@datarails-ai/dr-cli 1.6.138 → 1.6.140

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.138",
+  version: "1.6.140",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-15T20:14:54.448Z";
+var BUILD_TIME = "2026-10-16T10:39:49.051Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -31927,7 +31927,7 @@ function registerErrorEnrichmentsCommand(root) {
 
 // src/commands/skill.ts
 import { createHash as createHash8 } from "crypto";
-import { readFile as readFile3, mkdir as mkdir2, readdir as readdir2, rm as rm2, rmdir, stat, writeFile as writeFile3 } from "fs/promises";
+import { lstat, readFile as readFile3, mkdir as mkdir2, readdir as readdir2, rm as rm2, rmdir, stat, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname6, join as join9, resolve as resolve2 } from "path";
 
 // src/commands/_skillsRoot.ts
@@ -32107,6 +32107,9 @@ function skillDirAbs(targetAbs, dotDir, name) {
   return join9(targetAbs, dotDir, "skills", name);
 }
 var MANIFEST_FILE = ".dr-cli-manifest.json";
+var RETIRED_SKILLS = {
+  "datarails-connectors-onboard-connector": "drip-implement-connector"
+};
 var MARKER_BEGIN = "<!-- dr-cli:begin -->";
 var MARKER_END = "<!-- dr-cli:end -->";
 var USERSPACE_ENV = "DR_CLI_USERSPACE_SKILLS";
@@ -32209,7 +32212,16 @@ async function runSkillInstall(cfg) {
   const skills = await getEmbeddedSkills();
   const verbose = cfg.verbose ?? false;
   const probe = await pluginManagedProbe(abs, cfg.env);
-  if (probe.managed && !(cfg.force ?? false)) {
+  const pluginSkip = probe.managed && !(cfg.force ?? false);
+  await removeRetiredSkills({
+    targetAbs: abs,
+    skills,
+    // On a skipped install, a replacement whose plugin is absent is not written below.
+    servedByPlugins: pluginSkip ? probe.installedPlugins : null,
+    out: cfg.out,
+    verbose
+  });
+  if (pluginSkip) {
     cfg.out.write(
       `Skipped ${join9(abs, ".claude", "skills")}: this machine gets the dr-cli skills from the dr-cli plugin (${probe.reason}). Pass --force to write them anyway.
 `
@@ -32350,9 +32362,34 @@ async function readManifest(skillDir) {
     return [];
   }
 }
+async function removeRetiredSkills(cfg) {
+  const { targetAbs, out } = cfg;
+  for (const [old, replacement] of Object.entries(RETIRED_SKILLS)) {
+    for (const dotDir of [".claude", ".gemini"]) {
+      const skillDir = skillDirAbs(targetAbs, dotDir, old);
+      const removed = await removeUserSpaceCopy(skillDir);
+      if (removed === null) continue;
+      const files = `${removed.files} file${removed.files === 1 ? "" : "s"}`;
+      out.write(
+        `Removed retired skill ${old}: ${files} at ${skillDir} (now ${replacement})` + (removed.dirRemoved ? "" : "; directory kept, it holds files the CLI did not write") + "\n"
+      );
+      if (dotDir !== ".claude" || cfg.servedByPlugins === null) continue;
+      const next = cfg.skills.find((s) => s.name === replacement);
+      if (next === void 0 || cfg.servedByPlugins.has(next.plugin)) continue;
+      await installSkillTree({
+        skillDir: skillDirAbs(targetAbs, dotDir, next.name),
+        files: next.files,
+        out,
+        verbose: cfg.verbose,
+        label: `skill ${next.name}`
+      });
+    }
+  }
+}
 async function removeUserSpaceCopy(skillDir) {
   const manifestPath = join9(skillDir, MANIFEST_FILE);
   try {
+    if ((await lstat(skillDir)).isSymbolicLink()) return null;
     await stat(manifestPath);
   } catch {
     return null;
@@ -32360,7 +32397,9 @@ async function removeUserSpaceCopy(skillDir) {
   let files = 0;
   for (const rel of await readManifest(skillDir)) {
     try {
-      const p = join9(skillDir, ...relSegments(rel));
+      const segs = relSegments(rel);
+      if (await crossesLink(skillDir, segs.slice(0, -1))) continue;
+      const p = join9(skillDir, ...segs);
       await rm2(p, { force: true });
       await rmdir(dirname6(p)).catch(() => {
       });
@@ -32375,6 +32414,18 @@ async function removeUserSpaceCopy(skillDir) {
   );
   return { files, dirRemoved };
 }
+async function crossesLink(root, dirSegs) {
+  let p = root;
+  for (const seg of dirSegs) {
+    p = join9(p, seg);
+    try {
+      if ((await lstat(p)).isSymbolicLink()) return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 async function installSkillTree(opts) {
   const { skillDir, files, out, verbose, label } = opts;
   const prev = await readManifest(skillDir);
@@ -35874,7 +35925,7 @@ function registerDocumentsCommand(root) {
 // src/commands/integrations.ts
 import { Option as Option2 } from "commander";
 import { constants as fsConstants } from "fs";
-import { lstat, open as open2 } from "fs/promises";
+import { lstat as lstat2, open as open2 } from "fs/promises";
 
 // src/api/integrations.ts
 async function list23(client, opts, reqOptions) {
@@ -43860,7 +43911,7 @@ function parseSavedSearchId(raw) {
   return id;
 }
 async function writeSqlFile(path13, sql) {
-  const existing = await lstat(path13).catch((err) => {
+  const existing = await lstat2(path13).catch((err) => {
     if (err.code === "ENOENT") return void 0;
     throw err;
   });

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.138",
+  "cliVersion": "1.6.140",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/create-connector-lib/SKILL.md

@@ -13,7 +13,7 @@ file format, built on the SDK kit's generic pieces, and each org's connector is
 `lib/ramp/dataqueries/select_query.py`; find its thin connectors with
 `grep -rl "lib.ramp.dataqueries.select_query" --include=*.py us us2 uk ca`. Read both first.
 
-**REQUIRED:** `datarails-connectors-onboard-connector` for everything around the code: branch,
+**REQUIRED:** `drip-implement-connector` for everything around the code: branch,
 publish, datasource, filebox, binding. Its memory, streaming and 4xx rules apply to lib code too.
 
 ## Layout

package/dist/skills/{datarails-connectors-onboard-connector → drip-implement-connector}/SKILL.md

@@ -1,12 +1,16 @@
 ---
-name: datarails-connectors-onboard-connector
-description: Use when creating a new connector for the Datarails connectors platform and wiring it end-to-end on a dev/test env - writing the connection + dataquery files, publishing the artifact, binding it, and setting up the datasource + filebox so a sync actually runs. Triggers - "new connector", "onboard a connector", "publish a connector", "wire fmp_fx/<x> connector", "connector sync does nothing", "connector-jobs queue empty", "add <vendor> for another org", "reuse the <vendor> connector", "lib/<vendor>", "shared vendor code", ConnectorQuery/binding/datasource/filebox for a DatarailsConnector.
+name: drip-implement-connector
+description: Use when creating a new connector for DRIP (Datarails Integration Platform, the connectors platform) and wiring it end-to-end on a dev/test env - writing the connection + dataquery files, publishing the artifact, binding it, and setting up the datasource + filebox so a sync actually runs. Triggers - "new connector", "onboard a connector", "publish a connector", "wire fmp_fx/<x> connector", "connector sync does nothing", "connector-jobs queue empty", "add <vendor> for another org", "reuse the <vendor> connector", "lib/<vendor>", "shared vendor code", "DRIP connector", "SFTP connector", "pull files from SFTP", "lib/sftp", "sftp flavor", "host_key", ConnectorQuery/binding/datasource/filebox for a DatarailsConnector.
 ---
 
-# Onboard a connector (implement + wire end-to-end)
+# Implement a DRIP connector (implement + wire end-to-end)
 
 ## Overview
 
+**DRIP (Datarails Integration Platform)** is the product: the connectors platform that runs
+customer connectors (dr-connectors code, the connectors control plane, runtime and runners) and lands
+their output in fileboxes. This skill builds one DRIP connector and wires it until a sync lands.
+
 A **connector** is a two-file artifact — a `connections/<conn>.py` composed with a `dataqueries/<dq>.py`
 (no manifest; see the dr-connectors README for the authoritative file layout + programming model) —
 published to the shared JFrog repo by CI, then pulled into a datacenter's blob on ingest. Those two
@@ -73,6 +77,10 @@ loses the audited operator→target trail (`tech/security.md` §2.2, §8).
 A vendor's code may already live once in **`lib/<vendor>/`** (e.g. `lib/ramp`, `lib/sap_b1`,
 `lib/metmuseum`). List `lib/` in `C:\codegithub\dr-connectors` before anything else.
 
+**The source is an SFTP folder** → it is `lib/sftp` (any server: the customer's or the Datarails-hosted
+one), on the `sftp` flavor. Follow **`reference/sftp.md`**: the thin files, a connector-specific
+variant with its test, the datasource credentials (pinned `host_key`), the Sync-query and polling.
+
 **The lib exists** → the connector is **two thin files**, nothing to implement:
 
 ```python
@@ -613,6 +621,8 @@ python -c "import os,json;json.dump({'name':'<name>-connector','organization':<o
 python -c "import os,json;json.dump({'name':'<name>-connector','organization':<org_id>,'type':'DatarailsConnector','is_sync_service':True,'config':{'oauth':{'authorize_url':'<vendor authorize url>','token_url':'<vendor token url>','scopes':'<space-separated scopes>','client_id':os.environ['<CLIENT_ID_ENV>']},'oauth_secrets':{'client_secret':os.environ['<CLIENT_SECRET_ENV>']}}},open('ds.json','w'))"
 #    ...with nothing answered, the OAuth config is just:  'config':{'oauth':{}}
 #
+#    SFTP — host, port, username, password and/or private_key, and the pinned host_key: reference/sftp.md §3.
+#
 dr integrations add --payload-file ds.json --json $ACC      # -> note the datasource id
 rm -f ds.json
 
@@ -921,3 +931,4 @@ unmerged connector has no version to ingest, bind, or run.
 - `dr-cli` — datasource/filebox/integration commands.
 - `datarails-connect-inngest` — read the sync.requested event (for `filebox_uuid`) + run status.
 - `datarails-connectors-add-flavor` — add a flavor if the connector needs new deps.
+- `reference/sftp.md` — SFTP connectors on `lib/sftp`: sample code, credentials, Sync-query, polling.

package/dist/skills/drip-implement-connector/reference/sftp.md

@@ -0,0 +1,246 @@
+# SFTP connectors on DRIP (`lib/sftp`)
+
+An SFTP connector lands the files a customer drops in an SFTP folder. It never needs new vendor
+code: dr-connectors already ships **`lib/sftp`**, a provider of **`lib/filesource`**, on the `sftp`
+runner flavor. One lib serves any server, the customer's own or the SFTP server Datarails hosts in
+each datacenter:
+
+| Piece | Holds |
+|---|---|
+| Datasource credentials | the server: `host`, `port`, `username`, `password` and/or `private_key`, the pinned `host_key` |
+| Filebox Sync-query | which files: `folder`, `pattern`, the dating rule, the period window |
+| Binding | `--runtime-flavor sftp`; optional `max_files` in `query_config` |
+
+Read the lib's own docstrings before you start. They are the authoritative contract and this page
+only points into them: `lib/sftp/__init__.py`, `lib/sftp/connections/base_connection.py`,
+`lib/sftp/_core.py`, and `lib/filesource/dataqueries/files.py`, which has every Sync-query variable
+and the three run modes.
+
+**Not the same thing as `dr integrations sftp`.** That command gives a filebox a folder on the
+Datarails-hosted SFTP server that the customer *pushes* to (the dr-cli skill's
+`reference/integrations.md`). A DRIP SFTP connector *pulls* from a server. It can pull from the
+hosted one too, with the org's SFTP login.
+
+## 1. The connector: two thin files
+
+Most SFTP connectors are just the lib (Step 0 of the skill). Layout
+`<datacenter>/<org_id>_(<org_name>)/sftp/`:
+
+```python
+# <datacenter>/<org_id>_(<org_name>)/sftp/connections/<conn>.py
+"""<org>'s SFTP login on <server>: the lib's one SFTP connection; the datasource holds the host,
+user, password and pinned host key."""
+
+from lib.sftp.connections.base_connection import RUNTIME_FLAVOR, SftpConnection as CONNECTION  # noqa: F401
+```
+
+```python
+# <datacenter>/<org_id>_(<org_name>)/sftp/dataqueries/files.py
+"""<org>'s SFTP files: the lib's `files` query. The folder, file rule and period window are the
+filebox's Sync-query."""
+
+from lib.sftp.dataqueries.files import OBJECT_TYPES, get_query_class  # noqa: F401
+
+CONNECTION = "<conn>"
+```
+
+Name the connection after the server or feed (`datarails_sftp`, `<bank>_sftp`). The artifact is
+`sftp__files`. A dataquery that only re-exports the lib needs no test of its own: the lib's tests cover
+it (`scripts/check_connector_tests.py`). `dev-1/69_(test-connectors.com)/sftp/` is the reference
+pair, the platform's end-to-end check of the `sftp` flavor.
+
+## 2. A connector-specific variant
+
+When the Sync-query's regex cannot express the rule, subclass the lib's `FilesQuery` in the dataquery
+file and override one hook. Typical cases are a date a regex cannot read, files to leave out, and
+a file that must land in another shape. Keep `OBJECT_TYPES` one import hop away, and define your
+own `get_query_class`:
+
+```python
+# <datacenter>/<org_id>_(<org_name>)/sftp/dataqueries/files.py
+"""<org>'s <feed> on SFTP: the lib's `files` query, with the feed's own date rule and landed columns.
+
+THE DATE. `<prefix>_<MonYYYY>.csv` (e.g. `GL_Aug2026.csv`) belongs to that month; any other name has no
+date and is never an item.
+
+THE FILE. Lands under the header the filebox's table expects, columns picked from the source.
+"""
+
+import datetime as dt
+import re
+
+from dr_integrations_sdk import DataQuery
+
+from lib.filesource import _engine
+from lib.filesource.rewrite import CsvRewrite
+from lib.sftp.dataqueries.files import OBJECT_TYPES, FilesQuery as _FilesQuery  # noqa: F401
+
+CONNECTION = "<conn>"
+
+_NAME_MONTH = re.compile(r"_([A-Za-z]{3})([0-9]{4})[.]csv$")
+_LANDED = CsvRewrite(header=("Account", "Period", "Amount"), columns=(0, 2, 5), skip_records=1)
+
+
+class FilesQuery(_FilesQuery):
+    def date_of(self, file: _engine.RemoteFile, selection: _engine.Selection) -> dt.date | None:
+        m = _NAME_MONTH.search(file.name)
+        if not m:
+            return None
+        try:
+            return dt.datetime.strptime(f"{m[1]}{m[2]}", "%b%Y").date()
+        except ValueError:
+            return None
+
+    def transform(self, file, chunks, *, encoding=None):
+        # Stream it: never read a file whole. `encoding` is the Sync-query's, when set.
+        return _LANDED.stream(chunks, name=file.name, encoding=encoding)
+
+
+def get_query_class(name: str) -> type[DataQuery]:
+    return FilesQuery
+```
+
+The other hooks are `empty_output()`, which says what a period sync lands when no file matches
+(the default is a PermanentError), and the `lib.filesource.rewrite` steps `decode`, `replace` and
+`lines`. A new source format, such as a bank statement converted to CSV, is a dataquery module of
+its own on `lib.filesource`. `lib/sftp/bai2.py` and the `cibc_bai2` connectors are the example.
+
+A variant adds behaviour, so it needs a test next to it (`sftp/tests/test_files.py`). The `connector`
+fixture from the repo's `conftest.py` loads the files under test:
+
+```python
+# <datacenter>/<org_id>_(<org_name>)/sftp/tests/test_files.py
+"""<org>'s <feed>: the month comes from the name, and an unreadable name has no date."""
+
+import datetime as dt
+
+import pytest
+
+from lib.filesource import _engine
+
+
+def remote(name: str) -> _engine.RemoteFile:
+    at = dt.datetime(2026, 9, 3, 10, 0, tzinfo=dt.UTC)
+    return _engine.RemoteFile(path=f"/outbound/{name}", relative=name, size=10, modified=at,
+                              content_key=f"10|{int(at.timestamp())}", ref={"path": f"/outbound/{name}"})
+
+
+@pytest.mark.parametrize("name, day", [
+    ("GL_Aug2026.csv", dt.date(2026, 8, 1)),
+    ("GL_aug2026.csv", dt.date(2026, 8, 1)),
+    ("GL_2026_08.csv", None),
+    ("GL_Foo2026.csv", None),
+])
+def test_the_month_comes_from_the_name(connector, name, day):
+    query = connector.query_class("files")()
+    assert query.date_of(remote(name), _engine.Selection(dated_by="modified")) == day
+```
+
+Test a `transform` the same way: feed it chunks (an async generator of `bytes`) and compare the
+joined output. The connectors under `ca/*/sftp/tests/` use an in-memory `Source`/`Provider` to run a
+whole period sync or discover. Copy that pattern when the variant changes which files a sync takes.
+Fixtures are synthetic. Never copy a customer's file into a test.
+
+## 3. The datasource: the server login
+
+One datasource per server login. The credentials sit in the datasource's `config`, and the lib reads
+them by key:
+
+| Key | |
+|---|---|
+| `host` | bare hostname or IP, with no scheme, user, port or path |
+| `port` | optional, default 22 |
+| `username` | |
+| `password` and/or `private_key` | an OpenSSH or PEM key (Ed25519, ECDSA or RSA), plus `passphrase` when the key is encrypted |
+| `host_key` | **required.** The server's public key: the bare `<type> <base64>`, a `known_hosts` line, or raw `ssh-keyscan` output (the first key wins). A server with an unknown or changed key is refused |
+
+```bash
+# Pin the server's key. Run it from a trusted network, and check the fingerprint with the server's owner.
+ssh-keyscan -t ed25519 <host> > host_key.txt
+
+python -c "import os,json;json.dump({'name':'<name>-sftp','organization':<org_id>,'type':'DatarailsConnector','is_sync_service':True,'config':{'host':'<host>','port':22,'username':os.environ['SFTP_USER'],'password':os.environ['SFTP_PASSWORD'],'host_key':open('host_key.txt').read()}},open('ds.json','w'))"
+dr integrations add --payload-file ds.json --json $ACC      # -> note the datasource id
+rm -f ds.json host_key.txt
+```
+
+For key auth, swap `'password'` for `'private_key':open(os.environ['SFTP_KEY_FILE']).read()`, and add
+`'passphrase'` when the key is encrypted. Never echo or commit any of these values.
+
+**Only public hosts.** The lib refuses a host that resolves to a private, loopback, link-local or
+cluster-internal address. The one exception is the Datarails-hosted SFTP server of each datacenter
+(`HOSTED_SFTP_HOSTS` in `lib/sftp/_core.py`), which sits behind a private endpoint. Pulling from it
+uses the customer org's SFTP login and that account's `<account>.blob.core.windows.net` host. A hosted
+account missing from that list fails with "resolves to a private ... address". The fix is a lib PR
+that adds it, not a different host.
+
+## 4. The Sync-query: which files
+
+Set it with `dr filebox data-query set` (step 3c of the skill) as JSON **text**, with `objectType`
+inside it:
+
+```json
+{"objectType": "files", "folder": "/outbound", "pattern": "GL_*.csv",
+ "dated_by": "name", "date_regex": "_(?P<year>[0-9]{4})_(?P<month>[0-9]{2})[.]csv$",
+ "from": "{{ date_tag|somonth|format:'%Y-%m-%d' }}", "to": "{{ date_tag|eomonth|format:'%Y-%m-%d' }}",
+ "fileName": "GL_{{ date_tag|format:'%Y_%m' }}"}
+```
+
+`fileName` takes no extension: the runtime appends `.csv` (a `.csv` of your own would sanitize to
+`_csv.csv`). The rules are the skill's step 3c note.
+
+| Variable | |
+|---|---|
+| `folder` | required. Read only under it |
+| `depth` | subfolder levels to list, default 0 |
+| `pattern` | file-name glob, case-insensitive, default `*` |
+| `dated_by` | `modified` (default), `name`, `path` (a dated folder such as `2026/08/`), or `none` |
+| `date_regex`, `date_format` | with `name` or `path`: named groups `year`/`month`/`day`, or one group read with `date_format` |
+| `from` / `to` | period mode window. Required unless `dated_by: none` or `latest: true` |
+| `latest` | period mode: only the newest file of the window |
+| `combine` | `single` (default, exactly one file, byte for byte) or `csv` (same-header CSVs as one file, with `header_rows`) |
+| `decompress` | `auto` (default, gunzips `.gz`), `gzip` or `none` |
+| `encoding` | passed to a variant's `transform`. Without a transform it changes nothing |
+
+The filebox's DATE tag follows the same rule as any connector (step 3b of the skill). A dated rule
+gets a matching tag. `dated_by: none` gets `--no-date` and no `from`/`to`. `combine: single` with no
+file, or with more than one, is a PermanentError, as is more than `max_files` (default 500) matching
+files.
+
+## 5. Period sync or polled
+
+- **Period sync**: an ordinary filebox data-query sync (step 5 of the skill). It lands the files of
+  the selected period as one version.
+- **Polled**: the control plane lists the folder on a schedule and lands each new or changed file as
+  its own version, dated by the file's own date. This is what a feed the customer drops daily wants,
+  and what a Workato `new_file_in_dir` recipe did. Enable it after the binding exists:
+
+  ```bash
+  dr connectors poll enable <filebox_id> --same-name new-version $ACC   # a re-written file lands again
+  dr connectors poll get <filebox_id> $ACC
+  dr connectors poll items <filebox_id> $ACC                            # the item ledger
+  ```
+
+  A polled filebox needs exactly one DATE tag. With `dated_by: name` or `path`, the window is the
+  item's own date. With `modified`, it is the file's modification time, which is the one to use when a
+  file is re-written after its period ends. `--interval`, `--lookback`, `--settle` and `--since` tune
+  the poll (`dr connectors poll enable --help`).
+
+## 6. Bind and run
+
+The binding is step 4 of the skill, with the `sftp` flavor:
+
+```bash
+dr connectors query create --connector-id <id> --filebox-uuid <uuid> --filebox-id <filebox_id> \
+  --artifact-name sftp__files --artifact-version <vN> --runtime-flavor sftp --json $ACC
+```
+
+Errors you will meet in the completion store's `verdict`/`error`:
+
+| Error | Meaning |
+|---|---|
+| AuthError | the login was rejected. Check `username` and `password`/`private_key` |
+| `the datasource has no host_key` / key refused | `host_key` is missing, or the server's key changed. Re-pin it only after the owner confirms the change |
+| `resolves to a private ... address` | the host is not public (§3) |
+| `unknown objectType` | `objectType` is missing from the Sync-query JSON text |
+| `exactly one file` / no file | `combine: single` matched 0 or several files. Narrow `pattern` or use `latest` |
+| TransientError (timeout, reset) | the runtime retries it. Repeated ones mean the server is unreachable from our egress, so ask the owner to allow-list it |

package/dist/skills/plugins.json

@@ -3,13 +3,13 @@
     "connector-sandbox",
     "create-connector-lib",
     "datarails-connect-workato",
-    "datarails-connectors-onboard-connector",
     "dr-error-enrichment",
     "dr-error-enrichment-author",
     "dr-error-enrichment-improve",
     "dr-error-enrichment-maintain",
     "dr-error-enrichment-reconcile",
     "dr-filebox-api-setup",
+    "drip-implement-connector",
     "validate-workato-migration"
   ],
   "dr-cli": [

package/dist/skills/validate-workato-migration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: validate-workato-migration
-description: Use when a customer's Workato feed is being migrated to a dr-connectors (DRIP) connector and the connector's output has to be proven identical to Workato's before cut-over, or when working in the Workato-migration staging org test-workato-migration.com (US 21304, US2 1691, UK 3289, CA 5106). Also for "query create" returning 422 "artifact version not registered" for a staging-org binding, and for comparing connector CSVs with Workato filebox versions. Not for building or publishing the connector itself (datarails-connectors-onboard-connector) or for reading Workato alone (datarails-connect-workato). Triggers - "validate the migration", "compare Workato vs connector", "parity check against Workato", "test the migration in the staging org", "test_workato_migration org", "are the connector files identical to Workato", "migration validation report".
+description: Use when a customer's Workato feed is being migrated to a dr-connectors (DRIP) connector and the connector's output has to be proven identical to Workato's before cut-over, or when working in the Workato-migration staging org test-workato-migration.com (US 21304, US2 1691, UK 3289, CA 5106). Also for "query create" returning 422 "artifact version not registered" for a staging-org binding, and for comparing connector CSVs with Workato filebox versions. Not for building or publishing the connector itself (drip-implement-connector) or for reading Workato alone (datarails-connect-workato). Triggers - "validate the migration", "compare Workato vs connector", "parity check against Workato", "test the migration in the staging org", "test_workato_migration org", "are the connector files identical to Workato", "migration validation report".
 ---
 
 # Validate a Workato → DRIP migration in the staging org
@@ -39,7 +39,7 @@ and the access rules are in [reference/staging-orgs.md](reference/staging-orgs.m
 3. **Byte-identical is the only pass.** sha256 equal. Same values but different quoting,
    `-1` vs `-1.0` or CRLF vs LF is a **FAIL**: the connector must reproduce Workato's bytes.
 4. **Stop on mismatch.** Report and wait for the user. Don't edit, republish or re-sync on your own.
-5. `dr connectors` calls need VPN + `NODE_EXTRA_CA_CERTS` (see `datarails-connectors-onboard-connector`).
+5. `dr connectors` calls need VPN + `NODE_EXTRA_CA_CERTS` (see `drip-implement-connector`).
 6. Workato is **read-only**: GET only, via `datarails-connect-workato`.
 7. **Secrets never printed.** Credentials go from their source straight into the payload file in
    the same shell call, and the file is deleted afterwards.
@@ -165,6 +165,6 @@ Symptoms and fixes: [reference/gotchas.md](reference/gotchas.md).
 
 ## Related
 
-- `datarails-connectors-onboard-connector`: build, publish and wire the connector.
+- `drip-implement-connector`: build, publish and wire the connector.
 - `datarails-connect-workato`: recipes, connections, properties (GET only).
 - `dr-switch-user`: `dr login-as` details. `connector-sandbox`: local fix loop before a merge.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.138",
+  "version": "1.6.140",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {

package/scripts/postinstall.mjs

@@ -34,18 +34,12 @@
 // because npm aborts the entire install on a non-zero postinstall exit.
 // Failing to copy a skill shouldn't break the operator's install.
 //
-// Cleaning up removed skills: when a future release drops a skill that
-// previous releases shipped, add an explicit `rm` call here for the
-// orphaned `<home>/.claude/skills/<name>/` directory, kept for ~1–2
-// release cycles before being pruned. Example pattern:
-//
-//   import { rm } from 'node:fs/promises';
-//   import { join } from 'node:path';
-//   await rm(join(target, '.claude', 'skills', '<old-skill-name>'),
-//            { recursive: true, force: true });
-//
-// Files dropped *within* a surviving skill need no such call: each install records
-// a `.dr-cli-manifest.json` per skill and prunes what the previous one listed.
+// Cleaning up renamed or removed skills: add the old name to `RETIRED_SKILLS` in
+// src/commands/skill.ts. The `dr skill install` below then removes the copy an
+// earlier install wrote under `.claude/skills/<old>/` and `.gemini/skills/<old>/`,
+// on plugin-managed machines too. Files dropped *within* a surviving skill need
+// nothing: each install records a `.dr-cli-manifest.json` per skill and prunes
+// what the previous one listed.
 
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';