strata-cli 0.1.17 → 0.1.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0eed3ab022a70f7362fef36cecee35c47cb9a8e3f86845d2cbc6ed58e4212f16
-  data.tar.gz: d14df20e4a614d79640a874868d1d819a477cf21bd67ba9f4be8fbe64576db83
+  metadata.gz: e13d7f619d5b03f2c0ab353c8064fe5f1c17e97d8a3bc63d0d32abb11da628de
+  data.tar.gz: '095c483ea8913658de1d52dbe33bd71491b04b88f91f6e5c957417760bd1db1b'
 SHA512:
-  metadata.gz: 290d7b617d7bfb883d1e268d06447aeaa975015293c2b68e062132393d5dc8f8d1e1d846045c292dfd2956737cd744523ab21544d5a739dc232f93cec1d28027
-  data.tar.gz: 3e20c5dc5ce59f4757ad028c5ab89fe15403b56b386afc6c34b46af8ea53f4d28a99f8cb7786a3d7e23ea518bc848206d29bda461589cebb8b88bcb5eb3102a1
+  metadata.gz: 1444ff06c0d6ad24303c6fec60c925fda1fffa17513cb2c8c8e7a2071af0f070181c882d58f832e1fca088c6601168140b0557a20106a0e23513da47173a0302
+  data.tar.gz: e952da251f4c0562fcc1f26be54f84245e046ed3041374e5efb17faf4b293a903db3c573142ff43c6efd290306252f2ad37cfce27ec27f0a824b6f6485379bc6

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 ## [Unreleased]
 
+## [0.1.18] - 2026-09-26
+
+### Changed
+
+- **security.yml no longer scaffolded by init**: servers on the free license reject deploys that include `security.yml`, so `strata init` no longer creates it. `strata create policy` creates the file from the template the first time a policy is added.
+- **AGENTS.md**: notes that security policies need a Team or Enterprise license and points agents at `strata create policy`.
+
+### Fixed
+
+- **License error guidance on deploy**: when the server rejects a deploy because row-level security is not on the current license, `strata deploy` now explains how to resolve it: delete `security.yml` and redeploy, or email sales@strata.do to upgrade.
+- **Datasource prompts for sqlite and redshift**: `strata datasource add` previously wrote an empty, invalid config for these adapters because they had no prompt definitions. A parity test now covers every adapter the dwh gem registers.
+- **AGENTS.md snapshot key**: the template said `snapshot_date:` but the deployer reads `snapshot:`, so tables written from it deployed without a snapshot date.
+- **README**: documents browser sign-in, `strata project sample`, and which commands accept `--api-key`.
+
 ## [0.1.17] - 2026-09-09
 
 ### Added

data/README.md

@@ -77,6 +77,20 @@ Link local project to an existing project on the Strata server.
 strata project link 12345
 ```
 
+### `strata project sample`
+
+Clone the Strata TPC-DS sample project and set it up interactively. Prompts for the server URL and signs you in via browser (see [Authentication](#authentication)), then writes `.strata` and sets the project ID so you can deploy immediately.
+
+**Options:**
+- `-a, --api-key KEY` - API key (optional — skips browser sign-in when paired with `--server`)
+- `-s, --server URL` - Server URL (optional — prompted if omitted)
+
+**Examples:**
+```bash
+strata project sample
+cd tpc-ds-retail-sample && strata deploy
+```
+
 </details>
 
 <details>
@@ -350,6 +364,15 @@ ai_api_key: your-ai-key
 
 **Security:** The `.strata` file automatically has restrictive permissions (0600) for security.
 
+### Authentication
+
+You don't need to create an API key manually. When no key is configured, `strata deploy` (and `strata project sample`) asks how you'd like to authenticate:
+
+- **Sign in via browser (recommended)** — the CLI opens your server's sign-in page in the browser and fetches an API key automatically once you sign in (5-minute timeout).
+- **Paste an API key** — get one from your Strata server dashboard (**Settings → API Keys**) or your Strata administrator.
+
+Either way the key is saved to `.strata` for future runs. In CI or other non-interactive environments there are no prompts — write the API key into `.strata` before running `strata deploy --yes`.
+
 ### Datasources Configuration (`datasources.yml`)
 
 Defines all datasource connections:
@@ -429,7 +452,7 @@ Use service principal credentials and run `strata ds auth my_databricks` to save
 ## Security
 
 - ✅ Credentials stored in `.strata` with restrictive permissions (0600)
-- ✅ API keys never accepted via command line arguments
+- ✅ API keys never required on the command line — browser sign-in or the `.strata` file supplies them (optional `--api-key` flags exist on `init --source` and `project sample` for scripting)
 - ✅ File paths validated to prevent path traversal attacks
 - ✅ Git commit hashes validated before use
 - ✅ YAML files loaded safely to prevent code execution
@@ -453,7 +476,7 @@ server: https://your-strata-server.com
 
 ### "API key not found"
 
-Run `strata deploy` and enter your API key when prompted, or manually add to `.strata`:
+Run `strata deploy` and choose **Sign in via browser** when prompted — the CLI fetches and saves a key automatically. Alternatively paste a key at the prompt, or manually add it to `.strata`:
 
 ```yaml
 api_key: your-api-key

data/lib/strata/cli/generators/policy.rb

@@ -8,16 +8,16 @@ module Strata
     module Generators
       # Appends a new policy entry to the project's security.yml.
       # Receives a fully-resolved attrs hash from the Create subcommand.
+      #
+      # security.yml is not scaffolded by `strata init` because servers on the
+      # free license reject deploys that include it. It is created from the
+      # template here, the first time a policy is added.
       class Policy < Group
         argument :attrs, type: :hash
 
         def append_policy_to_security_yml
           security_file = "security.yml"
-
-          unless File.exist?(security_file)
-            raise Strata::CommandError,
-              "security.yml not found in the current directory. Run 'strata init' first."
-          end
+          copy_file "security.yml", security_file unless File.exist?(security_file)
 
           content = File.read(security_file)
           new_entry = format_policy_yaml(attrs)

data/lib/strata/cli/generators/project.rb

@@ -102,12 +102,6 @@ module Strata
           end
         end
 
-        def create_security_file
-          return if cloned_from_git?
-
-          copy_file "security.yml", "#{uid}/security.yml"
-        end
-
         def initialize_git
           return if cloned_from_git?
 

data/lib/strata/cli/generators/templates/AGENTS.md

@@ -33,7 +33,7 @@ These are non-negotiable. Violations break deploy, query planning, or production
 3. **Measures on unrelated detail facts must have distinct names** — e.g. `Store Gross Sales`, `Catalog Gross Sales`, not one `Gross Sales` on three channel facts. See [Naming conventions](#naming-conventions).
 4. **Dimensions may share names** when the business role is the same; Strata picks among tables at query time. **Measures do not combine that way** — duplicate measure names implies varying levels of aggregation of the same basic fact. The correct table and measure combination will be determined by context (i.e. what dimensions are present in the same query.)
 5. **Cross-fact totals use compound measures or blending** — not the same measure name on multiple facts. See [Combined metrics across facts](#combined-metrics-across-facts).
-6. Security policies can be implemented in the security.yml file.  Use the guidelines documented therin.
+6. Security policies (Team/Enterprise license) live in security.yml. Run `strata create policy` to scaffold the file with documented guidelines; do not add it on a free-license server, its deploys reject it.
 7. Strata supports role playing or aliasing of dimension tables.  For example, user wants date_dim table to also be used when query "Order Return Date". In that case, we simply point to the same physical_name "date_dim" but set the table name to "Order Return Date". If the user asks to alias an dimension table from an existing model we can simply copy the existing model, change the table name, and prefix all the dimensions in it with the appropriate prefix representing the role.
 
 ## Unsupported or impossible requirements
@@ -72,7 +72,7 @@ Use plain language, for example:
 | “Combine metrics by reusing the same name” | Not how Strata merges facts | Compound measure or blending on shared dimensions |
 | Cross-datasource compound measure | Same datasource required | Model per datasource or separate metrics |
 | Datasource swap migration | Not supported | Rename datasource; human migration plan |
-| Snapshot-style metric on a flow fact without `snapshot_date` | Wrong measure type | Normal additive measure, or proper snapshot table setup |
+| Snapshot-style metric on a flow fact without a table-level `snapshot` | Wrong measure type | Normal additive measure, or proper snapshot table setup |
 | Requirement needs engine feature you cannot verify | Risk of invalid model | Stop; cite docs or ask human — do not guess |
 
 When `strata audit all --agent` reports errors you cannot resolve within Strata’s rules, **stop and report the errors to the user** — do not keep patching YAML until the model drifts further from a valid design.
@@ -322,14 +322,14 @@ If referenced measures are not joinable in **one universe** from that host table
 
 **Requirements:**
 
-1. Table sets `snapshot_date: <Date dimension name>` (dimension on same table or unambiguous in the table’s universe).
+1. Table sets `snapshot: <Date dimension name>` (dimension on same table or unambiguous in the table’s universe).
 2. Measure sets `snapshot: ending` (value at end of period) or `snapshot: beginning` (value at start).
 
 ```yaml
 name: Inventory
 physical_name: inventory
 datasource: warehouse
-snapshot_date: Date
+snapshot: Date
 
 fields:
   - type: dimension

data/lib/strata/cli/sub_commands/datasource.rb

@@ -385,6 +385,17 @@ module Strata
               "database" => "test_db",
               "username" => "default"
             }
+          when "sqlite"
+            {
+              "file" => "./data/warehouse.db"
+            }
+          when "redshift"
+            {
+              "host" => "mycluster.abc123.us-east-1.redshift.amazonaws.com",
+              "port" => 5439,
+              "database" => "dev",
+              "username" => "awsuser"
+            }
           else
             {}
           end

data/lib/strata/cli/utils/deployment_monitor.rb

@@ -37,6 +37,9 @@ module Strata
           finished
         ].freeze
         TESTING_STAGE = :running_tests
+        SECURITY_LICENSE_ERROR = /row-level security is not available on your current license/i
+        SECURITY_LICENSE_HINT = "Row-level security requires a Team or Enterprise license. " \
+          "Delete security.yml from the project and redeploy, or email sales@strata.do to upgrade your license."
 
         # Initialize a new DeploymentMonitor
         #
@@ -350,6 +353,12 @@ module Strata
           error_messages.split("\n").each do |line|
             say "   #{line}", :error
           end
+          say "\n   #{SECURITY_LICENSE_HINT}", :warning if security_license_error?(error_messages)
+        end
+
+        # The server rejects security.yml when the license lacks row-level security.
+        def security_license_error?(error_messages)
+          error_messages.to_s.match?(SECURITY_LICENSE_ERROR)
         end
 
         def display_test_results(test_results, skip_opening_divider: false)

data/lib/strata/cli/version.rb

@@ -2,6 +2,6 @@
 
 module Strata
   module CLI
-    VERSION = "0.1.17"
+    VERSION = "0.1.18"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: strata-cli
 version: !ruby/object:Gem::Version
-  version: 0.1.17
+  version: 0.1.18
 platform: ruby
 authors:
 - Ajo Abraham
@@ -344,7 +344,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.6.7
 specification_version: 4
 summary: Command-line interface for the Strata Semantic Analytics System
 test_files: []