@datarails-ai/dr-cli 1.6.115 → 1.6.117

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.115",
+  version: "1.6.117",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-11T19:13:34.414Z";
+var BUILD_TIME = "2026-10-12T08:59:33.211Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -31273,6 +31273,61 @@ async function runPreviewData(cfg) {
   const result = await previewData(cfg.client, body, { signal: cfg.signal });
   writeJSONIndented(cfg.out, result);
 }
+async function findOrdinalCollisions(client, mapperId, docIds, signal) {
+  const details = await getDetails2(client, mapperId, { signal });
+  const tableId = details.template.id;
+  const mappers = await list20(client, tableId, { signal });
+  const self = mappers.find((m) => m.id === mapperId);
+  if (self === void 0) {
+    return null;
+  }
+  const ordinal = self.ordinal ?? null;
+  const wanted = new Set(docIds);
+  const others = mappers.filter(
+    (m) => m.id !== mapperId && (m.ordinal ?? null) === ordinal && (m.mapped_documents_ids ?? []).some((d) => wanted.has(d))
+  );
+  return { tableId, ordinal, others };
+}
+async function warnOrdinalCollisions(cfg, body) {
+  const err = cfg.err ?? process.stderr;
+  const raw = body["selected_document_ids"];
+  const docIds = (Array.isArray(raw) ? raw : []).map((d) => {
+    const n = typeof d === "string" && /^\s*\d+\s*$/.test(d) ? Number(d) : d;
+    if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) {
+      throw new Error(
+        `selected_document_ids must hold positive integer document ids, got ${JSON.stringify(d)}`
+      );
+    }
+    return n;
+  });
+  if (docIds.length === 0) {
+    return;
+  }
+  let found;
+  try {
+    found = await findOrdinalCollisions(cfg.client, cfg.mapperId, docIds, cfg.signal);
+  } catch (e) {
+    if (cfg.signal.aborted) {
+      throw e;
+    }
+    err.write(
+      `note: could not check for other mappers on the same ordinal: ${e.message}
+`
+    );
+    return;
+  }
+  if (found === null) {
+    return;
+  }
+  const ordinal = found.ordinal === null ? "null" : String(found.ordinal);
+  for (const other of found.others) {
+    const shared = (other.mapped_documents_ids ?? []).filter((d) => docIds.includes(d));
+    err.write(
+      `warning: mapper ${cfg.mapperId} and mapper ${other.id} (${other.name}) share ordinal ${ordinal} on table ${found.tableId}, so the server treats them as versions of one mapper. Binding ${cfg.mapperId} to document(s) [${shared.join(", ")}] unbinds them from ${other.id}; a mapper left with no documents and no processed versions is deleted with its rows. To load both side by side, re-create one with \`dr datamappers create\` (a new mapper gets the next free ordinal).
+`
+    );
+  }
+}
 async function runUpdateBinding(cfg) {
   if (cfg.mapperId <= 0) {
     throw new Error("mapper id must be positive");
@@ -31297,6 +31352,7 @@ async function runUpdateBinding(cfg) {
       body["rescan"] = r;
     }
   }
+  await warnOrdinalCollisions(cfg, body);
   const result = await updateBinding(cfg.client, cfg.mapperId, body, {
     signal: cfg.signal
   });
@@ -31456,6 +31512,18 @@ async function runDatamappersCreate(cfg) {
       "merge"
     );
   }
+  const rawDatamapperId = body["datamapper_id"];
+  const datamapperId = rawDatamapperId == null ? 0 : Number(rawDatamapperId);
+  if (!Number.isInteger(datamapperId) || datamapperId < 0) {
+    throw new Error(
+      `body datamapper_id must be a mapper id (a non-negative integer), got ${JSON.stringify(rawDatamapperId)} \u2014 remove it to create a new mapper`
+    );
+  }
+  const publishesVersion = datamapperId !== 0;
+  const requestedOrdinal = body["ordinal"];
+  if (!publishesVersion && requestedOrdinal == null) {
+    body["ordinal"] = 0;
+  }
   const { decoded: decodedCreate, changeCount: createChangeCount } = decodeBodyEntitiesDeep(body);
   if (createChangeCount > 0) {
     process.stderr.write(
@@ -31473,6 +31541,12 @@ async function runDatamappersCreate(cfg) {
   } else {
     renderMappersTable(cfg.out, [created]);
   }
+  if (!publishesVersion && typeof requestedOrdinal === "number" && typeof created.ordinal === "number" && created.ordinal !== requestedOrdinal) {
+    (cfg.err ?? process.stderr).write(
+      `note: the server gave mapper ${created.id} ordinal ${created.ordinal}, not ${requestedOrdinal}: a new mapper always takes the next free ordinal on the table. To publish a new version of an existing mapper (same ordinal), use \`dr datamappers update\`.
+`
+    );
+  }
   const declaredCalcNames = extractCalcFields(body).map((c) => c.name).filter((n) => n !== "");
   if (declaredCalcNames.length > 0 && rescanValue !== "") {
     const result = await verifyCalcFieldsMaterialise(
@@ -32329,7 +32403,7 @@ function registerDatamappersCommand(root) {
   addServerFlag(previewCmd);
   addAccountFlag(previewCmd);
   const bindCmd = dm.command("bind").description(
-    'Update which document IDs a mapper is bound to. Posts to `POST /api/templates/mappers/<id>/binding` with `{selected_document_ids, rescan?}`. The legacy webclient\'s "Mapping table with documents" modal calls this when the operator checks/unchecks docs in the binding picker.'
+    'Update which document IDs a mapper is bound to. Posts to `POST /api/templates/mappers/<id>/binding` with `{selected_document_ids, rescan?}`. The legacy webclient\'s "Mapping table with documents" modal calls this when the operator checks/unchecks docs in the binding picker. Warns first when another mapper of the table on the same ordinal is bound to one of those docs: mappers that share an ordinal are versions of one mapper, so the bind unbinds the other.'
   ).argument("<mapper_id>", "mapper id (positive integer)").option("--doc <id>", "Document id to bind (positive integer; repeatable)", collectInts, []).option(
     "--rescan <mode>",
     "Trigger a re-extraction: `latest` or `all` (default: omit; no rescan)",

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.115",
+  "cliVersion": "1.6.117",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/datarails-connectors-onboard-connector/SKILL.md

@@ -61,7 +61,8 @@ operator's own org**. `dr integrations add` is the one exception: its payload na
 explicitly, so the **datasource lands in the right org while the filebox lands out of tenant**. Everything
 downstream then looks healthy — the binding resolves, the sync completes, a version lands — but it landed
 in the wrong org and the customer never sees the filebox. `dr connectors` (control-plane) accepts the
-impersonated JWT and takes its org from it as well, so `--org-id` can be omitted there. Beyond the
+impersonated JWT and takes its org from it as well, so `--org-id` can be omitted there (an `--org-id`
+for another org is refused 403). Beyond the
 breakage, creating customer resources under the operator's own identity breaks resource-level scoping and
 loses the audited operator→target trail (`tech/security.md` §2.2, §8).
 
@@ -758,9 +759,10 @@ POST gets `401`; the port-forward also serves the SPA). Use the dr-cli, which ca
 to the internal control-plane (`dr connectors connector create` / `query create` — added 2026-07;
 older skill copies show the now-broken curl):
 ```bash
-# a) Connector (creds source). --org-id optional — the JWT org is used when omitted, and under the
-#    impersonated customer identity that IS the customer's org, so omitting it is correct. Note the returned id.
-dr connectors connector create --secret-ref <datasource_id> --json $ACC     # add --org-id <org> only to override the JWT org
+# a) Connector (creds source). Omit --org-id: the control plane creates the connector in the caller's
+#    JWT org, and under the impersonated customer identity that IS the customer's org. --org-id cannot
+#    override it: another org is refused 403, and a token with no org claim gets 400. Note the returned id.
+dr connectors connector create --secret-ref <datasource_id> --json $ACC
 # b) ConnectorQuery (the binding) — connector-id from (a); filebox-uuid + filebox-id from step 3b
 #    (filebox create). --filebox-id is the numeric doc id (MANDATORY; the Sync-query editor's write
 #    key — no uuid->id resolver on the monolith). It's the same <filebox_id> used in steps 3a/5.

package/dist/skills/dr-cli/reference/datamappers.md

@@ -35,6 +35,21 @@ the matching subcommand. `datamappers create <flat|dimension|multiple|from-file>
   Required body fields: `name`, `document_version_id`, `selected_document_ids`
   (GET returns this renamed as `mapped_documents_ids`), `config`, `sheet_name`.
 
+**Ordinal: mappers that share one are versions of one mapper.** Each mapper has
+an `ordinal` (the ORDINAL column of `datamappers list --table <id>`). The server
+binds documents per (table, ordinal): binding a mapper to a document moves that
+document off any other mapper of the table on the same ordinal, and a mapper left
+with no documents and no processed versions is then deleted with its rows. Two
+different extractions from one filebox (for example two tabs of one workbook)
+need two ordinals. `create` takes care of it: a new mapper always gets the
+table's next free ordinal, which the server picks itself (any `ordinal` in a
+`from-file` body is replaced, and dr notes the value it got). A body with no
+ordinal, or a null one, is sent with `ordinal: 0` because the server would
+otherwise store it as 0, a version of whichever mapper already holds 0.
+A body with `datamapper_id` publishes a new version and keeps its ordinal as
+sent; use `update` for that. `bind` warns, then binds anyway, when another
+mapper of the table on the same ordinal is bound to one of the documents.
+
 **Schema-bootstrap shortcut:** mapping `map_to: "<field>"` to a column the target
 template doesn't have yet auto-adds that field on the table (plus 4 system
 scenario fields on the first mapper). This is the documented way to declare
@@ -87,7 +102,8 @@ value-inference behavior. `NAME` is the target **table field** name (the
 - `datamappers preview --payload-file <p>` — renders mapper output for sample
   input ("what would this extract?") before saving.
 - `datamappers bind <mapper_id> --doc <id> [--rescan latest|all]` — change which
-  docs a mapper is bound to.
+  docs a mapper is bound to. A doc bound to another mapper of the table on the
+  same ordinal moves to this one (see *Ordinal* above), and dr warns first.
 
 ### `update --field NAME:TYPE` — set column types (materialising calc columns)
 

package/dist/skills/dr-cli/reference/safety.md

@@ -15,7 +15,7 @@ key attributes, and emits a short-lived confirmation token. Re-run with
   file between plan and confirm invalidates the token.
 - The printed confirm command echoes the plan invocation's `--account`, so on
   a keychain holding several identities for the server it can be pasted
-  verbatim — no need to re-add the flag by hand (gap #41).
+  verbatim — no need to re-add the flag by hand.
 
 Gated commands include: `dashboards delete`, `datamappers delete`,
 `dynamic-ranges delete`, `extables delete`, `functions delete`, `lut delete`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.115",
+  "version": "1.6.117",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {