@datarails-ai/dr-cli 1.6.162 → 1.6.164

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.162",
+  "cliVersion": "1.6.164",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -4665,6 +4665,74 @@
         }
       ]
     },
+    "template-library list": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "template-library get": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "template-library add": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        },
+        {
+          "resource": "fileboxes",
+          "action": "read"
+        }
+      ]
+    },
+    "template-library update": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "destructive"
+        }
+      ]
+    },
+    "template-library publish": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "destructive"
+        }
+      ]
+    },
+    "template-library unpublish": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        }
+      ]
+    },
+    "template-library archive": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "destructive"
+        }
+      ]
+    },
+    "template-library restore": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        }
+      ]
+    },
     "calendars audit list": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -376,6 +376,10 @@ area's gotchas.
 - `multi-product product-content list`
 - `multi-product org-products list|set` — `set` has replace semantics; two-step confirm gated
 
+**Template Library catalog** → [reference/template-library.md](reference/template-library.md)
+- `template-library list|get` — every entry (published/draft/archived); `get` lists the tables and fields (system names) the file reads
+- Every write runs only as org `template.library-new` on `US`: `add <filebox_id>` (a filebox of that org), `update <id>` fills in description/type/industry/tags/`--image pink|purple|yellow`, `publish|unpublish|archive|restore <id>` — all two-step confirm with the token bound to the planned values, `publish` word-gated on prod
+
 **Legacy RH_CONFIG inspection (read-only)** → [reference/rh-config.md](reference/rh-config.md)
 - `rh_config config|tables|download <bucket-id>` — inspect / download the bucket's config workbook (the Excel with the `RH_Config` sheet that the legacy parser reads).
   - _`rh_config download` is broken (its endpoint rejects the JWT and it saves the login HTML page). Download instead with `filebox download <document> --doc-version <id>`, using `id` + `document` from `rh_config config <bucket-id> --json`._
@@ -686,6 +690,7 @@ Each also names the relevant Help Center (KB) folder for customer-facing docs.
 - [reference/cash.md](reference/cash.md) — Cash module
 - [reference/spend-control.md](reference/spend-control.md) — Spend Control module
 - [reference/multi-product.md](reference/multi-product.md) — product-content catalog + per-org assignment (replace-semantics PUT)
+- [reference/template-library.md](reference/template-library.md) — Template Library catalog: add, card metadata, image, publish/archive
 - [reference/desk.md](reference/desk.md) — Desk: outbound-email onboarding (SMTP app password + SendGrid domain auth) and ticket creation
 - [reference/rh-config.md](reference/rh-config.md) — legacy RH_CONFIG inspection (read-only)
 - [reference/admin.md](reference/admin.md) — users, orgs, devices, feature flags, semantic tables, fx, kb, mcp, skill

package/dist/skills/dr-cli/reference/template-library.md

@@ -0,0 +1,81 @@
+# `dr template-library` — the Template Library catalog
+
+The Template Library (left nav → Template Library, `/templates-library`) is a
+server-wide catalog of best-practice fileboxes customers can import. Each entry
+points at a filebox in the **source org** and carries the card a customer sees:
+description, report type, industry, tags and image. The admin screen behind it
+is Library management, `api/report_library/management`.
+
+**Source org:** every write (`add`, `update`, `publish`, `unpublish`, `archive`,
+`restore`) runs only as org `template.library-new` on `US`. The commands check the
+identity's JWT (`organization_domain`) and the server, and refuse anything else
+before sending a request. The server itself accepts these writes from any
+authenticated user, so this check is the only guard today. Work as that org:
+
+```
+dr login-as support@template.library-new --server US
+```
+
+## Subcommands
+
+All take `--server` and `--account`. Every write is a two-step confirm: the first
+run prints the plan (old -> new values) and a token, the second run with
+`--confirm-token` applies it. The token is bound to the server, account and values
+planned: changing a flag, the image, or the content of `--description-file`
+between the two runs voids it.
+
+- `list [--status all|published|draft|archived] [--json]` — every entry with
+  its filebox, status, type, industry, image (`pink|purple|yellow|custom|none`)
+  and download count. → `GET /api/report_library/management`
+- `get <id> [--json]` — one entry, plus the tables and fields its file reads with
+  their system names (`Financials {financials}`, `Amount {amount}`). These are what
+  a customer's import must map. There is no per-id GET; this filters the list.
+- `add <filebox_id> [card flags]` — register a filebox as a **draft** entry. The
+  filebox must be in the org's own filebox list (the server would accept any org's
+  id, a filebox shared from another org included, so `add` checks it first and shows
+  its file name in the plan). Posts
+  `{document_id}` (exactly what the UI's "Add to template library" sends), then
+  writes any card flags with the update call; if that second step fails, the error
+  names the new entry so you can finish it with `update`. The server maps the file's tables
+  and fields in the background; check with `get` a little later. Refuses a
+  filebox that is already an entry. → `GET /api/documents/v2`, `GET /api/documents/<id>/versions/latestid` (+ the
+  version, for the file name), `POST …/management`, `PUT …/management/<id>`
+- `update <id> [card flags] [--creator <user_id>]` — fill in or change the card.
+  Only the flags you pass are sent. `--creator` must be one of the org's users
+  (`GET /api/organizations/contacts`, the UI picker's list). Editing a **published** entry changes the card
+  every customer org sees, so it is Tier A like `publish` (a token planned while the
+  entry was a draft does not confirm it). → `PUT /api/report_library/management/<id>`
+- `publish <id> [--image <color>]` — offer the entry to every customer org on the
+  server. Refused when archived or when it has no image (pass `--image`). Warns
+  about an empty description, type, industry or tags. Tier A: on production it
+  also needs the word typed in the confirmation dialog.
+- `unpublish <id>`, `archive <id>` (refused while published), `restore <id>`. A change
+  to the state an entry is already in (publishing a published entry, restoring one
+  that is not archived) is refused rather than confirmed as a no-op.
+
+`update` and the state commands refuse an entry whose `domain` is not
+`template.library-new`: the server would change another org's entry by id.
+
+Card flags (`add` and `update`):
+
+| Flag | Field | Notes |
+| --- | --- | --- |
+| `--description <text>` / `--description-file <path>` | `description` | one or the other; the file at most 64 KiB |
+| `--type <text>` | `report_type` | in use: Financial Planning, Financial Reporting, Headcount Planning, Strategic Reporting; at most 100 characters |
+| `--industry <text>` | `industry` | `General` for cross-industry; at most 100 characters |
+| `--tags <csv>` | `tags` | replaces the list (duplicates dropped); `""` clears it |
+| `--image pink\|purple\|yellow` | `report_image` | multipart upload of the bundled library image; no other image is accepted |
+
+## Typical flow
+
+```
+dr template-library add 626287 --server US --account support@template.library-new \
+  --type "Financial Reporting" --industry Construction \
+  --tags "WIP, Job Costing, Backlog" --description-file card.txt --image purple
+# re-run with the printed --confirm-token
+dr template-library get <new id> --server US --account support@template.library-new
+dr template-library publish <new id> --server US --account support@template.library-new
+```
+
+Before publishing, check that `get` lists every table and field the file uses with a
+system name: a field without one cannot be mapped during a customer's import.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.162",
+  "version": "1.6.164",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.30",
+    "@datarails-ai/dr-appspace-cli": "0.12.32",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",