v0.9.14

This release fixes a class of runtime panics and adds a connection-template generator, closing out the API surface audit (Phases 3 and 5).

Highlights

Fixed: --output arg collision panics

Four commands defined a local --output file-path argument that collided with the global --output <text|json> format flag (same clap argument id, different type). Every invocation panicked at runtime. All four now use --output-file for the file path:

• flows export — now exports a .yxzp package end-to-end (was completely broken)
• server system-info
• server runtime-settings
• tools workspace init

The global --output text|json format flag is unaffected on every other command.

Added: connection template generator

• connections connector-metadata template --connector <slug>: calls GET /v4/connectorMetadata/{slug}/defaults and emits a fillable JSON create-body. It derives type from the connector category (relational → jdbc, otherwise remotefile), sets vendor/vendorName to the slug, picks the first credentialType from the metadata, and builds a params skeleton from the connector’s connectionParameters (using defaults or <type> placeholders). This unblocks the body-construction half of connections create.

  • bigquery → type: jdbc, credentialType: apiKey, params: { projectId }
  • gsheetsuser → type: remotefile, credentialType: oauth2

Audit closeout

The full API surface audit (docs/one-api-surface-audit.md) is complete. docs/one-live-validation.md now carries a per-endpoint status table grouped into: working surfaces, PAT-scope-blocked surfaces, absent routes, and enterprise-tier-gated surfaces.

Known limitations (API/token scope, not CLI bugs)

• A cluster of surfaces returns AccessControlException (403) under the PAT minted by the workspace-bearer OIDC flow: flows permissions-get, flows parameters, platform role list, connections dry-run. The PAT has create/read/delete on flows and connections but lacks scope for these. Resolving requires a UI-minted token or broader OAuth scopes at the token-mint step.
• flows validate (/v4/flows/{id}/validate) and webhook-flow-tasks (/v4/webhookFlowTasks) return 404 — these routes are not present on non-enterprise tiers.
• Billing, plans, and scheduling remain enterprise-tier-gated (404 on non-enterprise tiers).

Validation

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace --locked
• Live smoke checks against a live test workspace