Run the tests please

move snowplow transform metrics to OSS, as transforms are now available on OSS

.claude/skills/_shared/clojure-commands.md

@@ -12,14 +12,7 @@
 
 ## Testing
 
-- **Run a test:** `./bin/mage run-tests namespace/test-name`
-- **Run all tests in a namespace:** `./bin/mage run-tests namespace`
-- **Run all tests for a module:** `./bin/mage run-tests test/metabase/notification` Because the module lives in that directory.
-
-Note: the `./bin/mage run-tests` command accepts multiple args, so you can pass
-`./bin/mage run-tests namespace/test-name namespace/other-test namespace/third-test`
-to run 3 tests, or
-`./bin/mage run-tests test/metabase/module1 test/metabase/module2` to run 2 modules.
+Use `./bin/test-agent` to run backend tests. See the top-level CLAUDE.md for usage.
 
 ## Code Readability
 

.claude/skills/add-tracing/SKILL.md

@@ -0,0 +1,357 @@
+--b-
+name: add-tracing
+description: Add OpenTelemetry tracing spans to Clojure code following Metabase tracing conventions. Use when instrumenting backend code with trace coverage.
+---
+
+# Add Tracing Spans to Clojure Code
+
+This skill helps you add OpenTelemetry (OTel) tracing spans to the Metabase backend codebase using the custom `tracing/with-span` macro.
+
+## Reference Files
+
+- `src/metabase/tracing/core.clj` - `with-span` macro, group registry, SDK lifecycle, `best-effort-sanitize-sql`, Pyroscope integration
+- `src/metabase/task/impl.clj` - `defjob` macro that wraps Quartz jobs with root spans
+- `.clj-kondo/config/modules/config.edn` - Module boundary configuration
+
+## Module Architecture
+
+The tracing module has a deliberately minimal API surface. **Only 2 namespaces are public** (listed in `:api` in the module config):
+
+| Namespace | Role | Status |
+|---|---|---|
+| `tracing.core` | Primary API: `with-span`, groups, SDK lifecycle, Pyroscope, MDC, `best-effort-sanitize-sql` | **Public API** |
+| `tracing.init` | Side-effect loader for `quartz` and `settings` | **Public API** (init convention) |
+| `tracing.attributes` | `best-effort-sanitize-sql` implementation (re-exported via `tracing.core`) | Internal |
+| `tracing.settings` | Setting definitions (`MB_TRACING_*` env vars) | Internal |
+| `tracing.quartz` | Quartz JDBC proxy + JobListener | Internal |
+
+**Rules:**
+- Only require `[metabase.tracing.core :as tracing]` from outside the module. `tracing/best-effort-sanitize-sql` and all other public functions are available from this single namespace.
+- Do not add new API namespaces. Add new public functions to `tracing.core` instead.
+- Do not require internal namespaces (`tracing.attributes`, `tracing.settings`, `tracing.quartz`) from outside the module.
+- `:uses :any` on the `core` module does NOT bypass the target module's `:api` check — internal namespaces are still enforced.
+
+### Cyclic Dependency Avoidance
+
+`tracing/core.clj` is required by many modules across the codebase. It **must NOT** compile-time require `tracing.settings`, as this creates transitive cyclic load dependencies (e.g., `settings/core -> tracing/settings -> tracing/core -> events/impl -> events/core`).
+
+Instead, `tracing/core.clj` uses `requiring-resolve` for settings access:
+
+```clojure
+;; CORRECT — lazy runtime resolution, no compile-time dependency
+((requiring-resolve 'metabase.tracing.settings/tracing-enabled))
+
+;; WRONG — creates cyclic load dependency
+(require '[metabase.tracing.settings :as settings])
+(settings/tracing-enabled)
+```
+
+External library namespaces (clj-otel API, SDK, exporters) are safe to require normally — they don't participate in Metabase namespace cycles.
+
+**Important:** `requiring-resolve` must use **literal quoted symbols**. Kondo hooks validate that `required-namespaces` are all simple symbols, so dynamic construction fails:
+
+```clojure
+;; CORRECT — literal quoted symbol
+(requiring-resolve 'metabase.tracing.settings/tracing-endpoint)
+
+;; WRONG — kondo hook rejects this: "Assert failed: (every? simple-symbol? required-namespaces)"
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-endpoint"))
+```
+
+## Quick Checklist
+
+When adding tracing spans:
+
+- [ ] Module has `tracing` in its `:uses` set in `.clj-kondo/config/modules/config.edn`
+- [ ] Added `[metabase.tracing.core :as tracing]` to ns requires (alphabetically sorted)
+- [ ] Span wraps a meaningful I/O boundary (not pure computation)
+- [ ] Group matches the domain (check `src/metabase/tracing/core.clj` for registered groups; add a new one if none fit)
+- [ ] Span name follows dot-notation convention (`"domain.subsystem.operation"`)
+- [ ] Attributes use namespaced keywords (`:search/query-length`, `:db/id`)
+- [ ] No sensitive data in attributes (use `best-effort-sanitize-sql` for HoneySQL, never raw SQL)
+- [ ] No new tracing namespaces created (add to `tracing.core` instead)
+- [ ] No `DO_NOT_ADD_NEW_FILES_HERE.txt` violations in the target directory
+- [ ] Run `clj-kondo --lint <files>` to verify 0 errors, 0 warnings
+- [ ] Add or update tests in the corresponding `test/` path (see Testing section below)
+- [ ] Run tests: `clojure -X:dev:test :only <test-ns>`
+
+## The `with-span` Macro
+
+```clojure
+(tracing/with-span group span-name attrs & body)
+```
+
+- **group** - A keyword selecting which trace group this span belongs to (e.g., `:tasks`, `:sync`)
+- **span-name** - A string identifying the span in traces (e.g., `"search.execute"`)
+- **attrs** - A map of span attributes (e.g., `{:db/id 42}`)
+- **body** - The code to execute inside the span
+
+**When disabled:** zero overhead -- single atom deref + boolean check, body runs directly.
+**When enabled:** creates OTel span AND injects `trace_id`/`span_id` into Log4j2 MDC for log-to-trace correlation.
+
+## Trace Groups
+
+Groups are registered in `src/metabase/tracing/core.clj`. Check that file for the current list. The general rule: **match the group to the domain, not the call site.** If code runs inside a Quartz job but is logically search work, use `:search`, not `:tasks`.
+
+To add a new group:
+
+```clojure
+;; In src/metabase/tracing/core.clj
+(register-group! :my-domain "Description of what this covers")
+```
+
+Users enable groups via `MB_TRACING_GROUPS=tasks,search,sync` (comma-separated, or `"all"`).
+
+## Naming Conventions
+
+### Span Names
+
+Use dot-separated hierarchical names: `"domain.subsystem.operation"`. The domain prefix should match the group name:
+
+```
+search.execute              -- `:search` group
+sync.fingerprint.table      -- `:sync` group
+task.session-cleanup.delete -- `:tasks` group
+db-app.collection-items     -- `:db-app` group
+```
+
+### Attributes
+
+Use namespaced keywords. The namespace groups related attributes:
+
+```clojure
+:db/id              -- Database ID (integer)
+:db/engine          -- Database engine name (string)
+:db/statement       -- Sanitized SQL (string, via best-effort-sanitize-sql)
+:search/engine      -- Search engine name (string)
+:search/query-length -- Query string length (integer)
+:sync/table         -- Table name (string)
+:sync/step          -- Sync step name (string)
+:task/name          -- Task name (string)
+:http/method        -- HTTP method (string)
+:http/url           -- Request URL (string)
+```
+
+Invent new namespaced attributes as needed (e.g., `:pulse/id`, `:transform/count`). Keep values as primitives (strings, numbers, booleans) -- no maps or collections.
+
+## Step-by-Step: Adding a Span
+
+### 1. Check module boundaries
+
+Look up the module for your namespace in `.clj-kondo/config/modules/config.edn`. If `tracing` is not in the module's `:uses` set, add it (keep alphabetically sorted):
+
+```edn
+my-module
+{:team "MyTeam"
+ :uses #{analytics config tracing util}}
+```
+
+### 2. Add the require
+
+```clojure
+(ns metabase.my-module.thing
+  (:require
+   [metabase.tracing.core :as tracing]
+   [metabase.util :as u]))
+```
+
+`best-effort-sanitize-sql` is available from `tracing.core` — no additional require needed.
+
+### 3. Identify the I/O boundary
+
+Only wrap code at **meaningful I/O boundaries**:
+
+**DO trace:**
+- External API calls (embedding APIs, metabot, webhooks)
+- Database queries (both app DB and user DB)
+- Network requests (HTTP calls to external services)
+- Heavy batch processing (batch indexing, batch embedding)
+- Top-level orchestration functions that coordinate multiple sub-operations
+
+**DO NOT trace:**
+- Pure computation (sorting, filtering, mapping)
+- Simple single-row lookups (`t2/select-one :model/Setting :key k`)
+- Every function in a call chain (only boundaries matter)
+- Trivial operations (string formatting, hash calculations)
+
+### 4. Wrap with `with-span`
+
+```clojure
+;; Simple span (no attributes needed)
+(tracing/with-span :search "search.init-index" {}
+  (do-expensive-thing))
+
+;; Span with static attributes
+(tracing/with-span :sync "sync.fingerprint.table"
+                   {:db/id (:db_id table)
+                    :sync/table (:name table)}
+  (fingerprint-fields! table fields))
+
+;; Span with computed attributes
+(tracing/with-span :search "search.execute"
+                   {:search/engine       (name (:search-engine ctx))
+                    :search/query-length (count (:search-string ctx))}
+  (search.engine/results ctx))
+
+;; Span with sanitized SQL (for dynamic HoneySQL queries)
+(let [hsql {:delete-from [(t2/table-name :model/Session)]
+            :where [:< :created_at oldest-allowed]}]
+  (tracing/with-span :tasks "task.session-cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+
+;; Sub-spans breaking a function into I/O phases
+(let [embedding (tracing/with-span :search "search.semantic.embedding"
+                                   {:search.semantic/provider (:provider model)}
+                  (get-embedding model search-string))
+      results   (tracing/with-span :search "search.semantic.db-query" {}
+                  (into [] xform reducible))]
+  (process results))
+
+;; Per-item iteration spans
+(doseq [e (search.engine/active-engines)]
+  (tracing/with-span :search "search.ingestion.update" {:search/engine (name e)}
+    (search.engine/update! e batch)))
+```
+
+### 5. Add tests
+
+Create or update tests in the corresponding `test/` path. Follow the patterns in existing tracing tests:
+
+- **Reference tests:** `test/metabase/tracing/quartz_test.clj`, `test/metabase/server/middleware/trace_test.clj`
+- Use `tracing/init-enabled-groups!` / `tracing/shutdown-groups!` with `try`/`finally` to manage group lifecycle
+- Test both enabled and disabled paths (verify zero overhead when group is off)
+- Use `reify` mocks for Java interfaces (Connection, PreparedStatement, JobListener, etc.)
+- Add `(set! *warn-on-reflection* true)` and type-hint proxy/reify calls to avoid reflection warnings
+
+```clojure
+(deftest my-span-enabled-test
+  (testing "when group is enabled, span is created"
+    (try
+      (tracing/init-enabled-groups! "my-group" "INFO")
+      ;; ... test that span behavior occurs ...
+      (finally
+        (tracing/shutdown-groups!)))))
+
+(deftest my-span-disabled-test
+  (testing "when group is disabled, code runs without tracing"
+    (tracing/shutdown-groups!)
+    ;; ... test that code still works, no wrapping applied ...
+    ))
+```
+
+### 6. Lint and run tests
+
+```bash
+# Lint modified source and test files — expect 0 errors, 0 warnings
+clj-kondo --lint path/to/modified/file.clj path/to/test/file.clj
+
+# Run tests (requires Java 21+)
+  clojure -X:dev:test :only my-ns.test-ns
+```
+
+Expect: all tests pass, 0 failures, 0 errors, no reflection warnings from your files.
+
+## Sanitizing SQL for Attributes
+
+When including SQL in span attributes, **always** use `tracing/best-effort-sanitize-sql`. This converts HoneySQL maps to parameterized SQL strings where values become `?` placeholders -- no data leaks.
+
+```clojure
+(let [hsql {:delete-from [:core_session]
+            :where [:< :created_at some-timestamp]}]
+  (tracing/with-span :tasks "task.cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+;; Trace attribute: db/statement = "DELETE FROM core_session WHERE created_at < ?"
+```
+
+**Rules:**
+- Never put raw SQL strings or user-provided values in attributes
+- Use `best-effort-sanitize-sql` only for app DB (HoneySQL) queries
+- For external/user DB queries, trace only timing and counts, not SQL content
+
+## Defjob and Root Spans
+
+The `defjob` macro in `metabase.task.impl` automatically wraps every Quartz job with a `:tasks` root span:
+
+```clojure
+(task/defjob ^{DisallowConcurrentExecution true} SessionCleanup [_]
+  (cleanup-sessions!))
+;; Automatically creates span: "task.SessionCleanup" {:task/name "SessionCleanup"}
+```
+
+You do NOT need a root span inside `defjob` bodies. Add **child spans** for I/O inside the job.
+
+For code on plain `Thread`s (not Quartz), add the root span manually:
+
+```clojure
+(defn init! []
+  (tracing/with-span :search "search.task.init" {}
+    (search/init-index!)))
+```
+
+## What NOT to Do
+
+### Span Usage Mistakes
+
+```clojure
+;; WRONG - pure computation, no I/O
+(tracing/with-span :search "search.format-results" {}
+  (map format-result results))
+
+;; WRONG - trivial single-row lookup
+(tracing/with-span :db-app "db-app.get-setting" {}
+  (t2/select-one :model/Setting :key "my-setting"))
+
+;; WRONG - raw SQL in attributes (data leak)
+(tracing/with-span :tasks "task.cleanup" {:db/statement raw-sql-string}
+  (execute! raw-sql-string))
+
+;; WRONG - wrong group (search work should use :search, not :tasks)
+(tracing/with-span :tasks "search.execute" {} ...)
+
+;; WRONG - redundant nesting (do-search already has a span)
+(tracing/with-span :search "search.process" {}
+  (let [results (do-search ctx)]
+    (tracing/with-span :search "search.format" {}
+      (format-results results))))
+```
+
+### Architecture Mistakes
+
+```clojure
+;; WRONG - creating a new tracing namespace
+(ns metabase.tracing.my-feature ...)
+
+;; WRONG - requiring internal tracing namespaces from outside the module
+(ns metabase.my-module.thing
+  (:require [metabase.tracing.attributes :as trace-attrs]      ;; internal!
+            [metabase.tracing.settings :as tracing.settings]   ;; internal!
+            [metabase.tracing.quartz :as tracing.quartz]))     ;; internal!
+
+;; WRONG - adding compile-time requires to tracing/core.clj for settings or SDK
+;; This creates cyclic load dependencies because tracing/core is widely required
+(ns metabase.tracing.core
+  (:require [metabase.tracing.settings :as settings]))  ;; causes cycle!
+
+;; WRONG - dynamic symbol construction with requiring-resolve (kondo rejects it)
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-enabled"))
+```
+
+## Configuration
+
+All settings are env-var-only (defined in `src/metabase/tracing/settings.clj`):
+
+```bash
+# Core
+MB_TRACING_ENABLED=true              # Enable tracing (default: false)
+MB_TRACING_ENDPOINT=host:4317        # OTLP collector endpoint (default: http://localhost:4317)
+MB_TRACING_GROUPS=tasks,search,sync  # Comma-separated groups or "all" (default: all)
+MB_TRACING_SERVICE_NAME=metabase     # Service name in traces (default: hostname)
+MB_TRACING_LOG_LEVEL=DEBUG           # Log threshold for traced threads: TRACE/DEBUG/INFO (default: INFO)
+
+# Batch span processor tuning
+MB_TRACING_MAX_QUEUE_SIZE=2048       # Max spans queued for export; drops when full (default: 2048)
+MB_TRACING_EXPORT_TIMEOUT_MS=10000   # Max wait for batch export to complete (default: 10000)
+MB_TRACING_SCHEDULE_DELAY_MS=5000    # Delay between consecutive batch exports (default: 5000)
+```

.claude/skills/e2e-test-create/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: e2e-test-create
+description: >
+  Analyze React component source code to understand UI structure,
+  then generate idiomatic Cypress E2E tests following Metabase conventions.
+  Falls back to Playwright MCP browser exploration only when code reading
+  and screenshot debugging are insufficient.
+disable-model-invocation: true
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - Skill
+  - "mcp__playwright__*"
+---
+
+# Code-Reading-First → Generate Cypress Tests (Metabase)
+
+You are writing Cypress E2E tests for the **Metabase** codebase.
+Before generating ANY test code, you MUST analyze React component source code
+to understand DOM structure, selectors, and user flows.
+
+## Phase 0 — Research
+
+1. Read existing helpers before writing anything:
+   - `e2e/support/helpers/` — all shared helpers (restore, signInAs, openOrdersTable, etc.)
+   - `e2e/support/cypress_sample_database.ts` — table/field schema constants (ORDERS, PRODUCTS, etc.)
+   - `e2e/support/cypress_sample_instance_data.ts` — instance-specific IDs (ORDERS_DASHBOARD_ID, NORMAL_USER_ID, etc.)
+2. Glob `e2e/test/scenarios/` to find the closest existing spec to the area under test.
+   Study its patterns — match them exactly.
+3. Glob `frontend/src/metabase/` to find React components for the feature area.
+
+## Phase 1 — Code Analysis
+
+Read React component source to understand DOM structure. No browser needed — source code has everything.
+
+1. **Find relevant components**: Glob and grep `frontend/src/metabase/` for the feature area.
+2. **Extract selectors**: Grep for `data-testid` in relevant components.
+3. **Note visible text**: Read component JSX for button labels, headings, placeholders.
+4. **Note aria attributes**: Grep for `aria-label` in relevant components.
+5. **Understand user flows**: Read event handlers (onClick, onSubmit, onChange) to understand interactions.
+6. **Find API calls**: Grep for `Api.use`, `fetch`, `useQuery`, endpoint definitions to identify API calls to intercept.
+7. **Cross-reference with existing specs**: Find specs in the same area and reuse their proven selectors and `cy.intercept` patterns.
+
+## Phase 2 — Start Backend
+
+Use `MB_EDITION=oss` by default. Only use `MB_EDITION=ee` when the user explicitly asks to write an enterprise test.
+
+Start the backend using `run_in_background: true` (NOT `&`).
+`bin/e2e-backend` automatically detects if a backend is already running and reuses it.
+```bash
+MB_EDITION=oss bin/e2e-backend
+```
+
+Do NOT manually generate snapshots by running unrelated test specs.
+The `bun test-cypress` runner has `GENERATE_SNAPSHOTS: true` by default and automatically
+generates snapshots before running any spec. When running tests in Phase 4 via the `/e2e-test` skill,
+snapshots will be generated on the first run if they don't already exist.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+## Phase 3 — Generate Cypress Spec
+
+### File location & naming
+
+Place specs in `e2e/test/scenarios/<area>/` mirroring the URL structure.
+Name: `<feature>.cy.spec.js` (NOT `.cy.spec.ts`).
+
+### Metabase conventions (mandatory)
+
+- **Helpers via `cy.H`**: All helpers are accessed via `const { H } = cy;` — NOT via direct imports from `e2e/support/helpers`.
+
+```js
+const { H } = cy;
+
+describe("feature name", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+});
+```
+
+- **Sample Database schema** (table/field definitions): Import from `cypress_sample_database`.
+
+```js
+import { ORDERS, ORDERS_ID, PRODUCTS } from "e2e/support/cypress_sample_database";
+```
+
+- **Instance data** (dashboard IDs, user IDs, etc.): Import from `cypress_sample_instance_data`.
+
+```js
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+```
+
+- **Selectors** (priority order):
+  1. `cy.findByText()` / `cy.findByLabelText()` / `cy.findByRole()` — from `@testing-library/cypress`
+  2. `cy.findByTestId()` — for `data-testid` attributes
+  3. `cy.get("[data-testid='...']")` — fallback
+  4. NEVER use positional selectors, CSS class names, or XPaths.
+
+- **Navigation helpers**: Use existing helpers like `H.openOrdersTable()`, `H.openNativeEditor()`,
+  `H.visitDashboard(id)`, `H.visitQuestion(id)` instead of raw `cy.visit()` chains.
+  Grep `e2e/support/helpers/` to discover what's available for your area.
+
+- **API setup over UI setup**: Use `cy.request()` or existing API helpers to set up state.
+  Only use the UI for the flow you're actually testing.
+
+- **Assertions**: Assert on visible text, URL, aria state — not DOM structure.
+
+- **Waits**: Never use `cy.wait(ms)`. Use `cy.intercept()` + `cy.wait("@alias")` for API calls,
+  or `cy.findByText().should("be.visible")` for DOM readiness.
+
+- **Isolation**: Each `it()` block must be independently runnable.
+  Don't depend on state from a previous `it()`.
+
+### Spec structure template
+
+```js
+const { H } = cy;
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+import { ORDERS, ORDERS_ID } from "e2e/support/cypress_sample_database";
+
+describe("area > sub-area > feature (#issue-number)", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+
+  it("should do the primary happy-path thing", () => {
+    // test
+  });
+
+  it("should handle the edge case", () => {
+    // test
+  });
+});
+```
+
+### Intercepts
+
+When you identified API calls during code analysis, stub or wait on them:
+
+```js
+cy.intercept("POST", "/api/dataset").as("dataset");
+// ... trigger action ...
+cy.wait("@dataset");
+```
+
+## Phase 4 — Validate
+
+After generating specs:
+1. Check that all imported helpers exist (Grep `e2e/support/helpers/`).
+2. **You MUST use the `/e2e-test` skill** to run tests — do NOT run `bun test-cypress` directly.
+   The `/e2e-test` skill handles edition selection, snapshot management, and correct env vars.
+   `/e2e-test GREP="should do the thing" --spec e2e/test/scenarios/<path>`
+   If you created multiple `it()` blocks, run each one individually to isolate failures.
+
+## Phase 5 — Fix Failures (up to 2 attempts)
+
+When a test fails, **try to fix it from Cypress output first**:
+1. Read the failure screenshot (path printed under `(Screenshots)`).
+2. Read the error message and code frame from the console output.
+3. Fix the test and re-run (back to Phase 4, step 2).
+
+If you cannot diagnose the issue after 2 attempts, proceed to Phase 6.
+
+## Phase 6 — Playwright Fallback
+
+Only reach this phase after 2 failed fix attempts from Phase 5. The backend is already running.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+**Bypass CSP** headers before navigating (Metabase serves strict CSP that blocks dev server scripts).
+Use `browser_run_code` to set this up:
+
+```js
+async (page) => {
+  // Strip CSP headers so the page loads (mirrors Cypress chromeWebSecurity: false)
+  await page.context().route('**/*', async (route) => {
+    const response = await route.fetch();
+    const headers = { ...response.headers() };
+    delete headers['content-security-policy'];
+    delete headers['content-security-policy-report-only'];
+    await route.fulfill({ response, headers });
+  });
+
+  // Sign in via API
+  const response = await page.request.post('http://localhost:4000/api/session', {
+    data: { username: 'admin@metabase.test', password: '12341234' }
+  });
+  const session = await response.json();
+  await page.context().addCookies([{
+    name: 'metabase.DEVICE',
+    value: session.id,
+    domain: 'localhost',
+    path: '/'
+  }]);
+
+  await page.goto('http://localhost:4000');
+  await page.waitForLoadState('networkidle');
+  return 'signed in';
+}
+```
+
+**Maintain an observation log incrementally.** After EVERY significant Playwright interaction,
+IMMEDIATELY append what you observed to the scratch file BEFORE performing the next interaction:
+
+```bash
+cat >> /tmp/e2e-observations.md << 'OBSERVATION'
+## [Page/Flow name]
+- URL: /question/notebook#...
+- Clicked: "Box plot" button → visible text "Box plot", role: radio
+- Selectors: data-testid="viz-type-button", findByText("Box plot")
+- API call: POST /api/dataset (triggered on viz change)
+- Key state: after selecting viz type, summary sidebar shows metric picker
+OBSERVATION
+```
+
+For each page/flow:
+- Take an accessibility snapshot (`browser_snapshot`).
+- Click through interactive elements, fill forms, trigger modals.
+- **Append to the observation log immediately after each step**: URLs, visible text, aria labels, `data-testid` attrs, API calls.
+- Screenshot key states.
+
+After exploration:
+1. Read back your observation log: `cat /tmp/e2e-observations.md`
+2. Fix the test using observed selectors and behavior.
+3. Re-run the test (back to Phase 4).
+4. Clean up: `rm -f /tmp/e2e-observations.md`
+
+## Phase 7 — Cleanup
+
+After all tests pass (or after giving up on fixing failures), **always kill the backend on port 4000**:
+```bash
+lsof -ti:4000 | xargs kill 2>/dev/null || true
+```
+
+Do NOT use broad `pkill` patterns — there may be other Metabase instances on different ports.
+The backend process started in Phase 2 will NOT be killed automatically when the Claude session ends.
+Leaving it running wastes resources and can interfere with future sessions. Always clean up.
+
+## What NOT to do
+
+- Do NOT use Playwright as the first step — always analyze source code first.
+- Do NOT kill the backend between phases — it stays running throughout.
+- Do NOT invent selectors you didn't find in source code or observe in the browser.
+- Do NOT hardcode database IDs — import from `cypress_sample_database` or `cypress_sample_instance_data`.
+- Do NOT use `cy.wait(1000)` or any numeric wait.
+- Do NOT create setup flows through the UI when an API helper exists.
+- Do NOT put tests in `cypress/e2e/` — Metabase uses `e2e/test/scenarios/`.
+- Do NOT import helpers directly from `e2e/support/helpers` — use `const { H } = cy;`.

.claude/skills/e2e-test/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: e2e-test
+description: Run Cypress E2E tests, analyze failures including screenshots, and stress test for flakiness
+disable-model-invocation: false
+---
+
+Run Cypress E2E test: $ARGUMENTS
+
+## Edition selection
+
+**Default: `MB_EDITION=oss`** — runs without enterprise tokens, simpler and faster.
+
+Only use `MB_EDITION=ee` when the user explicitly asks to write or run an enterprise test.
+
+**For `MB_EDITION=ee`:**
+These tokens must be exported in the shell before starting Claude Code:
+- `CYPRESS_MB_ALL_FEATURES_TOKEN` — all features (most EE tests need this)
+- `CYPRESS_MB_PRO_SELF_HOSTED_TOKEN` — pro self-hosted (permissions, SSO, sandboxing)
+- `CYPRESS_MB_STARTER_CLOUD_TOKEN` — starter plan (rarely needed)
+- `CYPRESS_MB_PRO_CLOUD_TOKEN` — pro cloud (rarely needed)
+
+**NEVER echo, print, or log token values. Only check if they are set:**
+```bash
+echo "ALL_FEATURES: ${CYPRESS_MB_ALL_FEATURES_TOKEN:+set}" && echo "PRO_SELF_HOSTED: ${CYPRESS_MB_PRO_SELF_HOSTED_TOKEN:+set}" && echo "STARTER: ${CYPRESS_MB_STARTER_CLOUD_TOKEN:+set}" && echo "PRO_CLOUD: ${CYPRESS_MB_PRO_CLOUD_TOKEN:+set}"
+```
+
+If tokens are missing, tell the user: "EE tokens are not set. Either export them and restart Claude Code, or add `MB_EDITION=oss` to run OSS-only tests."
+
+## Running
+
+First check if snapshots exist:
+```bash
+ls e2e/snapshots/default.sql 2>/dev/null && echo "snapshots exist" || echo "snapshots missing"
+```
+
+If snapshots exist, skip regeneration for speed:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress $ARGUMENTS
+```
+
+If snapshots are missing (first run), let the runner generate them:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress $ARGUMENTS
+```
+
+When running enterprise tests, replace `MB_EDITION=oss` with `MB_EDITION=ee` in the commands above.
+
+If `$ARGUMENTS` is empty, ask the user which spec to run.
+
+If the user provides a test name or fuzzy name instead of a spec path, find the spec file:
+```bash
+find e2e/test/scenarios -name "*FUZZY_NAME*.cy.spec.*" -type f
+```
+Then run with `--spec "path/to/matched.cy.spec.js"`.
+
+To filter by test name, use the `GREP` env var (not `--env grep=`, which breaks on commas):
+```bash
+GREP="test name here" MB_EDITION=oss bun test-cypress --spec path/to/spec.js
+```
+
+## Stress test (flaky detection)
+
+When the user asks to verify a test is not flaky:
+
+```bash
+MB_EDITION=oss bin/e2e-stress-test $ARGUMENTS
+```
+
+Set `E2E_STRESS_RUNS=N` for more iterations (default: 5). Stops on first failure and prints screenshot paths. Read those screenshots to analyze the failure.
+
+## Analyzing failures
+
+When tests fail:
+
+1. Read the **screenshot** for each failure — paths are printed in Cypress output under `(Screenshots)`, typically at `cypress/screenshots/<spec-name>/<test-name> (failed).png`
+2. Read the error message and code frame from the console output
+3. Identify the root cause: is it a test bug, a product bug, or a timing issue?
+4. Suggest a fix with specific code changes

.clj-kondo/config/modules/config.edn

@@ -215,6 +215,7 @@
            settings
            task
            task-history
+           tracing
            util}}
 
   auth-identity
@@ -397,6 +398,7 @@
            request
            revisions
            settings
+           tracing
            transforms
            upload
            util}}
@@ -589,6 +591,7 @@
            settings
            sql-tools
            system
+           tracing
            util
            warehouse-schema
            warehouses}}
@@ -667,7 +670,8 @@
    :api  #{metabase.events.core
            metabase.events.init}
    :uses #{models
-           util}}
+           util}
+   :friends #{tracing}}
 
   formatter
   {:team "UX West"
@@ -749,6 +753,7 @@
            metabase.lib.schema.common
            metabase.lib.schema.expression
            metabase.lib.schema.expression.temporal
+           metabase.lib.schema.filter
            metabase.lib.schema.id
            metabase.lib.schema.info
            metabase.lib.schema.join
@@ -890,6 +895,7 @@
            system
            task
            task-history
+           tracing
            util}}
 
   models
@@ -963,6 +969,7 @@
            system
            task
            task-history
+           tracing
            users
            util}}
 
@@ -1006,6 +1013,7 @@
            premium-features
            remote-sync
            settings
+           tracing
            util
            enterprise/advanced-permissions}}
 
@@ -1051,6 +1059,7 @@
            settings
            startup
            task
+           tracing
            util}}
 
   product-feedback
@@ -1118,6 +1127,7 @@
            request
            task
            task-history
+           tracing
            util
            enterprise/advanced-permissions
            enterprise/sandbox}}
@@ -1261,6 +1271,7 @@
            server
            settings
            system
+           tracing
            users
            util}}
 
@@ -1342,6 +1353,7 @@
            settings
            startup
            task
+           tracing
            transforms
            util}}
 
@@ -1388,6 +1400,7 @@
            session
            settings
            system
+           tracing
            users
            util
            enterprise/sso}}
@@ -1409,6 +1422,7 @@
            sso
            system
            task
+           tracing
            util}}
 
   settings
@@ -1531,6 +1545,7 @@
            settings
            task
            task-history
+           tracing
            util
            warehouse-schema
            warehouses}}
@@ -1547,6 +1562,7 @@
            metabase.task.core}
    :uses #{app-db
            classloader
+           tracing
            util}}
 
   task-history
@@ -1563,6 +1579,7 @@
            query-processor
            request
            task
+           tracing
            util}}
 
   tenants
@@ -1610,6 +1627,15 @@
            models
            util}}
 
+  tracing
+  {:team "DevEx"
+   :api  #{metabase.tracing.core
+           metabase.tracing.init}
+   :uses #{events
+           settings
+           task
+           util}}
+
   transforms
   {:team "Querying"
    :api  #{metabase.transforms.core
@@ -1632,6 +1658,7 @@
            settings
            task
            task-history
+           tracing
            transforms-base
            util}
    :friends #{models
@@ -2193,6 +2220,7 @@
            request
            revisions
            settings
+           sql-tools
            task
            transforms
            transforms-base
@@ -2433,6 +2461,7 @@
            search
            settings
            task
+           tracing
            util
            enterprise/llm
            enterprise/metabot-v3}}

.github/scripts/build-cross-version-matrix.js

@@ -0,0 +1,52 @@
+// This script is used in .github/workflows/cross-version.yml
+// to generate a matrix for cross-version migration testing
+
+/**
+ * Generate a CI matrix for cross-version migration testing (EE only).
+ *
+ * Creates pairs of [source, target] for testing HEAD against the last N
+ * minor versions in both upgrade and downgrade directions.
+ *
+ * @param {number} currentVersion - The current major version number (e.g., 59)
+ * @param {number} count - Number of previous minor versions to test against (default: 3)
+ * @returns {{ config: Array<{ source: string, target: string }> }}
+ *
+ * @example
+ * buildMatrix(59)
+ * // Returns:
+ * // {
+ * //   config: [
+ * //     { source: "HEAD", target: "v1.59.x" },
+ * //     { source: "v1.59.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.58.x" },
+ * //     { source: "v1.58.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.57.x" },
+ * //     { source: "v1.57.x", target: "HEAD" },
+ * //   ]
+ * // }
+ */
+function buildCrossVersionMatrix(currentVersion, count = 3) {
+  if (!Number.isInteger(currentVersion) || currentVersion < 1) {
+    throw new Error(
+      `Invalid currentVersion: ${currentVersion}. Must be a positive integer.`,
+    );
+  }
+
+  if (!Number.isInteger(count) || count < 1) {
+    throw new Error(`Invalid count: ${count}. Must be a positive integer.`);
+  }
+
+  const config = Array.from({ length: count }, (_, i) => currentVersion - i)
+    .filter((majorVersion) => majorVersion >= 1)
+    .flatMap((majorVersion) => {
+      const version = `v1.${majorVersion}.x`;
+      return [
+        { source: "HEAD", target: version },
+        { source: version, target: "HEAD" },
+      ];
+    });
+
+  return { config };
+}
+
+module.exports = { buildCrossVersionMatrix };

.github/scripts/build-cross-version-matrix.unit.spec.js

@@ -0,0 +1,242 @@
+const { buildCrossVersionMatrix } = require("./build-cross-version-matrix");
+
+describe("buildCrossVersionMatrix", () => {
+  describe("default behavior", () => {
+    it("should generate matrix with 3 versions by default", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.59.x" },
+          { source: "v1.59.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.58.x" },
+          { source: "v1.58.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.57.x" },
+          { source: "v1.57.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should use EE prefix (v1)", () => {
+      const result = buildCrossVersionMatrix(50);
+      expect(result.config[0].target).toBe("v1.50.x");
+      expect(result.config[1].source).toBe("v1.50.x");
+    });
+
+    it("should create pairs in both directions (upgrade and downgrade)", () => {
+      const result = buildCrossVersionMatrix(59);
+      const entries = result.config;
+
+      // Check HEAD -> version (upgrade test)
+      expect(entries.filter((e) => e.source === "HEAD")).toHaveLength(3);
+      // Check version -> HEAD (downgrade test)
+      expect(entries.filter((e) => e.target === "HEAD")).toHaveLength(3);
+    });
+  });
+
+  describe("custom count", () => {
+    it("should generate matrix with custom count", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      expect(result.config).toHaveLength(10); // 5 versions × 2 directions
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.58.x" },
+        { source: "v1.58.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.57.x" },
+        { source: "v1.57.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.56.x" },
+        { source: "v1.56.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.55.x" },
+        { source: "v1.55.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with count=1", () => {
+      const result = buildCrossVersionMatrix(59, 1);
+      expect(result.config).toHaveLength(2);
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with large count", () => {
+      const result = buildCrossVersionMatrix(59, 10);
+      expect(result.config).toHaveLength(20);
+
+      // Check first and last entries
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[18]).toEqual({
+        source: "HEAD",
+        target: "v1.50.x",
+      });
+      expect(result.config[19]).toEqual({
+        source: "v1.50.x",
+        target: "HEAD",
+      });
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle version 1", () => {
+      const result = buildCrossVersionMatrix(1);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should stop when version would go below 1", () => {
+      const result = buildCrossVersionMatrix(2, 5);
+      // Can only generate v1.2.x and v1.1.x (2 versions, not 5)
+      expect(result.config).toHaveLength(4);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.2.x" },
+          { source: "v1.2.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should handle high version numbers", () => {
+      const result = buildCrossVersionMatrix(100, 2);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.100.x" },
+          { source: "v1.100.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.99.x" },
+          { source: "v1.99.x", target: "HEAD" },
+        ],
+      });
+    });
+  });
+
+  describe("error handling", () => {
+    it("should throw for undefined currentVersion", () => {
+      expect(() => buildCrossVersionMatrix()).toThrow(
+        "Invalid currentVersion: undefined. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(59.5)).toThrow(
+        "Invalid currentVersion: 59.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(0)).toThrow(
+        "Invalid currentVersion: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(-1)).toThrow(
+        "Invalid currentVersion: -1. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for NaN currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(NaN)).toThrow(
+        "Invalid currentVersion: NaN. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer count", () => {
+      expect(() => buildCrossVersionMatrix(59, 2.5)).toThrow(
+        "Invalid count: 2.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero count", () => {
+      expect(() => buildCrossVersionMatrix(59, 0)).toThrow(
+        "Invalid count: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative count", () => {
+      expect(() => buildCrossVersionMatrix(59, -1)).toThrow(
+        "Invalid count: -1. Must be a positive integer.",
+      );
+    });
+  });
+
+  describe("matrix structure for GitHub Actions", () => {
+    it("should return object with config array", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toHaveProperty("config");
+      expect(Array.isArray(result.config)).toBe(true);
+    });
+
+    it("should produce valid JSON for GitHub Actions", () => {
+      const result = buildCrossVersionMatrix(59);
+      const json = JSON.stringify(result);
+      expect(() => JSON.parse(json)).not.toThrow();
+
+      const parsed = JSON.parse(json);
+      expect(parsed.config).toHaveLength(6);
+      expect(parsed.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+    });
+
+    it("should have consistent entry structure", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+
+      result.config.forEach((entry) => {
+        expect(entry).toHaveProperty("source");
+        expect(entry).toHaveProperty("target");
+        expect(typeof entry.source).toBe("string");
+        expect(typeof entry.target).toBe("string");
+        // Either source or target should be HEAD
+        expect(entry.source === "HEAD" || entry.target === "HEAD").toBeTruthy();
+      });
+    });
+  });
+
+  describe("version ordering", () => {
+    it("should generate versions in descending order", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      const versions = result.config
+        .filter((e) => e.source === "HEAD")
+        .map((e) => e.target);
+
+      expect(versions).toEqual([
+        "v1.59.x",
+        "v1.58.x",
+        "v1.57.x",
+        "v1.56.x",
+        "v1.55.x",
+      ]);
+    });
+
+    it("should interleave upgrade and downgrade tests", () => {
+      const result = buildCrossVersionMatrix(59, 2);
+
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[1]).toEqual({
+        source: "v1.59.x",
+        target: "HEAD",
+      });
+      expect(result.config[2]).toEqual({
+        source: "HEAD",
+        target: "v1.58.x",
+      });
+      expect(result.config[3]).toEqual({
+        source: "v1.58.x",
+        target: "HEAD",
+      });
+    });
+  });
+});

.github/scripts/setup-python-runner.sh

@@ -19,7 +19,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
+git clone --depth 1 -b extensible-resource-schema https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
 
 if [ "$SKIP_START" = false ]; then
   echo "Starting python-runner..."

.github/workflows/backend.yml

@@ -39,7 +39,7 @@ jobs:
   be-linter-eastwood-test:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 20
+    timeout-minutes: 30
     name: Eastwood (test)
     steps:
       - uses: actions/checkout@v4

.github/workflows/cross-version.yml

@@ -0,0 +1,102 @@
+name: Cross-Version Migration Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_version:
+        description: "Source version (e.g., v1.58.6 or HEAD)"
+        required: true
+        type: string
+      target_version:
+        description: "Target version (e.g., v1.58.7 or HEAD)"
+        required: true
+        type: string
+
+  pull_request:
+    paths:
+      - "cross-version/**"
+      - ".github/workflows/cross-version.yml"
+      - ".github/scripts/build-cross-version-matrix.js"
+
+  schedule:
+    # Run nightly at 3 AM UTC
+    - cron: "0 3 * * *"
+
+jobs:
+  # Generate matrix for scheduled/PR runs
+  generate-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+
+      - name: Generate version matrix
+        id: set-matrix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { buildCrossVersionMatrix } = require('${{ github.workspace }}/.github/scripts/build-cross-version-matrix');
+            const { config } = buildCrossVersionMatrix(${{ vars.CURRENT_VERSION }});
+            const matrix = JSON.stringify({ include: config });
+            core.setOutput("matrix", matrix);
+            console.log("matrix:", matrix);
+
+  # Matrix-based tests for scheduled/PR runs
+  test-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    needs: generate-matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ matrix.source }}" --target "${{ matrix.target }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true
+
+  # Manual test for workflow_dispatch
+  test-manual:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ inputs.source_version }}" --target "${{ inputs.target_version }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true

.github/workflows/module-boundaries-stats.yml

@@ -0,0 +1,78 @@
+name: Module Boundaries Stats
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 5 # every Friday at 1:40
+
+jobs:
+  module-boundaries-stats:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: get module boundary stats
+        id: get-stats
+        run: |
+          NAMED_MODULES=$(node --input-type=module -e "
+            import { elements } from './frontend/lint/module-boundaries.mjs';
+            const named = elements.filter(e => !['shared/other', 'app/misc', 'other'].includes(e.type));
+          ")
+
+          NAMED_DIRS=$(node --input-type=module -e "
+            import { elements } from './frontend/lint/module-boundaries.mjs';
+            const dirs = new Set();
+            for (const el of elements) {
+              const m = el.pattern.match(/^frontend\/src\/metabase\/(\w[\w-]*)\//)
+              if (m) dirs.add(m[1]);
+            }
+          ")
+          TOTAL_DIRS=$(ls -d frontend/src/metabase/*/ | xargs -I{} basename {} | wc -l | tr -d ' ')
+          NAMED_COUNT=$(echo "$NAMED_DIRS" | grep -c . || true)
+          UNMODULED=$(($TOTAL_DIRS - $NAMED_COUNT))
+
+          VIOLATIONS=$(bun run module-boundaries 2>&1 | grep -o '✖ [0-9]* problems' | grep -o '[0-9]*' || echo "0")
+
+          echo "$NAMED_MODULES modules, $UNMODULED unmoduled folders, $VIOLATIONS violations"
+
+          echo "NAMED_MODULES=$NAMED_MODULES" >> $GITHUB_OUTPUT
+          echo "UNMODULED=$UNMODULED" >> $GITHUB_OUTPUT
+          echo "VIOLATIONS=$VIOLATIONS" >> $GITHUB_OUTPUT
+      - name: Upload stats
+        uses: actions/github-script@v7
+        env:
+          NAMED_MODULES: ${{ steps.get-stats.outputs.NAMED_MODULES }}
+          UNMODULED: ${{ steps.get-stats.outputs.UNMODULED }}
+          VIOLATIONS: ${{ steps.get-stats.outputs.VIOLATIONS }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+            console.log("UNMODULED", Number(process.env.UNMODULED));
+            console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
+
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Modules': Number(process.env.NAMED_MODULES),
+                'Unmoduled folders': Number(process.env.UNMODULED),
+                'Violations': Number(process.env.VIOLATIONS),
+              }
+            ];
+
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 75146,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/repro-bot.yml

@@ -10,6 +10,11 @@ on:
         description: "Issue number to reproduce"
         required: true
         type: string
+      repro_bot_branch:
+        description: "Branch of repro-bot to use"
+        required: false
+        default: "main"
+        type: string
 
 jobs:
   repro-bot:
@@ -21,7 +26,7 @@ jobs:
       id-token: write
     if: |
       (github.event_name == 'push') ||
-      (github.event_name == 'issues' && github.event.label.name == 'repro-bot' && github.event.issue.state == 'open') ||
+      (github.event_name == 'issues' && github.event.label.name == '.Run Repro Bot' && github.event.issue.state == 'open') ||
       (github.event_name == 'workflow_dispatch')
 
     steps:
@@ -36,48 +41,100 @@ jobs:
             echo "number=${{ github.event.issue.number }}" >> $GITHUB_OUTPUT
           fi
 
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare-backend
+      - uses: ./.github/actions/prepare-frontend
+
       - name: Checkout repro-bot
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: metabase/repro-bot
-          ref: ci-support
+          ref: ${{ github.event.inputs.repro_bot_branch || 'main' }}
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          path: repro-bot
 
       - name: Pre-clone metabase bare git repo
-        run: git clone --bare https://github.com/metabase/metabase.git git/metabase
+        run: git clone --bare .git repro-bot/git/metabase
 
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: '21'
-
-      - name: Set up Python (uv)
-        uses: astral-sh/setup-uv@v4
+      - name: Capture Node.js path for MCP subprocesses
+        run: echo "NODE_BIN_DIR=$(dirname $(which node))" >> $GITHUB_ENV
 
       - name: Install playwright-cli
         run: |
           npm install -g @playwright/cli@latest
           playwright-cli install --skills
 
+      - name: Install bbin and clj-nrepl-eval
+        run: |
+          # Install babashka
+          curl -sLO https://raw.githubusercontent.com/babashka/babashka/master/install
+          chmod +x install
+          sudo ./install
+          rm install
+
+          # Install bbin
+          mkdir -p ~/.bbin/bin
+          curl -sL https://raw.githubusercontent.com/babashka/bbin/main/bbin > ~/.bbin/bin/bbin
+          chmod +x ~/.bbin/bin/bbin
+          export PATH="$HOME/.bbin/bin:$PATH"
+          export BBIN_HOME="$HOME/.bbin"
+
+          # Install clj-nrepl-eval via bbin
+          bbin install https://github.com/bhauman/clojure-mcp-light.git \
+            --tag v0.2.1 \
+            --as clj-nrepl-eval \
+            --main-opts '["-m" "clojure-mcp-light.nrepl-eval"]'
+
+          # Add to PATH for the rest of the workflow
+          echo "$HOME/.bbin/bin" >> $GITHUB_PATH
+
+          # Verify
+          clj-nrepl-eval --help | head -3
+
+      - name: Register MCP servers
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY_REPRO_BOT }}
+        run: |
+          UV_PATH="$(which uv)"
+          jq -n \
+            --arg uv "$UV_PATH" \
+            --arg key "$LINEAR_API_KEY" \
+            '{
+              mcpServers: {
+                "metabase-repro": {
+                  command: $uv,
+                  args: ["run", "--directory", "mcp", "--with", "fastmcp", "python", "-m", "metabase_repro"]
+                },
+                "linear-server": {
+                  url: "https://mcp.linear.app/mcp",
+                  type: "http",
+                  headers: {
+                    Authorization: ("Bearer " + $key)
+                  }
+                }
+              }
+            }' > ~/.claude.json
+
       - name: Generate GitHub App Token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         id: claude-app-token
         with:
           app-id: ${{ secrets.METABASE_BOT_APP_ID }}
           private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
 
       - name: Run repro-bot with Claude Code
+        id: claude
+        continue-on-error: true
         uses: anthropics/claude-code-action@v1
         env:
+          CLAUDE_CODE_DEBUG_LOGS_DIR: /tmp/claude-debug-logs
+          CLAUDE_WORKING_DIR: ${{ github.workspace }}/repro-bot
           MB_PREMIUM_EMBEDDING_TOKEN: ${{ secrets.PR_ENV_MB_PREMIUM_EMBEDDING_TOKEN }}
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
           GITHUB_ACTIONS_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        timeout-minutes: 30
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_REPRO_BOT }}
           github_token: ${{ steps.claude-app-token.outputs.token }}
-          plugins: |
-            @anthropic/plugin-productivity-linear
           prompt: |
             Read and follow the instructions in .claude/commands/repro.md to investigate this GitHub issue:
             https://github.com/${{ github.repository }}/issues/${{ steps.issue.outputs.number }}
@@ -86,15 +143,124 @@ jobs:
             - The bare git repo has been pre-cloned at git/metabase. The master worktree still needs setup via setup_master_worktree().
             - The GITHUB_ACTIONS_RUN_URL environment variable is set. If any phase fails catastrophically, follow the CI error handling in repro.md to post the error to Linear with the action run URL.
             - Docker is available for appdb (Postgres/MySQL/MariaDB) if needed.
-            - Java 21 and Python/uv are pre-installed.
-          claude_args: |
-            --allowedTools "Bash(playwright-cli*),Bash(gh *),Bash(jq*),Bash(find*),Bash(ls*),Bash(grep*),Bash(cat*),Bash(base64*),Bash(git*),Bash(npx*),Bash(docker*),Bash(kill*),Bash(curl*),Write,Read,Glob,Grep,Edit,MultiEdit,WebFetch,mcp__metabase_repro__*,mcp__plugin_productivity_linear__*"
+            - Java and Python/uv are pre-installed.
+          claude_args: >-
+            --allowedTools
+            "Glob,
+            Grep,
+            Read,
+            ToolSearch,
+            Skill(*),
+            WebSearch,
+            WebFetch(domain:docs.metabase.com),
+            WebFetch(domain:metabase.com),
+            WebFetch(domain:www.metabase.com),
+            Edit(//./**),
+            Edit(repro/**),
+            Edit(/tmp/**),
+            Write(//./**),
+            Write(repro/**),
+            Write(/tmp/**),
+            Bash(base64 *),
+            Bash(cat *),
+            Bash(cd *),
+            Bash(clj-nrepl-eval *),
+            Bash(clojure *),
+            Bash(cp *),
+            Bash(diff *),
+            Bash(docker *),
+            Bash(echo *),
+            Bash(find *),
+            Bash(gh api repos/metabase/metabase/*),
+            Bash(gh issue list * --repo metabase/metabase *),
+            Bash(gh issue view * --repo metabase/metabase *),
+            Bash(gh release *),
+            Bash(gh search *),
+            Bash(git *),
+            Bash(grep *),
+            Bash(head *),
+            Bash(jar *),
+            Bash(jq *),
+            Bash(kill *),
+            Bash(ls *),
+            Bash(mkdir *),
+            Bash(mv *),
+            Bash(npx playwright-cli:*),
+            Bash(pgrep *),
+            Bash(playwright-cli:*),
+            Bash(printf *),
+            Bash(ps *),
+            Bash(psql *),
+            Bash(PGPASSWORD=*),
+            Bash(python -m mcp.metabase_repro *),
+            Bash(python3 *),
+            Bash(sed *),
+            Bash(sort *),
+            Bash(strings *),
+            Bash(tail *),
+            Bash(tee *),
+            Bash(touch *),
+            Bash(unzip *),
+            Bash(wc *),
+            Bash(which *),
+            Bash(xargs *),
+            mcp__metabase-repro__api_call,
+            mcp__metabase-repro__browser_snapshot,
+            mcp__metabase-repro__check_setup,
+            mcp__metabase-repro__check_setup_token,
+            mcp__metabase-repro__cleanup,
+            mcp__metabase-repro__create_env,
+            mcp__metabase-repro__get_session_token,
+            mcp__metabase-repro__get_status,
+            mcp__metabase-repro__jar_download,
+            mcp__metabase-repro__repl_eval,
+            mcp__metabase-repro__reset_metabase,
+            mcp__metabase-repro__run_test,
+            mcp__metabase-repro__save_test_patch,
+            mcp__metabase-repro__setup_master_worktree,
+            mcp__metabase-repro__setup_worktree,
+            mcp__metabase-repro__start_appdb,
+            mcp__metabase-repro__start_metabase,
+            mcp__metabase-repro__stop_appdb_tool,
+            mcp__metabase-repro__stop_metabase,
+            mcp__linear-server__create_attachment,
+            mcp__linear-server__get_issue,
+            mcp__linear-server__list_comments,
+            mcp__linear-server__list_issues,
+            mcp__linear-server__list_issue_labels,
+            mcp__linear-server__save_comment,
+            mcp__linear-server__save_issue"
             --disallowedTools "Bash(git push*),Bash(rm -rf /*)"
 
-      - name: Upload SUGGESTIONS.md artifact
-        uses: actions/upload-artifact@v4
+      - name: Verify repro-bot completed successfully
+        run: |
+          if [ "${{ steps.claude.outcome }}" = "failure" ]; then
+            echo "::error::Claude Code crashed or exited with an error"
+            exit 1
+          fi
+
+          EXEC_FILE="${{ steps.claude.outputs.execution_file }}"
+          if [ -z "$EXEC_FILE" ] || [ ! -f "$EXEC_FILE" ]; then
+            echo "::error::No execution file found"
+            exit 1
+          fi
+
+          if ! grep -q "mcp__linear-server__" "$EXEC_FILE"; then
+            echo "::error::Claude did not post a comment on Linear"
+            exit 1
+          fi
+
+          echo "Repro-bot completed successfully and posted to Linear"
+
+      - name: Upload repro-bot artifacts
+        uses: actions/upload-artifact@v7
         if: always()
         with:
-          name: repro-suggestions
-          path: repro/*/SUGGESTIONS.md
+          name: repro-bot-${{ steps.issue.outputs.number }}
           if-no-files-found: ignore
+          path: |
+            repro/*/SUGGESTIONS.md
+            repro/*/*.log
+            repro/*/*.patch
+            repro/*/playwright/**
+            ${{ steps.claude.outputs.execution_file }}

.github/workflows/rerun-workflows.yml

@@ -40,11 +40,19 @@ jobs:
             const BRANCH = process.env.BRANCH_NAME;
 
             if (ATTEMPT <= MAX_ATTEMPTS) {
-              github.rest.actions.reRunWorkflowFailedJobs({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                run_id: ${{ github.event.workflow_run.id }},
-              });
+              try {
+                await github.rest.actions.reRunWorkflowFailedJobs({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  run_id: ${{ github.event.workflow_run.id }},
+                });
+              } catch (error) {
+                if (error.status === 403) {
+                  console.log(`Skipping re-run: ${error.message}`);
+                } else {
+                  throw error;
+                }
+              }
             } else if (!BRANCH.includes('backport-')) {
               // notify slack of repeated failure
               const { WebClient } = require('@slack/web-api');

.github/workflows/reset-cloud-test-dataset.yml

@@ -0,0 +1,63 @@
+name: Reset Cloud Test Dataset
+
+on:
+  workflow_dispatch:
+    inputs:
+      driver:
+        description: 'Driver to reset dataset for'
+        required: true
+        default: 'snowflake'
+        type: choice
+        options:
+          - snowflake
+          - bigquery-cloud-sdk
+          - redshift
+          - databricks
+      dataset-name:
+        description: 'Dataset name to drop (e.g., test-data)'
+        required: true
+        default: 'test-data'
+        type: string
+
+jobs:
+  reset-dataset:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CI: 'true'
+      DRIVERS: ${{ inputs.driver }}
+      # Snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      # BigQuery
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
+      # Redshift
+      MB_REDSHIFT_TEST_USER: metabase_ci
+      MB_REDSHIFT_TEST_DB: testdb
+      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
+      # Databricks
+      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
+      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
+      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
+      MB_DATABRICKS_TEST_CATALOG: metabase_ci
+      MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
+      MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare-backend
+      - name: Drop dataset
+        run: >-
+          clojure -X:dev:drivers:drivers-dev:test
+          metabase.test.data.impl/drop-dataset!
+          :driver '"${{ inputs.driver }}"'
+          :dataset-name '"${{ inputs.dataset-name }}"'

.gitignore

@@ -1,5 +1,6 @@
 *.class
 *.*.rej
+*.d.css
 *.iml
 *.jar
 *.log

.vscode/extensions.json

@@ -9,6 +9,7 @@
     "github.vscode-pull-request-github",
     "limejuly.vscode-yaml-block-highlight",
     "streetsidesoftware.code-spell-checker",
-    "styled-components.vscode-styled-components"
+    "styled-components.vscode-styled-components",
+    "vunguyentuan.vscode-css-variables"
   ]
 }

.vscode/settings.json

@@ -4,5 +4,6 @@
   "jake.autoDetect": "off",
   "gulp.autoDetect": "off",
   "npm.autoDetect": "off",
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "typescript.tsdk": "node_modules/typescript/lib",
+  "cssVariables.lookupFiles": ["**/*.d.css", "node_modules/@mantine/core/*.css"]
 }

CLAUDE.md

@@ -25,6 +25,18 @@ For detailed guidance on writing and reviewing code and documentation, see the s
 
 **Important**: When working with frontend code, read [frontend/CLAUDE.md](frontend/CLAUDE.md) for project-specific guidelines on component preferences, styling, TypeScript migration, testing requirements, and available scripts.
 
+## Running Backend Tests
+
+Use `./bin/test-agent` to run Clojure tests. It produces clean, plain-text output with no progress bars or ANSI codes.
+
+```bash
+./bin/test-agent :only '[metabase.foo-test]'              # run a namespace
+./bin/test-agent :only '[metabase.foo-test/some-test]'    # run a single test
+./bin/test-agent :only '[metabase.foo-test metabase.bar-test]'  # multiple namespaces
+```
+
+Do not use `clj -X:dev:test` directly — its progress-bar output is hard to parse.
+
 ## Tool Preferences
 
 If `clojure-mcp` tools are available, prefer them over shell-based alternatives for Clojure development.

bb.edn

@@ -351,12 +351,13 @@
                          "RUN"
                          (str "any of " (pr-str driver-triggers) " affected by cloud-driver module changes")]
                         ["7"    "Cloud driver + query-processor updated"  "RUN"  "query-processor module updated"]
-                        ["8"    "Cloud driver, no relevant changes"       "SKIP" "no relevant changes for cloud driver"]
-                        ["9"
+                        ["8"    "Cloud driver + driver deps affected"     "RUN"  "driver module affected by shared code changes"]
+                        ["9"    "Cloud driver, no relevant changes"       "SKIP" "no relevant changes for cloud driver"]
+                        ["10"
                          (str (pr-str driver-triggers) " module deps affected")
                          "RUN"
                          (str "any of " (pr-str driver-triggers) " affected by module changes")]
-                        ["10"   "Self-hosted driver, not affected"        "SKIP" "driver module not affected"]])))))
+                        ["11"   "Self-hosted driver, not affected"        "SKIP" "driver module not affected"]])))))
    :options [[nil "--git-ref REF" "The git ref to compute changed modules against"]
              [nil "--is-master-or-release MASTER_OR_RELEASE"]
              [nil "--pr-labels PR_LABELS" "Comma delimited labels on the pr"]
@@ -558,4 +559,25 @@
              [nil "--down" "Tear down all containers for this worktree"]
              [nil "--status" "Show current env status"]
              [nil "--slot SLOT" "Override port slot (0-99)" :parse-fn Integer/parseInt]]
-   :task (task! (dev-env/dev-env! parsed))}}}
+   :task (task! (dev-env/dev-env! parsed))}
+
+  -johnswanson-dev-env
+  {:doc "Stand up (or tear down) an isolated dev environment for this worktree. Interactive prompts when flags omitted."
+   :examples [["./bin/mage -johnswanson-dev-env" "Interactive TUI to configure infra (saves config)"]
+              ["./bin/mage -johnswanson-dev-env --run" "Configure + launch backend/frontend"]
+              ["./bin/mage -johnswanson-dev-env --run --no-frontend" "Configure + backend only"]
+              ["./bin/mage -johnswanson-dev-env --down" "Stop everything for this worktree"]
+              ["./bin/mage -johnswanson-dev-env --status" "Show running containers and processes"]]
+   :requires [[mage.johnswanson.dev-env :as jds-dev-env]]
+   :options [["-e" "--edition EDITION" "ee or oss (default: prompt)"]
+             ["-t" "--token TOKEN" "Token type: all-features, starter-cloud, pro-cloud, pro-self-hosted, none"]
+             [nil "--app-db DB" "App database: h2, postgres, mysql, mariadb (default: prompt)"]
+             [nil "--with SERVICE" "Warehouse service (repeatable): postgres, mysql, mariadb, mongo, clickhouse, ldap, maildev"
+              :multi true :default [] :update-fn conj]
+             [nil "--run" "Also launch backend + frontend in background"]
+             [nil "--no-frontend" "Skip frontend dev server (only with --run)"]
+             [nil "--down" "Stop everything for this worktree"]
+             [nil "--status" "Show current env status"]
+             [nil "--slot SLOT" "Override port slot (0-99)" :parse-fn Integer/parseInt]
+             [nil "--fresh" "Recreate containers from scratch"]]
+   :task (task! (jds-dev-env/dev-env! parsed))}}}

bin/e2e-backend

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PORT="${MB_JETTY_PORT:-4000}"
+
+if curl -sf "http://localhost:$PORT/api/health" > /dev/null 2>&1; then
+  echo "⚠️  Backend already running on :$PORT — reusing it. If you need a different MB_EDITION, kill it first: lsof -ti:$PORT | xargs kill"
+  exit 0
+fi
+
+exec node e2e/runner/start-backend.js

bin/e2e-stress-test

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RUNS="${E2E_STRESS_RUNS:-5}"
+
+if [ $# -eq 0 ]; then
+  echo "Usage: bin/e2e-stress-test [cypress args...]"
+  echo "  e.g. bin/e2e-stress-test --spec e2e/test/scenarios/organization/bookmarks-dashboard.cy.spec.js"
+  echo ""
+  echo "Set E2E_STRESS_RUNS=N to change iteration count (default: 5)"
+  exit 1
+fi
+
+rm -rf cypress/screenshots cypress/videos
+
+for i in $(seq 1 "$RUNS"); do
+  echo ""
+  echo "=========================================="
+  echo "  Run $i / $RUNS"
+  echo "=========================================="
+  echo ""
+
+  if ! CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress "$@"; then
+    echo ""
+    echo "=========================================="
+    echo "  FAILED on run $i / $RUNS"
+    echo "=========================================="
+
+    if ls cypress/screenshots/**/*.png 1>/dev/null 2>&1; then
+      echo ""
+      echo "Screenshots:"
+      find cypress/screenshots -name "*.png" -print
+    fi
+
+    exit 1
+  fi
+done
+
+echo ""
+echo "=========================================="
+echo "  All $RUNS runs passed"
+echo "=========================================="

bin/test-agent

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Agent-friendly test runner for Metabase backend (Clojure) tests.
+#
+# Differences from a normal `clj -X:dev:test` run:
+#   - Uses HAWK_MODE=cli/ci so eftest.report.pretty is used instead of the
+#     progress-bar reporter.  Failures print inline as they happen.
+#   - Strips ANSI escape codes from output so results are plain text.
+#   - Filters Maven download noise and reflection warnings.
+#
+# Usage:
+#   bin/test-agent :only '[metabase.foo-test]'
+#   bin/test-agent :only '[metabase.foo-test/some-test]'
+#   bin/test-agent                          # runs all tests (rarely what you want)
+#
+# Any extra arguments are forwarded directly to `clojure -X:dev:ee:ee-dev:test`.
+# The :test alias uses port 0 (OS-assigned random port) so parallel runs never collide.
+
+set -euo pipefail
+
+export HAWK_MODE=cli/ci
+
+# Filter noise and strip ANSI escape sequences
+clean_output() {
+  grep -v '^Downloading: ' \
+  | grep -v '^Reflection warning,' \
+  | grep -v '^Excluding directory' \
+  | grep -v '^Looking for test namespaces in directory' \
+  | sed $'s/\033[\[(][0-9;]*[A-Za-z]//g; s/\033[^[]*//g'
+}
+
+exec clojure -X:dev:ee:ee-dev:test "$@" 2>&1 | clean_output

bun.lock

@@ -102,7 +102,7 @@
         "hast-util-from-html": "^2.0.1",
         "hast-util-to-html": "^9.0.0",
         "history": "3",
-        "html2canvas-pro": "1.5.0",
+        "html2canvas-pro": "^2.0.2",
         "humanize-plus": "^1.8.1",
         "icepick": "2.4.0",
         "iframe-resizer": "~4.3.2",
@@ -122,7 +122,6 @@
         "mustache": "^2.3.2",
         "normalizr": "^3.0.2",
         "ora": "^8.0.1",
-        "password-generator": "2.3.2",
         "prettier": "^3.3.3",
         "process": "^0.11.10",
         "prop-types": "^15.5.7",
@@ -138,12 +137,12 @@
         "react-dnd-html5-backend": "4",
         "react-dom": "^18.2.0",
         "react-dropzone": "^14.2.3",
-        "react-grid-layout": "^1.4.4",
+        "react-grid-layout": "^1.5.3",
         "react-innertext": "^1.1.5",
         "react-is": "^18.2.0",
         "react-markdown": "^9.0.0",
         "react-redux": "^9.1.2",
-        "react-resizable": "^3.0.5",
+        "react-resizable": "^3.1.3",
         "react-router": "3",
         "react-router-redux": "^4.0.8",
         "react-transition-group": "^4.4.5",
@@ -299,6 +298,7 @@
         "eslint-import-resolver-node": "^0.3.9",
         "eslint-import-resolver-webpack": "^0.13.10",
         "eslint-module-utils": "^2.12.1",
+        "eslint-plugin-boundaries": "5.4.0",
         "eslint-plugin-chai-friendly": "^1.1.0",
         "eslint-plugin-cypress": "6.1.0",
         "eslint-plugin-depend": "1.4.0",
@@ -686,6 +686,8 @@
 
     "@bcoe/v8-coverage": ["@bcoe/v8-coverage@0.2.3", "", {}, "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw=="],
 
+    "@boundaries/elements": ["@boundaries/elements@1.2.0", "", { "dependencies": { "eslint-import-resolver-node": "0.3.9", "eslint-module-utils": "2.12.1", "handlebars": "4.7.8", "is-core-module": "2.16.1", "micromatch": "4.0.8" } }, "sha512-W65Gum02liMd3hmNrLmDBX1u5BmRMcunouFjLXyhxHnNY4YlK1kTxsgfflZ5XBGSnPnO0MkiUzAcoGzYrlx0RQ=="],
+
     "@bundled-es-modules/cookie": ["@bundled-es-modules/cookie@2.0.1", "", { "dependencies": { "cookie": "^0.7.2" } }, "sha512-8o+5fRPLNbjbdGRRmJj3h6Hh1AQJf2dk3qQ/5ZFb+PXkRNiSoMGGUKlsgLfrxneb72axVJyIYji64E2+nNfYyw=="],
 
     "@bundled-es-modules/statuses": ["@bundled-es-modules/statuses@1.0.1", "", { "dependencies": { "statuses": "^2.0.1" } }, "sha512-yn7BklA5acgcBr+7w064fGV+SGIFySjCKpqjcWgBAIfrAkY+4GQTJJHQMeT3V/sgz23VTEVV8TtOmkvJAhFVfg=="],
@@ -2898,6 +2900,8 @@
 
     "eslint-module-utils": ["eslint-module-utils@2.12.1", "", { "dependencies": { "debug": "^3.2.7" } }, "sha512-L8jSWTze7K2mTg0vos/RuLRS5soomksDPoJLXIslC7c8Wmut3bx7CPpJijDcBZtxQ5lrbUdM+s0OlNbz0DCDNw=="],
 
+    "eslint-plugin-boundaries": ["eslint-plugin-boundaries@5.4.0", "", { "dependencies": { "@boundaries/elements": "1.2.0", "chalk": "4.1.2", "eslint-import-resolver-node": "0.3.9", "eslint-module-utils": "2.12.1", "micromatch": "4.0.8" }, "peerDependencies": { "eslint": ">=6.0.0" } }, "sha512-6SQmEhXCqGrrxm9YiM24SC95CqrVi2MUOm5SDrfquceh/os8MIAvZYsDU69zvtCSb1S6UbNEmdioi1gCDc8+VQ=="],
+
     "eslint-plugin-chai-friendly": ["eslint-plugin-chai-friendly@1.1.0", "", { "peerDependencies": { "eslint": ">=3.0.0" } }, "sha512-+T1rClpDdXkgBAhC16vRQMI5umiWojVqkj9oUTdpma50+uByCZM/oBfxitZiOkjMRlm725mwFfz/RVgyDRvCKA=="],
 
     "eslint-plugin-cypress": ["eslint-plugin-cypress@6.1.0", "", { "dependencies": { "globals": "^17.3.0" }, "peerDependencies": { "eslint": ">=9" } }, "sha512-B8sxtNpINDxFkmsu1qKYjg70VsP8SGneEXgLcZMk1bUZcW08S+JyaiMdof1x6dmt02FgOD7YkT4wOaOD5HotJw=="],
@@ -3266,7 +3270,7 @@
 
     "html2canvas": ["html2canvas@1.4.1", "", { "dependencies": { "css-line-break": "^2.1.0", "text-segmentation": "^1.0.3" } }, "sha512-fPU6BHNpsyIhr8yyMpTLLxAbkaK8ArIBcmZIRiBLiDhjeqvXolaEmDGmELFuX9I4xDcaKKcJl+TKZLqruBbmWA=="],
 
-    "html2canvas-pro": ["html2canvas-pro@1.5.0", "", { "dependencies": { "css-line-break": "^2.1.0", "text-segmentation": "^1.0.3" } }, "sha512-izxSphcINRwfEVV6eamsPVdhsxSYqX8n/hxzK+niVWdB+onM+aYRoVO+xgS9iMmZoUleZTWg1tJwryikib2hXg=="],
+    "html2canvas-pro": ["html2canvas-pro@2.0.2", "", { "dependencies": { "css-line-break": "^2.1.0", "text-segmentation": "^1.0.3" } }, "sha512-9G/t0XgCZWonLwL0JwI7su6NdbOPUY7Ur4Ihpp8+XMaW9ibA2nDXF181Jr6tm94k8lX6sthpaXB3XqEnsMd5Cw=="],
 
     "htmlparser2": ["htmlparser2@6.1.0", "", { "dependencies": { "domelementtype": "^2.0.1", "domhandler": "^4.0.0", "domutils": "^2.5.2", "entities": "^2.0.0" } }, "sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A=="],
 
@@ -3906,7 +3910,7 @@
 
     "micromark-util-types": ["micromark-util-types@2.0.0", "", {}, "sha512-oNh6S2WMHWRZrmutsRmDDfkzKtxF+bc2VxLC9dvtrDIRFln627VsFP6fLMgTryGDljgLPjkrzQSDcPrjPyDJ5w=="],
 
-    "micromatch": ["micromatch@4.0.5", "", { "dependencies": { "braces": "^3.0.2", "picomatch": "^2.3.1" } }, "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA=="],
+    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
 
     "miller-rabin": ["miller-rabin@4.0.1", "", { "dependencies": { "bn.js": "^4.0.0", "brorand": "^1.0.1" }, "bin": { "miller-rabin": "bin/miller-rabin" } }, "sha512-115fLhvZVqWwHPbClyntxEVfVDfl9DLLTuJvq3g2O/Oxi8AiNouAHvDSzHS0viUJc+V5vm3eq91Xwqn9dp4jRA=="],
 
@@ -4164,8 +4168,6 @@
 
     "pascal-case": ["pascal-case@3.1.2", "", { "dependencies": { "no-case": "^3.0.4", "tslib": "^2.0.3" } }, "sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g=="],
 
-    "password-generator": ["password-generator@2.3.2", "", { "bin": { "password-generator": "bin/password-generator" } }, "sha512-kJWUrdveSAqHCeWJWnv5vNc89hFHM5au+pvKja5+xCTxlRF3zQaecJlR6hSoOotAJtQ3otQq4/Q4iWc/TxsXhA=="],
-
     "patch-console": ["patch-console@1.0.0", "", {}, "sha512-nxl9nrnLQmh64iTzMfyylSlRozL7kAXIaxw1fVcLYdyhNkJCRUzirRZTikXGJsg+hc4fqpneTK6iU2H1Q8THSA=="],
 
     "patch-package": ["patch-package@8.0.0", "", { "dependencies": { "@yarnpkg/lockfile": "^1.1.0", "chalk": "^4.1.2", "ci-info": "^3.7.0", "cross-spawn": "^7.0.3", "find-yarn-workspace-root": "^2.0.0", "fs-extra": "^9.0.0", "json-stable-stringify": "^1.0.2", "klaw-sync": "^6.0.0", "minimist": "^1.2.6", "open": "^7.4.2", "rimraf": "^2.6.3", "semver": "^7.5.3", "slash": "^2.0.0", "tmp": "^0.0.33", "yaml": "^2.2.2" }, "bin": { "patch-package": "index.js" } }, "sha512-da8BVIhzjtgScwDJ2TtKsfT5JFWz1hYoBl9rUQ1f38MC2HwnEIkK8VN3dKMKcP7P7bvvgzNDbfNHtx3MsQb5vA=="],
@@ -4502,13 +4504,13 @@
 
     "react-dom": ["react-dom@18.2.0", "", { "dependencies": { "loose-envify": "^1.1.0", "scheduler": "^0.23.0" } }, "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g=="],
 
-    "react-draggable": ["react-draggable@4.4.6", "", { "dependencies": { "clsx": "^1.1.1", "prop-types": "^15.8.1" } }, "sha512-LtY5Xw1zTPqHkVmtM3X8MUOxNDOUhv/khTgBgrUvwaS064bwVvxT+q5El0uUFNx5IEPKXuRejr7UqLwBIg5pdw=="],
+    "react-draggable": ["react-draggable@4.5.0", "", { "dependencies": { "clsx": "^2.1.1", "prop-types": "^15.8.1" }, "peerDependencies": { "react": ">= 16.3.0", "react-dom": ">= 16.3.0" } }, "sha512-VC+HBLEZ0XJxnOxVAZsdRi8rD04Iz3SiiKOoYzamjylUcju/hP9np/aZdLHf/7WOD268WMoNJMvYfB5yAK45cw=="],
 
     "react-dropzone": ["react-dropzone@14.2.3", "", { "dependencies": { "attr-accept": "^2.2.2", "file-selector": "^0.6.0", "prop-types": "^15.8.1" } }, "sha512-O3om8I+PkFKbxCukfIR3QAGftYXDZfOE2N1mr/7qebQJHs7U+/RSL/9xomJNpRg9kM5h9soQSdf0Gc7OHF5Fug=="],
 
     "react-fast-compare": ["react-fast-compare@2.0.4", "", {}, "sha512-suNP+J1VU1MWFKcyt7RtjiSWUjvidmQSlqu+eHslq+342xCbGTYmC0mEhPCOHxlW0CywylOC1u2DFAT+bv4dBw=="],
 
-    "react-grid-layout": ["react-grid-layout@1.5.0", "", { "dependencies": { "clsx": "^2.0.0", "fast-equals": "^4.0.3", "prop-types": "^15.8.1", "react-draggable": "^4.4.5", "react-resizable": "^3.0.5", "resize-observer-polyfill": "^1.5.1" } }, "sha512-WBKX7w/LsTfI99WskSu6nX2nbJAUD7GD6nIXcwYLyPpnslojtmql2oD3I2g5C3AK8hrxIarYT8awhuDIp7iQ5w=="],
+    "react-grid-layout": ["react-grid-layout@1.5.3", "", { "dependencies": { "clsx": "^2.1.1", "fast-equals": "^4.0.3", "prop-types": "^15.8.1", "react-draggable": "^4.4.6", "react-resizable": "^3.0.5", "resize-observer-polyfill": "^1.5.1" }, "peerDependencies": { "react": ">= 16.3.0", "react-dom": ">= 16.3.0" } }, "sha512-KaG6IbjD6fYhagUtIvOzhftXG+ViKZjCjADe86X1KHl7C/dsBN2z0mi14nbvZKTkp0RKiil9RPcJBgq3LnoA8g=="],
 
     "react-innertext": ["react-innertext@1.1.5", "", {}, "sha512-PWAqdqhxhHIv80dT9znP2KvS+hfkbRovFp4zFYHFFlOoQLRiawIic81gKb3U1wEyJZgMwgs3JoLtwryASRWP3Q=="],
 
@@ -4530,7 +4532,7 @@
 
     "react-remove-scroll-bar": ["react-remove-scroll-bar@2.3.8", "", { "dependencies": { "react-style-singleton": "^2.2.2", "tslib": "^2.0.0" } }, "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q=="],
 
-    "react-resizable": ["react-resizable@3.0.5", "", { "dependencies": { "prop-types": "15.x", "react-draggable": "^4.0.3" } }, "sha512-vKpeHhI5OZvYn82kXOs1bC8aOXktGU5AmKAgaZS4F5JPburCtbmDPqE7Pzp+1kN4+Wb81LlF33VpGwWwtXem+w=="],
+    "react-resizable": ["react-resizable@3.1.3", "", { "dependencies": { "prop-types": "15.x", "react-draggable": "^4.5.0" }, "peerDependencies": { "react": ">= 16.3", "react-dom": ">= 16.3" } }, "sha512-liJBNayhX7qA4tBJiBD321FDhJxgGTJ07uzH5zSORXoE8h7PyEZ8mLqmosST7ppf6C4zUsbd2gzDMmBCfFp9Lw=="],
 
     "react-router": ["react-router@3.2.6", "", { "dependencies": { "create-react-class": "^15.5.1", "history": "^3.0.0", "hoist-non-react-statics": "^3.3.2", "invariant": "^2.2.1", "loose-envify": "^1.2.0", "prop-types": "^15.7.2", "react-is": "^16.13.0", "warning": "^3.0.0" } }, "sha512-nlxtQE8B22hb/JxdaslI1tfZacxFU8x8BJryXOnR2RxB4vc01zuHYAHAIgmBkdk1kzXaA25hZxK6KAH/+CXArw=="],
 
@@ -5450,6 +5452,8 @@
 
     "@babel/register/source-map-support": ["source-map-support@0.5.19", "", { "dependencies": { "buffer-from": "^1.0.0", "source-map": "^0.6.0" } }, "sha512-Wonm7zOCIJzBGQdB+thsPar0kYuCIzYvxZwlBa87yi/Mdjv7Tip2cyVbLj5o0cFPN4EVkuTwb3GDDyUx2DGnGw=="],
 
+    "@boundaries/elements/is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
+
     "@bundled-es-modules/tough-cookie/tough-cookie": ["tough-cookie@4.1.4", "", { "dependencies": { "psl": "^1.1.33", "punycode": "^2.1.1", "universalify": "^0.2.0", "url-parse": "^1.5.3" } }, "sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag=="],
 
     "@cacheable/memory/keyv": ["keyv@5.5.3", "", { "dependencies": { "@keyv/serialize": "^1.1.1" } }, "sha512-h0Un1ieD+HUrzBH6dJXhod3ifSghk5Hw/2Y4/KHBziPlZecrFyE9YOTPU6eOs0V9pYl8gOs86fkr/KN8lUX39A=="],
@@ -5546,8 +5550,6 @@
 
     "@jest/core/ansi-escapes": ["ansi-escapes@4.3.2", "", { "dependencies": { "type-fest": "^0.21.3" } }, "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ=="],
 
-    "@jest/core/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "@jest/core/pretty-format": ["pretty-format@30.2.0", "", { "dependencies": { "@jest/schemas": "30.0.5", "ansi-styles": "^5.2.0", "react-is": "^18.3.1" } }, "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA=="],
 
     "@jest/core/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
@@ -5570,8 +5572,6 @@
 
     "@jest/transform/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.29", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ=="],
 
-    "@jest/transform/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "@jest/transform/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
     "@jridgewell/gen-mapping/@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.0", "", {}, "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ=="],
@@ -5620,8 +5620,6 @@
 
     "@nicolo-ribaudo/eslint-scope-5-internals/eslint-scope": ["eslint-scope@5.1.1", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^4.1.1" } }, "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw=="],
 
-    "@parcel/watcher/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "@pmmmwh/react-refresh-webpack-plugin/source-map": ["source-map@0.7.3", "", {}, "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ=="],
 
     "@redocly/cli/ajv": ["@redocly/ajv@8.17.4", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-BieiCML/IgP6x99HZByJSt7fJE4ipgzO7KAFss92Bs+PEI35BhY7vGIysFXLT+YmS7nHtQjZjhOQyPPEf7xGHA=="],
@@ -5716,8 +5714,6 @@
 
     "@storybook/react-docgen-typescript-plugin/find-cache-dir": ["find-cache-dir@3.3.1", "", { "dependencies": { "commondir": "^1.0.1", "make-dir": "^3.0.2", "pkg-dir": "^4.1.0" } }, "sha512-t2GDMt3oGC/v+BMwzmllWDuJF/xcDtE5j/fCGbqDD7OLuJkj0cfh1YSA5VKPvwMeLFLNDBkwOKZ2X85jGLVftQ=="],
 
-    "@storybook/react-docgen-typescript-plugin/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "@storybook/react-docgen-typescript-plugin/tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
 
     "@storybook/test/@testing-library/dom": ["@testing-library/dom@10.4.0", "", { "dependencies": { "@babel/code-frame": "^7.10.4", "@babel/runtime": "^7.12.5", "@types/aria-query": "^5.0.1", "aria-query": "5.3.0", "chalk": "^4.1.0", "dom-accessibility-api": "^0.5.9", "lz-string": "^1.5.0", "pretty-format": "^27.0.2" } }, "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ=="],
@@ -6218,8 +6214,6 @@
 
     "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
 
-    "fast-glob/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "fast-png/pako": ["pako@2.1.0", "", {}, "sha512-w+eufiZ1WuJYgPXbV/PO3NCMEc3xqylkKHzp8bxp1uW4qaSNQUkwmLLEc3kKsfz8lpV1F8Ht3U1Cm+9Srog2ug=="],
 
     "figures/escape-string-regexp": ["escape-string-regexp@1.0.5", "", {}, "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg=="],
@@ -6238,8 +6232,6 @@
 
     "find-test-names/acorn-walk": ["acorn-walk@8.2.0", "", {}, "sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA=="],
 
-    "find-yarn-workspace-root/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "flat-cache/rimraf": ["rimraf@3.0.2", "", { "dependencies": { "glob": "^7.1.3" }, "bin": { "rimraf": "bin.js" } }, "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA=="],
 
     "foreground-child/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
@@ -6324,8 +6316,6 @@
 
     "http-proxy-middleware/is-plain-obj": ["is-plain-obj@3.0.0", "", {}, "sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA=="],
 
-    "http-proxy-middleware/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "img-diff-js/@types/node": ["@types/node@14.18.63", "", {}, "sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ=="],
 
     "import-fresh/resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
@@ -6400,8 +6390,6 @@
 
     "jest-config/glob": ["glob@10.5.0", "", { "dependencies": { "foreground-child": "^3.1.0", "jackspeak": "^3.1.2", "minimatch": "^9.0.4", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^1.11.1" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg=="],
 
-    "jest-config/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "jest-config/parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="],
 
     "jest-config/pretty-format": ["pretty-format@30.2.0", "", { "dependencies": { "@jest/schemas": "30.0.5", "ansi-styles": "^5.2.0", "react-is": "^18.3.1" } }, "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA=="],
@@ -6416,16 +6404,12 @@
 
     "jest-haste-map/jest-worker": ["jest-worker@30.2.0", "", { "dependencies": { "@types/node": "*", "@ungap/structured-clone": "^1.3.0", "jest-util": "30.2.0", "merge-stream": "^2.0.0", "supports-color": "^8.1.1" } }, "sha512-0Q4Uk8WF7BUwqXHuAjc23vmopWJw5WH7w2tqBoUOZpOjW/ZnR44GXXd1r82RvnmI2GZge3ivrYXk/BE2+VtW2g=="],
 
-    "jest-haste-map/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "jest-junit/uuid": ["uuid@8.3.2", "", { "bin": { "uuid": "dist/bin/uuid" } }, "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="],
 
     "jest-leak-detector/pretty-format": ["pretty-format@30.2.0", "", { "dependencies": { "@jest/schemas": "30.0.5", "ansi-styles": "^5.2.0", "react-is": "^18.3.1" } }, "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA=="],
 
     "jest-matcher-utils/pretty-format": ["pretty-format@30.2.0", "", { "dependencies": { "@jest/schemas": "30.0.5", "ansi-styles": "^5.2.0", "react-is": "^18.3.1" } }, "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA=="],
 
-    "jest-message-util/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "jest-message-util/pretty-format": ["pretty-format@30.2.0", "", { "dependencies": { "@jest/schemas": "30.0.5", "ansi-styles": "^5.2.0", "react-is": "^18.3.1" } }, "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA=="],
 
     "jest-message-util/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
@@ -6510,6 +6494,8 @@
 
     "lint-staged/listr2": ["listr2@6.6.1", "", { "dependencies": { "cli-truncate": "^3.1.0", "colorette": "^2.0.20", "eventemitter3": "^5.0.1", "log-update": "^5.0.1", "rfdc": "^1.3.0", "wrap-ansi": "^8.1.0" } }, "sha512-+rAXGHh0fkEWdXBmX+L6mmfmXmXvDGEKzkjxO+8mP3+nI/r/CWznVBvsibXdxda9Zz0OW2e2ikphN3OwCT/jSg=="],
 
+    "lint-staged/micromatch": ["micromatch@4.0.5", "", { "dependencies": { "braces": "^3.0.2", "picomatch": "^2.3.1" } }, "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA=="],
+
     "listr2/colorette": ["colorette@2.0.20", "", {}, "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w=="],
 
     "load-json-file/graceful-fs": ["graceful-fs@4.2.4", "", {}, "sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw=="],
@@ -6548,8 +6534,6 @@
 
     "mdast-util-to-markdown/@types/unist": ["@types/unist@3.0.2", "", {}, "sha512-dqId9J8K/vGi5Zr7oo212BGii5m3q5Hxlkwy3WpYuKPklmBEvsbMYYyLxAQpSffdLl/gdW0XUpKWFvYmyoWCoQ=="],
 
-    "micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "miller-rabin/bn.js": ["bn.js@4.11.9", "", {}, "sha512-E6QoYqCKZfgatHTdHzs1RRKP7ip4vvm+EyRUeE2RF0NblwVvb0p6jSVeNTOFxPn26QXN2o6SMfNxKp6kU8zQaw=="],
 
     "mini-css-extract-plugin/schema-utils": ["schema-utils@4.0.0", "", { "dependencies": { "@types/json-schema": "^7.0.9", "ajv": "^8.8.0", "ajv-formats": "^2.1.1", "ajv-keywords": "^5.0.0" } }, "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg=="],
@@ -6762,8 +6746,6 @@
 
     "react-docgen-typescript-plugin/find-cache-dir": ["find-cache-dir@3.3.1", "", { "dependencies": { "commondir": "^1.0.1", "make-dir": "^3.0.2", "pkg-dir": "^4.1.0" } }, "sha512-t2GDMt3oGC/v+BMwzmllWDuJF/xcDtE5j/fCGbqDD7OLuJkj0cfh1YSA5VKPvwMeLFLNDBkwOKZ2X85jGLVftQ=="],
 
-    "react-docgen-typescript-plugin/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "react-draggable/clsx": ["clsx@1.2.1", "", {}, "sha512-EcR6r5a8bj6pu3ycsa/E/cKVGuTgZJZdsyUYHOksG/UHIiKfjxzRxYJpyVBwYaQeOvghal9fcc4PidlgzugAQg=="],
 
     "react-grid-layout/fast-equals": ["fast-equals@4.0.3", "", {}, "sha512-G3BSX9cfKttjr+2o1O22tYMLq0DPluZnYtq1rXumE1SpL/F/SLIfHx08WYQoWSIpeMYf8sRbJ8++71+v6Pnxfg=="],
@@ -6914,8 +6896,6 @@
 
     "stylelint/meow": ["meow@13.2.0", "", {}, "sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA=="],
 
-    "stylelint/micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
-
     "stylelint-scss/known-css-properties": ["known-css-properties@0.36.0", "", {}, "sha512-A+9jP+IUmuQsNdsLdcg6Yt7voiMF/D4K83ew0OpJtpu+l34ef7LaohWV0Rc6KNvzw6ZDizkqfyB5JznZnzuKQA=="],
 
     "stylelint-scss/mdn-data": ["mdn-data@2.24.0", "", {}, "sha512-i97fklrJl03tL1tdRVw0ZfLLvuDsdb6wxL+TrJ+PKkCbLrp2PCu2+OYdCKychIUm19nSM/35S6qz7pJpnXttoA=="],
@@ -7174,8 +7154,6 @@
 
     "@jest/core/ansi-escapes/type-fest": ["type-fest@0.21.3", "", {}, "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w=="],
 
-    "@jest/core/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "@jest/core/pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
     "@jest/core/pretty-format/react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
@@ -7202,8 +7180,6 @@
 
     "@jest/transform/@jridgewell/trace-mapping/@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.4.15", "", {}, "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg=="],
 
-    "@jest/transform/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "@jridgewell/gen-mapping/@jridgewell/trace-mapping/@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
 
     "@jridgewell/gen-mapping/@jridgewell/trace-mapping/@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.4.15", "", {}, "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg=="],
@@ -7254,8 +7230,6 @@
 
     "@nicolo-ribaudo/eslint-scope-5-internals/eslint-scope/estraverse": ["estraverse@4.3.0", "", {}, "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw=="],
 
-    "@parcel/watcher/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "@redocly/cli/glob/minimatch": ["minimatch@10.2.0", "", { "dependencies": { "brace-expansion": "^5.0.2" } }, "sha512-ugkC31VaVg9cF0DFVoADH12k6061zNZkZON+aX8AWsR9GhPcErkcMBceb6znR8wLERM2AkkOxy2nWRLpT9Jq5w=="],
 
     "@redocly/cli/react-dom/scheduler": ["scheduler@0.23.2", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ=="],
@@ -7354,8 +7328,6 @@
 
     "@storybook/react-docgen-typescript-plugin/find-cache-dir/make-dir": ["make-dir@3.1.0", "", { "dependencies": { "semver": "^6.0.0" } }, "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw=="],
 
-    "@storybook/react-docgen-typescript-plugin/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "@storybook/test/@testing-library/dom/dom-accessibility-api": ["dom-accessibility-api@0.5.13", "", {}, "sha512-R305kwb5CcMDIpSHUnLyIAp7SrSPBx6F0VfQFB3M75xVMHhXJJIdePYgbPPh1o57vCHNu5QztokWUPsLjWzFqw=="],
 
     "@svgr/core/cosmiconfig/js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="],
@@ -7584,8 +7556,6 @@
 
     "fast-glob/glob-parent/is-glob": ["is-glob@4.0.1", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-5G0tKtBTFImOqDnLB2hG6Bp2qcKEFduo4tZu9MT/H6NQv/ghhy30o55ufafxJ/LdH79LLs2Kfrn85TLKyA7BUg=="],
 
-    "fast-glob/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "file-entry-cache/flat-cache/flatted": ["flatted@3.3.3", "", {}, "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg=="],
 
     "filing-cabinet/enhanced-resolve/graceful-fs": ["graceful-fs@4.2.6", "", {}, "sha512-nTnJ528pbqxYanhpDYsi4Rd8MAeaBA67+RZ10CM1m3bTAVFEDcd5AuA4a6W5YkGZ1iNXHzZz8T6TBKLeBuNriQ=="],
@@ -7596,8 +7566,6 @@
 
     "find-cypress-specs/minimatch/brace-expansion": ["brace-expansion@2.0.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA=="],
 
-    "find-yarn-workspace-root/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "fork-ts-checker-webpack-plugin/chokidar/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="],
 
     "fork-ts-checker-webpack-plugin/chokidar/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
@@ -7628,8 +7596,6 @@
 
     "htmlparser2/domutils/domelementtype": ["domelementtype@2.2.0", "", {}, "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A=="],
 
-    "http-proxy-middleware/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "import-jsx/make-dir/semver": ["semver@6.3.0", "", { "bin": { "semver": "./bin/semver.js" } }, "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw=="],
 
     "ink/ansi-escapes/type-fest": ["type-fest@0.21.3", "", {}, "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w=="],
@@ -7758,8 +7724,6 @@
 
     "jest-config/glob/path-scurry": ["path-scurry@1.11.1", "", { "dependencies": { "lru-cache": "^10.2.0", "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" } }, "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA=="],
 
-    "jest-config/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "jest-config/pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
     "jest-config/pretty-format/react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
@@ -7776,8 +7740,6 @@
 
     "jest-haste-map/jest-worker/supports-color": ["supports-color@8.1.1", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q=="],
 
-    "jest-haste-map/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "jest-leak-detector/pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
     "jest-leak-detector/pretty-format/react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
@@ -7786,8 +7748,6 @@
 
     "jest-matcher-utils/pretty-format/react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
 
-    "jest-message-util/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "jest-message-util/pretty-format/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
     "jest-message-util/pretty-format/react-is": ["react-is@18.3.1", "", {}, "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg=="],
@@ -7852,6 +7812,8 @@
 
     "lint-staged/listr2/wrap-ansi": ["wrap-ansi@8.1.0", "", { "dependencies": { "ansi-styles": "^6.1.0", "string-width": "^5.0.1", "strip-ansi": "^7.0.1" } }, "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ=="],
 
+    "lint-staged/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+
     "log-update/ansi-escapes/type-fest": ["type-fest@0.21.3", "", {}, "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w=="],
 
     "md5.js/hash-base/readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="],
@@ -8034,8 +7996,6 @@
 
     "react-docgen-typescript-plugin/find-cache-dir/make-dir": ["make-dir@3.1.0", "", { "dependencies": { "semver": "^6.0.0" } }, "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw=="],
 
-    "react-docgen-typescript-plugin/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "react-docgen/@types/babel__core/@types/babel__traverse": ["@types/babel__traverse@7.14.2", "", { "dependencies": { "@babel/types": "^7.3.0" } }, "sha512-K2waXdXBi2302XUdcHcR1jCeU0LL4TD9HRs/gk0N2Xvrht+G/BfJa4QObBQZfhMdxiCpV3COl5Nfq4uKTeTnJA=="],
 
     "read-pkg-up/find-up/path-exists": ["path-exists@2.1.0", "", { "dependencies": { "pinkie-promise": "^2.0.0" } }, "sha512-yTltuKuhtNeFJKa1PiRzfLAU5182q1y4Eb4XCJ3PBqyzEDkAZRzBrKKBct682ls9reBVHf9udYLN5Nd+K1B9BQ=="],
@@ -8110,8 +8070,6 @@
 
     "stylelint/globby/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
-    "stylelint/micromatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
-
     "stylus/glob/minimatch": ["minimatch@3.1.2", "", { "dependencies": { "brace-expansion": "^1.1.7" } }, "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw=="],
 
     "svgo/css-tree/mdn-data": ["mdn-data@2.0.30", "", {}, "sha512-GaqWWShW4kv/G9IEucWScBx9G1/vsFZZJUO+tD26M8J8z3Kw5RDQjaoZe03YAClgeS/SWPOcb4nkFBTEi5DUEA=="],

cross-version/README.md

@@ -0,0 +1,55 @@
+# Cross-Version Migration Testing
+
+Tests Metabase database migrations across version upgrades and downgrades.
+
+## Quick Start
+
+```bash
+# Test upgrade (OSS)
+./test.sh --source v0.58.6 --target v0.58.7
+
+# Test downgrade (OSS)
+./test.sh --source v0.58.7 --target v0.58.6
+
+# Test Enterprise edition (use v1.x.x)
+./test.sh --source v1.58.6 --target v1.58.7
+```
+
+Edition is inferred from version prefix: `v0.x.x` = OSS, `v1.x.x` = EE.
+
+## Requirements
+
+- Docker
+- Docker Compose v2
+- Bun (for version helpers CLI)
+
+## How It Works
+
+### Upgrade Test
+1. Start PostgreSQL container
+2. Start SOURCE Metabase version, wait for healthy
+3. Stop SOURCE container (PostgreSQL persists)
+4. Start TARGET version - migrations run automatically
+5. Verify health check passes
+
+### Downgrade Test
+1. Start PostgreSQL container
+2. Start SOURCE (newer) Metabase version, wait for healthy
+3. Stop SOURCE container
+4. Start TARGET (older) version - expects refusal
+5. Run `migrate down` command
+6. Start TARGET version again
+7. Verify health check passes
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `METABASE_PORT` | 3000 | Port to expose Metabase |
+| `HEALTH_TIMEOUT` | 120 | Seconds to wait for health check |
+
+## CI
+
+The GitHub workflow (`.github/workflows/cross-version.yml`) supports:
+- **Manual trigger**: Specify source/target versions
+- **Nightly schedule**: Runs predefined version matrix

cross-version/cli.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+import {
+  compareVersions,
+  getDockerImage,
+  getMajorVersion,
+} from "../release/src/cross-version-helpers";
+
+const [cmd, ...args] = process.argv.slice(2);
+
+if (cmd === "compare") {
+  console.log(compareVersions(args[0], args[1]));
+} else if (cmd === "image") {
+  console.log(getDockerImage(args[0]));
+} else if (cmd === "major") {
+  console.log(getMajorVersion(args[0]));
+} else {
+  console.error("Usage: cli.ts <compare|image|major> [args]");
+  process.exit(1);
+}

cross-version/docker-compose.yml

@@ -0,0 +1,32 @@
+services:
+  postgres:
+    image: postgres:15
+    environment:
+      POSTGRES_USER: metabase
+      POSTGRES_PASSWORD: metabase
+      POSTGRES_DB: metabase
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U metabase"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+
+  metabase:
+    image: ${METABASE_IMAGE:-metabase/metabase:latest}
+    ports:
+      - "${METABASE_PORT:-3000}:3000"
+    environment:
+      MB_DB_TYPE: postgres
+      MB_DB_DBNAME: metabase
+      MB_DB_PORT: 5432
+      MB_DB_USER: metabase
+      MB_DB_PASS: metabase
+      MB_DB_HOST: postgres
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+volumes:
+  postgres_data:

cross-version/test.sh

@@ -0,0 +1,383 @@
+#!/usr/bin/env bash
+#
+# Cross-version migration testing for Metabase
+#
+# Usage:
+#   ./test.sh --source v0.58.6 --target v0.58.7
+#
+# Edition (OSS/EE) is inferred from version prefix (v0.x = OSS, v1.x = EE).
+# Direction (upgrade/downgrade) is inferred from version comparison.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Defaults
+SOURCE_VERSION=""
+TARGET_VERSION=""
+METABASE_PORT="${METABASE_PORT:-3000}"
+HEALTH_TIMEOUT="${HEALTH_TIMEOUT:-120}"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+log() { echo -e "${GREEN}[cross-version]${NC} $*"; }
+warn() { echo -e "${YELLOW}[cross-version]${NC} $*"; }
+error() { echo -e "${RED}[cross-version]${NC} $*" >&2; }
+
+usage() {
+  cat <<EOF
+Usage: $0 --source VERSION --target VERSION
+
+Options:
+  --source VERSION    Source version (e.g., v0.58.6 for OSS, v1.58.6 for EE)
+  --target VERSION    Target version (e.g., v0.58.7 for OSS, v1.58.7 for EE)
+  --help              Show this help
+
+Examples:
+  $0 --source v0.58.6 --target v0.58.7    # Upgrade test (OSS)
+  $0 --source v0.58.7 --target v0.58.6    # Downgrade test (OSS)
+  $0 --source v1.58.6 --target v1.58.7    # Upgrade test (EE)
+EOF
+  exit 1
+}
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --source) SOURCE_VERSION="$2"; shift 2 ;;
+    --target) TARGET_VERSION="$2"; shift 2 ;;
+    --help) usage ;;
+    *) error "Unknown option: $1"; usage ;;
+  esac
+done
+
+if [[ -z "$SOURCE_VERSION" || -z "$TARGET_VERSION" ]]; then
+  error "Both --source and --target are required"
+  usage
+fi
+
+# CLI wrapper for version helpers (uses tested TypeScript implementation)
+cli() {
+  bun "$SCRIPT_DIR/cli.ts" "$@"
+}
+
+wait_for_health() {
+  local timeout="$1"
+  local start_time=$(date +%s)
+
+  log "Waiting for Metabase to be healthy (timeout: ${timeout}s)..."
+
+  while true; do
+    local current_time=$(date +%s)
+    local elapsed=$((current_time - start_time))
+
+    if (( elapsed >= timeout )); then
+      error "Health check timed out after ${timeout}s"
+      return 1
+    fi
+
+    if curl -sf "http://localhost:${METABASE_PORT}/api/health" > /dev/null 2>&1; then
+      local response=$(curl -sf "http://localhost:${METABASE_PORT}/api/health")
+      if [[ "$response" == '{"status":"ok"}' ]]; then
+        log "Health check passed after ${elapsed}s"
+        return 0
+      fi
+    fi
+
+    sleep 2
+  done
+}
+
+# Start Metabase with a specific image
+start_metabase() {
+  local image="$1"
+  log "Starting Metabase with image: $image"
+
+  METABASE_IMAGE="$image" METABASE_PORT="$METABASE_PORT" \
+    docker compose up -d --quiet-pull
+}
+
+# Stop Metabase (but keep postgres)
+stop_metabase() {
+  log "Stopping Metabase container..."
+  docker compose stop metabase
+  docker compose rm -f metabase
+}
+
+# Get edition prefix from version (0 for OSS, 1 for EE)
+get_edition_prefix() {
+  local version="$1"
+  if [[ "$version" == "HEAD" ]]; then
+    echo "1"  # HEAD is EE
+  elif [[ "$version" =~ ^v([01])\. ]]; then
+    echo "${BASH_REMATCH[1]}"
+  else
+    error "Cannot determine edition from version: $version"
+    return 1
+  fi
+}
+
+# https://www.metabase.com/docs/latest/installation-and-operation/upgrading-metabase#using-the-migrate-down-command
+# Run a single migrate down step (rolls back exactly one major version)
+# This function is idempotent - it takes a version string and handles everything internally.
+migrate_down_step() {
+  local version="$1"
+  local image is_head="false"
+
+  # Resolve image from version
+  image=$(cli image "$version") || return 1
+  [[ "$version" == "HEAD" ]] && is_head="true"
+
+  log "Running 'migrate down' for version: $version (image: $image)"
+
+  local output
+  local exit_code=0
+
+  # The HEAD Docker image has version "vUNKNOWN" in its version.properties,
+  # which causes `migrate down` to fail with a NullPointerException when trying
+  # to determine the current major version. To work around this, we extract the
+  # JAR, replace version.properties with the upcoming version, and mount the
+  # modified JAR.
+  #
+  # HEAD is the next major version (CURRENT_VERSION + 1).
+  #
+  # See DEV-1636 for a potential backend fix that would make this unnecessary.
+  if [[ "$is_head" == "true" ]]; then
+    if [[ -z "$CURRENT_VERSION" ]]; then
+      error "CURRENT_VERSION must be set when testing HEAD downgrades"
+      return 1
+    fi
+    local next_version=$((CURRENT_VERSION + 1))
+    local upcoming_version="v1.${next_version}.0"
+    local work_dir="/tmp/metabase-head-jar"
+    local modified_jar="$work_dir/metabase.jar"
+
+    log "HEAD JAR needs patching (version.properties says 'vUNKNOWN', setting to $upcoming_version)"
+    rm -rf "$work_dir"
+    mkdir -p "$work_dir"
+
+    # Extract JAR from container (copy to host with proper permissions)
+    docker create --name metabase-jar-extract "$image" >/dev/null
+    docker cp metabase-jar-extract:/app/metabase.jar "$modified_jar"
+    docker rm metabase-jar-extract >/dev/null
+
+    # Create version.properties with upcoming version and update the JAR
+    echo "tag=$upcoming_version" > "$work_dir/version.properties"
+    echo "hash=HEAD" >> "$work_dir/version.properties"
+    echo "date=$(date +%Y-%m-%d)" >> "$work_dir/version.properties"
+    (cd "$work_dir" && zip -u metabase.jar version.properties >/dev/null)
+
+    log "HEAD JAR patched - proceeding with migrate down"
+
+    output=$(METABASE_IMAGE="$image" docker compose run --rm --quiet-pull \
+      -v "$modified_jar:/app/metabase.jar:ro" \
+      metabase "migrate down" 2>&1) || exit_code=$?
+  else
+    output=$(METABASE_IMAGE="$image" docker compose run --rm --quiet-pull metabase "migrate down" 2>&1) || exit_code=$?
+  fi
+
+  # Always print output for visibility
+  echo "$output"
+
+  # Check for errors - Metabase returns 0 even on partial rollback failures
+  if [[ $exit_code -ne 0 ]]; then
+    error "migrate down failed with exit code $exit_code"
+    return 1
+  fi
+
+  if echo "$output" | grep -q "ERROR.*liquibase\|RollbackFailedException\|Command failed with exception"; then
+    error "migrate down encountered errors (check logs above)"
+    return 1
+  fi
+}
+
+# Cascading migrate down: rolls back multiple major versions one at a time
+# Metabase only supports rolling back one major version per `migrate down` call,
+# so we need to iterate through intermediate versions.
+cascading_migrate_down() {
+  local source_version="$1"
+  local target_version="$2"
+
+  local source_major target_major edition_prefix
+  source_major=$(cli major "$source_version") || return 1
+  target_major=$(cli major "$target_version") || return 1
+  edition_prefix=$(get_edition_prefix "$source_version") || return 1
+
+  local steps=$((source_major - target_major))
+  log "Cascading migrate down: v$source_major → v$target_major ($steps step(s))"
+
+  # Build version sequence: source version first, then intermediate rolling versions
+  local versions=("$source_version")
+  local current=$((source_major - 1))
+  while (( current > target_major )); do
+    versions+=("v${edition_prefix}.${current}.x")
+    ((current--))
+  done
+
+  # Simple loop - each step handles its own image resolution
+  local step=1
+  for version in "${versions[@]}"; do
+    log "--------------------------------------------"
+    log "Cascade step $step/$steps: $version"
+    log "--------------------------------------------"
+    if ! migrate_down_step "$version"; then
+      error "Migrate down failed at step $step ($version)"
+      return 1
+    fi
+    ((step++))
+  done
+
+  log "--------------------------------------------"
+  log "Cascading migrate down complete"
+}
+
+# Check if Metabase refuses to start (downgrade detection)
+check_downgrade_refused() {
+  local timeout=60
+  local start_time=$(date +%s)
+
+  log "Checking if Metabase detects downgrade and refuses to start..."
+
+  while true; do
+    local current_time=$(date +%s)
+    local elapsed=$((current_time - start_time))
+
+    if (( elapsed >= timeout )); then
+      error "Timed out waiting for downgrade detection"
+      return 1
+    fi
+
+    # Check container logs for downgrade error
+    local logs=$(docker compose logs metabase 2>&1 || true)
+
+    if echo "$logs" | grep -qi "migrate.*down\|downgrade\|database.*newer"; then
+      log "Metabase correctly detected downgrade scenario"
+      return 0
+    fi
+
+    local status=$(docker compose ps metabase --format '{{.Status}}' 2>/dev/null || echo "")
+    if [[ "$status" =~ [Ee]xit ]]; then
+      log "Metabase container exited (expected for downgrade)"
+      return 0
+    fi
+
+    sleep 2
+  done
+}
+
+cleanup() {
+  log "Cleaning up..."
+  docker compose down -v --remove-orphans 2>/dev/null || true
+}
+
+check_image_exists() {
+  local image="$1"
+  if ! docker manifest inspect "$image" > /dev/null 2>&1; then
+    error "Docker image not found: $image"
+    exit 1
+  fi
+}
+
+main() {
+  local direction source_image target_image
+
+  direction=$(cli compare "$SOURCE_VERSION" "$TARGET_VERSION") || exit 1
+  source_image=$(cli image "$SOURCE_VERSION") || exit 1
+  target_image=$(cli image "$TARGET_VERSION") || exit 1
+
+  if [[ "$direction" == "same" ]]; then
+    error "Source and target versions are the same"
+    exit 1
+  fi
+
+  log "Checking if Docker images exist..."
+  check_image_exists "$source_image"
+  check_image_exists "$target_image"
+
+  log "============================================"
+  log "Cross-Version Migration Test"
+  log "============================================"
+  log "Direction: $direction"
+  log "Source: $source_image"
+  log "Target: $target_image"
+  log "============================================"
+
+  # Ensure clean state
+  cleanup
+
+  trap cleanup EXIT
+
+  log ""
+  log "Step 1: Starting SOURCE version ($SOURCE_VERSION)..."
+  start_metabase "$source_image"
+
+  if ! wait_for_health "$HEALTH_TIMEOUT"; then
+    error "❌ SOURCE version ($SOURCE_VERSION) failed health check"
+    docker compose logs metabase
+    exit 1
+  fi
+
+  log "✅ SOURCE version ($SOURCE_VERSION) is healthy"
+
+  log ""
+  log "Step 2: Stopping SOURCE version ($SOURCE_VERSION)..."
+  stop_metabase
+
+  log ""
+  log "Step 3: Starting TARGET version ($TARGET_VERSION)..."
+  start_metabase "$target_image"
+
+  if [[ "$direction" == "upgrade" ]]; then
+    # Upgrade: should migrate automatically and become healthy
+    if ! wait_for_health "$HEALTH_TIMEOUT"; then
+      error "❌ TARGET version ($TARGET_VERSION) failed health check after upgrade"
+      docker compose logs metabase
+      exit 1
+    fi
+    log "✅ UPGRADE successful - TARGET version ($TARGET_VERSION) is healthy"
+
+  else
+    # Downgrade: should refuse to start, then we run migrate down
+    if ! check_downgrade_refused; then
+      error "❌ TARGET version ($TARGET_VERSION) did not properly detect downgrade"
+      docker compose logs metabase
+      exit 1
+    fi
+
+    # Stop the failed container
+    stop_metabase
+
+    log ""
+    log "============================================"
+    log "Step 4: Rolling back database ($SOURCE_VERSION → $TARGET_VERSION)..."
+    log "============================================"
+    if ! cascading_migrate_down "$SOURCE_VERSION" "$TARGET_VERSION"; then
+      error "❌ migrate down failed"
+      exit 1
+    fi
+
+    # Try starting again
+    log ""
+    log "Step 5: Starting TARGET version ($TARGET_VERSION) after migrate down..."
+    start_metabase "$target_image"
+
+    if ! wait_for_health "$HEALTH_TIMEOUT"; then
+      error "❌ TARGET version ($TARGET_VERSION) failed health check after migrate down"
+      docker compose logs metabase
+      exit 1
+    fi
+    log "✅ DOWNGRADE successful - TARGET version ($TARGET_VERSION) is healthy after migrate down"
+  fi
+
+  log ""
+  log "============================================"
+  log "✅ TEST PASSED"
+  log "============================================"
+}
+
+main

deps.edn

@@ -47,6 +47,8 @@
   com.github.seancorfield/honeysql          {:mvn/version "2.7.1350"}           ; Honey SQL 2. SQL generation from Clojure data maps
   com.github.seancorfield/next.jdbc         {:mvn/version "1.3.1070"}           ; Talk to JDBC DBs
   com.github.steffan-westcott/clj-otel-api  {:mvn/version "0.2.8"}              ; Telemetry library
+  com.github.steffan-westcott/clj-otel-exporter-otlp {:mvn/version "0.2.8"}     ; OTLP span exporter (gRPC and HTTP)
+  com.github.steffan-westcott/clj-otel-sdk  {:mvn/version "0.2.8"}              ; OpenTelemetry SDK for programmatic configuration
   com.github.vertical-blank/sql-formatter   {:mvn/version "2.0.5"}              ; Java SQL formatting library https://github.com/vertical-blank/sql-formatter
   com.google.guava/guava                    {:mvn/version "33.5.0-jre"}         ; dep for BigQuery, Spark, and GA. Require here rather than letting different dep versions stomp on each other — see comments on #9697
   com.h2database/h2                         ^:antq/exclude                      ; https://metaboat.slack.com/archives/CKZEMT1MJ/p1727191010259979
@@ -80,7 +82,7 @@
   hiccup/hiccup                             {:mvn/version "2.0.0"}              ; HTML templating
   inflections/inflections                   {:mvn/version "0.15.0"}             ; Clojure/Script library used for prularizing words
   instaparse/instaparse                     {:mvn/version "1.5.0"}              ; Make your own parser
-  io.github.camsaul/toucan2                 {:mvn/version "1.0.570"}
+  io.github.camsaul/toucan2                 {:mvn/version "1.0.571"}
   io.github.eerohele/pp                     {#_#_:git/tag "2024-11-13.77"       ; super fast pretty-printing library
                                              :git/sha "ffc4edc482c057cd9412c62f018a41e9140c618b"
                                              :git/url "https://github.com/eerohele/pp"}
@@ -330,9 +332,9 @@
                  "-Dmb.jetty.join=false"
                  "-Dmb.field.filter.operators.enabled=true"
                  "-Dmb.api.key=test-api-key"
-                 ;; Different port from normal `:dev` so you can run tests on a different server.
-                 ;; TODO -- figure out how to do a random port like in the old project.clj?
-                 "-Dmb.jetty.port=3001"]}
+                 ;; Port 0 tells the OS to assign a random free port, allowing parallel test runs.
+                 ;; The actual port is read from the running Jetty server via server.instance/server-port.
+                 "-Dmb.jetty.port=0"]}
 
   ;; run the dev server with
   ;; clojure -M:run

docs/configuring-metabase/environment-variables.md

@@ -2469,13 +2469,26 @@ Default: `""`
 
 When set, starts a Java Flight Recorder (JFR) recording at startup that can be analyzed with JDK Mission Control or other JFR tools.
 
-- `"true"` generates a timestamped output file like `metabase-2026_01_15.jfr`
-- Any other non-empty value is used as the output filename (`.jfr` extension is appended if missing)
+- `"true"` generates a timestamped output file like `metabase-20260115_143000.jfr`
+- A value ending in `.jfr` is used as the output filename
+- Any other non-empty value is treated as a directory path. A new timestamped JFR file is written to that directory every 30 minutes (e.g., `metabase-20260115_143000.jfr`). Data is only written at the end of each 30-minute interval.
 - `""` or `"false"` disables monitoring (the default)
 
 The performance recording stores only method signature calls and other code execution metrics.
 It does not store any sensitive information such as environment variables, system properties, or other machine information.
 
+### `MB_MONITOR_PERFORMANCE_SAVE_RATE`
+
+Type: integer<br>
+Default: mode-specific (5 minutes for single-file mode, 30 minutes for rolling mode)
+
+Override the interval (in minutes) at which JFR recording data is saved to disk. Only applies when [MB_MONITOR_PERFORMANCE](#mb_monitor_performance) is enabled.
+
+- In single-file mode, the default is `5` minutes.
+- In rolling directory mode, the default is `30` minutes.
+
+Setting this value overrides the default for whichever mode is active.
+
 ### `MB_NO_SURVEYS`
 
 Type: boolean<br>

docs/data-modeling/models.md

@@ -6,7 +6,7 @@ redirect_from:
 
 # Models
 
-> Prefer [Transforms](../data-studio/transforms/transforms-overview.md) instead of models. Models remain supported for now, but will be deprecated in future versions of Metabase.
+> Consider using [Transforms](../data-studio/transforms/transforms-overview.md) instead of models.
 
 Models curate data from another table or tables from the same database to anticipate the kinds of questions people will ask of the data. You can think of them as derived tables, or a special kind of saved question meant to be used as the starting point for new questions. You can base a model on a SQL or query builder question, which means you can include custom, calculated columns in your model.
 

docs/data-studio/transforms/transforms-overview.md

@@ -35,7 +35,7 @@ Currently, Metabase can create transforms on the following databases:
 
 You can't create transforms on databases that have [Database routing](../../permissions/database-routing.md) enabled, or on Metabase's Sample Database.
 
-Transforms will create tables in your database, so the database user you use for your connection must have appropriate privileges. See [Database users, roles, and privileges](../../databases/users-roles-privileges.md).
+Transforms will create tables in your database, so the database user you use for your connection must have appropriate privileges. See [Database users, roles, and privileges](../../databases/users-roles-privileges.md). We suggest using a [Writable connection](../../databases/writable-connection.md) option for your database.
 
 ## Types of transforms
 

docs/databases/connections/athena.md

@@ -209,9 +209,9 @@ If Metabase also needs to create tables, you'll need additional AWS Glue permiss
 }
 ```
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/bigquery.md

@@ -161,9 +161,9 @@ FROM [my_dataset.my_table]
 
 If you're having trouble with your BigQuery connection, you can check out this [troubleshooting guide](../../troubleshooting-guide/bigquery-drive.md) that covers BigQuery issues, [this one](../../troubleshooting-guide/db-connection.md) on data warehouse connections, or visit [Metabase's discussion forum](https://discourse.metabase.com/search?q=bigquery) to see if someone has encountered and resolved a similar issue.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/clickhouse.md

@@ -77,10 +77,10 @@ You can limit the number of HTTP connections in the JDBC driver used to connect
 
 ### Additional JDBC connection string options
 
-You can append options to the JDBC connection string. Separate options with `&`, like so:
+You can append options to the JDBC connection string. All [server settings must be prefixed with `clickhouse_setting_`](https://clickhouse.com/docs/integrations/language-clients/java/jdbc#connection-properties). Separate options with `&`, like so:
 
 ```
-connection_timeout=1000&socket_timeout=300000
+clickhouse_setting_connection_timeout=1000&clickhouse_setting_socket_timeout=300000
 ```
 
 ### Re-run queries for simple explorations
@@ -101,9 +101,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/databricks.md

@@ -101,9 +101,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/druid.md

@@ -64,9 +64,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/mariadb.md

@@ -101,9 +101,9 @@ JSON schema inference doesn't work with MariaDB, due to implementation differenc
 
 If your password contains characters that aren't UTF-8, then you might need to add an additional variable to the connection string `passwordCharacterEncoding=<your_encoding_here>`. This ensures that MariaDB understands the special characters in the password during authentication.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Database routing
 

docs/databases/connections/mongodb.md

@@ -130,9 +130,9 @@ Instead, Metabase gets a sample of the fields in a collection by scanning a samp
 
 If you're not seeing all of the fields show up for a collection in Metabase, one workaround is to include all possible keys in the first document of the collection, and give those keys null values. That way, Metabase will be able to recognize the correct schema for the entire collection.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Database routing
 

docs/databases/connections/mysql.md

@@ -187,9 +187,9 @@ mysql:
 
 If your password contains characters that aren't UTF-8, then you might need to add an additional variable to the connection string `passwordCharacterEncoding=<your_encoding_here>`. This ensures that MySQL understands the special characters in the password during authentication.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/oracle.md

@@ -131,9 +131,9 @@ For example, if you're running Metabase from a directory called `/app/`, you sho
 
 The process for adding plugins when running via Docker is similar, but you'll need to mount the `plugins` directory. Refer to instructions [here](../../installation-and-operation/running-metabase-on-docker.md#adding-external-dependencies-or-plugins) for more details.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Danger zone
 

docs/databases/connections/postgresql.md

@@ -186,9 +186,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/presto.md

@@ -94,9 +94,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Database routing
 

docs/databases/connections/redshift.md

@@ -98,9 +98,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/snowflake.md

@@ -133,9 +133,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/sparksql.md

@@ -77,9 +77,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Danger zone
 

docs/databases/connections/sql-server.md

@@ -97,9 +97,9 @@ A fingerprinting query examines the first 10,000 rows from each column and uses
 
 To connect to Azure SQL, you'll need to set the port to 1433.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Database routing
 

docs/databases/connections/sqlite.md

@@ -61,9 +61,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Database routing
 

docs/databases/connections/starburst.md

@@ -91,9 +91,9 @@ Turn this option **ON** to scan a sample of values every time Metabase runs a [s
 
 A fingerprinting query examines the first 10,000 rows from each column and uses that data to guesstimate how many unique values each column has, what the minimum and maximum values are for numeric and timestamp columns, and so on. If you leave this option **OFF**, Metabase will only fingerprint your columns once during setup.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/connections/vertica.md

@@ -41,9 +41,9 @@ For example, if you're running Metabase from a directory called `/app/`, you sho
 
 The process for adding plugins when running via Docker is similar, but you'll need to mount the `plugins` directory. Refer to instructions [here](../../installation-and-operation/running-metabase-on-docker.md#adding-external-dependencies-or-plugins) for more details.
 
-## Writeable connection
+## Writable connection
 
-Set up an additional connection used for write operations. See [Writeable connections](../writeable-connection.md).
+Set up an additional connection used for write operations. See [Writable connections](../writable-connection.md).
 
 ## Model features
 

docs/databases/users-roles-privileges.md

@@ -21,7 +21,7 @@ Bundling your privileges into roles based on use cases makes it easier to manage
 - Use the same `analytics` role for other BI tools in your [data stack](https://www.metabase.com/learn/grow-your-data-skills/data-fundamentals/data-landscape) that need read-only access to the analytics tables in your database.
 - Revoke the write access for `metabase_model_persistence` without affecting the write access for `metabase_actions`.
 
-For operations that require write access, we recommend using separate [writeable connections](./writeable-connection.md).
+For operations that require write access, we recommend using separate [writable connections](./writable-connection.md).
 
 ## Minimum database privileges
 
@@ -102,7 +102,7 @@ if you're using actions or editable tables, then in addition to the [minimum dat
 
 - Create a new role called `metabase_writer`.
 - Give the role `INSERT`, `UPDATE`, and `DELETE` privileges to the relevant tables.
-- Give the `metabase_writer` role to the user used for your database connection. We recommend using a [writeable connection](./writeable-connection.md) and only granting this role to the user used for the writeable connection.
+- Give the `metabase_writer` role to the user used for your database connection. We recommend using a [writable connection](./writable-connection.md) and only granting this role to the user used for the writable connection.
 
 ```sql
 -- Create a role to bundle database privileges for Metabase writing to your database.
@@ -124,7 +124,7 @@ In addition to the [minimum database privileges](#minimum-database-privileges):
 - Create a new role called `metabase_model_persistence`.
 - Give the role `CREATE` access to the database.
 - Give the role `INSERT`, `UPDATE`, and `DELETE` privileges to the schema used for model persistence.
-- Give the `metabase_model_persistence` role to the user used for your database connection. We recommend using a [writeable connection](./writeable-connection.md) and only granting this role to the user used for the writeable connection.
+- Give the `metabase_model_persistence` role to the user used for your database connection. We recommend using a [writable connection](./writable-connection.md) and only granting this role to the user used for the writable connection.
 
 ```sql
 -- Create a role to bundle database privileges for Metabase model persistence.
@@ -144,20 +144,20 @@ GRANT metabase_model_persistence TO metabase;
 
 ## Privileges to enable transforms
 
-[Transforms](../data-studio/transforms/transforms-overview.md) let Metabase write query results back to your database. We suggest that you create a dedicated schema for your transforms. Metabase's database user will need to be able to create and drop transform tables. We recommend using a [writeable connection](./writeable-connection.md) and only granting write access to the user used for the writeable connection.
+[Transforms](../data-studio/transforms/transforms-overview.md) let Metabase write query results back to your database. We suggest that you create a dedicated schema for your transforms. Metabase's database user will need to be able to create and drop transform tables. We recommend using a [writable connection](./writable-connection.md) and only granting write access to the user used for the writable connection.
 
 In addition to the [minimum database privileges](#minimum-database-privileges):
 
 - Create a new role called `metabase_transforms`.
 - Create a dedicated schema for transforms.
 - Give the `metabase_transforms` role `CREATE TABLE` / `ALTER` / `DROP` privileges for the specified schema.
-- Give the `metabase_transforms` role to the user used for your database connection. We recommend using a [writeable connection](./writeable-connection.md) and only granting this role to the user used for the writeable connection.
+- Give the `metabase_transforms` role to the user used for your database connection. We recommend using a [writable connection](./writable-connection.md) and only granting this role to the user used for the writable connection.
 
 In certain cases, Metabase will give you an option to create new schemas for transforms, in which case you'll also need `CREATE SCHEMA` privileges for your metabase users (or `CREATE DATABASE` for ClickHouse).
 
 ## Privileges to enable uploads
 
-You can [upload CSVs](../databases/uploads.md) to supported databases. Metabase's database user should have write access (`INSERT`, `UPDATE`, `DELETE`) to the schema where you want to store the uploads. We recommend using a [writeable connection](./writeable-connection.md) and only granting write access to the user used for the writeable connection.
+You can [upload CSVs](../databases/uploads.md) to supported databases. Metabase's database user should have write access (`INSERT`, `UPDATE`, `DELETE`) to the schema where you want to store the uploads. We recommend using a [writable connection](./writable-connection.md) and only granting write access to the user used for the writable connection.
 
 You'll first need to create a schema to store uploads (or use an existing schema) and tell Metabase that you want to [use that schema to store uploads](./uploads.md#select-the-database-and-schema-that-you-want-to-store-the-data-in).
 
@@ -228,7 +228,7 @@ We recommend bundling privileges into roles based on use cases per customer. Tha
 
 ## Further reading
 
-- [Writeable connections](./writeable-connection.md)
+- [Writable connections](./writable-connection.md)
 - [Permissions strategies](https://www.metabase.com/learn/metabase-basics/administration/permissions/strategy)
 - [Permissions introduction](../permissions/introduction.md)
 - [People overview](../people-and-groups/start.md)

docs/databases/writable-connection.md

@@ -0,0 +1,62 @@
+---
+title: Writable connection
+summary: Add an optional separate database connection for write operations like transforms or editable tables to keep the main Metabase connection read-only for analytics.
+redirect_from:
+  - /docs/latest/databases/writeable-connection
+---
+
+## Writable connection
+
+> Writable connection requires the **Advanced transforms (SQL + Python)** add-on
+
+_Admin > Databases > Writable connection_
+
+Writable connection is an optional connection that Metabase will use for functionality that involves writing into the database (for example, transforms or CSV uploads). This allows you to keep your main Metabase connection read-only, and only to switch to connection with write permissions for the operations that require write access.
+
+![Writable connection in database settings](./images/writeable-connection.png)
+
+## How writable connection works
+
+Writable connection is an additional connection option added to an existing database connection.
+
+When a writable connection is configured for a database, Metabase automatically switches between connections behind the scenes based on what people are doing with the database. The main connection is used for querying, and the writable connection is used for [features that require writes](#features-that-use-writable-connection).
+
+Writable connection can use a different database user than the main connection, or even connect to a different database. For example, your main connection (used for querying) can go to a read replica, but the writable connection can be to a primary database.
+
+## Add a writable connection
+
+To add a writable connection to a database:
+
+1. Go to **Admin > Databases**.
+2. Select the database to add a writable connection to.
+3. Under **Writable connection**, click **Add writable connection**.
+4. Metabase will pre-fill some fields with information from your main connection. Input the credentials for the writable connection.
+5. Click **Save**. Metabase will try to connect using the new connection.
+
+## Remove a writable connection
+
+To remove a writable connection from a database:
+
+1. Go to **Admin > Databases**.
+2. Select the database you want to remove the writable connection from.
+3. Under **Writable connection**, click **Remove writable connection**.
+
+Once writable connection is removed, Metabase will revert to using the main connection for [features that need write access](#features-that-use-writable-connection), so your main connection will need to have appropriate database permissions, see [Users, roles, and privileges](./users-roles-privileges.md)
+
+## Features that use writable connection
+
+When configured, writable connection will be used for:
+
+- [Transforms](../data-studio/transforms/transforms-overview.md)
+- [CSV uploads](../databases/uploads.md)
+- [Editable tables](../data-modeling/editable-tables.md)
+- [Actions](../actions/introduction.md)
+- [Model persistence](../data-modeling/model-persistence.md)
+
+Your writable connection will need to have the privileges required for these operations. See [Users, roles, and privileges](./users-roles-privileges.md).
+
+## Limitations
+
+- Writable connection can't be used with [database routing](../permissions/database-routing.md).
+
+- Writable connection must use the same database engine as the primary connection - so for example, if the primary connection is to a PostgreSQL database, the writable connection must be to a PostgreSQL database as well.

docs/databases/writeable-connection.md

@@ -1,60 +0,0 @@
----
-title: Writeable connections
-summary: Add an optional separate database connection for write operations like transforms or editable tables to keep the main Metabase connection read-only for analytics.
----
-
-## Writeable connections
-
-> Writeable connection requires the **Advanced transforms (SQL + Python)** add-on
-
-_Admin > Databases > Writeable connection_
-
-Writeable connection is an optional connection that Metabase will use for functionality that involves writing into the database (for example, transforms or CSV uploads). This allows you to keep your main Metabase connection read-only, and only to switch to connection with write permissions for the operations that require write access.
-
-![Writeable connection in database settings](./images/writeable-connection.png)
-
-## How writeable connection works
-
-Writeable connection is an additional connection option added to an existing database connection.
-
-When a writeable connection is configured for a database, Metabase automatically switches between connections behind the scenes based on what people are doing with the database. The main connection is used for querying, and the writeable connection is used for [features that require writes](#features-that-use-writeable-connection).
-
-Writeable connection can use a different database user than the main connection, or even connect to a different database. For example, your main connection (used for querying) can go to a read replica, but the writeable connection can be to a primary database.
-
-## Add a writeable connection
-
-To add a writeable connection to a database:
-
-1. Go to **Admin > Databases**.
-2. Select the database to add a writeable connection to.
-3. Under **Writeable connection**, click **Add writeable connection**.
-4. Metabase will pre-fill some fields with information from your main connection. Input the credentials for the writeable connection.
-5. Click **Save**. Metabase will try to connect using the new connection.
-
-## Remove a writeable connection
-
-To remove a writeable connection from a database:
-
-1. Go to **Admin > Databases**.
-2. Select the database you want to remove the writeable connection from.
-3. Under **Writeable connection**, click **Remove writeable connection**.
-
-Once writeable connection is removed, Metabase will revert to using the main connection for [features that need write access](#features-that-use-writeable-connection), so your main connection will need to have appropriate database permissions, see [Users, roles, and privileges](./users-roles-privileges.md)
-
-## Features that use writeable connection
-
-When configured, writeable connection will be used for:
-
-- [Transforms](../data-studio/transforms/transforms-overview.md)
-- [CSV uploads](../databases/uploads.md)
-- [Editable tables](../data-modeling/editable-tables.md)
-- [Actions](../actions/introduction.md)
-- [Model persistence](../data-modeling/model-persistence.md)
-
-Your writeable connection will need to have the privileges required for these operations. See [Users, roles, and privileges](./users-roles-privileges.md).
-
-## Limitations
-
-- Writeable connection can't be used with [database routing](../permissions/database-routing.md).
-
-- Writeable connection must use the same database engine as the primary connection - so for example, if the primary connection is to a PostgreSQL database, the writeable connection must be to a PostgreSQL database as well.

docs/permissions/database-routing.md

@@ -40,7 +40,7 @@ Different database have different setups, so _what_ you can route between (datab
 
 Database routing **can't be used** on databases with:
 
-- [Writeable connections](../databases/writeable-connection.md)
+- [Writable connections](../databases/writable-connection.md)
 - [Editable tables](../data-modeling/editable-tables.md)
 - [Actions](../actions/introduction.md)
 - [CSV uploads](../databases/uploads.md)

docs/troubleshooting-guide/create-har-file.md

@@ -6,36 +6,29 @@ title: Creating a HAR file for troubleshooting
 
 HAR (short for _HTTP Archive_) files record network requests generated by your browser. HAR files can be helpful when troubleshooting issues with Metabase performance.
 
-> HAR files can contain sensitive information that you submit during the recording, like passwords and API keys. Before sharing the HAR file with anyone, review the file contents in a text editor.
+> The instructions below include steps for creating **HAR files that contain sensitive information** that you submit during the recording. Sensitive information includes session cookies and authentication information. Only record this information when specifically instructed, and when it is needed for diagnosing issues with sessions or authentication, etc. Before sharing such a HAR file with anyone, review the file contents in a text editor.
 
 To create the HAR file, follow the instructions for your web browser:
 
-- [Chrome](#create-a-har-file-in-chrome)
-- [Edge](#create-a-har-file-in-edge)
+- [Chrome or Edge](#create-a-har-file-in-google-chrome-and-microsoft-edge)
 - [Firefox](#create-a-har-file-in-firefox)
 - [Safari](#create-a-har-file-in-safari)
 
-## Create a HAR file in Chrome
+## Create a HAR file in Google Chrome and Microsoft Edge
 
-1. Open Chrome **Developer tools**.
+1. Open Chrome/Edge **Developer tools**.
    You can right-click anywhere on the page and select "Inspect".
 
 2. In Developer tools, switch to the **Network** tab.
    The network log recording should start automatically.
 
-3. With the Network tab open and recording in progress, repeat the steps to reproduce the issue.
+3. Click on the small **gear icon** in the top bar of the developer tools to open Settings. Scroll down to the **Network** section and enable **Allow to generate HAR files with sensitive data**
 
-4. Once you're finished reproducing the issue, right-click anywhere in the table of network calls and select **Save all as HAR with content**.
+   ![Developer tools Networks settings with the option highlighted to Allow to generate HAR files with sensitive data](images/chrome-har-settings.png)
 
-## Create a HAR file in Edge
+4. With the Network tab open and recording in progress, repeat the steps to reproduce the issue.
 
-1. Open Edge **Developer tools**. You can right-click anywhere on the page and select "Inspect".
-
-2. In Developer tools, switch to the **Network** tab (look for the Wi-Fi icon). The network log recording should start automatically.
-
-3. With the Network tab open and recording in progress, repeat the steps to reproduce the issue.
-
-4. Once you're finished reproducing the issue, right-click anywhere in the table and select **Save all as HAR with content**
+5. Once you're finished reproducing the issue, click the download icon on the far right of the toolbar just below the tab bar. Choose **Export HAR (with sensitive data)…** and save the file.
 
 ## Create a HAR file in Firefox
 
@@ -51,7 +44,7 @@ To create the HAR file, follow the instructions for your web browser:
 
 1. If you haven't yet, enable the **Develop** menu by going to **Safari > Settings > Advanced**, and select **Show features for web developers**.
 
-2. Open the Safari developer tools by going to **Develop > Show Web Inspector**.
+2. Open the Safari developer tools by going to **Develop > Show Web Inspector** or by right-clicking anywhere on the page and selecting **Inspect Element** from the context menu.
 
 3. In Developer tools, switch to the **Network** tab. The network log recording should start automatically.
 

e2e/runner/start-backend.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+const backend = require("./cypress-runner-backend");
+
+async function main() {
+  const jarPath = process.env.JAR_PATH;
+
+  if (jarPath) {
+    await backend.runFromJar(jarPath);
+  } else {
+    await backend.runFromSource();
+  }
+
+  console.log(`Backend ready on :${process.env.MB_JETTY_PORT}`);
+
+  const cleanup = () => {
+    backend.stop();
+    process.exit();
+  };
+  process.on("SIGTERM", cleanup);
+  process.on("SIGINT", cleanup);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

e2e/support/config.js

@@ -181,7 +181,7 @@ const defaultConfig = {
   viewportHeight: 800,
   viewportWidth: 1280,
   // enable video recording in run mode
-  video: true,
+  video: process.env["CYPRESS_VIDEO"] !== "false",
   videoCompression: true,
 };
 
@@ -213,7 +213,10 @@ const mainConfig = {
     },
   },
   retries: {
-    runMode: 2,
+    runMode:
+      process.env["CYPRESS_RETRIES"] != null
+        ? parseInt(process.env["CYPRESS_RETRIES"], 10)
+        : 2,
     openMode: 0,
   },
 };

e2e/support/cypress-embedding-sdk-component-test.config.js

@@ -7,6 +7,8 @@ const embeddingSdkComponentTestConfig = {
   defaultCommandTimeout: 10000,
   requestTimeout: 10000,
   video: false,
+  experimentalMemoryManagement: true,
+  numTestsKeptInMemory: 1,
   specPattern: "e2e/test-component/scenarios/embedding-sdk/**/*.cy.spec.tsx",
   indexHtmlFile: "e2e/support/component-index.html",
   supportFile: "e2e/support/component-cypress.js",

e2e/support/helpers/e2e-data-studio-helpers.ts

@@ -111,6 +111,8 @@ export const DataStudio = {
     dependenciesTab: () =>
       DataStudio.Metrics.header().findByText("Dependencies"),
     cachingTab: () => DataStudio.Metrics.header().findByText("Caching"),
+    overviewPageDescriptionSidebar: () =>
+      metricOverviewPage().findByTestId("metric-description-sidebar"),
   },
   Tables: {
     overviewPage: () => cy.findByTestId("table-overview-page"),
@@ -150,6 +152,8 @@ export const DataStudio = {
         .click(),
 
     Overview: {
+      descriptionSidebar: () => cy.findByTestId("table-description-sidebar"),
+
       descriptionText: () =>
         cy
           .findByTestId("table-description-section")

e2e/test-component/scenarios/embedding-sdk/subscriptions.cy.spec.tsx

@@ -77,6 +77,7 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
 
         mountSdkContent(
           <StaticDashboard dashboardId={dashboardId} withSubscriptions />,
+          { strictMode: true },
         );
       });
 
@@ -85,6 +86,9 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
         cy.icon("subscription").click();
         cy.findByText("Email this dashboard").should("be.visible");
 
+        // EMB-1413
+        cy.findByDisplayValue("Hourly").click();
+
         cy.log("can customize filter values");
         cy.findByRole("heading", {
           name: "Set filter values for when this gets sent",
@@ -107,6 +111,7 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
 
         mountSdkContent(
           <InteractiveDashboard dashboardId={dashboardId} withSubscriptions />,
+          { strictMode: true },
         );
       });
 
@@ -115,6 +120,9 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
         cy.icon("subscription").click();
         cy.findByText("Email this dashboard").should("be.visible");
 
+        // EMB-1413
+        cy.findByDisplayValue("Hourly").click();
+
         cy.log("can customize filter values");
         cy.findByRole("heading", {
           name: "Set filter values for when this gets sent",
@@ -137,6 +145,7 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
 
         mountSdkContent(
           <EditableDashboard dashboardId={dashboardId} withSubscriptions />,
+          { strictMode: true },
         );
       });
 
@@ -145,6 +154,9 @@ describe("scenarios > embedding-sdk > subscriptions", () => {
         cy.icon("subscription").click();
         cy.findByText("Email this dashboard").should("be.visible");
 
+        // EMB-1413
+        cy.findByDisplayValue("Hourly").click();
+
         cy.log("can customize filter values");
         cy.findByRole("heading", {
           name: "Set filter values for when this gets sent",

e2e/test/scenarios/admin/databases.cy.spec.js

@@ -807,8 +807,7 @@ describe("scenarios > admin > databases > sample database", () => {
     cy.findByLabelText(/Choose when syncs and scans happen/).click({
       force: true,
     });
-    // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-    cy.findByText("Hourly").click();
+    cy.findByDisplayValue("Hourly").click();
     H.popover().within(() => {
       cy.findByText("Daily").click({ force: true });
     });
@@ -819,10 +818,7 @@ describe("scenarios > admin > databases > sample database", () => {
       .click();
 
     H.popover().findByText("Regularly, on a schedule").click();
-    cy.findAllByRole("button", { name: /Daily/ })
-      .should("have.length", 2)
-      .eq(1)
-      .click();
+    cy.findAllByDisplayValue("Daily").should("have.length", 2).eq(1).click();
     H.popover().findByText("Weekly").click();
 
     cy.button("Save changes").click();

e2e/test/scenarios/dashboard-cards/dashboard-card-resizing.cy.spec.js

@@ -242,6 +242,70 @@ describe(
       });
     });
 
+    it("should keep the resize handle connected to the cursor while resizing (metabase#70451)", () => {
+      H.createDashboardWithQuestions({
+        dashboardDetails: {},
+        questions: [
+          {
+            display: "table",
+            query: {
+              "source-table": ORDERS_ID,
+              limit: 10,
+            },
+          },
+        ],
+      }).then(({ dashboard }) => {
+        H.visitDashboard(dashboard.id);
+      });
+
+      H.editDashboard();
+
+      let targetX, targetY;
+
+      H.getDashboardCard(0)
+        .find(".react-resizable-handle")
+        .then(($handle) => {
+          const rect = $handle[0].getBoundingClientRect();
+          const startX = Math.round(rect.left + rect.width / 2);
+          const startY = Math.round(rect.top + rect.height / 2);
+          targetX = startX + 200;
+          targetY = startY + 150;
+
+          // Not using the wrapper here because we want to avoid waits and we need the starting position for later
+          cy.wrap($handle)
+            .trigger("mousedown", {
+              button: 0,
+              clientX: startX,
+              clientY: startY,
+              force: true,
+            })
+            .trigger("mousemove", {
+              clientX: targetX,
+              clientY: targetY,
+              force: true,
+            });
+        });
+
+      // After dragging, the resize handle should still be near the cursor position.
+      H.getDashboardCard(0)
+        .find(".react-resizable-handle")
+        .then(($handle) => {
+          const rect = $handle[0].getBoundingClientRect();
+          const handleCenterX = Math.round(rect.left + rect.width / 2);
+          const handleCenterY = Math.round(rect.top + rect.height / 2);
+
+          const maxDrift = 50;
+          expect(
+            Math.abs(handleCenterX - targetX),
+            `Horizontal drift: handle at ${handleCenterX}, cursor at ${targetX}`,
+          ).to.be.lessThan(maxDrift);
+          expect(
+            Math.abs(handleCenterY - targetY),
+            `Vertical drift: handle at ${handleCenterY}, cursor at ${targetY}`,
+          ).to.be.lessThan(maxDrift);
+        });
+    });
+
     it("should not allow cards to be resized smaller than min height", () => {
       const cardIds = [];
       TEST_QUESTIONS.forEach((question) => {

e2e/test/scenarios/dashboard-cards/dashboard-sections.cy.spec.js

@@ -58,12 +58,12 @@ describe("scenarios > dashboard cards > sections", () => {
     selectQuestion("Orders, Count, Grouped by Created At (year)");
 
     overwriteDashCardTitle(
-      1,
+      2,
       "Orders, Count, Grouped by Created At (year)",
       "Line chart",
     );
     // TODO: if the mapping is done before the title is changed, the mapping is lost
-    mapDashCardToFilter(H.getDashboardCard(1), "Category");
+    mapDashCardToFilter(H.getDashboardCard(2), "Category");
 
     H.goToTab("Tab 1");
     H.saveDashboard();
@@ -101,7 +101,7 @@ describe("scenarios > dashboard cards > sections", () => {
     // Ensure parameter mapping is persisted
     H.editDashboard();
     filterPanel().findByText("Category").click();
-    H.getDashboardCard(1).findByText("Product.Category").should("exist");
+    H.getDashboardCard(2).findByText("Product.Category").should("exist");
   });
 });
 

e2e/test/scenarios/data-studio/data-studio-metrics.cy.spec.ts

@@ -70,11 +70,18 @@ describe("scenarios > data studio > library > metrics", () => {
       cy.findByText("Sum of all order totals across the store").should(
         "be.visible",
       );
+    });
+
+    H.DataStudio.Metrics.overviewPageDescriptionSidebar().within(() => {
+      cy.findByText("Last edited by Bobby Tables").should("be.visible");
+
       cy.findByText("Sample Database").should("be.visible");
-      cy.findByText("PUBLIC").should("be.visible");
+
       cy.findByText("Orders").should("be.visible");
-      cy.findByText("Creator and last editor").should("be.visible");
-      cy.findAllByText(/by Bobby Tables/).should("be.visible");
+      cy.findByText("Source table").should("be.visible");
+
+      cy.findByText("Dependencies").should("be.visible");
+      cy.findByText("Dependents").should("be.visible");
     });
 
     cy.log("Ensure chart is visible");

e2e/test/scenarios/data-studio/data-studio-tables.cy.spec.ts

@@ -83,6 +83,33 @@ describe("scenarios > data studio > library > tables", () => {
         .contains("Table description updated")
         .should("be.visible");
     });
+
+    it("should be able to view additional properties in sidebar", () => {
+      H.DataStudio.Tables.Overview.descriptionSidebar().within(() => {
+        cy.findByText("Entity type").should("be.visible");
+
+        cy.findByText("Last edited at").should("be.visible");
+
+        cy.findByText("Database").should("be.visible");
+        cy.findByText("Sample Database").should("be.visible");
+
+        cy.findByText("Source").should("be.visible");
+        cy.findByPlaceholderText("Select a data source").should(
+          "have.value",
+          "Ingested",
+        );
+
+        cy.findByText("Owner").should("be.visible");
+
+        cy.findByPlaceholderText("Pick someone, or type an email").should(
+          "have.value",
+          "No owner",
+        );
+        cy.findByText("Fields").should("be.visible");
+
+        cy.findByText("Dependents").should("be.visible");
+      });
+    });
   });
 
   describe("fields", () => {

e2e/test/scenarios/data-studio/transforms/transforms.cy.spec.ts

@@ -16,7 +16,6 @@ import type {
   CardType,
   CollectionId,
   PythonTransformTableAliases,
-  TransformId,
   TransformSourceCheckpointStrategy,
   TransformTagId,
 } from "metabase-types/api";
@@ -1509,108 +1508,6 @@ LIMIT
       H.assertQueryBuilderRowCount(1);
     });
 
-    it("should be possible to continue editing a transform after closing check dependencies modal (metabase#68272)", () => {
-      const transformTableName = "output_table";
-      const dependentCardName = "Question depending on transform";
-
-      cy.log("create MBQL transform with name and score columns");
-      H.getTableId({ name: SOURCE_TABLE, databaseId: WRITABLE_DB_ID }).then(
-        (sourceTableId) => {
-          H.getFieldId({ tableId: sourceTableId, name: "name" }).then(
-            (nameFieldId) => {
-              H.getFieldId({ tableId: sourceTableId, name: "score" }).then(
-                (scoreFieldId) => {
-                  H.createTransform(
-                    {
-                      name: "MBQL transform with deps",
-                      source: {
-                        type: "query",
-                        query: {
-                          database: WRITABLE_DB_ID,
-                          type: "query",
-                          query: {
-                            "source-table": sourceTableId,
-                            fields: [
-                              ["field", nameFieldId, null],
-                              ["field", scoreFieldId, null],
-                            ],
-                          },
-                        },
-                      },
-                      target: {
-                        type: "table",
-                        database: WRITABLE_DB_ID,
-                        name: transformTableName,
-                        schema: TARGET_SCHEMA,
-                      },
-                    },
-                    { wrapId: true },
-                  );
-                },
-              );
-            },
-          );
-        },
-      );
-
-      cy.get<TransformId>("@transformId").then((transformId) => {
-        cy.log("run the transform to create the output table");
-        H.runTransformAndWaitForSuccess(transformId);
-        H.resyncDatabase({
-          dbId: WRITABLE_DB_ID,
-          tableName: transformTableName,
-        });
-
-        cy.log("create a question that depends on the score column");
-        H.getTableId({
-          databaseId: WRITABLE_DB_ID,
-          name: transformTableName,
-        }).then((tableId) => {
-          H.createQuestion({
-            name: dependentCardName,
-            database: WRITABLE_DB_ID,
-            query: {
-              "source-table": tableId,
-              filter: [
-                ">",
-                ["field", "score", { "base-type": "type/Integer" }],
-                10,
-              ],
-            },
-          });
-        });
-
-        H.visitTransform(transformId);
-
-        cy.log("remove score column (breaking change)");
-        H.DataStudio.Transforms.clickEditDefinition();
-        H.getNotebookStep("data").findByLabelText("Pick columns").click();
-        H.popover().findByLabelText("Score").click();
-        H.DataStudio.Transforms.saveChangesButton().click();
-
-        cy.wait("@checkTransformDependencies");
-
-        H.modal().within(() => {
-          cy.findByText(
-            "These changes will break some other things. Save anyway?",
-          ).should("be.visible");
-          cy.findByText(dependentCardName).should("be.visible");
-
-          cy.log("cancel to continue editing");
-          cy.button("Cancel").click();
-        });
-
-        H.DataStudio.Transforms.editDefinitionButton().should("not.exist");
-        H.DataStudio.Transforms.saveChangesButton()
-          .should("be.visible")
-          .and("be.enabled");
-
-        H.getNotebookStep("data").findByLabelText("Pick columns").click();
-        H.popover().findByLabelText("Name").should("be.disabled");
-        H.popover().findByLabelText("Score").should("not.be.checked");
-      });
-    });
-
     it("should be able to update a Python query", { tags: ["@python"] }, () => {
       H.setPythonRunnerSettings();
       cy.log("create a new transform");

e2e/test/scenarios/dependencies/dependency-checks.cy.spec.ts

@@ -25,72 +25,6 @@ describe("scenarios > dependencies > dependency checks", () => {
   });
 
   describe("questions", () => {
-    it("should be able to confirm or cancel breaking changes to a MBQL question", () => {
-      createMbqlQuestionWithDependentMbqlQuestions();
-
-      cy.log("make breaking changes");
-      H.visitQuestion("@questionId");
-      H.openNotebook();
-      H.getNotebookStep("expression").findByText("Expr").icon("close").click();
-
-      cy.log("cancel breaking changes");
-      H.queryBuilderHeader().button("Save").click();
-      H.modal().button("Save").click();
-      H.modal().within(() => {
-        cy.findByText("Question with fields").should("be.visible");
-        cy.findByText("Question without fields").should("not.exist");
-        cy.findByText("Base question").should("not.exist");
-        cy.button("Cancel").click();
-      });
-      cy.get("@updateCard.all").should("have.length", 0);
-
-      cy.log("confirm breaking changes");
-      H.queryBuilderHeader().button("Save").click();
-      H.modal().button("Save").click();
-      H.modal().button("Save anyway").click();
-      cy.wait("@updateCard");
-    });
-
-    it("should be able to navigate to affected questions or their collection", () => {
-      createMbqlQuestionWithDependentMbqlQuestions();
-
-      cy.log("check that we can navigate to the broken question");
-      H.visitQuestion("@questionId");
-      H.openNotebook();
-      H.getNotebookStep("expression").findByText("Expr").icon("close").click();
-      H.queryBuilderHeader().button("Save").click();
-      H.modal().button("Save").click();
-      H.modal().findByText("Question with fields").click();
-      confirmDiscardChanges();
-      H.queryBuilderHeader()
-        .findByDisplayValue("Question with fields")
-        .should("be.visible");
-
-      cy.log("check that we can navigate to the collection of that question");
-      cy.go("back");
-      H.getNotebookStep("expression").findByText("Expr").icon("close").click();
-      H.queryBuilderHeader().button("Save").click();
-      H.modal().button("Save").click();
-      H.modal().within(() => {
-        cy.findByText("Question with fields").should("be.visible");
-        cy.findByText("Our analytics").click();
-      });
-      confirmDiscardChanges();
-      H.collectionTable().should("be.visible");
-
-      cy.log("check that we can navigate to the dashboard of that question");
-      cy.go("back");
-      H.getNotebookStep("expression").findByText("Expr").icon("close").click();
-      H.queryBuilderHeader().button("Save").click();
-      H.modal().button("Save").click();
-      H.modal().within(() => {
-        cy.findByText("Question with fields").should("be.visible");
-        cy.findByText("Orders in a dashboard").click();
-      });
-      confirmDiscardChanges();
-      H.dashboardHeader().should("be.visible");
-    });
-
     it("should not show a confirmation if there are no breaking changes when updating a MBQL question", () => {
       createMbqlQuestionWithDependentMbqlQuestions();
       H.visitQuestion("@questionId");
@@ -105,37 +39,6 @@ describe("scenarios > dependencies > dependency checks", () => {
   });
 
   describe("metrics", () => {
-    it("should be able to confirm or cancel breaking changes to a metric", () => {
-      createMetricWithDependentMbqlQuestionsAndTransforms();
-
-      cy.log("make breaking changes");
-      cy.get<number>("@metricId").then(H.visitMetric);
-      H.openQuestionActions("Edit metric definition");
-      H.getNotebookStep("summarize").findByText("Min of Score").click();
-      H.popover().within(() => {
-        cy.icon("chevronleft").click();
-        cy.findByText("Maximum of ...").click();
-        cy.findByText("Score").click();
-      });
-
-      cy.log("cancel breaking changes");
-      cy.findByTestId("edit-bar").button("Save changes").click();
-      H.modal().within(() => {
-        cy.findByText("Question with 2 stages").should("be.visible");
-        cy.findByText("Transform with 2 stages").should("be.visible");
-        cy.findByText("Question with 1 stage").should("not.exist");
-        cy.findByText("Transform with 1 stage").should("not.exist");
-        cy.findByText("Base metric").should("not.exist");
-        cy.button("Cancel").click();
-      });
-      cy.get("@updateCard.all").should("have.length", 0);
-
-      cy.log("confirm breaking changes");
-      cy.findByTestId("edit-bar").button("Save changes").click();
-      H.modal().button("Save anyway").click();
-      cy.wait("@updateCard");
-    });
-
     it("should not show a warning when a change to a metric is backward-compatible with existing content", () => {
       createMetricWithDependentMbqlQuestionsAndTransforms();
       cy.get<number>("@metricId").then(H.visitMetric);
@@ -154,21 +57,6 @@ describe("scenarios > dependencies > dependency checks", () => {
       H.NativeEditor.clear().type(queryString);
     };
 
-    it("should ignore breaking changes to a SQL transform after it was run", () => {
-      createSqlTransformWithDependentMbqlQuestions();
-
-      cy.log("make breaking changes");
-      cy.get<number>("@transformId").then(H.visitTransform);
-      goToEditorAndType('SELECT name FROM "Schema A"."Animals"');
-
-      cy.log("confirmation is shown");
-      H.DataStudio.Transforms.saveChangesButton().click();
-      cy.contains(
-        "h2",
-        "These changes will break some other things. Save anyway?",
-      );
-    });
-
     it("should not show a confirmation if there are no breaking changes when updating a SQL transform after it was run", () => {
       createSqlTransformWithDependentMbqlQuestions();
       cy.get<number>("@transformId").then(H.visitTransform);
@@ -177,35 +65,6 @@ describe("scenarios > dependencies > dependency checks", () => {
       cy.wait("@updateTransform");
     });
 
-    it("should be able to confirm or cancel breaking changes to a MBQL transform before it was run", () => {
-      createMbqlTransformWithDependentMbqlTransforms();
-
-      cy.log("make breaking changes");
-      cy.get<number>("@transformId").then(H.visitTransform);
-      H.DataStudio.Transforms.clickEditDefinition();
-      H.getNotebookStep("data").findByLabelText("Pick columns").click();
-      H.popover().findByLabelText("Score").click();
-
-      cy.log("cancel breaking changes");
-      H.DataStudio.Transforms.saveChangesButton().click();
-      H.modal().within(() => {
-        cy.findByText("Score transform").should("be.visible");
-        cy.findByText("Name transform").should("not.exist");
-        cy.findByText("Base transform").should("not.exist");
-        cy.button("Cancel").click();
-      });
-      cy.get("@updateTransform.all").should("have.length", 0);
-
-      cy.log("confirm breaking changes");
-      H.DataStudio.Transforms.saveChangesButton().click();
-      H.modal().within(() => {
-        cy.findByText("Score transform").should("be.visible");
-        cy.findByText("Name transform").should("not.exist");
-        cy.button("Save anyway").click();
-      });
-      cy.wait("@updateTransform");
-    });
-
     it("should not show a confirmation if there are no breaking changes when updating a MBQL transform before it was run", () => {
       createMbqlTransformWithDependentMbqlTransforms();
       cy.get<number>("@transformId").then(H.visitTransform);
@@ -480,7 +339,3 @@ function createMbqlTransformWithDependentMbqlTransforms() {
     },
   );
 }
-
-function confirmDiscardChanges() {
-  H.modal().should("have.length", 2).last().button("Discard changes").click();
-}

e2e/test/scenarios/embedding/embedding-admin-settings-oss.cy.spec.ts

@@ -50,7 +50,7 @@ describe(
           .should("have.attr", "href")
           .and(
             "eq",
-            "https://www.metabase.com/upgrade?utm_source=product&utm_medium=upsell&utm_content=embedding-page&source_plan=oss&utm_users=10&utm_campaign=embedded-analytics-js",
+            "https://www.metabase.com/upgrade?utm_source=product&utm_medium=upsell&utm_content=embedding-page&source_plan=oss&utm_users=10&utm_campaign=embedding-methods",
           );
       });
     });

e2e/test/scenarios/embedding/embedding-smoketests.cy.spec.js

@@ -46,7 +46,7 @@ describe("scenarios > embedding > smoke tests", { tags: "@OSS" }, () => {
           .should("have.attr", "href")
           .and(
             "eq",
-            "https://www.metabase.com/upgrade?utm_source=product&utm_medium=upsell&utm_content=embedding-page&source_plan=oss&utm_users=10&utm_campaign=embedded-analytics-js",
+            "https://www.metabase.com/upgrade?utm_source=product&utm_medium=upsell&utm_content=embedding-page&source_plan=oss&utm_users=10&utm_campaign=embedding-methods",
           );
       });
     });

e2e/test/scenarios/embedding/sdk-iframe-embedding/embed-options.cy.spec.ts

@@ -114,7 +114,7 @@ describe("EE", () => {
 
             cy.log("set up the second subscription");
             cy.button("Set up a new schedule").click();
-            cy.findByText("Hourly").click();
+            cy.findByDisplayValue("Hourly").click();
           });
 
           H.popover().findByRole("option", { name: "Daily" }).click();

e2e/test/scenarios/metrics/metrics-explorer.cy.spec.ts

@@ -331,11 +331,10 @@ describe("scenarios > metrics > explorer", () => {
       cy.wait("@dataset");
       H.MetricsViewer.breakoutLegend().within(() => {
         cy.findByRole("heading", { name: "Created At" }).should("be.visible");
-        cy.findByText("2022").should("be.visible");
-        cy.findByText("2023").should("be.visible");
-        cy.findByText("2024").should("be.visible");
-        cy.findByText("2025").should("be.visible");
-        cy.findByText("2026").should("be.visible");
+        const currentYear = new Date().getFullYear();
+        for (let year = 2022; year <= currentYear; year++) {
+          cy.findByText(String(year)).should("be.visible");
+        }
       });
 
       H.MetricsViewer.searchBarPills()
@@ -644,7 +643,7 @@ describe("scenarios > metrics > explorer", () => {
 
       H.popover().findByText("Doohickey").click();
 
-      H.popover().findByRole("button", { name: "Update filter" }).click();
+      H.popover().findByRole("button", { name: "Add filter" }).click();
       H.MetricsViewer.getMetricVisualization().should(
         "not.contain.text",
         "Doohickey",

e2e/test/scenarios/sharing/alert/alert.cy.spec.js

@@ -162,7 +162,8 @@ describe("scenarios > alert", () => {
       const adminSubscriptionError = `You're only allowed to email subscriptions to addresses ending in ${allowedDomain}`;
 
       function addEmailRecipient(email) {
-        cy.findByRole("textbox").click().type(`${email}`).blur();
+        // Mantine Select has the role `textbox` 🤦
+        cy.findAllByRole("textbox").first().click().type(`${email}`).blur();
       }
 
       function setAllowedDomains() {

e2e/test/scenarios/sharing/subscriptions.cy.spec.js

@@ -82,21 +82,16 @@ describe("scenarios > dashboard > subscriptions", () => {
       it("should not enable subscriptions without the recipient (metabase#17657)", () => {
         openDashboardSubscriptions();
 
-        // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-        cy.findByText("Email it").click();
+        H.sidebar().findByText("Email it").click();
 
         // Make sure no recipients have been assigned
         cy.findByPlaceholderText("Enter user names or email addresses");
 
         // Change the schedule to "Monthly"
-        // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-        cy.findByText("Hourly").click();
-        // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-        cy.findByText("Monthly").click();
+        cy.findByDisplayValue("Hourly").click();
+        H.popover().findByText("Monthly").click();
 
-        H.sidebar().within(() => {
-          cy.button("Done").should("be.disabled");
-        });
+        H.sidebar().button("Done").should("be.disabled");
       });
 
       it("should allow creation of a new email subscription", () => {
@@ -113,7 +108,7 @@ describe("scenarios > dashboard > subscriptions", () => {
         cy.findByPlaceholderText("Enter user names or email addresses").click();
         H.popover().should("be.visible").and("contain", `${admin.first_name}`);
         cy.realPress("Escape");
-        H.popover({ skipVisibilityCheck: true }).should("not.exist");
+        H.popover({ skipVisibilityCheck: true }).should("not.be.visible");
         cy.findByPlaceholderText("Enter user names or email addresses").should(
           "not.have.value",
         );
@@ -354,21 +349,20 @@ describe("scenarios > dashboard > subscriptions", () => {
 
     it("should not display 'null' day of the week (metabase#14405)", () => {
       assignRecipient();
-      // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-      cy.findByText("To:").click();
-      cy.findAllByTestId("select-button").contains("Hourly").click();
-      // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-      cy.findByText("Monthly").click();
-      cy.findAllByTestId("select-button").contains("First").click();
-      // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-      cy.findByText("15th (Midpoint)").click();
-      cy.findAllByTestId("select-button").contains("15th (Midpoint)").click();
-      // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-      cy.findByText("First").click();
+      H.sidebar().findByText("To:").click();
+
+      cy.findByDisplayValue("Hourly").click();
+      H.popover().findByText("Monthly").click();
+
+      cy.findByDisplayValue("First").click();
+      H.popover().findByText("15th (Midpoint)").click();
+
+      cy.findByDisplayValue("15th (Midpoint)").click();
+      H.popover().findByText("First").click();
+
       clickButton("Done");
       // Implicit assertion (word mustn't contain string "null")
-      // eslint-disable-next-line metabase/no-unscoped-text-selectors -- deprecated usage
-      cy.findByText(/^Emailed monthly on the first (?!null)/);
+      H.sidebar().findByText(/^Emailed monthly on the first (?!null)/);
     });
 
     it("should work when using dashboard default filter value on native query with required parameter (metabase#15705)", () => {

enterprise/backend/src/metabase_enterprise/agent_api/workspace.clj

@@ -228,7 +228,7 @@
             [:name :string]
             [:description {:optional true} [:maybe :string]]
             [:source TransformSource]
-            #_[:target TransformTarget]]]
+            [:target TransformTarget]]]
   (ws.api.common/create-workspace-transform! ws-id body))
 
 (api.macros/defendpoint :post "/:ws-id/transform/:tx-id/archive" :- :nil

enterprise/backend/src/metabase_enterprise/analytics/stats.clj

@@ -1,6 +1,5 @@
 (ns metabase-enterprise.analytics.stats
   (:require
-   [java-time.api :as t]
    [metabase-enterprise.advanced-config.settings :as advanced-config.settings]
    [metabase-enterprise.scim.core :as scim]
    [metabase-enterprise.semantic-search.core :as semantic-search]
@@ -36,12 +35,3 @@
    {:name      :semantic-search
     :available (premium-features/enable-semantic-search?)
     :enabled   (semantic-search/supported?)}])
-
-(defenterprise ee-transform-metrics
-  "Returns transform usage metrics for the Snowplow stats ping."
-  :feature :none
-  []
-  (let [one-day-ago (t/minus (t/offset-date-time) (t/days 1))]
-    {:transforms               (t2/count :model/Transform)
-     :transform_runs_last_24h  (t2/count :model/TransformRun
-                                         :start_time [:>= one-day-ago])}))

enterprise/backend/src/metabase_enterprise/dependencies/async.clj

@@ -0,0 +1,24 @@
+(ns metabase-enterprise.dependencies.async
+  "Single-threaded executor for dependency event work.
+
+  The two expensive post-save handlers (`::check-card-dependents` and `::update-card-dependents-metadata`)
+  submit their work here so the HTTP response returns immediately. Tasks execute serially
+  to avoid concurrent writes to dependent cards."
+  (:import
+   (java.util.concurrent Callable Executors ExecutorService ThreadFactory)))
+
+(set! *warn-on-reflection* true)
+
+(defonce ^:private executor
+  (delay (Executors/newSingleThreadExecutor
+          (reify ThreadFactory
+            (newThread [_ r]
+              (doto (Thread. r)
+                (.setName "dependency-event-worker")
+                (.setDaemon true)))))))
+
+(defn submit!
+  "Submit dependency work to the single-threaded executor. Tasks execute serially."
+  [f]
+  (let [task (bound-fn* f)]
+    (.submit ^ExecutorService @executor ^Callable task)))

enterprise/backend/src/metabase_enterprise/dependencies/events.clj

@@ -1,5 +1,6 @@
 (ns metabase-enterprise.dependencies.events
   (:require
+   [metabase-enterprise.dependencies.async :as async]
    [metabase-enterprise.dependencies.calculation :as deps.calculation]
    [metabase-enterprise.dependencies.findings :as deps.findings]
    [metabase-enterprise.dependencies.models.dependency :as models.dependency]
@@ -286,12 +287,14 @@
 (methodical/defmethod events/publish-event! ::check-card-dependents
   [_ {:keys [object]}]
   (when (premium-features/has-feature? :dependencies)
-    (lib-be/with-metadata-provider-cache
-      (let [has-stale-dependents? (t2/with-transaction [_conn]
-                                    (deps.findings/upsert-analysis! object)
-                                    (deps.findings/mark-dependents-stale! :card (:id object)))]
-        (when has-stale-dependents?
-          (task.entity-check/trigger-entity-check-job!))))))
+    (async/submit!
+     (fn []
+       (lib-be/with-metadata-provider-cache
+         (let [has-stale-dependents? (t2/with-transaction [_conn]
+                                       (deps.findings/upsert-analysis! object)
+                                       (deps.findings/mark-dependents-stale! :card (:id object)))]
+           (when has-stale-dependents?
+             (task.entity-check/trigger-entity-check-job!))))))))
 
 (derive ::check-transform :metabase/event)
 (derive :event/create-transform ::check-transform)

enterprise/backend/src/metabase_enterprise/dependencies/metadata_update.clj

@@ -2,6 +2,7 @@
   (:require
    [clojure.core.cache :as cache]
    [medley.core :as m]
+   [metabase-enterprise.dependencies.async :as async]
    [metabase-enterprise.dependencies.dependency-types :as deps.dependency-types]
    [metabase-enterprise.dependencies.metadata-provider :as deps.metadata-provider]
    [metabase-enterprise.dependencies.models.dependency :as models.dependency]
@@ -197,4 +198,6 @@
   [_ {{:keys [id dataset_query]} :object :keys [previous-object]}]
   (when (and (premium-features/has-feature? :dependencies)
              (not (lib/any-native-stage? dataset_query)))
-    (update-dependent-mbql-cards-metadata! dataset_query :card id previous-object :metadata/card)))
+    (async/submit!
+     (fn []
+       (update-dependent-mbql-cards-metadata! dataset_query :card id previous-object :metadata/card)))))

enterprise/backend/src/metabase_enterprise/dependencies/models/analysis_finding.clj

@@ -25,8 +25,9 @@
   - 3: Initial version
   - 4: Disable naive sql validation
   - 5: Added source entity tracking in analysis_finding_error table
-  - 6: Removed validate prefix from error_type in analysis_finding_error"
-  6)
+  - 6: Removed validate prefix from error_type in analysis_finding_error
+  - 7: Only mark inactive (not missing) field refs in :fields as soft (GHY-3157)"
+  7)
 
 (defn- error->finding-error-row
   "Convert an error from lib/find-bad-refs-with-source to a row for analysis_finding_error table.

enterprise/backend/src/metabase_enterprise/dependencies/native_validation.clj

@@ -1,10 +1,15 @@
 (ns metabase-enterprise.dependencies.native-validation
   (:require
+   [clojure.string :as str]
    [metabase.driver :as driver]
+   [metabase.driver.sql :as driver.sql]
    [metabase.lib.core :as lib]
+   [metabase.lib.metadata :as lib.metadata]
    [metabase.lib.schema :as lib.schema]
    [metabase.lib.schema.id :as lib.schema.id]
    [metabase.query-processor.compile :as qp.compile]
+   [metabase.sql-tools.core :as sql-tools]
+   [metabase.util :as u]
    [metabase.util.malli :as mu]))
 
 (mu/defn- compile-query :- ::lib.schema/native-only-query
@@ -21,15 +26,233 @@
         compiled    (qp.compile/compile-with-inline-parameters with-params)]
     (lib/native-query with-params (:query compiled))))
 
+(defn- has-card-template-tags?
+  "Returns true if the query has any card-type template tags."
+  [query]
+  (some #(= (:type %) :card) (lib/all-template-tags query)))
+
+(def ^:private card-placeholder-prefix
+  "Prefix used to generate placeholder table names for card references.
+   Card ref {{#N}} becomes mb__validat_card__N in the SQL sent to SQLGlot."
+  "mb__validat_card__")
+
+(defn- parse-card-placeholder
+  "If table-name is a card placeholder (e.g. \"mb__VALIDAT_card__42\" or \"MB__VALIDAT_CARD__42\"),
+   return the card ID. Returns nil otherwise. Case-insensitive to handle driver normalization."
+  [table-name]
+  (let [lower (u/lower-case-en (str table-name))]
+    (when (str/starts-with? lower card-placeholder-prefix)
+      (parse-long (subs lower (count card-placeholder-prefix))))))
+
+(defn- compile-toplevel-query
+  "Compile a query replacing card references with placeholder table names.
+   Card refs like {{#1}} are replaced with mb__validat_card__1.
+
+   Returns the compiled native-only-query, or nil if the original SQL contains
+   the placeholder prefix (collision guard)."
+  [query]
+  (let [stage     (first (:stages query))
+        sql       (:native stage)
+        ttags     (:template-tags stage)
+        card-tags (into {} (filter #(= (:type (val %)) :card)) ttags)]
+    (when-not (str/includes? sql card-placeholder-prefix)
+      (let [modified-sql
+            (reduce (fn [s [tag-name tag]]
+                      (str/replace s
+                                   (str "{{" tag-name "}}")
+                                   (str card-placeholder-prefix (:card-id tag))))
+                    sql
+                    card-tags)
+
+            non-card-tags
+            (into {} (remove #(= (:type (val %)) :card)) ttags)
+
+            modified-query
+            (-> query
+                (assoc-in [:stages 0 :native] modified-sql)
+                (assoc-in [:stages 0 :template-tags] non-card-tags))]
+        (compile-query modified-query)))))
+
+(defn- table-deps
+  "Returns the set of table dep maps (e.g. {:table \"products\" :schema \"public\"})
+   referenced directly in the compiled native query.
+   Excludes card placeholder tables (mb__validat_card__N)."
+  [driver compiled]
+  (into #{}
+        (filter (fn [dep]
+                  (and (:table dep)
+                       (not (parse-card-placeholder (:table dep))))))
+        (driver/native-query-deps driver compiled)))
+
+(defn- extract-source-entity
+  "Extract source entity info from a :single-column col-spec's source-columns.
+   When card-placeholders? is true, recognizes card placeholder table names (mb__validat_card__N).
+   Returns:
+   - {:kind :table, :spec table-spec} for a single real table source
+   - {:kind :card, :card-id N} for a single card placeholder source (only when card-placeholders?)
+   - :multiple for ambiguous sources (multiple sources of any kind)
+   - nil otherwise (no recognizable sources, or not a :single-column spec)"
+  [card-placeholders? col-spec]
+  (let [card-id-fn (if card-placeholders?
+                     (fn [source] (some-> source :table :table parse-card-placeholder))
+                     (constantly nil))]
+    (when (= (:type col-spec) :single-column)
+      (let [first-sources   (first (:source-columns col-spec))
+            all-col-sources (filter #(= (:type %) :all-columns) first-sources)]
+        (cond
+          (empty? all-col-sources) nil
+
+          (> (count all-col-sources) 1)
+          (let [cards  (keep card-id-fn all-col-sources)
+                tables (remove card-id-fn all-col-sources)]
+            (cond
+              (and (= 1 (count cards)) (empty? tables))
+              {:kind :card, :card-id (first cards)}
+              (and (empty? cards) (= 1 (count tables)))
+              {:kind :table, :spec (:table (first tables))}
+              :else :multiple))
+
+          :else
+          (let [source   (first all-col-sources)
+                card-id  (card-id-fn source)]
+            (if card-id
+              {:kind :card, :card-id card-id}
+              {:kind :table, :spec (:table source)})))))))
+
+(defn- resolve-table-id
+  "Map a SQL table spec {:table name, :schema schema} to a Metabase table ID.
+   Returns table ID or nil if not found."
+  [driver mp table-spec]
+  (:table (sql-tools/find-table-or-transform
+           driver
+           (lib.metadata/tables mp)
+           (lib.metadata/transforms mp)
+           table-spec)))
+
+(defn- card-column-exists?
+  "Check if a column name exists in a card's result-metadata (normalized comparison)."
+  [driver mp card-id col-name]
+  (when-let [card (lib.metadata/card mp card-id)]
+    (let [normalized (driver.sql/normalize-name driver col-name)]
+      (some #(= (driver.sql/normalize-name driver (:name %)) normalized)
+            (:result-metadata card)))))
+
+(defn- enrich-error
+  "Enrich a :missing-column error with source entity information from its col-spec.
+   When card-placeholders? is true, checks card placeholder columns against card metadata:
+   valid columns return nil (suppressed), invalid ones get source attribution.
+   Suppresses :missing-table-alias errors for card placeholder table names.
+   For other error types, returns the error unchanged."
+  [driver mp card-placeholders? col-spec error]
+  (cond
+    ;; Suppress missing-table-alias for card placeholders (e.g. SELECT * FROM mb__validat_card__1)
+    (and card-placeholders?
+         (= (:type error) :missing-table-alias)
+         (parse-card-placeholder (:name error)))
+    nil
+
+    (not= (:type error) :missing-column)
+    error
+
+    :else
+    (let [source (extract-source-entity card-placeholders? col-spec)]
+      (cond
+        ;; Table source
+        (and (map? source) (= (:kind source) :table))
+        (if-let [table-id (resolve-table-id driver mp (:spec source))]
+          (assoc error :source-entity-type :table :source-entity-id table-id)
+          error)
+
+        ;; Card placeholder source — check column against card metadata
+        (and (map? source) (= (:kind source) :card))
+        (let [card-id (:card-id source)]
+          (if (card-column-exists? driver mp card-id (:name error))
+            nil ;; column is valid, suppress error
+            (assoc error :source-entity-type :card :source-entity-id card-id)))
+
+        ;; Multiple/ambiguous sources
+        (= source :multiple)
+        (assoc error :source-entity-type :unknown)
+
+        ;; nil — unknown structure, leave unenriched for fallback
+        :else error))))
+
+(defn- validate-with-sources
+  "Validate a compiled native query, enriching errors with source entity information
+   derived from the col-spec's source-columns.
+   When card-placeholders? is true, card placeholder sources are recognized and valid
+   columns are filtered out (enrich-error returns nil)."
+  [driver compiled card-placeholders?]
+  (let [sql (lib/raw-native-query compiled)
+        mp (lib/->metadata-provider compiled)
+        {:keys [used-fields returned-fields errors]} (sql-tools/field-references driver sql)
+        check-fields (fn [fields]
+                       (mapcat (fn [col-spec]
+                                 (->> (sql-tools/resolve-field driver mp col-spec)
+                                      (keep :error)
+                                      (keep (partial enrich-error driver mp card-placeholders? col-spec))))
+                               fields))]
+    (into #{}
+          (map (partial driver.sql/normalize-error driver))
+          (concat errors
+                  (check-fields used-fields)
+                  (check-fields returned-fields)))))
+
+(defn- fallback-enrich
+  "Second-pass enrichment for errors that validate-with-sources couldn't attribute
+   (e.g., subquery sources). Falls back to the table-count approach."
+  [driver compiled errors]
+  (if (every? :source-entity-type errors)
+    errors
+    (let [mp     (lib/->metadata-provider compiled)
+          tables (table-deps driver compiled)
+          source (cond
+                   (empty? tables)
+                   nil
+
+                   (= 1 (count tables))
+                   (let [table-spec (first tables)]
+                     (if-let [table-id (if (int? (:table table-spec))
+                                         (:table table-spec)
+                                         (resolve-table-id driver mp table-spec))]
+                       {:source-entity-type :table
+                        :source-entity-id   table-id}
+                       {:source-entity-type :unknown}))
+
+                   :else
+                   {:source-entity-type :unknown})]
+      (if source
+        (into #{} (map (fn [error]
+                         (if (or (:source-entity-type error)
+                                 (not= (:type error) :missing-column))
+                           error
+                           (merge error source))))
+              errors)
+        errors))))
+
 (mu/defn validate-native-query
   "Compiles a (native) query and validates that the fields and tables it refers to really exist.
 
-   Returns either nil or a list of errors."
+   Returns a set of errors, each enriched with source entity information when possible."
   [driver :- :keyword
    query  :- ::lib.schema/query]
-  (->> query
-       compile-query
-       (driver/validate-native-query-fields driver)))
+  (into #{}
+        ;; Strip :unknown source attribution — consumers should not distinguish between
+        ;; "we tried and couldn't determine the source" vs "no source info available".
+        (map #(cond-> % (= :unknown (:source-entity-type %)) (dissoc :source-entity-type :source-entity-id)))
+        (if (has-card-template-tags? query)
+          (if-let [compiled (compile-toplevel-query query)]
+            (let [errors (validate-with-sources driver compiled true)]
+              (if (empty? errors)
+                errors
+                (fallback-enrich driver compiled errors)))
+            ;; Fallback: cards with placeholder collision
+            (driver/validate-native-query-fields driver (compile-query query)))
+          (let [compiled (compile-query query)
+                errors   (validate-with-sources driver compiled false)]
+            (if (empty? errors)
+              errors
+              (fallback-enrich driver compiled errors))))))
 
 (mu/defn native-result-metadata
   "Compiles a (native) query and calculates its result metadata"

enterprise/backend/src/metabase_enterprise/llm/settings.clj

@@ -22,6 +22,7 @@
 (defsetting ee-openai-api-key
   (deferred-tru "The OpenAI API Key used in Metabase Enterprise.")
   :encryption :when-encryption-key-set
+  :sensitive? true
   :visibility :settings-manager
   :export? false
   :doc false)
@@ -29,6 +30,7 @@
 (defsetting ee-anthropic-api-key
   (deferred-tru "The Anthropic API Key used in Metabase Enterprise.")
   :encryption :when-encryption-key-set
+  :sensitive? true
   :visibility :settings-manager
   :export? false
   :doc false)

enterprise/backend/src/metabase_enterprise/semantic_search/core.clj

@@ -12,6 +12,7 @@
    [metabase.analytics.core :as analytics]
    [metabase.premium-features.core :refer [defenterprise]]
    [metabase.search.engine :as search.engine]
+   [metabase.tracing.core :as tracing]
    [metabase.util :as u]
    [metabase.util.log :as log]
    [toucan2.realize :as t2.realize]))
@@ -38,53 +39,54 @@
   when semantic search returns too few results and some results were filtered out (e.g. due to permission checks)."
   :feature :semantic-search
   [search-ctx]
-  (try
-    (let [{:keys [results raw-count]}
-          (semantic.pgvector-api/query (semantic.env/get-pgvector-datasource!)
-                                       (semantic.env/get-index-metadata)
-                                       search-ctx)
-          final-count (count results)
-          threshold (semantic.settings/semantic-search-min-results-threshold)]
-      (if (or (>= final-count threshold)
-              (and (zero? raw-count)
-                   ;; :search-string is nil when using search to populate the list of tables for a given database in
-                   ;; the native query editor. Semantic search doesn't support this, so fallback in this case.
-                   (not (str/blank? (:search-string search-ctx)))))
-        results
-        ;; Fallback: semantic search found results but some were filtered out (e.g. due to permission checks), so try to
-        ;; supplement with appdb search.
+  (tracing/with-span :search "search.semantic.execute" {:search/query-length (count (:search-string search-ctx))}
+    (try
+      (let [{:keys [results raw-count]}
+            (semantic.pgvector-api/query (semantic.env/get-pgvector-datasource!)
+                                         (semantic.env/get-index-metadata)
+                                         search-ctx)
+            final-count (count results)
+            threshold (semantic.settings/semantic-search-min-results-threshold)]
+        (if (or (>= final-count threshold)
+                (and (zero? raw-count)
+                     ;; :search-string is nil when using search to populate the list of tables for a given database in
+                     ;; the native query editor. Semantic search doesn't support this, so fallback in this case.
+                     (not (str/blank? (:search-string search-ctx)))))
+          results
+          ;; Fallback: semantic search found results but some were filtered out (e.g. due to permission checks), so try to
+          ;; supplement with appdb search.
+          (let [fallback (fallback-engine)]
+            (log/debugf "Semantic search returned %d final results (< %d) from %d raw results, supplementing with %s search"
+                        final-count threshold raw-count fallback)
+            (analytics/inc! :metabase-search/semantic-fallback-triggered {:fallback-engine fallback})
+            (analytics/observe! :metabase-search/semantic-results-before-fallback final-count)
+
+            (when (some-> (:offset-int search-ctx) pos?)
+              (log/warn "Using an offset with semantic search will produce strange results, e.g. missing expected results, or duplicating them across pages"))
+
+            (let [total-limit      (semantic.settings/semantic-search-results-limit)
+                  fallback-results (try
+                                     (cond->> (search.engine/results (assoc search-ctx :search-engine fallback))
+                                       ;; The in-place engine returns a reducible (but not seqable) result that needs to
+                                       ;; be realized before we concat and dedup with the semantic engine results.
+                                       (= :search.engine/in-place fallback)
+                                       (into [] (comp (map t2.realize/realize)
+                                                      (take total-limit))))
+                                     (catch Throwable t
+                                       (log/warn t "Semantic search fallback errored, ignoring")
+                                       []))
+                  fallback-results (take total-limit fallback-results)
+                  _                (analytics/observe! :metabase-search/semantic-fallback-results-usage (count fallback-results))
+                  combined-results (concat results fallback-results)
+                  deduped-results  (m/distinct-by (juxt :model :id) combined-results)]
+              (take total-limit deduped-results)))))
+      (catch Exception e
+        (log/error e "Error executing semantic search, falling back to appdb")
         (let [fallback (fallback-engine)]
-          (log/debugf "Semantic search returned %d final results (< %d) from %d raw results, supplementing with %s search"
-                      final-count threshold raw-count fallback)
-          (analytics/inc! :metabase-search/semantic-fallback-triggered {:fallback-engine fallback})
-          (analytics/observe! :metabase-search/semantic-results-before-fallback final-count)
-
-          (when (some-> (:offset-int search-ctx) pos?)
-            (log/warn "Using an offset with semantic search will produce strange results, e.g. missing expected results, or duplicating them across pages"))
-
-          (let [total-limit      (semantic.settings/semantic-search-results-limit)
-                fallback-results (try
-                                   (cond->> (search.engine/results (assoc search-ctx :search-engine fallback))
-                                     ;; The in-place engine returns a reducible (but not seqable) result that needs to
-                                     ;; be realized before we concat and dedup with the semantic engine results.
-                                     (= :search.engine/in-place fallback)
-                                     (into [] (comp (map t2.realize/realize)
-                                                    (take total-limit))))
-                                   (catch Throwable t
-                                     (log/warn t "Semantic search fallback errored, ignoring")
-                                     []))
-                fallback-results (take total-limit fallback-results)
-                _                (analytics/observe! :metabase-search/semantic-fallback-results-usage (count fallback-results))
-                combined-results (concat results fallback-results)
-                deduped-results  (m/distinct-by (juxt :model :id) combined-results)]
-            (take total-limit deduped-results)))))
-    (catch Exception e
-      (log/error e "Error executing semantic search, falling back to appdb")
-      (let [fallback (fallback-engine)]
-        (analytics/inc! :metabase-search/semantic-error-fallback {:fallback-engine fallback})
-        (if fallback
-          (search.engine/results (assoc search-ctx :search-engine fallback))
-          (throw (ex-info "Error executing semantic search" {:type :semantic-search-error} e)))))))
+          (analytics/inc! :metabase-search/semantic-error-fallback {:fallback-engine fallback})
+          (if fallback
+            (search.engine/results (assoc search-ctx :search-engine fallback))
+            (throw (ex-info "Error executing semantic search" {:type :semantic-search-error} e))))))))
 
 (defenterprise update-index!
   "Enterprise implementation of semantic index updating."

enterprise/backend/src/metabase_enterprise/semantic_search/embedding.clj

@@ -6,6 +6,7 @@
    [metabase-enterprise.semantic-search.models.token-tracking :as semantic.models.token-tracking]
    [metabase-enterprise.semantic-search.settings :as semantic-settings]
    [metabase.analytics.core :as analytics]
+   [metabase.tracing.core :as tracing]
    [metabase.util :as u]
    [metabase.util.json :as json]
    [metabase.util.log :as log])
@@ -279,26 +280,30 @@
   [embedding-model texts process-fn & {:as opts}]
   (when (seq texts)
     (let [{:keys [model-name provider vector-dimensions]} embedding-model]
-      (u/profile (str "Generating embeddings " {:model model-name
-                                                :dimensions vector-dimensions
-                                                :texts (calc-token-metrics texts)})
-        (if (= "openai" provider)
-          (let [max-tokens-per-batch (semantic-settings/openai-max-tokens-per-batch)
-                batches (create-batches max-tokens-per-batch count-tokens texts)
+      (tracing/with-span :search "search.semantic.embeddings-batch"
+        {:search.semantic/provider   provider
+         :search.semantic/model-name model-name
+         :search.semantic/text-count (count texts)}
+        (u/profile (str "Generating embeddings " {:model model-name
+                                                  :dimensions vector-dimensions
+                                                  :texts (calc-token-metrics texts)})
+          (if (= "openai" provider)
+            (let [max-tokens-per-batch (semantic-settings/openai-max-tokens-per-batch)
+                  batches (create-batches max-tokens-per-batch count-tokens texts)
 
-                process-batch
-                (fn [batch-idx batch-texts]
-                  (let [embeddings (u/profile (format "Embedding batch %d/%d %s"
-                                                      (inc batch-idx) (count batches) (str (calc-token-metrics batch-texts)))
-                                     (openai-get-embeddings-batch embedding-model batch-texts opts))
-                        text-embedding-map (zipmap batch-texts embeddings)]
-                    (process-fn text-embedding-map)))]
+                  process-batch
+                  (fn [batch-idx batch-texts]
+                    (let [embeddings (u/profile (format "Embedding batch %d/%d %s"
+                                                        (inc batch-idx) (count batches) (str (calc-token-metrics batch-texts)))
+                                       (openai-get-embeddings-batch embedding-model batch-texts opts))
+                          text-embedding-map (zipmap batch-texts embeddings)]
+                      (process-fn text-embedding-map)))]
 
-            (transduce (map-indexed process-batch) (partial merge-with +) batches))
+              (transduce (map-indexed process-batch) (partial merge-with +) batches))
 
-          (let [embeddings (get-embeddings-batch embedding-model texts opts)
-                text-embedding-map (zipmap texts embeddings)]
-            (process-fn text-embedding-map)))))))
+            (let [embeddings (get-embeddings-batch embedding-model texts opts)
+                  text-embedding-map (zipmap texts embeddings)]
+              (process-fn text-embedding-map))))))))
 
 (comment
   ;; Configuration:

enterprise/backend/src/metabase_enterprise/semantic_search/index.clj

@@ -16,6 +16,7 @@
    [metabase.models.interface :as mi]
    [metabase.search.config :as search.config]
    [metabase.search.core :as search]
+   [metabase.tracing.core :as tracing]
    [metabase.util :as u]
    [metabase.util.json :as json]
    [metabase.util.log :as log]
@@ -389,20 +390,21 @@
   model + model_id already exists, it will be replaced. Parallelizes batch insertion
   using a shared thread pool with a configurable thread count (default: 2)."
   ([connectable index documents-reducible & {:keys [serial?] :or {serial? false}}]
-   (not-empty
-    (let [pool @index-update-executor
-          results (transduce
-                   (comp (partition-all *batch-size*)
-                         (map (if serial?
-                                #(upsert-index-batch! connectable index % {:type :index})
-                                #(upsert-index-pooled! pool connectable index % {:type :index}))))
-                   conj
-                   documents-reducible)]
-      (reduce (fn [update-counts result]
-                (let [value (if (future? result) @result result)]
-                  (merge-with + update-counts (when value value))))
-              {}
-              results)))))
+   (tracing/with-span :search "search.semantic.index-upsert" {}
+     (not-empty
+      (let [pool @index-update-executor
+            results (transduce
+                     (comp (partition-all *batch-size*)
+                           (map (if serial?
+                                  #(upsert-index-batch! connectable index % {:type :index})
+                                  #(upsert-index-pooled! pool connectable index % {:type :index}))))
+                     conj
+                     documents-reducible)]
+        (reduce (fn [update-counts result]
+                  (let [value (if (future? result) @result result)]
+                    (merge-with + update-counts (when value value))))
+                {}
+                results))))))
 
 (defn- drop-index-table-sql
   [{:keys [table-name]}]
@@ -803,7 +805,10 @@
       {:results [] :raw-count 0}
       (let [timer (u/start-timer)
 
-            embedding (embedding/get-embedding embedding-model search-string {:type :query})
+            embedding (tracing/with-span :search "search.semantic.embedding"
+                        {:search.semantic/provider   (:provider embedding-model)
+                         :search.semantic/model-name (:model-name embedding-model)}
+                        (embedding/get-embedding embedding-model search-string {:type :query}))
             embedding-time-ms (u/since-ms timer)
 
             db-timer (u/start-timer)
@@ -813,14 +818,18 @@
             xform (comp (map decode-metadata)
                         (map (partial legacy-input-with-score weights (keys scorers))))
             reducible (reducible-search-query db query)
-            raw-results (into [] xform reducible)
+            raw-results (tracing/with-span :search "search.semantic.db-query"
+                          {:search/query-length (count search-string)}
+                          (into [] xform reducible))
             db-query-time-ms (u/since-ms db-timer)
 
             filter-timer (u/start-timer)
-            filtered-results (->> raw-results
-                                  filter-read-permitted
-                                  (apply-collection-id-filter search-context)
-                                  (mapv search/collapse-id))
+            filtered-results (tracing/with-span :search "search.semantic.permission-filter"
+                               {:search.semantic/raw-count (count raw-results)}
+                               (->> raw-results
+                                    filter-read-permitted
+                                    (apply-collection-id-filter search-context)
+                                    (mapv search/collapse-id)))
             filter-time-ms (u/since-ms filter-timer)
 
             appdb-scorers (scoring/appdb-scorers search-context)

enterprise/backend/src/metabase_enterprise/transforms_python/api.clj

@@ -13,6 +13,8 @@
    [metabase.util.malli.schema :as ms]
    [toucan2.core :as t2]))
 
+;; dummy change to trigger CI
+
 (defn get-python-library-by-path
   "Get Python library details by path for use by other APIs."
   [path]

enterprise/backend/src/metabase_enterprise/transforms_python/settings.clj

@@ -19,6 +19,7 @@
   (deferred-tru "API token for authorizing with the python-runner service.")
   :type       :string
   :visibility :admin
+  :sensitive? true
   :default    (when (not config/is-prod?) "dev-token-12345")
   :feature    :transforms-python
   :doc        false
@@ -76,6 +77,7 @@
   :visibility :admin
   :feature    :transforms-python
   :default    (when (not config/is-prod?) "test")
+  :sensitive? true
   :doc        false
   :export?    false
   :encryption :no
@@ -85,6 +87,7 @@
   (deferred-tru "AWS secret access key for S3 authentication.")
   :type       :string
   :visibility :admin
+  :sensitive? true
   :feature    :transforms-python
   :default    (when (not config/is-prod?) "test")
   :doc        false

enterprise/backend/src/metabase_enterprise/workspaces/api.clj

@@ -380,8 +380,7 @@
             [:name :string]
             [:description {:optional true} [:maybe :string]]
             [:source TransformSource]
-            ;; Not sure why this schema is giving trouble
-            #_[:target TransformTarget]]]
+            [:target TransformTarget]]]
   (ws.api.common/create-workspace-transform! ws-id body))
 
 (api.macros/defendpoint :get "/:ws-id/transform" :- [:map [:transforms [:sequential WorkspaceTransformListing]]]

enterprise/backend/test/metabase_enterprise/analytics/stats_test.clj

@@ -1,12 +1,10 @@
 (ns metabase-enterprise.analytics.stats-test
   (:require
    [clojure.test :refer :all]
-   [java-time.api :as t]
    [metabase-enterprise.analytics.stats :as ee-stats]
    [metabase-enterprise.audit-app.audit :as ee-audit]
    [metabase.analytics.stats :as stats]
    [metabase.app-db.core :as mdb]
-   [metabase.lib.core :as lib]
    [metabase.test :as mt]
    [toucan2.core :as t2]))
 
@@ -38,29 +36,3 @@
                 :public             {}
                 :embedded           {}}
                (#'stats/dashboard-metrics)))))))
-
-(deftest ee-transform-metrics-test
-  (mt/with-temp-empty-app-db [_conn :h2]
-    (mdb/setup-db! :create-sample-content? false)
-    (testing "with no transforms"
-      (is (=? {:transforms 0 :transform_runs_last_24h 0}
-              (ee-stats/ee-transform-metrics))))
-    (testing "with transforms"
-      (mt/with-temp [:model/Transform transform {:target {:database (mt/id)
-                                                          :table "test_table"}
-                                                 :name "Test SQL transform"
-                                                 :source {:type "query"
-                                                          :query (lib/native-query (mt/metadata-provider) "SELECT 1")}}
-                     :model/TransformRun _ {:start_time (t/minus (t/offset-date-time) (t/hours 1))
-                                            :transform_id (:id transform)}]
-        (is (=? {:transforms 1 :transform_runs_last_24h 1}
-                (ee-stats/ee-transform-metrics))))
-      (testing "with old transform runs"
-        (mt/with-temp [:model/Transform transform {:target {:database (mt/id)
-                                                            :table "test_table"}
-                                                   :name "Test SQL transform"
-                                                   :source {:type "query"
-                                                            :query (lib/native-query (mt/metadata-provider) "SELECT 1")}}
-                       :model/TransformRun _ {:start_time (t/minus (t/offset-date-time) (t/hours 25))
-                                              :transform_id (:id transform)}]
-          (is (zero? (:transform_runs_last_24h (ee-stats/ee-transform-metrics)))))))))

enterprise/backend/test/metabase_enterprise/dependencies/api_test.clj

@@ -819,50 +819,51 @@
   (testing "GET /api/ee/dependencies/graph includes upstream nodes if ANY path to them is readable"
     (mt/dataset test-data
       (mt/with-premium-features #{:dependencies}
-        (mt/with-non-admin-groups-no-root-collection-perms
-          (mt/with-temp [:model/Collection readable-collection {}
-                         :model/Collection unreadable-collection {}
-                         :model/User user {:email "test@test.com"}]
-            (mt/with-model-cleanup [:model/Card :model/Dependency]
-              (let [base-card (card/create-card! (assoc (basic-card) :collection_id (:id readable-collection)) user)
-                    unreadable-middle (card/create-card! (assoc (wrap-card base-card)
-                                                                :collection_id (:id unreadable-collection))
-                                                         user)
-                    readable-alternate (card/create-card! (assoc (wrap-card base-card)
-                                                                 :collection_id (:id readable-collection))
-                                                          user)
-                    end-card (card/create-card! (assoc (wrap-two-cards unreadable-middle readable-alternate)
-                                                       :collection_id (:id readable-collection))
-                                                user)]
-                (perms/grant-collection-read-permissions! (perms/all-users-group) readable-collection)
-                (testing "Diamond pattern: complete upstream graph via readable path"
-                  (let [response (mt/user-http-request :rasta :get 200 "ee/dependencies/graph"
-                                                       :id (:id end-card)
-                                                       :type "card")
-                        nodes (set (map (juxt :type :id) (:nodes response)))
-                        expected-nodes #{["card" (:id end-card)] ["card" (:id readable-alternate)]
-                                         ["card" (:id base-card)] ["table" (mt/id :orders)]}]
-                    (is (= expected-nodes nodes)
-                        "Should see end-card, readable-alternate, base-card, and :orders table")))
-                (testing "Edges show complete readable dependency chain"
-                  (let [response (mt/user-http-request :rasta :get 200 "ee/dependencies/graph"
-                                                       :id (:id end-card)
-                                                       :type "card")
-                        edges (set (:edges response))
-                        expected-edges #{{:from_entity_id (:id end-card)
-                                          :from_entity_type "card"
-                                          :to_entity_id (:id readable-alternate)
-                                          :to_entity_type "card"}
-                                         {:from_entity_id (:id readable-alternate)
-                                          :from_entity_type "card"
-                                          :to_entity_id (:id base-card)
-                                          :to_entity_type "card"}
-                                         {:from_entity_id (:id base-card)
-                                          :from_entity_type "card"
-                                          :to_entity_id (mt/id :orders)
-                                          :to_entity_type "table"}}]
-                    (is (= expected-edges edges)
-                        "Should have edges through readable path only")))))))))))
+        (mt/with-empty-h2-app-db!
+          (mt/with-non-admin-groups-no-root-collection-perms
+            (mt/with-temp [:model/Collection readable-collection {}
+                           :model/Collection unreadable-collection {}
+                           :model/User user {:email "test@test.com"}]
+              (mt/with-model-cleanup [:model/Card :model/Dependency]
+                (let [base-card (card/create-card! (assoc (basic-card) :collection_id (:id readable-collection)) user)
+                      unreadable-middle (card/create-card! (assoc (wrap-card base-card)
+                                                                  :collection_id (:id unreadable-collection))
+                                                           user)
+                      readable-alternate (card/create-card! (assoc (wrap-card base-card)
+                                                                   :collection_id (:id readable-collection))
+                                                            user)
+                      end-card (card/create-card! (assoc (wrap-two-cards unreadable-middle readable-alternate)
+                                                         :collection_id (:id readable-collection))
+                                                  user)]
+                  (perms/grant-collection-read-permissions! (perms/all-users-group) readable-collection)
+                  (testing "Diamond pattern: complete upstream graph via readable path"
+                    (let [response (mt/user-http-request :rasta :get 200 "ee/dependencies/graph"
+                                                         :id (:id end-card)
+                                                         :type "card")
+                          nodes (set (map (juxt :type :id) (:nodes response)))
+                          expected-nodes #{["card" (:id end-card)] ["card" (:id readable-alternate)]
+                                           ["card" (:id base-card)] ["table" (mt/id :orders)]}]
+                      (is (= expected-nodes nodes)
+                          "Should see end-card, readable-alternate, base-card, and :orders table")))
+                  (testing "Edges show complete readable dependency chain"
+                    (let [response (mt/user-http-request :rasta :get 200 "ee/dependencies/graph"
+                                                         :id (:id end-card)
+                                                         :type "card")
+                          edges (set (:edges response))
+                          expected-edges #{{:from_entity_id (:id end-card)
+                                            :from_entity_type "card"
+                                            :to_entity_id (:id readable-alternate)
+                                            :to_entity_type "card"}
+                                           {:from_entity_id (:id readable-alternate)
+                                            :from_entity_type "card"
+                                            :to_entity_id (:id base-card)
+                                            :to_entity_type "card"}
+                                           {:from_entity_id (:id base-card)
+                                            :from_entity_type "card"
+                                            :to_entity_id (mt/id :orders)
+                                            :to_entity_type "table"}}]
+                      (is (= expected-edges edges)
+                          "Should have edges through readable path only"))))))))))))
 
 (deftest graph-filtering-all-unreadable-test
   (testing "GET /api/ee/dependencies/graph returns only root node when all upstream dependencies are unreadable"
@@ -1616,11 +1617,12 @@
 (deftest ^:sequential unreferenced-sample-db-test
   (testing "GET /api/ee/dependencies/unreferenced - should not return tables from the sample database"
     (mt/with-premium-features #{:dependencies}
-      (mt/with-temp [:model/Database {db-id :id} {:is_sample true}
-                     :model/Table    _           {:db_id db-id :name "Sample DB table - unreftest"}]
-        (is (=? {:data   []
-                 :total  0}
-                (mt/user-http-request :crowberto :get 200 "ee/dependencies/graph/unreferenced?types=table&query=unreftest")))))))
+      (mt/with-empty-h2-app-db!
+        (mt/with-temp [:model/Database {db-id :id} {:is_sample true}
+                       :model/Table    _           {:db_id db-id :name "Sample DB table - unreftest"}]
+          (is (=? {:data   []
+                   :total  0}
+                  (mt/user-http-request :crowberto :get 200 "ee/dependencies/graph/unreferenced?types=table&query=unreftest"))))))))
 
 (deftest ^:sequential unreferenced-audit-db-test
   (testing "GET /api/ee/dependencies/unreferenced - should not return tables from the audit database"

enterprise/backend/test/metabase_enterprise/dependencies/core_test.clj

@@ -197,7 +197,7 @@
                                                                 :base-provider provider
                                                                 :graph graph
                                                                 :include-native? true)]
-          (is (= #{:card :transform} (set (keys errors))))
+          (is (= #{:card} (set (keys errors))))
           ;; That breaks (1) the SQL card which uses the snippets, (2) the transforms, (3) both the MBQL and (4) SQL
           ;; queries that consume the transform's table.
           ;; We only check :missing-column errors since SQLGlot and Macaw produce different

enterprise/backend/test/metabase_enterprise/dependencies/events_test.clj

@@ -2,6 +2,7 @@
   (:require
    [clojure.string :as str]
    [clojure.test :refer [deftest is testing]]
+   [metabase-enterprise.dependencies.async :as async]
    [metabase-enterprise.dependencies.calculation :as deps.calculation]
    [metabase-enterprise.dependencies.events]
    [metabase-enterprise.dependencies.findings :as deps.findings]
@@ -793,7 +794,8 @@
                                              :from_entity_id child-card-id
                                              :to_entity_type :card
                                              :to_entity_id parent-card-id}]
-           (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*})
+           (with-redefs [async/submit! (fn [f] (f))]
+             (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*}))
            (assert-has-analyses
             {:card {parent-card-id -1}})
            (is (nil? (t2/select-one-fn :analysis_version :model/AnalysisFinding
@@ -828,7 +830,8 @@
                       other-card-id old-version}}))
            (t2/with-transaction [_conn]
              (binding [models.analysis-finding/*current-analysis-finding-version* new-version]
-               (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*}))
+               (with-redefs [async/submit! (fn [f] (f))]
+                 (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*})))
              (testing "Parent should be re-analyzed synchronously"
                (assert-has-analyses
                 {:card {parent-card-id new-version}}))
@@ -862,7 +865,8 @@
            (deps.findings/upsert-analysis! child-card)
            ;; Update parent - this marks child as stale
            (t2/with-transaction [_conn]
-             (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*})
+             (with-redefs [async/submit! (fn [f] (f))]
+               (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*}))
              ;; Verify child is stale
              (is (true? (t2/select-one-fn :stale :model/AnalysisFinding
                                           :analyzed_entity_type :card
@@ -895,7 +899,8 @@
                                                   :analyzed_entity_id card-id))))
            ;; Try to update with mark-dependents-stale! throwing an exception
            (binding [models.analysis-finding/*current-analysis-finding-version* new-version]
-             (with-redefs [deps.findings/mark-dependents-stale! (fn [_ _] (throw (ex-info "Simulated failure" {})))]
+             (with-redefs [async/submit!                     (fn [f] (f))
+                           deps.findings/mark-dependents-stale! (fn [_ _] (throw (ex-info "Simulated failure" {})))]
                (is (thrown-with-msg? clojure.lang.ExceptionInfo #"Simulated failure"
                                      (events/publish-event! :event/card-update {:object card :previous-object card :user-id api/*current-user-id*})))))
            ;; Verify analysis was NOT updated (rolled back)
@@ -925,18 +930,19 @@
          (deps.findings/upsert-analysis! child)
          (t2/with-transaction [_conn]
            (binding [models.analysis-finding/*current-analysis-finding-version* new-version]
-             (events/publish-event! :event/card-update {:object parent
-                                                        :previous-object parent
-                                                        :user-id api/*current-user-id*})
-             (testing "Native card update should trigger analysis"
-               (assert-has-analyses
-                {:card {parent-id new-version}}))
-             (testing "Its dependents should be marked stale"
-               (let [child-finding (t2/select-one :model/AnalysisFinding
-                                                  :analyzed_entity_type :card
-                                                  :analyzed_entity_id child-id)]
-                 (is (= old-version (:analysis_version child-finding)))
-                 (is (true? (:stale child-finding))))))))))))
+             (with-redefs [async/submit! (fn [f] (f))]
+               (events/publish-event! :event/card-update {:object parent
+                                                          :previous-object parent
+                                                          :user-id api/*current-user-id*})
+               (testing "Native card update should trigger analysis"
+                 (assert-has-analyses
+                  {:card {parent-id new-version}}))
+               (testing "Its dependents should be marked stale"
+                 (let [child-finding (t2/select-one :model/AnalysisFinding
+                                                    :analyzed_entity_type :card
+                                                    :analyzed_entity_id child-id)]
+                   (is (= old-version (:analysis_version child-finding)))
+                   (is (true? (:stale child-finding)))))))))))))
 
 (deftest ^:sequential card-update-stops-on-transforms-test
   (run-with-dependencies-setup!
@@ -974,22 +980,23 @@
                :transform {transform-id old-version}}))
            (binding [models.analysis-finding/*current-analysis-finding-version* new-version]
              (t2/with-transaction [_conn]
-               (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*})
-               (testing "parent card should be re-analyzed synchronously"
-                 (is (=? {:analysis_version new-version :stale false}
-                         (t2/select-one :model/AnalysisFinding
-                                        :analyzed_entity_type :card
-                                        :analyzed_entity_id parent-card-id))))
-               (testing "transform (direct dependent) should be marked stale"
-                 (is (=? {:analysis_version old-version :stale true}
-                         (t2/select-one :model/AnalysisFinding
-                                        :analyzed_entity_type :transform
-                                        :analyzed_entity_id transform-id))))
-               (testing "child card (transitive dependent) should be marked stale"
-                 (is (=? {:analysis_version old-version :stale true}
-                         (t2/select-one :model/AnalysisFinding
-                                        :analyzed_entity_type :card
-                                        :analyzed_entity_id child-card-id))))))))))))
+               (with-redefs [async/submit! (fn [f] (f))]
+                 (events/publish-event! :event/card-update {:object parent-card :previous-object parent-card :user-id api/*current-user-id*})
+                 (testing "parent card should be re-analyzed synchronously"
+                   (is (=? {:analysis_version new-version :stale false}
+                           (t2/select-one :model/AnalysisFinding
+                                          :analyzed_entity_type :card
+                                          :analyzed_entity_id parent-card-id))))
+                 (testing "transform (direct dependent) should be marked stale"
+                   (is (=? {:analysis_version old-version :stale true}
+                           (t2/select-one :model/AnalysisFinding
+                                          :analyzed_entity_type :transform
+                                          :analyzed_entity_id transform-id))))
+                 (testing "child card (transitive dependent) should be marked stale"
+                   (is (=? {:analysis_version old-version :stale true}
+                           (t2/select-one :model/AnalysisFinding
+                                          :analyzed_entity_type :card
+                                          :analyzed_entity_id child-card-id)))))))))))))
 
 (deftest ^:sequential transform-update-works-with-no-analyses-test
   (run-with-dependencies-setup!

enterprise/backend/test/metabase_enterprise/dependencies/findings_test.clj

@@ -1,11 +1,15 @@
 (ns metabase-enterprise.dependencies.findings-test
   (:require
    [clojure.test :refer :all]
+   [medley.core :as m]
+   [metabase-enterprise.dependencies.analysis :as deps.analysis]
    [metabase-enterprise.dependencies.findings :as deps.findings]
    [metabase-enterprise.dependencies.models.analysis-finding :as models.analysis-finding]
    [metabase.lib-be.core :as lib-be]
    [metabase.lib.core :as lib]
    [metabase.lib.metadata :as lib.metadata]
+   [metabase.lib.test-metadata :as meta]
+   [metabase.lib.test-util :as lib.tu]
    [metabase.test :as mt]
    [metabase.test.fixtures :as fixtures]
    [toucan2.core :as t2]))
@@ -72,8 +76,8 @@
                                    :analyzed_entity_id card-id
                                    :analyzed_entity_type :card))))))))
 
-(deftest ^:sequential does-not-report-errors-in-removable-refs-test-1-stage-fields
-  (testing ":fields lists have soft refs that the QP will remove, so they're not considered analysis findings"
+(deftest ^:sequential does-report-errors-for-missing-refs-in-fields-test
+  (testing "missing (not inactive) field refs in :fields are reported as findings (GHY-3157)"
     (backfill-all-entity-analyses!)
     (let [mp      (mt/metadata-provider)
           orders  (lib.metadata/table mp (mt/id :orders))
@@ -86,7 +90,7 @@
       (mt/with-premium-features #{:dependencies}
         (mt/with-temp [:model/Card {card-id :id} {:dataset_query query}]
           (is (= 1 (deps.findings/analyze-batch! :card 1)))
-          (is (= [models.analysis-finding/*current-analysis-finding-version* true]
+          (is (= [models.analysis-finding/*current-analysis-finding-version* false]
                  (t2/select-one-fn (juxt :analysis_version :result)
                                    :model/AnalysisFinding
                                    :analyzed_entity_id card-id
@@ -95,6 +99,28 @@
 ;; TODO: (bshepherdson, 2026-02-05) Add a test like does-not-report-errors-in-removable-refs-test-1-stage-fields for
 ;; join clause :fields as well. See QUE-3081 and QUE-3044.
 
+(deftest ^:parallel reports-missing-field-in-downstream-card-fields-test
+  (testing "Q2 based on Q1 with :fields referencing a column Q1 no longer returns should be reported (GHY-3157)"
+    (let [mp          meta/metadata-provider
+          q1          (lib/query mp (meta/table-metadata :orders))
+          q1-cols     (lib/returned-columns q1)
+          removed-col (m/find-first #(= (:name %) "ID") q1-cols)
+          ;; Card 101 = Q1 with ID removed from result-metadata (simulates Q1 dropping that field)
+          mp          (lib.tu/metadata-provider-with-card-from-query
+                       mp 101 q1
+                       {:result-metadata (vec (remove #(= (:name %) "ID") q1-cols))})
+          ;; Q2: query based on card 101, with :fields including the now-missing ID
+          q2-base     (lib/query mp {:lib/type :metadata/card :id 101})
+          q2-cols     (lib/returned-columns q2-base)
+          q2          (lib/with-fields q2-base (conj (vec q2-cols) (lib/ref removed-col)))
+          ;; Card 102 = Q2 (provide result-metadata explicitly since q2 has a bad ref)
+          mp          (lib.tu/metadata-provider-with-card-from-query
+                       mp 102 q2
+                       {:result-metadata (vec q2-cols)})
+          results     (deps.analysis/check-entity mp :card 102)]
+      (is (seq results)
+          "Q2 should have findings for the missing ID column from Q1"))))
+
 (defn- stale-map
   "Returns a map of {entity-id stale?} for the given card IDs."
   [card-ids]

enterprise/backend/test/metabase_enterprise/dependencies/metadata_update_test.clj

@@ -3,6 +3,7 @@
    [clojure.java.jdbc :as jdbc]
    [clojure.test :refer [deftest is testing]]
    [java-time.api :as t]
+   [metabase-enterprise.dependencies.async :as async]
    [metabase-enterprise.dependencies.dependency-types :as deps.dependency-types]
    [metabase-enterprise.dependencies.events :as deps.events]
    [metabase-enterprise.dependencies.findings :as deps.findings]
@@ -132,10 +133,11 @@
                                      [:model/Card :id :result_metadata :card_schema]
                                      :id [:in [parent-id child-id grandchild-id]])))
             (t2/update! :model/Card parent-id {:dataset_query (lib/query mp orders)})
-            (events/publish-event! :event/card-update
-                                   {:object (assoc parent-card :dataset_query (lib/query mp orders))
-                                    :previous-object parent-card
-                                    :user-id api/*current-user-id*})
+            (with-redefs [async/submit! (fn [f] (f))]
+              (events/publish-event! :event/card-update
+                                     {:object (assoc parent-card :dataset_query (lib/query mp orders))
+                                      :previous-object parent-card
+                                      :user-id api/*current-user-id*}))
             (is (= #{9}
                    (t2/select-fn-set (comp count :result_metadata)
                                      [:model/Card :id :result_metadata :card_schema]
@@ -156,10 +158,11 @@
                                               :to_entity_type :card
                                               :to_entity_id parent-id}]
             (t2/update! :model/Card child-id {:result_metadata nil})
-            (events/publish-event! :event/card-update
-                                   {:object (assoc parent-card :dataset_query native-query)
-                                    :previous-object parent-card
-                                    :user-id api/*current-user-id*})
+            (with-redefs [async/submit! (fn [f] (f))]
+              (events/publish-event! :event/card-update
+                                     {:object (assoc parent-card :dataset_query native-query)
+                                      :previous-object parent-card
+                                      :user-id api/*current-user-id*}))
             (is (= nil
                    (t2/select-one-fn :result_metadata
                                      [:model/Card :id :result_metadata :card_schema]
@@ -191,10 +194,11 @@
                                                 [0 :display_name]
                                                 "new-name")]
               (t2/update! :model/Card parent-id {:result_metadata new-result-metadata})
-              (events/publish-event! :event/card-update
-                                     {:object (assoc parent-card :result_metadata new-result-metadata)
-                                      :previous-object parent-card
-                                      :user-id api/*current-user-id*})
+              (with-redefs [async/submit! (fn [f] (f))]
+                (events/publish-event! :event/card-update
+                                       {:object (assoc parent-card :result_metadata new-result-metadata)
+                                        :previous-object parent-card
+                                        :user-id api/*current-user-id*}))
               (is (= #{[child-id "new-name"] [grandchild-id "new-name"]}
                      (t2/select-fn-set (juxt :id #(get-in % [:result_metadata 0 :display_name]))
                                        [:model/Card :id :result_metadata :card_schema]
@@ -233,10 +237,11 @@
               (t2/update! :model/Card parent-id {:result_metadata new-parent-metadata})
               (t2/update! :model/Card child-id {:result_metadata new-child-metadata})
               (t2/update! :model/Card grandchild-id {:result_metadata new-grandchild-metadata})
-              (events/publish-event! :event/card-update
-                                     {:object (assoc parent-card :result_metadata new-parent-metadata)
-                                      :previous-object parent-card
-                                      :user-id api/*current-user-id*})
+              (with-redefs [async/submit! (fn [f] (f))]
+                (events/publish-event! :event/card-update
+                                       {:object (assoc parent-card :result_metadata new-parent-metadata)
+                                        :previous-object parent-card
+                                        :user-id api/*current-user-id*}))
               (is (= #{[child-id "child-name"] [grandchild-id "grandchild-name"]}
                      (t2/select-fn-set (juxt :id #(get-in % [:result_metadata 0 :display_name]))
                                        [:model/Card :id :result_metadata :card_schema]
@@ -274,10 +279,11 @@
               (t2/update! :model/Card parent-id {:result_metadata new-parent-metadata})
               (t2/update! :model/Card child-id {:result_metadata new-child-metadata})
               (t2/update! :model/Card grandchild-id {:result_metadata nil})
-              (events/publish-event! :event/card-update
-                                     {:object (assoc parent-card :result_metadata new-parent-metadata)
-                                      :previous-object parent-card
-                                      :user-id api/*current-user-id*})
+              (with-redefs [async/submit! (fn [f] (f))]
+                (events/publish-event! :event/card-update
+                                       {:object (assoc parent-card :result_metadata new-parent-metadata)
+                                        :previous-object parent-card
+                                        :user-id api/*current-user-id*}))
               (is (= nil
                      (t2/select-one-fn #(get-in % [:result_metadata 0 :display_name])
                                        [:model/Card :id :result_metadata :card_schema]

enterprise/backend/test/metabase_enterprise/dependencies/models/dependency_test.clj

@@ -180,41 +180,42 @@
 
 (deftest dependency-analysis-version-test
   (testing "dependency_analysis_version is updated when entities are created or updated"
-    (testing "cards"
-      (mt/with-model-cleanup [:model/Dependency]
-        (mt/with-temp [:model/Card card {:dependency_analysis_version 0}]
-          (is (zero? (t2/select-one-fn :dependency_analysis_version :model/Card (:id card))))
-          (mt/with-premium-features #{:dependencies}
-            (card/update-card! {:card-before-update card
-                                :card-updates {:dataset_query (mt/mbql-query orders)}}))
-          (is (= deps.graph/current-dependency-analysis-version
-                 (t2/select-one-fn :dependency_analysis_version :model/Card (:id card)))))))
-    (testing "transforms create"
-      (mt/with-premium-features #{:dependencies}
-        (mt/with-temp [:model/Transform transform]
-          (is (= deps.graph/current-dependency-analysis-version
-                 (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform)))))))
-    (testing "transforms update"
-      (mt/with-premium-features #{}
-        (mt/with-temp [:model/Transform transform]
-          (is (zero? (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform))))
-          (mt/with-premium-features #{:dependencies}
-            (t2/update! :model/Transform (:id transform) {:source {:type "query" :query (mt/mbql-query products)}}))
-          (is (= deps.graph/current-dependency-analysis-version
-                 (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform)))))))
-    (testing "snippets create"
-      (mt/with-premium-features #{:dependencies}
-        (mt/with-temp [:model/NativeQuerySnippet snippet]
-          (is (= deps.graph/current-dependency-analysis-version
-                 (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet)))))))
-    (testing "snippets update"
-      (mt/with-premium-features #{}
-        (mt/with-temp [:model/NativeQuerySnippet snippet]
-          (is (zero? (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet))))
-          (mt/with-premium-features #{:dependencies}
-            (t2/update! :model/NativeQuerySnippet (:id snippet) {:content "new content"}))
-          (is (= deps.graph/current-dependency-analysis-version
-                 (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet)))))))))
+    (mt/with-empty-h2-app-db!
+      (testing "cards"
+        (mt/with-model-cleanup [:model/Dependency]
+          (mt/with-temp [:model/Card card {:dependency_analysis_version 0}]
+            (is (zero? (t2/select-one-fn :dependency_analysis_version :model/Card (:id card))))
+            (mt/with-premium-features #{:dependencies}
+              (card/update-card! {:card-before-update card
+                                  :card-updates {:dataset_query (mt/mbql-query orders)}}))
+            (is (= deps.graph/current-dependency-analysis-version
+                   (t2/select-one-fn :dependency_analysis_version :model/Card (:id card)))))))
+      (testing "transforms create"
+        (mt/with-premium-features #{:dependencies}
+          (mt/with-temp [:model/Transform transform]
+            (is (= deps.graph/current-dependency-analysis-version
+                   (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform)))))))
+      (testing "transforms update"
+        (mt/with-premium-features #{}
+          (mt/with-temp [:model/Transform transform]
+            (is (zero? (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform))))
+            (mt/with-premium-features #{:dependencies}
+              (t2/update! :model/Transform (:id transform) {:source {:type "query" :query (mt/mbql-query products)}}))
+            (is (= deps.graph/current-dependency-analysis-version
+                   (t2/select-one-fn :dependency_analysis_version :model/Transform (:id transform)))))))
+      (testing "snippets create"
+        (mt/with-premium-features #{:dependencies}
+          (mt/with-temp [:model/NativeQuerySnippet snippet]
+            (is (= deps.graph/current-dependency-analysis-version
+                   (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet)))))))
+      (testing "snippets update"
+        (mt/with-premium-features #{}
+          (mt/with-temp [:model/NativeQuerySnippet snippet]
+            (is (zero? (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet))))
+            (mt/with-premium-features #{:dependencies}
+              (t2/update! :model/NativeQuerySnippet (:id snippet) {:content "new content"}))
+            (is (= deps.graph/current-dependency-analysis-version
+                   (t2/select-one-fn :dependency_analysis_version :model/NativeQuerySnippet (:id snippet))))))))))
 
 (deftest dependency-analysis-version-create-card-test
   (testing "dependency_analysis_version is updated when a card is created"
@@ -227,37 +228,38 @@
 
 (deftest filtered-graph-dependencies-test
   (testing "filtered-graph-dependencies respects filter clause"
-    (mt/with-temp [:model/User user {:email "me@wherever.com"}]
-      (mt/with-premium-features #{:dependencies}
-        (mt/with-model-cleanup [:model/Card :model/Dependency]
-          (let [{id1 :id :as card1} (card/create-card! (basic-orders) user)
-                {id2 :id :as card2} (card/create-card! (wrap-card card1) user)
-                {id3 :id :as _card3} (card/create-card! (wrap-card card2) user)]
-            (testing "without filter, returns all dependencies"
-              (let [graph (deps.graph/graph-dependencies)
-                    deps (graph/transitive graph [[:card id3]])]
-                (is (= #{[:card id2] [:card id1] [:table (mt/id :orders)]}
-                       (set deps)))))
-            (testing "with filter excluding card1, omits card1 and its dependencies"
-              (let [filter-fn (fn [entity-type-field entity-id-field]
-                                [:and
-                                 [:= entity-type-field "card"]
-                                 [:in entity-id-field [id2 id3]]])
-                    graph (deps.graph/filtered-graph-dependencies filter-fn)
-                    deps (graph/transitive graph [[:card id3]])]
-                (is (= #{[:card id2]}
-                       (set deps))
-                    "Should only include card2, not card1 or table")))
-            (testing "with filter excluding card2, breaks the chain"
-              (let [filter-fn (fn [entity-type-field entity-id-field]
-                                [:and
-                                 [:= entity-type-field "card"]
-                                 [:in entity-id-field [id1 id3]]])
-                    graph (deps.graph/filtered-graph-dependencies filter-fn)
-                    deps (graph/transitive graph [[:card id3]])]
-                (is (= #{}
-                       (set deps))
-                    "Should be empty, chain is broken at card2")))))))))
+    (mt/with-empty-h2-app-db!
+      (mt/with-temp [:model/User user {:email "me@wherever.com"}]
+        (mt/with-premium-features #{:dependencies}
+          (mt/with-model-cleanup [:model/Card :model/Dependency]
+            (let [{id1 :id :as card1} (card/create-card! (basic-orders) user)
+                  {id2 :id :as card2} (card/create-card! (wrap-card card1) user)
+                  {id3 :id :as _card3} (card/create-card! (wrap-card card2) user)]
+              (testing "without filter, returns all dependencies"
+                (let [graph (deps.graph/graph-dependencies)
+                      deps (graph/transitive graph [[:card id3]])]
+                  (is (= #{[:card id2] [:card id1] [:table (mt/id :orders)]}
+                         (set deps)))))
+              (testing "with filter excluding card1, omits card1 and its dependencies"
+                (let [filter-fn (fn [entity-type-field entity-id-field]
+                                  [:and
+                                   [:= entity-type-field "card"]
+                                   [:in entity-id-field [id2 id3]]])
+                      graph (deps.graph/filtered-graph-dependencies filter-fn)
+                      deps (graph/transitive graph [[:card id3]])]
+                  (is (= #{[:card id2]}
+                         (set deps))
+                      "Should only include card2, not card1 or table")))
+              (testing "with filter excluding card2, breaks the chain"
+                (let [filter-fn (fn [entity-type-field entity-id-field]
+                                  [:and
+                                   [:= entity-type-field "card"]
+                                   [:in entity-id-field [id1 id3]]])
+                      graph (deps.graph/filtered-graph-dependencies filter-fn)
+                      deps (graph/transitive graph [[:card id3]])]
+                  (is (= #{}
+                         (set deps))
+                      "Should be empty, chain is broken at card2"))))))))))
 
 (deftest filtered-graph-dependents-test
   (testing "filtered-graph-dependents respects filter clause"

enterprise/backend/test/metabase_enterprise/dependencies/native_validation_test.clj

@@ -8,6 +8,7 @@
    [metabase.lib.core :as lib]
    [metabase.lib.metadata :as lib.metadata]
    [metabase.lib.test-metadata :as meta]
+   [metabase.lib.test-util :as lib.tu]
    [metabase.util :as u]))
 
 (defn- fake-query
@@ -102,14 +103,18 @@
           (is (= #{(lib/syntax-error)} result)
               (str "Expected syntax-error or empty set, got: " result))))
       (testing "bad table wildcard"
-        ;; Normalize expected value using driver conventions (H2 uppercases, Postgres lowercases)
-        (is (= (normalize-error-names driver #{(lib/missing-table-alias-error "products")})
+        ;; missing-table-alias errors don't get source attribution — the alias itself is unresolved
+        (is (= (normalize-error-names driver
+                                      #{(lib/missing-table-alias-error "products")})
                (deps.native-validation/validate-native-query
                 driver
                 (fake-query mp "select products.* from orders")))))
       (testing "bad col reference"
         ;; Normalize expected value using driver conventions (H2 uppercases, Postgres lowercases)
-        (is (= (normalize-error-names driver #{(lib/missing-column-error "bad")})
+        (is (= (normalize-error-names driver
+                                      #{(merge (lib/missing-column-error "bad")
+                                               {:source-entity-type :table
+                                                :source-entity-id   (meta/id :products)})})
                (deps.native-validation/validate-native-query
                 driver
                 (fake-query mp "select bad from products"))))))))
@@ -131,15 +136,23 @@
       (testing "Valid query - selecting existing columns from subquery"
         (validates? mp driver 10 empty?))
       (testing "Invalid query - selecting non-existent column from subquery"
-        (validates? mp driver 11 #{(lib/missing-column-error "CATEGORY")})
-        (validates? mp driver 12 #{(lib/missing-column-error "CATEGORY")}))
+        (validates? mp driver 11 #{(merge (lib/missing-column-error "CATEGORY")
+                                          {:source-entity-type :table
+                                           :source-entity-id   (meta/id :people)})})
+        (validates? mp driver 12 #{(merge (lib/missing-column-error "CATEGORY")
+                                          {:source-entity-type :table
+                                           :source-entity-id   (meta/id :people)})}))
       (testing "Nested subqueries"
         (validates? mp driver 13 empty?)
-        (validates? mp driver 14 #{(lib/missing-column-error "CATEGORY")}))
+        (validates? mp driver 14 #{(merge (lib/missing-column-error "CATEGORY")
+                                          {:source-entity-type :table
+                                           :source-entity-id   (meta/id :people)})}))
       (testing "SELECT * from subquery expands to subquery columns"
         (validates? mp driver 15 empty?)
         (validates? mp driver 16 empty?)
-        (validates? mp driver 17 #{(lib/missing-column-error "EMAIL")})))))
+        (validates? mp driver 17 #{(merge (lib/missing-column-error "EMAIL")
+                                          {:source-entity-type :table
+                                           :source-entity-id   (meta/id :people)})})))))
 
 (deftest ^:parallel validate-card-reference-after-expansion-test
   (testing "Validation of queries after card references have been expanded"
@@ -149,17 +162,55 @@
         (validates? mp driver 18 empty?))
       (testing "Card reference expanded to subquery - invalid column"
         (validates? mp driver 19
-                    #{(lib/missing-column-error "DESCRIPTION")}))
+                    #{(merge (lib/missing-column-error "DESCRIPTION")
+                             {:source-entity-type :card
+                              :source-entity-id   1})}))
       (testing "Card reference with alias - valid column"
         (validates? mp driver 20 empty?))
       (testing "Card reference with alias - invalid column"
         (validates? mp driver 21
-                    #{(lib/missing-column-error "PASSWORD")}))
+                    #{(merge (lib/missing-column-error "PASSWORD")
+                             {:source-entity-type :card
+                              :source-entity-id   1})}))
       (testing "Wildcard selection from card reference"
         (validates? mp driver 22 empty?))
       (testing "Invalid column from aliased card"
         (validates? mp driver 23
-                    #{(lib/missing-column-error "LATITUDE")})))))
+                    #{(merge (lib/missing-column-error "LATITUDE")
+                             {:source-entity-type :card
+                              :source-entity-id   1})})))))
+
+(deftest ^:parallel validate-card-reference-multi-card-test
+  (testing "Source attribution with multiple card references"
+    (let [mp (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (testing "Multi-card query, unqualified - source is unknown"
+        (validates? mp driver 24
+                    #{(lib/missing-column-error "BAD")}))
+      (testing "Multi-card query, qualified - source attributed to specific card"
+        (validates? mp driver 25
+                    #{(merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :card
+                              :source-entity-id   1})})))))
+
+(deftest ^:parallel validate-card-reference-mixed-table-card-test
+  (testing "Source attribution with mixed table and card references"
+    (let [mp (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (testing "Mixed table+card, unqualified - source is unknown"
+        (validates? mp driver 26
+                    #{(lib/missing-column-error "BAD")}))
+      (testing "Mixed table+card, qualified to table - source attributed to table"
+        (validates? mp driver 27
+                    #{(merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :table
+                              :source-entity-id   (meta/id :products)})}))
+      (testing "Mixed table+card, missing column + unknown alias"
+        (validates? mp driver 28
+                    #{(merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :table
+                              :source-entity-id   (meta/id :products)})
+                      (lib/missing-table-alias-error "xix")})))))
 
 (defn- check-result-metadata [driver mp query expected]
   (is (=? (normalize-result-metadata expected)
@@ -264,3 +315,204 @@
          driver mp
          "this is not a query"
          [])))))
+
+(deftest ^:parallel validate-native-query-source-attribution-test
+  (testing "errors include source entity info for table-only queries"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (testing "single table query - error attributed to that table"
+        (is (= (normalize-error-names driver
+                                      #{{:type               :missing-column
+                                         :name               "bad"
+                                         :source-entity-type :table
+                                         :source-entity-id   (meta/id :products)}})
+               (deps.native-validation/validate-native-query
+                driver
+                (fake-query mp "select bad from products")))))
+      (testing "multi-table query, unqualified - source is unknown"
+        (is (= (normalize-error-names driver
+                                      #{{:type               :missing-column
+                                         :name               "bad"}})
+               (deps.native-validation/validate-native-query
+                driver
+                (fake-query mp "select bad from products join orders on products.id = orders.product_id")))))
+      (testing "multi-table query, qualified - source attributed to specific table"
+        (is (= (normalize-error-names driver
+                                      #{{:type               :missing-column
+                                         :name               "bad"
+                                         :source-entity-type :table
+                                         :source-entity-id   (meta/id :products)}})
+               (deps.native-validation/validate-native-query
+                driver
+                (fake-query mp "select products.bad from products join orders on products.id = orders.product_id")))))
+      (testing "multi-table query, qualified with alias - source attributed to specific table"
+        (is (= (normalize-error-names driver
+                                      #{{:type               :missing-column
+                                         :name               "bad"
+                                         :source-entity-type :table
+                                         :source-entity-id   (meta/id :products)}})
+               (deps.native-validation/validate-native-query
+                driver
+                (fake-query mp "select p.bad from products p join orders o on p.id = o.product_id")))))
+      (testing "no errors - returns empty set"
+        (is (= #{}
+               (deps.native-validation/validate-native-query
+                driver
+                (fake-query mp "select * from products"))))))))
+
+(deftest ^:parallel fallback-single-table-cte-test
+  (testing "CTE with single table - fallback attributes missing column to that table"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (is (= (normalize-error-names driver
+                                    #{{:type               :missing-column
+                                       :name               "bad"
+                                       :source-entity-type :table
+                                       :source-entity-id   (meta/id :products)}})
+             (deps.native-validation/validate-native-query
+              driver
+              (fake-query mp "WITH cte AS (SELECT id, title FROM products) SELECT bad FROM cte")))))))
+
+(deftest ^:parallel fallback-multi-table-cte-test
+  (testing "CTE with multiple tables - fallback produces unknown source"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (is (= (normalize-error-names driver
+                                    #{{:type               :missing-column
+                                       :name               "bad"}})
+             (deps.native-validation/validate-native-query
+              driver
+              (fake-query mp "WITH cte AS (SELECT p.id, o.total FROM products p JOIN orders o ON p.id = o.product_id) SELECT bad FROM cte")))))))
+
+(deftest ^:parallel fallback-zero-tables-test
+  (testing "CTE with no real table references - error has no source attribution"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (is (= (normalize-error-names driver
+                                    #{{:type :missing-column
+                                       :name "bad"}})
+             (deps.native-validation/validate-native-query
+              driver
+              (fake-query mp "WITH cte AS (SELECT 1 AS id) SELECT bad FROM cte")))))))
+
+(deftest ^:parallel card-source-attribution-test
+  (testing "errors are attributed to the correct card"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (testing "mixed table+card, qualified to card - attributed to card"
+        (validates? mp driver 29
+                    #{(merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :card
+                              :source-entity-id   1})}))
+      (testing "multi-card, qualified to second card - attributed to card 2"
+        (validates? mp driver 30
+                    #{(merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :card
+                              :source-entity-id   2})})))))
+
+(deftest ^:parallel transitive-card-chain-test
+  (testing "Transitive card chain: c32 -> c31 -> c1, where c31's result-metadata lost CATEGORY"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (is (nil? (some #{"CATEGORY"} (map :name (:result-metadata (lib.metadata/card mp 31)))))
+          "Card 31 should not have CATEGORY in its result-metadata")
+      (validates? mp driver 32
+                  #{(merge (lib/missing-column-error "CATEGORY")
+                           {:source-entity-type :card
+                            :source-entity-id   31})}))))
+
+(deftest ^:parallel cross-reference-mbql-and-native-cards-test
+  (testing "Native query referencing an MBQL card"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))]
+      (testing "error attributed to MBQL card"
+        (validates? mp driver 34
+                    #{(merge (lib/missing-column-error "CATEGORY")
+                             {:source-entity-type :card
+                              :source-entity-id   33})}))
+      (testing "mixed MBQL + native card refs - errors attributed to correct cards"
+        (validates? mp driver 36
+                    #{(merge (lib/missing-column-error "CATEGORY")
+                             {:source-entity-type :card
+                              :source-entity-id   33})
+                      (merge (lib/missing-column-error "BAD")
+                             {:source-entity-type :card
+                              :source-entity-id   35})})))))
+
+(deftest ^:parallel card-with-special-char-column-test
+  (testing "Card reference where card has special characters in column names"
+    (let [base-mp (deps.tu/mock-metadata-provider {:snippets []})
+          driver  (:engine (lib.metadata/database base-mp))
+          card    (deps.tu/mock-card base-mp
+                                     {:id      100
+                                      :query   "SELECT 1"
+                                      :details {:result-metadata [{:name "FIRST NAME" :base-type :type/Text}
+                                                                  {:name "ORDER-ID"   :base-type :type/Integer}
+                                                                  {:name "NORMAL"     :base-type :type/Text}]}})
+          mp      (deps.tu/mock-metadata-provider {:cards [card] :snippets []})
+          mkquery (fn [sql]
+                    (let [ttags (lib/extract-template-tags mp sql)]
+                      (fake-query mp sql ttags)))]
+      (testing "valid column produces no errors"
+        (is (= #{}
+               (deps.native-validation/validate-native-query
+                driver
+                (mkquery "SELECT NORMAL FROM {{#100}}")))))
+      (testing "invalid column produces error attributed to card"
+        (is (= (normalize-error-names driver
+                                      #{(merge (lib/missing-column-error "BAD")
+                                               {:source-entity-type :card
+                                                :source-entity-id   100})})
+               (deps.native-validation/validate-native-query
+                driver
+                (mkquery "SELECT BAD FROM {{#100}}"))))))))
+
+(deftest ^:parallel placeholder-collision-test
+  (testing "When SQL contains the placeholder prefix as a real table, validation runs without source attribution"
+    (let [mp     (deps.tu/default-metadata-provider)
+          driver (:engine (lib.metadata/database mp))
+          ttags  (lib/extract-template-tags mp "SELECT BAD FROM {{#1}}")
+          query  (fake-query mp
+                             "SELECT BAD FROM mb__validat_card__99 JOIN {{#1}}"
+                             ttags)]
+      (is (= (normalize-error-names driver
+                                    #{(lib/missing-column-error "BAD")})
+             (deps.native-validation/validate-native-query driver query))))))
+
+(deftest ^:parallel placeholder-no-card-refs-test
+  (testing "Queries with tables named as placeholder produce expected validation results"
+    (let [mp     (lib.tu/mock-metadata-provider
+                  {:database {:id 100 :engine :h2}
+                   :tables   [{:name   "MB__VALIDAT_CARD__10330"
+                               :schema "PUBLIC"
+                               :id     333
+                               :db-id  1}]
+                   :fields   [{:table-id  333
+                               :name      "ID"
+                               :base-type :type/Integer}]})
+          driver (:engine (lib.metadata/database mp))]
+      (testing "Selection of column present in placeholder named table returns no error"
+        (let [query  (fake-query mp
+                                 "SELECT ID FROM MB__VALIDAT_CARD__10330")]
+          (is (= #{}
+                 (deps.native-validation/validate-native-query driver query)))))
+      (testing "Selection of column missing from placeholder named table returns an error with source"
+        (let [query  (fake-query mp
+                                 "SELECT BAD FROM MB__VALIDAT_CARD__10330")]
+          (is (= (normalize-error-names driver
+                                        #{(merge (lib/missing-column-error "BAD")
+                                                 {:source-entity-type :table
+                                                  :source-entity-id 333})})
+                 (deps.native-validation/validate-native-query driver query))))))))
+
+(deftest ^:parallel select-from-non-existent-card-test
+  (let [mp     (deps.tu/default-metadata-provider)
+        driver (:engine (lib.metadata/database mp))]
+    (testing "Select from non-existent card produces an error"
+      (let [query  (fake-query mp
+                               "SELECT ID FROM {{#1234-missing-card}}")]
+        (is (= (normalize-error-names driver
+                                      #{(merge (lib/missing-column-error "ID")
+                                               {:source-entity-type :card
+                                                :source-entity-id 1234})})
+               (deps.native-validation/validate-native-query driver query)))))))