Molt replicator fixes

src/current/_includes/molt/fetch-metrics.md

@@ -14,7 +14,7 @@ Cockroach Labs recommends monitoring the following metrics during data load:
 | `molt_fetch_table_export_duration_ms` | Duration (in milliseconds) of a table's export. For example:<br>`molt_fetch_table_export_duration_ms{table="public.users"}` |
 | `molt_fetch_table_import_duration_ms` | Duration (in milliseconds) of a table's import. For example:<br>`molt_fetch_table_import_duration_ms{table="public.users"}` |
 
-You can also use the [sample Grafana dashboard](https://molt.cockroachdb.com/molt/cli/grafana_dashboard.json) to view the preceding metrics.
+To visualize the preceding metrics, use the Grafana dashboard [bundled with your binary (`grafana_dashboard.json`)]({% link molt/molt-fetch.md %}#installation). The bundled dashboard matches your binary version. Alternatively, you can download the [latest dashboard](https://molt.cockroachdb.com/molt/cli/grafana_dashboard.json).
 
 {% if page.name != "migrate-bulk-load.md" %}
 {{site.data.alerts.callout_success}}

src/current/_includes/molt/molt-install.md

@@ -9,10 +9,12 @@ To install MOLT, download the binary that matches your architecture and source d
 | Mac              | AMD 64-bit   | [Download](https://molt.cockroachdb.com/molt/cli/molt-latest.darwin-amd64.tgz)  | [Download](https://molt.cockroachdb.com/molt/cli/molt-latest.darwin-amd64-oracle.tgz) |
 |                  | ARM 64-bit   | [Download](https://molt.cockroachdb.com/molt/cli/molt-latest.darwin-arm64.tgz)  | [Download](https://molt.cockroachdb.com/molt/cli/molt-latest.darwin-arm64-oracle.tgz) |
 
-The following binaries are included:
+The download package includes the following:
 
-- `molt`
-- `replicator`
+- `molt` binary.
+- `replicator` binary.
+- Grafana dashboard JSON files for MOLT Fetch (`grafana_dashboard.json`) and Replicator (`replicator_grafana_dashboard.json`) metrics.
+	- Oracle downloads also include the Oracle-specific Replicator dashboard (`replicator_oracle_grafana_dashboard.json`). Each bundled dashboard is compatible with its corresponding binary version.
 
 {{site.data.alerts.callout_success}}
 For ease of use, keep both `molt` and `replicator` in your current working directory.

src/current/molt/migrate-failback.md

@@ -166,12 +166,12 @@ base64 -i ./client.key | jq -R -r '@uri'
 base64 -i ./ca.crt | jq -R -r '@uri'
 ~~~
 
-When you [create the changefeed](#create-the-cockroachdb-changefeed), pass the encoded certificates in the changefeed URL, where `client_cert`, `client_key`, and `ca_cert` are [webhook sink parameters]({% link {{ site.current_cloud_version }}/changefeed-sinks.md %}#webhook-parameters). For example:
+When you [create the changefeed](#create-the-cockroachdb-changefeed), pass the encoded certificates in the changefeed URL, where `client_cert`, `client_key`, and `ca_cert` are [webhook sink parameters]({% link {{ site.current_cloud_version }}/changefeed-sinks.md %}#webhook-parameters):
 
 {% include_cached copy-clipboard.html %}
 ~~~ sql
 CREATE CHANGEFEED FOR TABLE table1, table2
-INTO 'webhook-https://host:port/database/schema?client_cert={base64_encoded_cert}&client_key={base64_encoded_key}&ca_cert={base64_encoded_ca}'
+INTO 'webhook-https://host:port/database/schema?client_cert={base64_and_url_encoded_cert}&client_key={base64_and_url_encoded_key}&ca_cert={base64_and_url_encoded_ca}'
 WITH ...;
 ~~~
 

src/current/molt/molt-fetch.md

@@ -1098,7 +1098,7 @@ Cockroach Labs recommends monitoring the following metrics:
 | `molt_fetch_table_export_duration_ms` | Duration (in milliseconds) of a table's export. For example:<br>`molt_fetch_table_export_duration_ms{table="public.users"}` |
 | `molt_fetch_table_import_duration_ms` | Duration (in milliseconds) of a table's import. For example:<br>`molt_fetch_table_import_duration_ms{table="public.users"}` |
 
-You can also use the [sample Grafana dashboard](https://molt.cockroachdb.com/molt/cli/grafana_dashboard.json) to view the preceding metrics.
+To visualize the preceding metrics, use the Grafana dashboard [bundled with your binary]({% link molt/molt-fetch.md %}#installation) (`grafana_dashboard.json`). The bundled dashboard matches your binary version. Alternatively, you can download the [latest dashboard](https://molt.cockroachdb.com/molt/cli/grafana_dashboard.json).
 
 ## Best practices
 

src/current/molt/molt-replicator.md

@@ -276,7 +276,15 @@ Encode client certificates for changefeed webhook URLs:
 
 You can use JSON Web Tokens (JWT) to authorize incoming changefeed connections and restrict writes to a subset of SQL databases or user-defined schemas in the target cluster.
 
-Replicator supports JWT claims that allow writes to specific databases, schemas, or all of them. JWT tokens must be signed using RSA or EC keys. HMAC and `None` signatures are automatically rejected.
+Replicator accepts any JWT token that meets the following requirements:
+
+- Tokens must be signed using RSA or EC keys. HMAC and `None` signatures are automatically rejected.
+- Tokens must include a `jti` (JWT ID) claim for revocation support.
+- Tokens must include a custom claim with the schema authorization list.
+
+{{site.data.alerts.callout_success}}
+You can generate tokens using the [`make-jwt` command](#generate-jwt-tokens).
+{{site.data.alerts.end}}
 
 To configure JWT authentication:
 
@@ -293,9 +301,31 @@ To pass the JWT token from the changefeed to the Replicator webhook sink, use th
 CREATE CHANGEFEED ... WITH webhook_auth_header='Bearer <encoded_token>';
 ~~~
 
+##### Generate JWT tokens
+
+The `make-jwt` command generates JWT tokens or claims for authorizing changefeed connections. It requires a signing key ([`-k`]({% link molt/replicator-flags.md %}#key)) and the database or schema to authorize ([`-a`]({% link molt/replicator-flags.md %}#allow)). You can output a signed token to a file ([`-o`]({% link molt/replicator-flags.md %}#output)) or generate an unsigned claim ([`--claim`]({% link molt/replicator-flags.md %}#claim)) for signing with an external JWT provider.
+
+The format of the `-a` argument depends on your target database. For CockroachDB and PostgreSQL, which have a schema concept, use the `database.schema` format:
+
+{% include_cached copy-clipboard.html %}
+~~~ shell
+replicator make-jwt -k ec.key -a database_name.schema_name -o out.jwt
+~~~
+
+For MySQL and Oracle, which do not have a schema concept, use only the database name:
+
+{% include_cached copy-clipboard.html %}
+~~~ shell
+replicator make-jwt -k ec.key -a database_name -o out.jwt
+~~~
+
+{{site.data.alerts.callout_success}}
+You can repeat the [`-a`]({% link molt/replicator-flags.md %}#allow) flag to authorize multiple schemas.
+{{site.data.alerts.end}}
+
 ##### Token quickstart
 
-The following example uses `OpenSSL` to generate keys, but any PEM-encoded RSA or EC keys will work.
+The following example uses `OpenSSL` to generate keys, but any PEM-encoded RSA or EC keys will work. When using this example, ensure the `-a` argument format matches your target database as specified in [Generate JWT tokens](#generate-jwt-tokens).
 
 {% include_cached copy-clipboard.html %}
 ~~~ shell
@@ -320,11 +350,7 @@ replicator make-jwt -k ec.key -a ycsb.public -o out.jwt
 
 ##### External JWT providers
 
-The `make-jwt` command also supports a [`--claim`]({% link molt/replicator-flags.md %}#claim) flag, which prints a JWT claim that can be signed by your existing JWT provider. The PEM-formatted public key or keys for that provider must be inserted into the `_replicator.jwt_public_keys` table. The `iss` (issuers) and `jti` (token id) fields will likely be specific to your auth provider, but the custom claim must be retained in its entirety.
-
-{{site.data.alerts.callout_success}}
-You can repeat the [`-a`]({% link molt/replicator-flags.md %}#allow) flag to create a claim for multiple schemas.
-{{site.data.alerts.end}}
+To use an external JWT provider, generate a claim with the `--claim` flag. The PEM-formatted public key or keys for that provider must be inserted into the `_replicator.jwt_public_keys` table. The `iss` (issuers) and `jti` (token id) fields will likely be specific to your auth provider, but the custom claim must be retained in its entirety:
 
 {% include_cached copy-clipboard.html %}
 ~~~ shell

src/current/molt/replicator-metrics.md

@@ -87,11 +87,11 @@ OK
 ### Visualize metrics
 
 <section class="filter-content" markdown="1" data-scope="postgres mysql cockroachdb">
-Use the [Replicator Grafana dashboard](https://replicator.cockroachdb.com/replicator_grafana_dashboard.json) to visualize metrics.
+Use the Replicator Grafana dashboard [bundled with your binary]({% link molt/molt-replicator.md %}#installation) (`replicator_grafana_dashboard.json`) to visualize metrics. The bundled dashboard matches your binary version. Alternatively, you can download the [latest dashboard](https://replicator.cockroachdb.com/replicator_grafana_dashboard.json).
 </section>
 
 <section class="filter-content" markdown="1" data-scope="oracle">
-Use the [Replicator Grafana dashboard](https://replicator.cockroachdb.com/replicator_grafana_dashboard.json) to visualize metrics. For Oracle sources, also import the [Oracle Grafana dashboard](https://replicator.cockroachdb.com/replicator_oracle_grafana_dashboard.json) to visualize [Oracle source metrics](#oracle-source).
+Use the Replicator Grafana dashboards [bundled with your binary]({% link molt/molt-replicator.md %}#installation) to visualize metrics. The general Replicator dashboard (`replicator_grafana_dashboard.json`) displays overall replication metrics, and the Oracle-specific dashboard (`replicator_oracle_grafana_dashboard.json`) displays [Oracle source metrics](#oracle-source). The bundled dashboards match your binary version. Alternatively, you can download the latest dashboards for [Replicator](https://replicator.cockroachdb.com/replicator_grafana_dashboard.json) and [Oracle source metrics](https://replicator.cockroachdb.com/replicator_oracle_grafana_dashboard.json).
 </section>
 
 ## Overall replication metrics
@@ -177,7 +177,7 @@ Monitor the following metrics to track checkpoint progress:
 #### Oracle source
 
 {{site.data.alerts.callout_success}}
-To visualize the following metrics, import the [Oracle Grafana dashboard](https://replicator.cockroachdb.com/replicator_oracle_grafana_dashboard.json).
+To visualize the following metrics, import the Oracle Grafana dashboard [bundled with your binary]({% link molt/molt-replicator.md %}#installation) (`replicator_oracle_grafana_dashboard.json`). The bundled dashboard matches your binary version. Alternatively, you can download the [latest dashboard](https://replicator.cockroachdb.com/replicator_oracle_grafana_dashboard.json).
 {{site.data.alerts.end}}
 
 - `oraclelogminer_scn_interval_size`