
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@bonnard/cli
Advanced tools
The Bonnard CLI (`bon`) takes you from zero to a deployed semantic layer in minutes. Define metrics in YAML, validate locally, deploy, and query — from your terminal or AI coding agent.
The Bonnard CLI (bon) takes you from zero to a deployed semantic layer in minutes. Define metrics in YAML, validate locally, deploy, and query — from your terminal or AI coding agent.
Open source — view source on GitHub
npx @bonnard/cli init # Create project structure + agent templates
bon datasource add --demo # Add demo dataset (no warehouse needed)
bon validate # Check syntax
bon login # Authenticate with Bonnard
bon deploy -m "Initial deploy" # Deploy to Bonnard
No install needed — npx runs the CLI directly. Or install globally for shorter commands:
npm install -g @bonnard/cli
Requires Node.js 20+.
| Command | Description |
|---|---|
bon init | Create project structure and AI agent templates |
bon login | Authenticate with Bonnard |
bon logout | Remove stored credentials |
bon whoami | Show current login status |
bon datasource add | Add a data source (interactive) |
bon datasource add --demo | Add read-only demo dataset |
bon datasource add --from-dbt | Import from dbt profiles |
bon datasource list | List configured data sources |
bon datasource remove <name> | Remove a data source |
bon validate | Validate cube and view YAML |
bon deploy -m "message" | Deploy to Bonnard |
bon deployments | List deployment history |
bon diff <id> | View changes in a deployment |
bon annotate <id> | Add context to deployment changes |
bon query '{"measures":["orders.count"]}' | Query the semantic layer (JSON) |
bon query "SELECT ..." --sql | Query the semantic layer (SQL) |
bon mcp | MCP setup instructions for AI agents |
bon mcp test | Test MCP server connectivity |
bon docs [topic] | Browse modeling documentation |
bon docs --search "joins" | Search documentation |
bon init generates context files for your AI coding tools:
.claude/rules/ + get-started skill.cursor/rules/ with auto-apply frontmatterAGENTS.md + skills folderYour agent understands Bonnard's modeling language from the first prompt.
After bon init:
my-project/
├── bon.yaml # Project configuration
├── bonnard/
│ ├── cubes/ # Cube definitions (measures, dimensions, joins)
│ └── views/ # View definitions (curated query interfaces)
└── .bon/ # Local config (gitignored)
└── datasources.yaml # Data source credentials
bon deploy --ci -m "CI deploy"
Non-interactive mode for pipelines. Datasources are synced automatically.
FAQs
<source media="(prefers-color-scheme: dark)" srcset="./assets/banner-dark.png" /> <source media="(prefers-color-scheme: light)" srcset="./assets/banner-light.png" /> <
The npm package @bonnard/cli receives a total of 25 weekly downloads. As such, @bonnard/cli popularity was classified as not popular.
We found that @bonnard/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.