@graphit/cli 0.2.356 → 0.2.357
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +3 -3
- package/.claude-plugin/plugin.json +1 -1
- package/.codex-plugin/plugin.json +1 -1
- package/bin/graphit +1 -1
- package/bin/graphit.ps1 +1 -1
- package/dist/commands/governance.d.ts +2 -0
- package/dist/commands/governance.js +79 -0
- package/dist/commands/governance.js.map +1 -1
- package/package.json +1 -1
- package/scripts/verb-policy-source.json +24 -0
- package/skills/graphit/SKILL.md +7 -3
- package/skills/graphit/VERSION.json +1 -1
- package/skills/graphit/references/governance.md +10 -0
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
},
|
|
8
8
|
"metadata": {
|
|
9
9
|
"description": "Graphit CLI plugin for AI coding assistants",
|
|
10
|
-
"version": "0.2.
|
|
10
|
+
"version": "0.2.357"
|
|
11
11
|
},
|
|
12
12
|
"plugins": [
|
|
13
13
|
{
|
|
@@ -16,9 +16,9 @@
|
|
|
16
16
|
"source": {
|
|
17
17
|
"source": "npm",
|
|
18
18
|
"package": "@graphit/cli",
|
|
19
|
-
"version": "0.2.
|
|
19
|
+
"version": "0.2.357"
|
|
20
20
|
},
|
|
21
|
-
"version": "0.2.
|
|
21
|
+
"version": "0.2.357",
|
|
22
22
|
"category": "data-visualization",
|
|
23
23
|
"tags": [
|
|
24
24
|
"bi",
|
package/bin/graphit
CHANGED
|
@@ -14,7 +14,7 @@ if [ -z "${GRAPHIT_PLUGIN_ROOT:-}" ]; then
|
|
|
14
14
|
fi
|
|
15
15
|
|
|
16
16
|
# graphit:floor (stamped by scripts/sync-plugin-version.mjs from cli/package.json)
|
|
17
|
-
FLOOR_VERSION="0.2.
|
|
17
|
+
FLOOR_VERSION="0.2.357"
|
|
18
18
|
|
|
19
19
|
PACKAGE_NAME="@graphit/cli"
|
|
20
20
|
# Strict semver: anything else is rejected so a tampered cache cannot inject.
|
package/bin/graphit.ps1
CHANGED
|
@@ -7,7 +7,7 @@ if (-not $env:GRAPHIT_PLUGIN_ROOT) {
|
|
|
7
7
|
}
|
|
8
8
|
|
|
9
9
|
# graphit:floor (stamped by scripts/sync-plugin-version.mjs from cli/package.json)
|
|
10
|
-
$FloorVersion = "0.2.
|
|
10
|
+
$FloorVersion = "0.2.357"
|
|
11
11
|
|
|
12
12
|
$PackageName = "@graphit/cli"
|
|
13
13
|
# Strict semver: anything else is rejected so a tampered cache cannot inject.
|
|
@@ -1,2 +1,4 @@
|
|
|
1
1
|
import { Command } from "commander";
|
|
2
|
+
/** Read the bounded owner authorization body without accepting arbitrary JSON. */
|
|
3
|
+
export declare function parseNumericAuthorizationFile(path: string): Record<string, unknown>;
|
|
2
4
|
export declare function registerGovernanceCommands(program: Command): void;
|
|
@@ -1,5 +1,36 @@
|
|
|
1
|
+
import { readFileSync, statSync } from "node:fs";
|
|
1
2
|
import { apiClient } from "../api/client.js";
|
|
2
3
|
import { output, errorOutput, note } from "../output/format.js";
|
|
4
|
+
const NUMERIC_AUTHORIZATION_MAX_FILE_KIB = 64;
|
|
5
|
+
const NUMERIC_AUTHORIZATION_MAX_FILE_BYTES = NUMERIC_AUTHORIZATION_MAX_FILE_KIB * 1024;
|
|
6
|
+
/** Read the bounded owner authorization body without accepting arbitrary JSON. */
|
|
7
|
+
export function parseNumericAuthorizationFile(path) {
|
|
8
|
+
if (statSync(path).size > NUMERIC_AUTHORIZATION_MAX_FILE_BYTES) {
|
|
9
|
+
throw new Error(`Numeric authorization file exceeds the ${NUMERIC_AUTHORIZATION_MAX_FILE_KIB} KiB limit`);
|
|
10
|
+
}
|
|
11
|
+
const raw = readFileSync(path, "utf-8");
|
|
12
|
+
let parsed;
|
|
13
|
+
try {
|
|
14
|
+
parsed = JSON.parse(raw);
|
|
15
|
+
}
|
|
16
|
+
catch {
|
|
17
|
+
// A malformed file is the caller's input, never a CLI defect: a raw
|
|
18
|
+
// SyntaxError would be framed as one by errorOutput.
|
|
19
|
+
throw new Error("Numeric authorization file is not valid JSON");
|
|
20
|
+
}
|
|
21
|
+
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
|
|
22
|
+
throw new Error("Numeric authorization file must contain a JSON object");
|
|
23
|
+
}
|
|
24
|
+
return parsed;
|
|
25
|
+
}
|
|
26
|
+
function parseRevision(raw) {
|
|
27
|
+
if (!/^\d+$/.test(raw))
|
|
28
|
+
throw new Error("--revision must be a non-negative integer");
|
|
29
|
+
const revision = Number(raw);
|
|
30
|
+
if (!Number.isSafeInteger(revision))
|
|
31
|
+
throw new Error("--revision is outside the supported integer range");
|
|
32
|
+
return revision;
|
|
33
|
+
}
|
|
3
34
|
export function registerGovernanceCommands(program) {
|
|
4
35
|
const gov = program.command("governance").description("Query governance management");
|
|
5
36
|
gov
|
|
@@ -61,5 +92,53 @@ export function registerGovernanceCommands(program) {
|
|
|
61
92
|
errorOutput(err);
|
|
62
93
|
}
|
|
63
94
|
});
|
|
95
|
+
const numeric = gov
|
|
96
|
+
.command("numeric")
|
|
97
|
+
.description("Inspect or override the numeric rollup authorization of a data source");
|
|
98
|
+
numeric
|
|
99
|
+
.command("show")
|
|
100
|
+
.description("Show the numeric authorization in force for a data source (platform default or admin override)")
|
|
101
|
+
.requiredOption("--source <id>", "Data source id")
|
|
102
|
+
.action(async function () {
|
|
103
|
+
try {
|
|
104
|
+
const { source } = this.opts();
|
|
105
|
+
const resp = await apiClient.get(`/api/v1/cli/governance/numeric/${encodeURIComponent(source)}`);
|
|
106
|
+
output(this, resp, { keyValue: true });
|
|
107
|
+
}
|
|
108
|
+
catch (err) {
|
|
109
|
+
errorOutput(err);
|
|
110
|
+
}
|
|
111
|
+
});
|
|
112
|
+
numeric
|
|
113
|
+
.command("grant")
|
|
114
|
+
.description("Override the platform default numeric authorization for a data source from a JSON file")
|
|
115
|
+
.requiredOption("--source <id>", "Data source id")
|
|
116
|
+
.requiredOption("--file <path>", "JSON authorization body")
|
|
117
|
+
.action(async function () {
|
|
118
|
+
try {
|
|
119
|
+
const { source, file } = this.opts();
|
|
120
|
+
const resp = await apiClient.put(`/api/v1/cli/governance/numeric/${encodeURIComponent(source)}`, parseNumericAuthorizationFile(file));
|
|
121
|
+
output(this, resp, { keyValue: true });
|
|
122
|
+
}
|
|
123
|
+
catch (err) {
|
|
124
|
+
errorOutput(err);
|
|
125
|
+
}
|
|
126
|
+
});
|
|
127
|
+
numeric
|
|
128
|
+
.command("revoke")
|
|
129
|
+
.description("Switch rollup acceleration off for a data source by revoking its numeric authorization")
|
|
130
|
+
.requiredOption("--source <id>", "Data source id")
|
|
131
|
+
.requiredOption("--revision <n>", "Expected authorization revision")
|
|
132
|
+
.action(async function () {
|
|
133
|
+
try {
|
|
134
|
+
const { source, revision: rawRevision } = this.opts();
|
|
135
|
+
const revision = parseRevision(rawRevision);
|
|
136
|
+
const resp = await apiClient.delete(`/api/v1/cli/governance/numeric/${encodeURIComponent(source)}?expected_revision=${revision}`);
|
|
137
|
+
output(this, resp, { keyValue: true });
|
|
138
|
+
}
|
|
139
|
+
catch (err) {
|
|
140
|
+
errorOutput(err);
|
|
141
|
+
}
|
|
142
|
+
});
|
|
64
143
|
}
|
|
65
144
|
//# sourceMappingURL=governance.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/commands/governance.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/commands/governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAC9C,MAAM,oCAAoC,GAAG,kCAAkC,GAAG,IAAI,CAAC;AAEvF,kFAAkF;AAClF,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,oCAAoC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,kCAAkC,YAAY,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC1G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAErF,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAC9B,+BAA+B,CAChC,CAAC;YACF,wEAAwE;YACxE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,gBAAgB;gBAAE,IAAI,CAAC,qBAAqB,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,cAAyC,CAAC;YAC5D,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAC7B,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,eAAe,EAAE,mDAAmD,EAAE,GAAG,CAAC;SACjF,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;SAC9C,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;SACrF,MAAM,CAAC,aAAa,EAAE,0CAA0C,EAAE,IAAI,CAAC;SACvE,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAC9B,gCAAgC,MAAM,EAAE,CACzC,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAmC,CAAC;YACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjB,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;gBACnB,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uEAAuE,CAAC,CAAC;IAExF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gGAAgG,CAAC;SAC7G,cAAc,CAAC,eAAe,EAAE,gBAAgB,CAAC;SACjD,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAsB,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAC9B,kCAAkC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,wFAAwF,CAAC;SACrG,cAAc,CAAC,eAAe,EAAE,gBAAgB,CAAC;SACjD,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,EAAoC,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAC9B,kCAAkC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAC9D,6BAA6B,CAAC,IAAI,CAAC,CACpC,CAAC;YACF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wFAAwF,CAAC;SACrG,cAAc,CAAC,eAAe,EAAE,gBAAgB,CAAC;SACjD,cAAc,CAAC,gBAAgB,EAAE,iCAAiC,CAAC;SACnE,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,EAAwC,CAAC;YAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CACjC,kCAAkC,kBAAkB,CAAC,MAAM,CAAC,sBAAsB,QAAQ,EAAE,CAC7F,CAAC;YACF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
|
package/package.json
CHANGED
|
@@ -686,6 +686,30 @@
|
|
|
686
686
|
"requires_approval": false,
|
|
687
687
|
"silent_retry_exempt": false
|
|
688
688
|
},
|
|
689
|
+
"governance numeric show": {
|
|
690
|
+
"surface": "cli_only",
|
|
691
|
+
"is_read_only": true,
|
|
692
|
+
"mutation_class": "none",
|
|
693
|
+
"requires_approval": false,
|
|
694
|
+
"silent_retry_exempt": true,
|
|
695
|
+
"reason": "Operator read for the admin who overrides a source's numeric rollup contract: it shows the authorization in force (the platform default or their override) plus the exact query-family and schema/runtime identities an override file must name. Those identities only mean something next to the override file on the admin's disk. An in-app turn has no such file and never explains why a graph was or was not accelerated through this surface - acceleration is silent and the ordinary path always answers."
|
|
696
|
+
},
|
|
697
|
+
"governance numeric grant": {
|
|
698
|
+
"surface": "cli_only",
|
|
699
|
+
"is_read_only": false,
|
|
700
|
+
"mutation_class": "governance",
|
|
701
|
+
"requires_approval": true,
|
|
702
|
+
"silent_retry_exempt": true,
|
|
703
|
+
"reason": "Replaces the platform default numeric contract for one data source with the org admin's own (tighter error limits, fewer finalizers or families, an expiry). Nobody needs this to get acceleration. The body is a reviewed JSON file on the admin's disk, and the override is the admin's own decision, not something an in-app agent turn should draft or submit on their behalf."
|
|
704
|
+
},
|
|
705
|
+
"governance numeric revoke": {
|
|
706
|
+
"surface": "cli_only",
|
|
707
|
+
"is_read_only": false,
|
|
708
|
+
"mutation_class": "governance",
|
|
709
|
+
"requires_approval": true,
|
|
710
|
+
"silent_retry_exempt": true,
|
|
711
|
+
"reason": "The off switch for one source's rollup acceleration: compare-and-set on the revision the admin read with show (0 for the platform default). It stays on the surface that installs overrides so switching acceleration off is never an in-app side effect of a data question."
|
|
712
|
+
},
|
|
689
713
|
"team list": {
|
|
690
714
|
"surface": "cli_only",
|
|
691
715
|
"is_read_only": true,
|
package/skills/graphit/SKILL.md
CHANGED
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
name: graphit
|
|
3
3
|
description: >-
|
|
4
4
|
Use Graphit for ANY question about the user's business or product data: metrics, KPIs, revenue, retention, spend, users, cohorts, funnels, trends, comparisons, "why did X change", "how are we doing on Y", analysis, reports, or dashboards. Activate even when the user does not say "Graphit" or name any tool: if someone wants to understand their numbers, this is the tool. Graphit answers through a governed semantic layer (computed the team's way, reusable and safe to share) and delivers the answer as a fast cached-data query or a hand-authored interactive HTML dashboard, and can create the metrics, dimensions, and rules an answer needs. Prefer Graphit over hand-rolled one-off analysis whenever the data is, or could be, the user's business data. Skip only for pure software tasks (code, logs, config, infra) or data with nothing to do with the user's business.
|
|
5
|
-
skill_version: "0.2.
|
|
5
|
+
skill_version: "0.2.357"
|
|
6
6
|
---
|
|
7
7
|
|
|
8
|
-
<!-- SIZE EXEMPTION (SKILL.md): hard limit 12,288 chars, exempted ceiling 34,
|
|
8
|
+
<!-- SIZE EXEMPTION (SKILL.md): hard limit 12,288 chars, exempted ceiling 34,560. Reviewed 2026-09-17. Always-loaded: the collaboration/pace spine, hard constraints + scope gate, the loop, and the generated command table (COMMANDS markers; cli/scripts/generate-commands-doc.mjs) - needed every turn, not deferrable. Marker sits after the frontmatter so the loader and sync-plugin-version.mjs parse it. Raises pay only for command-table growth; each is recorded in docs/knowledge/prompt-engineering/sizing/SIZING.md, prose changes in docs/workflow/prompt-changes/INDEX.md. -->
|
|
9
9
|
|
|
10
10
|
# Graphit CLI
|
|
11
11
|
|
|
@@ -151,6 +151,7 @@ Load only the relevant reference. Check `graphit <command> --help` for flags.
|
|
|
151
151
|
| a business-knowledge, schema, ERD, or data-dictionary document should inform semantic definitions | attached-docs.md |
|
|
152
152
|
| data-source refresh modes, incremental settings, or reconciliation | data-source-refresh.md |
|
|
153
153
|
| writing or validating a query | sql-reference.md, governance.md |
|
|
154
|
+
| rollup acceleration for a data source: inspect, switch off, override | governance.md |
|
|
154
155
|
| a user is confused about governance itself - what governed means, why a query was blocked, how it works | governance-explained.md |
|
|
155
156
|
| creating, designing and rendering a dashboard | dashboard-create.md, dashboard-planning.md, chart-selection.md, chart-patterns.md, graphit-style.md, runtime.md, kpi.md, table.md |
|
|
156
157
|
| adding interactivity (filters, parameters, saved views) | filters.md, filters-advanced.md, state-contract.md |
|
|
@@ -165,7 +166,7 @@ Load only the relevant reference. Check `graphit <command> --help` for flags.
|
|
|
165
166
|
|
|
166
167
|
## Commands
|
|
167
168
|
|
|
168
|
-
Claude Code supplies the `graphit` wrapper. On Codex, Cursor, terminals and CI, use `npx -y @graphit/cli@0.2.
|
|
169
|
+
Claude Code supplies the `graphit` wrapper. On Codex, Cursor, terminals and CI, use `npx -y @graphit/cli@0.2.357 <command>`; pin a version for reproducibility. The table is generated from the CLI; check command help for exact flags.
|
|
169
170
|
|
|
170
171
|
<!-- COMMANDS:START -->
|
|
171
172
|
|
|
@@ -271,6 +272,9 @@ _Generated by `npm run gen:commands`; do not hand-edit between the markers._
|
|
|
271
272
|
**governance** - Query governance management
|
|
272
273
|
- `governance status` - Show governance conformance summary
|
|
273
274
|
- `governance audit` - Query the governance audit log - `--last --tier --user --channel --limit`
|
|
275
|
+
- `governance numeric show` - Show the numeric authorization in force for a data source (platform default or admin override) - `--source`
|
|
276
|
+
- `governance numeric grant` - Override the platform default numeric authorization for a data source from a JSON file - `--source --file`
|
|
277
|
+
- `governance numeric revoke` - Switch rollup acceleration off for a data source by revoking its numeric authorization - `--source --revision`
|
|
274
278
|
|
|
275
279
|
**team** - Team management
|
|
276
280
|
- `team list` - List teams you belong to (org admins see all teams)
|
|
@@ -35,3 +35,13 @@ Search the KB genuinely, explain why visible definitions do not fit, and prefer
|
|
|
35
35
|
## Reporting
|
|
36
36
|
|
|
37
37
|
Report tier, semantic references, row cap, visible rules that changed the query, and any refusal or override. Read the receipt rather than inferring. A blocked or partial result is not success.
|
|
38
|
+
|
|
39
|
+
## Numeric rollup authorization
|
|
40
|
+
|
|
41
|
+
Org admins only, and never required. Every prepared data source carries the platform default numeric contract, so prepared rollups may answer governed queries with nothing installed. The server measures each exact query against the source before serving it, renews that evidence on its own after data refreshes and expiry, and sends anything outside the contract down the ordinary path. Acceleration is silent; never claim a result came from a rollup.
|
|
42
|
+
|
|
43
|
+
- `governance numeric show --source <id>` - the contract in force plus the query families, schema fingerprint and compiler/runtime versions an override must name. Acceleration is on only while `status` is `active`; a revoked record still says `platform_default: true`, so read `status` and `revision`, never that flag.
|
|
44
|
+
- `governance numeric revoke --source <id> --revision <n>` - switch acceleration off for one source; `n` is the revision `show` returned (0 for the platform default). Serving stops at the next request. There is no un-revoke: only a later `grant` quoting the revoked revision turns acceleration back on, so confirm with the admin before running it.
|
|
45
|
+
- `governance numeric grant --source <id> --file override.json` - replace the default for one source with tighter bounds. Body: `expected_revision`, `schema_fingerprint`, `compiler_version`, `runtime_version`, `query_families` (only families listed by `show`), `mode` (`exact` or `scoped_float`), `allowed_finalizers`, `absolute_error_limit` and `relative_error_limit` (required for `scoped_float`; both caps are enforced independently), `evidence_ttl_seconds`, `expires_at`, `reason`.
|
|
46
|
+
|
|
47
|
+
Never invent error limits for the admin: report what `show` returns and let them decide whether an override is wanted at all.
|