steve-cli 0.5.6__tar.gz → 1.0.2__tar.gz

{steve_cli-0.5.6 → steve_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steve-cli
-Version: 0.5.6
+Version: 1.0.2
 Summary: A simple CLI tool to run jobs from jobs.yaml with proper environment setup
 Author: Frank
 License: MIT
@@ -67,6 +67,8 @@ Requires-Dist: visidata>=3.0; extra == "all"
 
 A CLI tool for the data platform. Commands are organized by concern: general workspace automation, data lakehouse operations, semantic knowledge graphs, and governance.
 
+> **Upgrading from 0.x?** See [CHANGELOG.md](./CHANGELOG.md) — v1.0.0 introduces branch-isolated storage with breaking path changes that require a one-time data migration.
+
 ## Installation
 
 ```bash

{steve_cli-0.5.6 → steve_cli-1.0.2}/README.md

@@ -2,6 +2,8 @@
 
 A CLI tool for the data platform. Commands are organized by concern: general workspace automation, data lakehouse operations, semantic knowledge graphs, and governance.
 
+> **Upgrading from 0.x?** See [CHANGELOG.md](./CHANGELOG.md) — v1.0.0 introduces branch-isolated storage with breaking path changes that require a one-time data migration.
+
 ## Installation
 
 ```bash

{steve_cli-0.5.6 → steve_cli-1.0.2}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "steve-cli"
-version = "0.5.6"
+version = "1.0.2"
 description = "A simple CLI tool to run jobs from jobs.yaml with proper environment setup"
 readme = "README.md"
 license = {text = "MIT"}

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli/auth.py

@@ -21,6 +21,8 @@ def save_credentials(
     token: str,
     base_url: Optional[str] = None,
     workspace_name: Optional[str] = None,
+    expires_at: Optional[str] = None,
+    s3_endpoint: Optional[str] = None,
 ) -> None:
     _CREDENTIALS_FILE.parent.mkdir(parents=True, exist_ok=True)
     creds = load_credentials()
@@ -30,6 +32,10 @@ def save_credentials(
         entry["base_url"] = base_url.rstrip("/")
     if workspace_name:
         entry["workspace_name"] = workspace_name
+    if expires_at:
+        entry["expires_at"] = expires_at
+    if s3_endpoint:
+        entry["s3_endpoint"] = s3_endpoint
     workspaces[workspace_id] = entry
     creds["workspaces"] = workspaces
     _CREDENTIALS_FILE.write_text(json.dumps(creds, indent=2))
@@ -63,6 +69,10 @@ def get_token(workspace_id: Optional[str] = None) -> Optional[str]:
     return _get_workspace_entry(workspace_id).get("token")
 
 
+def get_s3_endpoint(workspace_id: Optional[str] = None) -> Optional[str]:
+    return _get_workspace_entry(workspace_id).get("s3_endpoint")
+
+
 def get_service_url(service: str, workspace_id: Optional[str] = None) -> Optional[str]:
     entry = _get_workspace_entry(workspace_id)
     base_url = entry.get("base_url")

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli/cli.py

@@ -963,9 +963,10 @@ def policies_apply(file: Path | None):
 @click.option("--workspace", "workspace_id", default=None, help="Workspace ID (defaults to WORKSPACE_ID from .env)")
 @click.option("--url", "base_url", default=None, help="Platform root host, e.g. jds-dev.internal.jambit.io")
 @click.option("--workspace-name", "workspace_name_opt", default=None, help="Workspace name")
+@click.option("--expires", "expires_at", default=None, help="Token expiry date/time (e.g. 2026-12-31 or ISO 8601). Informational only.")
 @click.option('--env-file', '-e', type=click.Path(path_type=Path), multiple=True,
               help='Path to .env file(s). Defaults to .env and .workspaces.env')
-def login(token: str | None, workspace_id: str | None, base_url: str | None, workspace_name_opt: str | None, env_file: tuple):
+def login(token: str | None, workspace_id: str | None, base_url: str | None, workspace_name_opt: str | None, expires_at: str | None, env_file: tuple):
     """Print CLI access URLs or save a service principal token."""
     cwd = Path.cwd()
     env_files = [Path(f) for f in env_file] if env_file else [cwd / ".env", cwd / ".workspaces.env"]
@@ -984,9 +985,27 @@ def login(token: str | None, workspace_id: str | None, base_url: str | None, wor
             click.secho("Could not resolve workspace ID. Set WORKSPACE_ID in .env or pass --workspace.", fg="red", err=True)
             raise SystemExit(1)
         click.echo(f"\nYou are about to log in to workspace {click.style(workspace_name, fg='cyan', bold=True)} ({resolved_workspace})")
-        save_credentials(resolved_workspace, token, base_url=base_url, workspace_name=workspace_name)
+        save_credentials(resolved_workspace, token, base_url=base_url, workspace_name=workspace_name, expires_at=expires_at)
         if base_url:
             click.echo(f"Platform: {base_url}")
+
+        s3_endpoint: str | None = None
+        if base_url:
+            try:
+                import urllib.request as _urlreq
+                config_url = f"https://datameshx.{base_url}/api/v1/cli/config"
+                req = _urlreq.Request(config_url, headers={"Authorization": f"Bearer {token}"})
+                with _urlreq.urlopen(req, timeout=5) as _r:
+                    import json as _json
+                    cfg = _json.loads(_r.read().decode())
+                    s3_endpoint = cfg.get("s3Endpoint")
+            except Exception as _e:
+                click.secho(f"Could not fetch platform config (s3Endpoint will use .env fallback): {_e}", fg="yellow", err=True)
+
+        if s3_endpoint:
+            save_credentials(resolved_workspace, token, base_url=base_url, workspace_name=workspace_name, expires_at=expires_at, s3_endpoint=s3_endpoint)
+            click.echo(f"S3 endpoint: {s3_endpoint}")
+
         click.secho(f"Logged in. Credentials saved to ~/.steve/credentials.json", fg="green")
         return
 
@@ -1022,6 +1041,238 @@ def logout(workspace_id: str | None, env_file: tuple):
         click.secho("All credentials removed.", fg="green")
 
 
+@main.command("status")
+@click.option('--env-file', '-e', type=click.Path(path_type=Path), multiple=True,
+              help='Path to .env file(s). Defaults to .env and .workspaces.env')
+@click.option('--no-check', is_flag=True, default=False, help='Skip connectivity checks.')
+def status(env_file: tuple, no_check: bool):
+    """Show current steve-cli environment, storage paths, and connectivity."""
+    import importlib.metadata
+    import urllib.request
+
+    cwd = Path.cwd()
+    env_files = [Path(f) for f in env_file] if env_file else [cwd / ".env", cwd / ".workspaces.env"]
+    for ef in env_files:
+        load_dotenv(ef)
+
+    try:
+        version = importlib.metadata.version("steve-cli")
+    except Exception:
+        version = "unknown"
+
+    def _section(title: str) -> None:
+        click.echo(f"\n{click.style(f'━━ {title} ', fg='bright_black')}{'━' * max(0, 48 - len(title))}")
+
+    def _row(label: str, value: str, value_color: str = "white") -> None:
+        click.echo(f"  {click.style(label.ljust(14), fg='bright_black')}  {click.style(value, fg=value_color)}")
+
+    def _check(label: str, url: str, timeout: int = 2, token: str = "", suffix: str = "") -> None:
+        if no_check:
+            _row(label, "(skipped)", "bright_black")
+            return
+        try:
+            req = urllib.request.Request(url)
+            if token:
+                req.add_header("Authorization", f"Bearer {token}")
+            with urllib.request.urlopen(req, timeout=timeout) as r:
+                _row(label, f"✓ reachable  ({url}){suffix}", "green")
+                return r.read()
+        except urllib.error.HTTPError:
+            _row(label, f"✓ reachable  ({url}){suffix}", "green")
+        except Exception as e:
+            _row(label, f"✗ unreachable  ({url}){suffix}: {e}", "red")
+
+    click.echo(f"\n{click.style('●', fg='green')} Steve CLI {click.style('v' + version, fg='cyan', bold=True)}")
+
+    from steve_cli.storage.branch import get_branch_prefix
+    import subprocess as _sp
+
+    branch = get_branch_prefix()
+    steve_branch_env = os.getenv("STEVE_BRANCH", "").strip()
+    gh_head = os.getenv("GITHUB_HEAD_REF", "").strip() or os.getenv("GITHUB_REF_NAME", "").strip()
+    if steve_branch_env:
+        branch_source = f"STEVE_BRANCH={steve_branch_env!r}"
+    elif gh_head:
+        branch_source = f"GITHUB env ({gh_head})"
+    else:
+        try:
+            r = _sp.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], capture_output=True, text=True, timeout=3)
+            branch_source = "git" if r.returncode == 0 and r.stdout.strip() else "fallback"
+        except Exception:
+            branch_source = "fallback"
+
+    workspace_id = os.getenv("WORKSPACE_ID", "")
+    workspace_name = os.getenv("WORKSPACE_NAME", "")
+    session = os.getenv("SESSION_NAME", "") or socket.gethostname()
+
+    from steve_cli.auth import _get_workspace_entry, get_service_url
+    import datetime as _dt
+    entry = _get_workspace_entry(workspace_id or None)
+    token = entry.get("token", "")
+    expires_at = entry.get("expires_at", "")
+    if token:
+        expiry_warn = False
+        expiry_str = ", expires never" if not expires_at else ""
+        if expires_at:
+            try:
+                exp = _dt.datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+                now = _dt.datetime.now(_dt.timezone.utc) if exp.tzinfo else _dt.datetime.now()
+                delta = exp - now
+                total_seconds = int(delta.total_seconds())
+                if total_seconds < 0:
+                    s = abs(total_seconds)
+                    if s < 3600:
+                        ago = f"{s // 60}m ago"
+                    elif s < 86400:
+                        ago = f"{s // 3600}h ago"
+                    else:
+                        ago = f"{s // 86400}d ago"
+                    expiry_str = f", expired {ago}"
+                    expiry_warn = True
+                elif total_seconds < 3600:
+                    expiry_str = f", expires in {total_seconds // 60}m ⚠"
+                    expiry_warn = True
+                elif total_seconds < 86400:
+                    expiry_str = f", expires in {total_seconds // 3600}h ⚠"
+                    expiry_warn = True
+                elif delta.days <= 7:
+                    expiry_str = f", expires in {delta.days}d ⚠"
+                    expiry_warn = True
+                else:
+                    expiry_str = f", expires {exp.strftime('%Y-%m-%d %H:%M')}"
+            except Exception:
+                expiry_str = f", expires {expires_at}"
+        token_display = f"✓ logged in  (stp_***{token[-4:]}{expiry_str})"
+        token_color = "yellow" if expiry_warn else "green"
+    else:
+        token_display = "✗ not logged in — run: steve login"
+        token_color = "yellow"
+
+    _section("Identity")
+    _row("Branch", f"{branch}  ({branch_source})", "cyan")
+    _row("Workspace ID", workspace_id or "(not set)", "white" if workspace_id else "yellow")
+    _row("Workspace", workspace_name or "(not set)", "white" if workspace_name else "yellow")
+    _row("Session", session, "white")
+    if token and not no_check:
+        _base_url = entry.get("base_url", "")
+        if _base_url:
+            try:
+                _req = urllib.request.Request(
+                    f"https://datameshx.{_base_url}/api/v1/cli/config",
+                    headers={"Authorization": f"Bearer {token}"},
+                )
+                with urllib.request.urlopen(_req, timeout=4) as _r:
+                    _r.read()
+                _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
+            except urllib.error.HTTPError as _e:
+                if _e.code == 401:
+                    _row("Auth", f"✗ token invalid/revoked  (stp_***{token[-4:]}{expiry_str})", "red")
+                else:
+                    _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
+            except Exception as _e:
+                _row("Auth", f"{token_display}  (validation failed: {_e})", token_color)
+        else:
+            _row("Auth", token_display, token_color)
+    else:
+        _row("Auth", token_display, token_color)
+
+    tiers = ["bronze", "silver", "gold"]
+    s3_rows = []
+    for tier in tiers:
+        tier_up = tier.upper()
+        bucket = os.getenv(f"{tier_up}_BUCKET", "")
+        if bucket:
+            s3_rows.append((f"S3 {tier}", f"s3://{bucket}/_store/{branch}/"))
+    for ws in _detect_workspaces():
+        for tier in tiers:
+            bucket = os.getenv(f"{ws}_BUCKET_{tier.upper()}", "")
+            if bucket:
+                s3_rows.append((f"S3 {ws.lower()}/{tier}", f"s3://{bucket}/_store/{branch}/"))
+
+    _section("Storage Paths")
+    if s3_rows:
+        for label, path in s3_rows:
+            _row(label, path, "cyan")
+    else:
+        _row("S3", "(no bucket env vars found)", "yellow")
+    _row("Iceberg base", f"_iceberg/{branch}/", "cyan")
+
+    trino_endpoint = get_service_url("trino", workspace_id or None)
+    resolved_workspace = workspace_name or workspace_id or ""
+    trino_catalog = os.getenv("TRINO_CATALOG", "minio")
+    trino_schema_explicit = os.getenv("TRINO_SCHEMA", "")
+
+    _section("Trino")
+    if trino_endpoint:
+        _row("Endpoint", trino_endpoint, "cyan")
+    else:
+        _row("Endpoint", "✗ not configured (login required)", "yellow")
+    _row("Catalog", trino_catalog, "white")
+    for tier in tiers:
+        if trino_schema_explicit:
+            schema = trino_schema_explicit
+        elif resolved_workspace:
+            ws_clean = resolved_workspace.lower().replace("-", "_")
+            schema = f"{ws_clean}_{tier}__{branch}"
+        else:
+            schema = f"(workspace not set — set WORKSPACE_NAME)"
+        _row(f"Schema {tier}", schema, "cyan" if resolved_workspace or trino_schema_explicit else "yellow")
+        if trino_schema_explicit:
+            break
+
+    lakekeeper = os.getenv("LAKEKEEPER_ENDPOINT", "") or get_service_url("lakekeeper", workspace_id or None)
+
+    _section("Connectivity")
+    _cred_s3 = entry.get("s3_endpoint", "")
+    _env_s3 = os.getenv("S3_ENDPOINT", "")
+    if _cred_s3:
+        s3_endpoint = _cred_s3
+        s3_source = "credentials"
+    elif _env_s3:
+        s3_endpoint = _env_s3
+        s3_source = "S3_ENDPOINT env"
+    else:
+        s3_endpoint = "http://localhost:9000"
+        s3_source = "default"
+    _check("S3 endpoint", s3_endpoint, suffix=f"  (from {s3_source})")
+    if trino_endpoint:
+        if no_check:
+            _row("Trino", "(skipped)", "bright_black")
+        else:
+            try:
+                import json as _json
+                req = urllib.request.Request(f"{trino_endpoint}/v1/info")
+                if token:
+                    req.add_header("Authorization", f"Bearer {token}")
+                req.add_header("X-Trino-User", os.getenv("TRINO_USER", "admin"))
+                with urllib.request.urlopen(req, timeout=3) as r:
+                    info = _json.loads(r.read())
+                version_str = info.get("nodeVersion", {}).get("version", "?")
+                state = info.get("state", "?")
+                uptime = info.get("uptime", "")
+                detail = f"v{version_str} {state.lower()}" + (f", up {uptime}" if uptime else "")
+                _row("Trino", f"✓ reachable  ({detail})  {trino_endpoint}", "green")
+            except Exception as e:
+                _row("Trino", f"✗ unreachable: {e}", "red")
+    else:
+        _row("Trino", "✗ not configured", "yellow")
+    if lakekeeper:
+        _check("Lakekeeper", f"{lakekeeper}/catalog/v1/config")
+    else:
+        _row("Lakekeeper", "(not configured — set LAKEKEEPER_ENDPOINT or login with --url)", "bright_black")
+
+    _section("Environment")
+    for ef in env_files:
+        state = "✓ found" if ef.exists() else "✗ missing"
+        color = "green" if ef.exists() else "bright_black"
+        _row(ef.name, state, color)
+    _row("STEVE_BRANCH", repr(steve_branch_env) if steve_branch_env else "(not set — auto-detected)", "white" if steve_branch_env else "bright_black")
+    detected_ws = _detect_workspaces()
+    if detected_ws:
+        _row("Upstream ws", ", ".join(detected_ws), "white")
+    click.echo()
+
+
 @main.command("upgrade")
 def upgrade():
     """Upgrade steve-cli to the latest version."""

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli/storage/__init__.py

@@ -1,3 +1,4 @@
+from .branch import get_branch_prefix
 from .protocol import Storage
 from .s3 import S3Storage
 from .trino import TrinoStorage
@@ -5,6 +6,7 @@ from .parquet import ParquetMetadata, extract_parquet_metadata
 from .metadata import FileMetadata, ColumnMetadata, MetadataExtractorPort, MetadataRegistry
 
 __all__ = [
+    "get_branch_prefix",
     "Storage",
     "S3Storage",
     "TrinoStorage",

steve_cli-1.0.2/steve_cli/storage/branch.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+import logging
+import os
+import re
+import subprocess
+
+logger = logging.getLogger(__name__)
+
+_MAIN_BRANCHES = {"main", "master"}
+
+
+def _sanitize(branch: str) -> str:
+    branch = branch.lower().strip()
+    branch = re.sub(r"[^a-z0-9]+", "_", branch)
+    return branch.strip("_") or "main"
+
+
+def get_branch_prefix() -> str:
+    for env_var in ("STEVE_BRANCH", "GITHUB_HEAD_REF", "GITHUB_REF_NAME"):
+        value = os.getenv(env_var, "").strip()
+        if value:
+            return _sanitize(value)
+
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+            capture_output=True,
+            text=True,
+            timeout=3,
+        )
+        if result.returncode == 0:
+            branch = result.stdout.strip()
+            if branch and branch != "HEAD":
+                return _sanitize(branch)
+    except Exception as exc:
+        logger.debug("git branch detection failed: %s", exc)
+
+    logger.warning("Could not detect git branch; defaulting to 'main'")
+    return "main"

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli/storage/s3.py

@@ -8,16 +8,27 @@ import boto3
 from botocore.client import Config
 from botocore.exceptions import ClientError, EndpointConnectionError
 
+from .branch import get_branch_prefix
+from steve_cli.auth import get_s3_endpoint
+
 logger = logging.getLogger(__name__)
 
 
 class S3Storage:
     def __init__(self, tier: str = "bronze", workspace: str | None = None):
         self.tier = tier.lower()
+        self._branch = get_branch_prefix()
         self.endpoint, self.bucket, access_key, secret_key, required_vars = (
             self._load_config(self.tier, workspace)
         )
 
+        cred_endpoint = get_s3_endpoint()
+        if cred_endpoint:
+            self.endpoint = cred_endpoint
+            self._endpoint_source = "credentials"
+        else:
+            self._endpoint_source = "env" if os.getenv("S3_ENDPOINT") else "default"
+
         missing = [v for v in required_vars if not os.getenv(v)]
         if missing:
             raise OSError(
@@ -66,11 +77,11 @@ class S3Storage:
             ]
         return endpoint, bucket, access_key, secret_key, required
 
-    @staticmethod
-    def _key(path: str) -> str:
+    def _key(self, path: str) -> str:
         if not path:
-            return ""
-        return str(PurePosixPath(path).as_posix().lstrip("/"))
+            return f"_store/{self._branch}/"
+        clean = str(PurePosixPath(path).as_posix().lstrip("/"))
+        return f"_store/{self._branch}/{clean}"
 
     def _object_location(self, path: str) -> str:
         return f"{self.endpoint}/{self.bucket}/{self._key(path)}"

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli/storage/trino.py

@@ -10,19 +10,21 @@ import pyarrow as pa
 import pyarrow.parquet as pq
 import requests
 
+from .branch import get_branch_prefix
+
 logger = logging.getLogger(__name__)
 
 
-def _derive_schema(tier: str, workspace: str | None) -> str | None:
-    if workspace:
-        prefix = workspace.lower().replace("-", "_")
-        return f"ws_{prefix}_{tier.lower()}"
-    return None
+def _derive_schema(tier: str, workspace: str | None, branch: str) -> str:
+    base = f"{workspace.lower().replace('-', '_')}_{tier.lower()}" if workspace else tier.lower()
+    return f"{base}__{branch}"
 
 
 class TrinoStorage:
     def __init__(self, tier: str = "bronze", workspace: str | None = None):
         from steve_cli.auth import get_service_url
+        self._branch = get_branch_prefix()
+        self._tier = tier.lower()
         self._workspace_id = os.getenv("WORKSPACE_ID")
         trino_endpoint = get_service_url("trino", self._workspace_id)
         if not trino_endpoint:
@@ -36,16 +38,25 @@ class TrinoStorage:
             ]
             detail = "\n".join(f"  {mark} {desc}" for mark, desc in checks)
             raise OSError(f"Trino endpoint not found:\n{detail}")
-        self.catalog = os.getenv("TRINO_CATALOG", "minio")
         resolved_workspace = workspace or os.getenv("WORKSPACE_NAME")
-        self.schema = _derive_schema(tier, resolved_workspace) or os.environ.get("TRINO_SCHEMA", "")
-        if not self.schema:
-            raise OSError("TRINO_SCHEMA is not set and no WORKSPACE_NAME or workspace was provided")
-        self.user = os.getenv("TRINO_USER", "admin")
+        default_catalog = f"{resolved_workspace}-{tier}" if resolved_workspace else "minio"
+        self.catalog = os.getenv("TRINO_CATALOG", default_catalog)
+        self.schema = os.environ.get("TRINO_SCHEMA") or _derive_schema(tier, resolved_workspace, self._branch)
+        self.user = os.getenv("TRINO_USER") or resolved_workspace or "admin"
         self._base = trino_endpoint.rstrip("/")
-        self._lakekeeper_endpoint = os.getenv("LAKEKEEPER_ENDPOINT")
-        default_warehouse = f"{resolved_workspace}-{tier}" if resolved_workspace else "minio"
-        self._lakekeeper_warehouse = os.getenv("LAKEKEEPER_WAREHOUSE", default_warehouse)
+        self._lakekeeper_endpoint = os.getenv("LAKEKEEPER_ENDPOINT") or get_service_url("lakekeeper", self._workspace_id)
+        self._lakekeeper_warehouse = os.getenv("LAKEKEEPER_WAREHOUSE", default_catalog)
+        _iceberg_bucket = os.getenv(f"{tier.upper()}_BUCKET", "")
+        if _iceberg_bucket:
+            self._iceberg_location_prefix = f"s3://{_iceberg_bucket}/_iceberg/{self._branch}"
+        else:
+            raise OSError(
+                f"TrinoStorage: missing bucket configuration for tier '{tier}' — "
+                f"{tier.upper()}_BUCKET is not set.\n"
+                f"  Required env vars: {tier.upper()}_BUCKET, {tier.upper()}_ACCESS_KEY, {tier.upper()}_SECRET_KEY\n"
+                f"  This workspace may only have read access to the '{tier}' tier. "
+                f"Write access requires provisioning credentials (run 'uv run steve setup env' or check workspace provisioning)."
+            )
         self.__iceberg_catalog = None
 
     @property
@@ -55,24 +66,43 @@ class TrinoStorage:
             from pyiceberg.io import load_file_io
             from pyiceberg.table import Table
 
-            # FIXME: Interim workaround — pyiceberg cannot use Lakekeeper's remote signing
-            # endpoint when running outside the cluster (hostname 'lakekeeper' doesn't resolve
-            # locally). We subclass RestCatalog to inject our local signer URI after pyiceberg
-            # merges table config (which overwrites s3.signer.uri with the internal hostname).
-            # Remove once Increment 5 (STS credential vending) is wired.
-            tier = self.schema.rsplit("_", 1)[-1].upper()
-            lakekeeper_base = self._lakekeeper_endpoint or "http://lakekeeper:8181/catalog"
+            # WORKAROUND: Lakekeeper's remote S3 presigner is bypassed for external access.
+            #
+            # Lakekeeper returns `s3.signer` / `s3.signer.uri` in the table config, which
+            # pyiceberg uses to sign S3 requests via Lakekeeper's signing endpoint. This works
+            # inside the cluster but fails from a laptop because:
+            #   1. The signed URI Lakekeeper produces contains the cluster-internal hostname
+            #      (e.g. http://minio:9000) which is unreachable externally.
+            #   2. Even after overriding the signer URI to the public lakekeeper subdomain,
+            #      Lakekeeper's signer returns HTTP 500 for URIs with the public minio hostname
+            #      because it only knows the internal minio endpoint.
+            #
+            # Current workaround: strip all signer config from the merged table properties and
+            # use direct S3 credentials (access-key + secret-key) with the public minio endpoint
+            # from ~/.steve/credentials.json. This bypasses Lakekeeper's access control for S3
+            # writes — credentials live on disk rather than being vended by the cluster.
+            #
+            # To revert: configure Lakekeeper with its public S3 endpoint so presigned URIs
+            # contain a resolvable hostname, then remove the merged.pop() calls below and
+            # restore `s3.signer.uri: lakekeeper_base` in s3_overrides.
+            tier = self._tier.upper()
+            lakekeeper_base = (self._lakekeeper_endpoint or "http://lakekeeper:8181/catalog").rstrip("/")
+            from steve_cli.auth import get_s3_endpoint as _get_s3_ep
+            _s3_ep = _get_s3_ep(self._workspace_id) or os.getenv("S3_ENDPOINT", "http://minio:9000")
             s3_overrides = {
-                "s3.endpoint": os.getenv("S3_ENDPOINT", "http://minio:9000"),
+                "s3.endpoint": _s3_ep,
                 "s3.access-key-id": os.getenv(f"{tier}_ACCESS_KEY") or os.getenv("AWS_ACCESS_KEY_ID", ""),
                 "s3.secret-access-key": os.getenv(f"{tier}_SECRET_KEY") or os.getenv("AWS_SECRET_ACCESS_KEY", ""),
                 "s3.path-style-access": "true",
-                "s3.signer.uri": lakekeeper_base,
             } if self._lakekeeper_endpoint else {}
 
             class _PatchedRestCatalog(RestCatalog):
                 def _response_to_table(self_, identifier_tuple, table_response):
                     merged = {**table_response.metadata.properties, **table_response.config, **s3_overrides, "uri": lakekeeper_base}
+                    # Strip remote-signer config — see WORKAROUND comment above.
+                    merged.pop("s3.signer", None)
+                    merged.pop("s3.signer.uri", None)
+                    merged.pop("s3.signer.endpoint", None)
                     return Table(
                         identifier=identifier_tuple,
                         metadata_location=table_response.metadata_location,
@@ -82,12 +112,16 @@ class TrinoStorage:
                         config=table_response.config,
                     )
 
+            from steve_cli.auth import get_token
+            stp_token = get_token(self._workspace_id)
+            token_kwargs = {"token": stp_token} if stp_token else {}
             try:
                 catalog = _PatchedRestCatalog(
                     "lakekeeper",
                     uri=lakekeeper_base,
                     warehouse=self._lakekeeper_warehouse,
                     **s3_overrides,
+                    **token_kwargs,
                 )
             except Exception as exc:
                 msg = str(exc)
@@ -172,7 +206,7 @@ class TrinoStorage:
         return path.strip("/").replace("/", "_").replace(".", "_")
 
     def list(self, prefix: str = "") -> list[str]:
-        rows = self._execute(f"SHOW TABLES FROM {self.catalog}.{self.schema}")
+        rows = self._execute(f'SHOW TABLES FROM "{self.catalog}".{self.schema}')
         tables = [r["Table"] for r in rows]
         if prefix:
             clean = prefix.strip("/")
@@ -183,7 +217,10 @@ class TrinoStorage:
         return self.list()
 
     def get_bytes(self, path: str) -> bytes:
-        table_ref = f"{self.catalog}.{self.schema}.{self._table_name(path)}"
+        table_name = self._table_name(path)
+        table_ref = f'"{self.catalog}".{self.schema}.{table_name}'
+        if os.getenv("STEVE_TRINO_TRACE") == "1":
+            logger.warning("[trino] get_bytes: %s  (warehouse=%s)", table_ref, self._lakekeeper_warehouse)
         try:
             rows = self._execute(f"SELECT * FROM {table_ref}")
         except OSError:
@@ -193,7 +230,39 @@ class TrinoStorage:
                 f"TrinoStorage: read from '{table_ref}' failed — {type(exc).__name__}: {exc}"
             ) from exc
         if not rows:
-            return b""
+            list_err: str | None = None
+            table_names: list[str] | None = None
+            try:
+                existing = self._execute(f'SHOW TABLES FROM "{self.catalog}".{self.schema}')
+                table_names = [r.get("Table", "") for r in existing]
+            except Exception as list_exc:
+                list_err = str(list_exc)
+
+            if table_names is not None and table_name in table_names:
+                raise OSError(
+                    f"TrinoStorage: table '{table_ref}' exists in Trino but returned 0 rows — "
+                    f"data may not have been written yet, or the last write produced an empty result."
+                )
+            elif list_err is not None:
+                raise OSError(
+                    f"TrinoStorage: table '{table_name}' not found in catalog='{self.catalog}' schema='{self.schema}'.\n"
+                    f"  Looked in: {table_ref}\n"
+                    f"  Could not list tables in that schema: {list_err}\n"
+                    f"  Hint: if data was written with get_storage() (S3/Parquet), read it back with get_storage(), not get_tables()."
+                )
+            elif table_names == []:
+                raise OSError(
+                    f"TrinoStorage: table '{table_name}' not found — schema '{self.catalog}'.'{self.schema}' exists but contains no tables.\n"
+                    f"  Looked in: {table_ref}\n"
+                    f"  Hint: if data was written with get_storage() (S3/Parquet), read it back with get_storage(), not get_tables()."
+                )
+            else:
+                raise OSError(
+                    f"TrinoStorage: table '{table_name}' not found in catalog='{self.catalog}' schema='{self.schema}'.\n"
+                    f"  Looked in: {table_ref}\n"
+                    f"  Tables found in that schema: {', '.join(table_names or [])}\n"
+                    f"  Hint: if data was written with get_storage() (S3/Parquet), read it back with get_storage(), not get_tables()."
+                )
         arrow_table = pa.Table.from_pylist(rows)
         buf = io.BytesIO()
         pq.write_table(arrow_table, buf)
@@ -204,11 +273,16 @@ class TrinoStorage:
         Path(local_path).write_bytes(self.get_bytes(path))
 
     def _ensure_namespace(self) -> None:
+        import datetime
+
         from pyiceberg.exceptions import NamespaceAlreadyExistsError
-        lakekeeper_base = self._lakekeeper_endpoint or "http://lakekeeper:8181/catalog"
+        lakekeeper_base = (self._lakekeeper_endpoint or "http://lakekeeper:8181/catalog").rstrip("/")
+        namespace_props = {"location": self._iceberg_location_prefix}
+        created = False
         try:
-            self._iceberg_catalog.create_namespace(self.schema)
+            self._iceberg_catalog.create_namespace(self.schema, properties=namespace_props)
             logger.info("Created namespace %s", self.schema)
+            created = True
         except NamespaceAlreadyExistsError:
             pass
         except Exception as exc:
@@ -224,6 +298,39 @@ class TrinoStorage:
                 f"[{lakekeeper_base}] — {type(exc).__name__}: {exc}"
             ) from exc
 
+        if created:
+            from pyiceberg.schema import Schema
+            from pyiceberg.types import NestedField, StringType
+            meta_schema = Schema(
+                NestedField(1, "branch", StringType(), required=False),
+                NestedField(2, "tier", StringType(), required=False),
+                NestedField(3, "schema_name", StringType(), required=False),
+                NestedField(4, "iceberg_location", StringType(), required=False),
+                NestedField(5, "created_at", StringType(), required=False),
+            )
+            meta_table_id = f"{self.schema}._meta"
+            try:
+                meta_table = self._iceberg_catalog.create_table(meta_table_id, schema=meta_schema)
+                meta_table.append(pa.table({
+                    "branch": [self._branch],
+                    "tier": [self._tier],
+                    "schema_name": [self.schema],
+                    "iceberg_location": [self._iceberg_location_prefix],
+                    "created_at": [datetime.datetime.now(datetime.timezone.utc).isoformat()],
+                }))
+                logger.info("Created _meta table in namespace %s", self.schema)
+            except Exception as exc:
+                logger.warning("Could not create _meta table in %s: %s", self.schema, exc)
+
+        try:
+            self._execute(
+                f'CREATE SCHEMA IF NOT EXISTS "{self.catalog}".{self.schema} '
+                f"WITH (location = '{self._iceberg_location_prefix}')"
+            )
+            logger.debug("Ensured Trino schema %s.%s", self.catalog, self.schema)
+        except Exception as exc:
+            logger.warning("Could not ensure Trino schema %s.%s: %s", self.catalog, self.schema, exc)
+
     def put_bytes(self, data: bytes, path: str) -> None:
         from pyiceberg.exceptions import NoSuchTableError
 
@@ -305,6 +412,18 @@ class TrinoStorage:
                 ) from exc
             _append(iceberg_table, arrow_table, table_id)
 
+        if os.getenv("STEVE_TRINO_TRACE") == "1":
+            snapshot = None
+            try:
+                snapshot = catalog.load_table(f"{self.schema}.{self._table_name(path)}").current_snapshot()
+            except Exception:
+                pass
+            logger.warning(
+                "[trino] put_bytes: wrote %d rows → %s.%s  (warehouse=%s, location=%s%s)",
+                len(arrow_table), self.catalog, table_id,
+                self._lakekeeper_warehouse, self._iceberg_location_prefix,
+                f", snapshot={snapshot.snapshot_id}" if snapshot else "",
+            )
         logger.info("Written %d rows to %s", len(arrow_table), table_id)
 
     def put_file(self, local_path: str, path: str) -> None:

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steve-cli
-Version: 0.5.6
+Version: 1.0.2
 Summary: A simple CLI tool to run jobs from jobs.yaml with proper environment setup
 Author: Frank
 License: MIT
@@ -67,6 +67,8 @@ Requires-Dist: visidata>=3.0; extra == "all"
 
 A CLI tool for the data platform. Commands are organized by concern: general workspace automation, data lakehouse operations, semantic knowledge graphs, and governance.
 
+> **Upgrading from 0.x?** See [CHANGELOG.md](./CHANGELOG.md) — v1.0.0 introduces branch-isolated storage with breaking path changes that require a one-time data migration.
+
 ## Installation
 
 ```bash

{steve_cli-0.5.6 → steve_cli-1.0.2}/steve_cli.egg-info/SOURCES.txt

@@ -28,6 +28,7 @@ steve_cli/lineage/adapters/openlineage.py
 steve_cli/policies/__init__.py
 steve_cli/policies/client.py
 steve_cli/storage/__init__.py
+steve_cli/storage/branch.py
 steve_cli/storage/parquet.py
 steve_cli/storage/protocol.py
 steve_cli/storage/s3.py