aidp-data-sharing

# `aidp-data-sharing` — Delta Sharing (shares & recipients) Open data sharing over the Delta Sharing protocol via the AIDP `DeltaShare` API. A differentiator: open-protocol sharing driven from the agent. **CLI (preferred):** `aidp delta-share <command> --instance-id <DATALAKE_OCID> --auth api_key --profile DEFAULT --region <r>` - Shares: `aidp delta-share create | get | list | update | delete | manage-access | manage-data-asset | manage-permission | list-data-assets` - Recipients: `aidp delta-share create-recipient | get-recipient | list-recipients | update-recipient | delete-recipient | manage-recipient-permission | list-recipient-shares | list-recipient-permissions` **Fallback (no CLI):** same `DeltaShare` REST API via `oci raw-request` (identical endpoint + auth; see `references/oci-raw-request.md`). > **Verify-first:** `GET /shares` and `GET /recipients` are **LIVE-VERIFIED 200** on `20240831/dataLakes` > (auth `--profile DEFAULT`, api_key) — `aidp delta-share list` / `list-recipients` hit the same path. > Default to that version/prefix; treat `20260430` as the future GA target and probe only after a tenancy > upgrade. Confirm any write with a live response before destructive actions; record in > `references/rest-endpoint-map.md`. ## When to use - "Share this table/schema with <team/org>", "set up Delta Sharing", "add/manage a recipient", "grant access to a share", "rotate a recipient token". ## Workflow 1. **Verify** with `aidp delta-share list` (CLI) — or `GET /shares` (REST fallback; auth ladder in `references/oci-raw-request.md`). 2. **Create a share** → **add data assets** (`manage-data-asset`, referencing real catalog tables from `aidp-catalog-explore`) → **create/attach recipients** → **manage access/permissions**. 3. Recipient tokens: surface expiry; rotate via `update-recipient` / `manage-recipient-permission`. **Never print the recipient bearer token.** 4. Confirm before granting access or deleting a share/recipient (outward-facing — data leaves the tenancy). **Mutating ops** (share/recipient `create`, `manage-access`, `manage-data-asset`, `manage-permission`, `manage-recipient-permission`): persist the body to `.aidp/payloads/` and confirm first ([references/payloads.md]($HOME/.aidp/references/payloads.md)). ### Fallback (no CLI) — REST endpoints (base `20240831/dataLakes/<OCID>`) - Shares: `POST|GET /shares` · `GET|PUT|DELETE /shares/{k}` · `GET /shares/{k}/recipients|permissions|dataAssets` · `POST /shares/{k}/actions/manageAccess|managePermission|manageDataAsset` - Recipients: `POST|GET /recipients` · `GET|PUT|DELETE /recipients/{k}` · `GET /recipients/{k}/shares|permissions` · `POST /recipients/{k}/actions/managePermission` ## Guardrails - Sharing publishes data externally — confirm scope (which assets, which recipient) before any grant. - Don't log share tokens/credentials. ## References - [references/aidp-cli-map.md]($HOME/.aidp/references/aidp-cli-map.md) · [references/payloads.md]($HOME/.aidp/references/payloads.md) · [references/oci-raw-request.md]($HOME/.aidp/references/oci-raw-request.md) · [references/rest-endpoint-map.md]($HOME/.aidp/references/rest-endpoint-map.md)