use polyglot sql ffi instead of sqlglot in graalvm

build.sh --all produces both Mac architectures with Apple clang and both
Linux architectures with zig cc against glibc 2.17, so a locally built jar
carries a working library for every supported platform. QuickJS-ng is
compiled in directly from its four core source files, dropping the CMake
dependency; the smoke test executes against the host-platform library and
CI's native runners execution-test the rest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/skills/clojure-write/SKILL.md

@@ -102,7 +102,3 @@ breakage keeps happening, *that* is the signal a comment was warranted.
 - End all files with a newline
 - When editing tabular code, where the columns line up, try to keep them aligned
 - Spaces on a line with nothing after it is not allowed
-- After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
-  or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
-  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
-  drifted; see "Module Boundaries" in the project `CLAUDE.md`.

.clj-kondo/config.edn

@@ -179,7 +179,6 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
-     metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
      metabase.channel.render.pdf/draw-too-large!
@@ -454,9 +453,6 @@
   metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.entity-retrieval.reconcile-test/with-isolated-index                 clojure.core/fn
-  metabase-enterprise.mfa.enrollment-flow-test/with-fresh-user-session!                  clojure.core/fn
-  metabase-enterprise.mfa.login-flow-test/with-enrolled-rasta!                           clojure.core/fn
-  metabase-enterprise.mfa.recovery-codes-test/with-confirmed-enrollment!                 clojure.core/fn
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -625,9 +621,6 @@
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
-   metabase.mq.core/with-queue                                                                                               hooks.common/let-second
-   metabase.mq.test-util/with-test-mq                                                                                        hooks.common/with-one-binding
-   metabase.mq.core/def-listener!                                                                                            hooks.metabase.mq.impl/def-listener
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
@@ -766,7 +759,6 @@
    metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
    metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
-   metabase.util.namespaces/import-macro                                                        macros.metabase.util.namespaces/import-macro
    metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment

.clj-kondo/config/modules/config.edn

@@ -159,8 +159,7 @@
   {:team    "Metabot"
    :api     #{metabase.agent-api.api
               metabase.agent-api.init}
-   :uses    #{ai-tracing
-              api
+   :uses    #{api
               auth-identity
               channel
               collections
@@ -181,7 +180,6 @@
                     :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
-                    :model/DashboardTab
                     :model/Database
                     :model/Table
                     :model/User}}
@@ -195,15 +193,6 @@
            models
            util}}
 
-  ai-tracing
-  {:team "Metabot"
-   :api  #{metabase.ai-tracing.api
-           metabase.ai-tracing.core
-           metabase.ai-tracing.init}
-   :uses #{api
-           settings
-           util}}
-
   analytics
   {:team "UX West"
    :api  #{metabase.analytics.api
@@ -1075,27 +1064,6 @@
    :model-exports #{:model/ModelIndex :model/ModelIndexValue}
    :model-imports #{:model/Card :model/Collection}}
 
-  indexes
-  {:team "Gadget"
-   :api  #{metabase.indexes.models.table-index
-           metabase.indexes.reconcile
-           metabase.indexes.schema}
-   :uses #{driver
-           models
-           util}
-   :model-exports #{:model/TableIndex}}
-
-  indexes-rest
-  {:team "Gadget"
-   :api  #{metabase.indexes-rest.api}
-   :uses #{api
-           indexes
-           transforms-base
-           util}
-   :model-imports #{:model/Database
-                    :model/TableIndex
-                    :model/Transform}}
-
   initialization-status
   {:team "UX West"
    :api  #{metabase.initialization-status.core}
@@ -1135,7 +1103,6 @@
            metabase.lib.metadata
            metabase.lib.metadata.protocols
            metabase.lib.options
-           metabase.lib.pivot
            metabase.lib.schema
            metabase.lib.schema.actions
            metabase.lib.schema.aggregation
@@ -1264,12 +1231,10 @@
    :model-exports #{:model/McpSessionLog
                     :model/McpToolCallLog}
    :uses #{agent-api
-           ai-tracing
            api
            app-db
            config
            llm
-           metabot
            oauth-server
            premium-features
            request
@@ -1310,7 +1275,6 @@
               slackbot}
    :uses    #{activity-feed
               agent-lib
-              ai-tracing
               analytics
               analytics-interface
               api
@@ -1342,6 +1306,7 @@
               settings
               slackbot
               sql-tools
+              store-api
               sync
               system
               task
@@ -1357,8 +1322,6 @@
    :model-imports #{:model/Card
                     :model/Collection
                     :model/Dashboard
-                    :model/DashboardCard
-                    :model/DashboardTab
                     :model/Database
                     :model/Field
                     :model/Glossary
@@ -1448,17 +1411,6 @@
                     :model/Table
                     :model/User}}
 
-  mq
-  {:team "UX West"
-   :api  #{metabase.mq.init}
-   :uses #{analytics-interface
-           app-db
-           classloader
-           settings
-           startup
-           task
-           util}}
-
   native-query-snippets
   {:team "Graphy"
    :api  #{metabase.native-query-snippets.api
@@ -1902,7 +1854,6 @@
            cache
            config
            dashboards
-           database-routing
            driver
            events
            formatter
@@ -1996,12 +1947,20 @@
   {:team "UX West"
    :api  #{metabase.sample-data.core
            metabase.sample-data.init}
-   :uses #{driver
+   :uses #{config
+           models
+           permissions
            plugins
            settings
            sync
            util}
-   :model-imports #{:model/DataPermissions :model/Database :model/Table}}
+   :model-imports #{:model/Card
+                    :model/Dashboard
+                    :model/DashboardCard
+                    :model/DataPermissions
+                    :model/Database
+                    :model/Field
+                    :model/Table}}
 
   search
   {:team "UX West"
@@ -2115,7 +2074,6 @@
            channel
            config
            events
-           premium-features
            request
            settings
            sso
@@ -2213,7 +2171,7 @@
   sql-parsing
   {:team "DevEx"
    :api #{metabase.sql-parsing.core}
-   :uses #{analytics-interface util}}
+   :uses #{util}}
 
   sql-tools
   {:team "DevEx"
@@ -2356,7 +2314,6 @@
            permissions
            premium-features
            search
-           session
            util}
    :model-imports #{:model/AiUsageLog
                     :model/Card
@@ -2421,7 +2378,6 @@
            database-routing
            driver
            events
-           indexes
            lib
            lib-be
            models
@@ -2451,7 +2407,6 @@
                     :model/Database
                     :model/Field
                     :model/Table
-                    :model/TableIndex
                     :model/User}}
 
   transforms-base
@@ -2465,13 +2420,11 @@
    :model-imports #{:model/Database
                     :model/Field
                     :model/Table
-                    :model/TableIndex
                     :model/Transform
                     :model/TransformRun}
    :uses #{database-routing
            driver
            events
-           indexes
            lib
            lib-be
            premium-features
@@ -2898,7 +2851,6 @@
    :uses #{driver
            premium-features
            enterprise/advanced-config
-           enterprise/mfa
            enterprise/scim
            enterprise/semantic-search
            enterprise/sso}
@@ -3132,6 +3084,7 @@
   {:team "UX West"
    :api  #{metabase-enterprise.database-routing.api}
    :uses #{api
+           config
            database-routing
            driver
            events
@@ -3369,22 +3322,6 @@
            util}
    :model-imports #{:model/MetabotConversation :model/MetabotFeedback :model/MetabotMessage}}
 
-  enterprise/mfa
-  {:team "Graphy"
-   :api  #{metabase-enterprise.mfa.core
-           metabase-enterprise.mfa.init
-           metabase-enterprise.mfa.routes}
-   :uses #{api
-           appearance
-           channel
-           config
-           events
-           premium-features
-           settings
-           sso
-           util}
-   :model-imports #{:model/AuthIdentity :model/User}}
-
   enterprise/permission-debug
   {:team "UX West"
    :api  #{metabase-enterprise.permission-debug.api}
@@ -3564,7 +3501,6 @@
            config
            connection-pool
            events
-           lib-be
            llm
            metabot
            models

.clj-kondo/config/test-helpers/config.edn

@@ -36,9 +36,6 @@
      ;; Definitely thread safe
      metabase.test.util.dynamic-redefs/patch-vars!
 
-     ;; test-only cleanup of in-memory throttle state (atom resets)
-     metabase.session.api/reset-throttlers-for-testing!
-
      ;; TODO: most of these symbols shouldn't be here, we should go through them and
      ;; find the functions/macros that use them and make sure their names end with !
      ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used

.clj-kondo/macros/metabase/util/namespaces.clj

@@ -6,8 +6,3 @@
    `(def ~(-> sym name symbol) "docstring" ~sym))
   ([sym name]
    `(def ~name "docstring" ~sym)))
-
-(defmacro import-macro
-  "Kondo macro replacement for [[metabase.util.namespaces/import-macro]]."
-  [sym]
-  `(def ~(-> sym name symbol) "docstring" ~sym))

.clj-kondo/src/hooks/metabase/mq/impl.clj

@@ -1,18 +0,0 @@
-(ns hooks.metabase.mq.impl
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
-
-(defn def-listener
-  "Kondo hook for `mq/def-listener`. Rewrites to a `fn` form so kondo can analyze bindings.
-
-   Form:
-     (mq/def-listener! :queue/bar [msgs] body...)"
-  [{:keys [node]}]
-  (let [[_ _channel-name bindings & body] (:children node)
-        ;; rewrite as: (fn [bindings...] body...)
-        new-node (hooks/list-node
-                  (list*
-                   (hooks/token-node 'fn)
-                   bindings
-                   body))]
-    {:node new-node}))

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:25
+FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
 # Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 

.github/actions/prepare-backend/action.yml

@@ -4,7 +4,7 @@ description: |
 inputs:
   java-version:
     required: true
-    default: "25"
+    default: "21"
   clojure-version:
     required: true
     default: "1.12.0.1488"
@@ -36,13 +36,6 @@ runs:
       uses: ./.github/actions/get-cache-keys
       id: get-cache-keys
 
-    - name: Install uv (for Python package installation)
-      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-      with:
-        enable-cache: false
-        version: "0.10.2" # keep in sync with mise.toml
-        github-token: ${{ github.token }}
-
     - name: Restore M2 cache
       uses: actions/cache/restore@v5
       with:

.github/actions/prepare-ci-conductor/action.yml

@@ -1,52 +0,0 @@
-name: Prepare CI Conductor
-description: >-
-  Make the ci-conductor sources runnable in the workspace.
-  Unless the checkout is headed for master, they are overlaid from master, so every
-  branch runs the latest scripts while its workflow wiring stays branch-historical.
-
-runs:
-  using: composite
-  steps:
-    - name: Detect bun
-      id: bun
-      shell: bash
-      run: |
-        if command -v bun >/dev/null; then
-          echo "present=true" >> "$GITHUB_OUTPUT"
-        else
-          echo "present=false" >> "$GITHUB_OUTPUT"
-        fi
-
-    - name: Install bun
-      if: steps.bun.outputs.present != 'true'
-      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      with:
-        bun-version-file: "package.json"
-        token: ${{ github.token }}
-
-    # Anything headed for master runs master's own sources, so a PR can test its own changes.
-    - name: Fetch ci-conductor sources from master
-      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
-      uses: actions/checkout@v6
-      with:
-        repository: metabase/metabase
-        ref: master
-        path: .ci-conductor-master
-        persist-credentials: false
-        sparse-checkout-cone-mode: false
-        sparse-checkout: |
-          release/ci-conductor
-          e2e/support/ci_conductor.ts
-
-    # e2e/support/config.js and e2e/support/ci_conductor.ts resolve these by relative
-    # path at bundle time, so the sources have to land where the branch expects them.
-    - name: Overlay ci-conductor sources from master
-      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
-      shell: bash
-      run: |
-        set -euo pipefail
-        rm -rf release/ci-conductor
-        mv .ci-conductor-master/release/ci-conductor release/ci-conductor
-        mv .ci-conductor-master/e2e/support/ci_conductor.ts e2e/support/ci_conductor.ts
-        rm -rf .ci-conductor-master
-        echo "Overlaid ci-conductor sources from master."

.github/actions/prepare-cypress/action.yml

@@ -15,10 +15,6 @@ outputs:
 runs:
   using: "composite"
   steps:
-    # e2e/support/config.js imports the reporter, so it has to be in place before Cypress bundles.
-    - name: Prepare CI Conductor
-      uses: ./.github/actions/prepare-ci-conductor
-
     - name: Install Chrome v144
       uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
       with:

.github/actions/quarantine-gate/action.yml

@@ -1,8 +1,8 @@
-name: CI Conductor quarantine gate
+name: CI Conductor quarantine gate (dry run)
 description: >-
-  Check this job's test failures against ci-conductor's quarantine list.
-  Either enforces the quarantine or only prints a verdict (dry run).
-  Fails closed when enforcing but the `CI_CONDUCTOR_BASE_URL` is missing or unreachable.
+  Check this job's test failures against ci-conductor's quarantine list and print
+  a verdict. DRY RUN — it never fails the job. No-ops unless CI_CONDUCTOR_BASE_URL
+  is set.
 
 inputs:
   adapter:
@@ -13,23 +13,31 @@ inputs:
       Suite label to gate (CI_CONDUCTOR_TEST_SUITE). MUST match the label this
       job reports under, or the gate checks the wrong quarantine list.
     required: true
-  enforce-quarantine:
-    description: >-
-      Whether the gate actually gates the job. When "false", it only prints a verdict.
-    required: false
-    default: "false"
 
 runs:
   using: composite
   steps:
-    - name: Prepare CI Conductor
-      uses: ./.github/actions/prepare-ci-conductor
+    - name: Detect bun
+      id: bun
+      shell: bash
+      run: |
+        if command -v bun >/dev/null; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Install bun
+      if: steps.bun.outputs.present != 'true'
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version-file: 'package.json'
+        token: ${{ github.token }}
     - name: Check failures against the quarantine list
       shell: bash
       env:
         CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
         ADAPTER: ${{ inputs.adapter }}
-        QUARANTINE_DRY_RUN: ${{ inputs.enforce-quarantine != 'true' }}
+        QUARANTINE_DRY_RUN: "true"
       run: |
         case "$ADAPTER" in
           backend|frontend|e2e) ;;

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -15,8 +15,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Prepare CI Conductor
-      uses: ./.github/actions/prepare-ci-conductor
+    - name: Detect bun
+      id: bun
+      shell: bash
+      run: |
+        if command -v bun >/dev/null; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+    - name: Install bun
+      if: steps.bun.outputs.present != 'true'
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version-file: 'package.json'
+        token: ${{ github.token }}
     - name: Report failed tests to ci-conductor
       shell: bash
       env:

.github/actions/test-driver/action.yml

@@ -14,15 +14,8 @@ inputs:
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
   edition:
     required: false
-    default: "ee"
+    default: 'ee'
     description: Edition to test (oss or ee)
-  quarantine-engine:
-    required: false
-  driver-status:
-    required: false
-    default: ""
-    description: >-
-      Configured status for this driver ("info", "skip", "required", or empty), as reported by `mage driver-decisions`.
 
 outputs:
   test-outcome:
@@ -46,25 +39,35 @@ runs:
       run: bun run build-static-viz
       shell: bash
       env:
-        MB_EDITION: ${{ inputs.edition }}
-
+        MB_EDITION: ee
     - name: Test database driver
       run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
-      # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
-      # Driver "info" status can affect this logic. See below.
+      # Trunk Quarantine controls the final state of the run in the CI!
+      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+      # whether to fail or to pass the whole job, based on the quarantine list.
       continue-on-error: true
-
     - name: Report failed tests to ci-conductor
-      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
-      # This step should NEVER fail the job!
+      # Positioned right after the test run (before the report/upload steps) so it
+      # reads pristine JUnit. Gated to non-clean runs + continue-on-error so it can
+      # never change the job outcome — Trunk Quarantine remains the sole arbiter.
+      # junit-name is the per-job identity label (e.g. be-tests-postgres-ee); only
+      # workflows that also set CI_CONDUCTOR_BASE_URL actually POST. See DEV-2224 /
+      # DEV-2235.
+      if: ${{ always() && steps.run-test.outcome != 'success' }}
       continue-on-error: true
       uses: ./.github/actions/report-failures-to-ci-conductor
       with:
         test-suite: ${{ inputs.junit-name }}
         adapter: backend
-
+    - name: Quarantine gate (dry run)
+      if: ${{ always() && steps.run-test.outcome != 'success' }}
+      continue-on-error: true
+      uses: ./.github/actions/quarantine-gate
+      with:
+        adapter: backend
+        test-suite: ${{ inputs.junit-name }}
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
@@ -78,7 +81,6 @@ runs:
         list-suites: failed
         list-tests: failed
         fail-on-error: false
-
     - name: Upload Logs on Failure
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v7
@@ -88,20 +90,3 @@ runs:
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
       continue-on-error: true
-
-    # Last, because this is the only step allowed to fail the job: everything above it reports the
-    # failure (JUnit report, logs, ci-conductor) and must run regardless of the verdict below.
-    - name: Quarantine gate
-      # Off master and release branches an "info" driver is data-collection only - the test always passes!
-      # On master and release branches "info" carries no weight - the quarantine logic applies.
-      if: |
-        !cancelled()
-        && steps.run-test.outcome == 'failure'
-        && !(inputs.driver-status == 'info'
-             && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')))
-      continue-on-error: ${{ inputs.quarantine-engine != 'ci-conductor' }}
-      uses: ./.github/actions/quarantine-gate
-      with:
-        adapter: backend
-        test-suite: ${{ inputs.junit-name }}
-        enforce-quarantine: ${{ inputs.quarantine-engine == 'ci-conductor' }}

.github/actions/upload-test-results/action.yml

@@ -34,10 +34,6 @@ inputs:
     description: >-
       Optional label disambiguating matrix legs of the same job, so the info-driver
       job summary and PR comment stay distinct per leg.
-  run-trunk:
-    required: false
-    default: "true"
-    description: Whether to run the Trunk step at all.
 
 runs:
   using: "composite"
@@ -64,11 +60,13 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: ${{ always() && github.repository_owner == 'metabase' && inputs.run-trunk == 'true' }}
       # Important!
-      # For "info" drivers off master/release branches, our own status takes precedence: we let this
-      # step pass so the job is reported as passing regardless of the real outcome (still uploaded).
-      # On master and release branches, info status is ignored and the real outcome gates the job.
+      # 1. This step must always run because it controls job's exit code.
+      # 2. There's no point in running this outside the organization
+      # 3. For "info" drivers off master/release branches, our own status takes precedence: we let this
+      #    step pass so the job is reported as passing regardless of the real outcome (still uploaded).
+      #    On master and release branches, info status is ignored and the real outcome gates the job.
+      if: always() && github.repository_owner == 'metabase'
       continue-on-error: ${{ inputs.driver-status == 'info' && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
       uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
       env:

.github/file-paths.yaml

@@ -7,10 +7,6 @@ default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
 
-actionlint:
-  - ".github/workflows/*.yml"
-  - ".github/workflows/*.yaml"
-
 shared_sources: &shared_sources
   - "src/**/*.cljc"
   - "src/**/*.cljs"

.github/scripts/setup-python-runner.sh

@@ -19,8 +19,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git --branch seccomp python-runner
-
+git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
 
 if [ "$SKIP_START" = false ]; then
   echo "Starting python-runner..."

.github/team.json

@@ -93,8 +93,7 @@
         "deniskaber",
         "andsalves",
         "kevinkelleher12",
-        "AndreyChernykh",
-        "bowbahdoe"
+        "AndreyChernykh"
       ]
     },
     {

.github/workflows/actionlint.yml

@@ -1,42 +0,0 @@
-name: Actionlint
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-    paths:
-      - '.github/workflows/**'
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  actionlint:
-    name: Lint Github Actions Workflows
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get changed Github actions
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-          list-files: shell
-      - name: Setup actionlint
-        id: download
-        shell: bash
-        run: |
-          if command -v actionlint; then
-            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
-          else
-            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
-            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
-          fi
-      - name: Run actionlint
-        run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/app-db.yml

@@ -76,7 +76,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -120,7 +120,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -132,7 +131,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -193,7 +191,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -245,7 +243,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -257,7 +254,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -311,7 +307,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -357,7 +353,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -369,7 +364,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend.yml

@@ -45,7 +45,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
+    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -121,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [25]
+        java-version: [21]
         job:
           - name: Enterprise Tests
             edition: ee
@@ -167,7 +167,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -197,31 +197,35 @@ jobs:
           clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
           :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           ${{ matrix.job.test-args }}
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
         continue-on-error: true
 
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
-        # This step should NEVER fail the job!
+        # Positioned between the test run and "Upload Test Results" so it reads
+        # pristine JUnit (before Trunk quarantine processing). Gated to non-clean
+        # runs + continue-on-error so it can never change the job outcome — Trunk
+        # Quarantine remains the sole arbiter. See DEV-2224 / DEV-2235.
+        if: ${{ always() && steps.run-java-tests.outcome != 'success' }}
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
         with:
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
           adapter: backend
 
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+      - name: Quarantine gate (dry run)
+        if: ${{ always() && steps.run-java-tests.outcome != 'success' }}
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: backend
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always()
+        if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
         with:
           input-path: ./target/junit/
           output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
@@ -230,7 +234,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-java-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
@@ -259,7 +262,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [25]
+        java-version: [21]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v6

.github/workflows/build-static-viz-quickjs.yml

@@ -0,0 +1,44 @@
+name: Build static-viz QuickJS library
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+    paths:
+      - "native/static-viz-quickjs/**"
+      - ".github/workflows/build-static-viz-quickjs.yml"
+  pull_request:
+    paths:
+      - "native/static-viz-quickjs/**"
+      - ".github/workflows/build-static-viz-quickjs.yml"
+
+jobs:
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - platform: linux-amd64
+            runner: ubuntu-latest
+            lib: libstaticviz.so
+          - platform: linux-arm64
+            runner: ubuntu-24.04-arm
+            lib: libstaticviz.so
+          - platform: macos-arm64
+            runner: macos-latest
+            lib: libstaticviz.dylib
+          - platform: macos-amd64
+            runner: macos-15-intel
+            lib: libstaticviz.dylib
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build and smoke-test library
+        run: ./native/static-viz-quickjs/build.sh
+      - name: Upload library
+        uses: actions/upload-artifact@v4
+        with:
+          name: static-viz-quickjs-${{ matrix.platform }}
+          path: resources/static-viz-quickjs/${{ matrix.platform }}/${{ matrix.lib }}
+          if-no-files-found: error

.github/workflows/bundle-size-stats.yml

@@ -26,7 +26,7 @@ jobs:
       # Only record a data point when a bundle's as-served size (brotli where the
       # build ships .br, else gzip) moved by at least this percent vs the last
       # plotted point, keeping the chart to real changes.
-      MIN_DELTA_PERCENT: "0.5"
+      MIN_DELTA_PERCENT: "1"
     steps:
       - name: Check out the code
         uses: actions/checkout@v6

.github/workflows/docs-generate-63.yml

@@ -1,22 +0,0 @@
-name: Auto-update documentation (release)
-
-on:
-  schedule:
-    - cron: "0 23 * * 1-5" # Every Monday through Friday at 11 PM UTC
-  workflow_dispatch:
-    inputs:
-      target_branch:
-        description: "Target branch for documentation update"
-        required: false
-        default: "release-x.63.x"
-        type: string
-
-jobs:
-  update-release-docs:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    name: Call documentation update for release branch
-    uses: ./.github/workflows/docs-generate-base.yml
-    with:
-      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
-    secrets:
-      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers.yml

@@ -46,7 +46,6 @@ jobs:
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
       # Per-driver configured status from ci-test-config (skip | info | required)
-      h2-status: ${{ steps.driver-decisions.outputs.h2-status }}
       athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
       bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
       clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
@@ -57,7 +56,6 @@ jobs:
       mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
       mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
       oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
-      postgres-status: ${{ steps.driver-decisions.outputs.postgres-status }}
       presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
       redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
       snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
@@ -138,7 +136,7 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
+          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}
         shell: bash
 
   be-tests-athena-ee:
@@ -179,8 +177,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -194,7 +190,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -258,8 +253,6 @@ jobs:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -273,7 +266,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -346,8 +338,6 @@ jobs:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -359,8 +349,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -404,8 +392,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -417,8 +403,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
@@ -479,8 +463,6 @@ jobs:
       with:
         junit-name: 'be-tests-databricks-ee'
         test-args: ${{ matrix.job.test-args }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -494,7 +476,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
@@ -556,8 +537,6 @@ jobs:
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
         test-args: ${{ matrix.job.test-args }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -571,7 +550,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -591,8 +569,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -604,8 +580,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -626,8 +600,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -639,8 +611,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -703,7 +673,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -760,8 +730,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -773,8 +741,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -844,8 +810,6 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -857,8 +821,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -930,8 +892,6 @@ jobs:
           test-args: >-
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -943,8 +903,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
@@ -979,8 +937,6 @@ jobs:
         junit-name: 'be-tests-mongo-sharded-cluster-ee'
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -992,8 +948,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-oracle:
     needs: determine-driver-skips
@@ -1068,8 +1022,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1081,8 +1033,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -1125,7 +1075,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
+              startsWith(github.ref_name, 'release-')
             ) &&
             ''
           ) ||
@@ -1176,8 +1126,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -1189,9 +1137,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
-          report-variant: ${{ matrix.version.name }}-${{ matrix.job.name }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1268,8 +1213,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1281,8 +1224,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
@@ -1356,8 +1297,6 @@ jobs:
         test-args: >-
           ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: ${{ !matrix.job.skip && !cancelled() }}
@@ -1371,7 +1310,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1391,11 +1329,8 @@ jobs:
           - name: Driver Tests
             test-args: >-
               :only-tags [:mb/driver-tests]
-              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
-          - name: Upload Tests
-            test-args: >-
-              :only-tags [:mb/upload-tests]
           - name: Transforms Python Tests
             test-args: >-
               :only-tags [:mb/transforms-python-test]
@@ -1444,8 +1379,6 @@ jobs:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1459,7 +1392,6 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
         report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1501,8 +1433,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1514,8 +1444,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
@@ -1546,8 +1474,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1559,8 +1485,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1626,8 +1550,6 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.version.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1639,8 +1561,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1755,8 +1675,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1768,8 +1686,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   drivers-tests-result:
     needs:
@@ -1823,13 +1739,11 @@ jobs:
               "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
               "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
               "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
-              "be-tests-h2": "${{ needs.determine-driver-skips.outputs.h2-status }}",
               "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
               "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
               "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
               "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
               "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
-              "be-tests-postgres": "${{ needs.determine-driver-skips.outputs.postgres-status }}",
               "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
               "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
               "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",

.github/workflows/e2e-matrix-builder.yml

@@ -46,7 +46,7 @@ jobs:
             const { buildMatrix } = require('${{ github.workspace }}/.github/scripts/build-e2e-matrix.js');
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
-            const java = 25;
+            const java = 21;
             const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,

.github/workflows/e2e-test.yml

@@ -164,7 +164,9 @@ jobs:
           node e2e/runner/run_cypress_ci.js e2e \
             --expose grepTags="-@mongo+-@python+-@OSS+-@skip" \
             --spec "$SPEC_PATH"
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
@@ -179,7 +181,9 @@ jobs:
           node e2e/runner/run_cypress_ci.js e2e \
           --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@mongo+-@python+-@OSS+-@skip'}}" \
           --spec "$SPEC_PATH"
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
         continue-on-error: true
 
       - name: Rewrite JUnit hook failures
@@ -209,18 +213,17 @@ jobs:
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
-      - name: Quarantine gate
-        # Only one of the two run steps executes; the other reports `skipped`. Only gate on actual failure.
-        if: ${{ !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure') }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+      - name: Quarantine gate (dry run)
+        # always(), unlike backend/frontend: the run step is continue-on-error
+        # (Trunk governs its outcome), so its result can't gate on real failures.
+        if: always()
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: e2e
           test-suite: e2e
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7

.github/workflows/embedding-sdk-component-tests.yml

@@ -95,8 +95,6 @@ jobs:
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
-        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -122,21 +120,19 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+      - name: Quarantine gate (dry run)
+        if: always()
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: e2e
           test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        if: failure()
         with:
           name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
           path: |
@@ -145,7 +141,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: "SDK component tests > Publish Summary"
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        if: failure()
         uses: actions/github-script@v9
         with:
           script: | #js
@@ -277,8 +273,6 @@ jobs:
         run: |
           node e2e/runner/run_cypress_ci.js component \
             --expose grepTags="-@skip-backward-compatibility"
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
-        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -304,21 +298,19 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+      - name: Quarantine gate (dry run)
+        if: always()
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: e2e
           test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        if: failure()
         with:
           name: cypress-recording-embedding-sdk-cross-version
           path: |
@@ -327,7 +319,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Publish Summary
-        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        if: failure()
         uses: actions/github-script@v9
         with:
           script: | #js

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -10,6 +10,11 @@ env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
   MB_EDITION: ee
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  REPO_ID: ${{ github.event.repository.id }}
+  COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
 jobs:
   get-sample-apps-data:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -98,6 +103,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-sample-app
       MB_EDITION: ee
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
@@ -209,6 +215,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-sample-app-shoppy-e2e-tests-${{ matrix.environment }}-bundle
     env:
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-shoppy
       MB_EDITION: ee
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
@@ -276,6 +283,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-shoppy-synthetic-monitoring-tests
     env:
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-shoppy-synthetic
       MB_EDITION: ee
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
@@ -369,19 +377,8 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
-      # Host apps are the only suite here running through Metabase's Cypress config,
-      # whose `after:spec` hook reports failures and writes QUARANTINE_FAILURES_FILE.
-      # Sample-app suites load their own config (no-op), so ci-conductor is scoped to this job.
-      CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
-      CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
       CI_CONDUCTOR_TEST_SUITE: embedding-sdk-host-app
-      REPO_ID: ${{ github.event.repository.id }}
-      COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-      TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
       QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
-      # `Fail job if tests failed` is the arbiter until ci-conductor takes over.
-      # Exactly one of the two gates the job.
-      CI_CONDUCTOR_QUARANTINE_ACTIVE: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -437,24 +434,23 @@ jobs:
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
+        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-host-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./cypress
           if-no-files-found: ignore
 
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
-        continue-on-error: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
+      - name: Quarantine gate (dry run)
+        if: always()
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: e2e
           test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
-          enforce-quarantine: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE }}
 
       - name: Fail job if tests failed
-        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' && env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
+        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
         run: |
           exit 1

.github/workflows/frontend.yml

@@ -110,25 +110,29 @@ jobs:
       - name: Run frontend unit tests
         id: fe-tests
         run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
-        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        # Trunk Quarantine controls the final state of the run in the CI!
+        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
+        # whether to fail or to pass the whole job, based on the quarantine list.
         continue-on-error: true
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
-        # This step should NEVER fail the job!
+        # Positioned between the test run and "Upload Test Results" so it reads
+        # pristine JUnit (before Trunk quarantine processing). Gated to non-clean
+        # runs + continue-on-error so it can never change the job outcome — Trunk
+        # Quarantine remains the sole arbiter. See DEV-2224 / DEV-2235.
+        if: ${{ always() && steps.fe-tests.outcome != 'success' }}
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
         with:
           test-suite: fe-tests-unit
           adapter: frontend
-      - name: Quarantine gate
-        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
-        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+      - name: Quarantine gate (dry run)
+        if: ${{ always() && steps.fe-tests.outcome != 'success' }}
+        continue-on-error: true
         timeout-minutes: 3
         uses: ./.github/actions/quarantine-gate
         with:
           adapter: frontend
           test-suite: fe-tests-unit
-          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && github.event_name != 'workflow_dispatch'
@@ -140,7 +144,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.fe-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}

.github/workflows/pre-release.yml

@@ -122,7 +122,7 @@ jobs:
     strategy:
       matrix:
         edition: [oss, ee]
-        java-version: [25]
+        java-version: [21]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
         uses: actions/setup-java@v5.2.0

.github/workflows/semantic-search.yml

@@ -34,7 +34,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -61,7 +61,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -73,7 +72,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -95,7 +93,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -136,7 +134,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -148,7 +145,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -170,7 +166,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -211,7 +207,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -223,7 +218,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -245,7 +239,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -287,7 +281,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -299,73 +292,6 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-
-  # pgvector-on-the-app-db mode: the app db itself is a pgvector-capable Postgres and
-  # MB_PGVECTOR_DB_URL is deliberately unset. The dedicated-harness tests gate themselves off; the
-  # appdb-pgvector-mode round trip (and the URL-independent unit tests) run for real.
-  semantic-search-tests-appdb-mode:
-    if: ${{ !inputs.skip }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
-    strategy:
-      fail-fast: false
-      matrix:
-        version:
-          - name: pgvector pg17 as app db, no dedicated pgvector
-            junit-name: semantic-search-tests-appdb-mode-pg17
-            appdb-image: pgvector/pgvector:pg17
-        job:
-          - name: Semantic Search Tests
-            build-static-viz: false
-            test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
-            exclude-tag: ':mb/driver-tests'
-
-    services:
-      postgres:
-        image: ${{ matrix.version.appdb-image }}
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: mb_test
-          POSTGRES_DB: mb_test
-          POSTGRES_HOST_AUTH_METHOD: trust
-    env:
-      CI: 'true'
-      MB_DB_TYPE: postgres
-      MB_DB_PORT: 5432
-      MB_DB_HOST: localhost
-      MB_DB_DBNAME: mb_test
-      MB_DB_USER: mb_test
-      # opts this job into the destructive appdb-pgvector-mode round trip, which then FAILS (rather
-      # than silently skipping) if the app db can't actually host pgvector
-      MB_APPDB_PGVECTOR_MODE_TEST: 'true'
-    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test ${{ matrix.version.name }}
-        id: test-driver
-        uses: ./.github/actions/test-driver
-        with:
-          build-static-viz: ${{ matrix.job.build-static-viz }}
-          junit-name: ${{ matrix.version.junit-name }}
-          test-args: >-
-            ${{ matrix.job.test-args }}
-            :exclude-tags '[${{ matrix.job.exclude-tag }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-result:
     needs:
@@ -373,7 +299,6 @@ jobs:
       - semantic-search-tests-mariadb
       - semantic-search-tests-mysql
       - semantic-search-tests-postgres
-      - semantic-search-tests-appdb-mode
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: semantic-search-tests-result

.github/workflows/snowplow.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
-          java-version: 25
+          java-version: 21
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:

.github/workflows/tag-for-release.yml

@@ -201,7 +201,7 @@ jobs:
       uses: actions/setup-java@v5.2.0
       with:
         distribution: 'temurin'
-        java-version: 25
+        java-version: 21
 
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
       uses: ./.github/actions/fetch-artifact

.github/workflows/team-issues-slack-notification.yml

@@ -1,15 +1,3 @@
-# .github/workflows/team-issues-slack-notification.yml
-#
-# Posts newly team-labeled bugs to the team's Slack channel (e.g.
-# #team-graphy-bugs), now including a link to the synced Linear issue.
-#
-# Changes from the current version:
-# - Checks out .github/scripts so we can reuse find-linear-issue.js
-# - The message-building step now queries Linear (via attachmentsForURL)
-#   with a short retry, and appends "Linear: <link|ID>" when found
-# - Degrades gracefully: if no Linear issue is attached (or the API is
-#   down), the message posts without the Linear issue link
-
 name: Team Issues Slack Notification
 
 on:
@@ -26,58 +14,18 @@ jobs:
        ( contains(github.event.issue.labels.*.name, 'Type:Bug') ||
          contains(github.event.issue.labels.*.name, 'flaky-test-fix') )
     steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: .github/scripts
-
-      - name: Build Slack message (with Linear link if available)
+      - name: Setting title
         uses: actions/github-script@v9
         id: vars
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
         with:
           script: |
-            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
-
-            const title = context.payload.issue.title;
-            const issueUrl = context.payload.issue.html_url;
-
-            let text = title + '\n' + issueUrl;
-
-            // The Linear issue is usually already synced by the time the
-            // team label lands at triage, but retry briefly just in case.
-            try {
-              const delaysSeconds = [0, 15, 30];
-              let result = null;
-
-              for (const delay of delaysSeconds) {
-                if (delay) await new Promise((r) => setTimeout(r, delay * 1000));
-                result = await findLinearIssue({
-                  githubIssueUrl: issueUrl,
-                  linearApiKey: process.env.LINEAR_API_KEY,
-                });
-                if (result.success) break;
-              }
-
-              if (result && result.success) {
-                const id = result.issue; // e.g. "GIT-1234"
-                text += `\nLinear: <https://linear.app/metabase/issue/${id}|${id}>`;
-              } else {
-                core.info(`No Linear issue found for ${issueUrl}; posting without link.`);
-              }
-            } catch (e) {
-              // Never block the notification on a Linear lookup failure
-              core.warning(`Linear lookup failed: ${e.message}`);
-            }
-
-            core.setOutput('message', JSON.stringify(text));
-
+            core.setOutput('issue_title', JSON.stringify(${{ toJson(github.event.issue.title) }} + '\n' + ${{ toJson(github.event.issue.html_url) }}));
       - name: Extracting team name
         id: team_name
         env:
           LABEL_NAME: ${{ github.event.label.name }}
         run: |
-          team_label="${LABEL_NAME//&/$}"
+          team_label=$(sed 's/&/\$/g' <<< "$LABEL_NAME")
           echo "$team_label"
           team_name=${team_label#*.Team/}
           echo "$team_name"
@@ -107,7 +55,7 @@ jobs:
                   "type": "section",
                   "text": {
                     "type": "mrkdwn",
-                    "text": ${{ steps.vars.outputs.message }}
+                    "text": ${{ steps.vars.outputs.issue_title }}
                   }
                 }
               ]

.github/workflows/uberjar.yml

@@ -143,7 +143,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 25 }}"
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
       - name: Build
         run: ./bin/build.sh
       - name: Upload bundle stats
@@ -174,7 +174,7 @@ jobs:
     strategy:
       matrix:
         edition: ["ee", "oss"]
-        java-version: [25]
+        java-version: [21]
     steps:
       - name: Check out the code
         uses: actions/checkout@v6

.gitignore

@@ -83,6 +83,8 @@ cypress.env.json
 /resources/frontend_client/app/**/*.hot-update.js
 /resources/frontend_client/app/**/*.hot-update.json
 /resources/frontend_client/app/dist/
+/resources/static-viz-quickjs/
+/native/static-viz-quickjs/build/
 /resources/frontend_client/app/locales
 /resources/frontend_client/app/embed.js
 /resources/frontend_client/app/embedding-sdk.js
@@ -190,10 +192,8 @@ CLAUDE.local.md
 /logs
 /.clojure-mcp
 
-# Python dependencies (pip-installed, not committed)
-/resources/python-sources/sqlglot/
-/resources/python-sources/sqlglot-*.dist-info/
-/resources/python-sources/.lock
+# polyglot-sql-ffi native libraries (downloaded, not committed)
+/resources/polyglot-sql-ffi/*/
 __pycache__/
 .mcp.json
 .config/wt.toml
@@ -204,4 +204,3 @@ __pycache__/
 
 # dependency-cruiser output
 dependency-graph.json
-.playwright-cli/

CLAUDE.md

@@ -58,25 +58,6 @@ For module-scoped runs — useful when validating a branch's blast radius — pa
 
 Once again, do not use `clj -X:dev:test` directly — its progress-bar output is hard to parse.
 
-## Module Boundaries
-
-The linter config at `.clj-kondo/config/modules/config.edn` records each module's `:api`, `:uses`,
-`:model-exports`, and `:model-imports`. `metabase.core.modules-test` fails when it drifts from the source.
-
-After **any** backend change that could shift module boundaries, regenerate it:
-
-```bash
-./bin/mage fix-modules-config
-```
-
-Changes that shift boundaries include: adding/removing/renaming a `src` namespace, adding or dropping a
-cross-module `require` or `:model/X` reference, or creating a new module. When unsure, just run it — it is
-a no-op (exits `unchanged`) when nothing drifted.
-
-It piggybacks on a running dev nREPL (~5s) and auto-spawns a JVM if none is running (~15s). It only edits
-the four generated keys; structural changes it can't safely make (a new module needs a human `:team`, or
-modules need reordering) are printed as `WARNING:` lines for you to resolve by hand.
-
 ## Tool Preferences
 
 If `clojure-mcp` tools are available, prefer them over shell-based alternatives for Clojure development.

Dockerfile

@@ -13,7 +13,7 @@ RUN apt-get update && apt-get upgrade -y && apt-get install wget apt-transport-h
     && wget -qO - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor | tee /etc/apt/trusted.gpg.d/adoptium.gpg > /dev/null \
     && echo "deb https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | tee /etc/apt/sources.list.d/adoptium.list \
     && apt-get update \
-    && apt install temurin-25-jdk -y \
+    && apt install temurin-21-jdk -y \
     && curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh \
     && chmod +x linux-install-1.12.0.1488.sh \
     && ./linux-install-1.12.0.1488.sh \
@@ -41,7 +41,7 @@ RUN INTERACTIVE=false CI=true MB_EDITION=$MB_EDITION bin/build.sh :version ${VER
 ## Remember that this runner image needs to be the same as bin/docker/Dockerfile with the exception that this one grabs the
 ## jar from the previous stage rather than the local build
 
-FROM eclipse-temurin:25-jre-alpine AS runner
+FROM eclipse-temurin:21-jre-alpine AS runner
 
 ENV FC_LANG=en-US LC_CTYPE=en_US.UTF-8
 

bb.edn

@@ -265,15 +265,6 @@
    :requires [[mage.modules]]
    :task (task! (mage.modules/cli-can-skip-driver-tests (:arguments parsed)))}
 
-  fix-modules-config
-  {:doc "Regenerate .clj-kondo/config/modules/config.edn so it passes metabase.core.modules-test."
-   :examples [["./bin/mage fix-modules-config" "Fix the modules config (uses the running dev REPL if available, else a JVM)"]
-              ["./bin/mage fix-modules-config --port 59498" "Use the dev REPL on a specific nREPL port"]]
-   ;; Cold-JVM fallback invokes `clojure -X:dev dev.modules-config/fix-config!`.
-   :options [["-p" "--port PORT" "nREPL port to use, defaults to value in .nrepl-port"]]
-   :requires [[mage.modules]]
-   :task (task! (mage.modules/cli-fix-config (cli/parse! (current-task))))}
-
   ls
   {:doc "List all mage public and private tasks"
    :examples [["./bin/mage ls" "List all tasks"]]

bin/build/src/build.clj

@@ -1,7 +1,7 @@
 (ns build
   (:require
    [build.licenses :as license]
-   [build.python :as build.python]
+   [build.polyglot-ffi :as build.polyglot-ffi]
    [build.uberjar :as uberjar]
    [build.version-properties :as version-properties]
    [clojure.edn :as edn]
@@ -91,8 +91,8 @@
                    (build-licenses! edition))
    #_#_:drivers      (fn [{:keys [edition]}]
                        (build-drivers/build-drivers! edition))
-   :python       (fn [{:keys [edition]}]
-                   (build.python/build-python-deps! edition))
+   :polyglot-ffi (fn [{:keys [edition]}]
+                   (build.polyglot-ffi/download-polyglot-ffi! edition))
    :uberjar      (fn [{:keys [edition]}]
                    (build-uberjar! edition))))
 

bin/build/src/build/polyglot_ffi.clj

@@ -0,0 +1,34 @@
+(ns build.polyglot-ffi
+  "Build step that downloads the polyglot-sql-ffi native library for every supported platform into
+  `resources/polyglot-sql-ffi/`, so the uberjar can load the right one at runtime wherever it
+  runs. The version is pinned by `resources/polyglot-sql-ffi/version.txt`."
+  (:require
+   [clojure.java.io :as io]
+   [environ.core :as env]
+   [metabase.sql-parsing.ffi :as sql-parsing.ffi]
+   [metabuild-common.core :as u]))
+
+(set! *warn-on-reflection* true)
+
+(def ^:private platform->library-file-name
+  {"linux-x86_64"   "libpolyglot_sql_ffi.so"
+   "linux-aarch64"  "libpolyglot_sql_ffi.so"
+   "macos-x86_64"   "libpolyglot_sql_ffi.dylib"
+   "macos-aarch64"  "libpolyglot_sql_ffi.dylib"
+   "windows-x86_64" "polyglot_sql_ffi.dll"})
+
+(defn download-polyglot-ffi!
+  "Download the polyglot-sql-ffi shared library for every platform into `resources` for bundling
+  into the uberjar. Can be skipped by setting SKIP_POLYGLOT_FFI=true."
+  [_edition]
+  (if (= (env/env :skip-polyglot-ffi) "true")
+    (u/announce "Skipping polyglot-sql-ffi libraries (SKIP_POLYGLOT_FFI=true)")
+    (u/step "Download polyglot-sql-ffi native libraries"
+      (doseq [[platform lib-name] (sort platform->library-file-name)
+              :let [target (io/file u/project-root-directory
+                                    "resources" "polyglot-sql-ffi" platform lib-name)]]
+        (if (.exists target)
+          (u/announce "%s already present" (str target))
+          (do
+            (sql-parsing.ffi/download-library! platform lib-name target)
+            (u/announce "Downloaded %s" (str target))))))))

bin/build/src/build/python.clj

@@ -1,38 +0,0 @@
-(ns build.python
-  "Build step to install Python dependencies (sqlglot) for GraalVM Python."
-  (:require
-   [clojure.java.io :as io]
-   [environ.core :as env]
-   [metabuild-common.core :as u]))
-
-(set! *warn-on-reflection* true)
-
-(def ^:private python-sources-dir
-  "Directory where sqlglot and sql_tools.py shim live."
-  (u/filename u/project-root-directory "resources" "python-sources"))
-
-(def ^:private sqlglot-version
-  "Pinned sqlglot version for reproducible builds.
-  Read from pyproject.toml (single source of truth for both dev and build)."
-  (->> (io/file u/project-root-directory "resources/python-sources/pyproject.toml")
-       slurp
-       (re-find #"\"sqlglot==([^\"]+)\"")
-       second))
-
-(defn build-python-deps!
-  "Install sqlglot to resources/python-sources for bundling into uberjar.
-
-  Uses `uv pip install`. The --no-compile flag skips .pyc generation since GraalVM Python
-  uses interpreted mode.
-
-  Can be skipped by setting SKIP_PYTHON_DEPS=true."
-  [_edition]
-  (if (= (env/env :skip-python-deps) "true")
-    (u/announce "Skipping Python dependencies (SKIP_PYTHON_DEPS=true)")
-    (u/step "Install Python dependencies (sqlglot)"
-      (u/create-directory-unless-exists! python-sources-dir)
-      (u/sh {:dir u/project-root-directory}
-            "uv" "pip" "install" "-r" (u/filename python-sources-dir "pyproject.toml")
-            "--target" python-sources-dir
-            "--no-compile")
-      (u/announce "sqlglot %s installed to %s" sqlglot-version python-sources-dir))))

bin/build/src/i18n/common.clj

@@ -55,9 +55,7 @@
      :fuzzy?            (.isFuzzy message)
      :plural?           (.isPlural message)
      :source-references (seq (remove str/blank? (.getSourceReferences message)))
-     ;; the `msgctxt` a message was extracted with (nil when it declares none). Part of a
-     ;; message's identity: the same `msgid` can appear under several contexts.
-     :context           (.getMsgctxt message)}))
+     :comment           (.getMsgctxt message)}))
 
 (defn po-contents
   "Contents of the PO file for a `locale`."

bin/build/src/i18n/create_artifacts/frontend.clj

@@ -22,34 +22,20 @@
   [message-id]
   (str/replace message-id #"\{\s*(\d+)\s*\}" "\\${ $1 }"))
 
-(defn- ->translation-entry [message]
-  [(->ttag-reference (:id message))
-   (if (:plural? message)
-     {:msgid_plural (:id-plural message)
-      :msgstr       (map ->ttag-reference (:str-plural message))}
-     {:msgstr [(->ttag-reference (:str message))]})])
-
-(defn- ->translations-map
-  "ttag looks a translation up by (context, msgid), so the top level of the map is keyed by the
-  message's `msgctxt` — `\"\"` for the messages that declare none.
-
-  Two messages may share a `msgid` as long as their contexts differ, e.g. `Year` exists both as a
-  pluralized unit (`ngettext(\"Year\", \"Years\", n)`) and as a granularity option
-  (``c(\"Date granularity option\").t`Year` ``). Keying by `msgid` alone collapsed them onto one
-  entry, so the last one won and the other's translation was lost — including, for the pair above,
-  the plural form that `ngettext` then failed to find."
-  [messages drop-msgids]
-  (let [frontend-messages (into []
-                                (comp
-                                 ;; filter out i18n messages that aren't used on the FE client
-                                 (filter frontend-message?)
-                                 (remove (fn [{:keys [id]}] (contains? drop-msgids id)))
-                                 i18n/print-message-count-xform)
-                                messages)]
-    (into {}
-          (map (fn [[context messages]]
-                 [context (into {} (map ->translation-entry) messages)]))
-          (group-by #(or (:context %) "") frontend-messages))))
+(defn- ->translations-map [messages drop-msgids]
+  {"" (into {}
+            (comp
+             ;; filter out i18n messages that aren't used on the FE client
+             (filter frontend-message?)
+             (remove (fn [{:keys [id]}] (contains? drop-msgids id)))
+             i18n/print-message-count-xform
+             (map (fn [message]
+                    [(->ttag-reference (:id message))
+                     (if (:plural? message)
+                       {:msgid_plural (:id-plural message)
+                        :msgstr       (map ->ttag-reference (:str-plural message))}
+                       {:msgstr [(->ttag-reference (:str message))]})])))
+            messages)})
 
 (defn- ->i18n-map
   "Convert the contents of a `.po` file to map format used in the frontend client."

bin/build/test/i18n/create_artifacts/frontend_test.clj

@@ -36,21 +36,5 @@
                           {:msgstr ["Average of ${ 0 }"]}
 
                           "Median of ${ 0 }"
-                          {:msgstr ["Median of ${ 0 }"]}
-
-                          "Year"
-                          {:msgid_plural "Years"
-                           :msgstr       ["Año" "Años"]}}
-
-                         "Date granularity option, distinct from the pluralized unit"
-                         {"Year"
-                          {:msgstr ["Año"]}}}}
-         (#'frontend/->i18n-map test-common/po-contents #{})))
-  (testing "a msgid that exists under several contexts keeps one entry per context, so neither
-  translation (nor a plural form) is lost"
-    (let [{translations :translations} (#'frontend/->i18n-map test-common/po-contents #{})]
-      (is (= {:msgid_plural "Years", :msgstr ["Año" "Años"]}
-             (get-in translations ["" "Year"])))
-      (is (= {:msgstr ["Año"]}
-             (get-in translations ["Date granularity option, distinct from the pluralized unit"
-                                   "Year"]))))))
+                          {:msgstr ["Median of ${ 0 }"]}}}}
+         (#'frontend/->i18n-map test-common/po-contents #{}))))

bin/build/test/i18n/create_artifacts/test_common.clj

@@ -8,7 +8,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["frontend/src/metabase/admin/datamodel/components/database/MetadataTable.jsx:136"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private singular-message-backend
   {:id                "No table description yet"
@@ -18,7 +18,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["metabase/warehouse_schema/models/table.clj"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private singular-template-message-frontend
   {:id                "Count of {0}"
@@ -28,7 +28,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["frontend/src/metabase/reference/databases/TableDetail.jsx:38"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private singular-template-message-backend
   {:id                "Count of {0}"
@@ -38,7 +38,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["src/metabase/warehouse_schema/models/table.clj:80"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private plural-message-frontend
   {:id                "{0} Queryable Table"
@@ -48,7 +48,7 @@
    :fuzzy?            false
    :plural?           true
    :source-references ["frontend/src/metabase/admin/datamodel/components/database/MetadataTableList.jsx:77"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private plural-message-backend
   {:id               "{0} table"
@@ -58,7 +58,7 @@
    :fuzzy?            false
    :plural?           true
    :source-references ["src/metabase/automagic_dashboards/core.clj"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private plural-message-frontend-with-empty
   {:id                "{0} metric"
@@ -68,7 +68,7 @@
    :fuzzy?            false
    :plural?           true
    :source-references ["frontend/src/metabase/query_builder/components/view/QuestionDescription.jsx:20"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private plural-message-backend-with-empty
   {:id                "{0} metric"
@@ -78,7 +78,7 @@
    :fuzzy?            false
    :plural?           true
    :source-references ["src/metabase/automagic_dashboards/core.clj"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private cljc-message
   {:id                "Average of {0}"
@@ -88,7 +88,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["src/metabase/utils/aggregation.cljc"]
-   :context           nil})
+   :comment           nil})
 
 (def ^:private cljs-message
   {:id                "Median of {0}"
@@ -98,29 +98,7 @@
    :fuzzy?            false
    :plural?           false
    :source-references ["src/metabase/utils/aggregation.cljs"]
-   :context           nil})
-
-;; The same `msgid` under two different contexts — a pluralized unit and a granularity option.
-;; They are separate messages, and collapsing them onto one entry loses a translation.
-(def ^:private plural-message-frontend-no-context
-  {:id                "Year"
-   :id-plural         "Years"
-   :str               nil
-   :str-plural        ["Año" "Años"]
-   :fuzzy?            false
-   :plural?           true
-   :source-references ["frontend/src/metabase/querying/utils.ts:41"]
-   :context           nil})
-
-(def ^:private singular-message-frontend-with-context
-  {:id                "Year"
-   :id-plural         nil
-   :str               "Año"
-   :str-plural        nil
-   :fuzzy?            false
-   :plural?           false
-   :source-references ["frontend/src/metabase/visualizations/SmartScalar/definition.ts:127"]
-   :context           "Date granularity option, distinct from the pluralized unit"})
+   :comment           nil})
 
 (def ^:private messages
   [singular-message-frontend
@@ -132,9 +110,7 @@
    plural-message-backend
    plural-message-backend-with-empty
    cljc-message
-   cljs-message
-   plural-message-frontend-no-context
-   singular-message-frontend-with-context])
+   cljs-message])
 
 (def po-contents
   "Contents of a `.po` file."

bin/check-migration-versions

@@ -40,7 +40,7 @@ elif [[ "$BASE_REF" == "master" ]]; then
     echo "CURRENT_VERSION: ${CURRENT_VERSION}"
 
     matches=0
-    for l in backport single-backport double-backport triple-backport; do
+    for l in backport double-backport triple-backport; do
         if [[ ",$labels," == *",$l,"* ]]; then
             # N.B. not ((matches++)) — that exits 1 when matches=0 under set -e
             matches=$((matches + 1))
@@ -51,7 +51,6 @@ elif [[ "$BASE_REF" == "master" ]]; then
     version=$((CURRENT_VERSION + 1))
     # Backport labels shift the target version back so migrations land on the correct release branch.
     [[ ",$labels," == *",backport,"* ]]        && version=$((CURRENT_VERSION))
-    [[ ",$labels," == *",single-backport,"* ]] && version=$((CURRENT_VERSION))
     [[ ",$labels," == *",double-backport,"* ]] && version=$((CURRENT_VERSION - 1))
     [[ ",$labels," == *",triple-backport,"* ]] && version=$((CURRENT_VERSION - 2))
 
@@ -105,7 +104,7 @@ if [[ "$errors" -gt 0 ]]; then
     fi
     echo "" >&2
     echo "If this PR will be backported, ensure the correct backport label is applied" >&2
-    echo "(backport, single-backport, double-backport, or triple-backport) and re-run CI, even if you" >&2
+    echo "(backport, double-backport, or triple-backport) and re-run CI, even if you" >&2
     echo "plan to create the backport PRs manually. Base the label on the oldest" >&2
     echo "release you're targeting, and simply close any unwanted PRs." >&2
     echo "" >&2

bin/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:25-jre-alpine
+FROM eclipse-temurin:21-jre-alpine
 
 ENV FC_LANG=en-US LC_CTYPE=en_US.UTF-8
 

bin/docker/Dockerfile_ubuntu

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:25-jre-noble as runner
+FROM eclipse-temurin:21-jre-noble as runner
 
 ENV FC_LANG=en-US LC_CTYPE=en_US.UTF-8
 

bin/docker/run_metabase.sh

@@ -11,9 +11,6 @@ JAVA_OPTS="${JAVA_OPTS} -Dlogfile.path=target/log"
 JAVA_OPTS="${JAVA_OPTS} -XX:+CrashOnOutOfMemoryError"
 JAVA_OPTS="${JAVA_OPTS} -server"
 JAVA_OPTS="${JAVA_OPTS} --add-opens java.base/java.nio=ALL-UNNAMED"
-# Truffle (GraalJS/GraalPy) loads a native library; JDK 25+ warns and future JDKs
-# will block it unless native access is enabled
-JAVA_OPTS="${JAVA_OPTS} --enable-native-access=ALL-UNNAMED"
 
 if [ ! -z "$JAVA_TIMEZONE" ]; then
     JAVA_OPTS="${JAVA_OPTS} -Duser.timezone=${JAVA_TIMEZONE}"

bun.lock

@@ -30,6 +30,11 @@
         "@emotion/styled": "^11.11.0",
         "@floating-ui/dom": "^1.7.4",
         "@floating-ui/react": "^0.27.16",
+        "@formatjs/intl-datetimeformat": "^7.4.9",
+        "@formatjs/intl-getcanonicallocales": "^3.2.10",
+        "@formatjs/intl-locale": "^5.3.9",
+        "@formatjs/intl-numberformat": "^9.3.11",
+        "@formatjs/intl-pluralrules": "^6.3.10",
         "@juggle/resize-observer": "^3.4.0",
         "@lezer/highlight": "^1.2.1",
         "@lezer/lr": "^1.4.2",
@@ -68,6 +73,7 @@
         "@tiptap/suggestion": "^3.2.0",
         "@types/js-yaml": "^4.0.9",
         "@types/react-router": "3.0.27",
+        "@types/redux-auth-wrapper": "2.0.16",
         "@uiw/react-codemirror": "^4.23.6",
         "@visx/axis": "^3.10.1",
         "@visx/clip-path": "^3.3.0",
@@ -110,7 +116,7 @@
         "inflection": "^1.7.1",
         "inquirer-toggle": "^1.0.1",
         "js-cookie": "3.0.7",
-        "js-yaml": "^4.3.0",
+        "js-yaml": "^4.2.0",
         "json5": "^2.2.2",
         "jspdf": "^4.2.1",
         "kbar": "0.1.0-beta.45",
@@ -142,14 +148,15 @@
         "react-innertext": "^1.1.5",
         "react-is": "^18.2.0",
         "react-markdown": "^9.0.0",
-        "react-qr-code": "^2.0.15",
         "react-redux": "^9.1.2",
         "react-resizable": "^3.1.3",
         "react-router": "3",
+        "react-router-redux": "^4.0.8",
         "react-transition-group": "^4.4.5",
         "react-use": "^17.5.1",
         "react-virtualized": "9.22.6",
         "redux-actions": "^2.0.1",
+        "redux-auth-wrapper": "2.1.0",
         "redux-undo": "^1.1.0",
         "rehype-external-links": "^3.0.0",
         "remark-gfm": "^4.0.0",
@@ -164,8 +171,7 @@
         "tinykeys": "^3.0.0",
         "ts-pattern": "^5.9.0",
         "ttag": "1.7.21",
-        "typescript": "6.0.3",
-        "typescript7": "npm:typescript@7.0.2",
+        "typescript": "^6.0.3",
         "underscore": "^1.13.8",
         "url": "^0.11.4",
         "use-sync-external-store": "^1.6.0",
@@ -268,6 +274,7 @@
         "@types/react-grid-layout": "^1.3.5",
         "@types/react-is": "^18.2.4",
         "@types/react-resizable": "^3.0.4",
+        "@types/react-router-redux": "^4.0.53",
         "@types/react-textarea-autosize": "^4.3.6",
         "@types/react-transition-group": "^4.4.5",
         "@types/react-virtualized": "^9.22.2",
@@ -358,7 +365,6 @@
         "open": "^10.1.0",
         "open-cli": "^8.0.0",
         "openapi-typescript": "^7.10.0",
-        "otpauth": "^9.5.1",
         "oxfmt": "^0.38.0",
         "patch-package": "^8.0.1",
         "pg": "^8.8.0",
@@ -442,8 +448,6 @@
     "follow-redirects": "^1.16.0",
     "form-data": "4.0.6",
     "js-cookie": "^3.0.7",
-    "js-yaml": "^4.3.0",
-    "linkify-it": "^5.0.2",
     "lodash": "^4.18.1",
     "lodash-es": "^4.18.1",
     "markdown-it": "^14.2.0",
@@ -453,7 +457,6 @@
     "prosemirror-state": "^1.4.4",
     "prosemirror-view": "^1.40.1",
     "qs": "6.15.2",
-    "redux": "5.0.1",
     "webpack": "5.105.0",
     "webpack-dev-middleware": "^5.3.4",
     "webpack-dev-server": "^5.2.1",
@@ -1011,6 +1014,24 @@
 
     "@floating-ui/utils": ["@floating-ui/utils@0.2.10", "", {}, "sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ=="],
 
+    "@formatjs/bigdecimal": ["@formatjs/bigdecimal@0.2.6", "", {}, "sha512-aPzKsGQOkQRHUEbyO/ZtYfr4EqaBQnSs6U4tzTla1xBnIdEHgY2GqEqso28UMwWRkzKqqTj5+/6BmuOsRkfn2A=="],
+
+    "@formatjs/fast-memoize": ["@formatjs/fast-memoize@3.1.6", "", {}, "sha512-H5aexk1Le7T9TPmscacZ+1pR6CTa2n1wq+HDVGXhH8TzUlQQpeXzZs91dRtmFHrbeNbjPFPfQujUqm7MHgVoXQ=="],
+
+    "@formatjs/intl-datetimeformat": ["@formatjs/intl-datetimeformat@7.4.9", "", { "dependencies": { "@formatjs/bigdecimal": "0.2.6", "@formatjs/intl-localematcher": "0.8.10" } }, "sha512-dpGGhYrAq+3X0ME9V161qCgQcaY1IGhKUR6y58mep53qd3sg86ai+WkjlLbP0Hr2TFpPU9Z+i4oCxh1RUvW6mA=="],
+
+    "@formatjs/intl-getcanonicallocales": ["@formatjs/intl-getcanonicallocales@3.2.10", "", {}, "sha512-iH9faynSJ7EO8h7VgMfkjGBMUvmmalyio2dTqB2tSSi8UZuWWfHmeQ/RT+Ztl/SUdrN5tm0SO3218uLQIkCGXw=="],
+
+    "@formatjs/intl-locale": ["@formatjs/intl-locale@5.3.9", "", { "dependencies": { "@formatjs/intl-getcanonicallocales": "3.2.10", "@formatjs/intl-supportedvaluesof": "2.3.8" } }, "sha512-h8xk+FFg0R9jZmX2r+75BglH5Bd++7pnCn5veN4Fv9a+E6TiYgD0QnYXbYOzOskLPKaTnFrUFkQ7OYJUasuONw=="],
+
+    "@formatjs/intl-localematcher": ["@formatjs/intl-localematcher@0.8.10", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.6" } }, "sha512-P/IC3qws3jH+1fEs+o0RIFgXKRaQlFehjS5W0FPAqdo6hgzawLl+eD0q0JjheQ3XtoOe5n8WSYfX06KQZI/QJA=="],
+
+    "@formatjs/intl-numberformat": ["@formatjs/intl-numberformat@9.3.11", "", { "dependencies": { "@formatjs/bigdecimal": "0.2.6", "@formatjs/intl-localematcher": "0.8.10" } }, "sha512-AF7I2OIV/kSTvUBBV5nnP+SBA71DiSRcK5O9buEcHohqcg5ZhAcWmLf9FCpMya/saHahi2E0IOS2oSP+keRP5g=="],
+
+    "@formatjs/intl-pluralrules": ["@formatjs/intl-pluralrules@6.3.10", "", { "dependencies": { "@formatjs/bigdecimal": "0.2.6", "@formatjs/intl-localematcher": "0.8.10" } }, "sha512-pMoqKYhsfz2ostOQsh/5e66EJPiYWzy4yO7k9zcBLfw0pgOf15TRDYaT6lPghqUe9gdEEfP74QL7u6gwomxCTg=="],
+
+    "@formatjs/intl-supportedvaluesof": ["@formatjs/intl-supportedvaluesof@2.3.8", "", { "dependencies": { "@formatjs/fast-memoize": "3.1.6" } }, "sha512-webY7Ylc4CRRgxXFxZ4yRIr+9SKZyMLh+Hrsim4vG3HKSpD+T7d9XXvTdd6UDILyXf7BsqAa8l5/Nn2eENWCqw=="],
+
     "@gerrit0/mini-shiki": ["@gerrit0/mini-shiki@3.23.0", "", { "dependencies": { "@shikijs/engine-oniguruma": "^3.23.0", "@shikijs/langs": "^3.23.0", "@shikijs/themes": "^3.23.0", "@shikijs/types": "^3.23.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-bEMORlG0cqdjVyCEuU0cDQbORWX+kYCeo0kV1lbxF5bt4r7SID2l9bqsxJEM0zndaxpOUT7riCyIVEuqq/Ynxg=="],
 
     "@hey-api/codegen-core": ["@hey-api/codegen-core@0.8.2", "", { "dependencies": { "@hey-api/types": "0.1.4", "ansi-colors": "4.1.3", "c12": "3.3.4", "color-support": "1.1.3" } }, "sha512-R2NMf3wq97rh1mjz33WJQU8svz3F0RYUjvx/QzXucjpSqQ3O5huTdDjErG4fMxSr1X+X56NuDrqtGfHmo1TRUQ=="],
@@ -1233,7 +1254,7 @@
 
     "@nicolo-ribaudo/eslint-scope-5-internals": ["@nicolo-ribaudo/eslint-scope-5-internals@5.1.1-v1", "", { "dependencies": { "eslint-scope": "5.1.1" } }, "sha512-54/JRvkLIzzDWshCWfuhadfrfZVPiElY8Fcgmg1HroEly/EDSszzhBAsarCux+D/kOslTRquNzuyGSmUSTTHGg=="],
 
-    "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
+    "@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
 
     "@nodable/entities": ["@nodable/entities@2.1.0", "", {}, "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA=="],
 
@@ -1971,6 +1992,8 @@
 
     "@types/react-router": ["@types/react-router@3.0.27", "", { "dependencies": { "@types/history": "^3", "@types/react": "*" } }, "sha512-Sq4bfTZ8TuHFTHXyzA3tu/BTGm/d4B8CwtOK4qOyJNoJMkY87qMOazkBizMHNpszVR1+kYOCNLjPdh/wAD7ESw=="],
 
+    "@types/react-router-redux": ["@types/react-router-redux@4.0.55", "", { "dependencies": { "@types/history": "^3.2.5", "redux": "^3.6.0" } }, "sha512-2fbxIc9OTmVyOUgBnRa3gcbMJT035Scu1bmkYMEiv7IzMht24W+gGzIrlYurSz3cijY4r9d16O/0+nycZ0RXjg=="],
+
     "@types/react-textarea-autosize": ["@types/react-textarea-autosize@4.3.6", "", { "dependencies": { "@types/react": "*" } }, "sha512-cTf8tCem0c8A7CERYbTuF+bRFaqYu7N7HLCa6ZhUhDx8XnUsTpGx5udMWljt87JpciUKuUkImKPEsy6kcKhrcQ=="],
 
     "@types/react-transition-group": ["@types/react-transition-group@4.4.5", "", { "dependencies": { "@types/react": "*" } }, "sha512-juKD/eiSM3/xZYzjuzH6ZwpP+/lejltmiS3QEzV/vmb/Q8+HfDmxu+Baga8UEMGBqV88Nbg4l2hY/K2DkyaLLA=="],
@@ -1981,6 +2004,8 @@
 
     "@types/redux-actions": ["@types/redux-actions@2.6.5", "", {}, "sha512-RgXOigay5cNweP+xH1ru+Vaaj1xXYLpWIfSVO8cSA8Ii2xvR+HRfWYdLe1UVOA8X0kIklalGOa0DTDyld0obkg=="],
 
+    "@types/redux-auth-wrapper": ["@types/redux-auth-wrapper@2.0.16", "", { "dependencies": { "@types/history": "^4.7.11", "@types/react": "*", "redux": "^3.7.2" } }, "sha512-Uj3IFMqVD4e9aCiBPrw+Ix5msJvWlrjRAVa1iV529zNzEYhdtLfVq9/tM4K9yZWMRjLFqXbTam2qz2bgnklrSA=="],
+
     "@types/resolve": ["@types/resolve@1.20.6", "", {}, "sha512-A4STmOXPhMUtHH+S6ymgE2GiBSMqf4oTvcQZMcHzokuTLVYzXTB8ttjcgxOVaAp2lGwEdzZ0J+cRbbeevQj1UQ=="],
 
     "@types/retry": ["@types/retry@0.12.2", "", {}, "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow=="],
@@ -2053,46 +2078,6 @@
 
     "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.54.0", "", { "dependencies": { "@typescript-eslint/types": "8.54.0", "eslint-visitor-keys": "^4.2.1" } }, "sha512-VFlhGSl4opC0bprJiItPQ1RfUhGDIBokcPwaFH4yiBCaNPeld/9VeXbiPO1cLyorQi1G1vL+ecBk1x8o1axORA=="],
 
-    "@typescript/typescript-aix-ppc64": ["@typescript/typescript-aix-ppc64@7.0.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ=="],
-
-    "@typescript/typescript-darwin-arm64": ["@typescript/typescript-darwin-arm64@7.0.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA=="],
-
-    "@typescript/typescript-darwin-x64": ["@typescript/typescript-darwin-x64@7.0.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA=="],
-
-    "@typescript/typescript-freebsd-arm64": ["@typescript/typescript-freebsd-arm64@7.0.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ=="],
-
-    "@typescript/typescript-freebsd-x64": ["@typescript/typescript-freebsd-x64@7.0.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw=="],
-
-    "@typescript/typescript-linux-arm": ["@typescript/typescript-linux-arm@7.0.2", "", { "os": "linux", "cpu": "arm" }, "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ=="],
-
-    "@typescript/typescript-linux-arm64": ["@typescript/typescript-linux-arm64@7.0.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ=="],
-
-    "@typescript/typescript-linux-loong64": ["@typescript/typescript-linux-loong64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ=="],
-
-    "@typescript/typescript-linux-mips64el": ["@typescript/typescript-linux-mips64el@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA=="],
-
-    "@typescript/typescript-linux-ppc64": ["@typescript/typescript-linux-ppc64@7.0.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA=="],
-
-    "@typescript/typescript-linux-riscv64": ["@typescript/typescript-linux-riscv64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ=="],
-
-    "@typescript/typescript-linux-s390x": ["@typescript/typescript-linux-s390x@7.0.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw=="],
-
-    "@typescript/typescript-linux-x64": ["@typescript/typescript-linux-x64@7.0.2", "", { "os": "linux", "cpu": "x64" }, "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A=="],
-
-    "@typescript/typescript-netbsd-arm64": ["@typescript/typescript-netbsd-arm64@7.0.2", "", { "os": "none", "cpu": "arm64" }, "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA=="],
-
-    "@typescript/typescript-netbsd-x64": ["@typescript/typescript-netbsd-x64@7.0.2", "", { "os": "none", "cpu": "x64" }, "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA=="],
-
-    "@typescript/typescript-openbsd-arm64": ["@typescript/typescript-openbsd-arm64@7.0.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ=="],
-
-    "@typescript/typescript-openbsd-x64": ["@typescript/typescript-openbsd-x64@7.0.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg=="],
-
-    "@typescript/typescript-sunos-x64": ["@typescript/typescript-sunos-x64@7.0.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g=="],
-
-    "@typescript/typescript-win32-arm64": ["@typescript/typescript-win32-arm64@7.0.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ=="],
-
-    "@typescript/typescript-win32-x64": ["@typescript/typescript-win32-x64@7.0.2", "", { "os": "win32", "cpu": "x64" }, "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g=="],
-
     "@uiw/codemirror-extensions-basic-setup": ["@uiw/codemirror-extensions-basic-setup@4.23.8", "", { "dependencies": { "@codemirror/autocomplete": "^6.0.0", "@codemirror/commands": "^6.0.0", "@codemirror/language": "^6.0.0", "@codemirror/lint": "^6.0.0", "@codemirror/search": "^6.0.0", "@codemirror/state": "^6.0.0", "@codemirror/view": "^6.0.0" } }, "sha512-XJR/8AEVcE7ufy1BhW2nCN9qSVDYEdCtYLfvhaMwl6Q3qcaYYCGE2K5QbFCy7LsdP/3uZKvc1OskuqatoOPdhQ=="],
 
     "@uiw/react-codemirror": ["@uiw/react-codemirror@4.23.8", "", { "dependencies": { "@babel/runtime": "^7.18.6", "@codemirror/commands": "^6.1.0", "@codemirror/state": "^6.1.1", "@codemirror/theme-one-dark": "^6.0.0", "@uiw/codemirror-extensions-basic-setup": "4.23.8", "codemirror": "^6.0.0" } }, "sha512-/NA5Pj4MmXkLSlmlUm4yfEmRLntrNq5TkQKBSINn7TukXQ4fc+C6Bk0U60Qa4rkvCSgwzZdQ2exyP0t0+2GtqA=="],
@@ -2857,6 +2842,8 @@
 
     "decode-tiff": ["decode-tiff@0.2.1", "", {}, "sha512-v/7hQBv/DrOVQ+Eljg0BLMRbXZYuuw3YZ8duZuFxYpo6qUkdn7oFRkN95RZKbnh08EHNjrMXMbEUNhTLuhPvvA=="],
 
+    "decode-uri-component": ["decode-uri-component@0.2.2", "", {}, "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ=="],
+
     "dedent": ["dedent@1.5.1", "", { "peerDependencies": { "babel-plugin-macros": "^3.1.0" }, "optionalPeers": ["babel-plugin-macros"] }, "sha512-+LxW+KLWxu3HW3M2w2ympwtqPrqYRzU8fqi6Fhd18fBALe15blJPI/I4+UHveMVG6lJqB4JNd4UG0S5cnVHwIg=="],
 
     "deep-eql": ["deep-eql@5.0.2", "", {}, "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q=="],
@@ -3765,7 +3752,7 @@
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
-    "js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="],
+    "js-yaml": ["js-yaml@4.2.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw=="],
 
     "jsbn": ["jsbn@0.1.1", "", {}, "sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg=="],
 
@@ -3857,7 +3844,7 @@
 
     "lines-and-columns": ["lines-and-columns@1.1.6", "", {}, "sha1-HADHQ7QzzQpOgHWPe2SldEDZ/wA="],
 
-    "linkify-it": ["linkify-it@5.0.2", "", { "dependencies": { "uc.micro": "^2.0.0" } }, "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q=="],
+    "linkify-it": ["linkify-it@5.0.1", "", { "dependencies": { "uc.micro": "^2.0.0" } }, "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg=="],
 
     "linkifyjs": ["linkifyjs@4.3.2", "", {}, "sha512-NT1CJtq3hHIreOianA8aSXn6Cw0JzYOuDQbOrSPe7gqFnCpKP++MQe3ODgO3oh2GJFORkAAdqredOa60z63GbA=="],
 
@@ -4289,8 +4276,6 @@
 
     "ospath": ["ospath@1.2.2", "", {}, "sha512-o6E5qJV5zkAbIDNhGSIlyOhScKXgQrSRMilfph0clDfM0nEnBOlKlH4sWDmG95BW/CvwNz0vmm7dJVtU2KlMiA=="],
 
-    "otpauth": ["otpauth@9.5.1", "", { "dependencies": { "@noble/hashes": "2.2.0" } }, "sha512-fJmDAHc8wImfqqqOXIlBvT1dEKrZK0Cmb2VEgScpNTolCz0PHh6ExUZGv4sLtOsWNaHCQlD+rRqaPgnoxFoZjQ=="],
-
     "outdent": ["outdent@0.8.0", "", {}, "sha512-KiOAIsdpUTcAXuykya5fnVVT+/5uS0Q1mrkRHcF89tpieSmY33O/tmc54CqwA+bfhbtEfZUNLHaPUiB9X3jt1A=="],
 
     "outvariant": ["outvariant@1.4.3", "", {}, "sha512-+Sl2UErvtsoajRDKCE5/dBz4DIvHXQQnAxtQTF04OJxY0+DyZXSo5P5Bb7XYWOh81syohlYL24hbDwxedPUJCA=="],
@@ -4625,8 +4610,6 @@
 
     "qified": ["qified@0.5.0", "", { "dependencies": { "hookified": "^1.12.1" } }, "sha512-Zj6Q/Vc/SQ+Fzc87N90jJUzBzxD7MVQ2ZvGyMmYtnl2u1a07CejAhvtk4ZwASos+SiHKCAIylyGHJKIek75QBw=="],
 
-    "qrcode-generator": ["qrcode-generator@2.0.4", "", {}, "sha512-mZSiP6RnbHl4xL2Ap5HfkjLnmxfKcPWpWe/c+5XxCuetEenqmNFf1FH/ftXPCtFG5/TDobjsjz6sSNL0Sr8Z9g=="],
-
     "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
 
     "query-string": ["query-string@4.3.4", "", { "dependencies": { "object-assign": "^4.1.0", "strict-uri-encode": "^1.0.0" } }, "sha1-u7aTucqRXCMlFbIosaArYJBD2+s="],
@@ -4699,8 +4682,6 @@
 
     "react-number-format": ["react-number-format@5.4.4", "", {}, "sha512-wOmoNZoOpvMminhifQYiYSTCLUDOiUbBunrMrMjA+dV52sY+vck1S4UhR6PkgnoCquvvMSeJjErXZ4qSaWCliA=="],
 
-    "react-qr-code": ["react-qr-code@2.2.0", "", { "dependencies": { "prop-types": "^15.8.1", "qrcode-generator": "^2.0.4" }, "peerDependencies": { "react": "*" } }, "sha512-e5nS0UUN22K3Nf8KBRUzemfdJ6OmnN5w+kbnj1lvJaol9RyVRFeGl05bCkxSN2ZegbLxjjYjX1+mmAoX9+fAhw=="],
-
     "react-reconciler": ["react-reconciler@0.26.2", "", { "dependencies": { "loose-envify": "^1.1.0", "object-assign": "^4.1.1", "scheduler": "^0.20.2" } }, "sha512-nK6kgY28HwrMNwDnMui3dvm3rCFjZrcGiuwLc5COUipBK5hWHLOxMJhSnSomirqWwjPBJKV1QcbkI0VJr7Gl1Q=="],
 
     "react-redux": ["react-redux@9.1.2", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.3", "use-sync-external-store": "^1.0.0" } }, "sha512-0OA4dhM1W48l3uzmv6B7TXPCGmokUU4p1M44DGN2/D9a1FjVPukVjER1PcPX97jIg6aUeLq1XJo1IpfbgULn0w=="],
@@ -4715,6 +4696,8 @@
 
     "react-router": ["react-router@3.2.6", "", { "dependencies": { "create-react-class": "^15.5.1", "history": "^3.0.0", "hoist-non-react-statics": "^3.3.2", "invariant": "^2.2.1", "loose-envify": "^1.2.0", "prop-types": "^15.7.2", "react-is": "^16.13.0", "warning": "^3.0.0" } }, "sha512-nlxtQE8B22hb/JxdaslI1tfZacxFU8x8BJryXOnR2RxB4vc01zuHYAHAIgmBkdk1kzXaA25hZxK6KAH/+CXArw=="],
 
+    "react-router-redux": ["react-router-redux@4.0.8", "", {}, "sha1-InQDWWtRUeGCN32rg1tdRfD4BU4="],
+
     "react-router-v7": ["react-router@7.18.1", "", { "dependencies": { "cookie": "^1.0.1", "set-cookie-parser": "^2.6.0" }, "peerDependencies": { "react": ">=18", "react-dom": ">=18" }, "optionalPeers": ["react-dom"] }, "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg=="],
 
     "react-style-singleton": ["react-style-singleton@2.2.3", "", { "dependencies": { "get-nonce": "^1.0.0", "tslib": "^2.0.0" } }, "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ=="],
@@ -4763,10 +4746,12 @@
 
     "reduce-reducers": ["reduce-reducers@0.4.3", "", {}, "sha512-+CNMnI8QhgVMtAt54uQs3kUxC3Sybpa7Y63HR14uGLgI9/QR5ggHvpxwhGGe3wmx5V91YwqQIblN9k5lspAmGw=="],
 
-    "redux": ["redux@5.0.1", "", {}, "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w=="],
+    "redux": ["redux@3.7.2", "", { "dependencies": { "lodash": "^4.2.1", "lodash-es": "^4.2.1", "loose-envify": "^1.1.0", "symbol-observable": "^1.0.3" } }, "sha512-pNqnf9q1hI5HHZRBkj3bAngGZW/JMCmexDlOxw4XagXY2o1327nHH54LoTjiPJ0gizoqPDRqWyX/00g0hD6w+A=="],
 
     "redux-actions": ["redux-actions@2.6.5", "", { "dependencies": { "invariant": "^2.2.4", "just-curry-it": "^3.1.0", "loose-envify": "^1.4.0", "reduce-reducers": "^0.4.3", "to-camel-case": "^1.0.0" } }, "sha512-pFhEcWFTYNk7DhQgxMGnbsB1H2glqhQJRQrtPb96kD3hWiZRzXHwwmFPswg6V2MjraXRXWNmuP9P84tvdLAJmw=="],
 
+    "redux-auth-wrapper": ["redux-auth-wrapper@2.1.0", "", { "dependencies": { "hoist-non-react-statics": "^3.3.0", "invariant": "^2.2.4", "lodash.isempty": "^4.4.0", "prop-types": "^15.5.0", "query-string": "^5.1.1" } }, "sha512-UtU64cJk2pWcMMfgWIVoyBVG0p8ZiGJ++vqrvQ5r5ghZZOLRq+M5aTS0RRNneiB+aCCZBzI+txFSaKYVRrv8qQ=="],
+
     "redux-thunk": ["redux-thunk@3.1.0", "", {}, "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw=="],
 
     "redux-undo": ["redux-undo@1.1.0", "", {}, "sha512-zzLFh2qeF0MTIlzDhDLm9NtkfBqCllQJ3OCuIl5RKlG/ayHw6GUdIFdMhzMS9NnrnWdBX5u//ExMOHpfudGGOg=="],
@@ -5185,6 +5170,8 @@
 
     "swc-plugin-coverage-instrument": ["swc-plugin-coverage-instrument@0.0.32", "", {}, "sha512-KsO1xNQdcVb331Rm98Op6uYf36/CYdF1kILQxOddmtCNlRLISpCUqHcnogu+QgELZvG48oie+w0fzS8uktjcEA=="],
 
+    "symbol-observable": ["symbol-observable@1.2.0", "", {}, "sha512-e900nM8RRtGhlV36KGEU9k65K3mPb1WV70OdjfxlG2EAuM1noi/E/BaW/uMhL7bPEssK8QV57vN3esixjUvcXQ=="],
+
     "symbol-tree": ["symbol-tree@3.2.4", "", {}, "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw=="],
 
     "synckit": ["synckit@0.11.12", "", { "dependencies": { "@pkgr/core": "^0.2.9" } }, "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ=="],
@@ -5359,8 +5346,6 @@
 
     "typescript-plugin-css-modules": ["typescript-plugin-css-modules@5.1.0", "", { "dependencies": { "@types/postcss-modules-local-by-default": "^4.0.2", "@types/postcss-modules-scope": "^3.0.4", "dotenv": "^16.4.2", "icss-utils": "^5.1.0", "less": "^4.2.0", "lodash.camelcase": "^4.3.0", "postcss": "^8.4.35", "postcss-load-config": "^3.1.4", "postcss-modules-extract-imports": "^3.0.0", "postcss-modules-local-by-default": "^4.0.4", "postcss-modules-scope": "^3.1.1", "reserved-words": "^0.1.2", "sass": "^1.70.0", "source-map-js": "^1.0.2", "stylus": "^0.62.0", "tsconfig-paths": "^4.2.0" } }, "sha512-6h+sLBa4l+XYSTn/31vZHd/1c3SvAbLpobY6FxDiUOHJQG1eD9Gh3eCs12+Eqc+TCOAdxcO+zAPvUq0jBfdciw=="],
 
-    "typescript7": ["typescript@7.0.2", "", { "optionalDependencies": { "@typescript/typescript-aix-ppc64": "7.0.2", "@typescript/typescript-darwin-arm64": "7.0.2", "@typescript/typescript-darwin-x64": "7.0.2", "@typescript/typescript-freebsd-arm64": "7.0.2", "@typescript/typescript-freebsd-x64": "7.0.2", "@typescript/typescript-linux-arm": "7.0.2", "@typescript/typescript-linux-arm64": "7.0.2", "@typescript/typescript-linux-loong64": "7.0.2", "@typescript/typescript-linux-mips64el": "7.0.2", "@typescript/typescript-linux-ppc64": "7.0.2", "@typescript/typescript-linux-riscv64": "7.0.2", "@typescript/typescript-linux-s390x": "7.0.2", "@typescript/typescript-linux-x64": "7.0.2", "@typescript/typescript-netbsd-arm64": "7.0.2", "@typescript/typescript-netbsd-x64": "7.0.2", "@typescript/typescript-openbsd-arm64": "7.0.2", "@typescript/typescript-openbsd-x64": "7.0.2", "@typescript/typescript-sunos-x64": "7.0.2", "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" }, "bin": { "tsc": "bin/tsc" } }, "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA=="],
-
     "uc.micro": ["uc.micro@2.1.0", "", {}, "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A=="],
 
     "uglify-js": ["uglify-js@3.19.3", "", { "bin": { "uglifyjs": "bin/uglifyjs" } }, "sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ=="],
@@ -5711,6 +5696,8 @@
 
     "@hey-api/json-schema-ref-parser/@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
 
+    "@hey-api/json-schema-ref-parser/js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
+
     "@hey-api/openapi-ts/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
 
     "@hey-api/shared/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
@@ -5733,6 +5720,8 @@
 
     "@istanbuljs/load-nyc-config/find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
 
+    "@istanbuljs/load-nyc-config/js-yaml": ["js-yaml@3.14.0", "", { "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-/4IbIeHcD9VMHFqDR/gQ7EdZdLimOvW2DdcxFjdyyZ9NsbS+ccrXqVWDtab/lRl5AlUqmpBx8EhPaWR+OtY17A=="],
+
     "@jest/console/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
     "@jest/core/ansi-escapes": ["ansi-escapes@4.3.2", "", { "dependencies": { "type-fest": "^0.21.3" } }, "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ=="],
@@ -5829,12 +5818,14 @@
 
     "@redocly/openapi-core/ajv": ["@redocly/ajv@8.17.4", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-BieiCML/IgP6x99HZByJSt7fJE4ipgzO7KAFss92Bs+PEI35BhY7vGIysFXLT+YmS7nHtQjZjhOQyPPEf7xGHA=="],
 
-    "@redocly/respect-core/@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
+    "@redocly/openapi-core/js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
 
     "@redocly/respect-core/ajv": ["@redocly/ajv@8.17.4", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-BieiCML/IgP6x99HZByJSt7fJE4ipgzO7KAFss92Bs+PEI35BhY7vGIysFXLT+YmS7nHtQjZjhOQyPPEf7xGHA=="],
 
     "@redocly/respect-core/colorette": ["colorette@2.0.20", "", {}, "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w=="],
 
+    "@reduxjs/toolkit/redux": ["redux@5.0.1", "", {}, "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w=="],
+
     "@rushstack/node-core-library/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
     "@rushstack/node-core-library/fs-extra": ["fs-extra@11.3.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-Z4XaCL6dUDHfP/jT25jJKMmtxvuwbkrD1vNSMFlo9lNLY2c5FHYSQgHPRZUjAB26TpDEoW9HCOgplrdbaPV/ew=="],
@@ -5971,6 +5962,8 @@
 
     "@types/react-virtualized/@types/prop-types": ["@types/prop-types@15.7.15", "", {}, "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw=="],
 
+    "@types/redux-auth-wrapper/@types/history": ["@types/history@4.7.11", "", {}, "sha512-qjDJRrmvBMiTx+jyLxvLfJU7UznFuokDv4f3WRuriHKERccVpFU+8XMQUAbDzoiJCsmexxRExQeMwwCdamSKDA=="],
+
     "@types/serve-index/@types/express": ["@types/express@4.17.13", "", { "dependencies": { "@types/body-parser": "*", "@types/express-serve-static-core": "^4.17.18", "@types/qs": "*", "@types/serve-static": "*" } }, "sha512-6bSZTPaTIACxn48l50SR+axgrqm6qXFIxrdAKaG6PaJk3+zuUr35hBlgT7vOmJcum+OEaIBLtHV/qloEAFITeA=="],
 
     "@typescript-eslint/parser/@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.60.0", "", { "dependencies": { "@typescript-eslint/types": "8.60.0", "@typescript-eslint/visitor-keys": "8.60.0" } }, "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw=="],
@@ -6193,6 +6186,8 @@
 
     "content-disposition/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
 
+    "cosmiconfig/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "cosmiconfig/parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="],
 
     "create-ecdh/bn.js": ["bn.js@4.11.9", "", {}, "sha512-E6QoYqCKZfgatHTdHzs1RRKP7ip4vvm+EyRUeE2RF0NblwVvb0p6jSVeNTOFxPn26QXN2o6SMfNxKp6kU8zQaw=="],
@@ -6285,6 +6280,8 @@
 
     "diffie-hellman/bn.js": ["bn.js@4.11.9", "", {}, "sha512-E6QoYqCKZfgatHTdHzs1RRKP7ip4vvm+EyRUeE2RF0NblwVvb0p6jSVeNTOFxPn26QXN2o6SMfNxKp6kU8zQaw=="],
 
+    "dnd-core/redux": ["redux@4.2.0", "", { "dependencies": { "@babel/runtime": "^7.9.2" } }, "sha512-oSBmcKKIuIR4ME29/AeNUnl5L+hvBq7OaJWzaptTQJAntaPvxIJqfnjbaEiCzzaIz+XmVILfqAM3Ob0aXLPfjA=="],
+
     "dom-serializer/domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
 
     "domhandler/domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
@@ -6721,6 +6718,8 @@
 
     "mocha/glob": ["glob@8.1.0", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^5.0.1", "once": "^1.3.0" } }, "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ=="],
 
+    "mocha/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "mocha/minimatch": ["minimatch@5.1.6", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g=="],
 
     "mocha/supports-color": ["supports-color@8.1.1", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q=="],
@@ -6989,6 +6988,8 @@
 
     "reduce-function-call/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
+    "redux-auth-wrapper/query-string": ["query-string@5.1.1", "", { "dependencies": { "decode-uri-component": "^0.2.0", "object-assign": "^4.1.0", "strict-uri-encode": "^1.0.0" } }, "sha512-gjWOsm2SoGlgLEdAGt7a6slVOk9mGiXmPFMqrEhLQ68rhQuBnpfs3+EmlvqKyxnCo9/PPlF+9MtY02S1aFg+Jw=="],
+
     "reg-cli/glob": ["glob@7.2.0", "", { "dependencies": { "fs.realpath": "^1.0.0", "inflight": "^1.0.4", "inherits": "2", "minimatch": "^3.0.4", "once": "^1.3.0", "path-is-absolute": "^1.0.0" } }, "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q=="],
 
     "reg-cli/make-dir": ["make-dir@3.1.0", "", { "dependencies": { "semver": "^6.0.0" } }, "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw=="],
@@ -7283,6 +7284,8 @@
 
     "write-file-atomic/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
 
+    "yaml-lint/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "yargs/escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
 
     "yargs-unparser/camelcase": ["camelcase@6.3.0", "", {}, "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA=="],
@@ -7357,6 +7360,8 @@
 
     "@istanbuljs/load-nyc-config/find-up/locate-path": ["locate-path@5.0.0", "", { "dependencies": { "p-locate": "^4.1.0" } }, "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g=="],
 
+    "@istanbuljs/load-nyc-config/js-yaml/argparse": ["argparse@1.0.10", "", { "dependencies": { "sprintf-js": "~1.0.2" } }, "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg=="],
+
     "@jest/core/ansi-escapes/type-fest": ["type-fest@0.21.3", "", {}, "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w=="],
 
     "@jest/core/pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
@@ -7489,8 +7494,12 @@
 
     "@storybook/test/@testing-library/dom/dom-accessibility-api": ["dom-accessibility-api@0.5.13", "", {}, "sha512-R305kwb5CcMDIpSHUnLyIAp7SrSPBx6F0VfQFB3M75xVMHhXJJIdePYgbPPh1o57vCHNu5QztokWUPsLjWzFqw=="],
 
+    "@svgr/core/cosmiconfig/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "@svgr/core/cosmiconfig/parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="],
 
+    "@svgr/plugin-svgo/cosmiconfig/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "@svgr/plugin-svgo/cosmiconfig/parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="],
 
     "@tiptap/extension-bubble-menu/@floating-ui/dom/@floating-ui/core": ["@floating-ui/core@1.6.8", "", { "dependencies": { "@floating-ui/utils": "^0.2.8" } }, "sha512-7XJ9cPU+yI2QeLS+FCSlqNFZJq8arvswefkZrYI1yQBbftw6FyrZOxYSh+9S7z7TpeWlRt9zJ5IhM1WIL334jA=="],
@@ -8157,6 +8166,8 @@
 
     "openapi-typescript/@redocly/openapi-core/@redocly/config": ["@redocly/config@0.22.2", "", {}, "sha512-roRDai8/zr2S9YfmzUfNhKjOF0NdcOIqF7bhf4MVC5UxpjIysDjyudvlAiVbpPHp3eDRWbdzUgtkK1a7YiDNyQ=="],
 
+    "openapi-typescript/@redocly/openapi-core/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "openapi-typescript/@redocly/openapi-core/minimatch": ["minimatch@5.1.6", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g=="],
 
     "ora/cli-cursor/restore-cursor": ["restore-cursor@4.0.0", "", { "dependencies": { "onetime": "^5.1.0", "signal-exit": "^3.0.2" } }, "sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg=="],
@@ -8189,6 +8200,10 @@
 
     "raw-body/http-errors/statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
 
+    "react-dnd-html5-backend/dnd-core/redux": ["redux@4.2.0", "", { "dependencies": { "@babel/runtime": "^7.9.2" } }, "sha512-oSBmcKKIuIR4ME29/AeNUnl5L+hvBq7OaJWzaptTQJAntaPvxIJqfnjbaEiCzzaIz+XmVILfqAM3Ob0aXLPfjA=="],
+
+    "react-dnd/dnd-core/redux": ["redux@4.2.0", "", { "dependencies": { "@babel/runtime": "^7.9.2" } }, "sha512-oSBmcKKIuIR4ME29/AeNUnl5L+hvBq7OaJWzaptTQJAntaPvxIJqfnjbaEiCzzaIz+XmVILfqAM3Ob0aXLPfjA=="],
+
     "react-docgen-typescript-plugin/find-cache-dir/make-dir": ["make-dir@3.1.0", "", { "dependencies": { "semver": "^6.0.0" } }, "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw=="],
 
     "react-docgen/@types/babel__core/@types/babel__traverse": ["@types/babel__traverse@7.14.2", "", { "dependencies": { "@babel/types": "^7.3.0" } }, "sha512-K2waXdXBi2302XUdcHcR1jCeU0LL4TD9HRs/gk0N2Xvrht+G/BfJa4QObBQZfhMdxiCpV3COl5Nfq4uKTeTnJA=="],
@@ -8207,6 +8222,8 @@
 
     "redoc/@redocly/openapi-core/@redocly/config": ["@redocly/config@0.22.2", "", {}, "sha512-roRDai8/zr2S9YfmzUfNhKjOF0NdcOIqF7bhf4MVC5UxpjIysDjyudvlAiVbpPHp3eDRWbdzUgtkK1a7YiDNyQ=="],
 
+    "redoc/@redocly/openapi-core/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
+
     "redoc/@redocly/openapi-core/minimatch": ["minimatch@5.1.6", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g=="],
 
     "reg-cli/glob/minimatch": ["minimatch@3.1.2", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw=="],

deps.edn

@@ -104,6 +104,7 @@
                                              :git/sha "b4a2d78647a049870b316753d7aae7fb4ade3ae5"} ; patched to resolve an issue causing OOM
   net.carcdr/oidc-provider                  {:mvn/version "0.6.2"}              ; OAuth/OIDC server abstract implementation
   net.cgrand/macrovich                      {:mvn/version "0.2.2"}              ; utils for writing macros for both Clojure & ClojureScript
+  net.java.dev.jna/jna                      {:mvn/version "5.19.1"}             ; native library loading, for the QuickJS static-viz renderer
   net.redhogs.cronparser/cron-parser-core   {:mvn/version "3.5"                 ; describe Cron schedule in human-readable language
                                              :exclusions  [org.slf4j/slf4j-api]}
   net.sf.cssbox/cssbox                      {:mvn/version "5.0.2"               ; HTML / CSS rendering
@@ -117,15 +118,15 @@
   org.apache.httpcomponents.client5/httpclient5 {:mvn/version "5.6.2"}              ; pinned: must pair with httpcore5 5.4.x (upstream pairing); ClickHouse JDBC needs httpcore5 5.3.4+
   org.apache.httpcomponents.core5/httpcore5     {:mvn/version "5.4.3"}              ; pinned: 5.4.2+
   org.apache.httpcomponents.core5/httpcore5-h2  {:mvn/version "5.4.3"}              ; pinned: must match httpcore5 version
-  org.apache.logging.log4j/log4j-1.2-api        {:mvn/version "2.26.1"}             ; apache logging framework
-  org.apache.logging.log4j/log4j-api            {:mvn/version "2.26.1"}             ; add compatibility with log4j 1.2
-  org.apache.logging.log4j/log4j-core           {:mvn/version "2.26.1"}             ; apache logging framework
-  org.apache.logging.log4j/log4j-jcl            {:mvn/version "2.26.1"}             ; allows the commons-logging API to work with log4j 2
-  org.apache.logging.log4j/log4j-jul            {:mvn/version "2.26.1"}             ; java.util.logging (JUL) -> Log4j2 adapter
+  org.apache.logging.log4j/log4j-1.2-api        {:mvn/version "2.25.4"}             ; apache logging framework
+  org.apache.logging.log4j/log4j-api            {:mvn/version "2.25.4"}             ; add compatibility with log4j 1.2
+  org.apache.logging.log4j/log4j-core           {:mvn/version "2.25.4"}             ; apache logging framework
+  org.apache.logging.log4j/log4j-jcl            {:mvn/version "2.25.4"}             ; allows the commons-logging API to work with log4j 2
+  org.apache.logging.log4j/log4j-jul            {:mvn/version "2.25.4"}             ; java.util.logging (JUL) -> Log4j2 adapter
   org.apache.logging.log4j/log4j-layout-template-json
-  {:mvn/version "2.26.1"}             ; allows the custom json logging format
+  {:mvn/version "2.25.4"}             ; allows the custom json logging format
   org.apache.logging.log4j/log4j-slf4j2-impl
-  {:mvn/version "2.26.1"}             ; allows the slf4j2 API to work with log4j 2
+  {:mvn/version "2.25.4"}             ; allows the slf4j2 API to work with log4j 2
   org.apache.pdfbox/pdfbox                  {:mvn/version "3.0.5"}              ; PDF generation (backend dashboard PDF prototype)
   org.apache.poi/poi                        {:mvn/version "5.5.1"}              ; Work with Office documents (e.g. Excel spreadsheets) -- newer version than one specified by Docjure
   org.apache.poi/poi-ooxml                  {:mvn/version "5.5.1"
@@ -161,16 +162,14 @@
   org.clojure/tools.namespace               {:mvn/version "1.5.0"}
   org.clojure/tools.reader                  {:mvn/version "1.5.2"}
   org.clojure/tools.trace                   {:mvn/version "0.8.0"}              ; function tracing
-  org.eclipse.jetty/jetty-server            {:mvn/version "12.1.11"}
-  org.eclipse.jetty/jetty-unixdomain-server {:mvn/version "12.1.11"}
-  org.eclipse.jetty.ee9/jetty-ee9-servlet   {:mvn/version "12.1.11"}
-  org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-server {:mvn/version "12.1.11"}
+  org.eclipse.jetty/jetty-server            {:mvn/version "12.1.7"}
+  org.eclipse.jetty/jetty-unixdomain-server {:mvn/version "12.1.7"}
+  org.eclipse.jetty.ee9/jetty-ee9-servlet   {:mvn/version "12.1.7"}
+  org.eclipse.jetty.ee9.websocket/jetty-ee9-websocket-jetty-server {:mvn/version "12.1.7"}
   org.eclipse.jgit/org.eclipse.jgit        {:mvn/version "7.3.0.202506031305-r"}; Java implementation of Git version control system
   org.flatland/ordered                      {:mvn/version "1.15.12"}            ; ordered maps & sets
   org.graalvm.polyglot/js-community         {:mvn/version "25.0.1" :extension "pom"} ; JavaScript engine
   org.graalvm.polyglot/polyglot             {:mvn/version "25.0.1"}             ; GraalVM platform, required by JS engine
-  org.graalvm.polyglot/python               {:mvn/version "25.0.1"
-                                             :extension "pom"}
   org.jsoup/jsoup                           {:mvn/version "1.21.2"}             ; required by hickory
   org.liquibase/liquibase-core              {:mvn/version "4.33.0"              ; migration management (Java lib)
                                              :exclusions  [ch.qos.logback/logback-classic]}
@@ -651,15 +650,7 @@
                ;; https://clojurians.slack.com/archives/C03S1KBA2/p1667925853699669
                ;; An issue has been filed here https://github.com/jonase/eastwood/issues/444
                ;; and a simple reproduction repo can be found here https://github.com/metabase/snowplow-eastwood-issue
-               ;;
-               ;; The two Quartz queue-affinity DriverDelegate shims are `gen-class` namespaces whose
-               ;; only body is a `(.superRtp this ...)` call to their own exposed super method. That
-               ;; method exists only on the class the namespace itself generates, so `this` can't be
-               ;; type-hinted with it at compile time (the class isn't defined yet) — the reflective
-               ;; call is unavoidable. Eastwood also can't reliably analyze these gen-class shims.
-               :exclude-namespaces [metabase.analytics.snowplow
-                                    metabase.mq.quartz-affinity-delegate-std
-                                    metabase.mq.quartz-affinity-delegate-postgres]}}
+               :exclude-namespaces [metabase.analytics.snowplow]}}
 
   ;; Test counterpart of :eastwood. Starts with :reflection only; add more linters as we fix other eastwood
   ;; issues in tests.
@@ -812,7 +803,7 @@
   ;;
   ;; the various steps available are:
   ;;
-  ;;    :version :translations :frontend :licenses :drivers :python :uberjar
+  ;;    :version :translations :frontend :licenses :drivers :polyglot-ffi :uberjar
   :build/all
   {:exec-fn build/build-cli}
 

dev/email-preview/README.md

@@ -1,52 +0,0 @@
-# Email template preview
-
-A browser-based previewer for the transactional email templates in
-`src/metabase/channel/email/*.hbs`, so you can work on email copy and design
-without running Metabase or sending real emails.
-
-## Run it
-
-```
-bun run email-dev
-```
-
-That starts a tiny local server and opens the preview in your browser
-(default: http://localhost:8455 — set `PORT` to change it).
-
-## Using it
-
-- **Pick a template** in the left sidebar. The shared header/footer partials
-  are included automatically, just like in real emails.
-- **Edit the template**: open the `.hbs` file in any editor, save, and the
-  preview refreshes by itself (it polls for changes every second).
-- **Fill in values**: the *Fields* panel on the right lists every value the
-  template receives (`{{applicationName}}`, user names, links, …) as editable
-  inputs. The *JSON* tab shows the same data raw, for arrays and adding keys.
-  Edits are per-browser (localStorage); *Reset* restores the defaults.
-- **Check widths** with the Desktop / Narrow / Phone buttons — email clients
-  are usually around 600px.
-- **Copy HTML** copies the fully rendered email, e.g. to paste into an email
-  client testing tool like Litmus.
-
-## What's a "sample context"?
-
-Each email is rendered from a template plus data supplied by the backend at
-send time (the "context"). The defaults in `sample-contexts.js` mirror what
-the real send-time code passes, with demo values. If a template gains a new
-variable, add a default for it there.
-
-## Fidelity caveats
-
-- Production renders with Java Handlebars (jknack); this tool uses
-  handlebars.js. For everything these templates use (`#if`, `#each`, `#with`,
-  partials, the custom helpers) the output is the same, but it is a preview,
-  not a byte-for-byte reproduction — QA real sends for final signoff.
-- Subject lines live in Clojure code (`messages.clj` and the notification
-  handlers), not in the templates, so they don't appear here.
-- Rendered dashboard/card images in subscription emails are placeholders —
-  the real content comes from the visualization renderer at send time.
-- `cid:` images (inline attachments, e.g. some icons) show as broken images
-  in the browser; they work in real emails.
-- What you see is a browser rendering. Email clients (Outlook especially)
-  are stricter — the preview is for copy and layout iteration, not client
-  compatibility testing.

dev/email-preview/index.html

@@ -1,571 +0,0 @@
-<!DOCTYPE html>
-<!--
-  Email template preview tool.
-
-  Renders the Handlebars email templates in src/metabase/channel/email/ with
-  sample data, entirely in the browser — no backend required. Run it with:
-
-      ./bin/email-preview
-
-  then edit any .hbs file in your editor; the preview reloads automatically.
-
-  Fidelity notes: production renders these templates with Java Handlebars
-  (jknack) — this tool uses handlebars.js, which is equivalent for everything
-  these templates use ({{#if}}, {{#each}}, {{#with}}, partials). The custom
-  helpers (equals, format-date, now, initials, card-url, dashboard-url,
-  trash-url) are re-implemented below; format-date approximates java-time
-  formatting with a common-token subset.
--->
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>Metabase Email Template Preview</title>
-<script src="https://cdn.jsdelivr.net/npm/handlebars@4.7.8/dist/handlebars.min.js"></script>
-<script src="sample-contexts.js"></script>
-<style>
-  :root {
-    --brand: #509EE3;
-    --text-dark: #4C5773;
-    --text-medium: #949AAB;
-    --border: #EEECEC;
-    --bg: #F9FBFC;
-  }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    font-family: 'Lato', 'Helvetica Neue', Helvetica, sans-serif;
-    color: var(--text-dark);
-    display: flex;
-    height: 100vh;
-    overflow: hidden;
-  }
-  #sidebar {
-    width: 260px;
-    min-width: 260px;
-    border-right: 1px solid var(--border);
-    background: var(--bg);
-    overflow-y: auto;
-    padding: 0.5em 0;
-  }
-  #sidebar h1 {
-    font-size: 0.95em;
-    padding: 0.5em 1em;
-    margin: 0;
-    color: var(--text-dark);
-  }
-  #sidebar .group-label {
-    font-size: 0.7em;
-    text-transform: uppercase;
-    letter-spacing: 0.06em;
-    color: var(--text-medium);
-    padding: 1em 1.2em 0.3em;
-  }
-  #sidebar button {
-    display: block;
-    width: 100%;
-    text-align: left;
-    border: none;
-    background: none;
-    padding: 0.45em 1.2em;
-    font: inherit;
-    font-size: 0.85em;
-    color: var(--text-dark);
-    cursor: pointer;
-    border-left: 3px solid transparent;
-  }
-  #sidebar button:hover { background: #EDF2F5; }
-  #sidebar button.active {
-    border-left-color: var(--brand);
-    background: #EDF2F5;
-    font-weight: bold;
-    color: var(--brand);
-  }
-  #main { flex: 1; display: flex; flex-direction: column; min-width: 0; }
-  #toolbar {
-    display: flex;
-    align-items: center;
-    gap: 0.5em;
-    padding: 0.5em 1em;
-    border-bottom: 1px solid var(--border);
-    font-size: 0.85em;
-  }
-  #toolbar .name { font-weight: bold; margin-right: auto; }
-  #toolbar button {
-    font: inherit;
-    padding: 0.3em 0.8em;
-    border: 1px solid var(--border);
-    border-radius: 4px;
-    background: white;
-    color: var(--text-dark);
-    cursor: pointer;
-  }
-  #toolbar button.on { border-color: var(--brand); color: var(--brand); font-weight: bold; }
-  #error {
-    display: none;
-    padding: 0.6em 1em;
-    background: #FDF3F3;
-    color: #C7484C;
-    font-size: 0.85em;
-    border-bottom: 1px solid #EFC7C7;
-    white-space: pre-wrap;
-  }
-  #content { flex: 1; display: flex; min-height: 0; }
-  #preview-pane {
-    flex: 1;
-    overflow: auto;
-    background: #E8EDF2;
-    display: flex;
-    justify-content: center;
-    padding: 1.5em;
-  }
-  #frame {
-    border: none;
-    background: white;
-    width: 100%;
-    max-width: 900px;
-    height: 100%;
-    box-shadow: 0 1px 4px rgba(0,0,0,0.15);
-    transition: max-width 0.15s ease;
-  }
-  #context-pane {
-    width: 340px;
-    min-width: 340px;
-    border-left: 1px solid var(--border);
-    display: flex;
-    flex-direction: column;
-    background: var(--bg);
-  }
-  #context-pane header {
-    display: flex;
-    align-items: center;
-    padding: 0.5em 0.8em;
-    font-size: 0.8em;
-    color: var(--text-medium);
-  }
-  #context-pane header span { margin-right: auto; text-transform: uppercase; letter-spacing: 0.06em; font-size: 0.85em; }
-  #context-pane header button {
-    font: inherit;
-    font-size: 0.95em;
-    border: none;
-    background: none;
-    color: var(--brand);
-    cursor: pointer;
-  }
-  #context {
-    flex: 1;
-    border: none;
-    border-top: 1px solid var(--border);
-    resize: none;
-    font-family: Menlo, Monaco, 'Courier New', monospace;
-    font-size: 11px;
-    line-height: 1.5;
-    padding: 0.8em;
-    color: var(--text-dark);
-    background: white;
-    outline: none;
-  }
-  #context.bad { background: #FDF3F3; }
-  #context-pane header .tab {
-    color: var(--text-medium);
-    padding: 0.1em 0.5em;
-    border-radius: 4px;
-  }
-  #context-pane header .tab.on { color: var(--brand); font-weight: bold; background: #EDF2F5; }
-  #fields {
-    flex: 1;
-    overflow-y: auto;
-    border-top: 1px solid var(--border);
-    background: white;
-    padding: 0.6em 0.8em 1.5em;
-  }
-  #fields label {
-    display: block;
-    font-size: 0.7em;
-    color: var(--text-medium);
-    margin: 0.9em 0 0.25em;
-    word-break: break-all;
-  }
-  #fields input[type=text], #fields textarea.field {
-    width: 100%;
-    font: inherit;
-    font-size: 0.8em;
-    padding: 0.35em 0.5em;
-    border: 1px solid var(--border);
-    border-radius: 4px;
-    color: var(--text-dark);
-  }
-  #fields textarea.field { resize: vertical; min-height: 3.2em; }
-  #fields .note {
-    font-size: 0.75em;
-    color: var(--text-medium);
-    margin-top: 1.2em;
-    line-height: 1.5;
-  }
-  #empty {
-    margin: auto;
-    color: var(--text-medium);
-    text-align: center;
-  }
-</style>
-</head>
-<body>
-  <nav id="sidebar">
-    <h1>📧 Email templates</h1>
-    <div id="template-list"></div>
-    <div class="group-label">Partials (shared header/footer)</div>
-    <div id="partial-list"></div>
-  </nav>
-  <div id="main">
-    <div id="toolbar">
-      <span class="name" id="current-name">—</span>
-      <button data-width="900">Desktop</button>
-      <button data-width="600">Narrow</button>
-      <button data-width="375">Phone</button>
-      <button id="copy-html" title="Copy rendered HTML to clipboard">Copy HTML</button>
-    </div>
-    <div id="error"></div>
-    <div id="content">
-      <div id="preview-pane">
-        <div id="empty">← Pick a template.<br><br>Edit the .hbs file in any editor and<br>the preview refreshes automatically.</div>
-        <iframe id="frame" hidden></iframe>
-      </div>
-      <div id="context-pane">
-        <header>
-          <span>Sample data</span>
-          <button class="tab on" data-tab="fields">Fields</button>
-          <button class="tab" data-tab="json">JSON</button>
-          <button id="reset-context" title="Discard edits, restore the default sample data">Reset</button>
-        </header>
-        <div id="fields"></div>
-        <textarea id="context" spellcheck="false" hidden></textarea>
-      </div>
-    </div>
-  </div>
-
-<script>
-'use strict';
-
-const TEMPLATE_DIR = '/src/metabase/channel/email/';
-const POLL_MS = 1000;
-
-// Used only if the server doesn't provide a directory listing.
-const FALLBACK_TEMPLATES = [
-  '_dashsub_alert_header', '_footer', '_header', '_logo', '_notification_card_condition',
-  'broken_subscription_notification', 'card_notification_archived', 'card_notification_changed_stopped',
-  'comment_created', 'creator_sentiment_email', 'dashboard_subscription', 'follow_up_email',
-  'login_from_new_device', 'mfa_disabled', 'mfa_enabled', 'mfa_login_code', 'mfa_removed_by_admin',
-  'new_user_invite', 'notification_card', 'notification_card_new_confirmation',
-  'notification_card_unsubscribed', 'notification_card_you_were_added', 'notification_card_you_were_removed',
-  'password_reset', 'persisted-model-error', 'security_advisory', 'slack_token_error',
-  'support_access_grant', 'transform_failed', 'transform_failure_digest', 'user_joined_notification',
-  'warn_deprecate_pulse',
-];
-
-// ---- Custom helpers, mirroring metabase.channel.template.handlebars-helper ----
-
-const SITE_URL = (window.COMMON_CONTEXT && window.COMMON_CONTEXT.siteUrl) || 'http://localhost:3000';
-
-Handlebars.registerHelper('equals', (x, y) => x === y || String(x) === String(y));
-Handlebars.registerHelper('now', () => new Date());
-Handlebars.registerHelper('initials', (name) => {
-  const m = String(name || '').match(/\b\w/g);
-  return m ? m.slice(0, 2).join('').toUpperCase() : '';
-});
-Handlebars.registerHelper('card-url', (id) => `${SITE_URL}/question/${id}`);
-Handlebars.registerHelper('dashboard-url', (id) => `${SITE_URL}/dashboard/${id}`);
-Handlebars.registerHelper('trash-url', () => `${SITE_URL}/trash`);
-// Approximates java-time formatting for the common tokens.
-Handlebars.registerHelper('format-date', (date, fmt) => {
-  const d = date instanceof Date ? date : new Date(date);
-  if (isNaN(d)) return String(date);
-  const pad = (n) => String(n).padStart(2, '0');
-  const MONTHS = ['January','February','March','April','May','June','July','August','September','October','November','December'];
-  const tokens = {
-    yyyy: d.getFullYear(), YYYY: d.getFullYear(),
-    MMMM: MONTHS[d.getMonth()], MMM: MONTHS[d.getMonth()].slice(0, 3), MM: pad(d.getMonth() + 1),
-    dd: pad(d.getDate()), d: d.getDate(),
-    HH: pad(d.getHours()), h: ((d.getHours() + 11) % 12) + 1,
-    mm: pad(d.getMinutes()), a: d.getHours() < 12 ? 'AM' : 'PM',
-  };
-  if (typeof fmt !== 'string') return d.toLocaleString();
-  return fmt.replace(/yyyy|YYYY|MMMM|MMM|MM|dd|d|HH|h|mm|a/g, (t) => tokens[t]);
-});
-
-// ---- State ----
-
-let allNames = [];
-let currentName = null;
-let sources = {};       // name -> .hbs source text
-let lastRenderedHtml = '';
-let contextDebounce = null;
-
-const $ = (sel) => document.querySelector(sel);
-const isPartial = (name) => name.startsWith('_');
-const partials = () => allNames.filter(isPartial);
-
-// ---- Template discovery & fetching ----
-
-async function fetchSource(name) {
-  const res = await fetch(TEMPLATE_DIR + name + '.hbs', { cache: 'no-store' });
-  if (!res.ok) throw new Error(`Could not load ${name}.hbs (HTTP ${res.status})`);
-  return res.text();
-}
-
-async function discoverTemplates() {
-  // Served by dev/email-preview/serve.ts (bun run email-dev).
-  try {
-    const res = await fetch('/templates.json', { cache: 'no-store' });
-    if (res.ok) {
-      const names = await res.json();
-      if (Array.isArray(names) && names.length) return names.sort();
-    }
-  } catch (e) { /* fall through */ }
-  // Any static server with directory listings (e.g. python3 -m http.server).
-  try {
-    const res = await fetch(TEMPLATE_DIR, { cache: 'no-store' });
-    const doc = new DOMParser().parseFromString(await res.text(), 'text/html');
-    const names = [...doc.querySelectorAll('a')]
-      .map((a) => a.getAttribute('href') || '')
-      .filter((h) => h.endsWith('.hbs'))
-      .map((h) => decodeURIComponent(h.split('/').pop().replace(/\.hbs$/, '')));
-    if (names.length) return names.sort();
-  } catch (e) { /* fall through */ }
-  return FALLBACK_TEMPLATES;
-}
-
-// ---- Context handling ----
-
-function deepMerge(a, b) {
-  if (Array.isArray(a) || Array.isArray(b) || typeof a !== 'object' || typeof b !== 'object' || !a || !b) {
-    return b === undefined ? a : b;
-  }
-  const out = { ...a };
-  for (const k of Object.keys(b)) out[k] = deepMerge(a[k], b[k]);
-  return out;
-}
-
-function defaultContext(name) {
-  const sample = (window.SAMPLE_CONTEXTS || {})[name] || {};
-  return deepMerge(window.COMMON_CONTEXT || {}, sample);
-}
-
-const storageKey = (name) => `email-preview:ctx:${name}`;
-
-function loadContextText(name) {
-  return localStorage.getItem(storageKey(name))
-      || JSON.stringify(defaultContext(name), null, 2);
-}
-
-function currentContext() {
-  return JSON.parse($('#context').value);
-}
-
-// ---- Fields form: a simple fill-in-the-blanks view over the same JSON ----
-
-function leafPaths(obj, prefix = []) {
-  const out = [];
-  for (const [k, v] of Object.entries(obj || {})) {
-    const path = [...prefix, k];
-    if (v !== null && typeof v === 'object' && !Array.isArray(v)) {
-      out.push(...leafPaths(v, path));
-    } else {
-      out.push({ path, value: v });
-    }
-  }
-  return out;
-}
-
-function setPath(obj, path, value) {
-  let o = obj;
-  for (const k of path.slice(0, -1)) o = o[k] ?? (o[k] = {});
-  o[path[path.length - 1]] = value;
-}
-
-let fieldDebounce = null;
-
-function updateFromField(path, value) {
-  clearTimeout(fieldDebounce);
-  fieldDebounce = setTimeout(() => {
-    let ctx;
-    try { ctx = currentContext(); } catch (e) { return; }
-    setPath(ctx, path, value);
-    $('#context').value = JSON.stringify(ctx, null, 2);
-    localStorage.setItem(storageKey(currentName), $('#context').value);
-    render();
-  }, 300);
-}
-
-function buildFieldsForm() {
-  const el = $('#fields');
-  el.innerHTML = '';
-  let ctx;
-  try {
-    ctx = currentContext();
-  } catch (e) {
-    el.innerHTML = '<div class="note">The JSON tab has a syntax error — fix it there first.</div>';
-    return;
-  }
-  for (const { path, value } of leafPaths(ctx)) {
-    const label = document.createElement('label');
-    label.textContent = path.join(' › ');
-    el.appendChild(label);
-    let input;
-    if (typeof value === 'boolean') {
-      input = document.createElement('input');
-      input.type = 'checkbox';
-      input.checked = value;
-      input.addEventListener('change', () => updateFromField(path, input.checked));
-    } else if (Array.isArray(value)) {
-      input = document.createElement('textarea');
-      input.className = 'field';
-      input.value = JSON.stringify(value, null, 2);
-      input.addEventListener('input', () => {
-        try { updateFromField(path, JSON.parse(input.value)); } catch (e) { /* keep typing */ }
-      });
-    } else {
-      const isLong = typeof value === 'string' && value.length > 60;
-      input = document.createElement(isLong ? 'textarea' : 'input');
-      if (isLong) { input.className = 'field'; } else { input.type = 'text'; }
-      input.value = value == null ? '' : String(value);
-      const wasNumber = typeof value === 'number';
-      input.addEventListener('input', () =>
-        updateFromField(path, wasNumber && input.value !== '' && !isNaN(input.value) ? Number(input.value) : input.value));
-    }
-    el.appendChild(input);
-  }
-  el.insertAdjacentHTML('beforeend',
-    '<div class="note">These are demo values — they only affect this preview, never real emails. ' +
-    'For arrays or new keys, use the JSON tab. Edits are saved in your browser; Reset restores the defaults.</div>');
-}
-
-// ---- Rendering ----
-
-function showError(msg) {
-  const el = $('#error');
-  el.textContent = msg;
-  el.style.display = 'block';
-}
-function clearError() { $('#error').style.display = 'none'; }
-
-function render() {
-  if (!currentName) return;
-  let ctx;
-  try {
-    ctx = currentContext();
-    $('#context').classList.remove('bad');
-  } catch (e) {
-    $('#context').classList.add('bad');
-    showError('Sample data is not valid JSON: ' + e.message);
-    return;
-  }
-  try {
-    for (const p of partials()) Handlebars.registerPartial(p, sources[p] ?? '');
-    const template = Handlebars.compile(sources[currentName] ?? '');
-    lastRenderedHtml = template(ctx);
-    clearError();
-  } catch (e) {
-    showError('Template error: ' + e.message);
-    return;
-  }
-  const frame = $('#frame');
-  const scrollY = frame.contentWindow ? frame.contentWindow.scrollY : 0;
-  frame.onload = () => frame.contentWindow.scrollTo(0, scrollY);
-  frame.srcdoc = lastRenderedHtml;
-  frame.hidden = false;
-  $('#empty').style.display = 'none';
-}
-
-// ---- Selection ----
-
-async function selectTemplate(name) {
-  currentName = name;
-  $('#current-name').textContent = name + '.hbs';
-  document.querySelectorAll('#sidebar button').forEach((b) =>
-    b.classList.toggle('active', b.dataset.name === name));
-  $('#context').value = loadContextText(name);
-  buildFieldsForm();
-  const needed = [name, ...partials()];
-  await Promise.all(needed.map(async (n) => { sources[n] = await fetchSource(n); }));
-  render();
-  history.replaceState(null, '', '#' + name);
-}
-
-// ---- Live reload: poll the current template + partials for changes ----
-
-setInterval(async () => {
-  if (!currentName) return;
-  let changed = false;
-  for (const n of [currentName, ...partials()]) {
-    try {
-      const text = await fetchSource(n);
-      if (text !== sources[n]) { sources[n] = text; changed = true; }
-    } catch (e) { /* transient; keep last good copy */ }
-  }
-  if (changed) render();
-}, POLL_MS);
-
-// ---- UI wiring ----
-
-$('#context').addEventListener('input', () => {
-  clearTimeout(contextDebounce);
-  contextDebounce = setTimeout(() => {
-    localStorage.setItem(storageKey(currentName), $('#context').value);
-    render();
-  }, 300);
-});
-
-$('#reset-context').addEventListener('click', () => {
-  localStorage.removeItem(storageKey(currentName));
-  $('#context').value = loadContextText(currentName);
-  buildFieldsForm();
-  render();
-});
-
-document.querySelectorAll('#context-pane .tab').forEach((btn) => {
-  btn.addEventListener('click', () => {
-    document.querySelectorAll('#context-pane .tab').forEach((b) => b.classList.remove('on'));
-    btn.classList.add('on');
-    const showFields = btn.dataset.tab === 'fields';
-    $('#fields').hidden = !showFields;
-    $('#context').hidden = showFields;
-    if (showFields) buildFieldsForm(); // pick up any JSON-tab edits
-  });
-});
-
-document.querySelectorAll('#toolbar button[data-width]').forEach((btn) => {
-  btn.addEventListener('click', () => {
-    document.querySelectorAll('#toolbar button[data-width]').forEach((b) => b.classList.remove('on'));
-    btn.classList.add('on');
-    $('#frame').style.maxWidth = btn.dataset.width + 'px';
-  });
-});
-
-$('#copy-html').addEventListener('click', async () => {
-  await navigator.clipboard.writeText(lastRenderedHtml);
-  $('#copy-html').textContent = 'Copied!';
-  setTimeout(() => { $('#copy-html').textContent = 'Copy HTML'; }, 1200);
-});
-
-// ---- Boot ----
-
-(async function init() {
-  if (typeof Handlebars === 'undefined') {
-    showError('Could not load handlebars.js from the CDN — this tool needs an internet connection.');
-    return;
-  }
-  allNames = await discoverTemplates();
-  const list = $('#template-list');
-  const plist = $('#partial-list');
-  for (const name of allNames) {
-    const btn = document.createElement('button');
-    btn.textContent = name;
-    btn.dataset.name = name;
-    btn.addEventListener('click', () => selectTemplate(name));
-    (isPartial(name) ? plist : list).appendChild(btn);
-  }
-  const fromHash = location.hash.slice(1);
-  if (fromHash && allNames.includes(fromHash)) selectTemplate(fromHash);
-})();
-</script>
-</body>
-</html>

dev/email-preview/sample-contexts.js

@@ -1,407 +0,0 @@
-/*
- * Default sample data for the email template preview tool (index.html).
- *
- * COMMON_CONTEXT mirrors `common-context` in metabase.channel.email.messages —
- * values every template receives. SAMPLE_CONTEXTS holds per-template extras,
- * shaped to match what each template's real render call site passes (see the
- * render calls in messages.clj, impl/email.clj, and the notification handlers
- * seeded in notification/seed.clj).
- *
- * These are demo values only — the preview never sends email. Tweak freely;
- * per-browser edits live in localStorage, this file is just the defaults.
- */
-
-const BUTTON_STYLE =
-  "display: inline-block; box-sizing: border-box; padding: 0.5rem 1.375rem; " +
-  "font-size: 1.063rem; font-weight: bold; text-decoration: none; cursor: pointer; " +
-  "color: #fff; border: 1px solid #509EE3; background-color: #509EE3; border-radius: 4px;";
-
-// Templates rendered through the notification pipeline get a snake_case
-// `context` map instead of the camelCase top-level keys.
-const NOTIFICATION_CONTEXT = {
-  application_name: "Metabase",
-  application_color: "#509EE3",
-  application_logo_url: "http://static.metabase.com/email_logo.png",
-  site_url: "http://localhost:3000",
-};
-
-const NOTIFICATION_STYLE = {
-  color_text_dark: "#4C5773",
-  color_text_medium: "#696E7B",
-  color_text_light: "#949AAB",
-};
-
-const CARD_PLACEHOLDER = (name) =>
-  `<div style="padding:2em;background:#f9fbfc;border:1px dashed #ccc;text-align:center;color:#949AAB;margin-bottom:1em;">[rendered card: ${name}]</div>`;
-
-window.COMMON_CONTEXT = {
-  applicationName: "Metabase",
-  applicationColor: "#509EE3",
-  applicationLogoUrl: "http://static.metabase.com/email_logo.png",
-  buttonStyle: BUTTON_STYLE,
-  colorTextLight: "#B8BBC3",
-  colorTextMedium: "#949AAB",
-  colorTextDark: "#4C5773",
-  siteUrl: "http://localhost:3000",
-};
-
-window.SAMPLE_CONTEXTS = {
-  // ---- Account & auth ----
-
-  mfa_enabled: {},
-  mfa_disabled: {},
-  mfa_removed_by_admin: {},
-  mfa_login_code: { code: "836114" },
-
-  password_reset: {
-    emailType: "password_reset",
-    logoHeader: true,
-    google: false,
-    nonGoogleSSO: false,
-    isActive: true,
-    passwordResetUrl: "http://localhost:3000/auth/reset_password/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-    adminEmail: "admin@example.com",
-    adminEmailSet: true,
-  },
-
-  login_from_new_device: {
-    context: NOTIFICATION_CONTEXT,
-    payload: { style: { color_text_dark: "#4C5773" } },
-    "first-name": "Meredith",
-    device: "Chrome (Mac OS X 10.15)",
-    location: "Oakland, California",
-    timestamp: "Friday, July 10, 2026 at 9:14 AM (PDT)",
-  },
-
-  new_user_invite: {
-    context: NOTIFICATION_CONTEXT,
-    payload: {
-      event_info: {
-        details: { invitor: { first_name: "Meredith", email: "meredith@example.com" } },
-        object: { is_from_setup: false },
-      },
-      custom: {
-        user_invited_join_url: "http://localhost:3000/auth/join/a1b2c3d4-e5f6-7890",
-        // Set a name here (and optionally invite_target_is_dashboard) to
-        // preview the "wants to share a question/dashboard" variant.
-        invite_target_name: "",
-        invite_target_is_dashboard: false,
-      },
-    },
-  },
-
-  user_joined_notification: {
-    context: NOTIFICATION_CONTEXT,
-    payload: { style: { color_text_dark: "#4C5773" } },
-    joinedUserName: "Oscar",
-    joinedViaSSO: false,
-    joinedUserEmail: "oscar@example.com",
-    joinedDate: "Friday, July 10",
-    adminEmail: "admin@example.com",
-    joinedUserEditUrl: "http://localhost:3000/admin/people",
-  },
-
-  // ---- Surveys & follow-ups ----
-
-  follow_up_email: {
-    emailType: "notification",
-    logoHeader: true,
-    heading: "We hope you've been enjoying Metabase.",
-    callToAction: "Would you mind taking a quick 5 minute survey to tell us how it's going?",
-    link: "https://metabase.com/feedback/active",
-  },
-
-  creator_sentiment_email: {
-    emailType: "notification",
-    logoHeader: true,
-    "first-name": "Meredith",
-    link: "https://metabase.com/feedback/creator",
-    "self-hosted": "http://localhost:3000",
-  },
-
-  // ---- Subscriptions & alerts ----
-
-  dashboard_subscription: {
-    context: { ...NOTIFICATION_CONTEXT, include_branding: true },
-    creator: { common_name: "Meredith Palmer" },
-    payload: {
-      dashboard: {
-        id: 12,
-        name: "Quarterly Revenue Overview",
-        description: "<p>Key revenue metrics, refreshed daily for the leadership team.</p>",
-      },
-      parameters: [
-        { id: "a1b2c3d4", name: "Date Range", value: "past30days" },
-        { id: "e5f6a7b8", name: "Category", value: "Gadget" },
-      ],
-      dashboard_subscription: { id: 301, disable_links: false },
-      style: NOTIFICATION_STYLE,
-    },
-    computed: {
-      icon_cid: "dashboard-icon@metabase", // cid: inline attachment; shows broken in browser
-      dashboard_has_tabs: false,
-      dashboard_content: CARD_PLACEHOLDER("Monthly Orders") + CARD_PLACEHOLDER("Revenue by Region"),
-      filters:
-        "<table cellpadding='0' cellspacing='0'><tr>" +
-        "<td style='font-size:12px;color:#949AAB;padding-right:12px;'><strong style='color:#696E7B;'>Date Range:</strong> Past 30 days</td>" +
-        "<td style='font-size:12px;color:#949AAB;'><strong style='color:#696E7B;'>Category:</strong> Gadget</td>" +
-        "</tr></table>",
-      management_text: "Manage your subscriptions",
-      management_url: "http://localhost:3000/account/notifications",
-    },
-  },
-
-  notification_card: {
-    context: { ...NOTIFICATION_CONTEXT, include_branding: true },
-    creator: { common_name: "Meredith Palmer" },
-    payload: {
-      card: { id: 42, name: "Monthly Orders" },
-      notification_card: { send_condition: "goal_above", send_once: true, disable_links: false },
-      style: NOTIFICATION_STYLE,
-    },
-    computed: {
-      icon_cid: "bell-icon@metabase", // cid: inline attachment; shows broken in browser
-      content: CARD_PLACEHOLDER("Monthly Orders"),
-      alert_schedule: "Run daily at 9:00 AM",
-      goal_value: 5000,
-      management_text: "Manage your subscriptions",
-      management_url: "http://localhost:3000/account/notifications",
-    },
-  },
-
-  notification_card_new_confirmation: {
-    emailType: "notification",
-    logoHeader: true,
-    payload: {
-      event_info: {
-        object: {
-          payload: {
-            card_id: 42,
-            card: { name: "Monthly Orders" },
-            send_condition: "has_result",
-            disable_links: false,
-          },
-        },
-      },
-    },
-  },
-
-  notification_card_unsubscribed: {
-    emailType: "notification",
-    logoHeader: true,
-    payload: { card_id: 42, card: { name: "Monthly Orders" } },
-  },
-
-  notification_card_you_were_added: {
-    emailType: "notification",
-    logoHeader: true,
-    payload: { card_id: 42, card: { name: "Monthly Orders" }, send_condition: "has_result" },
-  },
-
-  notification_card_you_were_removed: {
-    emailType: "notification",
-    logoHeader: true,
-    actor_name: "Meredith Palmer",
-    payload: { card_id: 42, card: { name: "Monthly Orders" }, disable_links: false },
-  },
-
-  card_notification_archived: {
-    emailType: "notification",
-    logoHeader: true,
-    card: { id: 42, name: "Monthly Orders" },
-    actor: { first_name: "Meredith", last_name: "Palmer" },
-    disable_links: false,
-  },
-
-  card_notification_changed_stopped: {
-    emailType: "notification",
-    logoHeader: true,
-    card: { id: 42, name: "Monthly Orders" },
-    actor: { first_name: "Meredith", last_name: "Palmer" },
-    disable_links: false,
-  },
-
-  broken_subscription_notification: {
-    emailType: "notification",
-    logoHeader: true,
-    dashboardName: "Quarterly Revenue Overview",
-    dashboardUrl: "http://localhost:3000/dashboard/12",
-    disable_links: false,
-    badParameters: [
-      { name: "Region", value: "West or Midwest" },
-      { name: "Product Category", value: "Gadget" },
-    ],
-    affectedUsers: [
-      { "notification-type": "email", recipient: "Meredith Palmer", role: "Dashboard Creator" },
-      { "notification-type": "email", recipient: "Oscar Nunez", role: "Subscription Creator" },
-    ],
-  },
-
-  warn_deprecate_pulse: {
-    emailType: "notification",
-    logoHeader: true,
-    userName: "Meredith Palmer",
-    instanceURL: "http://localhost:3000",
-    pulses: [
-      { name: "Weekly Sales Pulse", url: "http://localhost:3000/pulse/23" },
-      { name: "Support Ticket Volume", url: "http://localhost:3000/pulse/31" },
-    ],
-  },
-
-  // ---- Comments & collaboration ----
-
-  comment_created: {
-    context: NOTIFICATION_CONTEXT,
-    payload: {
-      style: { color_text_dark: "#4C5773" },
-      event_info: {
-        author: "Oscar Nunez",
-        parent_author: "Meredith Palmer",
-        entity_type: "document",
-        entity_title: "Q3 Planning Notes",
-        document_href: "/document/87",
-        comment_href: "/document/87?comment=214",
-        parent_comment: "<p>Should we fold the churn analysis into this doc, or keep it separate?</p>",
-        comment: "<p>Let's fold it in — I'll add a section under <strong>Retention</strong> this afternoon.</p>",
-      },
-    },
-  },
-
-  // ---- Admin & ops ----
-
-  security_advisory: {
-    emailType: "notification",
-    logoHeader: false,
-    context: {
-      ...NOTIFICATION_CONTEXT,
-      style: { button: BUTTON_STYLE },
-    },
-    payload: {
-      custom: {
-        severity_label: "Critical",
-        severity_color: "#E65050",
-        status_label: "Active",
-        security_center_url: "http://localhost:3000/admin/tools/security-center",
-      },
-      event_info: {
-        object: {
-          title: "SQL injection in embedded question parameters",
-          description:
-            "A vulnerability was identified that could allow specially crafted embedded question parameters " +
-            "to execute arbitrary SQL against connected databases. Your instance version matches the affected range.",
-          remediation: "Upgrade to Metabase 55.8.2 or later, or disable static embedding until you can upgrade.",
-          advisory_url: "https://www.metabase.com/security/advisories/MB-2026-0042",
-        },
-      },
-    },
-  },
-
-  slack_token_error: {
-    emailType: "notification",
-    logoHeader: false,
-    context: {
-      ...NOTIFICATION_CONTEXT,
-      style: { button: BUTTON_STYLE },
-    },
-  },
-
-  support_access_grant: {
-    context: NOTIFICATION_CONTEXT,
-    payload: {
-      style: { color_text_dark: "#4C5773" },
-      event_info: {
-        duration_minutes: 120,
-        grant_end_time: "2026-07-10T21:14:00Z",
-        notes:
-          "Investigating slow dashboard loads reported by the customer.\n" +
-          "Access limited to admin settings and query diagnostics.",
-        ticket_number: "SUP-18342",
-        password_reset_url: "http://localhost:3000/auth/reset_password/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-      },
-    },
-  },
-
-  "persisted-model-error": {
-    "database-name": "Sample Database",
-    errors: [
-      {
-        "is-not-first": false,
-        error: "Table 'orders_source' not found; it may have been renamed or dropped.",
-        "card-id": 42,
-        "card-name": "Monthly Orders",
-        "collection-name": "Finance",
-        "last-run-at": "July 10, 2026, 3:10 AM PDT",
-        "last-run-trigger": "Scheduled",
-        "card-url": "http://localhost:3000/question/42",
-        "collection-url": "http://localhost:3000/collection/7",
-        "caching-log-details-url": "http://localhost:3000/admin/tools/model-caching/101",
-      },
-      {
-        "is-not-first": true,
-        error: "Query timed out after 600 seconds.",
-        "card-id": 43,
-        "card-name": "Customer LTV",
-        "collection-name": "Finance",
-        "last-run-at": "July 10, 2026, 3:12 AM PDT",
-        "last-run-trigger": "Scheduled",
-        "card-url": "http://localhost:3000/question/43",
-        "collection-url": "http://localhost:3000/collection/7",
-        "caching-log-details-url": "http://localhost:3000/admin/tools/model-caching/102",
-      },
-    ],
-  },
-
-  transform_failed: {
-    context: NOTIFICATION_CONTEXT,
-    payload: {
-      style: { color_text_dark: "#4C5773" },
-      event_info: {
-        job_name: "Nightly Warehouse Refresh",
-        job_href: "http://localhost:3000/admin/transforms/jobs/7",
-        failures: [
-          {
-            transform_name: "Orders Enriched",
-            transform_href: "http://localhost:3000/admin/transforms/15/runs",
-            message: {
-              first_line: 'Column "discount_pct" does not exist in source table.',
-              details: [
-                "at stage 2 of 3 (join with promotions)",
-                "last successful run: July 9, 2026, 2:00 AM",
-              ],
-            },
-          },
-          {
-            transform_name: "Customer LTV Rollup",
-            transform_href: "http://localhost:3000/admin/transforms/16/runs",
-            message: { first_line: "Query timed out after 600 seconds.", details: [] },
-          },
-        ],
-      },
-    },
-  },
-
-  transform_failure_digest: {
-    context: NOTIFICATION_CONTEXT,
-    payload: {
-      style: { color_text_dark: "#4C5773" },
-      event_info: {
-        job_count: 2,
-        failure_count: 5,
-        jobs: [
-          {
-            job_name: "Nightly Warehouse Refresh",
-            job_href: "http://localhost:3000/admin/transforms/jobs/7",
-            failure_count: 3,
-            latest_error: 'Column "discount_pct" does not exist in source table.',
-          },
-          {
-            job_name: "Hourly Events Rollup",
-            job_href: "http://localhost:3000/admin/transforms/jobs/9",
-            failure_count: 2,
-            latest_error: "Query timed out after 600 seconds.",
-          },
-        ],
-      },
-    },
-  },
-};

dev/email-preview/serve.ts

@@ -1,60 +0,0 @@
-/**
- * Dev server for the email template preview tool.
- *
- *     bun run email-dev            # serves on :8455 and opens the browser
- *     PORT=9000 bun run email-dev
- *
- * Serves dev/email-preview/index.html, exposes the list of templates at
- * /templates.json, and serves the .hbs files themselves so the page can
- * fetch (and live-reload) them.
- */
-import { readdir } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-
-const REPO_ROOT = fileURLToPath(new URL("../..", import.meta.url));
-const PREVIEW_DIR = `${REPO_ROOT}dev/email-preview/`;
-const TEMPLATE_DIR = `${REPO_ROOT}src/metabase/channel/email/`;
-const PORT = Number(process.env.PORT || 8455);
-
-const server = Bun.serve({
-  port: PORT,
-  async fetch(req) {
-    const pathname = decodeURIComponent(new URL(req.url).pathname);
-    if (pathname.includes("..")) {
-      return new Response("bad path", { status: 400 });
-    }
-    if (pathname === "/" || pathname === "/index.html") {
-      return new Response(Bun.file(`${PREVIEW_DIR}index.html`));
-    }
-    if (pathname === "/sample-contexts.js") {
-      return new Response(Bun.file(`${PREVIEW_DIR}sample-contexts.js`));
-    }
-    if (pathname === "/templates.json") {
-      const names = (await readdir(TEMPLATE_DIR))
-        .filter((f) => f.endsWith(".hbs"))
-        .map((f) => f.replace(/\.hbs$/, ""))
-        .sort();
-      return Response.json(names);
-    }
-    // .hbs sources, fetched by the page as /src/metabase/channel/email/<name>.hbs
-    const file = Bun.file(REPO_ROOT + pathname.slice(1));
-    if (await file.exists()) {
-      return new Response(file, {
-        headers: { "cache-control": "no-store" },
-      });
-    }
-    return new Response("not found", { status: 404 });
-  },
-});
-
-const url = `http://localhost:${server.port}/`;
-console.log(`📧 Email template preview → ${url}`);
-console.log(`   Templates: src/metabase/channel/email/*.hbs (edits reload live)`);
-
-if (!process.env.EMAIL_DEV_NO_OPEN) {
-  const opener =
-    process.platform === "darwin" ? "open"
-    : process.platform === "win32" ? "start"
-    : "xdg-open";
-  Bun.spawn([opener, url], { stdout: "ignore", stderr: "ignore" });
-}

dev/notes/model-boundary-enforcement.md

@@ -166,7 +166,7 @@ Use the dev namespace to see what the config should contain:
 
 ```clojure
 (dev.model-boundary-config/compute-model-boundaries) ;; returns data
-(dev.modules-config/update-config!)                  ;; rewrite config.edn
+(dev.model-boundary-config/update-config!)           ;; rewrite config.edn
 ```
 
 ## Limitations and future directions

dev/resources/dev/modules_config_test/expected-config.edn

@@ -1,44 +0,0 @@
-;;
-;; Synthetic modules config used by dev.modules-config-test. Small, but structurally a full config:
-;; a header comment block plus a `:metabase/modules` map. Each module here is shaped to exercise a
-;; different branch of the rewriter (sentinel preservation, resorting, append, removal, comment
-;; preservation, and the library-module skip). See the test for the intent behind each.
-;;
-{:metabase/modules
- {alpha
-  {:team "Test Team"
-   ;; :api is a sentinel — must survive even though a real :api is computed for alpha.
-   :api  :any
-   ;; unsorted + carries an element comment; rewriting to sorted order drops the comment.
-   :uses #{beta gamma}
-   ;; stale: missing :model/Gamma, must be rewritten.
-   :model-imports #{:model/Beta :model/Gamma}
-   :model-exports #{:model/Alpha}}
-
-  beta
-  {:team "Test Team"
-   ;; :api missing entirely — must be appended.
-   :uses #{}
-   :model-exports #{:model/Beta}
-   :api #{metabase.beta.core}}
-
-  connection-pool
-  {:team "Test Team"
-   ;; Library-sourced module absent from the deps graph; the rewriter must leave it untouched.
-   :api  #{metabase.connection-pool}}
-
-  gamma
-  {:team "Test Team"
-   :api  :any
-   :uses :any
-   ;; bypass sentinel — preserved; also means gamma drives no model-imports.
-   :model-imports :bypass
-   :model-exports #{:model/Gamma}}
-
-  enterprise/zeta
-  {:team "Test Team"
-   :api  #{}
-   ;; already correct + sorted; the element comment must be preserved untouched.
-   :uses #{alpha ; core dependency
-           beta}
-   :model-imports #{:model/Alpha}}}}

dev/resources/dev/modules_config_test/input-config.edn

@@ -1,42 +0,0 @@
-;;
-;; Synthetic modules config used by dev.modules-config-test. Small, but structurally a full config:
-;; a header comment block plus a `:metabase/modules` map. Each module here is shaped to exercise a
-;; different branch of the rewriter (sentinel preservation, resorting, append, removal, comment
-;; preservation, and the library-module skip). See the test for the intent behind each.
-;;
-{:metabase/modules
- {alpha
-  {:team "Test Team"
-   ;; :api is a sentinel — must survive even though a real :api is computed for alpha.
-   :api  :any
-   ;; unsorted + carries an element comment; rewriting to sorted order drops the comment.
-   :uses #{gamma ; used heavily
-           beta}
-   ;; stale: missing :model/Gamma, must be rewritten.
-   :model-imports #{:model/Beta}}
-
-  beta
-  {:team "Test Team"
-   ;; :api missing entirely — must be appended.
-   :uses #{}
-   :model-exports #{:model/Beta}}
-
-  connection-pool
-  {:team "Test Team"
-   ;; Library-sourced module absent from the deps graph; the rewriter must leave it untouched.
-   :api  #{metabase.connection-pool}}
-
-  gamma
-  {:team "Test Team"
-   :api  :any
-   :uses :any
-   ;; bypass sentinel — preserved; also means gamma drives no model-imports.
-   :model-imports :bypass}
-
-  enterprise/zeta
-  {:team "Test Team"
-   :api  #{}
-   ;; already correct + sorted; the element comment must be preserved untouched.
-   :uses #{alpha ; core dependency
-           beta}
-   :model-exports #{:model/Zeta}}}}

dev/resources/dev/modules_config_test/mocks.edn

@@ -1,36 +0,0 @@
-;;
-;; Mock inputs for dev.modules-config-test — the four values dev.modules-config/compute-desired takes.
-;; Shaped like the real dev.deps-graph outputs, but tiny and hand-authored so the expected output is
-;; predictable. `:config` mirrors (kondo-config): connection-pool is intentionally absent (the deps graph
-;; dissocs it), which is what makes the rewriter leave that module untouched.
-;;
-{:config
- {alpha           {}
-  beta            {}
-  gamma           {:model-imports :bypass}
-  enterprise/zeta {}}
-
- ;; one entry per source file: {:module M :namespace NS :deps [{:module M :namespace NS} ...]}
- :dependencies
- [{:module alpha :namespace metabase.alpha.core
-   :deps [{:module beta :namespace metabase.beta.core}
-          {:module gamma :namespace metabase.gamma.core}]}
-  {:module beta :namespace metabase.beta.core :deps []}
-  {:module gamma :namespace metabase.gamma.core :deps []}
-  {:module enterprise/zeta :namespace metabase-enterprise.zeta.core
-   :deps [{:module alpha :namespace metabase.alpha.core}
-          {:module beta :namespace metabase.beta.core}]}]
-
- ;; {:model/X => owning module}
- :model-ownership
- {:model/Alpha alpha
-  :model/Beta  beta
-  :model/Gamma gamma
-  :model/Zeta  enterprise/zeta}
-
- ;; {module => #{models it references}}
- :model-references
- {alpha           #{:model/Alpha :model/Beta :model/Gamma}
-  beta            #{:model/Beta}
-  gamma           #{:model/Gamma :model/Alpha}
-  enterprise/zeta #{:model/Zeta :model/Alpha}}}

dev/src/dev/model_boundary_config.clj

@@ -9,9 +9,13 @@
 
   To update config.edn with computed model boundaries:
 
-    (dev.modules-config/update-config!)"
+    (dev.model-boundary-config/update-config!)"
   (:require
-   [dev.deps-graph :as deps-graph]))
+   [clojure.string :as str]
+   [dev.deps-graph :as deps-graph]
+   [rewrite-clj.node :as r.node]
+   [rewrite-clj.parser :as r.parser]
+   [rewrite-clj.zip :as z]))
 
 (set! *warn-on-reflection* true)
 
@@ -25,51 +29,133 @@
   `:model-imports` for module M = models owned by other modules that M references.
 
   Modules with `:model-imports :bypass` are excluded: they don't need computed imports, and their
-  references don't drive exports (models used only by bypass modules need not be exported).
+  references don't drive exports (models used only by bypass modules need not be exported)."
+  []
+  (let [config      (deps-graph/kondo-config)
+        ownership   (deps-graph/model-ownership)
+        module-refs (deps-graph/model-references-by-module)
+        all-modules (set (keys config))
+        bypass-modules (into #{}
+                             (keep (fn [[mod mod-config]]
+                                     (when (= (:model-imports mod-config) :bypass)
+                                       mod)))
+                             config)
+        ;; {:model/X => #{modules that reference it}} — inverted index for fast export lookups
+        ;; Only non-bypass modules drive exports.
+        model->referencing-modules
+        (reduce-kv (fn [acc mod models]
+                     (if (contains? bypass-modules mod)
+                       acc
+                       (reduce (fn [acc model]
+                                 (update acc model (fnil conj #{}) mod))
+                               acc
+                               models)))
+                   {}
+                   module-refs)]
+    {:model-exports
+     (into (sorted-map)
+           (for [mod all-modules
+                 :let [owned (into #{} (comp (filter (fn [[_ owner]] (= owner mod))) (map key)) ownership)]
+                 :when (seq owned)]
+             [mod (into (sorted-set)
+                        (for [model owned
+                              :let [refs (get model->referencing-modules model)]
+                              :when (some #(not= % mod) refs)]
+                          model))]))
+     :model-imports
+     (into (sorted-map)
+           (for [mod all-modules
+                 :when (not (contains? bypass-modules mod))
+                 :let [imported (into (sorted-set)
+                                      (for [model (get module-refs mod)
+                                            :let [defining-mod (get ownership model)]
+                                            :when (and defining-mod (not= defining-mod mod))]
+                                        model))]
+                 :when (seq imported)]
+             [mod imported]))}))
 
-  The 3-arity variant takes precomputed `config`, `ownership`, and `module-refs` so callers that already
-  have them (e.g. a single shared parse pass) can avoid re-parsing every source file."
-  ([]
-   (compute-model-boundaries (deps-graph/kondo-config)
-                             (deps-graph/model-ownership)
-                             (deps-graph/model-references-by-module)))
-  ([config ownership module-refs]
-   (let [all-modules (set (keys config))
-         bypass-modules (into #{}
-                              (keep (fn [[mod mod-config]]
-                                      (when (= (:model-imports mod-config) :bypass)
-                                        mod)))
-                              config)
-         ;; {:model/X => #{modules that reference it}} — inverted index for fast export lookups
-         ;; Only non-bypass modules drive exports.
-         model->referencing-modules
-         (reduce-kv (fn [acc mod models]
-                      (if (contains? bypass-modules mod)
-                        acc
-                        (reduce (fn [acc model]
-                                  (update acc model (fnil conj #{}) mod))
-                                acc
-                                models)))
-                    {}
-                    module-refs)]
-     {:model-exports
-      (into (sorted-map)
-            (for [mod all-modules
-                  :let [owned (into #{} (comp (filter (fn [[_ owner]] (= owner mod))) (map key)) ownership)]
-                  :when (seq owned)]
-              [mod (into (sorted-set)
-                         (for [model owned
-                               :let [refs (get model->referencing-modules model)]
-                               :when (some #(not= % mod) refs)]
-                           model))]))
-      :model-imports
-      (into (sorted-map)
-            (for [mod all-modules
-                  :when (not (contains? bypass-modules mod))
-                  :let [imported (into (sorted-set)
-                                       (for [model (get module-refs mod)
-                                             :let [defining-mod (get ownership model)]
-                                             :when (and defining-mod (not= defining-mod mod))]
-                                         model))]
-                  :when (seq imported)]
-              [mod imported]))})))
+(def ^:private config-path ".clj-kondo/config/modules/config.edn")
+
+(def ^:private set-indent
+  "Indentation for multi-line model sets — aligns with existing config.edn style."
+  (apply str (repeat 20 \space)))
+
+(defn- model-set-str
+  "Build a string representation of a sorted set of model keywords.
+  Short sets (<=3 items) stay on one line; longer sets get one item per line."
+  [models]
+  (let [sorted (sort models)]
+    (if (<= (count sorted) 3)
+      (str "#{" (str/join " " sorted) "}")
+      (str "#{" (str/join (str "\n" set-indent) sorted) "}"))))
+
+(defn- find-module-config
+  "Navigate from `root` to the config map for `module-sym`. Returns a zipper or nil."
+  [root module-sym]
+  (let [mods-zloc (-> (z/of-node root)
+                      (z/find-value z/next :metabase/modules)
+                      z/right)]
+    (z/find-value (z/down mods-zloc) z/right module-sym)))
+
+(defn- find-key-value
+  "Find the value zipper for keyword `k` inside a map zipper, or nil."
+  [map-zloc k]
+  (some-> (z/find-value (z/down map-zloc) z/right k)
+          z/right))
+
+(defn update-config!
+  "Compute model boundaries and update config.edn with `:model-exports` and `:model-imports` for all modules.
+
+  Only updates keys that already exist in the config — does not add new keys.
+  Uses rewrite-clj to manipulate the AST directly, preserving formatting."
+  []
+  (let [boundaries    (compute-model-boundaries)
+        root-zloc     (z/of-node (r.parser/parse-file-all config-path))
+        modules-zloc  (-> root-zloc
+                          (z/find-value z/next :metabase/modules)
+                          z/right)
+        module-syms   (loop [zloc (z/down modules-zloc), acc []]
+                        (if-not zloc
+                          acc
+                          (recur (some-> zloc z/right z/right)
+                                 (conj acc (z/sexpr zloc)))))
+        updated-root
+        (reduce
+         (fn [root module-sym]
+           (reduce
+            (fn [root config-key]
+              (let [mod-cfg  (some-> (find-module-config root module-sym) z/right)
+                    val-zloc (when mod-cfg (find-key-value mod-cfg config-key))
+                    computed (get-in boundaries [config-key module-sym] #{})]
+                (cond
+                  ;; Key exists with a non-set value (e.g. :bypass, :any) — leave it alone.
+                  (and val-zloc (not (set? (z/sexpr val-zloc))))
+                  root
+
+                  ;; Key exists with a set value — replace or remove.
+                  val-zloc
+                  (if (seq computed)
+                    (z/root (z/replace val-zloc (r.parser/parse-string (model-set-str computed))))
+                    (-> val-zloc z/remove z/remove z/root))
+
+                  ;; Key missing and nothing to add.
+                  (empty? computed)
+                  root
+
+                  ;; Key missing — append `<newline><indent>:key <set>` to the module config map,
+                  ;; splicing new children directly to avoid the separator spaces `append-child` inserts.
+                  :else
+                  (let [m-node       (z/node mod-cfg)
+                        new-children (concat (r.node/children m-node)
+                                             [(r.node/newlines 1)
+                                              (r.node/spaces 3)
+                                              (r.node/keyword-node config-key)
+                                              (r.node/spaces 1)
+                                              (r.parser/parse-string (model-set-str computed))])]
+                    (z/root (z/replace mod-cfg (r.node/replace-children m-node new-children)))))))
+            root
+            [:model-exports :model-imports]))
+         (z/root root-zloc)
+         module-syms)]
+    (spit config-path (z/root-string (z/of-node updated-root)))
+    (println "Updated" config-path "with :model-exports and :model-imports.")))

dev/src/dev/modules_config.clj

@@ -1,308 +0,0 @@
-(ns dev.modules-config
-  "Generate/repair `.clj-kondo/config/modules/config.edn` so it passes `metabase.core.modules-test`.
-
-  The heavy lifting already lives in [[dev.deps-graph]] (which computes the correct `:api` and `:uses`
-  for every module) and [[dev.model-boundary-config]] (which computes `:model-exports`/`:model-imports`).
-  This namespace ties them together into a single writer that rewrites the four *generated* keys in place,
-  sorted, while preserving everything a human owns: `:team`, `:friends`, header/footer comments, inline
-  `;;` annotations on set elements, the `:ignored-namespace-patterns` key, and the sentinel values
-  `:any`/`:bypass`.
-
-  Usage:
-
-    (dev.modules-config/update-config!)   ; from a warm REPL — fast
-
-  Or from a cold JVM (see `./bin/mage fix-modules-config`):
-
-    clojure -X:dev dev.modules-config/-main
-
-  Scope: this auto-fixes the *content and ordering* of `:api`, `:uses`, `:model-exports`, and
-  `:model-imports` for modules that already exist in the config. Structural changes — adding a brand new
-  module (which needs a human-assigned `:team`), removing a stale one, or reordering modules — are only
-  *reported* as warnings, never performed, since they require judgement this tool doesn't have."
-  (:require
-   [clojure.string :as str]
-   [dev.deps-graph :as deps-graph]
-   [dev.model-boundary-config :as mbc]
-   [rewrite-clj.node :as n]
-   [rewrite-clj.parser :as r.parser]
-   [rewrite-clj.zip :as z]))
-
-(set! *warn-on-reflection* true)
-
-(def ^:private config-path ".clj-kondo/config/modules/config.edn")
-
-(def ^:private generated-keys
-  "The keys this tool owns and rewrites. Order matters only for where appended keys land."
-  [:api :uses :model-exports :model-imports])
-
-;;;; ---------------------------------------------------------------------------
-;;;; Ordering — must match `metabase.core.modules-test`
-;;;; ---------------------------------------------------------------------------
-
-(defn- enterprise? [module-name]
-  (str/starts-with? (str module-name) "enterprise/"))
-
-(defn- sort-module-names
-  "Sort module symbols with `enterprise/` modules last. Mirrors the test's `sort-module-names`."
-  [module-names]
-  (sort-by (juxt #(if (enterprise? %) 1 0) str) module-names))
-
-(defn- sort-for-key
-  "Return the sorted element vector for a generated key. `:uses` sorts modules enterprise-last; everything
-  else (namespace symbols for `:api`, `:model/X` keywords for the model keys) sorts naturally."
-  [k elements]
-  (vec (if (= k :uses)
-         (sort-module-names elements)
-         (sort elements))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Set nodes
-;;;; ---------------------------------------------------------------------------
-
-(defn- set-elements
-  "Ordered vector of element sexprs in a `:set` node, in file order. (`z/sexpr` would return an unordered
-  set, useless for the sortedness comparison.)"
-  [set-node]
-  (into [] (comp (filter #(= :token (n/tag %))) (map n/sexpr))
-        (n/children set-node)))
-
-(defn- build-set-node
-  "rewrite-clj `:set` node for `sorted-elements`. Small sets (<=3) stay inline; larger ones go one element
-  per line, continuation lines indented `indent` spaces to align under the first element. Matches the
-  hand-formatting convention used throughout config.edn (and by [[dev.model-boundary-config]])."
-  [sorted-elements indent]
-  (r.parser/parse-string
-   (if (<= (count sorted-elements) 3)
-     (str "#{" (str/join " " sorted-elements) "}")
-     (let [pad (apply str (repeat indent \space))]
-       (str "#{" (str/join (str "\n" pad) sorted-elements) "}")))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Zipper navigation
-;;;; ---------------------------------------------------------------------------
-
-(defn- modules-map-zloc
-  "Zipper at the `:metabase/modules` map value."
-  [root-node]
-  (-> (z/of-node root-node)
-      (z/find-value z/next :metabase/modules)
-      z/right))
-
-(defn- module-config-zloc
-  "Zipper at the config map for `module-sym`, or nil."
-  [root-node module-sym]
-  (some-> (z/find-value (z/down (modules-map-zloc root-node)) z/right module-sym)
-          z/right))
-
-(defn- key-value-zloc
-  "Zipper at the value of `k` inside a map zipper, or nil."
-  [map-zloc k]
-  (some-> (z/find-value (z/down map-zloc) z/right k)
-          z/right))
-
-(defn- module-syms-in-order
-  "Vector of module symbols in file order (skips non-symbol keys like `:ignored-namespace-patterns`)."
-  [root-node]
-  (loop [zloc (z/down (modules-map-zloc root-node)), acc []]
-    (if-not zloc
-      acc
-      (let [k (z/sexpr zloc)]
-        (recur (some-> zloc z/right z/right)
-               (cond-> acc (symbol? k) (conj k)))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Editing
-;;;; ---------------------------------------------------------------------------
-
-(defn- append-indent
-  "Continuation indent for a freshly appended `:key #{...}` line: aligns elements under the first one."
-  [k]
-  ;; "   :key " + "#{" -> element starts two columns past `#`
-  (+ 3 (count (str k)) 1 2))
-
-(defn- update-module-key
-  "Rewrite one generated `key` of one module in `root-node`, returning the new root node.
-  `computed` is the desired set (possibly empty). `indent` is the continuation indent for an existing set
-  (from its `#{` column) or nil to fall back to an appended-key indent."
-  [root-node module-sym k computed indent]
-  (let [map-zloc (module-config-zloc root-node module-sym)
-        val-zloc (when map-zloc (key-value-zloc map-zloc k))]
-    (cond
-      ;; No such module (structural — handled/warned elsewhere).
-      (nil? map-zloc) root-node
-
-      ;; Sentinel value (`:any`/`:bypass`) — human-owned, leave untouched.
-      (and val-zloc (not (set? (z/sexpr val-zloc)))) root-node
-
-      ;; Existing set value.
-      val-zloc
-      (let [elements (set-elements (z/node val-zloc))
-            target   (sort-for-key k computed)]
-        (cond
-          (empty? computed)
-          (if (#{:model-exports :model-imports} k)
-            ;; Model keys default to absent; drop the now-empty key entirely.
-            (-> val-zloc z/remove z/remove z/root)
-            ;; :api/:uses stay explicit; normalize to `#{}` only if not already empty.
-            (if (empty? elements)
-              root-node
-              (z/root (z/replace val-zloc (n/set-node [])))))
-
-          ;; Already correct and sorted — leave the node (and its comments) byte-for-byte.
-          (= elements target) root-node
-
-          :else
-          (z/root (z/replace val-zloc (build-set-node target (or indent (append-indent k)))))))
-
-      ;; Key missing but needed — append it to the module's config map.
-      (empty? computed) root-node
-
-      :else
-      (let [m-node   (z/node map-zloc)
-            set-node (build-set-node (sort-for-key k computed) (append-indent k))
-            children (concat (n/children m-node)
-                             [(n/newlines 1) (n/spaces 3)
-                              (n/keyword-node k) (n/spaces 1) set-node])]
-        (z/root (z/replace map-zloc (n/replace-children m-node children)))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Indents (captured from the pristine, position-tracked parse)
-;;;; ---------------------------------------------------------------------------
-
-(defn- collect-indents
-  "Map of `[module-sym key]` -> continuation-indent (spaces) for every existing generated set value,
-  read from element `#{` columns so rebuilt sets align exactly like their neighbours. Navigates the
-  position-tracked zipper `pos-root` directly (re-wrapping via `z/of-node` would drop positions)."
-  [pos-root]
-  (let [mods (-> pos-root (z/find-value z/next :metabase/modules) z/right)]
-    (loop [zloc (z/down mods), acc {}]
-      (if-not zloc
-        acc
-        (let [k    (z/sexpr zloc)
-              vmap (z/right zloc)]
-          (recur (some-> vmap z/right)
-                 (if (symbol? k)
-                   (reduce
-                    (fn [acc gk]
-                      (let [vz (some-> (z/find-value (z/down vmap) z/right gk) z/right)]
-                        (if (and vz (= :set (z/tag vz)))
-                          (assoc acc [k gk] (inc (second (z/position vz))))
-                          acc)))
-                    acc
-                    generated-keys)
-                   acc)))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Compute the desired config (single shared parse pass)
-;;;; ---------------------------------------------------------------------------
-
-(defn compute-desired
-  "Compute the desired value of every generated key for every module.
-
-  Returns `{module-sym {:api set, :uses set, :model-exports set, :model-imports set}}`.
-
-  The 4-arity is pure: it derives the answer purely from the four inputs (the parsed Kondo `config`, the
-  `dependencies` file-scan, `model-ownership`, and `model-references`), so it can be exercised in tests
-  with mock data and no file or REPL state. The 0-arity gathers those four inputs from [[dev.deps-graph]]
-  for real, running the independent file-scanning passes concurrently so a warm REPL finishes in a few
-  seconds."
-  ([]
-   (let [config (deps-graph/kondo-config)
-         f-deps (future (deps-graph/dependencies))
-         f-own  (future (deps-graph/model-ownership))
-         f-refs (future (deps-graph/model-references-by-module))]
-     (compute-desired config @f-deps @f-own @f-refs)))
-  ([config dependencies model-ownership model-references]
-   (let [api+uses   (deps-graph/generate-config dependencies config)
-         boundaries (mbc/compute-model-boundaries config model-ownership model-references)
-         modules    (into #{} (concat (keys api+uses)
-                                      (keys (:model-exports boundaries))
-                                      (keys (:model-imports boundaries))))]
-     (into {}
-           (map (fn [module]
-                  [module {:api            (get-in api+uses [module :api] #{})
-                           :uses           (get-in api+uses [module :uses] #{})
-                           :model-exports  (get-in boundaries [:model-exports module] #{})
-                           :model-imports  (get-in boundaries [:model-imports module] #{})}]))
-           modules))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Structural warnings (things this tool won't auto-fix)
-;;;; ---------------------------------------------------------------------------
-
-(defn- structural-warnings
-  "Sequence of human-readable warnings for structural mismatches this tool won't touch."
-  [file-modules desired]
-  (let [file-set    (set file-modules)
-        desired-set (set (keys desired))
-        to-add      (sort (remove file-set desired-set))
-        ;; a desired module absent from the file needs adding; but connection-pool etc. legitimately live
-        ;; only in the file, so only flag file modules that produced *no* generated data as candidates.
-        sorted?     (= file-modules (sort-module-names file-modules))]
-    (cond-> []
-      (seq to-add)
-      (conj (str "New module(s) not in config — add them by hand (they need a :team): "
-                 (str/join ", " to-add)))
-
-      (not sorted?)
-      (conj "Modules are not sorted by name (enterprise/ last) — reorder them by hand."))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Entry point
-;;;; ---------------------------------------------------------------------------
-
-(defn rewrite-config
-  "Pure core of the tool. Given the current config.edn `original` text and the `desired` per-module
-  generated-key map (see [[compute-desired]]), return
-
-    {:text     the rewritten config text
-     :warnings [human-readable strings for structural mismatches this tool won't touch]}
-
-  Idempotent: a config already matching `desired` yields `:text` byte-for-byte equal to `original`. Only
-  modules present in `desired` are touched, so library-sourced entries like `connection-pool` (dissoc'd
-  from the deps graph) are left alone."
-  [original desired]
-  (let [pos-root     (z/of-string original {:track-position? true})
-        indents      (collect-indents pos-root)
-        ;; full `:forms` node: keeps the header/footer comment blocks that surround the top-level map.
-        full-root    (z/root pos-root)
-        file-modules (module-syms-in-order full-root)
-        edited       (reduce
-                      (fn [root-node module-sym]
-                        (reduce
-                         (fn [root-node k]
-                           (update-module-key root-node module-sym k
-                                              (get-in desired [module-sym k] #{})
-                                              (get indents [module-sym k])))
-                         root-node
-                         generated-keys))
-                      full-root
-                      (filter desired file-modules))]
-    {:text     (n/string edited)
-     :warnings (structural-warnings file-modules desired)}))
-
-(defn update-config!
-  "Rewrite `.clj-kondo/config/modules/config.edn` so the generated keys are correct and sorted.
-  Idempotent: a clean config is left byte-for-byte unchanged. Returns `:updated` or `:unchanged`."
-  []
-  (let [original                (slurp config-path)
-        {:keys [text warnings]} (rewrite-config original (compute-desired))]
-    #_{:clj-kondo/ignore [:discouraged-var]}
-    (doseq [w warnings]
-      (println (str "WARNING: " w)))
-    (if (= text original)
-      (do #_{:clj-kondo/ignore [:discouraged-var]}
-       (println "config.edn already up to date.")
-          :unchanged)
-      (do (spit config-path text)
-          #_{:clj-kondo/ignore [:discouraged-var]}
-          (println "Updated" config-path)
-          :updated))))
-
-(defn fix-config!
-  "Cold-JVM entry point for `clojure -X:dev dev.modules-config/fix-config!`. Takes (and ignores) the
-  `-X` exec-args map."
-  [_]
-  (update-config!)
-  (shutdown-agents))

dev/src/dev/mq_perf.clj

@@ -1,273 +0,0 @@
-(ns dev.mq-perf
-  "Load/perf harness for the **Quartz** MQ backend (`metabase.mq.queue.quartz`).
-
-  Unlike the old appdb harness this drives the real Quartz path: each published batch becomes a
-  trigger on a per-queue durable job, fired by Quartz's worker pool. It therefore needs a running
-  Quartz scheduler with the JDBC JobStore — i.e. run it inside a normal dev system (the dev REPL
-  already has `db` + scheduler + mq up) rather than the old `start-mq!` standalone mode.
-
-  Key thing to watch: the publish buffer coalesces messages published close together into one
-  batch (one trigger carrying up to `:max-batch-messages` messages). So Quartz fires far fewer
-  triggers than there are messages — the benchmarks report both message throughput and the trigger
-  count / coalescing factor, since the trigger rate is what actually stresses the QRTZ_* tables.
-
-  Transactional modes (`:mode`): every benchmark takes a `:mode` selecting which publish path in
-  `metabase.mq.publish` it drives — this is what makes the QRTZ pressure differ dramatically:
-
-    :none-no-txn — `:never` queue, published *outside* a transaction. Immediate publish through the
-                   sliding-window buffer, which coalesces across publishers (few, fat triggers).
-    :none-in-txn — `:never` queue, published *inside* a transaction. Deferred to after-commit (in
-                   memory, no outbox table), then goes through the same buffer — still coalesced.
-    :require     — `:require` queue, published *inside* a transaction (mandatory — throws otherwise).
-                   Messages are written to the `queue_message_outbox` table in the business txn and
-                   published *directly to the backend at commit*, BYPASSING the buffer. So there is
-                   no cross-transaction coalescing: one committed publish ≈ one trigger. This is the
-                   durable path, and its trigger rate tracks the message rate — the QRTZ tables feel
-                   every message. (See the perf note on `def-queue!`.)
-
-  So the same message rate produces wildly different trigger counts across modes; the benchmarks
-  report `:mode`, triggers fired, and the coalescing factor so the tradeoff is visible.
-
-  Usage (in the dev REPL, with the system started):
-
-    (require 'dev.mq-perf)
-    (dev.mq-perf/run-all!)                 ; sweeps every mode
-    (dev.mq-perf/bench-sustained! {:duration-sec 10 :target-msgs-sec 2000 :mode :require})
-    (dev.mq-perf/bench-e2e-latency! {:n 500 :msgs-sec 500 :mode :none-in-txn})
-    (dev.mq-perf/bench-publish-throughput! {:n 5000 :mode :none-no-txn})"
-  (:require
-   [metabase.mq.core :as mq]
-   [metabase.mq.listener :as listener]
-   [metabase.mq.publish-buffer :as publish-buffer]
-   [metabase.mq.queue.quartz :as q.quartz]
-   [metabase.mq.queue.registry :as q.registry]
-   [metabase.task.core :as task]
-   [metabase.util.log :as log]
-   [toucan2.core :as t2])
-  (:import
-   (org.quartz JobKey JobListener Scheduler)
-   (org.quartz.impl.matchers GroupMatcher)))
-
-(set! *warn-on-reflection* true)
-
-;;; --------------------------------------------- helpers ---------------------------------------------
-
-(defn- ensure-queue!
-  ([ch] (ensure-queue! ch {:transactional :try}))
-  ([ch config] (when-not (q.registry/get-queue ch) (q.registry/register-queue! ch config))))
-
-(def scenarios
-  "Publish paths the harness exercises, each selecting a distinct route through
-  `metabase.mq.publish/publish-collected!`. `:transactional` is the queue's declared mode; `:in-txn?`
-  is whether the benchmark wraps each publish in a DB transaction. See the ns docstring for details."
-  {:none-no-txn {:transactional :never   :in-txn? false}
-   :none-in-txn {:transactional :never   :in-txn? true}
-   :require     {:transactional :require :in-txn? true}})
-
-(defn- scenario-queue
-  "Per-mode queue name, so the three modes never collide on config (a queue is registered once)."
-  [base mode]
-  (keyword "queue" (str base "-" (name mode))))
-
-(defn- mode-config
-  "Queue config for `mode`, merged with any `extra` (e.g. `:max-batch-messages`)."
-  [mode extra]
-  (merge {:transactional (:transactional (scenarios mode))} extra))
-
-(defn- putter
-  "Returns `(fn [msg])` publishing one message to `ch` on `mode`'s path — wrapping the publish in a DB
-  transaction for the transactional modes so `:require` hits the outbox and `:none-in-txn` hits the
-  after-commit defer."
-  [ch mode]
-  (if (:in-txn? (scenarios mode))
-    (fn [msg] (t2/with-transaction [_conn] (mq/with-queue ch [q] (mq/put q msg))))
-    (fn [msg] (mq/with-queue ch [q] (mq/put q msg)))))
-
-(defn- outbox-depth
-  "Rows still sitting in the transactional outbox for `ch` — should be 0 after a clean run (the
-  after-commit path deletes each row once it's published). A non-zero value means publishes are being
-  left for the recovery sweep, i.e. the backend couldn't keep up at commit time."
-  [ch]
-  (t2/count :queue_message_outbox :queue_name (name ch)))
-
-(defn- pct [sorted p]
-  (when (seq sorted)
-    (nth sorted (min (dec (count sorted)) (long (* p (count sorted)))))))
-
-(defn- stats [xs]
-  (let [s (vec (sort xs))]
-    {:n (count s) :min (first s) :max (peek s)
-     :p50 (pct s 0.50) :p95 (pct s 0.95) :p99 (pct s 0.99)
-     :avg (when (seq s) (/ (reduce + 0.0 s) (count s)))}))
-
-(defn- fmt [x] (when x (format "%.2f" (double x))))
-
-(defn- publish-at-rate!
-  "Calls `(f i)` `n` times, pacing to ~`msgs-sec` (nil = as fast as possible)."
-  [n msgs-sec f]
-  (let [interval-ns (when (and msgs-sec (pos? msgs-sec)) (long (/ 1e9 msgs-sec)))
-        start       (System/nanoTime)]
-    (dotimes [i n]
-      (f i)
-      (when interval-ns
-        (let [target (+ start (* (long (inc i)) interval-ns))
-              now    (System/nanoTime)]
-          (when (> target now)
-            (let [sleep-ms (long (/ (- target now) 1e6))]
-              (when (pos? sleep-ms) (Thread/sleep sleep-ms)))))))))
-
-(defn- do-with-trigger-count!
-  "Counts actual Quartz job executions (= triggers fired) in the mq group while `thunk` runs, via a
-  temporary JobListener. Returns `[thunk-result trigger-count]`. This is the true trigger rate — not
-  the listener-invocation count, which is inflated by max-batch-messages slicing."
-  [thunk]
-  (let [^Scheduler scheduler (task/scheduler)
-        counter   (atom 0)
-        lname     "mq-perf-trigger-counter"
-        jl        (reify JobListener
-                    (getName [_] lname)
-                    (jobToBeExecuted [_ _ctx])
-                    (jobExecutionVetoed [_ _ctx])
-                    (jobWasExecuted [_ _ctx _ex] (swap! counter inc)))]
-    (.addJobListener (.getListenerManager scheduler) jl (GroupMatcher/jobGroupEquals "metabase.mq.queue"))
-    (try
-      [(thunk) @counter]
-      (finally (.removeJobListener (.getListenerManager scheduler) lname)))))
-
-(defn clean!
-  "Unlisten + drop all `:queue/bench-*` queues and delete their durable Quartz jobs (and any
-  leftover triggers) so a benchmark run leaves the scheduler tidy.
-
-  Also evicts the bench queues from the quartz backend's private `ensured-jobs` process cache. That
-  cache is deliberately trusted over the scheduler on the publish hot path, so without this eviction
-  a *re-run* of a same-named benchmark would skip recreating the just-deleted durable job and every
-  publish would throw `JobPersistenceException` (silently dropped by the publish buffer → 0 delivered)."
-  []
-  (doseq [ch (keys @q.registry/*queues*)
-          :when (.startsWith (name ch) "bench-")]
-    (try (mq/unlisten! ch) (catch Throwable _))
-    (swap! q.registry/*queues* dissoc ch))
-  ;; `ensured-jobs` is private to the quartz backend; reach it via its var (dev harness only).
-  (swap! @#'q.quartz/ensured-jobs (fn [s] (into #{} (remove (fn [[ch _]] (.startsWith (name ch) "bench-"))) s)))
-  (when-let [^Scheduler scheduler (task/scheduler)]
-    (doseq [^JobKey jk (.getJobKeys scheduler (GroupMatcher/jobGroupEquals "metabase.mq.queue"))
-            :when (.startsWith (.getName jk) "bench-")]
-      (.deleteJob scheduler jk))))
-
-;;; --------------------------------------------- benchmarks ---------------------------------------------
-
-(defn bench-publish-throughput!
-  "How fast can the publish side enqueue + schedule triggers? Publishes `n` single-message batches
-  as fast as possible (buffer flushed at the end), measuring publish-side msgs/sec. Does not wait
-  for delivery. `:mode` selects the publish path (see [[scenarios]]); the transactional modes pay a
-  DB round-trip per message, so this is where their per-publish cost shows up."
-  [{:keys [n mode] :or {n 5000 mode :none-no-txn}}]
-  (let [ch  (scenario-queue "bench-pub" mode)
-        put (putter ch mode)]
-    (ensure-queue! ch (mode-config mode nil))
-    (let [start (System/nanoTime)]
-      (publish-at-rate! n nil (fn [i] (put {:i i})))
-      (publish-buffer/flush-publish-buffer!)
-      (let [secs (/ (- (System/nanoTime) start) 1e9)]
-        {:bench :publish-throughput :mode mode :n n
-         :elapsed-sec (fmt secs) :msgs-sec (fmt (/ n secs))}))))
-
-(defn bench-e2e-latency!
-  "Publishes `n` messages at ~`msgs-sec` and measures publish->receive latency (ms) percentiles
-  through the full pipeline (buffer -> quartz trigger -> worker thread -> listener)."
-  [{:keys [n msgs-sec mode] :or {n 500 msgs-sec 500 mode :none-no-txn}}]
-  (let [ch        (scenario-queue "bench-e2e" mode)
-        put       (putter ch mode)
-        latencies (atom [])
-        received  (atom 0)]
-    (ensure-queue! ch (mode-config mode nil))
-    (listener/batch-listen! ch (fn [msgs]
-                                 (let [now (System/nanoTime)]
-                                   (doseq [m msgs]
-                                     (when-let [p (:pub-ns m)]
-                                       (swap! latencies conj (/ (- now (double p)) 1e6)))
-                                     (swap! received inc)))))
-    (try
-      (publish-at-rate! n msgs-sec (fn [_] (put {:pub-ns (System/nanoTime)})))
-      (publish-buffer/flush-publish-buffer!)
-      (let [deadline (+ (System/currentTimeMillis) 30000)]
-        (while (and (< @received n) (< (System/currentTimeMillis) deadline))
-          (Thread/sleep 50)))
-      (merge {:bench :e2e-latency :mode mode :published n :received @received :target-msgs-sec msgs-sec}
-             (update-vals (select-keys (stats @latencies) [:p50 :p95 :p99 :min :max :avg]) fmt))
-      (finally (mq/unlisten! ch)))))
-
-(defn bench-sustained!
-  "Publishes at ~`target-msgs-sec` for `duration-sec`, then drains. Reports delivered messages/sec,
-  the number of Quartz triggers actually fired, and the resulting coalescing factor (messages per
-  trigger). `:mode` selects the publish path (see [[scenarios]]): the buffered modes coalesce so the
-  trigger rate stays flat, while `:require` publishes each committed batch straight to the backend so
-  the trigger rate tracks the message rate — compare `:triggers-sec` / `:msgs-per-trigger` across
-  modes to see the QRTZ pressure tradeoff. `:outbox-remaining` should be 0 (rows deleted on publish)."
-  [{:keys [duration-sec target-msgs-sec max-batch mode]
-    :or   {duration-sec 10 target-msgs-sec 2000 max-batch 100 mode :none-no-txn}}]
-  (let [ch       (scenario-queue (str "bench-sustained-mb" max-batch) mode)
-        put      (putter ch mode)
-        received (atom 0)]
-    (ensure-queue! ch (mode-config mode {:max-batch-messages max-batch}))
-    (listener/batch-listen! ch (fn [msgs] (swap! received + (count msgs))))
-    (try
-      (let [n (* duration-sec target-msgs-sec)
-            [result triggers]
-            (do-with-trigger-count!
-             (fn []
-               (let [start (System/nanoTime)]
-                 (publish-at-rate! n target-msgs-sec (fn [i] (put {:i i})))
-                 (publish-buffer/flush-publish-buffer!)
-                 (let [pub-secs (/ (- (System/nanoTime) start) 1e9)
-                       deadline (+ (System/currentTimeMillis) 60000)]
-                   (while (and (< @received n) (< (System/currentTimeMillis) deadline))
-                     (Thread/sleep 100))
-                   {:pub-secs pub-secs :total-secs (/ (- (System/nanoTime) start) 1e9)}))))]
-        {:bench :sustained :mode mode :target-msgs-sec target-msgs-sec :duration-sec duration-sec :max-batch max-batch
-         :published n :received @received :outbox-remaining (outbox-depth ch)
-         :publish-sec (fmt (:pub-secs result)) :total-sec (fmt (:total-secs result))
-         :delivered-msgs-sec (fmt (/ @received (:total-secs result)))
-         :triggers-fired triggers
-         :triggers-sec (fmt (/ triggers (:total-secs result)))
-         :msgs-per-trigger (fmt (/ @received (max 1 triggers)))})
-      (finally (mq/unlisten! ch)))))
-
-(defn start-system!
-  "Headless bootstrap for a benchmark node: app DB + Quartz scheduler + MQ subsystem (no Jetty).
-  Idempotent enough for a fresh process. Point `MB_DB_*` at a DEDICATED database — running several
-  nodes against the same DB exercises Quartz clustering, but aiming at a live instance's DB would
-  make this node also run that instance's scheduled jobs."
-  []
-  ((requiring-resolve 'metabase.app-db.core/setup-db!) :create-sample-content? false)
-  ((requiring-resolve 'metabase.task.core/start-scheduler!))
-  (require 'metabase.mq.init)
-  ;; invoking the startup-logic method for ::MqStart runs mq.init/start!
-  ((requiring-resolve 'metabase.startup.core/def-startup-logic!) :metabase.mq.init/MqStart)
-  (log/info "MQ benchmark node started (DB + scheduler + MQ)."))
-
-(defn run-modes!
-  "Runs the sustained throughput benchmark across all three [[scenarios]] at the same message rate so
-  the QRTZ-pressure tradeoff is directly comparable. `clean!`s between modes so each starts fresh.
-  `:require` pays a DB round-trip per publish, so it defaults to a gentler rate."
-  [{:keys [duration-sec target-msgs-sec require-msgs-sec]
-    :or   {duration-sec 10 target-msgs-sec 2000 require-msgs-sec 500}}]
-  (mapv (fn [mode]
-          (log/infof "MQ quartz perf: sustained (%s)" (name mode))
-          (clean!)
-          (bench-sustained! {:duration-sec    duration-sec
-                             :target-msgs-sec (if (= mode :require) require-msgs-sec target-msgs-sec)
-                             :mode            mode}))
-        [:none-no-txn :none-in-txn :require]))
-
-(defn run-all!
-  "Runs the standard suite (publish throughput, e2e latency, then a sustained sweep across every
-  transactional mode) and returns a vector of result maps. Assumes the system is already up (use
-  [[start-system!]] first in a headless process)."
-  []
-  (log/info "MQ quartz perf: publish throughput")
-  (let [r1 (bench-publish-throughput! {:n 5000})]
-    (log/info "MQ quartz perf: e2e latency")
-    (let [r2 (bench-e2e-latency! {:n 500 :msgs-sec 500})]
-      (log/info "MQ quartz perf: sustained throughput (all modes)")
-      (into [r1 r2] (run-modes! {:duration-sec 10 :target-msgs-sec 2000})))))

dev/src/dev/mq_perf_multi.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# Runs multiple Quartz-MQ benchmark nodes against the same database to exercise clustering.
-#
-# Usage:
-#   ./dev/src/dev/mq_perf_multi.sh start       # Start 2 nodes (default)
-#   ./dev/src/dev/mq_perf_multi.sh start 4     # Start 4 nodes
-#   ./dev/src/dev/mq_perf_multi.sh stop        # Stop all running nodes
-#   ./dev/src/dev/mq_perf_multi.sh logs        # Tail all node logs
-#
-# Each node starts a headless JVM (DB + Quartz scheduler + MQ, no Jetty) and runs the benchmark
-# suite immediately. Because the Quartz backend is clustered via the JDBC JobStore, all nodes
-# pointed at the same DB form a cluster and share trigger execution.
-#
-# IMPORTANT: point MB_DB_* at a DEDICATED throwaway database, e.g.:
-#   MB_DB_TYPE=postgres MB_DB_DBNAME=mq_bench MB_DB_USER=... ./dev/src/dev/mq_perf_multi.sh start 3
-# Aiming at a live instance's DB would make these nodes also run that instance's scheduled jobs.
-#
-# (A synchronized "go" start across nodes is not implemented — nodes begin as soon as they boot.)
-
-set -euo pipefail
-cd "$(git rev-parse --show-toplevel)"
-
-LOG_DIR="target/mq-perf-logs"
-PID_DIR="target/mq-perf-pids"
-
-cmd_start() {
-  local num_nodes="${1:-2}"
-  mkdir -p "$LOG_DIR" "$PID_DIR"
-
-  # Clean up stale pids
-  rm -f "$PID_DIR"/*.pid
-
-  echo "Starting $num_nodes MQ benchmark nodes..."
-  echo "Logs in $LOG_DIR/"
-  echo
-
-  for i in $(seq 1 "$num_nodes"); do
-    local log_file="$LOG_DIR/node-$i.log"
-    clojure -M:dev:ee:ee-dev -e "
-      (require 'dev.mq-perf)
-      (dev.mq-perf/start-system!)
-      (clojure.pprint/pprint (dev.mq-perf/run-all!))
-      (dev.mq-perf/clean!)
-      (shutdown-agents)
-    " > "$log_file" 2>&1 &
-    local pid=$!
-    echo "$pid" > "$PID_DIR/node-$i.pid"
-    echo "  Node $i started (PID $pid, log: $log_file)"
-  done
-
-  echo
-  echo "Nodes are running the suite. Watch progress with:"
-  echo "  $0 logs"
-}
-
-cmd_stop() {
-  if [ ! -d "$PID_DIR" ]; then
-    echo "No nodes running."
-    return
-  fi
-
-  for pid_file in "$PID_DIR"/*.pid; do
-    [ -f "$pid_file" ] || continue
-    local pid
-    pid=$(cat "$pid_file")
-    local name
-    name=$(basename "$pid_file" .pid)
-    if kill -0 "$pid" 2>/dev/null; then
-      kill "$pid"
-      echo "Stopped $name (PID $pid)"
-    else
-      echo "$name (PID $pid) already exited"
-    fi
-    rm -f "$pid_file"
-  done
-}
-
-cmd_logs() {
-  if [ ! -d "$LOG_DIR" ]; then
-    echo "No logs found."
-    return
-  fi
-  tail -f "$LOG_DIR"/node-*.log
-}
-
-case "${1:-}" in
-  start) cmd_start "${2:-2}" ;;
-  stop)  cmd_stop ;;
-  logs)  cmd_logs ;;
-  *)
-    echo "Usage: $0 {start [N]|stop|logs}"
-    echo
-    echo "  start [N]  Start N benchmark nodes (default 2); each runs the suite immediately"
-    echo "  stop       Kill all running nodes"
-    echo "  logs       Tail all node logs"
-    exit 1
-    ;;
-esac

dev/test/dev/modules_config_test.clj

@@ -1,147 +0,0 @@
-(ns dev.modules-config-test
-  (:require
-   [clojure.edn :as edn]
-   [clojure.java.io :as io]
-   [clojure.string :as str]
-   [clojure.test :refer :all]
-   [dev.modules-config :as mc]
-   [rewrite-clj.node :as n]
-   [rewrite-clj.parser :as r.parser]))
-
-(defn- resource [path]
-  (slurp (io/resource (str "dev/modules_config_test/" path))))
-
-(defn- rewrite
-  "Rewrite `input` text against `desired`, returning just the text."
-  [input desired]
-  (:text (mc/rewrite-config input desired)))
-
-;;;; ---------------------------------------------------------------------------
-;;;; End-to-end golden test: full config + mock inputs -> expected config
-;;;; ---------------------------------------------------------------------------
-
-(deftest ^:parallel full-config-rewrite-test
-  (testing "a full config.edn rewritten against mock deps-graph inputs matches the expected resource"
-    (let [{:keys [config dependencies model-ownership model-references]}
-          (edn/read-string (resource "mocks.edn"))
-          desired          (mc/compute-desired config dependencies model-ownership model-references)
-          {:keys [text warnings]} (mc/rewrite-config (resource "input-config.edn") desired)]
-      (is (= (resource "expected-config.edn") text))
-      (is (= [] warnings)
-          "the scenario is structurally sound (no new/unsorted modules)")
-      (testing "and rewriting is idempotent — re-running on the output is a no-op"
-        (is (= text (rewrite text desired)))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; compute-desired is pure: value in, value out
-;;;; ---------------------------------------------------------------------------
-
-(deftest ^:parallel compute-desired-test
-  (let [{:keys [config dependencies model-ownership model-references]}
-        (edn/read-string (resource "mocks.edn"))
-        desired (mc/compute-desired config dependencies model-ownership model-references)]
-    (testing ":api = a module's namespaces used by *other* modules; :uses = modules it depends on"
-      (is (= #{'metabase.beta.core} (get-in desired ['beta :api])))
-      (is (= #{'beta 'gamma} (get-in desired ['alpha :uses])))
-      (is (= #{} (get-in desired ['enterprise/zeta :api]))
-          "zeta is used by nobody"))
-    (testing ":model-exports = owned models referenced elsewhere; a model only used at home is not exported"
-      (is (= #{:model/Alpha} (get-in desired ['alpha :model-exports])))
-      (is (= #{} (get-in desired ['enterprise/zeta :model-exports]))
-          "zeta owns :model/Zeta but only references it itself"))
-    (testing ":model-imports = referenced models owned by other modules"
-      (is (= #{:model/Beta :model/Gamma} (get-in desired ['alpha :model-imports]))))
-    (testing "a :bypass module drives no imports and its references don't force exports"
-      (is (= #{} (get-in desired ['gamma :model-imports]))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Sorting (must match metabase.core.modules-test)
-;;;; ---------------------------------------------------------------------------
-
-(deftest ^:parallel sort-module-names-test
-  (testing "enterprise/ modules sort last, others alphabetically"
-    (is (= '[alpha beta enterprise/aaa enterprise/zzz]
-           (#'mc/sort-module-names '[enterprise/zzz beta enterprise/aaa alpha])))))
-
-(deftest ^:parallel sort-for-key-test
-  (testing ":uses sorts modules enterprise-last; other keys sort naturally"
-    (is (= '[alpha enterprise/zeta] (#'mc/sort-for-key :uses '[enterprise/zeta alpha])))
-    (is (= '[a.b a.c a.d] (#'mc/sort-for-key :api '[a.d a.b a.c])))
-    (is (= [:model/A :model/B] (#'mc/sort-for-key :model-imports [:model/B :model/A])))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Set nodes
-;;;; ---------------------------------------------------------------------------
-
-(deftest ^:parallel set-elements-test
-  (testing "elements come back in file order (not the unordered order z/sexpr would give)"
-    (is (= '[gamma alpha beta]
-           (#'mc/set-elements (r.parser/parse-string "#{gamma alpha beta}"))))
-    (is (= '[a b]
-           (#'mc/set-elements (r.parser/parse-string "#{a ; trailing\n b}")))
-        "comments and whitespace are skipped")))
-
-(deftest ^:parallel build-set-node-test
-  (testing "<=3 elements stay inline"
-    (is (= "#{a b c}" (n/string (#'mc/build-set-node '[a b c] 10)))))
-  (testing ">3 elements go one per line, continuation lines indented to `indent`"
-    (is (= "#{a\n    b\n    c\n    d}"
-           (n/string (#'mc/build-set-node '[a b c d] 4)))))
-  (testing "empty set"
-    (is (= "#{}" (n/string (#'mc/build-set-node [] 4))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; rewrite-config branches (via tiny hand-written configs)
-;;;; ---------------------------------------------------------------------------
-
-(defn- parse-modules [text]
-  (:metabase/modules (edn/read-string text)))
-
-(deftest ^:parallel sentinel-values-are-preserved-test
-  (testing ":any and :bypass survive even when a concrete value is computed"
-    (let [input "{:metabase/modules {m {:api :any :uses :any :model-imports :bypass}}}"]
-      (is (= input (rewrite input '{m {:api  #{metabase.m.core}
-                                       :uses #{other}
-                                       :model-imports #{:model/X}}}))))))
-
-(deftest ^:parallel missing-key-is-appended-test
-  (let [input  "{:metabase/modules {m {:team \"T\"}}}"
-        output (rewrite input '{m {:api #{metabase.m.core}}})]
-    (is (= #{'metabase.m.core} (get-in (parse-modules output) ['m :api])))))
-
-(deftest ^:parallel unsorted-set-is-resorted-test
-  (let [input "{:metabase/modules {m {:uses #{gamma beta alpha}}}}"]
-    (is (str/includes? (rewrite input '{m {:uses #{alpha beta gamma}}})
-                       "#{alpha beta gamma}"))))
-
-(deftest ^:parallel empty-computed-values-test
-  (testing "an emptied model key is removed entirely"
-    (let [input  "{:metabase/modules {m {:model-exports #{:model/X}}}}"
-          output (rewrite input '{m {:model-exports #{}}})]
-      (is (not (contains? (get (parse-modules output) 'm) :model-exports)))))
-  (testing "an emptied :api is normalized to #{} rather than removed"
-    (let [input  "{:metabase/modules {m {:api #{metabase.m.core}}}}"
-          output (rewrite input '{m {:api #{}}})]
-      (is (= #{} (get-in (parse-modules output) ['m :api]))))))
-
-(deftest ^:parallel comment-preservation-test
-  (testing "a comment inside a set that does NOT change is preserved"
-    (let [input "{:metabase/modules {m {:uses #{alpha ; keep me\n beta}}}}"]
-      (is (str/includes? (rewrite input '{m {:uses #{alpha beta}}}) "; keep me"))))
-  (testing "a comment inside a set that IS resorted is dropped"
-    (let [input "{:metabase/modules {m {:uses #{beta ; drop me\n alpha}}}}"]
-      (is (not (str/includes? (rewrite input '{m {:uses #{alpha beta}}}) "; drop me"))))))
-
-;;;; ---------------------------------------------------------------------------
-;;;; Structural warnings (things the tool won't auto-fix, only reports)
-;;;; ---------------------------------------------------------------------------
-
-(deftest ^:parallel structural-warnings-test
-  (testing "a desired module absent from the file is reported (needs a human-assigned :team)"
-    (let [{:keys [warnings]} (mc/rewrite-config "{:metabase/modules {a {:uses #{}}}}"
-                                                '{a {:uses #{}} b {:uses #{}}})]
-      (is (some #(str/includes? % "b") warnings))))
-  (testing "out-of-order modules are reported"
-    (let [{:keys [warnings]} (mc/rewrite-config "{:metabase/modules {beta {:uses #{}} alpha {:uses #{}}}}"
-                                                '{alpha {:uses #{}} beta {:uses #{}}})]
-      (is (some #(str/includes? % "sorted") warnings)))))

docs/ai/overview.md

@@ -26,7 +26,7 @@ Metabot is Metabase's built-in AI agent. Metabot can help you with most daily ta
 **Provider**: Choose from:
 
 - Metabase's own AI Service (available as an add-on exclusively for Metabase Cloud)
-- Third-party models via your own [provider API key](settings.md#bring-your-own-api-key)
+- Third-party models via an API key (Anthropic models only for now).
 
 **Plans**: available on all plans. You can only use Metabase's AI Service on Metabase Cloud.
 

docs/ai/settings.md

@@ -54,15 +54,9 @@ To disable Metabase AI provider and stop charges:
 
 ### Bring your own API key
 
-You can specify your own API key and model for Metabot from one of the supported providers. When you connect a provider, the **Model** dropdown lists the supported models that your API key can access.
+You can specify your own API key and model for Metabot from one of the supported providers. Currently, Metabase only supports models from Anthropic.
 
-- **Amazon Bedrock**: Claude and GPT models.
-- **Anthropic**: Claude models (Opus, Sonnet, Haiku, and Fable).
-- **Microsoft Azure**: Your own Azure deployments of Claude or GPT models. Enter the deployment name you configured in Azure.
-- **OpenAI**: GPT models.
-- **OpenRouter**: Claude and GPT models.
-
-If you're interested in Metabase supporting more AI providers or models, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features.md).
+If you're interested in Metabase supporting more AI providers, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features.md).
 
 To enable AI features with your own API key:
 

docs/configuring-metabase/config-template.md

@@ -222,8 +222,6 @@ config:
     metabot-enabled: true
     metabot-recent-views-enabled: true
     metabot-slack-signing-secret: null
-    mfa-challenge-signing-key: null
-    mfa-enforcement: 'off'
     native-query-autocomplete-match-style: substring
     nested-field-columns-value-length-limit: 50000
     no-data-illustration: default
@@ -244,9 +242,6 @@ config:
     premium-embedding-token: null
     query-caching-max-kb: 2000
     query-caching-max-ttl: 3024000.0
-    queue-backend: quartz
-    queue-max-retries: 5
-    queue-no-listener-max-age-ms: 86400000
     redirect-all-requests-to-https: false
     remote-sync-auto-import: false
     remote-sync-auto-import-rate: 5
@@ -327,7 +322,7 @@ config:
     thread-interrupt-escalation-timeout-ms: 0
     transform-run-job-sql-concurrency: 3
     transform-timeout: 240
-    transforms-enabled: null
+    transforms-enabled: false
     unaggregated-query-row-limit: null
     uploads-settings: null
     usage-metadata-enabled: false

docs/configuring-metabase/environment-variables.md

@@ -1301,7 +1301,7 @@ The Anthropic API Key.
 - Default: `anthropic/claude-sonnet-4-6`
 - [Configuration file name](./config-file.md): `llm-metabot-provider`
 
-The AI provider and model for Metabot. Format: provider/model-name, e.g. `anthropic/claude-haiku-4-5`, `openai/gpt-5.4`, `openrouter/anthropic/claude-haiku-4.5`.
+The AI provider and model for Metabot. Format: provider/model-name, e.g. `anthropic/claude-haiku-4-5`, `openai/gpt-5.4`, `openrouter/anthropic/claude-haiku-4-5`.
 
 ### `MB_LOAD_ANALYTICS_CONTENT`
 
@@ -1394,21 +1394,6 @@ Whether the user's recently viewed items are included in the Metabot system prom
 
 Signing secret for verifying requests from the Metabot Slack app.
 
-### `MB_MFA_CHALLENGE_SIGNING_KEY`
-
-- Type: string
-- Default: `null`
-
-Key used to sign MFA challenge tokens. Generated automatically on first use.
-
-### `MB_MFA_ENFORCEMENT`
-
-- Type: keyword
-- Default: `off`
-- [Configuration file name](./config-file.md): `mfa-enforcement`
-
-Controls whether two-factor authentication is available to users. :off disables it entirely; :optional allows users to enroll voluntarily.
-
 ### `MB_NATIVE_QUERY_AUTOCOMPLETE_MATCH_STYLE`
 
 - Type: keyword
@@ -1596,27 +1581,6 @@ The maximum size of the cache, per saved question, in kilobytes.
 
 The absolute maximum time to keep any cached query results, in seconds.
 
-### `MB_QUEUE_BACKEND`
-
-- Type: string
-- Default: `quartz`
-
-Which queue backend to use. Valid values: `quartz`, `memory`.
-
-### `MB_QUEUE_MAX_RETRIES`
-
-- Type: integer
-- Default: `5`
-
-Maximum number of times a failed queue message will be retried before being dropped.
-
-### `MB_QUEUE_NO_LISTENER_MAX_AGE_MS`
-
-- Type: integer
-- Default: `86400000`
-
-How long (in milliseconds) a Quartz queue message with no listener anywhere in the cluster is kept before the reaper drops it. With node-affinity, such a message is never acquired and just waits in the store; this bounds that wait so a message for a queue no node handles (e.g. a new queue whose node was rolled back) does not linger forever. Generous by default (1 day) so a node can restart or be re-upgraded and still deliver it.
-
 ### `MB_REDIRECT_ALL_REQUESTS_TO_HTTPS`
 
 - Type: boolean
@@ -2363,14 +2327,10 @@ Controls the timeout for transform runs, including the queries they execute. Thi
 ### `MB_TRANSFORMS_ENABLED`
 
 - Type: boolean
-- Default: `null`
-- [Exported as](../installation-and-operation/serialization.md): `transforms-enabled`.
+- Default: `false`
 - [Configuration file name](./config-file.md): `transforms-enabled`
 
-Whether transforms are enabled.
-
-When enabled, data analysts and admins can write, schedule and run transforms.
-  Disabling this feature will hide all transform features, prevent transform editing or creation, and prevent any new runs.
+Enable transforms for instances that have not explicitly purchased the transform add-on.
 
 ### `MB_UNAGGREGATED_QUERY_ROW_LIMIT`
 

docs/dashboards/introduction.md

@@ -331,8 +331,6 @@ Public links can be viewed by anyone, even if they don't have access to Metabase
 
 You can export the entire dashboard as PDF, or export results of individual questions on the dashboard. See [Exporting results](../questions/exporting-results.md).
 
-To get a PDF of a dashboard delivered on a schedule, [attach a PDF to a dashboard subscription](./subscriptions.md#attach-a-pdf-of-the-dashboard).
-
 ## Configuring a dashboard through its URL
 
 You can amend the URL of a dashboard to automatically enter fullscreen or auto-refresh the dashboard. Customizing the dashboard's URL allows you to configure the dashboard - even when you do not have any input access to the device where the dashboard will be displayed, like scripted screens, for example.

docs/dashboards/subscriptions.md

@@ -79,6 +79,8 @@ This is helpful for dashboards that are displaying time-limited results (for exa
 
 When configuring an email subscription, you can tell Metabase if it should attach results to the email as a file, in addition to displaying the table in the email body.
 
+Currently, you can only send attachments with question results. You can't send the whole dashboard as a PDF attachment.
+
 If you've added filters to your dashboard and set default values for those filters, Metabase will apply those default values to your subscriptions, filtering the results of all questions that are connected to those filters when the subscriptions are sent. To learn more, check out [dashboard filters](./filters.md).
 
 ### File format
@@ -102,20 +104,6 @@ The attached files will include up to 1 048 575 rows by default (Excel's row lim
 
 You can toggle on "Send only attachments (no charts)" if you want to receive just the .csv or .xlsx files without the charts. Remember to select the results you want to attach in "Questions to attach" above the toggle.
 
-## Attach a PDF of the dashboard
-
-To attach a PDF of the dashboard to your subscription, enable the **Attach a PDF of the dashboard** toggle in the subscription settings. When the subscription runs, Metabase generates the PDF and attaches it to the email or Slack message.
-
-The PDF attachment follows the layout of your dashboard. Cards appear in the same arrangement as the dashboard, and each tab starts a new page. Some cards may display differently than they do in your browser. For example, tables that scroll on the dashboard may display all of their columns in the PDF.
-
-Metabase generates the PDF on the Metabase server, which means:
-
-- Generating the PDF can take a minute or more.
-- The PDF uses a light theme. It doesn't follow the theme you set in your browser.
-- The PDF can differ in small ways from the dashboard in your browser. For example, map legends may display in a different position, and charts with many small segments may hide some labels.
-
-Iframe cards created from a URL display as links. Iframe cards created from embed code display "Unable to render this card".
-
 ## Adding multiple subscriptions
 
 You can add multiple subscriptions to a single dashboard. To add a subscription, click on the **+** icon in the dashboard subscription panel.

docs/databases/uploads.md

@@ -19,7 +19,6 @@ To manage upload settings, admins can hit cmd/ctrl + K and search for "Settings
 
 - [PostgreSQL](../databases/connections/postgresql.md)
 - [MySQL](../databases/connections/mysql.md)
-- [Snowflake](../databases/connections/snowflake.md)
 - [Redshift](../databases/connections/redshift.md)
 - [ClickHouse](../databases/connections/clickhouse.md) (only supported on ClickHouse Cloud)
 

docs/developers-guide/build.md

@@ -18,7 +18,7 @@ To complete any build of the Metabase code, you'll need to install the following
 
 1. [Clojure (https://clojure.org)](https://clojure.org/guides/getting_started) - install the latest release by following the guide depending on your OS
 
-2. [Java Development Kit JDK (https://adoptopenjdk.net/releases.html)](https://adoptopenjdk.net/releases.html) - you need to install JDK 25 ([more info on Java versions](../installation-and-operation/running-the-metabase-jar-file.md))
+2. [Java Development Kit JDK (https://adoptopenjdk.net/releases.html)](https://adoptopenjdk.net/releases.html) - you need to install JDK 21 ([more info on Java versions](../installation-and-operation/running-the-metabase-jar-file.md))
 
 3. [Node.js (https://nodejs.org/)](https://nodejs.org/) - latest LTS release
 
@@ -33,7 +33,7 @@ curl -fsSL https://bun.sh/install | bash
 On a most recent stable Ubuntu/Debian, all the tools above, with the exception of Clojure and Bun, can be installed by using:
 
 ```
-sudo apt install openjdk-25-jdk nodejs
+sudo apt install openjdk-21-jdk nodejs
 ```
 
 If you have multiple JDK versions installed in your machine, be sure to switch your JDK before building with:
@@ -42,7 +42,7 @@ If you have multiple JDK versions installed in your machine, be sure to switch y
 sudo update-alternatives --config java
 ```
 
-Then select Java 25 in the menu.
+Then select Java 21 in the menu.
 
 ### Running on M1 Apple computers
 

docs/developers-guide/driver-changelog.md

@@ -4,45 +4,8 @@ title: Driver interface changelog
 
 # Driver Interface Changelog
 
-## Metabase 0.64.0
-
-- Added a `:native-pivot-tables` driver feature flag for drivers that can compile a pivot query as a single
-  `GROUP BY GROUPING SETS (...)` statement instead of the legacy multi-query path. Drivers that opt in must also
-  derive from `:sql-mbql5` (which provides the `:pivot` clause compiler). Defaults to `false`.
-
-- Index Manager: drivers can now read and create table indexes, in the broad sense (secondary indexes, sort keys,
-  distribution keys, clustering, etc.). New driver feature flags:
-
-  - `:index/fetch` -- the driver can read the indexes that physically exist on a table. Implemented by Postgres,
-    ClickHouse, and Redshift.
-
-  - `:index/standalone-create` -- the driver can create an index on a transform's target table as a standalone
-    statement after the table is created. Implemented by Postgres.
-
-  - `:index/inline-create` -- the driver inlines an index into the table-creation statement itself (e.g. Redshift
-    `SORTKEY`) rather than creating it afterwards. Such drivers render the index from the `:indexes` key of the
-    transform details when they build the creation statement: in `metabase.driver/compile-transform` (the CTAS for a
-    SQL transform) and/or `metabase.driver/create-table!` (the CREATE TABLE for a Python transform). Implemented by
-    Redshift.
-
-  New driver methods:
-
-  - `metabase.driver/fetch-table-indexes` `[driver database schema table]` -- reads a table's physical indexes,
-    returning them as a vector of normalized index maps. Drivers declaring `:index/fetch` implement it; the default
-    implementation throws.
-
-  - `metabase.driver/supported-index-methods` `[driver database]` -- returns the index methods the driver supports as
-    a map of `index-kind` to a metadata map carrying at least `:lifecycle` (`:standalone` or `:inline`). Defaults to
-    `{}`.
-
-  - `metabase.driver/compile-create-index` `[driver schema table structured]` -- compiles a `:standalone` index into
-    the DDL statement(s) that create it.
-
 ## Metabase 0.63.0
 
-- `metabase.driver/refresh-table-stats!` `[driver database schema table transform-type]` -- refreshes table
-  statistics (e.g. `ANALYZE`) after a transform run. Defaults to a no-op.
-
 - `metabase.driver/describe-table-fks`, deprecated in 0.49.0, has been removed. Please implement
   `metabase.driver/describe-fks` instead. This method is now required for drivers that support
   `:metadata/key-constraints`.

docs/embedding/authentication.md

@@ -281,8 +281,6 @@ app.get("/sso/metabase", async (req, res) => {
 });
 ```
 
-For modular embedding, Metabase exchanges the JWT via `POST /auth/sso` with a JSON body (not a `GET` redirect). Full app embedding typically uses the `GET` redirect shown above. See [JWT-based authentication](../people-and-groups/authenticating-with-jwt.md).
-
 ## Embedding Metabase in a different domain
 
 {% include plans-blockquote.html feature="Authenticated modular embeds" convert_pro_link_to_embedding=true is_plural=true %}

docs/embedding/full-app-embedding.md

@@ -109,8 +109,6 @@ If you're using [JWT](../people-and-groups/authenticating-with-jwt.md), you can
 https://metabase.example.com/auth/sso?jwt=<token>&return_to=%2Fdashboard%2F1
 ```
 
-To avoid putting the JWT in the URL, you can also authenticate with a `POST` request and a JSON body. See [JWT-based authentication](../people-and-groups/authenticating-with-jwt.md).
-
 You must URL encode (or double encode, depending on your web setup) all of the parameters in your redirect link, including parameters for filters (e.g., `filter=value`) and [UI settings](#showing-or-hiding-metabase-ui-components) (e.g., `top_nav=true`). For example, if you added two filter parameters to the JWT example shown above, your `src` link would become:
 
 ```

docs/embedding/guest-embedding.md

@@ -197,8 +197,6 @@ See [Modular embedding parameters](./parameters.md#pass-parameter-values-to-embe
 
 Locked parameters let you filter data without exposing the filter to the end-user. Locking parameters is useful for restricting data based on who's viewing the embed (for example, showing each customer only their own data).
 
-![Locked parameters](./images/locked-parameters.png)
-
 To use locked parameters, you need to:
 
 1. Set the parameter to **Locked** in the embed settings.

docs/embedding/tenants.md

@@ -308,8 +308,6 @@ For an overview of how data permissions work in Metabase, see [Data permissions]
 
   If every tenant has their data in a separate database, then instead of using permissions for data access control, you can use [**database routing**](../permissions/database-routing.md) to route queries to appropriate databases directly.
 
-  For a comparison of data isolation methods, see [Choosing a data isolation method](../permissions/data-isolation-methods.md).
-
 - **Create queries** controls whether tenant users can create queries on the data they see. If you want to give your tenant users the ability to drill through (e.g., through `drills` parameter in [modular embedding](../embedding/modular-embedding.md)), you need to give them "Create queries" permissions, because a drill through is a new query.
 
 - **Download results** controls, unsurprisingly, whether people can download results of queries. You need to set download permissions if you want to give your users the option to download their data as a spreadsheet (for example, through `with-downloads` parameter in [modular embedding](../embedding/modular-embedding.md)).
@@ -439,4 +437,3 @@ If you disable multi-tenant strategy, _all your tenant users will be deactivated
 - [Embedding overview](./start.md)
 - [JWT authentication](../people-and-groups/authenticating-with-jwt.md)
 - [Permissions overview](../permissions/start.md)
-- [Data isolation methods](../permissions/data-isolation-methods.md)

docs/installation-and-operation/running-the-metabase-jar-file.md

@@ -45,7 +45,7 @@ You may already have Java installed. To check the version, open a terminal and r
 java -version
 ```
 
-If Java isn't installed, you'll need to install Java before you can run Metabase. We recommend version 25 of JRE from [Eclipse Temurin](https://adoptium.net/) with HotSpot JVM. You can run Metabase wherever Java 25 runs. Earlier Java versions aren't supported. The particular processor architecture shouldn't matter (although we only test Metabase for x86 and ARM).
+If Java isn't installed, you'll need to install Java before you can run Metabase. We recommend version 21 of JRE from [Eclipse Temurin](https://adoptium.net/) with HotSpot JVM. You can run Metabase wherever Java 21 runs. Earlier Java versions aren't supported. The particular processor architecture shouldn't matter (although we only test Metabase for x86 and ARM).
 
 ### 2. Download Metabase
 

docs/people-and-groups/authenticating-with-jwt.md

@@ -22,30 +22,7 @@ Assuming your site is localhost serving on port 3000:
 5. In the event of a successful sign-in, your authentication app should issue a GET request to your Metabase endpoint with the token and the "return to" URI: `http://localhost:3000/auth/sso?jwt=TOKEN_GOES_HERE&return_to=/question/1-superb-question`.
 6. Metabase verifies the JSON Web Token, logs the person in, then redirects the person to their original destination, `/question/1-superb-question`.
 
-- For full app embeds, use a `GET` request.
-- For modular embeds use a `POST` request with a JSON body (to avoid putting the JWT in the URL). You'll also want to use `POST` requests in contexts that log or cache URLs, such as server-side integrations or testing.
-
-In both cases the login behavior is the same, and you can pass `return_to` as a query parameter in both `GET` and `POST` requests.
-
-An example `POST` request with curl:
-
-```bash
-curl -X POST "http://localhost:3000/auth/sso?return_to=/question/1-superb-question" \
-  -H "Content-Type: application/json" \
-  -d '{"jwt": "TOKEN_GOES_HERE"}'
-```
-
-Or with JavaScript:
-
-```js
-await fetch(`${METABASE_URL}/auth/sso?return_to=/question/1-superb-question`, {
-  method: "POST",
-  headers: { "Content-Type": "application/json" },
-  body: JSON.stringify({ jwt: token }),
-  credentials: "include",
-});
-```
-
+As an alternative to putting the JWT in the URL query string (which some environments log or cache), you can send the same token in the body of a `POST` request to `/auth/sso` with `Content-Type: application/json` and a JSON body like `{"jwt": "TOKEN_GOES_HERE"}`. You can still pass `return_to` as a query parameter on that URL (for example `POST /auth/sso?return_to=/question/1-superb-question`). The login behavior is otherwise the same as the GET flow.
 
 ## Set up JWT authentication
 

docs/permissions/data-isolation-methods.md

@@ -1,90 +0,0 @@
----
-title: Data isolation methods
-summary: Compare the ways Metabase can restrict data access for internal analytics or multi-tenant setups, including row and column security, impersonation, database routing, and locked parameters.
----
- 
-# Data isolation methods
-
-> Row and column security, impersonation, and database routing are only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.
-
-Metabase offers several ways to ensure people only see the data they're supposed to see, whether you're restricting data by team for internal analytics or isolating customer data in a multi-tenant setup. The best method depends on how you store your data and where you want to enforce access rules:
-
-- If all data lives in the same tables, use [row and column security](#row-and-column-security) to filter data in Metabase, or [impersonation](#impersonation) to enforce access rules at the database level.
-- If each customer or team has their own database, use [database routing](#database-routing).
-- If you're embedding dashboards for people without Metabase accounts, use [locked parameters](#locked-parameters).
-
-You can combine these methods. For example, you can use locked parameters for a guest embed while using row and column security for signed-in users.
-
-## Row and column security
-
-[Row and column security](./row-and-column-security.md) lets you control which rows and columns each group can see. You can define rules that filter data based on [user attributes](../people-and-groups/managing.md#adding-a-user-attribute). Metabase applies your rules to questions you build in the query builder.
-
-![Row and column security](./images/row-and-column-level-security.png)
-
-Use row and column security when:
-
-- You need granular control over which rows and columns each group or customer can see.
-- You want to manage access rules in the Metabase UI instead of in your database.
-
-Don't use row and column security when:
-
-- People need to write native SQL queries. Row and column security doesn't apply to the SQL editor.
-- You need column-level security on MongoDB or Druid, which only support row-level security.
-
-## Impersonation
-
-[Impersonation](./impersonation.md) lets your database control what each person can see. You define roles and row-level security policies in your database. Metabase connects using the role specified by each person's [user attribute](../people-and-groups/managing.md#adding-a-user-attribute), and your database enforces what that role can see.
-
-![Impersonation](./images/connection-impersonation.png)
-
-Use impersonation when:
-
-- You want to centralize access logic in your database instead of in Metabase.
-- People need to write native SQL queries. Since your database enforces the rules, the rules apply in the SQL editor too.
-
-Don't use impersonation when:
-
-- Your database [doesn't support it](./impersonation.md#databases-that-support-impersonation).
-- You don't want to set up and maintain roles and policies in your database.
-- You rely heavily on caching. You can't share cached results between roles.
-
-## Database routing
-
-[Database routing](./database-routing.md) sends each person's queries to their own database. You build questions and dashboards once against a primary database, and Metabase routes queries to the right destination database based on each person's [user attribute](../people-and-groups/managing.md#adding-a-user-attribute). Database routing requires that each group's data lives in a separate database, and that all destination databases have identical schemas.
-
-![Database routing](./images/database-routing-diagram.png)
-
-Use database routing when:
-
-- You want the strongest isolation. Each group's data lives in a separate database.
-- You want to avoid one group's queries affecting the performance of another group's queries.
-
-Don't use database routing when:
-
-- Groups share tables. Use [row and column security](#row-and-column-security) or [impersonation](#impersonation) instead.
-- You want to manage access rules in the Metabase UI instead of maintaining a separate database for each group.
-
-## Locked parameters
-
-[Locked parameters](../embedding/guest-embedding.md#locked-parameters) filter an embedded dashboard or question before Metabase displays it. Your app passes the filter value in a signed JWT. The filter is invisible to the person viewing the embed, and they can't change it.
-
-![Locked parameters](../embedding/images/locked-parameters.png)
-
-Use locked parameters when:
-
-- You want to restrict data without setting up Metabase accounts, user attributes, or permissions.
-- You want to filter data without exposing the filter or its values to the people viewing the embed.
-
-Don't use locked parameters when:
-
-- You want account-level or role-based access control across your Metabase.
-- You're working with sensitive data. Use a method that enforces access at the permissions or database level instead, like [row and column security](#row-and-column-security), [impersonation](#impersonation), or [database routing](#database-routing).
-
-## Further reading
-
-- [Permissions overview](./start.md)
-- [Tenants](../embedding/tenants.md)
-- [Row and column security](./row-and-column-security.md)
-- [Impersonation](./impersonation.md)
-- [Database routing](./database-routing.md)
-- [Locked parameters for guest embeds](../embedding/guest-embedding.md#locked-parameters)

docs/permissions/database-routing.md

@@ -9,8 +9,6 @@ summary: Route queries to different databases based on who's viewing them. Great
 
 With database routing, an admin can build a question once using one database, and the question will run its query against a different database with the same schema depending on who is viewing the question.
 
-![Database routing diagram](./images/database-routing-diagram.png)
-
 Database routing is useful for:
 
 - Managing modular and full app embedding setups where each customer has their own database with identical schemas.