v0.11.0

Added

• tx query checks the tables, columns and measures a DAX query names before sending it. A
  typo fails at once with TOMIX_QUERY_UNKNOWN_REFERENCE and the closest name
  (Did you mean 'Amount'?), or the table's columns or the model's tables when nothing is
  close, instead of a server error. Names the query defines itself are understood;
  --no-validate skips the check (#240).
• tx query --cold reports TOMIX_QUERY_COLD_UNAVAILABLE when it cannot clear the cache, and
  --trace reports TOMIX_QUERY_TRACE_UNAVAILABLE when it cannot capture server timings, so
  the JSON output says so too, not only a stderr line.

Changed

• Edits and undo in a live session (tx shell, tx serve, tx mcp, tx ui) are faster on
  large models: the session copies the model for the next undo step in the background after
  each edit instead of during it. On a model with 1,000 measures an edit drops from about
  100 ms to about 50 ms and undo from about 55 ms to about 30 ms (#423).
• The undo history of a live session is capped by model size as well as by count, so a large
  model keeps fewer than 50 steps and the session's memory stays near 250 MB (#423).
• Text output uses color more sparingly. Labels in key-value blocks (auth status, doctor,
  diff, connect, validate, vertipaq, …) are plain instead of bold, with the values lined
  up in one column. Progress lines and notices such as "Authenticating..." and where
  credentials were saved are dim. Placeholders in --help (<path>, [options]) are dim too
  (#440).
• With stdin piped ($secret | tx auth login --password -), a command's progress label prints
  once, dim, on stderr instead of as plain text on stdout (#440).

Fixed

• tx query and tx test work with read access only (the Viewer role with Build permission).
  They used to fail with Database not found, because the server lists only the models a
  caller can write to. Commands that read the model's metadata now fail with TOMIX_METADATA_ACCESS_DENIED
  instead, naming the write access they need. The docs no longer say --trace and --cold
  need admin rights: write access (workspace Admin, Member or Contributor) is enough.

• A wrong model name on a Power BI workspace fails with TOMIX_DATABASE_NOT_FOUND instead of
  TOMIX_CONNECT_FAILED and a raw (404) Not Found.

• tx validate checks each row-level security filter on its own table permission
  (Roles/<role>/<table>). It used to parse a role's filters joined as Table: <filter> lines,
  so a role with more than one filter could fail with Unexpected ':' after the end of the expression (DAX0007). Renaming a column or table now rewrites the RLS filters that use
  it instead of only warning, and BPA rules see filters that span several lines whole.

• tx validate, tx deps and rename fixup also cover calculation group no-selection and
  multiple-or-empty-selection expressions and calculation item format string expressions.

• tx bpa run checks rules scoped to TablePermission, which it used to skip: the dynamic RLS
  rule (full ruleset) now reports roles that filter on USERPRINCIPALNAME() or USERNAME(),
  and DAX_COLUMNS_FULLY_QUALIFIED checks RLS filters, with --fix qualifying their column
  references. A permission is reported as <role>/<table>.

• Reference tracking (deps, validate, rename and remove guards, BPA) now reads DAX with the
  same lexer as tx format and dax check, so a date literal (dt"2024-01-01") or a query
  parameter (@Risk) is no longer taken for a table named dt or Risk (#204).

• The tx deploy preview no longer reports a calculated column as modified when its source
  has no dataType (as Power BI Desktop writes it) and the deployed model holds the type the
  engine inferred, for example datetime, calculated to unknown, calculated.

• A modified object in tx diff and the tx deploy preview now prints as
  ~ CalculatedColumn Calculations/Date: DataType, so the changed property no longer reads as
  part of the object's name (Calculations/Date Detail). A column's type change is labelled
  DataType in text output; JSON keeps Detail.

• -s/--server and tx connect now reach an on-premises Analysis Services server as typed
  (ssas01.contoso.com, 10.0.0.5, ssas01:2383, ssas01.contoso.com\TABULAR, or a full
  MSOLAP connection string) with your Windows identity, instead of prefixing it with
  powerbi://api.powerbi.com/v1.0/myorg/ and sending the deploy to Power BI. deploy warns
  (TOMIX_DEPLOY_AMBIGUOUS_SERVER) when a dotted two-part name such as Sales.Prod could also
  be a workspace name.

What's Changed

• fix(validate): check each RLS filter on its table permission by @bgarcevic in #448
• chore(release): prepare 0.11.0 by @github-actions[bot] in #447

Full Changelog: v0.10.0...v0.11.0