strata-cli 0.1.17 → 0.1.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0eed3ab022a70f7362fef36cecee35c47cb9a8e3f86845d2cbc6ed58e4212f16
-  data.tar.gz: d14df20e4a614d79640a874868d1d819a477cf21bd67ba9f4be8fbe64576db83
+  metadata.gz: 7cdf350ee694b8dfcac291d7aeb7f13cc3f0cec82535f56e61fe9408ffbcc6f7
+  data.tar.gz: eb05515761938400bbad1961110569d46db0a9f6e118b3b091bdcf42c62f0b34
 SHA512:
-  metadata.gz: 290d7b617d7bfb883d1e268d06447aeaa975015293c2b68e062132393d5dc8f8d1e1d846045c292dfd2956737cd744523ab21544d5a739dc232f93cec1d28027
-  data.tar.gz: 3e20c5dc5ce59f4757ad028c5ab89fe15403b56b386afc6c34b46af8ea53f4d28a99f8cb7786a3d7e23ea518bc848206d29bda461589cebb8b88bcb5eb3102a1
+  metadata.gz: a9300ece338d7b455ddf1db63658e95820a96dea1807493e0cfbcbb7931d19d9d5ddef6b5953c16cf083bc28416099a64f3cf5b5263c68b44b5981a018c83487
+  data.tar.gz: f5c4575f2ab7415300e22794efedada1cf43bd77da69d9a4d04dd9abb84ac87da109b0b28f911ed2e6e74ad06532ee6b57eed1c1b2dd7693d9da14abbe38147b

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 ## [Unreleased]
 
+## [0.1.19] - 2026-09-30
+
+### Added
+
+- **BigQuery datasource**: `strata datasource add bigquery` prompts for `project_id` and `dataset`; `strata ds auth` stores a service account `keyfile` path (Application Default Credentials when left blank). Requires dwh 0.6.0.
+
+## [0.1.18] - 2026-09-26
+
+### Changed
+
+- **security.yml no longer scaffolded by init**: servers on the free license reject deploys that include `security.yml`, so `strata init` no longer creates it. `strata create policy` creates the file from the template the first time a policy is added.
+- **AGENTS.md**: notes that security policies need a Team or Enterprise license and points agents at `strata create policy`.
+
+### Fixed
+
+- **License error guidance on deploy**: when the server rejects a deploy because row-level security is not on the current license, `strata deploy` now explains how to resolve it: delete `security.yml` and redeploy, or email sales@strata.do to upgrade.
+- **Datasource prompts for sqlite and redshift**: `strata datasource add` previously wrote an empty, invalid config for these adapters because they had no prompt definitions. A parity test now covers every adapter the dwh gem registers.
+- **AGENTS.md snapshot key**: the template said `snapshot_date:` but the deployer reads `snapshot:`, so tables written from it deployed without a snapshot date.
+- **README**: documents browser sign-in, `strata project sample`, and which commands accept `--api-key`.
+
 ## [0.1.17] - 2026-09-09
 
 ### Added

data/README.md

@@ -77,6 +77,20 @@ Link local project to an existing project on the Strata server.
 strata project link 12345
 ```
 
+### `strata project sample`
+
+Clone the Strata TPC-DS sample project and set it up interactively. Prompts for the server URL and signs you in via browser (see [Authentication](#authentication)), then writes `.strata` and sets the project ID so you can deploy immediately.
+
+**Options:**
+- `-a, --api-key KEY` - API key (optional — skips browser sign-in when paired with `--server`)
+- `-s, --server URL` - Server URL (optional — prompted if omitted)
+
+**Examples:**
+```bash
+strata project sample
+cd tpc-ds-retail-sample && strata deploy
+```
+
 </details>
 
 <details>
@@ -350,6 +364,15 @@ ai_api_key: your-ai-key
 
 **Security:** The `.strata` file automatically has restrictive permissions (0600) for security.
 
+### Authentication
+
+You don't need to create an API key manually. When no key is configured, `strata deploy` (and `strata project sample`) asks how you'd like to authenticate:
+
+- **Sign in via browser (recommended)** — the CLI opens your server's sign-in page in the browser and fetches an API key automatically once you sign in (5-minute timeout).
+- **Paste an API key** — get one from your Strata server dashboard (**Settings → API Keys**) or your Strata administrator.
+
+Either way the key is saved to `.strata` for future runs. In CI or other non-interactive environments there are no prompts — write the API key into `.strata` before running `strata deploy --yes`.
+
 ### Datasources Configuration (`datasources.yml`)
 
 Defines all datasource connections:
@@ -411,6 +434,15 @@ my_databricks:
 
 Use service principal credentials and run `strata ds auth my_databricks` to save `oauth_client_id` and `oauth_client_secret` in `.strata`.
 
+```yaml
+my_bigquery:
+  adapter: bigquery
+  project_id: my-gcp-project
+  dataset: analytics
+```
+
+Run `strata ds auth my_bigquery` to save a service account `keyfile` path in `.strata`, or leave it blank to use `gcloud auth application-default login`.
+
 ## Supported Data Warehouse Adapters
 
 - **PostgreSQL** - Full support
@@ -425,11 +457,12 @@ Use service principal credentials and run `strata ds auth my_databricks` to save
 - **Databricks** - Databricks SQL warehouse support
 - **ClickHouse** - ClickHouse HTTP/native SQL support
 - **SQLite** - SQLite database support
+- **BigQuery** - Google BigQuery support (service account keyfile or Application Default Credentials)
 
 ## Security
 
 - ✅ Credentials stored in `.strata` with restrictive permissions (0600)
-- ✅ API keys never accepted via command line arguments
+- ✅ API keys never required on the command line — browser sign-in or the `.strata` file supplies them (optional `--api-key` flags exist on `init --source` and `project sample` for scripting)
 - ✅ File paths validated to prevent path traversal attacks
 - ✅ Git commit hashes validated before use
 - ✅ YAML files loaded safely to prevent code execution
@@ -453,7 +486,7 @@ server: https://your-strata-server.com
 
 ### "API key not found"
 
-Run `strata deploy` and enter your API key when prompted, or manually add to `.strata`:
+Run `strata deploy` and choose **Sign in via browser** when prompted — the CLI fetches and saves a key automatically. Alternatively paste a key at the prompt, or manually add it to `.strata`:
 
 ```yaml
 api_key: your-api-key

data/lib/strata/cli/credentials.rb

@@ -50,6 +50,8 @@ module Strata
           credentials["oauth_client_secret"] = @prompt.ask("OAuth Client Secret:")
         when "clickhouse"
           credentials["password"] = @prompt.mask("Enter Password (leave blank if none):")
+        when "bigquery"
+          credentials["keyfile"] = @prompt.ask("Service account keyfile path (leave blank for Application Default Credentials):")
         else
           if required?
             unless %w[postgres mysql trino sqlserver].include?(adapter)

data/lib/strata/cli/descriptions/datasource/add.txt

@@ -18,4 +18,4 @@ Examples:
 
   strata datasource add snowflake        # Directly add Snowflake datasource
 
-Supported adapters: postgres, mysql, sqlserver, snowflake, athena, trino, duckdb, druid, clickhouse, databricks, redshift, sqlite
+Supported adapters: postgres, mysql, sqlserver, snowflake, athena, trino, duckdb, druid, clickhouse, databricks, redshift, sqlite, bigquery

data/lib/strata/cli/generators/policy.rb

@@ -8,16 +8,16 @@ module Strata
     module Generators
       # Appends a new policy entry to the project's security.yml.
       # Receives a fully-resolved attrs hash from the Create subcommand.
+      #
+      # security.yml is not scaffolded by `strata init` because servers on the
+      # free license reject deploys that include it. It is created from the
+      # template here, the first time a policy is added.
       class Policy < Group
         argument :attrs, type: :hash
 
         def append_policy_to_security_yml
           security_file = "security.yml"
-
-          unless File.exist?(security_file)
-            raise Strata::CommandError,
-              "security.yml not found in the current directory. Run 'strata init' first."
-          end
+          copy_file "security.yml", security_file unless File.exist?(security_file)
 
           content = File.read(security_file)
           new_entry = format_policy_yaml(attrs)

data/lib/strata/cli/generators/project.rb

@@ -102,12 +102,6 @@ module Strata
           end
         end
 
-        def create_security_file
-          return if cloned_from_git?
-
-          copy_file "security.yml", "#{uid}/security.yml"
-        end
-
         def initialize_git
           return if cloned_from_git?
 

data/lib/strata/cli/generators/templates/AGENTS.md

@@ -33,7 +33,7 @@ These are non-negotiable. Violations break deploy, query planning, or production
 3. **Measures on unrelated detail facts must have distinct names** — e.g. `Store Gross Sales`, `Catalog Gross Sales`, not one `Gross Sales` on three channel facts. See [Naming conventions](#naming-conventions).
 4. **Dimensions may share names** when the business role is the same; Strata picks among tables at query time. **Measures do not combine that way** — duplicate measure names implies varying levels of aggregation of the same basic fact. The correct table and measure combination will be determined by context (i.e. what dimensions are present in the same query.)
 5. **Cross-fact totals use compound measures or blending** — not the same measure name on multiple facts. See [Combined metrics across facts](#combined-metrics-across-facts).
-6. Security policies can be implemented in the security.yml file.  Use the guidelines documented therin.
+6. Security policies (Team/Enterprise license) live in security.yml. Run `strata create policy` to scaffold the file with documented guidelines; do not add it on a free-license server, its deploys reject it.
 7. Strata supports role playing or aliasing of dimension tables.  For example, user wants date_dim table to also be used when query "Order Return Date". In that case, we simply point to the same physical_name "date_dim" but set the table name to "Order Return Date". If the user asks to alias an dimension table from an existing model we can simply copy the existing model, change the table name, and prefix all the dimensions in it with the appropriate prefix representing the role.
 
 ## Unsupported or impossible requirements
@@ -72,7 +72,7 @@ Use plain language, for example:
 | “Combine metrics by reusing the same name” | Not how Strata merges facts | Compound measure or blending on shared dimensions |
 | Cross-datasource compound measure | Same datasource required | Model per datasource or separate metrics |
 | Datasource swap migration | Not supported | Rename datasource; human migration plan |
-| Snapshot-style metric on a flow fact without `snapshot_date` | Wrong measure type | Normal additive measure, or proper snapshot table setup |
+| Snapshot-style metric on a flow fact without a table-level `snapshot` | Wrong measure type | Normal additive measure, or proper snapshot table setup |
 | Requirement needs engine feature you cannot verify | Risk of invalid model | Stop; cite docs or ask human — do not guess |
 
 When `strata audit all --agent` reports errors you cannot resolve within Strata’s rules, **stop and report the errors to the user** — do not keep patching YAML until the model drifts further from a valid design.
@@ -322,14 +322,14 @@ If referenced measures are not joinable in **one universe** from that host table
 
 **Requirements:**
 
-1. Table sets `snapshot_date: <Date dimension name>` (dimension on same table or unambiguous in the table’s universe).
+1. Table sets `snapshot: <Date dimension name>` (dimension on same table or unambiguous in the table’s universe).
 2. Measure sets `snapshot: ending` (value at end of period) or `snapshot: beginning` (value at start).
 
 ```yaml
 name: Inventory
 physical_name: inventory
 datasource: warehouse
-snapshot_date: Date
+snapshot: Date
 
 fields:
   - type: dimension

data/lib/strata/cli/helpers/datasource_helper.rb

@@ -13,7 +13,8 @@ module Strata
         athena: %w[aws-sdk-athena aws-sdk-s3 rexml],
         trino: %w[trino-client],
         sqlite: %w[sqlite3],
-        duckdb: %w[duckdb]
+        duckdb: %w[duckdb],
+        bigquery: %w[google-cloud-bigquery]
       }.freeze
 
       def resolve_datasource(ds_key_arg = nil)
@@ -197,6 +198,8 @@ module Strata
           "Notes:\n- AWS SDK gems are pure Ruby; no system libraries required."
         when :trino
           "Notes:\n- 'trino-client' is pure Ruby; no system libraries required."
+        when :bigquery
+          "Notes:\n- 'google-cloud-bigquery' is pure Ruby; no system libraries required.\n- Authenticate with a service account keyfile or `gcloud auth application-default login`."
         when :duckdb
           "Notes:\n- See https://github.com/suketa/ruby-duckdb"
         else

data/lib/strata/cli/sub_commands/datasource.rb

@@ -114,6 +114,9 @@ module Strata
             if adapter == "databricks"
               say "  Databricks uses OAuth M2M with service principal credentials (client ID + client secret).", :cyan
             end
+            if adapter == "bigquery"
+              say "  BigQuery uses a service account JSON keyfile, or gcloud Application Default Credentials if left blank.", :cyan
+            end
             say ""
             creds.collect
             creds.write_local(ds_key, self)
@@ -161,6 +164,9 @@ module Strata
           if adapter == "databricks"
             say "  Databricks uses OAuth M2M with service principal credentials (client ID + client secret).", :cyan
           end
+          if adapter == "bigquery"
+            say "  BigQuery uses a service account JSON keyfile, or gcloud Application Default Credentials if left blank.", :cyan
+          end
           say ""
           creds.collect
           creds.write_local(ds_key, self)
@@ -385,6 +391,22 @@ module Strata
               "database" => "test_db",
               "username" => "default"
             }
+          when "sqlite"
+            {
+              "file" => "./data/warehouse.db"
+            }
+          when "redshift"
+            {
+              "host" => "mycluster.abc123.us-east-1.redshift.amazonaws.com",
+              "port" => 5439,
+              "database" => "dev",
+              "username" => "awsuser"
+            }
+          when "bigquery"
+            {
+              "project_id" => "my-gcp-project",
+              "dataset" => "analytics"
+            }
           else
             {}
           end
@@ -393,6 +415,7 @@ module Strata
         def humanize_field(field)
           {
             "account_identifier" => "Account identifier",
+            "project_id" => "Project ID",
             "s3_output_location" => "S3 output location",
             "auth_mode" => "Auth mode"
           }.fetch(field, field.split("_").map(&:capitalize).join(" "))

data/lib/strata/cli/utils/deployment_monitor.rb

@@ -37,6 +37,9 @@ module Strata
           finished
         ].freeze
         TESTING_STAGE = :running_tests
+        SECURITY_LICENSE_ERROR = /row-level security is not available on your current license/i
+        SECURITY_LICENSE_HINT = "Row-level security requires a Team or Enterprise license. " \
+          "Delete security.yml from the project and redeploy, or email sales@strata.do to upgrade your license."
 
         # Initialize a new DeploymentMonitor
         #
@@ -350,6 +353,12 @@ module Strata
           error_messages.split("\n").each do |line|
             say "   #{line}", :error
           end
+          say "\n   #{SECURITY_LICENSE_HINT}", :warning if security_license_error?(error_messages)
+        end
+
+        # The server rejects security.yml when the license lacks row-level security.
+        def security_license_error?(error_messages)
+          error_messages.to_s.match?(SECURITY_LICENSE_ERROR)
         end
 
         def display_test_results(test_results, skip_opening_divider: false)

data/lib/strata/cli/version.rb

@@ -2,6 +2,6 @@
 
 module Strata
   module CLI
-    VERSION = "0.1.17"
+    VERSION = "0.1.19"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: strata-cli
 version: !ruby/object:Gem::Version
-  version: 0.1.17
+  version: 0.1.19
 platform: ruby
 authors:
 - Ajo Abraham
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: aws-sdk-athena
   requirement: !ruby/object:Gem::Requirement
@@ -224,7 +224,7 @@ description: |
   Comprehensive CLI tool for managing Strata Semantic Analytics projects. Create and initialize
   projects, manage datasource connections, build semantic table models with AI assistance, run
   audits and validations, and deploy projects to Strata servers. Supports multiple data warehouse
-  adapters including PostgreSQL, MySQL, SQL Server, Snowflake, Athena, Trino, ClickHouse, and more.
+  adapters including PostgreSQL, MySQL, SQL Server, Snowflake, BigQuery, Athena, Trino, ClickHouse, and more.
 email:
 - ajo@strata.site
 - allen@strata.site
@@ -344,7 +344,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.6.7
 specification_version: 4
 summary: Command-line interface for the Strata Semantic Analytics System
 test_files: []