chore: sync upstream superset-sh/superset @ cb3268fdf

.env.example

@@ -110,6 +110,24 @@ ANTHROPIC_API_KEY=
 # -----------------------------------------------------------------------------
 BLOB_READ_WRITE_TOKEN=
 
+# -----------------------------------------------------------------------------
+# Cloudflare storage + user content origin (pages, thumbnails, chat attachments)
+# -----------------------------------------------------------------------------
+CLOUDFLARE_ACCOUNT_ID=
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+# Pages and files; read through the usercontent Worker (apps/usercontent) with a ticket.
+R2_PRIVATE_BUCKET=
+# Where pages are served from, one subdomain per page under it (apps/usercontent):
+# https://frame.supersetusercontent.com
+USERCONTENT_URL=
+# App-referenced files (apps/usercontent, same Worker): https://media.supersetusercontent.com
+MEDIA_URL=
+# Shared with the usercontent Worker (wrangler secret); 32+ characters.
+USERCONTENT_TOKEN_SECRET=
+# Optional: page thumbnails are skipped while unset.
+CLOUDFLARE_BROWSER_RENDERING_TOKEN=
+
 # -----------------------------------------------------------------------------
 # PostHog Analytics
 # -----------------------------------------------------------------------------
@@ -130,6 +148,24 @@ NEXT_PUBLIC_SENTRY_DSN_DOCS=
 NEXT_PUBLIC_SENTRY_DSN_API=
 SENTRY_DSN_DESKTOP=
 
+# Sentry public integration — powers Sentry automation triggers (issue created,
+# resolved, assigned, ...). Optional: leave blank and the Sentry trigger simply
+# reports "Requires connection" in the editor; nothing else breaks.
+#
+# These come from a Sentry *public integration* (Settings -> Developer Settings
+# -> Public Integration), not from the DSN/auth-token above, which are for error
+# reporting. A Sentry app allows exactly one Redirect URL, so a local checkout
+# needs its own app rather than sharing the deployed one:
+#   Redirect URL: http://localhost:<API_PORT>/api/integrations/sentry/callback
+#   Webhook URL:  http://localhost:<API_PORT>/api/integrations/sentry/webhook
+# Permissions: Project, Issue & Event, Organization, Member = Read.
+# The client secret is shown once, at creation — save it then.
+# Sentry cannot reach localhost, so webhooks (and therefore live triggers) need
+# a tunnel; the install flow and the project picker work without one.
+SENTRY_APP_SLUG=
+SENTRY_CLIENT_ID=
+SENTRY_CLIENT_SECRET=
+
 # -----------------------------------------------------------------------------
 # Resend (Email)
 # -----------------------------------------------------------------------------

.env.local.example

@@ -95,6 +95,24 @@ ANTHROPIC_API_KEY=sk-ant-fake-local-dev
 # -----------------------------------------------------------------------------
 BLOB_READ_WRITE_TOKEN=vercel_blob_rw_fake_local_dev
 
+# -----------------------------------------------------------------------------
+# Cloudflare storage + user content origin (fake for local dev; publishing a
+# page needs real R2 credentials and `bun run --cwd apps/usercontent dev`)
+# -----------------------------------------------------------------------------
+CLOUDFLARE_ACCOUNT_ID=fake-cloudflare-account-id
+R2_ACCESS_KEY_ID=fake-r2-access-key-id
+R2_SECRET_ACCESS_KEY=fake-r2-secret-access-key
+R2_PRIVATE_BUCKET=superset-private-dev
+# Setup's port allocator writes USERCONTENT_DEV_PORT (base+14) and this URL
+# into the shared .env; 8787 is the bare fallback used without setup.
+USERCONTENT_URL=http://frame.usercontent.localhost:8787
+MEDIA_URL=http://media.usercontent.localhost:8787
+USERCONTENT_TOKEN_SECRET=local-dev-usercontent-secret-change-me-32
+# Deliberately empty: unset means page thumbnails are skipped, which is the
+# right local behavior. A fake value would make every publish enqueue a
+# doomed capture job.
+CLOUDFLARE_BROWSER_RENDERING_TOKEN=
+
 # -----------------------------------------------------------------------------
 # PostHog Analytics (disabled in local dev)
 # -----------------------------------------------------------------------------
@@ -115,6 +133,24 @@ NEXT_PUBLIC_SENTRY_DSN_DOCS=
 NEXT_PUBLIC_SENTRY_DSN_API=
 SENTRY_DSN_DESKTOP=
 
+# Sentry public integration — powers Sentry automation triggers (issue created,
+# resolved, assigned, ...). Optional: leave blank and the Sentry trigger simply
+# reports "Requires connection" in the editor; nothing else breaks.
+#
+# These come from a Sentry *public integration* (Settings -> Developer Settings
+# -> Public Integration), not from the DSN/auth-token above, which are for error
+# reporting. A Sentry app allows exactly one Redirect URL, so a local checkout
+# needs its own app rather than sharing the deployed one:
+#   Redirect URL: http://localhost:<API_PORT>/api/integrations/sentry/callback
+#   Webhook URL:  http://localhost:<API_PORT>/api/integrations/sentry/webhook
+# Permissions: Project, Issue & Event, Organization, Member = Read.
+# The client secret is shown once, at creation — save it then.
+# Sentry cannot reach localhost, so webhooks (and therefore live triggers) need
+# a tunnel; the install flow and the project picker work without one.
+SENTRY_APP_SLUG=
+SENTRY_CLIENT_ID=
+SENTRY_CLIENT_SECRET=
+
 # -----------------------------------------------------------------------------
 # Resend (Email — fake for local dev)
 # -----------------------------------------------------------------------------

.github/prompts/update-roadmap.md

@@ -33,9 +33,14 @@ The Notion database "Product Roadmap" (data source `collection://7cbe2be9-46f2-4
 Regenerate the `ROADMAP_ITEMS` array in `apps/marketing/src/app/roadmap/data.ts`:
 
 - `id`: kebab-case slug of the public title (stable across runs — reuse existing ids where the item is unchanged).
-- `title` = `Public title`, `description` = `Public description`, `category` = `Public category`, `status` = mapped lane.
+- `title` and `description` are Lingui message descriptors, not plain strings. Write them as
+  `msg({ id: "marketing.roadmap.item.<camelCaseSlug>.title", message: "Public title" })` and
+  `msg({ id: "marketing.roadmap.item.<camelCaseSlug>.description", message: "Public description" })`,
+  where `<camelCaseSlug>` is the item's `id` in camelCase. Message IDs are permanent: when an item's
+  copy changes, edit the `message` and keep the existing ID. Only a genuinely new item gets a new ID.
+- `category` = `Public category`, `status` = mapped lane. Both stay raw union values, not descriptors.
 - Order within each lane: keep the existing file's order for unchanged items; append new items at the end of their lane.
-- Do not change the types, `CATEGORIES`, `STATUS_LABELS`, or `STATUS_DESCRIPTIONS` unless a `Public category` value doesn't exist in the union — in that case flag it in the PR description instead of editing types.
+- Do not change the types, `CATEGORIES`, `CATEGORY_LABELS`, `STATUS_LABELS`, or `STATUS_DESCRIPTIONS` unless a `Public category` value doesn't exist in the union — in that case flag it in the PR description instead of editing types.
 
 ## Ship it
 

.github/workflows/ci.yml

@@ -93,6 +93,11 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          # The i18n audit compares this branch against its merge base to catch
+          # translations left behind by an English edit; a shallow clone has no
+          # merge base to find.
+          fetch-depth: 0
 
       - name: Setup Bun
         id: setup-bun
@@ -115,6 +120,8 @@ jobs:
       # Message catalogs must match source (extract) and compile with no
       # missing translations (--strict); a dirty diff means someone forgot
       # to run `bun run --cwd packages/i18n check` after changing strings.
+      # The audit also fails on translations left stranded by an English edit,
+      # which --strict cannot see because nothing is missing.
       - name: Audit i18n catalogs
         run: bun run --cwd packages/i18n check
 

.github/workflows/deploy-preview.yml

@@ -128,6 +128,14 @@ jobs:
           DATABASE_URL: ${{ env.DATABASE_URL }}
           DATABASE_URL_UNPOOLED: ${{ env.DATABASE_URL_UNPOOLED }}
           BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          R2_PRIVATE_BUCKET: superset-private-dev
+          USERCONTENT_URL: ${{ vars.USERCONTENT_URL_DEV }}
+          MEDIA_URL: ${{ vars.MEDIA_URL_DEV }}
+          USERCONTENT_TOKEN_SECRET: ${{ secrets.USERCONTENT_TOKEN_SECRET_DEV }}
+          CLOUDFLARE_BROWSER_RENDERING_TOKEN: ${{ secrets.CLOUDFLARE_BROWSER_RENDERING_TOKEN }}
           NEXT_PUBLIC_API_URL: https://${{ env.API_ALIAS }}
           NEXT_PUBLIC_WEB_URL: https://${{ env.WEB_ALIAS }}
           NEXT_PUBLIC_MARKETING_URL: https://${{ env.MARKETING_ALIAS }}
@@ -185,6 +193,14 @@ jobs:
             --env DATABASE_URL=$DATABASE_URL \
             --env DATABASE_URL_UNPOOLED=$DATABASE_URL_UNPOOLED \
             --env BLOB_READ_WRITE_TOKEN=$BLOB_READ_WRITE_TOKEN \
+            --env CLOUDFLARE_ACCOUNT_ID=$CLOUDFLARE_ACCOUNT_ID \
+            --env R2_ACCESS_KEY_ID=$R2_ACCESS_KEY_ID \
+            --env R2_SECRET_ACCESS_KEY=$R2_SECRET_ACCESS_KEY \
+            --env R2_PRIVATE_BUCKET=$R2_PRIVATE_BUCKET \
+            --env USERCONTENT_URL=$USERCONTENT_URL \
+            --env MEDIA_URL=$MEDIA_URL \
+            --env USERCONTENT_TOKEN_SECRET=$USERCONTENT_TOKEN_SECRET \
+            --env CLOUDFLARE_BROWSER_RENDERING_TOKEN=$CLOUDFLARE_BROWSER_RENDERING_TOKEN \
             --env NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
             --env NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL \
             --env NEXT_PUBLIC_MARKETING_URL=$NEXT_PUBLIC_MARKETING_URL \
@@ -307,6 +323,8 @@ jobs:
           NEXT_PUBLIC_ADMIN_URL: https://${{ env.ADMIN_ALIAS }}
           NEXT_PUBLIC_DOCS_URL: https://${{ env.DOCS_ALIAS }}
           NEXT_PUBLIC_RELAY_URL: ${{ secrets.RELAY_URL }}
+          USERCONTENT_URL: ${{ vars.USERCONTENT_URL_DEV }}
+          MEDIA_URL: ${{ vars.MEDIA_URL_DEV }}
           BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
           NEXT_PUBLIC_COOKIE_DOMAIN: ${{ secrets.NEXT_PUBLIC_COOKIE_DOMAIN }}
           NEXT_PUBLIC_POSTHOG_KEY: ${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
@@ -340,6 +358,8 @@ jobs:
             --env NEXT_PUBLIC_ADMIN_URL=$NEXT_PUBLIC_ADMIN_URL \
             --env NEXT_PUBLIC_DOCS_URL=$NEXT_PUBLIC_DOCS_URL \
             --env NEXT_PUBLIC_RELAY_URL=$NEXT_PUBLIC_RELAY_URL \
+            --env USERCONTENT_URL=$USERCONTENT_URL \
+            --env MEDIA_URL=$MEDIA_URL \
             --env NEXT_PUBLIC_COOKIE_DOMAIN=$NEXT_PUBLIC_COOKIE_DOMAIN \
             --env NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY \
             --env NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST \
@@ -360,6 +380,10 @@ jobs:
           vercel alias $VERCEL_URL ${{ env.WEB_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN
           echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT
 
+      - name: Smoke test web routes
+        run: |
+          bun scripts/smoke-routes.ts "https://${{ env.WEB_ALIAS }}" /
+
       - name: Save web success status
         run: |
           cat > web-status.env << EOF
@@ -475,6 +499,17 @@ jobs:
           vercel alias $VERCEL_URL ${{ env.MARKETING_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN
           echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT
 
+      # Until now the pipeline deployed and never requested a page, so a build
+      # that returned 500 on every route still went green. MARKETING-67/68/69
+      # reached production that way.
+      - name: Smoke test marketing routes
+        run: |
+          bun scripts/smoke-routes.ts "https://${{ env.MARKETING_ALIAS }}" --localized \
+            / /pricing /enterprise /download /join-us /community /contact \
+            /blog /changelog /compare /roadmap /leaderboard /marketplace \
+            /agent-orchestration /parallel-coding-agents /factory-2026 \
+            /mcp-install /stats /team /starchart /the-production-run
+
       - name: Save marketing success status
         run: |
           cat > marketing-status.env << EOF
@@ -594,6 +629,10 @@ jobs:
           vercel alias $VERCEL_URL ${{ env.ADMIN_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN
           echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT
 
+      - name: Smoke test admin routes
+        run: |
+          bun scripts/smoke-routes.ts "https://${{ env.ADMIN_ALIAS }}" /
+
       - name: Save admin success status
         run: |
           cat > admin-status.env << EOF
@@ -678,6 +717,10 @@ jobs:
           vercel alias $VERCEL_URL ${{ env.DOCS_ALIAS }} --scope=$VERCEL_ORG_ID --token=$VERCEL_TOKEN
           echo "vercel_url=$VERCEL_URL" >> $GITHUB_OUTPUT
 
+      - name: Smoke test docs routes
+        run: |
+          bun scripts/smoke-routes.ts "https://${{ env.DOCS_ALIAS }}" /
+
       - name: Save docs success status
         run: |
           cat > docs-status.env << EOF

.github/workflows/deploy-production.yml

@@ -85,6 +85,14 @@ jobs:
           NEXT_PUBLIC_COOKIE_DOMAIN: ${{ secrets.NEXT_PUBLIC_COOKIE_DOMAIN }}
           BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
           BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          R2_PRIVATE_BUCKET: ${{ vars.R2_PRIVATE_BUCKET }}
+          USERCONTENT_URL: ${{ vars.USERCONTENT_URL }}
+          MEDIA_URL: ${{ vars.MEDIA_URL }}
+          USERCONTENT_TOKEN_SECRET: ${{ secrets.USERCONTENT_TOKEN_SECRET }}
+          CLOUDFLARE_BROWSER_RENDERING_TOKEN: ${{ secrets.CLOUDFLARE_BROWSER_RENDERING_TOKEN }}
           GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
           GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
           GOOGLE_PUBSUB_TOPIC: ${{ secrets.GOOGLE_PUBSUB_TOPIC }}
@@ -148,6 +156,14 @@ jobs:
             --env DATABASE_URL=$DATABASE_URL \
             --env DATABASE_URL_UNPOOLED=$DATABASE_URL_UNPOOLED \
             --env BLOB_READ_WRITE_TOKEN=$BLOB_READ_WRITE_TOKEN \
+            --env CLOUDFLARE_ACCOUNT_ID=$CLOUDFLARE_ACCOUNT_ID \
+            --env R2_ACCESS_KEY_ID=$R2_ACCESS_KEY_ID \
+            --env R2_SECRET_ACCESS_KEY=$R2_SECRET_ACCESS_KEY \
+            --env R2_PRIVATE_BUCKET=$R2_PRIVATE_BUCKET \
+            --env USERCONTENT_URL=$USERCONTENT_URL \
+            --env MEDIA_URL=$MEDIA_URL \
+            --env USERCONTENT_TOKEN_SECRET=$USERCONTENT_TOKEN_SECRET \
+            --env CLOUDFLARE_BROWSER_RENDERING_TOKEN=$CLOUDFLARE_BROWSER_RENDERING_TOKEN \
             --env NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
             --env NEXT_PUBLIC_WEB_URL=$NEXT_PUBLIC_WEB_URL \
             --env NEXT_PUBLIC_MARKETING_URL=$NEXT_PUBLIC_MARKETING_URL \
@@ -252,6 +268,8 @@ jobs:
           NEXT_PUBLIC_ADMIN_URL: ${{ secrets.NEXT_PUBLIC_ADMIN_URL }}
           NEXT_PUBLIC_DOCS_URL: ${{ secrets.NEXT_PUBLIC_DOCS_URL }}
           NEXT_PUBLIC_RELAY_URL: ${{ secrets.RELAY_URL }}
+          USERCONTENT_URL: ${{ vars.USERCONTENT_URL }}
+          MEDIA_URL: ${{ vars.MEDIA_URL }}
           BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
           NEXT_PUBLIC_COOKIE_DOMAIN: ${{ secrets.NEXT_PUBLIC_COOKIE_DOMAIN }}
           NEXT_PUBLIC_POSTHOG_KEY: ${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
@@ -285,6 +303,8 @@ jobs:
             --env NEXT_PUBLIC_ADMIN_URL=$NEXT_PUBLIC_ADMIN_URL \
             --env NEXT_PUBLIC_DOCS_URL=$NEXT_PUBLIC_DOCS_URL \
             --env NEXT_PUBLIC_RELAY_URL=$NEXT_PUBLIC_RELAY_URL \
+            --env USERCONTENT_URL=$USERCONTENT_URL \
+            --env MEDIA_URL=$MEDIA_URL \
             --env NEXT_PUBLIC_COOKIE_DOMAIN=$NEXT_PUBLIC_COOKIE_DOMAIN \
             --env NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY \
             --env NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST \
@@ -517,6 +537,37 @@ jobs:
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: bunx wrangler deploy
 
+  deploy-content:
+    name: Deploy Usercontent Worker to Cloudflare
+    runs-on: ubuntu-latest
+    environment: production
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Bun
+        id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Cache dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ steps.setup-bun.outputs.bun-revision }}-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen --ignore-scripts
+
+      - name: Deploy Worker
+        working-directory: apps/usercontent
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: bunx wrangler deploy
+
   deploy-docs:
     name: Deploy Docs to Vercel
     runs-on: ubuntu-latest