@datarails-ai/dr-cli 1.6.106 → 1.6.108

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.106",
+  version: "1.6.108",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.11.3",
+    "@datarails-ai/dr-appspace-cli": "0.11.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-07T14:49:41.993Z";
+var BUILD_TIME = "2026-10-07T17:12:24.139Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -5338,7 +5338,7 @@ async function poll(host, path11, deviceCode, options, terminalHints, onSuccess)
   const interval = options.interval ?? 2e3;
   const maxWait = options.maxWait ?? 6e5;
   const now = options.now ?? Date.now;
-  const sleep4 = options.sleep ?? defaultSleep;
+  const sleep3 = options.sleep ?? defaultSleep;
   const signal = options.signal;
   const base = host.replace(/\/+$/, "");
   const deadline = now() + maxWait;
@@ -5366,7 +5366,7 @@ async function poll(host, path11, deviceCode, options, terminalHints, onSuccess)
     }
     const errCode = tryParseErrorCode(text2);
     if (errCode === "authorization_pending" || errCode === "slow_down") {
-      await sleep4(interval, signal);
+      await sleep3(interval, signal);
       continue;
     }
     if (errCode) {
@@ -12284,7 +12284,7 @@ var defaultSleep2 = (ms, signal) => new Promise((resolve3, reject) => {
 async function pollTask(client, label, path11, options = {}) {
   const interval = options.pollIntervalMs ?? AGGREGATE_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? AGGREGATE_POLL_TIMEOUT_MS;
-  const sleep4 = options.sleep ?? defaultSleep2;
+  const sleep3 = options.sleep ?? defaultSleep2;
   const now = options.now ?? Date.now;
   const inner = new AbortController();
   const onOuterAbort = () => inner.abort(options.signal?.reason);
@@ -12326,7 +12326,7 @@ async function pollTask(client, label, path11, options = {}) {
         return result.env;
       }
       try {
-        await sleep4(interval, inner.signal);
+        await sleep3(interval, inner.signal);
       } catch {
         const reason = inner.signal.reason instanceof Error ? inner.signal.reason.message : String(inner.signal.reason ?? "aborted");
         throw new Error(`${label} polling timed out: ${reason}`);
@@ -15542,7 +15542,7 @@ var abortableSleep = (ms, signal) => new Promise((resolve3, reject) => {
 });
 async function putWithCacheKeyPolling(client, path11, payload, options = {}) {
   const interval = options.pollIntervalMs ?? CACHE_KEY_POLL_INTERVAL_MS;
-  const sleep4 = options.sleep ?? abortableSleep;
+  const sleep3 = options.sleep ?? abortableSleep;
   const label = options.label ?? "data";
   const body = JSON.stringify(payload);
   const first = await putOnce(client, path11, body, options);
@@ -15558,7 +15558,7 @@ async function putWithCacheKeyPolling(client, path11, payload, options = {}) {
   const pollPath = withCacheKey(path11, cacheKey);
   for (; ; ) {
     try {
-      await sleep4(interval, options.signal);
+      await sleep3(interval, options.signal);
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       throw new Error(`${label} polling timed out: ${reason}`);
@@ -15747,7 +15747,7 @@ function parseDrilldown(body) {
 }
 async function exportDrilldownCsv(client, id, body, options = {}) {
   const interval = options.pollIntervalMs ?? CACHE_KEY_POLL_INTERVAL_MS;
-  const sleep4 = options.sleep ?? abortableSleep;
+  const sleep3 = options.sleep ?? abortableSleep;
   const path11 = `/api/functions/${id}/drilldown/export_to_csv`;
   const payload = JSON.stringify(body);
   let res = await putOnce(client, path11, payload, options);
@@ -15758,7 +15758,7 @@ async function exportDrilldownCsv(client, id, body, options = {}) {
     }
     for (; ; ) {
       try {
-        await sleep4(interval, options.signal);
+        await sleep3(interval, options.signal);
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
         throw new Error(`drill-down CSV export polling timed out: ${reason}`);
@@ -18210,7 +18210,7 @@ var LUT_SAVE_POLL_TIMEOUT_MS = 3e5;
 async function saveMappings(client, documentId, body, options = {}) {
   const interval = options.pollIntervalMs ?? LUT_SAVE_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? LUT_SAVE_POLL_TIMEOUT_MS;
-  const sleep4 = options.sleep ?? defaultPollSleep;
+  const sleep3 = options.sleep ?? defaultPollSleep;
   const now = options.now ?? Date.now;
   const deadline = now() + timeout;
   const path11 = `/api/documents/${documentId}/web_update_lut`;
@@ -18232,7 +18232,7 @@ async function saveMappings(client, documentId, body, options = {}) {
         `lut save-mappings: the server is still writing after ${Math.round(timeout / 1e3)}s (task ${cacheKey}). The write is still running server-side \u2014 re-run the same command to rejoin it, or raise --timeout.`
       );
     }
-    await sleep4(interval, options.signal);
+    await sleep3(interval, options.signal);
     const tick = await postOnce(client, pollPath, payload, options.signal);
     if (tick.status === 200) {
       return toResult(tick.text);
@@ -18530,7 +18530,7 @@ async function exportDocument(client, id, destinationOrgIds, override, reqOption
 async function pollDocumentJob(client, basePath, label, requestId, options = {}) {
   const interval = options.pollIntervalMs ?? AUTO_CALC_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? AUTO_CALC_POLL_TIMEOUT_MS;
-  const sleep4 = options.sleep ?? defaultSleep3;
+  const sleep3 = options.sleep ?? defaultSleep3;
   const now = options.now ?? Date.now;
   const deadline = now() + timeout;
   for (; ; ) {
@@ -18558,7 +18558,7 @@ async function pollDocumentJob(client, basePath, label, requestId, options = {})
         `${label} polling timed out after ${timeout}ms (request ${requestId} still processing)`
       );
     }
-    await sleep4(interval, options.signal);
+    await sleep3(interval, options.signal);
   }
 }
 
@@ -21783,7 +21783,7 @@ async function waitForReAggregation(cfg) {
   let interval = cfg.pollIntervalMs ?? REAGG_POLL_INTERVAL_MS;
   const maxInterval = cfg.maxPollIntervalMs ?? REAGG_POLL_MAX_INTERVAL_MS;
   const timeout = cfg.timeoutMs ?? REAGG_POLL_TIMEOUT_MS;
-  const sleep4 = cfg.sleep ?? defaultSleep4;
+  const sleep3 = cfg.sleep ?? defaultSleep4;
   const now = cfg.now ?? Date.now;
   const accepted = [...cfg.accepted];
   const observedProcessing = /* @__PURE__ */ new Set();
@@ -21818,7 +21818,7 @@ async function waitForReAggregation(cfg) {
       break;
     }
     try {
-      await sleep4(interval, cfg.signal);
+      await sleep3(interval, cfg.signal);
     } catch {
       aborted = true;
       break;
@@ -24425,7 +24425,7 @@ async function waitForSuggestionRun(r, cfg, runId) {
   let interval = cfg.pollIntervalMs ?? SUGGESTIONS_POLL_INTERVAL_MS;
   const maxInterval = cfg.maxPollIntervalMs ?? SUGGESTIONS_POLL_MAX_INTERVAL_MS;
   const timeout = cfg.timeoutMs ?? SUGGESTIONS_POLL_TIMEOUT_MS;
-  const sleep4 = cfg.sleep ?? defaultSleep5;
+  const sleep3 = cfg.sleep ?? defaultSleep5;
   const now = cfg.now ?? Date.now;
   const errOut = cfg.errOut ?? process.stderr;
   const start = now();
@@ -24455,7 +24455,7 @@ async function waitForSuggestionRun(r, cfg, runId) {
       break;
     }
     try {
-      await sleep4(interval, cfg.signal);
+      await sleep3(interval, cfg.signal);
     } catch {
       aborted = true;
       break;
@@ -30451,9 +30451,6 @@ function registerSkillCommand(root) {
   });
 }
 
-// src/commands/datamappers.ts
-import { setTimeout as sleep3 } from "timers/promises";
-
 // src/api/datamappers.ts
 async function list20(client, tableId, options) {
   const out = await client.getJSON(`/api/templates/${tableId}/mappers`, options);
@@ -30487,14 +30484,6 @@ async function create12(client, tableId, body, options) {
   }
   return out;
 }
-async function update8(client, id, body, options) {
-  const path11 = `/api/templates/mappers/${id}`;
-  const out = await client.putJSON(path11, body, options);
-  if (out === null) {
-    throw new Error(`PUT ${path11}: empty response from datamapper update`);
-  }
-  return out;
-}
 async function deleteById12(client, tableId, id, options) {
   await client.deleteJSON(`/api/templates/${tableId}/mappers/${id}`, options);
 }
@@ -31218,34 +31207,69 @@ async function runDatamappersUpdate(cfg) {
       "merge"
     );
   }
+  const err = cfg.err ?? process.stderr;
   const { decoded: decodedBody, changeCount } = decodeBodyEntitiesDeep(body);
   if (changeCount > 0) {
-    process.stderr.write(
-      `note: decoded ${changeCount} HTML entit${changeCount === 1 ? "y" : "ies"} (&quot; \u2192 ", &amp; \u2192 &, &lt; \u2192 <, &gt; \u2192 >) in the request body \u2014 mirrors the legacy webclient's ajaxService.success post-processing; the server's GET response carries the entities and the PUT-side parser doesn't decode them.
+    err.write(
+      `note: decoded ${changeCount} HTML entit${changeCount === 1 ? "y" : "ies"} (&quot; \u2192 ", &amp; \u2192 &, &lt; \u2192 <, &gt; \u2192 >) in the request body \u2014 mirrors the legacy webclient's ajaxService.success post-processing; the server's GET response carries the entities and the mapper compiler doesn't decode them.
 `
     );
     body = decodedBody;
   }
   validateCalcFields(extractCalcFields(body));
-  const err = cfg.err ?? process.stderr;
-  const scanBaseline = rescanValue === "latest" && cfg.verifyScanDispatch !== void 0 ? await captureScanBaseline(cfg.client, cfg.id, cfg.signal, err) : void 0;
-  let updated;
+  const details = await getDetails2(cfg.client, cfg.id, { signal: cfg.signal });
+  const templateId = details.template.id;
+  const payloadVersion = body["document_version_id"];
+  if (payloadVersion != null && !(Number.isInteger(payloadVersion) && payloadVersion > 0)) {
+    throw new Error(
+      `payload document_version_id must be a positive integer, got ${JSON.stringify(payloadVersion)}`
+    );
+  }
+  const versionId = payloadVersion ?? details.from_version;
+  if (typeof versionId !== "number") {
+    throw new Error(
+      `mapper ${cfg.id} has no source document version (typical after an org import or template push). Add "document_version_id" to the payload: an ACTIVE version of one of its documents (\`dr filebox versions <filebox_id>\`), with a sheet_name that exists in it`
+    );
+  }
+  const current = await get14(cfg.client, templateId, cfg.id, { signal: cfg.signal });
+  for (const key of ["id", "mapped_documents_ids", "previous_version", "mapping_date"]) {
+    delete body[key];
+  }
+  const boundDocs = current.mapped_documents_ids ?? [];
+  const payloadDocs = body["selected_document_ids"];
+  const hasPayloadDocs = Array.isArray(payloadDocs) && payloadDocs.length > 0;
+  if (boundDocs.length === 0 && !hasPayloadDocs) {
+    throw new Error(
+      `mapper ${cfg.id} is bound to no documents, so it is most likely an older version that an update or a UI publish replaced. Find the current one with \`dr datamappers list --table ${templateId}\`, or name the documents in the payload with "selected_document_ids"`
+    );
+  }
+  body = {
+    // GET returns the name HTML-escaped; sent back as is, it would be stored escaped twice.
+    name: decodeHtmlEntitiesDeep(details.name),
+    ordinal: current.ordinal,
+    ...body,
+    // Pinned after the spread: a null version or an empty doc list in the
+    // payload would otherwise publish a version bound to nothing.
+    document_version_id: versionId,
+    selected_document_ids: hasPayloadDocs ? payloadDocs : boundDocs,
+    datamapper_id: cfg.id
+  };
+  const publishPath = `/api/templates/${templateId}/mappers`;
+  let published;
   try {
-    updated = await update8(cfg.client, cfg.id, body, {
-      signal: cfg.signal
-    });
+    published = await create12(cfg.client, templateId, body, { signal: cfg.signal });
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     if (/HTTP 500/.test(msg)) {
-      const hint = "hint: the server logs an `ETLError: Custom Columns: The creation of '<field>' field has failed due to incorrect formula syntax.` line for this case but the response body is a bare 500 HTML page. Common causes the client-side guard cannot detect: (1) a [field] reference in a calc formula that does not resolve to any header `map_to`, calc-field `name`, or system field (`[FileBox_ID]`, `[System_Year]`, `[Posting Date]`, \u2026), (2) an unsupported function name (try copying the function spelling from another working calc field via `dr datamappers get`), (3) a string literal that's a plain-English placeholder (e.g. `\"Customer or Client name\"`) which parses but the ETL refuses. Iterate on calc-field formulas one at a time. If every formula looks correct and PUT still 500s, fall back to the workaround: `dr datamappers create from-file <table> --file <new.json>` then `dr datamappers delete <old_id> --table <table>` (note: this orphans references \u2014 LUTs/dashboards/functions pointing at the old mapper id break).";
+      const hint = "hint: the server logs an `ETLError: Custom Columns: The creation of '<field>' field has failed due to incorrect formula syntax.` line for this case but the response body is a bare 500 HTML page. Common causes the client-side guard cannot detect: (1) a [field] reference in a calc formula that does not resolve to any header `map_to`, calc-field `name`, or system field (`[FileBox_ID]`, `[System_Year]`, `[Posting Date]`, \u2026), (2) an unsupported function name (try copying the function spelling from another working calc field via `dr datamappers get`), (3) a string literal that's a plain-English placeholder (e.g. `\"Customer or Client name\"`) which parses but the ETL refuses. Iterate on calc-field formulas one at a time.";
       const responseBody = extractResponseBodyFromError(msg);
       let logPath;
       try {
         logPath = await writeErrorLog({
           command: `dr datamappers update ${cfg.id} --payload-file ${payloadFile}`,
           server: cfg.serverFlag ?? "",
-          method: "PUT",
-          url: `/api/templates/mappers/${cfg.id}`,
+          method: "POST",
+          url: publishPath,
           status: 500,
           requestBody: body,
           responseBody,
@@ -31264,103 +31288,26 @@ ${hint}${logSuffix}`);
     throw err2;
   }
   if (cfg.asJson) {
-    writeJSONIndented(cfg.out, updated);
+    writeJSONIndented(cfg.out, published);
   } else {
-    renderMappersTable(cfg.out, [updated]);
-  }
-  if (scanBaseline !== void 0) {
-    const opts = cfg.verifyScanDispatch ?? {};
-    const started2 = await waitForNewScan(cfg.client, scanBaseline, cfg.signal, opts);
-    if (!started2) {
-      const docIds = await mappedDocumentIds(
-        cfg.client,
-        scanBaseline.templateId,
-        cfg.id,
-        cfg.signal
-      );
-      err.write(
-        formatNoScanWarning({
-          mapperId: cfg.id,
-          templateId: scanBaseline.templateId,
-          timeoutMs: opts.timeoutMs ?? DEFAULT_SCAN_DISPATCH_TIMEOUT_MS,
-          docIds
-        })
-      );
-    }
-  }
-}
-var DEFAULT_SCAN_DISPATCH_TIMEOUT_MS = 3e4;
-var DEFAULT_SCAN_DISPATCH_POLL_MS = 2e3;
-function scanFingerprint(report) {
-  let maxScanId = 0;
-  for (const doc of report.documents ?? []) {
-    for (const v of doc.versions ?? []) {
-      if (typeof v.scan_id === "number" && v.scan_id > maxScanId) maxScanId = v.scan_id;
-    }
-  }
-  return `${report.scans_status?.last_updated ?? ""}|${maxScanId}`;
-}
-async function captureScanBaseline(client, mapperId, signal, err) {
-  try {
-    const details = await getDetails2(client, mapperId, { signal });
-    const templateId = details.template.id;
-    const report = await getStatus(client, templateId, { signal });
-    return { templateId, fingerprint: scanFingerprint(report) };
-  } catch (e) {
-    if (signal.aborted) throw e;
-    err.write(
-      "note: could not read the scan status before the update, so dr cannot confirm a rescan starts. Check with `dr scans status <template_id>` afterwards.\n"
-    );
-    return void 0;
-  }
-}
-async function waitForNewScan(client, baseline, signal, opts) {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_SCAN_DISPATCH_TIMEOUT_MS;
-  const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_SCAN_DISPATCH_POLL_MS;
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    try {
-      const report = await getStatus(client, baseline.templateId, { signal });
-      if (scanFingerprint(report) !== baseline.fingerprint) return true;
-    } catch (e) {
-      if (signal.aborted) throw e;
-    }
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) return false;
-    await sleep3(Math.min(pollIntervalMs, remaining), void 0, { signal });
+    renderMappersTable(cfg.out, [published]);
   }
-}
-async function mappedDocumentIds(client, templateId, mapperId, signal) {
-  try {
-    const mapper = await get14(client, templateId, mapperId, { signal });
-    return Array.isArray(mapper.mapped_documents_ids) ? mapper.mapped_documents_ids : void 0;
-  } catch (e) {
-    if (signal.aborted) throw e;
-    return void 0;
-  }
-}
-function formatNoScanWarning(p) {
-  const secs = Math.round(p.timeoutMs / 1e3);
-  const lines = [
-    `warning: mapper ${p.mapperId} was saved, but no new scan showed up on template ${p.templateId} within ${secs}s.`,
-    '  Either the scan is still queued, or this server predates the DR-54200 fix and ignored rescan="latest", so existing data still has the old config.',
-    `  Check first: dr scans status ${p.templateId}`
-  ];
-  if (p.docIds !== void 0 && p.docIds.length === 0) {
-    lines.push("  The mapper has no bound documents, so there is nothing to scan.");
-  } else {
-    const docFlags = p.docIds !== void 0 ? p.docIds.map((d) => `--doc ${d}`).join(" ") : "--doc <doc_id> [--doc <doc_id> ...]";
-    lines.push(
-      "  If no new scan appears there, re-bind the mapper to its current documents with a rescan:"
+  err.write(
+    `note: mapper ${cfg.id} was published as new version ${published.id} on template ${templateId}; use ${published.id} for later updates.
+`
+  );
+  const declaredCalcNames = extractCalcFields(body).map((c) => c.name).filter((n) => n !== "");
+  if (declaredCalcNames.length > 0 && rescanValue !== "") {
+    const result = await verifyCalcFieldsMaterialise(
+      cfg.client,
+      templateId,
+      declaredCalcNames,
+      cfg.signal,
+      cfg.verifyCalcFieldsOpts
     );
-    if (p.docIds === void 0) {
-      lines.push(
-        `    dr datamappers get ${p.mapperId} --table ${p.templateId} --json   # read mapped_documents_ids`
-      );
-    }
-    lines.push(`    dr datamappers bind ${p.mapperId} ${docFlags} --rescan latest`);
+    const timeoutMs = cfg.verifyCalcFieldsOpts?.timeoutMs ?? 3e4;
+    err.write(formatVerifyResult(templateId, result, timeoutMs));
   }
-  return lines.join("\n") + "\n";
 }
 async function buildConveniencePayload(client, tableId, name, versionId, sheet, flags, signal) {
   const fieldTypes = parseFieldOverrides(flags.fieldOverrides);
@@ -31973,8 +31920,12 @@ function registerDatamappersCommand(root) {
   addServerFlag(fromFileCmd);
   addAccountFlag(fromFileCmd);
   const updateCmd = dm.command("update").description(
-    "Update a datamapper in place (payload-file only \u2014 server accepts config+sheet_name+rescan). `--rescan latest` (the default) re-extracts the LATEST version of each document bound to the mapper. Servers without the DR-54200 fix save the config and start no scan, so after the update dr watches the template for a new scan and, when none shows up, prints how to check `dr scans status` and the `dr datamappers bind` fallback. For a full historical rescan (every calculated field re-executed against every document version ever uploaded), use `dr rescan table <template_id>` instead \u2014 that is far more expensive and higher-blast."
-  ).argument("<mapper_id>", "mapper id (positive integer)").option("--payload-file <path>", "Path to a JSON file with the PUT body (required)", "").option(
+    'Update a datamapper (payload-file only: config + sheet_name, optionally name). Publishes the payload as a new version of the mapper, the way the UI "Publish and scan" does: new columns are added to the table, the new version takes over the documents of the old one, and the old version is unbound. The new version has a NEW mapper id, which dr prints. `--rescan latest` (the default) re-extracts the LATEST version of each bound document, then dr checks that any calculated fields in the payload appear on the table. For a full historical rescan (every calculated field re-executed against every document version ever uploaded), use `dr rescan table <template_id>` instead \u2014 that is far more expensive and higher-blast.'
+  ).argument("<mapper_id>", "mapper id (positive integer)").option(
+    "--payload-file <path>",
+    "Path to a JSON file with the mapper body: config, sheet_name, optional name (required)",
+    ""
+  ).option(
     "--field <NAME:TYPE>",
     'Set a column type via fields_to_change (Text|Float|Date|Integer). Repeatable. Mirrors the UI "Publish and scan" so a calc column referencing a LUT-injected column materialises instead of 500ing on inferred types. Note: the server blocks a type change (HTTP 400) when the template has more than one mapper.',
     collectArrayOpt,
@@ -31996,8 +31947,7 @@ function registerDatamappersCommand(root) {
           serverFlag: opts.server ?? "",
           asJson: opts.json === true,
           signal: setup.signal,
-          out: process.stdout,
-          verifyScanDispatch: {}
+          out: process.stdout
         });
       } finally {
         setup.cleanup();
@@ -33732,7 +33682,7 @@ async function create15(client, body, reqOptions) {
   }
   return out;
 }
-async function update9(client, id, body, reqOptions) {
+async function update8(client, id, body, reqOptions) {
   const path11 = `/api/v3/data_integrations/${id}/`;
   const out = await client.putJSON(path11, body, reqOptions);
   if (out === null) {
@@ -35510,7 +35460,7 @@ var defaultSleep6 = (ms, signal) => new Promise((resolve3, reject) => {
 async function waitForDataQuerySync(cfg) {
   let interval = cfg.pollIntervalMs ?? DQ_WAIT_POLL_INTERVAL_MS;
   const maxInterval = cfg.maxPollIntervalMs ?? DQ_WAIT_POLL_MAX_INTERVAL_MS;
-  const sleep4 = cfg.sleep ?? defaultSleep6;
+  const sleep3 = cfg.sleep ?? defaultSleep6;
   const now = cfg.now ?? Date.now;
   const start = now();
   const deadline = start + cfg.timeoutSec * 1e3;
@@ -35552,7 +35502,7 @@ async function waitForDataQuerySync(cfg) {
       break;
     }
     try {
-      await sleep4(interval, cfg.signal);
+      await sleep3(interval, cfg.signal);
     } catch {
       outcome = "cancelled";
       break;
@@ -36863,7 +36813,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
     throw new Error("version id must be positive");
   }
   const err = cfg.err ?? process.stderr;
-  const sleep4 = cfg.sleep ?? defaultCycleTagSleep;
+  const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
   const settleMs = cfg.tagSettleDelayMs ?? CYCLE_TAG_SETTLE_DELAY_MS;
   const details = await getDetails(cfg.client, cfg.docId, { signal: cfg.signal });
   const tag = (details.tags_config ?? []).find(isFileStatusTag);
@@ -36956,7 +36906,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
     }
   };
   const readBack = async () => {
-    await sleep4(settleMs, cfg.signal);
+    await sleep3(settleMs, cfg.signal);
     return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
   };
   await write();
@@ -39291,7 +39241,7 @@ async function runIntegrationsSync(cfg) {
     throw new Error("integration id must be positive");
   }
   const interval = cfg.pollIntervalMs ?? INTEGRATIONS_SYNC_POLL_INTERVAL_MS;
-  const sleep4 = cfg.sleep ?? defaultSleep7;
+  const sleep3 = cfg.sleep ?? defaultSleep7;
   const resp = await resync(cfg.client, cfg.id, {
     signal: cfg.signal
   });
@@ -39340,7 +39290,7 @@ async function runIntegrationsSync(cfg) {
         return;
       }
       try {
-        await sleep4(interval, inner.signal);
+        await sleep3(interval, inner.signal);
       } catch {
         cfg.out.write(
           `Timed out waiting for sync to finish \u2014 last status was ${orDash2(lastStatus)}
@@ -39430,7 +39380,7 @@ async function runIntegrationsUpdate(cfg) {
     throw new Error("--payload-file is required");
   }
   const body = await readJsonPayload(pf);
-  const updated = await update9(cfg.client, cfg.id, body, {
+  const updated = await update8(cfg.client, cfg.id, body, {
     signal: cfg.signal
   });
   if (cfg.asJson) {
@@ -57217,7 +57167,7 @@ async function create16(client, body, options) {
   }
   return out;
 }
-async function update10(client, id, body, options) {
+async function update9(client, id, body, options) {
   const out = await client.putJSON(`/api/templates/${id}/calcmodels`, body, options);
   if (out === null) {
     throw new Error(
@@ -57314,7 +57264,7 @@ async function runCalcmodelsUpdate(cfg) {
     );
   }
   validateCalcmodelBody(body);
-  const updated = await update10(cfg.client, cfg.id, body, {
+  const updated = await update9(cfg.client, cfg.id, body, {
     signal: cfg.signal
   });
   if (cfg.asJson) {
@@ -57361,7 +57311,7 @@ async function runCalcmodelsSetFlow(cfg) {
       `new update_flow:     ${flow}`
     ]),
     execute: async () => {
-      const updated = await update10(
+      const updated = await update9(
         cfg.client,
         cfg.id,
         { ...model, update_flow: flow },
@@ -57391,7 +57341,7 @@ async function runCalcmodelsRecalculate(cfg) {
       `type: ${model.type}`
     ]),
     execute: async () => {
-      await update10(cfg.client, cfg.id, model, { signal: cfg.signal });
+      await update9(cfg.client, cfg.id, model, { signal: cfg.signal });
       cfg.out.write(`recalculation queued \u2014 check status via dr calcmodels get ${cfg.id}
 `);
     }
@@ -57657,7 +57607,7 @@ async function create17(client, templateId, body, options) {
   }
   return out;
 }
-async function update11(client, templateId, calcId, body, options) {
+async function update10(client, templateId, calcId, body, options) {
   const out = await client.putJSON(
     `/api/templates/${templateId}/calc_vals/${calcId}`,
     body,
@@ -57784,7 +57734,7 @@ async function runCalcValsUpdate(cfg) {
         `--file body.id (${String(bodyId)}) does not match URL id (${cfg.id}) \u2014 refusing to overwrite calc value #${cfg.id} with another value's body. Either fix the body's id field or point --file at the right file.`
       );
     }
-    updated = await update11(cfg.client, cfg.templateId, cfg.id, body, {
+    updated = await update10(cfg.client, cfg.templateId, cfg.id, body, {
       signal: cfg.signal
     });
   } else {
@@ -57799,7 +57749,7 @@ async function runCalcValsUpdate(cfg) {
       // `--format ""` clears the mask (→ null); otherwise keep existing.
       format: cfg.format !== void 0 ? cfg.format === "" ? null : cfg.format : existing.format
     };
-    updated = await update11(cfg.client, cfg.templateId, cfg.id, body, {
+    updated = await update10(cfg.client, cfg.templateId, cfg.id, body, {
       signal: cfg.signal
     });
   }
@@ -60805,7 +60755,7 @@ async function defaultSleep8(ms, signal) {
 async function pollExtractionStatus(client, contractFileIds, options = {}) {
   const interval = options.pollIntervalMs ?? EXTRACT_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? EXTRACT_POLL_TIMEOUT_MS;
-  const sleep4 = options.sleep ?? defaultSleep8;
+  const sleep3 = options.sleep ?? defaultSleep8;
   const now = options.now ?? Date.now;
   const resolved = /* @__PURE__ */ new Map();
   if (contractFileIds.length === 0) return { resolved, pending: [] };
@@ -60855,7 +60805,7 @@ async function pollExtractionStatus(client, contractFileIds, options = {}) {
       options.onTick?.(resolved.size, contractFileIds.length);
       if (resolved.size >= contractFileIds.length) break;
       if (now() > deadline || inner.signal.aborted) break;
-      await sleep4(interval, inner.signal);
+      await sleep3(interval, inner.signal);
     }
   } finally {
     clearTimeout(deadlineTimer);
@@ -63712,7 +63662,7 @@ function registerSpendControlCommand(root) {
   );
   addServerFlag(bulkCreate);
   addAccountFlag(bulkCreate);
-  const update12 = contracts.command("update").description("Partially update a contract by id (PATCH /contracts/{id})").argument("<contract_id>", "Contract UUID").requiredOption("--from <path>", "Path to JSON body matching ContractPartialUpdateSchema").option("--json", "Output raw JSON of the updated contract", false).action(async (contractId, opts) => {
+  const update11 = contracts.command("update").description("Partially update a contract by id (PATCH /contracts/{id})").argument("<contract_id>", "Contract UUID").requiredOption("--from <path>", "Path to JSON body matching ContractPartialUpdateSchema").option("--json", "Output raw JSON of the updated contract", false).action(async (contractId, opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runContractUpdate({
@@ -63727,8 +63677,8 @@ function registerSpendControlCommand(root) {
       setup.cleanup();
     }
   });
-  addServerFlag(update12);
-  addAccountFlag(update12);
+  addServerFlag(update11);
+  addAccountFlag(update11);
   for (const spec of [
     {
       name: "archive",

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.106",
+  "cliVersion": "1.6.108",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/SKILL.md

@@ -556,8 +556,9 @@ returns the source rows behind the number.
 counts — and a token; re-run with `--confirm-token` to fire it) → poll `scans
 status` again. This is a **full historical** rescan (every calc field × every
 version). To only pick up a datamapper change on the live template, prefer
-`datamappers update <id> --rescan latest` (latest version of the mapper's bound
-documents only) — far cheaper and lower-blast.
+`datamappers update <id> --payload-file <p> --rescan latest` (latest version of
+the mapper's bound documents only) — far cheaper and lower-blast. It publishes a
+new mapper version, so the mapper gets a **new id**, which dr prints.
 
 **Build a `create` body from plain-English intent** (calc models, datamappers,
 metrics): you resolve names → integer IDs yourself against the tenant

package/dist/skills/dr-cli/reference/datamappers.md

@@ -67,12 +67,23 @@ value-inference behavior. `NAME` is the target **table field** name (the
 ## Update / preview / bind / delete
 
 - `datamappers update`, `datamappers delete` (two-step confirm).
-- `datamappers update --rescan latest` — after the PUT, dr watches the
-  template's scan status for up to 30s, because servers without the DR-54200 fix
-  save the config but ignore `rescan: "latest"`. If no new scan shows up, it
-  prints a warning with a ready `datamappers bind <id> --doc … --rescan latest`
-  command. Run `scans status <template_id>` first: the scan may only be queued,
-  and `bind` on a queued scan starts a second one. Don't re-run `update`.
+- `datamappers update <id> --payload-file <p>` publishes the payload as a **new
+  version** of the mapper, the same request the UI's "Publish and scan" sends
+  (`POST /api/templates/<tid>/mappers` with `datamapper_id` = the old id). The
+  server adds any new columns to the table, binds the new version to the old
+  one's documents, unbinds the old one, and rescans (`--rescan latest` by
+  default). The payload needs `config` and `sheet_name`; dr fills in `name`,
+  `ordinal`, the bound documents and the source version from the old mapper,
+  and any of those keys in the payload wins.
+- **The mapper gets a new id.** dr prints it (`note: mapper <old> was published
+  as new version <new>`). Use the new id for the next update, and keep an
+  old→new log if anything outside the table refers to the mapper id.
+  `update` refuses an old id that is bound to no documents, and points at
+  `datamappers list --table <tid>` for the current one.
+- A mapper made by an org import or template push has no source version on
+  record, and `update` stops with an error. Add `"document_version_id"` to the
+  payload: an ACTIVE version of one of its documents, with a `sheet_name` that
+  exists in it.
 - `datamappers preview --payload-file <p>` — renders mapper output for sample
   input ("what would this extract?") before saving.
 - `datamappers bind <mapper_id> --doc <id> [--rescan latest|all]` — change which
@@ -82,15 +93,15 @@ value-inference behavior. `NAME` is the target **table field** name (the
 
 `datamappers update <id> --payload-file <p> [--field NAME:TYPE ...]`. Repeatable;
 `TYPE` is `Text|Float|Date|Integer`. Each `--field` becomes a `fields_to_change`
-entry on the PUT body, telling the server to set that column's type **explicitly**
+entry in the body, telling the server to set that column's type **explicitly**
 instead of inferring it — this is exactly what the web UI's "Publish and scan"
-does (same `PUT api/templates/mappers/<id>` endpoint; the only payload difference
-is `fields_to_change`).
+does (same `POST api/templates/<tid>/mappers` endpoint; the only payload
+difference is `fields_to_change`).
 
 **When you need it:** adding a calc column that multiplies/divides by a
 **LUT-injected column**. LUT columns land as **Text**; the server infers Text for
 them, so a formula like `[Posting Amount] * [Sign]` fails to materialise and the
-PUT returns a bare `HTTP 500` (`ETLError: … incorrect formula syntax`) — even
+publish returns a bare `HTTP 500` (`ETLError: … incorrect formula syntax`) — even
 though the formula is valid. Fixing the LUT column's type up-front lets it
 materialise:
 
@@ -120,12 +131,12 @@ valid formula the ETL compiler can't resolve (unknown/wrong-cased function,
 unresolvable `[field]` reference, a string-constant that happens to be quoted)
 still returns a bare 500.
 
-After `create`, the CLI polls the template's `fields[]` for up to 30s for every
+After `create` and `update`, the CLI polls the template's `fields[]` for up to 30s for every
 declared calc field to materialise, and warns (pointing at `mapper-recipes get`
 for working formulas) if any are missing — this catches the EOMONTH failure
 mode. Skipped when `--no-rescan` is set.
 
-On a PUT 500, the CLI writes a `dr-cli-error-<timestamp>.md` to the cwd capturing
+On a create or update 500, the CLI writes a `dr-cli-error-<timestamp>.md` to the cwd capturing
 URL + status + request/response bodies; the path is named in the stderr error.
 
 Formula syntax:

package/dist/skills/dr-cli/reference/integrations.md

@@ -12,7 +12,7 @@ Write:
 
 - `integrations add` (payload-file), `integrations sync`,
   `integrations test-connection`, `integrations update`,
-  `integrations delete` (two-step confirm).
+  `integrations delete` (two-step confirm, Tier A, see below).
 - `integrations revoke <id>` (two-step confirm; Tier A on prod) — Disconnect a
   `DatarailsConnector` OAuth data source: `POST /api/v2/data_integrations/<id>/revoke`.
   The grant is cleared locally first (`oauth_tokens`/`oauth_pending` dropped,
@@ -23,6 +23,38 @@ Write:
   `revoked` may leave the grant live at the vendor. Legacy vendors are refused.
 - `integrations share users` / `integrations share groups`.
 
+### Deleting a data source (`integrations delete <id>`)
+
+`DELETE /api/v3/data_integrations/<id>/`. It cannot be undone and **cascades to queries and
+documents**. Typical use: removing a validation or staging datasource that holds live customer
+credentials once its bindings are gone.
+
+1. **Plan:** run it without a token, as the identity that owns the data source (on a staging org,
+   the impersonated staging user, never the operator):
+   `dr integrations delete <id> --server <S> --account <user>`. It prints `name`, `type`, `status`,
+   `org` (name + id) and `shared` (user/group counts), plus the exact confirm command with a token
+   that expires in **10 minutes** and is bound to this id and verb. Check the org id and the name
+   before going on: the plan does **not** list the queries and documents the cascade will remove.
+   Make sure nothing you want to keep still points at this data source.
+2. **Relay and get a "yes"**: name, org and why it is being deleted.
+3. **Confirm:** re-run the printed command with `--confirm-token <tok>`. On a prod tenant (`US`,
+   `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO`) this is **Tier A**: the binary shows a fresh word in a
+   desktop dialog (or a TTY prompt) and a human must type it. With no interactive channel it exits
+   non-zero; hand the printed line to the user rather than retrying. Success prints
+   `Deleted integration <id> — "<name>".`
+4. **Verify:** `dr integrations get <id> --server <S> --account <user>` returns `HTTP 404`.
+
+Notes:
+
+- `dr connectors` `Connector` rows that reference the data source (`--secret-ref`) are **not**
+  deleted, and dr-cli has no connector delete. Delete the `dr connectors` bindings first
+  (`dr connectors query delete`), then record the orphaned connector id.
+- A `403` (`delete refused: …`) means the identity can't delete it: switch to the owner's account,
+  not to the operator.
+- Deleting a validation data source on the Workato-migration staging orgs left the staging fileboxes
+  in place (their data-query rows pointed at the data source). Check one with `dr filebox get` after
+  the delete if you need them as evidence.
+
 ## IT-admin file-sync (`integrations it`)
 
 File-sync connectors only — OneDrive / SharePoint / Egnyte. Output redacts

package/dist/skills/dr-cli/reference/templates.md

@@ -149,8 +149,9 @@ except on `update`, which resolves the range's own table automatically.
   the blast radius (document + version counts) and get a token, then re-run with
   `--confirm-token` — token-only, no word gate even on prod (a rescan re-derives
   data, it doesn't delete it). To pick up a datamapper change on the live template
-  **without** touching history, use `datamappers update <id> --rescan latest`
-  instead (re-extracts the latest version of the mapper's bound documents); a full rescan will re-run pre-existing
+  **without** touching history, use `datamappers update <id> --payload-file <p>
+  --rescan latest` instead (re-extracts the latest version of the mapper's bound
+  documents; it publishes a new mapper version, so the mapper gets a new id); a full rescan will re-run pre-existing
   calc fields against old rows, so a latent divide-by-null there fails the whole
   scan. Refuses `UsageStats` on every tenant (system data, not customer-owned).
 - `dataflow get` — the dependency graph: inputs → mappers → LUTs → table →

package/dist/skills/fx-conversion-matrix/SKILL.md

@@ -431,27 +431,20 @@ this path that advice does not hold.) The generator omits it.
 `document_version_id` is required and is **not** in `dr datamappers get` output —
 read it from the upload response or `dr filebox versions <filebox_id>`.
 
-### Changing a mapper that already exists: remap, don't update
+### Changing a mapper that already exists: remap
 
 Widening an existing feed mapper, or adding reporting-amount columns to a business
-table's mappers, means editing mappers that already exist. `dr datamappers update` is
-the obvious tool, and on many orgs **it cannot work.** A mapper created by an org
-import or template push has no source version on record. `PUT
-/api/templates/mappers/<id>` reads the mapper's source file, and for such a mapper it
-fails with a bare HTTP 500. The server log shows `AttributeError: 'NoneType' object has
-no attribute 'get_document_data'`. No request body fixes it, because the endpoint never
-reads a version from the body.
+table's mappers, means editing mappers that already exist. `dr datamappers update
+<id> --payload-file <p>` does this as a remap: it publishes the edited config as a new
+version of the mapper, the way the UI's "Publish and scan" does, and fills in `name`,
+`ordinal`, the bound documents and the source version from the old mapper.
 
-Remap instead. `dr datamappers create from-file <table_id>` with the existing
-mapper's id replaces it in place and records a real source version:
+A mapper created by an org import or template push has no source version on record,
+and `update` stops with an error saying so. Put a version in the payload:
 
 ```json
 {
-  "name": "<existing name>",
-  "datamapper_id": <existing mapper id>,
-  "ordinal": <existing ordinal>,
   "document_version_id": <an ACTIVE version of one of its documents>,
-  "selected_document_ids": [<its mapped_documents_ids>],
   "sheet_name": "<a sheet that exists in THAT version>",
   "config": { ... the edited config ... }
 }
@@ -459,7 +452,8 @@ mapper's id replaces it in place and records a real source version:
 
 - **The mapper gets a new id.** The old id stays behind bound to no documents, and
   lookups, which live on the table, are unaffected. Keep an old→new id log for rollback.
-- **`ordinal` must be the existing one.** A lower one is refused as a duplicate mapper.
+- **`ordinal` must be the existing one.** `update` sends it for you; a lower one in the
+  payload is refused as a duplicate mapper.
 - **`sheet_name` must exist in the version you pass**, and a mapper's
   `preview_sheet_name` is often stale. Check with `dr filebox sheets <version_id>`; when
   the preview sheet is gone and the version has one sheet, use that one.
@@ -754,7 +748,7 @@ the package layout reaches every producer.
 | `#NAME?` on the label cell | `TEXT()` wrapped around `DR.MONTH()` | Step 4 |
 | Self-rate is not exactly 1 | ratio not anchored to the target row | Step 4 |
 | Custom code rejected by the Tables dialog | never registered as an org currency | Step 1 |
-| `datamappers update` 500s on an unchanged config | mapper has no source version (org import) | remap, Step 6 |
+| `datamappers update`: mapper has no source document version | mapper made by an org import | `document_version_id` in the payload, Step 6 |
 | Remap 500s: `Cannot read sheet with name …` | chosen version is in `ERROR` status | use the newest ACTIVE version, Step 6 |
 | New lookup columns empty on every target row | lookup built while the FX table was still scanning | rebuild the lookup, Step 7 |
 | Opening balances have no currency amounts | calc-model rows skip the mappers | **Step 7c** |

package/dist/skills/validate-workato-migration/SKILL.md

@@ -152,8 +152,11 @@ goes merge → new vN → §3 → `dr connectors query repoint` → re-sync. Cut
 
 The staging datasource holds **live customer credentials**, so remove it right away:
 1. `dr connectors query list` → `dr connectors query delete <queryId>` for each binding.
-2. `dr integrations delete <ds>` (two-step confirm). dr-cli has no connector delete, so the orphaned
-   `Connector` row points at a deleted datasource. Record its id.
+2. `dr integrations delete <ds> $STG` prints a plan and a confirm token. Re-run it with
+   `--confirm-token <tok>`. Prod is Tier A, so a human types the word shown in the desktop dialog; with
+   no interactive channel, hand the line to the user. Verify with `dr integrations get <ds> $STG` → 404.
+   dr-cli has no connector delete, so the orphaned `Connector` row points at a deleted datasource.
+   Record its id. (dr-cli skill, `reference/integrations.md`, "Deleting a data source".)
 3. Keep the staging fileboxes as evidence until cut-over + ticket close, then delete the `<Customer>` tree.
 4. Delete the local `wk/` and `st/` downloads: they are customer data. Keep only `report.md`.
 5. Record the report, what was deleted and what was kept in the migration ticket.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.106",
+  "version": "1.6.108",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.11.3",
+    "@datarails-ai/dr-appspace-cli": "0.11.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",