@datarails-ai/dr-cli 1.6.113 → 1.6.115

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.113",
+  "cliVersion": "1.6.115",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1923,6 +1923,66 @@
         "until": "DR-53511"
       }
     },
+    "connectors poll enable": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll set": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll disable": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll get": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll run": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll resume": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll items": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll retry": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll skip": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors poll seed": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
     "filebox list": {
       "requires": [
         {
@@ -2055,6 +2115,14 @@
         }
       ]
     },
+    "filebox set-version-label": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
     "filebox set-version-workflow": {
       "requires": [
         {

package/dist/skills/datarails-connectors-onboard-connector/SKILL.md

@@ -547,6 +547,9 @@ operator JWT: `dr connectors query repoint <queryId> --artifact-version vN --ser
 VPN's TLS-inspection cert isn't trusted by Node: set `NODE_EXTRA_CA_CERTS` to the gateway CA (do NOT
 port-forward as a workaround, and never `NODE_TLS_REJECT_UNAUTHORIZED=0`). `dr filebox`/`dr integrations`
 working while `dr connectors` fails is expected — those hit the public monolith, not the internal CP.
+Repoint, create and delete are scoped to the caller's org, so an operator login (not `login-as`) gets
+`403`. A repoint to an artifact of a **different flavor** must pass `--runtime-flavor <new flavor>` in
+the same command, or it gets `422`.
 
 ## 3. Datasource + filebox (monolith, via dr-cli)
 
@@ -763,8 +766,22 @@ dr connectors connector create --secret-ref <datasource_id> --json $ACC     # ad
 #    key — no uuid->id resolver on the monolith). It's the same <filebox_id> used in steps 3a/5.
 dr connectors query create --connector-id <id> --filebox-uuid <uuid> --filebox-id <filebox_id> \
   --artifact-name "<vendor>__<dq>" --artifact-version "<ver>" \
-  --runtime-flavor base --query-config '{"base_url":"https://api.vendor.com","max_mb":30}' --json $ACC
+  --runtime-flavor <flavor> --query-config '{"base_url":"https://api.vendor.com","max_mb":30}' --json $ACC
 ```
+**`--runtime-flavor` must be the artifact's flavor**: the `RUNTIME_FLAVOR` constant in the
+connector's `connection.py` (`base`, `bigquery`, `redshift`, `ibmiodbc`, `sftp`, …). It picks the runner queue
+the jobs go to. Always pass it, even for `base`. The flag defaults to `base`, and the control-plane
+rejects a mismatch with `422 runtime_flavor must be the pinned artifact's (<flavor>)`. Before that
+check existed, a non-base connector bound without the flag silently ran on the base runner,
+which does not have the flavor's packages.
+
+The control-plane also checks two more things on `query create`:
+- **Org:** the caller's JWT org must be the connector's org (`403`). This is why `$ACC` must be the
+  `dr login-as` customer identity.
+- **Filebox:** it asks the monolith, with the caller's token, whether the caller can see the filebox.
+  `403` means the caller can't see it, `422` means `--filebox-id` and `--filebox-uuid` name different
+  fileboxes, and `503` means the monolith couldn't answer.
+
 Both need `NODE_EXTRA_CA_CERTS` (VPN CA) like every `dr connectors` call. Verify with
 `dr connectors binding get <filebox_uuid> --json $ACC` (secret_ref + artifact + query_config resolve).
 The connector's `req.config` = `public_config` ∪ `query_config` ∪ the data-query's sync_query (its
@@ -871,7 +888,10 @@ unmerged connector has no version to ingest, bind, or run.
 | `dr filebox data-query get`/`versions --json` shows `&#x27;` (or `&quot;`) in config strings | The monolith serializer HTML-escapes string values on **read**; the DB stores raw quotes. | Cosmetic/display only — placeholder rendering still works. Don't "fix" the stored value; if you need the true string, HTML-unescape the output. |
 | New artifact code doesn't run even after publish | The runtime resolves the **active-version pointer** (`connector`+`org`), not your latest publish. | `dr connectors publish <dq.py>` then `dr connectors promote <name> --artifact-version vN` (both need `NODE_EXTRA_CA_CERTS`). Confirm: in-cluster `GET /internal/connectors/<name>/active?org_id=<org>`. |
 | `dr filebox get` never shows the filebox `uuid` | Not exposed by that command. | Read `filebox_uuid` from the `sync.requested` event (`datarails-connect-inngest`), or capture it from `dr filebox create --json`. |
-| Creating a binding via `curl localhost:8000/connectors` (or `/connector-queries`) → `401` / SPA HTML | Those POSTs are **authenticated** now; the port-forward serves the SPA. There is no unauthenticated create path. | Use the dr-cli (carries the JWT): `dr connectors connector create --secret-ref <ds>` then `dr connectors query create --connector-id <id> --filebox-uuid <uuid> --artifact-name … --artifact-version … --query-config '{…}'`. See step 4. |
+| Creating a binding via `curl localhost:8000/connectors` (or `/connector-queries`) → `401` / SPA HTML | Those POSTs are **authenticated** now; the port-forward serves the SPA. There is no unauthenticated create path. | Use the dr-cli (carries the JWT): `dr connectors connector create --secret-ref <ds>` then `dr connectors query create --connector-id <id> --filebox-uuid <uuid> --filebox-id <filebox_id> --artifact-name … --artifact-version … --runtime-flavor <flavor> --query-config '{…}'`. See step 4. |
+| `query create` / `query repoint` → `422 runtime_flavor must be the pinned artifact's (<flavor>)` | `--runtime-flavor` was left at its `base` default for a non-base artifact. Or a repoint moved to an artifact of another flavor without changing the binding's flavor. | Pass `--runtime-flavor` = the connector's `RUNTIME_FLAVOR`, in the same command as the artifact change. |
+| `query create` / `query repoint` / `query delete` → `403`, and the control-plane logs `cross_org_denied` | The CLI identity is the operator (`@datarails.com`), whose JWT org is not the connector's org. These routes are org-scoped. | `dr login-as <customer-user-email> --server <X>` and use that `--account` (see *Identity*). |
+| `query create`, or a repoint that changes the filebox → `403 the filebox is not one the caller can see`, `422 … name different fileboxes`, or `503 the monolith could not confirm the filebox` | The control-plane checks with the monolith, using the caller's token, that the caller can see the filebox. `403`: wrong org or wrong id. `422`: `--filebox-id` and `--filebox-uuid` come from two different fileboxes. `503`: the monolith was unreachable. | Use the `uuid` and numeric id from the same `dr filebox create --json` output, under the customer identity. On `503`, retry. |
 | Connector's own `log.info(...)` lines never appear in the runner logs / Groundcover (but `dr.runner` INFO does) | The hook runs in a **sandbox whose root logger has no handler**, so bare `logging` is dropped (only WARNING+ via lastResort, and even that may not surface). | Use `kit.logging.get_logger("<vendor>__<dq>")`: a stdout handler with a `[<vendor>__<dq>]` prefix, so lines are greppable in the shared `connectors-runner` pod. Never hand-roll a `StreamHandler` helper. Log auth (never the secret), the window, per-page progress, row count. |
 | A credential reaches Groundcover through a log line that logs no secret | The connector logged the raw `base_url`. It is **operator-supplied binding config**, so it can carry `user:pass@` userinfo or a credential in the query string — and the runner log is a shared multi-tenant stream. 24 connectors in dr-connectors currently do this (harmless for the keyless public sources, not for the credentialed ones). | Log only the hostname: `urlsplit(base_url).hostname` drops userinfo, port, path and query, which is all a log line needs to identify the environment. `samples/sample_streaming_fanout/` and the databricks connections model this. `kit.http.client`'s retry and error lines already name only `METHOD scheme://host[:port]/path`, and `kit.redact.safe_snippet` redacts credential-shaped vendor text. |
 | `get_query_class` receives `None` / multi-dataset connector raises "unknown objectType" / wrong dataset runs | `objectType` was placed at the data-query **config top level** instead of **inside `config.query`**. The runtime reads `dq["query"].get("objectType")` with **no top-level fallback**, so it comes through as `None`. | Put `objectType` inside the Sync-query, which is JSON **text**: `config.query = '{"objectType":"<dataset>"}'` (drop any top-level `objectType`). `dr connectors dev-fetch` warns when it's missing. Single-dataset connectors survive via their default; multi-dataset ones fail. |

package/dist/skills/dr-cli/SKILL.md

@@ -62,8 +62,9 @@ per server can be logged in at once.
   credential file when one is in use (see below).
 - `dr login --api-key --server US` — save a user-bound **API key** instead of a
   browser session. The key is read from a hidden prompt, or from stdin when
-  piped (`printf '%s\n' "$KEY" | dr login --api-key -s us`; piped, `-s` is
-  required unless a credential file already names the server; don't run the
+  piped (`printf '%s\n' "$KEY" | dr login --api-key -s <KEY>`, with the server
+  the key was issued on; piped, `-s` is required unless a credential file
+  already names the server, and a different `-s` is refused; don't run the
   piped form under shell tracing or command logging). Never pass the key as an
   argument or paste it into chat. `dr` exchanges it for a JWT itself, so no
   re-login is ever needed while the key is live — and `login --api-key` does that
@@ -108,7 +109,9 @@ exchange response does not carry it and `login --api-key` does not set it, so
 update it in the file alongside the key, or the warning keeps naming the old
 one.
 
-`--server <KEY>` is **required on every command that hits an API**. Valid keys:
+`--server <KEY>` is **required on every command that hits an API — unless a
+credential file is in use**, which already names the server: omit it then (a
+different key is refused as not matching the credentials). Valid keys:
 `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` (case-insensitive).
 
 You can also pass a full **`https://<host>.datarails.com` URL** instead of a
@@ -282,7 +285,7 @@ area's gotchas.
 
 **Fileboxes & documents** → [reference/filebox-documents.md](reference/filebox-documents.md)
 - `filebox list|get|versions|tags|sheets|preview|create|upload|upload-version|update|download` (alias `fileboxes`)
-- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-workflow|set-version-file-status|set-version-cycle`
+- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-label|set-version-workflow|set-version-file-status|set-version-cycle`
   - _archived versions (opt-in; defaults unchanged): `versions --archived|--all` to discover them; `archive-version`/`restore-version` also take `--doc` + `--version-number <n>` or `--latest-archived`/`--latest-active`_
   - _include in database: `versions --included` lists the versions whose `include_file` flag is on (intent, not delivered rows); `set-version-include <vid> --include on|off` writes the flag (two-step confirm both ways — off deletes the version's table rows, on queues an ETL scan). `--doc <id> --all-except-latest` is the bulk cleanup; it never targets the latest, and warns in the plan if the latest is itself excluded_
 - `filebox share|shares|set-option|set-tag-config|set-parent|lock|unlock|lock-date-tag|unlock-date-tag|locked-date-tags`

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -6,7 +6,9 @@
 `filebox sheets`, `filebox preview`, `filebox shares <doc_id>` (current user +
 group shares). Names are HTML-decoded before render.
 
-`filebox versions <doc_id>` lists **active** versions by default (unchanged).
+`filebox versions <doc_id>` lists **active** versions by default (unchanged);
+the table includes each version's `LABEL` (blank when unset; control characters
+show as escapes such as `\n`).
 To see archived (auto_save) versions, pass `--archived` (archived only) or
 `--all` (active + archived); both add an `ARCHIVED` column. This is the only
 way to discover an archived version's id from the CLI — archived rows are
@@ -33,7 +35,10 @@ set-version-include` (below).
 - `filebox upload-version <id>` — push a new version. Accepts `--date <date>
   --scenario <name>` to validate-then-tag at upload time in one call (planning
   fileboxes — same validation and read-back confirmation as
-  `set-version-cycle`).
+  `set-version-cycle`). `--label <text>` labels the new version after the upload
+  and any cycle tag (validated first, so a bad label uploads nothing). If the
+  label write fails the command exits non-zero naming the new version id, and
+  `--json` reports `label_error` instead of `label`.
 - `filebox download` — download document content.
 
 ## Filebox — update / config
@@ -114,6 +119,17 @@ set-version-include` (below).
 - `filebox set-version-date-tag <vid> --doc <id> --month|--quarter|--day|--year|--week …
   [--json]` — set the date tag on one version (resolves the tag id from the doc's
   config; other tags untouched).
+- `filebox set-version-label <vid> --label "<text>" | --clear [--json]` — set or
+  remove a version's free-text label; name, date and dimension tags are
+  untouched, and a locked date tag does not block it. No confirm step. Address it
+  like `archive-version` (global id, or `--doc <doc_id>` with `--version-number
+  <n>` / `--latest-active`; a tie on the highest number is refused — pass the
+  global id). The version is loaded first, so a bad id fails without writing,
+  and the label is read back after the write. `--json` returns `version_id`,
+  `doc_id`, `version`, `label` and `previous_label`. At most 256 characters, no
+  control characters, and not `auto-calculated` (reserved by the server for
+  versions it generates); pass the label as one quoted argument. Needs change
+  rights on the filebox or to be the version's uploader (HTTP 405 otherwise).
 - `filebox set-version-workflow <vid> --doc <id> --status <Not Started|In Progress|Pending|Approved|Rejected>`
   — set the workflow LIST-tag value (setting `Approved` requires `approve_workflow`).
 - `filebox set-version-file-status <vid> --doc <id> --status <Draft|Final> [--json]`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.113",
+  "version": "1.6.115",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {