sunstone-data-platform 1.2.0__tar.gz → 1.4.0__tar.gz

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/.gitignore

@@ -20,3 +20,4 @@ security-prompts/
 /research-stack
 /target/
 CLAUDE.local.md
+/.sunstone

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sunstone-data-platform
-Version: 1.2.0
+Version: 1.4.0
 Summary: Sunstone Data Platform - Data lakehouse with semantic metadata
 Author-email: Sunstone Institute <stig@sunstone.institute>
 License-Expression: MIT
@@ -9,13 +9,15 @@ Requires-Dist: charset-normalizer>=3.4.0
 Requires-Dist: duckdb>=1.5.3
 Requires-Dist: fastexcel>=0.20.2
 Requires-Dist: httpx>=0.27.0
+Requires-Dist: keyring>=25
 Requires-Dist: publicsuffixlist>=1.0.2.20261003
 Requires-Dist: pyiceberg[duckdb,gcsfs,s3fs]>=0.10.0
 Requires-Dist: python-dateutil>=2.9.0.post0
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: python-slugify>=8.0.0
+Requires-Dist: rdflib>=7.6
 Requires-Dist: rich>=14.0.0
-Requires-Dist: sunstone-py>=1.15.0
+Requires-Dist: sunstone-py>=1.19.0
 Requires-Dist: typer>=0.27.1
 Provides-Extra: pipelines
 Requires-Dist: dagster-docker>=0.29.0; extra == 'pipelines'
@@ -61,7 +63,7 @@ full data flow.
 ## Endpoints
 
 - `/catalog` — DCAT JSON-LD view of the lakehouse, served by graph-server views
-  (see [the views design](docs/specs/2026-08-02-graph-server-views-design.md))
+  (see [DP-SPEC-13](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-13))
 - `/ui/` — the data explorer, a 3D view of the data graph, served by
   graph-server (see [docs/data-explorer.md](docs/data-explorer.md))
 
@@ -199,7 +201,7 @@ uv run pytest tests/unit/test_query.py -v
 
 | Command | Description |
 |---------|-------------|
-| `sunstone data login`, `logout`, `whoami` | Sign in to graph-server (Keycloak) |
+| `sunstone auth login`, `logout`, `whoami` | Sign in to graph-server (Keycloak) |
 | `sunstone data ls [namespace]` | List namespaces and tables |
 | `sunstone data show <table>` | Dataset metadata from the graph (table, Turtle or JSON-LD) |
 | `sunstone data info [table]` | Iceberg table properties for one or all datasets |
@@ -263,8 +265,8 @@ src/sunstone_data/
 ## Documentation
 
 - [docs/README.md](docs/README.md) - Index of all documentation
-- [docs/architecture.md](docs/architecture.md) - System overview and data flow
-- [docs/specs2/](docs/specs2/) - Current design, one file per subsystem. The Python client and CLI are in [05-python-client.md](docs/specs2/05-python-client.md).
+- [docs/architecture.md](docs/architecture.md) - System overview, data flow, and an index of the specs in Worklode. The Python client and CLI are in [DP-SPEC-1](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-1).
+- [docs/releasing.md](docs/releasing.md) - How to release the server and the client
 
 ## Resetting the Stack
 
@@ -284,7 +286,7 @@ MIT
 `graph-server` requires a Keycloak bearer token on every route except
 `/healthz`/`/readyz`. Access is role-based: the client roles in your token
 determine which environment you can use. See
-`docs/specs/2026-07-05-graph-server-auth-design.md`.
+[DP-SPEC-14](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-14).
 
 No hostnames or client ids ship in this package. Each environment's
 `base_iri` comes from config: Sunstone-managed machines get
@@ -297,11 +299,13 @@ graph-server publishes the OIDC issuer and public client id at
 
 ```bash
 sunstone env init          # cache discovery for configured environments
-sunstone data login        # browser sign-in (authorization code + PKCE)
+sunstone auth login        # browser sign-in (authorization code + PKCE)
 ```
 
 A browser window opens for Keycloak SSO; the refresh token renews silently
-until the SSO session expires.
+until the SSO session expires. The refresh token is stored in the OS keyring
+(macOS Keychain, Windows Credential Locker, Linux Secret Service). Without a
+usable keyring it falls back to a mode-0600 file under `~/.cache/sunstone/`.
 
 ### Services (CI, automation)
 

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/README.md

@@ -35,7 +35,7 @@ full data flow.
 ## Endpoints
 
 - `/catalog` — DCAT JSON-LD view of the lakehouse, served by graph-server views
-  (see [the views design](docs/specs/2026-08-02-graph-server-views-design.md))
+  (see [DP-SPEC-13](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-13))
 - `/ui/` — the data explorer, a 3D view of the data graph, served by
   graph-server (see [docs/data-explorer.md](docs/data-explorer.md))
 
@@ -173,7 +173,7 @@ uv run pytest tests/unit/test_query.py -v
 
 | Command | Description |
 |---------|-------------|
-| `sunstone data login`, `logout`, `whoami` | Sign in to graph-server (Keycloak) |
+| `sunstone auth login`, `logout`, `whoami` | Sign in to graph-server (Keycloak) |
 | `sunstone data ls [namespace]` | List namespaces and tables |
 | `sunstone data show <table>` | Dataset metadata from the graph (table, Turtle or JSON-LD) |
 | `sunstone data info [table]` | Iceberg table properties for one or all datasets |
@@ -237,8 +237,8 @@ src/sunstone_data/
 ## Documentation
 
 - [docs/README.md](docs/README.md) - Index of all documentation
-- [docs/architecture.md](docs/architecture.md) - System overview and data flow
-- [docs/specs2/](docs/specs2/) - Current design, one file per subsystem. The Python client and CLI are in [05-python-client.md](docs/specs2/05-python-client.md).
+- [docs/architecture.md](docs/architecture.md) - System overview, data flow, and an index of the specs in Worklode. The Python client and CLI are in [DP-SPEC-1](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-1).
+- [docs/releasing.md](docs/releasing.md) - How to release the server and the client
 
 ## Resetting the Stack
 
@@ -258,7 +258,7 @@ MIT
 `graph-server` requires a Keycloak bearer token on every route except
 `/healthz`/`/readyz`. Access is role-based: the client roles in your token
 determine which environment you can use. See
-`docs/specs/2026-07-05-graph-server-auth-design.md`.
+[DP-SPEC-14](https://worklode.dev.sunstoneinstitute.ai/DP-SPEC-14).
 
 No hostnames or client ids ship in this package. Each environment's
 `base_iri` comes from config: Sunstone-managed machines get
@@ -271,11 +271,13 @@ graph-server publishes the OIDC issuer and public client id at
 
 ```bash
 sunstone env init          # cache discovery for configured environments
-sunstone data login        # browser sign-in (authorization code + PKCE)
+sunstone auth login        # browser sign-in (authorization code + PKCE)
 ```
 
 A browser window opens for Keycloak SSO; the refresh token renews silently
-until the SSO session expires.
+until the SSO session expires. The refresh token is stored in the OS keyring
+(macOS Keychain, Windows Credential Locker, Linux Secret Service). Without a
+usable keyring it falls back to a mode-0600 file under `~/.cache/sunstone/`.
 
 ### Services (CI, automation)
 

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/pyproject.toml

@@ -13,7 +13,7 @@ authors = [
     { name = "Sunstone Institute", email = "stig@sunstone.institute" }
 ]
 dependencies = [
-    "sunstone-py>=1.15.0",
+    "sunstone-py>=1.19.0",
     "pyiceberg[s3fs,gcsfs,duckdb]>=0.10.0",
     "duckdb>=1.5.3",
     "python-dotenv>=1.2.2",
@@ -25,6 +25,8 @@ dependencies = [
     "python-slugify>=8.0.0",
     "python-dateutil>=2.9.0.post0",
     "publicsuffixlist>=1.0.2.20261003",
+    "keyring>=25",
+    "rdflib>=7.6",
 ]
 
 [project.entry-points."sunstone.plugins"]
@@ -40,6 +42,9 @@ pipelines = [
 
 [tool.hatch.version]
 source = "vcs"
+# Only `v*` tags are client versions. Without --match, setuptools-scm takes the
+# nearest tag of any kind and strips a `server-` prefix (DP-REQ-391).
+raw-options = { git_describe_command = "git describe --dirty --tags --long --match v[0-9]*" }
 
 [tool.hatch.build.hooks.vcs]
 version-file = "src/sunstone_data/_version.py"

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.0'
-__version_tuple__ = version_tuple = (1, 2, 0)
+__version__ = version = '1.4.0'
+__version_tuple__ = version_tuple = (1, 4, 0)
 
 __commit_id__ = commit_id = None

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/auth/__init__.py

@@ -12,8 +12,9 @@ health, the UI and public views. Two ways to get one:
 environment credential, so CI is never silently authenticated as whoever
 last logged in on that machine.
 
-Access tokens live in memory only. The refresh token is the sole thing
-written to disk.
+Access tokens live in memory only. The refresh token is the sole credential
+kept between runs: in the OS keyring, or a mode-0600 file when no keyring is
+usable.
 """
 
 from sunstone_data.auth.client_creds import (

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/auth/pkce.py

@@ -13,7 +13,7 @@ wildcard for ports, so the port cannot be ephemeral. The port is bound
 *before* the authorization URL is built, because the ``redirect_uri`` must
 name it.
 
-This is the flow behind ``sunstone data login`` (spec 180 §4). The public
+This is the flow behind ``sunstone auth login`` (spec 180 §4). The public
 client it signs in as is the one graph-server publishes as ``clientId`` in
 ``/ui/config.json``, the same one the graph explorer UI uses.
 """

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/auth/stepup.py

@@ -83,10 +83,12 @@ def step_up(
     """
     settings = get_settings()
     if os.environ.get("SUNSTONE_ACCESS_TOKEN", "").strip() or (settings.client_id and settings.client_secret):
-        raise StepUpRequired("writes to main need a passkey sign-in; a service credential cannot step up")
+        raise StepUpRequired("writes to a protected ref need a passkey sign-in; a service credential cannot step up")
     session = store.read_session(env_name)
     if session is None:
-        raise StepUpRequired(f"writes to main need a passkey sign-in; run `sunstone data login` for {env_name!r}")
+        raise StepUpRequired(
+            f"writes to a protected ref need a passkey sign-in; run `sunstone auth login` for {env_name!r}"
+        )
     issuer = session.issuer or discovered_issuer(env_name, settings.graph_url)
     authorization_endpoint = discover_authorization_endpoint(issuer, client)
     token_endpoint = discover_token_endpoint(issuer, client)

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/auth/store.py

@@ -1,30 +1,40 @@
 """Per-environment cache for a human login session.
 
-Holds the OAuth2 refresh token from ``sunstone data login`` so a user logs in
+Holds the OAuth2 refresh token from ``sunstone auth login`` so a user logs in
 once per environment. Access tokens are never stored here — they are minted on
 demand and kept in memory only.
 
-The file lives next to the discovery cache but one level down, so the two
-never collide::
+The refresh token goes in the OS keyring (macOS Keychain, Windows Credential
+Locker, Secret Service on Linux) under service ``sunstone-data-platform`` and
+the environment name. The rest of the session (issuer, client id, time) goes
+in a file next to the discovery cache, one level down so the two never
+collide::
 
     $XDG_CACHE_HOME/sunstone/data-platform/auth/{env_name}.json
 
-It is written atomically and chmod'ed ``0600``: a refresh token is a
-long-lived credential, so no other user on the machine may read it.
+When no keyring is usable (e.g. a headless Linux box), the refresh token is
+written into that file instead. The file is always written atomically and
+chmod'ed ``0600``, so no other user on the machine can read it.
 """
 
 from __future__ import annotations
 
 import json
+import logging
 import os
 import tempfile
 import time
 from dataclasses import asdict, dataclass, field, fields
 from pathlib import Path
 
+logger = logging.getLogger(__name__)
+
 #: Mode a session file must end up with — owner read/write only.
 SESSION_FILE_MODE = 0o600
 
+#: Keyring service name; the keyring username is the environment name.
+KEYRING_SERVICE = "sunstone-data-platform"
+
 
 @dataclass(frozen=True)
 class Session:
@@ -53,18 +63,56 @@ def session_path(env_name: str) -> Path:
     return _auth_dir() / f"{env_name}.json"
 
 
+def _keyring_set(env_name: str, token: str) -> bool:
+    """Store ``token`` in the OS keyring. Returns False if no keyring is usable."""
+    try:
+        import keyring
+
+        keyring.set_password(KEYRING_SERVICE, env_name, token)
+    except Exception:
+        logger.debug("OS keyring not usable", exc_info=True)
+        return False
+    return True
+
+
+def _keyring_get(env_name: str) -> str | None:
+    try:
+        import keyring
+
+        return keyring.get_password(KEYRING_SERVICE, env_name)
+    except Exception:
+        logger.debug("OS keyring not usable", exc_info=True)
+        return None
+
+
+def _keyring_delete(env_name: str) -> None:
+    try:
+        import keyring
+
+        keyring.delete_password(KEYRING_SERVICE, env_name)
+    except Exception:
+        # Missing entry or no usable keyring: nothing to delete either way.
+        logger.debug("No keyring entry deleted", exc_info=True)
+
+
 def write_session(env_name: str, session: Session) -> Path:
     """Persist a login session, atomically and mode 0600.
 
-    Returns the path written.
+    The refresh token goes in the OS keyring when one is usable, else in the
+    session file. Returns the path written.
     """
     path = session_path(env_name)
+    data = asdict(session)
+    if _keyring_set(env_name, session.refresh_token):
+        del data["refresh_token"]
+    else:
+        logger.warning("No usable OS keyring; storing the refresh token in %s (mode 0600)", path)
     path.parent.mkdir(parents=True, exist_ok=True)
     fd, tmp_name = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
     try:
         os.chmod(tmp_name, SESSION_FILE_MODE)
         with os.fdopen(fd, "w", encoding="utf-8") as f:
-            json.dump(asdict(session), f, indent=2)
+            json.dump(data, f, indent=2)
         os.replace(tmp_name, path)
     except Exception:
         Path(tmp_name).unlink(missing_ok=True)
@@ -76,7 +124,10 @@ def write_session(env_name: str, session: Session) -> Path:
 
 
 def read_session(env_name: str) -> Session | None:
-    """Load a cached login session. Returns None if missing or unreadable."""
+    """Load a cached login session. Returns None if missing or unreadable.
+
+    A refresh token in the file (keyring fallback) wins over the keyring.
+    """
     try:
         with open(session_path(env_name), encoding="utf-8") as f:
             data = json.load(f)
@@ -86,6 +137,11 @@ def read_session(env_name: str) -> Session | None:
         return None
     field_names = {f.name for f in fields(Session)}
     kwargs = {k: v for k, v in data.items() if k in field_names}
+    if not kwargs.get("refresh_token"):
+        token = _keyring_get(env_name)
+        if token is None:
+            return None
+        kwargs["refresh_token"] = token
     try:
         return Session(**kwargs)
     except TypeError:
@@ -95,3 +151,4 @@ def read_session(env_name: str) -> Session | None:
 def clear_session(env_name: str) -> None:
     """Remove the cached session for an environment, if any."""
     session_path(env_name).unlink(missing_ok=True)
+    _keyring_delete(env_name)

sunstone_data_platform-1.4.0/src/sunstone_data/branch.py

@@ -0,0 +1,66 @@
+"""Default data branch: the current git branch (or CI ref), normalized (DP-SPEC-12 section 12)."""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+from collections.abc import Mapping
+from pathlib import Path
+
+_MAX_LENGTH = 128
+
+
+class NoDataBranchError(ValueError):
+    """No data branch could be derived; the caller must pass ``--branch``."""
+
+
+def normalize_branch_name(name: str) -> str:
+    """Turn a git branch name into a valid data branch name.
+
+    In order: characters outside ``[A-Za-z0-9_.-]`` become ``-``, runs of
+    ``-`` collapse to one, a name not starting with a letter or ``_`` gets a
+    ``_`` prefix, and the result is cut to 128 characters.
+    """
+    name = re.sub(r"[^A-Za-z0-9_.-]", "-", name)
+    name = re.sub(r"-{2,}", "-", name)
+    if not re.match(r"[A-Za-z_]", name):
+        name = "_" + name
+    return name[:_MAX_LENGTH]
+
+
+def _git_branch(cwd: Path | None) -> str | None:
+    """The checked-out git branch, or None (not a checkout, git missing, detached HEAD)."""
+    try:
+        result = subprocess.run(
+            ["git", "symbolic-ref", "--short", "-q", "HEAD"],
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    name = result.stdout.strip()
+    return name if result.returncode == 0 and name else None
+
+
+def current_data_branch(cwd: Path | None = None, env: Mapping[str, str] | None = None) -> str:
+    """Return the data branch for ``cwd``, normalized.
+
+    Order: the checked-out git branch (also on a branch with no commits yet),
+    then ``GITHUB_HEAD_REF``, then ``GITHUB_REF_NAME``. CI checks out pull
+    requests on a detached HEAD, which is why the variables come second.
+
+    Raises:
+        NoDataBranchError: None of these gives a branch. Never falls back to ``main``.
+    """
+    env = os.environ if env is None else env
+    name = _git_branch(cwd) or env.get("GITHUB_HEAD_REF") or env.get("GITHUB_REF_NAME")
+    if not name:
+        raise NoDataBranchError(
+            "Cannot tell which data branch to use: not on a git branch and GITHUB_HEAD_REF / "
+            "GITHUB_REF_NAME are unset. Pass --branch."
+        )
+    return normalize_branch_name(name)

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/cli/_app.py

@@ -21,6 +21,9 @@ app = typer.Typer(
 data_app = typer.Typer(help="Data operations")
 app.add_typer(data_app, name="data")
 
+auth_app = typer.Typer(help="Sign in to the data platform")
+app.add_typer(auth_app, name="auth")
+
 console = Console()
 
-__all__ = ["app", "data_app", "console"]
+__all__ = ["app", "auth_app", "data_app", "console"]

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/cli/commands/__init__.py

@@ -9,6 +9,7 @@ point can register the whole CLI surface in well under 100ms.
 """
 
 from sunstone_data.cli.commands import (  # noqa: F401  (import side-effect: registers commands)
+    conceptmap,
     data_auth,
     data_import,
     data_info,

sunstone_data_platform-1.4.0/src/sunstone_data/cli/commands/conceptmap.py

@@ -0,0 +1,81 @@
+"""``sunstone data conceptmap create|update|sssom``: push a map-concepts scope directory, read its mappings (DP-REQ-323)."""
+
+from __future__ import annotations
+
+import json
+import sys
+from dataclasses import asdict
+from pathlib import Path
+
+import typer
+
+from sunstone_data.cli._app import console, data_app
+from sunstone_data.cli._errors import cli_errors
+
+conceptmap_app = typer.Typer(help="Push concept maps from map-concepts scope directories", no_args_is_help=True)
+data_app.add_typer(conceptmap_app, name="conceptmap")
+
+_SCOPE_DIR = typer.Argument(
+    ..., help="Scope directory written by map-concepts (reads scheme/*.ttl and scheme/mappings.sssom.tsv)"
+)
+# Concept maps are published content, so the default is main, not the git
+# branch of the directory the command runs in (DP-REQ-30).
+_BRANCH = typer.Option("main", "--branch", "-b", help="Branch to write")
+_BRANCH_READ = typer.Option("main", "--branch", "-b", help="Branch to read")
+_JSON = typer.Option(False, "--json", help="Output as JSON")
+
+
+def _report(result, json_output: bool) -> None:
+    from urllib.parse import quote
+
+    from sunstone_data.config import get_settings
+
+    link = f"{get_settings().graph_url}/ui/#visualise?graph={quote(result.graph_iri, safe='')}"
+    if json_output:
+        print(json.dumps({**asdict(result), "url": link}))
+        return
+    console.print(
+        f"Concept map [cyan]{result.conceptmap}[/cyan]: {result.graph_iri} on {result.branch}, "
+        f"{result.triples} triples (ETag {result.etag})"
+    )
+    console.print(link)
+
+
+@conceptmap_app.command("create")
+def create_cmd(scope_dir: Path = _SCOPE_DIR, branch: str = _BRANCH, json_output: bool = _JSON) -> None:
+    """Allocate a new concept map and push the scope directory to it."""
+    with cli_errors(json_output):
+        from sunstone_data import conceptmap
+
+        _report(conceptmap.create(scope_dir, branch), json_output)
+
+
+@conceptmap_app.command("update")
+def update_cmd(
+    n: int = typer.Argument(..., help="Concept map id, the <n> in /conceptmap/<n>"),
+    scope_dir: Path = _SCOPE_DIR,
+    branch: str = _BRANCH,
+    json_output: bool = _JSON,
+) -> None:
+    """Replace an existing concept map with the scope directory."""
+    with cli_errors(json_output):
+        from sunstone_data import conceptmap
+
+        _report(conceptmap.update(n, scope_dir, branch), json_output)
+
+
+@conceptmap_app.command("sssom")
+def sssom_cmd(
+    n: int = typer.Argument(..., help="Concept map id, the <n> in /conceptmap/<n>"),
+    branch: str = _BRANCH_READ,
+    output: Path | None = typer.Option(None, "--output", "-o", help="File to write (default: stdout)"),
+) -> None:
+    """Write a concept map's mappings as an SSSOM TSV file."""
+    with cli_errors(False):
+        from sunstone_data import conceptmap
+
+        text = conceptmap.sssom(n, branch)
+        if output is None:
+            sys.stdout.write(text)
+        else:
+            output.write_text(text, encoding="utf-8")

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/cli/commands/data_auth.py

@@ -1,16 +1,16 @@
-"""``sunstone data login`` / ``logout`` / ``whoami`` — human sign-in sessions.
+"""``sunstone auth login`` / ``logout`` / ``whoami`` — human sign-in sessions.
 
 ``login`` runs the PKCE browser flow (:mod:`sunstone_data.auth.pkce`) and
-caches only the refresh token, per environment, mode 0600. Access tokens are
-minted on demand and never touch disk, so ``whoami`` reports what was cached,
-not live token claims.
+caches only the refresh token, per environment, in the OS keyring (see
+:mod:`sunstone_data.auth.store`). Access tokens are minted on demand and never
+stored, so ``whoami`` reports what was cached, not live token claims.
 """
 
 from __future__ import annotations
 
 import typer
 
-from sunstone_data.cli._app import console, data_app
+from sunstone_data.cli._app import auth_app, console
 
 _ENV_OPTION_HELP = "Environment to act on (defaults to the active sunstone environment)."
 
@@ -21,7 +21,7 @@ def _resolve_env(env: str | None) -> str:
     return env or current_environment_name()
 
 
-@data_app.command("login")
+@auth_app.command("login")
 def login_cmd(
     env: str | None = typer.Option(None, "--env", help=_ENV_OPTION_HELP),
 ) -> None:
@@ -78,7 +78,7 @@ def login_cmd(
     console.print(f"[green]Logged in to '{env_name}'.[/green]")
 
 
-@data_app.command("logout")
+@auth_app.command("logout")
 def logout_cmd(
     env: str | None = typer.Option(None, "--env", help=_ENV_OPTION_HELP),
 ) -> None:
@@ -94,7 +94,7 @@ def logout_cmd(
         console.print(f"Not logged in to '{env_name}'; nothing to do.")
 
 
-@data_app.command("whoami")
+@auth_app.command("whoami")
 def whoami_cmd(
     env: str | None = typer.Option(None, "--env", help=_ENV_OPTION_HELP),
 ) -> None:
@@ -109,7 +109,7 @@ def whoami_cmd(
     env_name = _resolve_env(env)
     session = store.read_session(env_name)
     if session is None:
-        console.print(f"Not logged in to '{env_name}'. Run `sunstone data login`.")
+        console.print(f"Not logged in to '{env_name}'. Run `sunstone auth login`.")
         return
 
     age_hours = max(0.0, time.time() - session.cached_at) / 3600

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/cli/commands/data_import.py

@@ -49,8 +49,7 @@ def _format_result(result, as_json: bool = False, branch: str = "main") -> None:
     console.print(f"  Snapshot: {result.snapshot_id}")
     console.print(f"  Dataset: [cyan]{iri}[/cyan]")
     console.print(f"  Activity: [cyan]{activity}[/cyan]")
-    if branch != "main":
-        console.print(f"  Branch: [cyan]{branch}[/cyan]")
+    console.print(f"  Branch: [cyan]{branch}[/cyan]")
 
 
 @data_app.command("import")
@@ -71,7 +70,12 @@ def import_cmd(
         help="Publisher organization path, e.g. un/who. Overrides the source-URL rules file. Does not set the namespace.",
     ),
     tag: list[str] | None = typer.Option(None, "--tag", "-t", help="Add tags (key:value)"),
-    branch: str = typer.Option("main", "--branch", "-b", help="Branch to import to"),
+    branch: str | None = typer.Option(
+        None,
+        "--branch",
+        "-b",
+        help="Branch to import to (default: the normalized git branch, else the CI ref; fails if neither)",
+    ),
     force_schema: bool = typer.Option(False, "--force-schema", help="Allow unsafe schema changes"),
     json_output: bool = typer.Option(False, "--json", help="Output as JSON"),
 ) -> None:
@@ -86,11 +90,15 @@ def import_cmd(
         TransferSpeedColumn,
     )
 
+    from sunstone_data.branch import current_data_branch
     from sunstone_data.import_ import run_import
 
     is_url = source.startswith(("http://", "https://"))
 
     try:
+        if branch is None:
+            branch = current_data_branch()
+
         if sys.stdout.isatty() and not json_output:
             with Progress(
                 SpinnerColumn(),

{sunstone_data_platform-1.2.0 → sunstone_data_platform-1.4.0}/src/sunstone_data/cli/commands/data_publish.py

@@ -10,7 +10,12 @@ from sunstone_data.cli._app import console, data_app
 @data_app.command("publish")
 def publish_cmd(
     table: str = typer.Argument(..., help="Table identifier (namespace.table)"),
-    branch: str = typer.Option("main", "--branch", "-b", help="Branch to publish on"),
+    branch: str | None = typer.Option(
+        None,
+        "--branch",
+        "-b",
+        help="Branch to publish on (default: the normalized git branch, else the CI ref; fails if neither)",
+    ),
     version: str | None = typer.Option(
         None, "--version", help="Publish the table's current snapshot under this version label, e.g. v1.0"
     ),
@@ -27,6 +32,7 @@ def publish_cmd(
 
     from sunstone.lineage import Metadata
 
+    from sunstone_data.branch import current_data_branch
     from sunstone_data.catalog import get_catalog
     from sunstone_data.graph.dataset import DatasetDescription, DatasetVersion
     from sunstone_data.publish import publish
@@ -34,6 +40,9 @@ def publish_cmd(
     from sunstone_data.resolve import dataset_iri
 
     try:
+        if branch is None:
+            branch = current_data_branch()
+
         ref = TableRef.parse(table)
         identifier = f"{ref.namespace}.{ref.table}"
         versions: tuple[DatasetVersion, ...] = ()