cypress.io/linux/stable/111.0.5563.146
-        chrome-version: 1097615
+        chrome-version: 144
       id: setup-chrome
 
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
-      run: echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-      shell: bash
+    - name: Get cache keys
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
     - name: Get Cypress cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
+      uses: actions/cache/restore@v4
       with:
         path: ~/.cache/Cypress
-        key: ${{ runner.os }}-Cypress-${{ hashFiles('**/yarn.lock') }}
+        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+
     - name: Ensure that Cypress executable is ready
       run: |
-        yarn cypress install
-        yarn cypress cache path
-        yarn cypress cache list
-        yarn cypress verify
+        bun run cypress install
+        bun run cypress cache path
+        bun run cypress cache list
+        bun run cypress verify
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/actions/prepare-frontend/action.yml

@@ -1,37 +1,61 @@
 name: Prepare front-end environment
+description: "Prepare the front-end environment for the CI build"
 inputs:
   node-version:
     description: "The version of Node.js to use, overriding .nvmrc"
     required: false
+  apply-patches:
+    description: "Whether to patch frontend dependencies with patch-package."
+    required: true
+    default: "true"
 runs:
   using: "composite"
   steps:
-    - name: Prepare Node.js
-      uses: actions/setup-node@v4
+    - name: Prepare Node + Bun environment
+      uses: ./.github/actions/prepare-node-bun
       with:
-        node-version: ${{ inputs.node-version }} # this overrides, if present
-        node-version-file: ".nvmrc"
+        node-version: ${{ inputs.node-version }}
 
-    - name: Check to see if dependencies should be cached
-      if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
+    - name: Get cache keys
+      uses: ./.github/actions/get-cache-keys
+      id: get-cache-keys
+
+    - name: Restore M2 cache
+      uses: actions/cache/restore@v4
+      with:
+        path: |
+          ~/.m2
+          ~/.gitlibs
+        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
+
+    - name: Get bun cache directory
+      id: bun-cache
       run: |
-        echo "Commit message includes [ci nocache]; dependencies will NOT be cached"
-        yarn cache clean
+        BUN_CACHE_DIR=$(bun pm cache)
+        echo "Bun cache directory: $BUN_CACHE_DIR"
+        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
       shell: bash
-    - name: Get M2 cache
-      uses: actions/cache@v4
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
 
-    - name: Get node_modules cache
-      uses: actions/cache@v4
+    - name: Restore node_modules cache
+      uses: actions/cache/restore@v4
       id: node-modules-cache
-      if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}
+        path: |
+          ${{ steps.bun-cache.outputs.dir }}
+          node_modules
+        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.node-restore-key }}
 
-    - run: yarn install --frozen-lockfile --prefer-offline
+    # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
+    # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
+    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
+    - name: Clean install
+      run: bun install --frozen-lockfile
+      shell: bash
+    - name: Patch frontend dependencies
+      if: inputs.apply-patches == 'true'
+      run: bun run patch-package
       shell: bash

.github/actions/prepare-node-bun/action.yml

@@ -0,0 +1,20 @@
+name: Prepare Node + Bun environment
+description: "Set up Node.js and Bun for CI jobs"
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        node-version-file: ".nvmrc"
+
+    - name: Install bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -0,0 +1,14 @@
+name: Prepare Release Scripts
+description: Set up bun and build release scripts
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
+
+    - name: Build release scripts
+      shell: bash
+      run: cd ${{ github.workspace }}/release && bun install --frozen-lockfile && bun run build

.github/actions/prepare-shoppy-e2e/action.yml

@@ -0,0 +1,132 @@
+name: Prepare Shoppy E2E environment
+description: Shared setup steps for Shoppy E2E tests (regular and synthetic)
+
+inputs:
+  commit:
+    description: "Commit SHA for artifact retrieval"
+    required: true
+  sample-app-branch-name:
+    description: "Branch name for the sample app"
+    required: true
+  sample-app-environment:
+    description: "Environment (production/development)"
+    required: true
+  staging-mb-all-features-token:
+    description: "Staging MB all features token"
+    required: true
+  shoppy-iam-role:
+    description: "Shoppy IAM role for AWS credentials"
+    required: true
+  shoppy-metabase-app-db-s3-bucket:
+    description: "S3 bucket for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-s3-key:
+    description: "S3 key for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-user:
+    description: "Shoppy Metabase app DB user"
+    required: true
+  shoppy-metabase-app-db-database:
+    description: "Shoppy Metabase app DB database"
+    required: true
+  metastore-dev-server-url:
+    description: "Metastore dev server URL"
+    required: true
+  shoppy-datadog-application-id:
+    description: "Shoppy Datadog application ID"
+    required: true
+  shoppy-datadog-client-token:
+    description: "Shoppy Datadog client token"
+    required: true
+
+outputs:
+  chrome-path:
+    description: "Path to Chrome executable"
+    value: ${{ steps.cypress-prep.outputs.chrome-path }}
+  sample_app_branch_exists:
+    description: "Whether the sample app branch exists"
+    value: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/maximize-disk-space
+
+    # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v1
+      with:
+        version: latest
+
+    - name: Retrieve uberjar artifact for ee
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ inputs.commit }}
+        edition: ee
+        extract-path: "target/uberjar"
+        output-name: "metabase.jar"
+
+    - name: Retrieve Embedding SDK dist artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: embedding-sdk-${{ inputs.commit }}
+        path: ${{ github.workspace }}/resources/embedding-sdk
+
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare Cypress environment
+      id: cypress-prep
+      uses: ./.github/actions/prepare-cypress
+
+    - name: Check if sample app branch exists
+      id: check-sample-app-branch
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+      run: |
+        REPO_URL="https://github.com/metabase/shoppy.git"
+        echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
+        if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
+          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+        else
+          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Configure AWS credentials
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.shoppy-iam-role }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+
+    - name: Download Shoppy's App DB PostgreSQL dump from S3
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      run: |
+        aws s3 cp s3://${{ inputs.shoppy-metabase-app-db-s3-bucket }}/${{ inputs.shoppy-metabase-app-db-s3-key }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
+
+    - name: Prepare and launch Shoppy containers
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+        SAMPLE_APP_ENVIRONMENT: ${{ inputs.sample-app-environment }}
+        CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ inputs.staging-mb-all-features-token }}
+        METASTORE_DEV_SERVER_URL: ${{ inputs.metastore-dev-server-url }}
+        METABASE_APP_DB_USER: ${{ inputs.shoppy-metabase-app-db-user }}
+        METABASE_APP_DB: ${{ inputs.shoppy-metabase-app-db-database }}
+        SHOPPY_DATADOG_APPLICATION_ID: ${{ inputs.shoppy-datadog-application-id }}
+        SHOPPY_DATADOG_CLIENT_TOKEN: ${{ inputs.shoppy-datadog-client-token }}
+        SHOPPY_DATADOG_SITE: "us5.datadoghq.com"
+        SHOPPY_DATADOG_ENV: "staging"
+      run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
+
+    - name: Prune build cache
+      shell: bash
+      run: docker builder prune -af
+
+    - name: Log free disk space
+      shell: bash
+      run: df -h /

.github/actions/prepare-uberjar-artifact/action.yml

@@ -2,9 +2,10 @@ name: Prepare Uberjar Artifact
 description: Prepare and upload Metabase JAR as a GitHub artifact.
 
 inputs:
-  name:
-    required: true
-    description: Artifact name
+  edition:
+    required: false
+    default: "ee"
+    description: Metabase edition (ee or oss)
 
 runs:
   using: "composite"
@@ -18,7 +19,7 @@ runs:
     - name: Upload JARs as artifact
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.name }}
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
         path: |
           ./target/uberjar/metabase.jar
           ./COMMIT-ID

.github/actions/run-embedding-sdk-storybook/action.yml

@@ -1,33 +0,0 @@
-name: Run Embedding SDK Storybook
-runs:
-  using: "composite"
-  steps:
-    - name: Prepare frontend environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: "cljs"
-
-    - name: Compile CLJS
-      run: yarn build-pure:cljs
-      shell: bash
-
-    - name: Build Storybook
-      run: yarn build-storybook-embedding-sdk
-      shell: bash
-
-    - name: Serve Storybook
-      run: yarn http-server storybook-static -p 6006 &
-      shell: bash
-
-    - name: Wait for Storybook to become available
-      run: |
-        echo "Waiting for Storybook to be served..."
-        while ! curl --silent --fail http://localhost:6006; do
-          sleep 5
-          echo "Retrying..."
-        done
-        echo "Storybook is being served!"
-      shell: bash

.github/actions/sdk-bundle-size-check/action.yml

@@ -0,0 +1,111 @@
+name: Embedding SDK Bundle Size Check
+description: |
+  Downloads the current branch's uberjar and builds the base ref's
+  embedding-sdk.js from source, compares their sizes,
+  and sets output if the size change exceeds the threshold.
+
+inputs:
+  edition:
+    description: 'Metabase edition (ee or oss)'
+    required: true
+  base-ref-commit:
+    description: 'Commit SHA of the base ref (e.g. merge base).'
+    required: true
+  threshold-percent:
+    description: 'Percent threshold for bundle size change'
+    required: true
+
+outputs:
+  status:
+    description: "Bundle size status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.status }}
+  size_change_percent:
+    description: "size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.size_change_percent }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare backend
+      uses: ./.github/actions/prepare-backend
+    - name: Prepare frontend
+      uses: ./.github/actions/prepare-frontend
+    - name: Download current uberjar
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ github.event.pull_request.head.sha || github.sha }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/current-uberjar
+    - name: Extract embedding-sdk bundles from current uberjar
+      shell: bash
+      run: |
+        # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
+        unzip -j temp/current-uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
+          -d temp/current-bundle 2>/dev/null || \
+        unzip -j temp/current-uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk.js" \
+          -d temp/current-bundle
+
+        # Extract chunks directory if it exists (new layout only)
+        mkdir -p temp/current-chunks
+        unzip -j temp/current-uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/chunks/*" \
+          -d temp/current-chunks 2>/dev/null || true
+    - name: Checkout base ref
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref-commit }}
+        path: temp/base-ref-src
+    - name: Build base-ref embedding-sdk.js
+      shell: bash
+      run: |
+        cd temp/base-ref-src
+        bun install
+        MB_EDITION=${{ inputs.edition }} bun run build-release
+    - name: Compare sizes and set output
+      id: compare
+      shell: bash
+      run: |
+        # --- Legacy (monolithic) bundle comparison ---
+        current_size=$(wc -c < temp/current-bundle/embedding-sdk.js) || { echo "::error::Failed to read current bundle"; exit 1; }
+
+        # Base ref: try new layout first, fall back to old
+        if [ -f "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" ]; then
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js")
+        else
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk.js")
+        fi
+        [ "$current_size" -gt 0 ] && [ "$base_ref_size" -gt 0 ] || { echo "::error::Bundle file is empty"; exit 1; }
+
+        diff=$((current_size - base_ref_size))
+        percent=$(( diff * 100 / base_ref_size ))
+
+        echo "=== Legacy (monolithic) bundle ==="
+        echo "Current size: $current_size bytes"
+        echo "Base ref size: $base_ref_size bytes"
+        echo "Difference: $diff bytes ($percent%)"
+
+        threshold="${{ inputs.threshold-percent }}"
+        if [ "$percent" -gt "$threshold" ]; then
+          status="increased"
+        elif [ "$percent" -lt "$(( -threshold ))" ]; then
+          status="decreased"
+        else
+          status="stable"
+        fi
+
+        echo "status=$status" >> $GITHUB_OUTPUT
+        echo "size_change_percent=$percent" >> $GITHUB_OUTPUT
+
+        # --- Chunked bundle (informational) ---
+        if ls temp/current-chunks/*.js 1>/dev/null 2>&1; then
+          chunks_size=$(cat temp/current-chunks/*.js | wc -c)
+          echo ""
+          echo "=== Chunked bundle (bootstrap + chunks) ==="
+          echo "Total chunked size: $chunks_size bytes"
+          echo "chunks_size=$chunks_size" >> $GITHUB_OUTPUT
+        else
+          echo ""
+          echo "No chunked bundle found (expected on master)"
+        fi

.github/actions/setup-python-runner/action.yml

@@ -0,0 +1,14 @@
+name: Setup Python Runner
+description: Setup python-runner for tests
+inputs:
+  metabase-automation-token:
+    description: Token for accessing the python-runner repository
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup python-runner
+      run: ./.github/scripts/setup-python-runner.sh
+      shell: bash
+      env:
+        METABASE_AUTOMATION_USER_TOKEN: ${{ inputs.metabase-automation-token }}

.github/actions/test-driver/action.yml

@@ -9,29 +9,47 @@ inputs:
   build-static-viz:
     required: true
     default: false
+  logs-artifact-suffix:
+    required: false
+    description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+  edition:
+    required: false
+    default: 'ee'
+    description: Edition to test (oss or ee)
+
+outputs:
+  test-outcome:
+    description: "The outcome of the test run (success, failure, cancelled, skipped)"
+    value: ${{ steps.run-test.outcome }}
 
 runs:
   using: "composite"
   steps:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: driver
     - name: Prepare front-end environment
+      if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
-      if: ${{ inputs.build-static-viz == 'true' }}
     - name: Build static viz frontend
-      run: yarn build-static-viz
-      shell: bash
       if: ${{ inputs.build-static-viz == 'true' }}
+      run: bun run build-static-viz
+      shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
+      id: run-test
+      # Trunk Quarantine controls the final state of the run in the CI!
+      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+      # whether to fail or to pass the whole job, based on the quarantine list.
+      continue-on-error: true
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@v1
-      if: failure()
+      # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
+      # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
+      # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
+      if: ${{ steps.run-test.outcome != 'success' }}
       with:
         path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
@@ -40,9 +58,11 @@ runs:
         list-tests: failed
         fail-on-error: false
     - name: Upload Logs on Failure
-      if: always() && !success()
+      if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
-        name: test-logs-${{ github.job }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
+      # Failing to upload the artifact should never affect the outcome of the whole test run.
+      continue-on-error: true

.github/actions/update-cache/action.yml

@@ -0,0 +1,41 @@
+name: Update cache
+description: |
+  Update a GitHub Actions cache based on a provided path and key.
+  If a cache entry already exists for the given key, it is first removed.
+  This ensures immutability of cache entries, and prevents runtime errors.
+
+inputs:
+  path:
+    description: "The path(s) to cache, separated by newlines."
+    required: true
+  key:
+    description: "The cache key to use."
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check if the cache entry exists
+      id: cache-lookup
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}
+        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
+    - name: Delete the cache entry if it exists
+      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
+      run: |
+        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
+        gh api \
+          --method DELETE \
+          -H "Accept: application/vnd.github+json" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+      shell: bash
+    - name: Save the new cache entry
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}

.github/actions/upload-test-results/action.yml

@@ -7,9 +7,7 @@ inputs:
   output-name:
     required: true
     default: test
-  aws-access-key-id:
-    required: true
-  aws-secret-access-key:
+  role-to-assume:
     required: true
   aws-region:
     required: true
@@ -20,7 +18,9 @@ inputs:
     required: true
   variant:
     required: false
-    default: ''
+    default: ""
+  previous-step-outcome:
+    required: true
 
 runs:
   using: "composite"
@@ -28,8 +28,7 @@ runs:
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ inputs.aws-access-key-id }}
-        aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
+        role-to-assume: ${{ inputs.role-to-assume }}
         aws-region: ${{ inputs.aws-region }}
     - name: zip test results
       env:
@@ -48,11 +47,18 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: ${{ always() && !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
+      # Important!
+      # 1. This step must always run because it controls job's exit code.
+      # 2. There's no point in running this outside the organization
+      if: always() && github.repository_owner == 'metabase'
       uses: trunk-io/analytics-uploader@main
+      env:
+        TRUNK_REPO_URL: git@github.com:metabase/metabase.git
       with:
         junit-paths: ${{ inputs.input-path }}
         variant: ${{ inputs.variant || inputs.output-name }}
         org-slug: metabase
+        dry-run: ${{ (github.event_name == 'pull_request' && github.event.pull_request.draft == true) || github.repository != 'metabase/metabase' }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
-      continue-on-error: true
+        use-cache: true
+        previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/codeql/codeql-config.yml

@@ -1,3 +1,5 @@
+version: 1
+
 name: "Metabase CodeQL config"
 
 paths-ignore:

.github/copilot-instructions.md

@@ -1,52 +1,55 @@
 # Metabase Developer Assistant Instructions
 
-## Frontend Development
+For detailed coding standards and conventions, see `CLAUDE.md` and the skills in `.claude/skills/`.
 
-### Repository Structure
+## Code Review Standards
 
-```
-frontend/src/
-├── metabase/           # Main application components and pages
-├── metabase-lib/       # Query building and data modeling utilities
-├── metabase-types/     # TypeScript type definitions
-└── metabase/ui/        # Design system components
+Review focus areas: Security → Performance → Testing → Documentation (in priority order)
 
-e2e/                    # Cypress end-to-end tests
-frontend/test/          # Jest unit tests
-```
+When reviewing code, use these emoji prefixes to categorize feedback:
+- 🔒 Security concerns
+- ⚡ Performance opportunities
+- 🧹 Cleanup needs
+- 📚 Documentation gaps
+- 🚨 Blocking issues
+- 💭 Clarification questions
 
-### Technology Stack
+### Security Critical Issues
 
-- **Framework**: React 18 with TypeScript
-- **State**: Redux Toolkit
-- **Styling**: CSS Modules (preferred) > Emotion styled-components
-- **UI**: `metabase/ui` components built with Mantine v8
-- **Build**: Rspack (primary), Webpack (legacy)
-- **Testing**: Jest + React Testing Library, Cypress
+- Check for hardcoded secrets, API keys, or credentials
+- Look for SQL injection and XSS vulnerabilities
+- Verify proper input validation and sanitization
+- Review authentication and authorization logic
+- Ensure enterprise features use the plugin system (no enterprise code in OSS)
 
-### Coding Standards
+### Performance Red Flags
 
-#### Component Preferences
+- Identify N+1 database query problems
+- Spot inefficient loops and algorithmic issues
+- Check for memory leaks and resource cleanup
+- Review caching opportunities for expensive operations
 
-- Prefer `metabase/ui`components over `metabase/common/components`
-- Use `.tsx` for components, `.ts` for utilities
+### Code Quality Essentials
 
-#### Styling
+- Functions should be focused and appropriately sized
+- Use clear, descriptive naming conventions
+- Ensure proper error handling throughout
+- Remove dead code and unused imports
 
-ALWAYS prefer Mantine style props,then CSS modules. DO NOT suggest styled components, they are deprecated.
+### Review Style
 
-#### TypeScript Migration
+- Only flag actual issues worth mentioning
+- Do not post "looks good" comments or congratulate following conventions
+- Be specific and actionable in feedback
+- Explain the "why" behind recommendations
+- Ask clarifying questions when code intent is unclear
 
-When heavily editing `.js`/`.jsx` files, create a separate PR to convert to TypeScript first, then implement changes.
+### Review Format
 
-#### Enterprise Features
+- Condense feedback into as few comments as possible
+- Prefer a single summary comment over dozens of inline comments
+- Only use inline comments for critical issues that require immediate attention
+- For non-critical issues, link to the specific line from the summary instead
+- Delete all stale comments and summaries on each new push or CI run
 
-Enterprise functionality MUST use the plugin system. It is very important to not expose enterprise code in the OSS version.
-
-#### Testing Requirements
-
-All PRs should include tests. Prefer Unit tests over E2E tests.
-
-#### Localization
-
-All user-facing strings MUST be localized using the ttag library. Localized strings should be complete phrases, do not concatenate a few separately localized strings. You should add context to strings where the meaning of the string might not be obvious in isolation: e.g. "Home" might have different words in some languages depending on whether you're talking about a dwelling or the landing page for a website.
+Language-specific rules are in `.github/instructions/*.instructions.md`.

.github/file-paths.yaml

@@ -11,22 +11,26 @@ shared_specs: &shared_specs
   - "test/**/*.cljc"
   - "test/**/*.cljs"
 
-frontend_ci: &frontend_ci
+shared_ci: &shared_ci
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
+  - ".github/workflows/run-tests.yml"
+
+shared_e2e: &shared_e2e
+  - "e2e/runner/**"
+  - "e2e/snapshot-creators/**"
+  - "e2e/support/**"
+
+frontend_ci: &frontend_ci
+  - *shared_ci
   - ".github/workflows/frontend.yml"
 
-frontend_embedding_sdk_ci: &frontend_embedding_sdk_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
-  - ".github/workflows/*embedding-sdk*.yml"
-
 frontend_configs: &frontend_configs
-  - "yarn.lock"
+  - "bun.lock"
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
-  - ".eslintrc.js"
+  - "eslint.config.mjs"
   - "postcss.config.js"
   - "rspack.config.js"
   - "rspack.main.config.js"
@@ -41,14 +45,12 @@ frontend_sources: &frontend_sources
   - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
+# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
 frontend_embedding_sources:
   - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
-frontend_embedding_sdk_sources:
-  - *frontend_configs
-  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
+# Used only in .github/workflows/embedding-sdk-labels-reminder.yml
 frontend_embedding_sdk_package_sources:
   - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"
 
@@ -76,15 +78,16 @@ frontend_loki_ci: &frontend_loki_ci
   - ".storybook/**"
 
 backend_ci: &backend_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/test-driver/**"
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
 
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
+  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
   - "**/presto_jdbc.clj"
+  - "**/presto_jdbc_test.clj"
   - ".github/workflows/presto-kerberos-integration-test.yml"
 
 backend_sources: &backend_sources
@@ -117,9 +120,9 @@ sources: &sources
   - *backend_sources
 
 e2e_ci: &e2e_ci
-  - ".github/actions/prepare-frontend/**"
-  - ".github/actions/prepare-backend/**"
+  - *shared_ci
   - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
   - ".github/workflows/e2e-*"
@@ -127,22 +130,27 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
   - e2e/!(test-host-app)**/*.cy.*.{js,ts}
 
-e2e_cross_version: &e2e_cross_version
-  - ".github/workflows/e2e-cross-version.yml"
-  - "e2e/test/scenarios/cross-version/**"
+embedding_sdk_ci: &embedding_sdk_ci
+  - *shared_ci
+  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/actions/fetch-artifact/action.yml"
+  - ".github/actions/prepare-cypress/**"
+  - ".github/workflows/embedding-sdk*.yml"
 
-e2e_embedding_sdk:
-  - *frontend_embedding_sdk_ci
-  - *sources
-  - "e2e/component/**/*.cy.*.{js,ts}"
-
-e2e_embedding_sdk_compatibility:
+embedding_sdk_components:
   - *default
-  - *frontend_embedding_sdk_ci
+  - *embedding_sdk_ci
+  - *sources
+  - *shared_e2e
+  - "e2e/test-component/**/*.cy.*.{js,jsx,ts,tsx}"
+
+embedding_sdk_host_sample_apps:
+  - *default
+  - *embedding_sdk_ci
   - *frontend_sources
   - *backend_sources
+  - *shared_e2e
   - "e2e/embedding-sdk-host-apps/**"
-  - "e2e/runner/embedding-sdk/**"
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow
@@ -170,6 +178,7 @@ yaml:
   - "**/*.yaml"
 
 codeql:
+  - ".github/workflows/codeql.yml"
   - "frontend/src/**"
   - "enterprise/frontend/src/**"
 
@@ -190,3 +199,19 @@ cljs:
   - *shared_specs
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
+
+serialization_baseline:
+  - ".github/workflows/serialization.yml"
+  - "test_resources/serialization_baseline/**"
+
+openapi:
+  - ".github/workflows/openapi.yml"
+  - "src/metabase/api/**"
+  - "src/metabase/api_routes/**"
+  - "src/metabase/*_rest/api.clj"
+  - "src/metabase/*/api.clj"
+  - "src/metabase/*/api/*.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api/*.clj"
+  - "resources/openapi/**"
+  - "package.json"

.github/instructions/clojure.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "**/*.{clj,cljs,cljc}"
+---
+
+# Clojure/ClojureScript Code Review
+
+When reviewing Clojure or ClojureScript code, apply the guidelines in these files:
+- `.claude/skills/_shared/clojure-style-guide.md`
+- `.claude/skills/clojure-review/SKILL.md`

.github/instructions/docs.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "docs/**/*.md"
+---
+
+# Documentation Review
+
+When reviewing documentation, apply the guidelines in these files:
+- `.claude/skills/_shared/metabase-style-guide.md`
+- `.claude/skills/docs-review/SKILL.md`

.github/instructions/typescript.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.{ts,tsx,js,jsx}"
+---
+
+# TypeScript/JavaScript Code Review
+
+When reviewing TypeScript or JavaScript code, apply the guidelines in these files:
+
+- `.claude/skills/typescript-review/SKILL.md`
+- `docs/developers-guide/frontend.md`
+- `frontend/CLAUDE.md`

.github/scripts/average-e2e-timings.js

@@ -21,7 +21,6 @@ const collectAndAverageTimings = async ({
 
     const timingData = await downloadAndExtractArtifacts(
       artifacts,
-      token,
       github,
       context,
     );

.github/scripts/build-cross-version-matrix.js

@@ -0,0 +1,52 @@
+// This script is used in .github/workflows/cross-version.yml
+// to generate a matrix for cross-version migration testing
+
+/**
+ * Generate a CI matrix for cross-version migration testing (EE only).
+ *
+ * Creates pairs of [source, target] for testing HEAD against the last N
+ * minor versions in both upgrade and downgrade directions.
+ *
+ * @param {number} currentVersion - The current major version number (e.g., 59)
+ * @param {number} count - Number of previous minor versions to test against (default: 3)
+ * @returns {{ config: Array<{ source: string, target: string }> }}
+ *
+ * @example
+ * buildMatrix(59)
+ * // Returns:
+ * // {
+ * //   config: [
+ * //     { source: "HEAD", target: "v1.59.x" },
+ * //     { source: "v1.59.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.58.x" },
+ * //     { source: "v1.58.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.57.x" },
+ * //     { source: "v1.57.x", target: "HEAD" },
+ * //   ]
+ * // }
+ */
+function buildCrossVersionMatrix(currentVersion, count = 3) {
+  if (!Number.isInteger(currentVersion) || currentVersion < 1) {
+    throw new Error(
+      `Invalid currentVersion: ${currentVersion}. Must be a positive integer.`,
+    );
+  }
+
+  if (!Number.isInteger(count) || count < 1) {
+    throw new Error(`Invalid count: ${count}. Must be a positive integer.`);
+  }
+
+  const config = Array.from({ length: count }, (_, i) => currentVersion - i)
+    .filter((majorVersion) => majorVersion >= 1)
+    .flatMap((majorVersion) => {
+      const version = `v1.${majorVersion}.x`;
+      return [
+        { source: "HEAD", target: version },
+        { source: version, target: "HEAD" },
+      ];
+    });
+
+  return { config };
+}
+
+module.exports = { buildCrossVersionMatrix };

.github/scripts/build-cross-version-matrix.unit.spec.js

@@ -0,0 +1,242 @@
+const { buildCrossVersionMatrix } = require("./build-cross-version-matrix");
+
+describe("buildCrossVersionMatrix", () => {
+  describe("default behavior", () => {
+    it("should generate matrix with 3 versions by default", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.59.x" },
+          { source: "v1.59.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.58.x" },
+          { source: "v1.58.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.57.x" },
+          { source: "v1.57.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should use EE prefix (v1)", () => {
+      const result = buildCrossVersionMatrix(50);
+      expect(result.config[0].target).toBe("v1.50.x");
+      expect(result.config[1].source).toBe("v1.50.x");
+    });
+
+    it("should create pairs in both directions (upgrade and downgrade)", () => {
+      const result = buildCrossVersionMatrix(59);
+      const entries = result.config;
+
+      // Check HEAD -> version (upgrade test)
+      expect(entries.filter((e) => e.source === "HEAD")).toHaveLength(3);
+      // Check version -> HEAD (downgrade test)
+      expect(entries.filter((e) => e.target === "HEAD")).toHaveLength(3);
+    });
+  });
+
+  describe("custom count", () => {
+    it("should generate matrix with custom count", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      expect(result.config).toHaveLength(10); // 5 versions × 2 directions
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.58.x" },
+        { source: "v1.58.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.57.x" },
+        { source: "v1.57.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.56.x" },
+        { source: "v1.56.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.55.x" },
+        { source: "v1.55.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with count=1", () => {
+      const result = buildCrossVersionMatrix(59, 1);
+      expect(result.config).toHaveLength(2);
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with large count", () => {
+      const result = buildCrossVersionMatrix(59, 10);
+      expect(result.config).toHaveLength(20);
+
+      // Check first and last entries
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[18]).toEqual({
+        source: "HEAD",
+        target: "v1.50.x",
+      });
+      expect(result.config[19]).toEqual({
+        source: "v1.50.x",
+        target: "HEAD",
+      });
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle version 1", () => {
+      const result = buildCrossVersionMatrix(1);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should stop when version would go below 1", () => {
+      const result = buildCrossVersionMatrix(2, 5);
+      // Can only generate v1.2.x and v1.1.x (2 versions, not 5)
+      expect(result.config).toHaveLength(4);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.2.x" },
+          { source: "v1.2.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should handle high version numbers", () => {
+      const result = buildCrossVersionMatrix(100, 2);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.100.x" },
+          { source: "v1.100.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.99.x" },
+          { source: "v1.99.x", target: "HEAD" },
+        ],
+      });
+    });
+  });
+
+  describe("error handling", () => {
+    it("should throw for undefined currentVersion", () => {
+      expect(() => buildCrossVersionMatrix()).toThrow(
+        "Invalid currentVersion: undefined. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(59.5)).toThrow(
+        "Invalid currentVersion: 59.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(0)).toThrow(
+        "Invalid currentVersion: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(-1)).toThrow(
+        "Invalid currentVersion: -1. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for NaN currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(NaN)).toThrow(
+        "Invalid currentVersion: NaN. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer count", () => {
+      expect(() => buildCrossVersionMatrix(59, 2.5)).toThrow(
+        "Invalid count: 2.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero count", () => {
+      expect(() => buildCrossVersionMatrix(59, 0)).toThrow(
+        "Invalid count: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative count", () => {
+      expect(() => buildCrossVersionMatrix(59, -1)).toThrow(
+        "Invalid count: -1. Must be a positive integer.",
+      );
+    });
+  });
+
+  describe("matrix structure for GitHub Actions", () => {
+    it("should return object with config array", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toHaveProperty("config");
+      expect(Array.isArray(result.config)).toBe(true);
+    });
+
+    it("should produce valid JSON for GitHub Actions", () => {
+      const result = buildCrossVersionMatrix(59);
+      const json = JSON.stringify(result);
+      expect(() => JSON.parse(json)).not.toThrow();
+
+      const parsed = JSON.parse(json);
+      expect(parsed.config).toHaveLength(6);
+      expect(parsed.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+    });
+
+    it("should have consistent entry structure", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+
+      result.config.forEach((entry) => {
+        expect(entry).toHaveProperty("source");
+        expect(entry).toHaveProperty("target");
+        expect(typeof entry.source).toBe("string");
+        expect(typeof entry.target).toBe("string");
+        // Either source or target should be HEAD
+        expect(entry.source === "HEAD" || entry.target === "HEAD").toBeTruthy();
+      });
+    });
+  });
+
+  describe("version ordering", () => {
+    it("should generate versions in descending order", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      const versions = result.config
+        .filter((e) => e.source === "HEAD")
+        .map((e) => e.target);
+
+      expect(versions).toEqual([
+        "v1.59.x",
+        "v1.58.x",
+        "v1.57.x",
+        "v1.56.x",
+        "v1.55.x",
+      ]);
+    });
+
+    it("should interleave upgrade and downgrade tests", () => {
+      const result = buildCrossVersionMatrix(59, 2);
+
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[1]).toEqual({
+        source: "v1.59.x",
+        target: "HEAD",
+      });
+      expect(result.config[2]).toEqual({
+        source: "HEAD",
+        target: "v1.58.x",
+      });
+      expect(result.config[3]).toEqual({
+        source: "v1.58.x",
+        target: "HEAD",
+      });
+    });
+  });
+});

.github/scripts/build-e2e-matrix.js

@@ -3,14 +3,8 @@
 // grouping some specific tests together, other tests are split into chunks
 
 const DEFAULT_SPEC_PATTERN = "./e2e/test/scenarios/**/*.cy.spec.*";
-const EMBEDDING_SDK_SPEC_PATTERN =
-  "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*";
 
 const specialTestConfigs = [
-  {
-    name: "embedding-sdk",
-    specs: EMBEDDING_SDK_SPEC_PATTERN,
-  },
   {
     name: "oss-subset",
     edition: "oss",
@@ -18,6 +12,7 @@ const specialTestConfigs = [
     specs: DEFAULT_SPEC_PATTERN,
   },
   { name: "mongo", tags: "@mongo", specs: DEFAULT_SPEC_PATTERN },
+  { name: "python", tags: "@python", specs: DEFAULT_SPEC_PATTERN },
 ];
 
 /**
@@ -57,17 +52,21 @@ function buildMatrix(options, inputSpecs, inputChunks) {
     );
   }
 
-  const regularTests = new Array(regularChunks).fill(1).map((files, index) => ({
-    name: `e2e-group-${index + 1}`,
-    // works when specs less than 5, otherwise seems all chunks will contain
-    // same specs
-    ...(!isDefaultSpecPattern && {
-      specs: inputSpecs
-        .split(",")
-        .slice(SPECS_PER_CHUNK * index, SPECS_PER_CHUNK * (index + 1))
-        .join(","),
-    }),
-  }));
+  const regularTests = Array.from({ length: regularChunks }, (_, index) => {
+    const paddedIndex = String(index + 1).padStart(2, "0");
+
+    return {
+      name: `e2e-group-${paddedIndex}`,
+      // works when specs less than 5, otherwise seems all chunks will contain
+      // same specs
+      ...(!isDefaultSpecPattern && {
+        specs: inputSpecs
+          .split(",")
+          .slice(SPECS_PER_CHUNK * index, SPECS_PER_CHUNK * (index + 1))
+          .join(","),
+      }),
+    };
+  });
 
   const testSets = isDefaultSpecPattern
     ? regularTests.concat(specialTestConfigs)