@datarails-ai/dr-cli 1.6.95 → 1.6.97

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.95",
+  "cliVersion": "1.6.97",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1795,6 +1795,26 @@
         }
       ]
     },
+    "integrations sftp create": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "write"
+        },
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
+    "integrations sftp provision": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "write"
+        }
+      ]
+    },
     "connectors publish": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",

package/dist/skills/dr-cli/SKILL.md

@@ -299,6 +299,7 @@ area's gotchas.
     reconnect before the next sync._
 - `integrations share users|groups`
 - `integrations it list|get|add|update|delete|resync` (IT-admin file-sync; redacts secrets by default)
+- `integrations sftp create|provision` — self-serve SFTP fileboxes: `create --name <n>` makes a filebox and its SFTP folder `/<name>_<id>` in one step; `provision <filebox_id>` does it for an existing filebox
 - `entities list|qbd-availability|netsuite-connections|rename|rename-group|delete|mark-completed` (alias `companies`)
 - `entities create qbo|xero|qbd|netsuite` (connected accounting systems)
 - `error-enrichments list|stats|get|create|update|delete|test-regex|export|import` — the

package/dist/skills/dr-cli/reference/integrations.md

@@ -34,6 +34,40 @@ secrets by default.
   `--set-config KEY=VAL`), `integrations it delete` (two-step confirm),
   `integrations it resync`.
 
+## Self-serve SFTP (`integrations sftp`)
+
+The embedded SFTP integration: each filebox gets its own folder in the org's SFTP
+container, and files dropped there land in the filebox.
+
+- `integrations sftp create --name <n> [flags]` creates an SFTP filebox in one step
+  (`--scenario`, `--date-sub-type`, `--parent`, `--no-date` as on `filebox create`).
+  `integrations sftp provision <filebox_id> [flags]` sets up SFTP on a filebox that
+  already exists. Both make the UI wizard's call,
+  `POST /api/v3/data_integrations/fileboxes/<id>/sftp/provision`, which creates the
+  folder `/<filebox name>_<filebox id>` (with a `.keep` file) and, for the org's
+  first SFTP filebox, the org's SFTP user and password.
+- The org is the logged-in account's org (`--server`, `--account`; `dr login-as` to
+  act as a customer). There is no org flag.
+- Give the client the printed **Folder** unchanged. An SFTP login opens inside the
+  org's container, so the container name is never part of the path. **Host** is the
+  bare hostname.
+- `--date-method filename|upload_date`. A date-tagged filebox defaults to
+  `upload_date`. `filename` also needs `--date-format` (one of the 10 formats the UI
+  offers) and `--date-position beginning|end`. `--backfill <n>` adds subfolders
+  `<folder>/-1` … `<folder>/-N` (`upload_date` only). A `--no-date` filebox takes none
+  of these flags.
+- Safe to re-run: no folder is duplicated, and flags left out keep their stored values.
+- The password is redacted unless `--show-secrets`, in `--json` output too. It is the
+  org's password: one SFTP user serves every SFTP filebox in the org, so revealing it
+  gives access to all of their folders.
+- Errors: 404 "not enabled" means the org's `integrations__sftp` flag is off. 403
+  means the account does not own the filebox, or is a viewer. 400 "already connected" means the
+  filebox is linked to another data source. 502 means the gateway is unavailable;
+  re-run. When `integrations sftp create` fails at the SFTP step, the filebox
+  already exists, so finish with `integrations sftp provision <id>`.
+- Do not copy SFTP settings from another filebox with `filebox data-query set`. That
+  links the filebox but creates no folder, so the client has nowhere to drop files.
+
 ## Entities — company data sources (`entities`, alias `companies`)
 
 The connected accounting systems (QuickBooks Online/Desktop, Xero, NetSuite) —

package/dist/skills/dr-cli/reference/reconciliation-mec.md

@@ -45,8 +45,8 @@ Account assignment / sign-off (all take the bank-account UUID via
   resets. Every account is checked before anything is written, and the
   write goes out in PATCHes of 100 accounts. If one fails, the error says
   how many accounts landed; re-run the same file without a token and the
-  new plan covers only the rest. Before each PATCH after the first, the
-  accounts are re-read; if any account in the next chunk is gone (a
+  new plan covers only the rest. Before each PATCH, the accounts are
+  re-read; if any account in the next chunk is gone (a
   trial-balance rebuild re-mints account ids) or its member slots changed
   since the plan, the run halts, says how many accounts landed, and names
   the drifted accounts. Gone accounts mean the file must be rebuilt from
@@ -55,6 +55,13 @@ Account assignment / sign-off (all take the bank-account UUID via
 - `reconciliation accounts clear-assignee <account_uuid> --date <YYYY-MM-DD>
   --type Preparer|Reviewer` — unassigns (preserves due_date, resets sign-off).
   Two-step confirm.
+- `reconciliation accounts clear-assignee --file <csv> --date <YYYY-MM-DD>` —
+  the bulk form. Header `account_id,type`, one row per (account, role); the
+  user columns of a set-assignee file are rejected, so a set-assignee
+  manifest cannot be passed here by mistake. One plan and one token cover the
+  whole file. Slots already Unassigned, and accounts with no member slots,
+  are skipped. Same 100-account PATCHes, per-chunk re-check, and resume
+  behaviour as `set-assignee --file`.
 - `reconciliation accounts set-due-date <account_uuid> --date <YYYY-MM-DD>
   --type Preparer|Reviewer (--due-date <YYYY-MM-DD> | --epoch <n> | --clear)`.
   Two-step confirm.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.95",
+  "version": "1.6.97",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.10.19",
+    "@datarails-ai/dr-appspace-cli": "0.10.20",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",