@datarails-ai/dr-cli 1.6.147 → 1.6.149

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.147",
+  "cliVersion": "1.6.149",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1724,6 +1724,10 @@
         {
           "resource": "fileboxes",
           "action": "write"
+        },
+        {
+          "resource": "tables",
+          "action": "read"
         }
       ]
     },
@@ -1732,6 +1736,10 @@
         {
           "resource": "fileboxes",
           "action": "write"
+        },
+        {
+          "resource": "tables",
+          "action": "read"
         }
       ]
     },
@@ -1740,6 +1748,10 @@
         {
           "resource": "fileboxes",
           "action": "write"
+        },
+        {
+          "resource": "tables",
+          "action": "read"
         }
       ]
     },
@@ -1971,190 +1983,198 @@
         }
       ]
     },
+    "integrations escalation-report": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "read"
+        }
+      ]
+    },
     "connectors publish": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors query repoint": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors query create": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors query list": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors query delete": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors connector create": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors artifact deregister": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors promote": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors binding get": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors sync cancel": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors active get": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors dev-fetch": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll enable": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll set": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll disable": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll get": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll run": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll resume": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll items": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll retry": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll skip": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors poll seed": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks create": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks list": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks get": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks update": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks delete": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks run": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks pause": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks resume": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "connectors tasks runs": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
-        "until": "DR-53511"
+        "until": "DR-56164"
       }
     },
     "filebox list": {
@@ -3845,10 +3865,6 @@
     },
     "entities mark-completed": {
       "requires": [
-        {
-          "resource": "integrations",
-          "action": "write"
-        },
         {
           "resource": "fileboxes",
           "action": "write"

package/dist/skills/dr-cli/SKILL.md

@@ -326,6 +326,7 @@ area's gotchas.
 - `integrations it list|get|add|update|delete|resync` (IT-admin file-sync; redacts secrets by default)
 - `integrations sftp create|provision` — self-serve SFTP fileboxes: `create --name <n>` makes a filebox and its SFTP folder `/<name>_<id>` in one step; `provision <filebox_id>` does it for an existing filebox
 - `integrations netsuite readiness|saved-search-sql` — NetSuite 3.0 -> SuiteQL migration: `readiness <id> [--dry-run]` probes the bundle and, on CONFIRMED, stamps `bundle_version` 3 (two-step confirm); `saved-search-sql <id> --saved-search <ssid> [--out <file>]` prints a saved search's SQL and its library match
+- `integrations escalation-report [--server <key> | --servers A,B | --all-servers] [--out <file.html>] [--json]` — staff only: paused data sources and fileboxes, auth-error email funnel and recovery as one HTML page
 - `entities list|qbd-availability|netsuite-connections|rename|rename-group|delete|mark-completed` (alias `companies`)
 - `entities create qbo|xero|qbd|netsuite` (connected accounting systems)
 - `error-enrichments list|stats|get|create|update|delete|test-regex|export|import|types list|types create` — the
@@ -600,6 +601,11 @@ network traffic or hand-edits JSON. Full recipes in the relevant reference file.
   `[M].SHIFT(...)` / `[M].AS_OF(...)` — SHIFT unit `consumption_period`
   follows the query grain; `PERIODS_IN_YEAR` metrics reject day-grain
   queries. See reference/metrics.md.
+- **Metric `--format`** (`metrics create base|calc`, `metrics update`) accepts
+  only what the web app's Format editor produces: `[$ € £ ₪]` + `#,###`|`####`
+  + `[.# … .####]` + `[[kilo]k|[mega]M]` + `[%]` (no currency with `%`).
+  Single-quote it (`'$#,###.##'`); there is no empty format — reset with
+  `'#,###'`. See reference/metrics.md.
 - **`metrics data --agg`** is `DEFAULT|MTD|QTD|YTD|MTG|QTG|YTG`. The `*TG` "to
   go" values accumulate **forward** from the current bucket (inclusive) to the
   period end — the mirror of `*TD`. See reference/metrics.md.

package/dist/skills/dr-cli/reference/integrations.md

@@ -136,6 +136,25 @@ is the NetSuite connection (data integration) id, not a filebox id.
   call failed, or the translated SQL is over the 100,000-character custom-report cap;
   the detail says which.
 
+## Auth-error escalation report (`integrations escalation-report`)
+
+Staff only (Datarails admins and the Integrations Team); anyone else gets a 403.
+
+- `integrations escalation-report --server <key> --out <file.html>` writes one
+  self-contained HTML page: KPI cards and a By region table (one row per server plus a
+  total that matches the cards) at the top, then data sources paused now (by vendor,
+  server and age, plus the ones paused over 30 days for Customer Success), paused
+  fileboxes and filebox-days paused (a proxy for syncs not run), the auth-error email
+  funnel with recovery between emails, and recovery after a pause (per ISO week, by
+  trigger, time paused, repeat pausers). Without `--out` the page goes to stdout.
+- `--servers A,B` or `--all-servers` (production servers; `--include-test` adds the
+  rest) merge every server into one page. A server without a stored login is skipped. A
+  server that fails, e.g. `Audit events are unavailable on <key>` (a 502), is listed on
+  the page; the page is still written and the command then exits non-zero.
+- `--json` prints the merged raw data (every row tagged with its `server`) instead.
+- Event history covers the audit retention window (~90 days). Refused sync attempts are
+  on the Groundcover board.
+
 ## Entities — company data sources (`entities`, alias `companies`)
 
 The connected accounting systems (QuickBooks Online/Desktop, Xero, NetSuite) —
@@ -150,7 +169,7 @@ i.e. integration data sources at the company level.
 - `entities rename <doc_ids> --alias <s>` (CSV doc ids),
   `entities rename-group <doc_ids> --group <s>` (move into a group).
 - `entities delete <doc_ids>` — two-step confirm.
-- `entities mark-completed <doc_id>` — IT-support override for a stuck state.
+- `entities mark-completed <doc_id>` — clears the document's stale export-error badge; it marks nothing completed and does not touch sync state.
 
 ## Customer-facing docs (KB)
 

package/dist/skills/dr-cli/reference/metrics.md

@@ -92,13 +92,41 @@ Required: `--name`, `--template <id>`, `--value-field <id>`, `--date-field <id>`
 - No `--time-aggregation` — a CALC rollup inherits time-aggregation from each
   referenced BASE, so a single CALC-level value would be meaningless.
 
+## Display format (`--format`)
+
+`metrics create base`, `metrics create calc` and `metrics update <id>` take
+`--format '<f>'`, stored at `configuration.format` (the FORMAT column of
+`metrics list`). Only the strings the web app's metric Format editor can
+produce are accepted; anything else is rejected before any request. Build it
+from these parts, in this order:
+
+| Part | Values |
+|------|--------|
+| currency prefix (optional) | `$` `€` `£` `₪` |
+| digits | `#,###` (thousands separator) or `####` |
+| decimals (optional) | `.#` `.##` `.###` `.####` |
+| scale (optional) | `[kilo]k` (thousands) or `[mega]M` (millions) |
+| percent suffix (optional) | `%` — never together with a currency |
+
+- Examples: `'#,###'`, `'$#,###.##'`, `'€####[mega]M'`, `'####.#%'`.
+- Always single-quote the value: an unquoted `#` starts a shell comment.
+- `$` is stored quoted, as the editor stores it: `$#,###` is saved (and shown
+  in FORMAT) as `"$"#,###`. Both spellings are accepted on input.
+- Excel-style `0` placeholders (`#,##0.00`) and anything else outside the
+  table are rejected; the error suggests the `#` spelling when there is one.
+- There is no empty format. The editor's default is `#,###`; to reset a
+  metric, pass `--format '#,###'`.
+- On `update`, the CLI reads the metric first and sends its configuration back
+  with only `format` changed, so a CALC formula is left exactly as stored.
+
 ## Update / delete
 
 - `metrics update <id>` — partial PATCH. Flags: `--name`, `--description`,
   `--category`, `--dimensions`, `--hide`/`--unhide`, `--time-aggregation`,
   `--aggregator`, `--template`, `--value-field`, `--date-field`, `--filter`,
-  `--exclude-filter`, `--clear-filters`. `--description ""` clears to `null` on
-  the wire (matching how `get` round-trips an untouched field).
+  `--exclude-filter`, `--clear-filters`, `--format` (see above).
+  `--description ""` clears to `null` on the wire (matching how `get`
+  round-trips an untouched field).
   - **No `--formula`** — CALC formulas and other create-time fields (kind,
     template, value/date field, aggregator) are intentionally not editable in
     place; changing them yields a different metric. To fix a formula:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.147",
+  "version": "1.6.149",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.19",
+    "@datarails-ai/dr-appspace-cli": "0.12.20",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",