chore: upgrade to cube v1.6.75 and fix High/Critical CVEs

.cursor/rules/docs-example-data-model.mdc

@@ -0,0 +1,69 @@
+---
+description: Canonical data model to use as the basis for all documentation examples
+globs: docs-mintlify/**
+alwaysApply: false
+---
+
+# Canonical Example Data Model
+
+All documentation examples and recipes must use the [ecommerce demo data model](https://github.com/cubedevinc/ecommerce_demo) as their basis unless the topic genuinely requires a different domain.
+
+## Cubes
+
+### `order_items` (fact, `ECOMMERCE.ORDER_ITEMS`)
+The primary fact table. Use this as the starting point for most examples.
+
+Key fields:
+- `id` — primary key
+- `order_id`, `user_id`, `product_id`, `inventory_item_id` — foreign keys
+- `status` (string) — `complete`, `processing`, `shipped`, `cancelled`, `returned`
+- `sale_price` (number) — revenue per line item; measure `total_sale_price` (sum, currency)
+- `created_at`, `shipped_at`, `delivered_at`, `returned_at` (time)
+- `is_delivered` (boolean)
+- measures: `count`, `order_count` (count_distinct on order_id), `total_sale_price`
+
+### `orders` (`ECOMMERCE.ORDERS`)
+Order-level table. Use when examples are about order status or counts.
+
+Key fields:
+- `order_id` — primary key
+- `user_id`, `status`, `gender`, `num_of_item`
+- `created_at`, `delivered_at`, `shipped_at` (time)
+- measures: `count`
+
+### `products` (`ECOMMERCE.PRODUCTS`)
+Product catalog. Use when examples need brand, category, or product dimensions.
+
+Key fields:
+- `id` — primary key
+- `brand`, `category`, `department`, `name`, `sku`
+- `cost`, `retail_price` (number)
+- measures: `count`
+
+### `users` (`ECOMMERCE.USERS`)
+Customer table. Use when examples need demographic or geographic dimensions.
+
+Key fields:
+- `id` — primary key
+- `first_name`, `last_name`, `full_name`, `email`
+- `age`, `gender`
+- `city`, `state`, `country`
+- `traffic_source`
+- `created_at` (time)
+- measures: `count`
+
+## Common example patterns
+
+**Revenue over time** → `order_items.total_sale_price` + `order_items.created_at`
+
+**Orders by status** → `order_items.count` + `order_items.status`
+
+**Revenue by brand/category** → `order_items.total_sale_price` joined to `products.brand` / `products.category`
+
+**User demographics** → `users.count` + `users.city` / `users.country` / `users.traffic_source`
+
+**Multi-cube join** → `order_items` joins `orders`, `products`, `users` via foreign keys defined in the repo
+
+## Reference
+
+Full model: https://github.com/cubedevinc/ecommerce_demo

.cursor/rules/mintlify-mdx-gotchas.mdc

@@ -0,0 +1,110 @@
+---
+description: Mintlify MDX parsing gotchas — patterns that look correct but render broken
+globs: docs-mintlify/**
+alwaysApply: true
+---
+
+# Mintlify MDX gotchas
+
+Mintlify uses MDX (Markdown + JSX). A handful of patterns parse cleanly in
+plain Markdown but render broken once wrapped in JSX components like
+`<Step>`. Use these rules when authoring or editing pages in
+`docs-mintlify/`.
+
+## `<Step>` must start with prose, not a fenced code block
+
+When a fenced code block is the **first child** of a `<Step>` component,
+Mintlify's MDX parser collapses the entire block onto one line, exposing
+the literal triple backticks. Every `<Step>` body must begin with at least
+one line of prose (a single sentence is enough).
+
+❌ Renders broken — fence is the first child:
+
+````mdx
+<Step title="Attach the bucket permissions">
+  ```json
+  {
+    "Version": "2012-10-17",
+    ...
+  }
+  ```
+</Step>
+````
+
+✅ Add a one-line lead-in:
+
+````mdx
+<Step title="Attach the bucket permissions">
+  Allow the role to read, write, and list objects in your bucket:
+
+  ```json
+  {
+    "Version": "2012-10-17",
+    ...
+  }
+  ```
+</Step>
+````
+
+The intro line also reads better — it tells the user what the snippet does
+before they hit it. Apply the same rule to any code block (`json`, `bash`,
+`dotenv`, `yaml`, `sql`, …) that would otherwise be the first child of a
+`<Step>`.
+
+This rule applies anywhere a fenced code block sits at the top of a JSX
+component body. `<Step>` is the most common offender; `<Tab>` and `<Card>`
+behave the same way.
+
+## Angle-bracket placeholders must be backticked in prose
+
+`<tenant-name>`, `<aws-account-id>`, `<deployment-id>`, etc. are useful
+placeholders inside fenced code blocks (they're plain text there) but in
+prose they have to be wrapped in backticks. Otherwise MDX tries to parse
+them as JSX components and either errors out or silently swallows them.
+
+❌ MDX tries to parse `<tenant-name>` as a component:
+
+```mdx
+The issuer URL is https://<tenant-name>.cubecloud.dev.
+```
+
+✅ Backticked:
+
+```mdx
+The issuer URL is `https://<tenant-name>.cubecloud.dev`.
+```
+
+Inside fenced ```` ``` ```` blocks (and Mermaid diagrams that don't pass
+through the JSX parser) the bare form is fine.
+
+## Mermaid participant labels can't carry angle-bracket placeholders
+
+Mermaid renders `<br/>` inside participant labels as a line break, but it
+doesn't tolerate other `<…>` tags — they break the diagram. Use a plain
+description ("your tenant URL") instead of `<tenant-name>.cubecloud.dev`
+in `participant` labels.
+
+## Bash heredoc / assignment with `<placeholder>` breaks copy-paste
+
+`PROJECT_NUMBER=<project-number>` looks fine in a doc, but bash interprets
+`<` as input redirection — pasting the line errors out. Quote it:
+
+```bash
+PROJECT_NUMBER="<project-number>"
+DEPLOYMENT_ID="<deployment-id>"
+```
+
+Quotes preserve the placeholder visually and let the user `sed`-replace
+without the line failing first.
+
+## Don't use a body H1
+
+Mintlify renders the frontmatter `title` as the page H1. Adding `# Heading`
+in the body produces two H1s and breaks the doc outline. Use `## Heading`
+for the first body section.
+
+## Verifying
+
+`mintlify dev --no-open` boots a local preview and surfaces compile errors
+on startup. `mintlify broken-links` flags dead internal anchors. Run both
+before publishing a non-trivial doc change.

.cursor/rules/static-assets.mdc

@@ -0,0 +1,135 @@
+---
+description: How to upload and reference static images/assets for Mintlify docs
+globs: docs-mintlify/**
+alwaysApply: false
+---
+
+# Static assets for the Mintlify docs
+
+## Where assets live
+
+- **Editorial assets** (provider logos, UI screenshots, architecture diagrams,
+  recipe images, etc.) → S3 bucket `cube-dev-websites-shared`, served via CDN
+  at `https://static.cube.dev/<key>`. **Never** commit these binaries to the
+  repo.
+- **Site chrome** that ships with Mintlify itself (the favicon and the logos
+  in `docs-mintlify/logo/`) stays in the repo. Don't add new files there.
+
+If you're not sure: anything you'd reference from an `.mdx` page → S3.
+
+## Uploading editorial assets
+
+Use the script in `docs-mintlify/scripts/` (no AWS console clicks needed).
+Run it from the `docs-mintlify/` directory:
+
+```bash
+./scripts/upload-asset.sh <local-file> <dest-key>
+```
+
+Examples:
+
+```bash
+./scripts/upload-asset.sh ./snowflake.svg     icons/snowflake.svg
+./scripts/upload-asset.sh ./architecture.png  docs/getting-started/architecture.png
+./scripts/upload-asset.sh ./flow.svg          diagrams/pre-aggregations-flow.svg
+```
+
+The script prints (and copies to clipboard on macOS) the final
+`https://static.cube.dev/<key>` URL. Paste that URL into the relevant
+`.mdx` file.
+
+Full docs: `docs-mintlify/scripts/README.md`.
+
+## First-time AWS setup
+
+The upload script needs the AWS CLI and credentials for the
+`cube-dev-websites-shared` bucket. If `./scripts/upload-asset.sh` fails with
+`command not found: aws` or an AWS auth error, run through these steps once.
+
+If the user hasn't configured AWS yet, walk them through this — don't try to
+guess credentials or upload without a working profile.
+
+1. **Install the AWS CLI**
+
+   ```bash
+   brew install awscli         # macOS
+   # or: pipx install awscli    # cross-platform
+   ```
+
+2. **Get credentials**
+
+   You need an IAM user / SSO role with `s3:PutObject` and `s3:HeadObject`
+   on `cube-dev-websites-shared`. Ask whoever manages Cube's AWS account
+   (post in the internal infra/ops channel) — don't reuse personal keys.
+
+3. **Configure a local profile**
+
+   The script picks up the `cube-static` profile by default. Use that name
+   to avoid having to set `AWS_PROFILE` every time:
+
+   ```bash
+   aws configure --profile cube-static
+   # AWS Access Key ID:     <your key>
+   # AWS Secret Access Key: <your secret>
+   # Default region name:   us-west-2
+   # Default output format: json
+   ```
+
+   If you must use a different profile name, prefix every invocation:
+
+   ```bash
+   AWS_PROFILE=my-profile ./scripts/upload-asset.sh ./logo.svg icons/foo.svg
+   ```
+
+4. **Verify access** before your first real upload:
+
+   ```bash
+   aws sts get-caller-identity --profile cube-static
+   aws s3 ls s3://cube-dev-websites-shared/icons/ --profile cube-static | head
+   ```
+
+   Both commands should succeed. If `ls` returns an `AccessDenied` error,
+   credentials are wrong or lack S3 permissions — fix that before uploading.
+
+Never commit AWS keys to the repo or paste them into chat. They live only in
+`~/.aws/credentials` (or your SSO config).
+
+## Path conventions
+
+| Prefix                            | Use for                                            |
+| --------------------------------- | -------------------------------------------------- |
+| `icons/<slug>.svg`                | Provider / integration / vendor logos for `<Card>` |
+| `icons/<slug>-light.svg`          | Logo, light variant (use on dark backgrounds)      |
+| `icons/<slug>-dark.svg`           | Logo, dark variant (use on light backgrounds)      |
+| `docs/<section>/<slug>/<file>`    | Screenshots & images for a specific docs page      |
+| `diagrams/<slug>.svg`             | Architecture / flow diagrams                       |
+| `recipes/<slug>/<file>`           | Recipe-specific screenshots                        |
+
+Use kebab-case slugs. Match the existing `icons/<slug>.svg` pattern already
+referenced from pages like `admin/connect-to-data/visualization-tools/index.mdx`
+and `admin/deployment/providers/index.mdx` — don't invent a new top-level
+prefix when one of the above fits.
+
+For provider logos, prefer SVG. For UI screenshots, prefer PNG (or WebP for
+larger images). Compress before uploading — the bucket is cached aggressively.
+
+## Immutability rule
+
+Asset URLs are **immutable by convention** — files are served with
+`Cache-Control: public, max-age=31536000, immutable`. The upload script
+refuses to overwrite existing keys.
+
+When an asset needs to change:
+
+1. Upload a new key with a version suffix (e.g. `snowflake-v2.svg`).
+2. Update the `.mdx` reference in the same PR.
+
+Never use `--force` on an asset that is already live.
+
+## Don't
+
+- Don't commit screenshots, provider logos, or diagrams into `docs-mintlify/`
+  itself — they bloat the repo and Mintlify build, and can't be reused.
+- Don't reference Contentful (`ucarecdn.com`, `images.ctfassets.net`) URLs in
+  new docs content. Mirror to `static.cube.dev` first.
+- Don't reuse the same key for a different image. Bump the version suffix.

.cursor/rules/writing-documentation.mdc

@@ -0,0 +1,9 @@
+---
+alwaysApply: true
+globs: docs-mintlify/**
+---
+
+This repo only contains code for Cube Core and documentation.
+Our cloud product codebase is located in ~/code/cubejs-enterprise (at least that is where it is located on Artyom's mac). Research the cloud product codebase when documenting new features.
+Our documenation is built with https://www.mintlify.com. Make sure you follow Mintlify best practices when designing documentation.
+Our competitors are [Omni](https://omni.co/) and [Hex](https://hex.tech/). We use their documentation sometimes as a reference.