@datarails-ai/dr-cli 1.6.146 → 1.6.148

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.146",
+  "cliVersion": "1.6.148",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1971,6 +1971,14 @@
         }
       ]
     },
+    "integrations escalation-report": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "read"
+        }
+      ]
+    },
     "connectors publish": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",

package/dist/skills/dr-cli/SKILL.md

@@ -326,6 +326,7 @@ area's gotchas.
 - `integrations it list|get|add|update|delete|resync` (IT-admin file-sync; redacts secrets by default)
 - `integrations sftp create|provision` — self-serve SFTP fileboxes: `create --name <n>` makes a filebox and its SFTP folder `/<name>_<id>` in one step; `provision <filebox_id>` does it for an existing filebox
 - `integrations netsuite readiness|saved-search-sql` — NetSuite 3.0 -> SuiteQL migration: `readiness <id> [--dry-run]` probes the bundle and, on CONFIRMED, stamps `bundle_version` 3 (two-step confirm); `saved-search-sql <id> --saved-search <ssid> [--out <file>]` prints a saved search's SQL and its library match
+- `integrations escalation-report [--server <key> | --servers A,B | --all-servers] [--out <file.html>] [--json]` — staff only: paused data sources and fileboxes, auth-error email funnel and recovery as one HTML page
 - `entities list|qbd-availability|netsuite-connections|rename|rename-group|delete|mark-completed` (alias `companies`)
 - `entities create qbo|xero|qbd|netsuite` (connected accounting systems)
 - `error-enrichments list|stats|get|create|update|delete|test-regex|export|import|types list|types create` — the

package/dist/skills/dr-cli/reference/integrations.md

@@ -136,6 +136,25 @@ is the NetSuite connection (data integration) id, not a filebox id.
   call failed, or the translated SQL is over the 100,000-character custom-report cap;
   the detail says which.
 
+## Auth-error escalation report (`integrations escalation-report`)
+
+Staff only (Datarails admins and the Integrations Team); anyone else gets a 403.
+
+- `integrations escalation-report --server <key> --out <file.html>` writes one
+  self-contained HTML page: KPI cards and a By region table (one row per server plus a
+  total that matches the cards) at the top, then data sources paused now (by vendor,
+  server and age, plus the ones paused over 30 days for Customer Success), paused
+  fileboxes and filebox-days paused (a proxy for syncs not run), the auth-error email
+  funnel with recovery between emails, and recovery after a pause (per ISO week, by
+  trigger, time paused, repeat pausers). Without `--out` the page goes to stdout.
+- `--servers A,B` or `--all-servers` (production servers; `--include-test` adds the
+  rest) merge every server into one page. A server without a stored login is skipped. A
+  server that fails, e.g. `Audit events are unavailable on <key>` (a 502), is listed on
+  the page; the page is still written and the command then exits non-zero.
+- `--json` prints the merged raw data (every row tagged with its `server`) instead.
+- Event history covers the audit retention window (~90 days). Refused sync attempts are
+  on the Groundcover board.
+
 ## Entities — company data sources (`entities`, alias `companies`)
 
 The connected accounting systems (QuickBooks Online/Desktop, Xero, NetSuite) —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.146",
+  "version": "1.6.148",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.18",
+    "@datarails-ai/dr-appspace-cli": "0.12.20",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",