@datarails-ai/dr-cli 1.6.113 → 1.6.115

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.113",
+  version: "1.6.115",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-09T10:02:15.002Z";
+var BUILD_TIME = "2026-10-11T19:13:34.414Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -3863,7 +3863,10 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   // org export cleanup (dr organizations export delete). Removes the export's
   // server-side record + blob folder — migration ARTIFACTS only; no org data
   // is touched, and the state is recoverable by re-running the export.
-  "org-export|delete"
+  "org-export|delete",
+  // connectors poll item skip (dr connectors poll skip). The item is never landed,
+  // but `dr connectors poll retry` queues it again, so the token alone is enough.
+  "connector-poll-item|skip"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -3998,7 +4001,15 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // imported-org delete (dr organizations import delete-orgs) — PERMANENTLY
   // deletes whole organizations via the org-delete chord. The single most
   // destructive verb in the CLI; the word gate stays on prod unconditionally.
-  "org-import|delete-orgs"
+  "org-import|delete-orgs",
+  // connectors polled ingestion (dr connectors poll seed / set / resume --source land).
+  // A seed marks items landed so they never land; `set` is gated (as `set-land-or-seed`)
+  // only when it lands a wider window or seeds / lands on a change-policy switch;
+  // `resume --source land` lands everything a changed source holds. Versions landed in
+  // a customer filebox, or files hidden from it, cannot be taken back from the CLI.
+  "connector-poll|seed",
+  "connector-poll|set-land-or-seed",
+  "connector-poll|resume-land"
 ]);
 function classifyTier(action) {
   const key = `${action.resource}|${action.verb}`;
@@ -19023,6 +19034,14 @@ async function setVersionAutoSave(client, versionId, autoSave, reqOptions) {
     reqOptions
   );
 }
+async function setVersionNameLabel(client, versionId, label, reqOptions) {
+  return client.do(
+    "PUT",
+    `/api/documents/versions/${versionId}/name`,
+    JSON.stringify({ label }),
+    reqOptions
+  );
+}
 async function setVersionIncludeFile(client, versionId, includeFile, reqOptions) {
   return client.do(
     "PUT",
@@ -35947,7 +35966,10 @@ async function runFileboxVersions(cfg) {
     writeJSONIndented(cfg.out, selected);
     return;
   }
-  renderFileboxVersionsTable(cfg.out, selected, includeArchived, wantIncluded);
+  const forTable = selected.map(
+    (v) => typeof v.label === "string" ? { ...v, label: decodeHtmlEntitiesDeep(v.label) } : v
+  );
+  renderFileboxVersionsTable(cfg.out, forTable, includeArchived, wantIncluded);
 }
 async function runFileboxTags(cfg) {
   const tags = await listTags(cfg.client, { signal: cfg.signal });
@@ -36214,6 +36236,9 @@ async function runFileboxUploadVersion(cfg) {
       "--date and --scenario must be used together (planning fileboxes set both at once)"
     );
   }
+  if (cfg.label !== void 0) {
+    validateVersionLabel(cfg.label);
+  }
   let blob;
   try {
     blob = await fileToBlob(cfg.filePath);
@@ -36314,6 +36339,26 @@ async function runFileboxUploadVersion(cfg) {
       throw new Error(confirmation.failure);
     }
   }
+  let appliedLabel = null;
+  let labelFailed = false;
+  let labelFailure;
+  if (cfg.label !== void 0) {
+    if (id <= 0) {
+      throw new Error(
+        `uploaded, but could not read the new version id from the response to label it \u2014 set the label with \`dr filebox set-version-label\`. Server response: ${JSON.stringify(result)}`
+      );
+    }
+    try {
+      appliedLabel = await writeVersionLabel(cfg.client, id, cfg.label, cfg.signal);
+    } catch (err) {
+      labelFailed = true;
+      labelFailure = err;
+    }
+  }
+  const labelJSON = cfg.label === void 0 ? {} : labelFailed ? {
+    label_error: labelFailure instanceof Error ? labelFailure.message : String(labelFailure)
+  } : { label: appliedLabel };
+  const errStream = cfg.err ?? process.stderr;
   if (cfg.asJson) {
     if (prepared !== void 0) {
       writeJSONIndented(cfg.out, {
@@ -36324,11 +36369,15 @@ async function runFileboxUploadVersion(cfg) {
         cycle_tag_id: prepared.cycleTagId,
         date: prepared.cycleDate,
         scenario: cfg.scenario,
+        ...labelJSON,
         ...cycleTagVerdictJSON(confirmation)
       });
-      return;
+    } else if (cfg.label !== void 0) {
+      cfg.out.write(JSON.stringify({ ...asRecord2(result), ...labelJSON }) + "\n");
+    } else {
+      cfg.out.write(JSON.stringify(result) + "\n");
     }
-    cfg.out.write(JSON.stringify(result) + "\n");
+    if (labelFailed) throw uploadLabelFailure(id, labelFailure, errStream);
     return;
   }
   if (renamed !== null) {
@@ -36355,6 +36404,26 @@ ${JSON.stringify(result)}
 `
     );
   }
+  if (labelFailed) throw uploadLabelFailure(id, labelFailure, errStream);
+  if (cfg.label !== void 0) {
+    cfg.out.write(`Set label on version ${id}: ${JSON.stringify(appliedLabel)}.
+`);
+  }
+}
+function uploadLabelFailure(versionId, err, errStream) {
+  const retry = `retry with \`dr filebox set-version-label ${versionId} --label <text>\``;
+  if (isTypedError(err)) {
+    errStream.write(`uploaded version ${versionId}, but setting its label failed \u2014 ${retry}
+`);
+    return err;
+  }
+  const msg = err instanceof Error ? err.message : String(err);
+  return new Error(
+    `uploaded version ${versionId}, but setting its label failed: ${msg} \u2014 ${retry}`,
+    {
+      cause: err
+    }
+  );
 }
 async function runFileboxUpdate(cfg) {
   if (cfg.id <= 0) {
@@ -36903,6 +36972,12 @@ async function resolveVersionByNumber(client, docId, target, signal) {
   }
   if (target.number === void 0) {
     const latest = pool.reduce((a, b) => b.version > a.version ? b : a);
+    const tied = pool.filter((v) => v.version === latest.version);
+    if (target.refuseTiedLatest === true && tied.length > 1) {
+      throw new Error(
+        `ambiguous latest: ${tied.length} ${setLabel} versions of filebox ${docId} share version number ${latest.version} (ids ${tied.map((v) => v.id).join(", ")}); pass the global version id instead`
+      );
+    }
     return { id: latest.id, version: latest.version };
   }
   const matches = pool.filter((v) => v.version === target.number);
@@ -36970,6 +37045,116 @@ async function runFileboxSetVersionDateTag(cfg) {
   const body = await res.text();
   throw new Error(`set version date-tag refused (HTTP ${res.status}): ${body.trim()}`);
 }
+var VERSION_LABEL_MAX = 256;
+var RESERVED_VERSION_LABEL = "auto-calculated";
+var CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
+function validateVersionLabel(label) {
+  if (label.trim() === "") {
+    throw new Error("--label must not be empty \u2014 use --clear to remove a label");
+  }
+  if (new RegExp(CONTROL_CHARS.source).test(label)) {
+    throw new Error("--label must not contain control characters (newlines, tabs and the like)");
+  }
+  if (label.trim().toLowerCase() === RESERVED_VERSION_LABEL) {
+    throw new Error(
+      `--label "${RESERVED_VERSION_LABEL}" is reserved: the server uses it to mark versions it generated itself, which scanning can skip and archiving can move to cold storage`
+    );
+  }
+  const length = [...label].length;
+  if (length > VERSION_LABEL_MAX) {
+    throw new Error(`--label must be at most ${VERSION_LABEL_MAX} characters (got ${length})`);
+  }
+  return label;
+}
+function renderVersionLabelCell(label) {
+  if (label === null || label === void 0) return "";
+  return label.replace(CONTROL_CHARS, (c) => {
+    if (c === "\n") return "\\n";
+    if (c === "\r") return "\\r";
+    if (c === "	") return "\\t";
+    return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+  });
+}
+function parseVersionLabelFlags(label, clear) {
+  if (label !== void 0 && clear) {
+    throw new Error("pass either --label <text> or --clear, not both");
+  }
+  if (clear) return null;
+  if (label === void 0) {
+    throw new Error("one of --label <text> or --clear is required");
+  }
+  return validateVersionLabel(label);
+}
+function isTypedError(err) {
+  return !(err instanceof Error) || err.constructor !== Error || "code" in err;
+}
+async function writeVersionLabel(client, versionId, label, signal) {
+  const res = await setVersionNameLabel(client, versionId, label, { signal });
+  if (res.status < 200 || res.status >= 300) {
+    const body = (await res.text()).trim();
+    const detail = body === "" && res.status === 405 ? "no permission \u2014 changing a version's label needs change rights on the filebox, or to be the user who uploaded the version" : body;
+    throw new Error(
+      `${label === null ? "clear" : "set"} version label refused (HTTP ${res.status}): ${detail}`
+    );
+  }
+  let readBack;
+  try {
+    readBack = await getVersion(client, versionId, { signal });
+  } catch (err) {
+    if (isTypedError(err)) throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`label written to version ${versionId}, but reading it back failed: ${msg}`, {
+      cause: err
+    });
+  }
+  const stored = readBack.label === null || readBack.label === void 0 ? null : decodeHtmlEntitiesDeep(readBack.label);
+  const expected = label === null ? null : label.trim();
+  const matches = expected === null ? stored === null || stored === "" : stored === expected;
+  if (!matches) {
+    throw new Error(
+      `the server accepted the label for version ${versionId} but reports ${JSON.stringify(stored)} on read-back, not ${JSON.stringify(expected)}`
+    );
+  }
+  return expected === null ? null : stored;
+}
+async function runFileboxSetVersionLabel(cfg) {
+  if (cfg.versionId <= 0) {
+    throw new Error("version id must be positive");
+  }
+  let current;
+  try {
+    current = decodeHtmlEntitiesDeep(
+      await getVersion(cfg.client, cfg.versionId, { signal: cfg.signal })
+    );
+  } catch (err) {
+    if (isTypedError(err)) throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/HTTP 404\b/.test(msg)) {
+      throw new Error(
+        `version ${cfg.versionId} not found \u2014 label not changed (find the id with \`dr filebox versions <doc_id>\`)`,
+        { cause: err }
+      );
+    }
+    throw new Error(`load version ${cfg.versionId}: ${msg} \u2014 label not changed`, { cause: err });
+  }
+  const stored = await writeVersionLabel(cfg.client, cfg.versionId, cfg.label, cfg.signal);
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, {
+      version_id: cfg.versionId,
+      doc_id: current.document,
+      version: current.version,
+      label: stored,
+      previous_label: current.label ?? null
+    });
+    return;
+  }
+  const target = versionLabel(cfg.versionId, current.version);
+  cfg.out.write(
+    stored === null ? `Cleared label on ${target}.
+` : `Set label on ${target}: ${JSON.stringify(stored)}.
+`
+  );
+}
 var WORKFLOW_STATUSES = [
   "Not Started",
   "In Progress",
@@ -38248,7 +38433,7 @@ function renderFileboxVersionsTable(out, versions, showArchived = false, showInc
     out.write("(no versions)\n");
     return;
   }
-  const header = ["VERSION_ID", "VERSION", "NAME", "STATUS", "DOC_ID", "CREATED"];
+  const header = ["VERSION_ID", "VERSION", "NAME", "LABEL", "STATUS", "DOC_ID", "CREATED"];
   if (showArchived) header.push("ARCHIVED");
   if (showIncluded) header.push("INCLUDED");
   const rows = [{ cells: header }];
@@ -38257,6 +38442,7 @@ function renderFileboxVersionsTable(out, versions, showArchived = false, showInc
       String(v.id),
       String(v.version),
       v.name,
+      renderVersionLabelCell(v.label),
       v.status,
       String(v.document),
       renderCreateTime(v.create_time)
@@ -38527,6 +38713,9 @@ function registerFileboxCommand(root) {
     "--scenario <name>",
     "Forecast/budget filebox: scenario/cycle name (must already exist). Use with --date."
   ).option("--date-tag-name <name>", "Date tag to use when the filebox has more than one DATE tag").option(
+    "--label <text>",
+    "Label the new version right after the upload (same as `set-version-label --label`)"
+  ).option(
     "--no-reconcile",
     `Upload under the file's literal name without correcting its extension to the byte content. Use only when you intend a wrong-but-deliberate name; the server may then reject it with HTTP 400 "Invalid file signature".`
   ).option("--json", "Output raw JSON instead of a summary", false).action(
@@ -38543,6 +38732,7 @@ function registerFileboxCommand(root) {
           ...opts.date !== void 0 ? { dateInput: opts.date } : {},
           ...opts.scenario !== void 0 ? { scenario: opts.scenario } : {},
           ...opts.dateTagName !== void 0 ? { dateTagName: opts.dateTagName } : {},
+          ...opts.label !== void 0 ? { label: opts.label } : {},
           reconcile: opts.reconcile !== false,
           asJson: opts.json === true,
           signal: setup.signal,
@@ -38881,6 +39071,46 @@ function registerFileboxCommand(root) {
   );
   addServerFlag(setVersionDateTagCmd);
   addAccountFlag(setVersionDateTagCmd);
+  const setVersionLabelCmd = fb.command("set-version-label").description(
+    "Set or clear a filebox version's label (date and dimension tags are left unchanged). Address it by global version id, or by --doc with --version-number/--latest-active."
+  ).argument(
+    "[version_id]",
+    "document version id (global). Omit to address by --doc + --version-number/--latest-active."
+  ).option("--label <text>", "the new label (at most 256 characters)").option("--clear", "remove the label", false).option("--doc <doc_id>", "filebox id \u2014 resolve the version within this filebox").option("--version-number <n>", "per-filebox version number to label (requires --doc)").option("--latest-active", "label the latest active version of --doc (requires --doc)", false).option(
+    "--json",
+    "Output a JSON record (version_id, doc_id, version, label, previous_label)",
+    false
+  ).action(
+    async (idStr, opts) => {
+      const label = parseVersionLabelFlags(opts.label, opts.clear === true);
+      const addressing = parseVersionAddressing(
+        idStr,
+        { doc: opts.doc, versionNumber: opts.versionNumber, latest: opts.latestActive },
+        "--latest-active"
+      );
+      const setup = await setupCall(opts.server, opts.account);
+      try {
+        const versionId = addressing.mode === "direct" ? addressing.versionId : (await resolveVersionByNumber(
+          setup.client,
+          addressing.docId,
+          { number: addressing.number, from: "active", refuseTiedLatest: true },
+          setup.signal
+        )).id;
+        await runFileboxSetVersionLabel({
+          client: setup.client,
+          versionId,
+          label,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(setVersionLabelCmd);
+  addAccountFlag(setVersionLabelCmd);
   const setVersionWorkflowCmd = fb.command("set-version-workflow").description(
     "Set the WORKFLOW tag value on a single document version (Approve / Reject / move to In Progress / etc.)"
   ).argument("<version_id>", "document version id (positive integer)").requiredOption(
@@ -40928,6 +41158,82 @@ async function cancelSync(client, fileboxUuid, target = {}, reqOptions) {
   }
   return out;
 }
+async function getPoll(client, queryId, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll`;
+  let out;
+  try {
+    out = await client.getJSON(path12, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("GET", path12, err);
+  }
+  if (out === null) {
+    throw new Error(`GET ${path12}: empty response from control-plane poll get`);
+  }
+  return out;
+}
+async function putPoll(client, queryId, fields, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll`;
+  let out;
+  try {
+    out = await client.putJSON(path12, fields, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("PUT", path12, err);
+  }
+  if (out === null) {
+    throw new Error(`PUT ${path12}: empty response from control-plane poll set`);
+  }
+  return out;
+}
+async function postPollJSON(client, path12, body, what, reqOptions) {
+  let out;
+  try {
+    out = await client.postJSON(path12, body, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("POST", path12, err);
+  }
+  if (out === null) {
+    throw new Error(`POST ${path12}: empty response from control-plane ${what}`);
+  }
+  return out;
+}
+async function runPoll(client, queryId, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll/run`;
+  return postPollJSON(client, path12, {}, "poll run", reqOptions);
+}
+async function seedPoll(client, queryId, body, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll/seed`;
+  return postPollJSON(client, path12, body, "poll seed", reqOptions);
+}
+async function resumePoll(client, queryId, body, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll/resume`;
+  return postPollJSON(client, path12, body, "poll resume", reqOptions);
+}
+async function listPollItems(client, queryId, query = {}, reqOptions) {
+  const params = new URLSearchParams();
+  if (query.state !== void 0) params.set("state", query.state);
+  if (query.limit !== void 0) params.set("limit", String(query.limit));
+  if (query.after !== void 0) params.set("after", String(query.after));
+  const suffix = params.toString() === "" ? "" : `?${params.toString()}`;
+  const path12 = `/connector-queries/${queryId}/poll/items${suffix}`;
+  let out;
+  try {
+    out = await client.getJSON(path12, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("GET", path12, err);
+  }
+  if (out === null) {
+    throw new Error(`GET ${path12}: empty response from control-plane poll items`);
+  }
+  return out;
+}
+async function retryPollItem(client, queryId, itemId, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll/items/${itemId}/retry`;
+  return postPollJSON(client, path12, {}, "poll item retry", reqOptions);
+}
+async function skipPollItem(client, queryId, itemId, reqOptions) {
+  const path12 = `/connector-queries/${queryId}/poll/items/${itemId}/skip`;
+  return postPollJSON(client, path12, {}, "poll item skip", reqOptions);
+}
 function toControlPlaneError(method, path12, err) {
   const msg = err instanceof Error ? err.message : String(err);
   const m = /HTTP (\d{3})(?::\s*([\s\S]*))?$/.exec(msg);
@@ -41157,6 +41463,962 @@ function registerDevFetch(connectors) {
   );
 }
 
+// src/commands/connectorsPoll.ts
+import * as readline2 from "readline";
+import { createHash as createHash10 } from "crypto";
+
+// src/types/connectors.ts
+var POLL_ITEM_STATES = [
+  "seen",
+  "new",
+  "dispatched",
+  "running",
+  "retry_wait",
+  "landed",
+  "failed",
+  "skipped",
+  "seeded",
+  "superseded"
+];
+
+// src/commands/connectorsPoll.ts
+var DURATION_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
+var DURATION_BOUNDS = {
+  "--interval": [300, 7 * 86400],
+  "--settle": [0, 86400]
+};
+var LOOKBACK_MAX_DAYS = 3650;
+function parseDurationSeconds(raw, flag) {
+  const m = /^(\d+)([smhd])?$/.exec(raw.trim());
+  const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS[m[2] ?? "s"] ?? 1);
+  const [min, max] = DURATION_BOUNDS[flag] ?? [0, Number.MAX_SAFE_INTEGER];
+  if (m === null) {
+    throw new Error(`invalid ${flag} "${raw}": expected a duration like 90s, 5m or 1h`);
+  }
+  if (!Number.isSafeInteger(seconds) || seconds < min || seconds > max) {
+    throw new Error(
+      `invalid ${flag} "${raw}": must be between ${formatSeconds(min)} and ${formatSeconds(max)}`
+    );
+  }
+  return seconds;
+}
+function parseLookbackDays(raw) {
+  const m = /^(\d+)d?$/.exec(raw.trim());
+  const days = m === null ? 0 : Number(m[1]);
+  if (days < 1 || days > LOOKBACK_MAX_DAYS) {
+    throw new Error(
+      `invalid --lookback "${raw}": must be between 1 and ${LOOKBACK_MAX_DAYS} days, e.g. 180d`
+    );
+  }
+  return days;
+}
+var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+var DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
+function inRange(value, max, min = 0) {
+  const n = Number(value ?? "0");
+  return n >= min && n <= max;
+}
+function isCalendarDay(y, m, d) {
+  if (!inRange(m, 12, 1)) return false;
+  const daysInMonth3 = new Date(Date.UTC(Number(y), Number(m), 0)).getUTCDate();
+  return inRange(d, daysInMonth3, 1);
+}
+function parseTimestampFlag(raw, flag) {
+  const invalid = new Error(
+    `invalid ${flag} "${raw}": expected YYYY-MM-DD or a timestamp with a zone (e.g. 2026-10-08T17:30:00+03:00)`
+  );
+  const value = raw.trim();
+  const dateOnly = DATE_ONLY_RE.exec(value);
+  if (dateOnly !== null) {
+    if (!isCalendarDay(dateOnly[1], dateOnly[2], dateOnly[3])) throw invalid;
+    return (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString();
+  }
+  const dt = DATE_TIME_RE.exec(value);
+  const valid = dt !== null && isCalendarDay(dt[1], dt[2], dt[3]) && inRange(dt[4], 23) && inRange(dt[5], 59) && inRange(dt[6], 59) && inRange(dt[7], 23) && inRange(dt[8], 59);
+  const ms = valid ? Date.parse(value) : NaN;
+  if (Number.isNaN(ms)) throw invalid;
+  return new Date(ms).toISOString();
+}
+function parseSameName(raw) {
+  if (raw === "new-version") return "new_version";
+  if (raw === "ignore") return "ignore";
+  throw new Error(`--same-name must be new-version or ignore (got "${raw}")`);
+}
+function parseChoice(raw, flag, choices) {
+  const match = choices.find((c) => c === raw);
+  if (match === void 0) {
+    throw new Error(`${flag} must be ${choices.join(" or ")} (got "${raw}")`);
+  }
+  return match;
+}
+var WIDEN_CHOICES = ["seed", "land"];
+var POLICY_CHOICES = ["rekey", "seed", "land"];
+function parseSettings(opts) {
+  const fields = {};
+  if (opts.interval !== void 0) {
+    fields.interval_seconds = parseDurationSeconds(opts.interval, "--interval");
+  }
+  if (opts.since !== void 0) fields.since = parseTimestampFlag(opts.since, "--since");
+  if (opts.lookback !== void 0) fields.lookback_days = parseLookbackDays(opts.lookback);
+  if (opts.settle !== void 0) {
+    fields.settle_seconds = parseDurationSeconds(opts.settle, "--settle");
+  }
+  if (opts.sameName !== void 0) fields.change_policy = parseSameName(opts.sameName);
+  return fields;
+}
+function settingsArgs(opts) {
+  const pairs = [
+    ["--interval", opts.interval],
+    ["--since", opts.since],
+    ["--lookback", opts.lookback],
+    ["--settle", opts.settle],
+    ["--same-name", opts.sameName]
+  ];
+  return pairs.filter((p) => p[1] !== void 0).map(([flag, value]) => ` ${flag} ${value.trim()}`).join("");
+}
+async function resolvePollBinding(client, filebox, signal) {
+  const wanted = filebox.trim();
+  const byId = /^\d+$/.test(wanted);
+  const rows = await listQueries(client, { signal });
+  const matches = rows.filter(
+    (q) => byId ? q.filebox_id === Number(wanted) : q.filebox_uuid.toLowerCase() === wanted.toLowerCase()
+  );
+  const [first] = matches;
+  if (first === void 0) {
+    throw new Error(
+      `no connector binding for filebox ${wanted} in this org (see dr connectors query list)`
+    );
+  }
+  if (matches.length > 1) {
+    const ids = matches.map((q) => `#${q.query_id}`).join(", ");
+    throw new Error(`filebox ${wanted} has several connector bindings (${ids})`);
+  }
+  return first;
+}
+function isNotPolled(err) {
+  return err instanceof ControlPlaneError && err.status === 404 && err.body.includes("not polled");
+}
+function isPollThrottled(err) {
+  return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
+}
+async function explainNotPolled(filebox, call) {
+  try {
+    return await call;
+  } catch (err) {
+    if (isNotPolled(err)) {
+      throw new Error(
+        `filebox ${filebox} is not set to polled ingestion; run dr connectors poll enable ${filebox}`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+}
+async function readFileboxDateTag(monolith, fileboxId, signal) {
+  const details = await getDetails(monolith, fileboxId, { signal });
+  const dateTags = (details.tags_config ?? []).filter((t) => t.type === "DATE");
+  const [only] = dateTags;
+  if (only === void 0) return {};
+  if (dateTags.length > 1) {
+    const names = dateTags.map((t) => t.name).join(", ");
+    throw new Error(
+      `filebox ${fileboxId} has several DATE tags (${names}); a polled filebox needs exactly one`
+    );
+  }
+  return { id: only.id, name: only.name };
+}
+function formatSeconds(sec) {
+  if (sec > 0 && sec % 86400 === 0) return `${sec / 86400}d`;
+  if (sec > 0 && sec % 3600 === 0) return `${sec / 3600}h`;
+  if (sec > 0 && sec % 60 === 0) return `${sec / 60}m`;
+  return `${sec}s`;
+}
+function oneLine3(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function sameNameLabel(policy) {
+  return policy === "new_version" ? "new-version" : String(policy);
+}
+function formatDateTag(tag) {
+  if (tag?.id === void 0) return "none (undated filebox)";
+  return `${tag.name ?? "?"} (id ${tag.id})`;
+}
+function bindingTarget(binding) {
+  return `filebox ${binding.filebox_uuid} (query #${binding.query_id})`;
+}
+function renderPoll(out, headline, binding, p) {
+  const row = (label, value) => {
+    out.write(`  ${`${label}:`.padEnd(15)}${value}
+`);
+  };
+  const status2 = `${p.enabled ? "enabled" : "disabled"}${p.paused_reason === null ? "" : `, paused: ${oneLine3(p.paused_reason)}`}`;
+  const counts = Object.entries(p.counts).sort(([a], [b]) => a.localeCompare(b)).map(([state, n]) => `${state}=${n}`).join("  ");
+  out.write(`${headline} for ${bindingTarget(binding)}
+`);
+  row("Status", status2);
+  row("Interval", formatSeconds(p.interval_seconds));
+  row("Date tag", formatDateTag(p.date_tag));
+  row("Since", p.since ?? "-");
+  row("Lookback", `${p.lookback_days}d`);
+  row("Settle", formatSeconds(p.settle_seconds));
+  row("Same name", sameNameLabel(p.change_policy));
+  row("Max attempts", String(p.max_attempts));
+  row("Last poll", `${p.last_poll_at ?? "-"} ${oneLine3(p.last_poll_status ?? "")}`.trimEnd());
+  row("Next poll", p.next_poll_at);
+  row("Failures", String(p.consecutive_failures));
+  row("Discover", p.discover_in_flight ? `in flight since ${p.discover_sent_at ?? "?"}` : "-");
+  row("Last digest", p.last_digest ?? "-");
+  row("Pending seed", p.poll_run_seed_until ?? "-");
+  row(
+    "Pending rekey",
+    p.poll_run_rekey_to === null ? "-" : `to ${sameNameLabel(p.poll_run_rekey_to)}`
+  );
+  row("Items", counts === "" ? "(none)" : counts);
+}
+function writeTable26(out, rows) {
+  const widths = [];
+  for (const r of rows) {
+    r.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  }
+  for (const r of rows) {
+    const cells = r.map(
+      (cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)
+    );
+    out.write(`${cells.join("").trimEnd()}
+`);
+  }
+}
+function renderItemTable(out, items) {
+  const rows = [["ID", "LABEL", "DATE", "STATE", "ATTEMPTS", "VERSION", "ERROR"]];
+  for (const it of items) {
+    const error = it.last_error ?? (it.skip_reason === null ? null : `skipped: ${it.skip_reason}`);
+    rows.push([
+      String(it.id),
+      oneLine3(it.label),
+      it.item_date ?? "-",
+      it.state,
+      String(it.attempts),
+      it.version_id === null ? "-" : String(it.version_id),
+      error === null ? "-" : truncate3(oneLine3(error), 80)
+    ]);
+  }
+  writeTable26(out, rows);
+}
+async function runPollEnable(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  let existing;
+  try {
+    existing = await getPoll(cfg.client, binding.query_id, { signal: cfg.signal });
+  } catch (err) {
+    if (!isNotPolled(err)) throw err;
+    existing = null;
+  }
+  const s = cfg.settings;
+  if (existing !== null && (s.since !== void 0 || s.lookback_days !== void 0 || s.change_policy !== void 0)) {
+    throw new Error(
+      `filebox ${cfg.filebox} is already polled; change --since, --lookback or --same-name with dr connectors poll set ${cfg.filebox}, which asks what to do with a wider window or a policy switch`
+    );
+  }
+  if (binding.filebox_id <= 0) {
+    throw new Error(
+      `connector-query #${binding.query_id} has no filebox id recorded, so its date tag cannot be read; record it with dr connectors query repoint ${binding.query_id} --filebox-id <id>`
+    );
+  }
+  const dateTag = await readFileboxDateTag(cfg.monolith, binding.filebox_id, cfg.signal);
+  const stored = await putPoll(
+    cfg.client,
+    binding.query_id,
+    { enabled: true, date_tag: dateTag, ...s },
+    { signal: cfg.signal }
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, stored);
+    return;
+  }
+  renderPoll(cfg.out, "Polling enabled", binding, stored);
+}
+function windowStart(since, lookbackDays, now) {
+  const start = now - lookbackDays * 864e5;
+  return since === null ? start : Math.max(start, Date.parse(since));
+}
+function widening(current, changes, now) {
+  if (changes.since === void 0 && changes.lookback_days === void 0) return null;
+  const from = windowStart(current.since, current.lookback_days, now);
+  const to = windowStart(
+    changes.since ?? current.since,
+    changes.lookback_days ?? current.lookback_days,
+    now
+  );
+  if (to >= from) return null;
+  return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
+}
+async function ask(cfg, message, choices, defaultChoice) {
+  const answer = await cfg.prompt(message, choices, defaultChoice);
+  if (answer === null) throw new Error("poll set cancelled; nothing was changed");
+  return parseChoice(answer, "the answer", choices);
+}
+var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
+var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
+async function runPollSet(cfg) {
+  if (Object.keys(cfg.changes).length === 0) {
+    throw new Error(
+      "poll set: pass at least one of --interval, --since, --lookback, --settle, --same-name"
+    );
+  }
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const current = await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  );
+  const body = { ...cfg.changes };
+  const detail = [`target:      ${bindingTarget(binding)}`];
+  const wider = widening(current, cfg.changes, cfg.now ?? Date.now());
+  if (wider !== null) {
+    const what = `the polling window widens (start ${wider.from} -> ${wider.to})`;
+    if (cfg.widen === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --widen seed or --widen land (${WIDEN_HELP})`);
+    }
+    body.widen = cfg.widen ?? await ask(cfg, `${what}. ${WIDEN_HELP}.`, WIDEN_CHOICES);
+    detail.push(`window:      start ${wider.from} -> ${wider.to}, widen ${body.widen}`);
+  } else if (cfg.widen !== void 0) {
+    body.widen = cfg.widen;
+  }
+  const newPolicy = cfg.changes.change_policy;
+  const policySwitch = newPolicy !== void 0 && newPolicy !== current.change_policy;
+  if (policySwitch) {
+    const change = `${sameNameLabel(current.change_policy)} -> ${sameNameLabel(newPolicy)}`;
+    const what = `--same-name changes ${change}`;
+    if (cfg.onPolicyChange === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --on-policy-change rekey, seed or land (${POLICY_HELP})`);
+    }
+    body.on_policy_change = cfg.onPolicyChange ?? await ask(cfg, `${what}. ${POLICY_HELP}.`, POLICY_CHOICES, "rekey");
+    detail.push(`same name:   ${change}, on policy change ${body.on_policy_change}`);
+  } else if (cfg.onPolicyChange !== void 0) {
+    body.on_policy_change = cfg.onPolicyChange;
+  }
+  const put = async () => {
+    const stored = await putPoll(cfg.client, binding.query_id, body, {
+      signal: cfg.signal
+    });
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, stored);
+      return;
+    }
+    renderPoll(cfg.out, "Polling settings updated", binding, stored);
+  };
+  const landsOrHides = wider !== null && body.widen === "land" || policySwitch && (body.on_policy_change === "seed" || body.on_policy_change === "land");
+  if (!landsOrHides) {
+    await put();
+    return;
+  }
+  const flags = `${body.widen === void 0 ? "" : ` --widen ${body.widen}`}${body.on_policy_change === void 0 ? "" : ` --on-policy-change ${body.on_policy_change}`}`;
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(cfg.filebox, "set-land-or-seed", cfg.scope, { ...body }),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll set ${cfg.filebox}${cfg.settingsArgs}${flags}${cfg.targetArgs}`,
+    describe: async () => detail,
+    execute: async () => {
+      cfg.deadline?.resume();
+      await put();
+    }
+  });
+}
+function confirmDigest(scope, payload) {
+  const canonical = JSON.stringify({
+    server: scope.serverKey,
+    account: scope.account ?? "",
+    controlPlane: scope.controlPlane,
+    payload: Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a.localeCompare(b)))
+  });
+  return createHash10("sha256").update(canonical).digest("hex").slice(0, 12);
+}
+function pollConfirmAction(filebox, verb, scope, payload = {}) {
+  return {
+    resource: "connector-poll",
+    id: `${filebox.trim()}#${confirmDigest(scope, payload)}`,
+    verb
+  };
+}
+function pollItemConfirmAction(filebox, item, scope) {
+  return {
+    resource: "connector-poll-item",
+    id: `${filebox.trim()}/${item}#${confirmDigest(scope, {})}`,
+    verb: "skip"
+  };
+}
+async function runPollDisable(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  );
+  const stored = await putPoll(
+    cfg.client,
+    binding.query_id,
+    { enabled: false },
+    { signal: cfg.signal }
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, stored);
+    return;
+  }
+  renderPoll(cfg.out, "Polling disabled", binding, stored);
+}
+async function runPollGet(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const p = await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, p);
+    return;
+  }
+  renderPoll(cfg.out, "Polling", binding, p);
+}
+async function runPollRun(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  let p;
+  try {
+    p = await explainNotPolled(
+      cfg.filebox,
+      runPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+    );
+  } catch (err) {
+    if (isPollThrottled(err)) {
+      throw new Error(
+        `a poll of filebox ${cfg.filebox} is running or ran less than a minute ago; try again shortly`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, p);
+    return;
+  }
+  renderPoll(cfg.out, "Poll requested", binding, p);
+}
+async function runPollResume(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const resume = async () => {
+    const p = await explainNotPolled(
+      cfg.filebox,
+      resumePoll(
+        cfg.client,
+        binding.query_id,
+        cfg.source === void 0 ? {} : { source: cfg.source },
+        { signal: cfg.signal }
+      )
+    );
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, p);
+      return;
+    }
+    renderPoll(cfg.out, "Polling resumed", binding, p);
+  };
+  if (cfg.source !== "land") {
+    await resume();
+    return;
+  }
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(cfg.filebox, "resume-land", cfg.scope),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll resume ${cfg.filebox} --source land${cfg.targetArgs}`,
+    describe: async () => [
+      `target:      ${bindingTarget(binding)}`,
+      "source:      land every item the changed source holds now"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      await resume();
+    }
+  });
+}
+async function countSeedable(cfg, binding) {
+  const untilMs = Date.parse(cfg.until);
+  let count = 0;
+  for (const state of ["seen", "new"]) {
+    let after = null;
+    do {
+      cfg.deadline?.resume();
+      const page = await explainNotPolled(
+        cfg.filebox,
+        listPollItems(
+          cfg.client,
+          binding.query_id,
+          { state, ...after === null ? {} : { after } },
+          { signal: cfg.signal }
+        )
+      );
+      count += page.items.filter(
+        (it) => it.source_modified_at !== null && Date.parse(it.source_modified_at) <= untilMs
+      ).length;
+      after = page.next_after;
+    } while (after !== null);
+  }
+  return count;
+}
+async function runPollSeed(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  if (cfg.dryRun) {
+    const wouldSeed = await countSeedable(cfg, binding);
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, { dry_run: true, until: cfg.until, would_seed: wouldSeed });
+      return;
+    }
+    cfg.out.write(`Seed dry run for ${bindingTarget(binding)}: nothing was changed.
+`);
+    cfg.out.write(
+      `${wouldSeed} already-discovered items would be seeded (items not yet discovered are not counted).
+`
+    );
+    return;
+  }
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(cfg.filebox, "seed", cfg.scope, { until: cfg.until }),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll seed ${cfg.filebox} --until ${cfg.untilArg}${cfg.targetArgs}`,
+    describe: async () => [
+      `target:      ${bindingTarget(binding)}`,
+      `until:       ${cfg.until}`,
+      "effect:      items modified at or before it are marked landed and never land"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      const p = await explainNotPolled(
+        cfg.filebox,
+        seedPoll(
+          cfg.client,
+          binding.query_id,
+          { until: cfg.until },
+          {
+            signal: cfg.signal
+          }
+        )
+      );
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, p);
+        return;
+      }
+      renderPoll(cfg.out, "Seed requested", binding, p);
+    }
+  });
+}
+async function runPollItems(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const page = await explainNotPolled(
+    cfg.filebox,
+    listPollItems(
+      cfg.client,
+      binding.query_id,
+      {
+        ...cfg.state !== void 0 ? { state: cfg.state } : {},
+        ...cfg.limit !== void 0 ? { limit: cfg.limit } : {},
+        ...cfg.after !== void 0 ? { after: cfg.after } : {}
+      },
+      { signal: cfg.signal }
+    )
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, page);
+    return;
+  }
+  if (page.items.length === 0) {
+    cfg.out.write(`No items${cfg.state === void 0 ? "" : ` in state ${cfg.state}`}.
+`);
+    return;
+  }
+  renderItemTable(cfg.out, page.items);
+  if (page.next_after !== null) {
+    const state = cfg.state === void 0 ? "" : ` --state ${cfg.state}`;
+    const limit = cfg.limit === void 0 ? "" : ` --limit ${cfg.limit}`;
+    cfg.out.write(
+      `
+More: dr connectors poll items ${cfg.filebox}${state}${limit} --after ${page.next_after}
+`
+    );
+  }
+}
+function renderItemResult(cfg, binding, headline, item) {
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, item);
+    return;
+  }
+  cfg.out.write(`${headline} (${bindingTarget(binding)})
+`);
+  renderItemTable(cfg.out, [item]);
+}
+async function runPollRetry(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const item = await explainNotPolled(
+    cfg.filebox,
+    retryPollItem(cfg.client, binding.query_id, cfg.itemId, { signal: cfg.signal })
+  );
+  renderItemResult(cfg, binding, `Item ${cfg.itemId} queued for retry`, item);
+}
+async function runPollSkip(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollItemConfirmAction(cfg.filebox, cfg.itemId, cfg.scope),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll skip ${cfg.filebox} ${cfg.itemId}${cfg.targetArgs}`,
+    describe: async () => [
+      `item:        ${cfg.itemId} of ${bindingTarget(binding)}`,
+      "effect:      the item is never landed (dr connectors poll retry queues it again)"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      const item = await explainNotPolled(
+        cfg.filebox,
+        skipPollItem(cfg.client, binding.query_id, cfg.itemId, {
+          signal: cfg.signal
+        })
+      );
+      renderItemResult(cfg, binding, `Item ${cfg.itemId} skipped`, item);
+    }
+  });
+}
+async function withMonolith(opts, action) {
+  const monolithHost = resolve(resolveServer(opts.server)).host;
+  const setup = await setupCall(opts.server, opts.account, {
+    host: monolithHost,
+    authHost: monolithHost
+  });
+  try {
+    await action(setup.client);
+  } finally {
+    setup.cleanup();
+  }
+}
+function scopeOf(opts) {
+  const serverKey = resolveServer(opts.server);
+  return {
+    serverKey,
+    account: normaliseAccount(opts.account),
+    controlPlane: resolveConnectorsUrl(serverKey, opts.connectorsUrl)
+  };
+}
+function targetArgsOf(opts) {
+  const url = (opts.connectorsUrl ?? "").trim();
+  return ` --server ${resolveServer(opts.server)}${url === "" ? "" : ` --connectors-url ${url}`}`;
+}
+function addCommonFlags(cmd, jsonHelp) {
+  cmd.option("--json", jsonHelp, false);
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  addConnectorsUrlFlag(cmd);
+}
+function addConfirmTokenFlag(cmd) {
+  return cmd.option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed");
+}
+function addSettingsFlags(cmd) {
+  return cmd.option("--interval <duration>", "how often to poll, 5m to 7d (default: per source)").option("--since <date>", "never pick up items modified before this date or timestamp").option("--lookback <days>", "window every poll lists, 1d to 3650d (default: per source)").option("--settle <duration>", "how long an item must stay unchanged before landing, 0s to 1d").option(
+    "--same-name <policy>",
+    "a changed file under the same name: new-version (lands again) or ignore"
+  );
+}
+function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.stdin, output: process.stderr }) {
+  return new Promise((resolvePrompt) => {
+    const rl = readline2.createInterface({
+      input: io.input,
+      output: io.output,
+      ...io.terminal !== void 0 ? { terminal: io.terminal } : {}
+    });
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      resolvePrompt(value);
+    };
+    rl.on("SIGINT", () => settle(null));
+    rl.on("close", () => settle(null));
+    io.output.write(`${message}
+`);
+    const question = defaultChoice === void 0 ? `[${choices.join("/")}]: ` : `[${choices.join("/")}] (Enter = ${defaultChoice}): `;
+    const askOnce = () => {
+      rl.question(question, (answer) => {
+        const picked = answer.trim().toLowerCase();
+        if (picked === "" && defaultChoice !== void 0) {
+          settle(defaultChoice);
+        } else if (choices.includes(picked)) {
+          settle(picked);
+        } else {
+          io.output.write(`Answer one of: ${choices.join(", ")}
+`);
+          askOnce();
+        }
+      });
+    };
+    askOnce();
+  });
+}
+function registerConnectorsPoll(connectors) {
+  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version");
+  const enableCmd = addSettingsFlags(
+    poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
+  ).action(async (filebox, opts) => {
+    const settings = parseSettings(opts);
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await withMonolith(opts, async (monolith) => {
+        await runPollEnable({
+          client,
+          monolith,
+          filebox,
+          settings,
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    });
+  });
+  addCommonFlags(enableCmd, "Output the stored binding as JSON");
+  const setCmd = addConfirmTokenFlag(
+    addSettingsFlags(
+      poll2.command("set").description("Change polling settings (only the given flags change)").argument("<filebox>", "filebox id or uuid")
+    ).option(
+      "--widen <seed|land>",
+      "a wider window: seed (mark exposed items landed) or land them"
+    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land")
+  ).action(
+    async (filebox, opts) => {
+      const changes = parseSettings(opts);
+      const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
+      const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, "set-land-or-seed", scopeOf(opts), {
+          ...changes,
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
+        }),
+        opts.confirmToken
+      );
+      await withConnectorsSetup(opts, async (setup) => {
+        const deadline = {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        };
+        await runPollSet({
+          client: setup.client,
+          filebox,
+          changes,
+          settingsArgs: settingsArgs(opts),
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { onPolicyChange } : {},
+          interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
+          prompt: async (message, choices, defaultChoice) => {
+            deadline.pause();
+            try {
+              return await ttyChoicePrompt(message, choices, defaultChoice);
+            } finally {
+              deadline.resume();
+            }
+          },
+          deadline,
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(setCmd, "Output the stored binding as JSON");
+  const disableCmd = poll2.command("disable").description("Stop polling (an item already in flight still finishes)").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollDisable({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(disableCmd, "Output the stored binding as JSON");
+  const getCmd = poll2.command("get").description("Show polling settings, last poll, pending seed / rekey and item counts").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollGet({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(getCmd, "Output the raw binding as JSON");
+  const runCmd = poll2.command("run").description("Poll now").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRun({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(runCmd, "Output the binding as JSON");
+  const resumeCmd = addConfirmTokenFlag(
+    poll2.command("resume").description("Resume a paused binding (after fixing credentials, or a source change)").argument("<filebox>", "filebox id or uuid").option(
+      "--source <seed|land>",
+      "after a source change: seed (mark present items landed) or land them"
+    )
+  ).action(async (filebox, opts) => {
+    const source = opts.source === void 0 ? void 0 : parseChoice(opts.source, "--source", WIDEN_CHOICES);
+    if (source === "land") {
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, "resume-land", scopeOf(opts)),
+        opts.confirmToken
+      );
+    }
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollResume({
+        client: setup.client,
+        filebox,
+        ...source !== void 0 ? { source } : {},
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(resumeCmd, "Output the binding as JSON");
+  const itemsCmd = poll2.command("items").description("List the item ledger: label, date, state, attempts, version, error").argument("<filebox>", "filebox id or uuid").option("--state <state>", `only items in this state (${POLL_ITEM_STATES.join("|")})`).option("--limit <n>", "page size (default and maximum: the control-plane page size, 100)").option("--after <id>", "start after this item id (the next-page cursor)").action(
+    async (filebox, opts) => {
+      const state = opts.state === void 0 ? void 0 : POLL_ITEM_STATES.find((s) => s === opts.state);
+      if (opts.state !== void 0 && state === void 0) {
+        throw new Error(
+          `invalid --state "${opts.state}": expected one of ${POLL_ITEM_STATES.join(", ")}`
+        );
+      }
+      const limit = opts.limit === void 0 ? void 0 : parsePositiveIntArg2(opts.limit, "--limit");
+      const after = opts.after === void 0 ? void 0 : parsePositiveIntArg2(opts.after, "--after");
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        await runPollItems({
+          client,
+          filebox,
+          ...state !== void 0 ? { state } : {},
+          ...limit !== void 0 ? { limit } : {},
+          ...after !== void 0 ? { after } : {},
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(itemsCmd, "Output the raw page as JSON");
+  const retryCmd = poll2.command("retry").description("Queue a failed, waiting or skipped item again").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)").action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRetry({
+        client,
+        filebox,
+        itemId,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(retryCmd, "Output the item as JSON");
+  const skipCmd = addConfirmTokenFlag(
+    poll2.command("skip").description("Skip an item so it is never landed (two-step confirmation)").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)")
+  ).action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await preflightConfirmToken(
+      pollItemConfirmAction(filebox, itemId, scopeOf(opts)),
+      opts.confirmToken
+    );
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollSkip({
+        client: setup.client,
+        filebox,
+        itemId,
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(skipCmd, "Output the item as JSON");
+  const seedCmd = addConfirmTokenFlag(
+    poll2.command("seed").description("Mark items modified at or before --until as already landed (cut-over)").argument("<filebox>", "filebox id or uuid").requiredOption(
+      "--until <timestamp>",
+      "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
+    ).option(
+      "--dry-run",
+      "count the already-discovered items it would mark, without changing anything",
+      false
+    )
+  ).action(
+    async (filebox, opts) => {
+      const until = parseTimestampFlag(opts.until, "--until");
+      const dryRun = opts.dryRun === true;
+      if (!dryRun) {
+        await preflightConfirmToken(
+          pollConfirmAction(filebox, "seed", scopeOf(opts), { until }),
+          opts.confirmToken
+        );
+      }
+      await withConnectorsSetup(opts, async (setup) => {
+        await runPollSeed({
+          client: setup.client,
+          filebox,
+          until,
+          untilArg: opts.until.trim(),
+          dryRun,
+          deadline: {
+            pause: () => setup.pauseTimeout(),
+            resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+          },
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
+}
+
 // src/commands/connectors.ts
 var CONTROL_PLANE_HOST = (subDomain) => `https://${subDomain}-connectors-control-plane.datarails.io`;
 function resolveConnectorsUrl(serverKey, connectorsUrlFlag) {
@@ -41202,7 +42464,12 @@ async function withConnectorsSetup(opts, action) {
     authHost: resolve(serverKey).host
   });
   try {
-    await action({ client: setup.client, signal: setup.signal });
+    await action({
+      client: setup.client,
+      signal: setup.signal,
+      pauseTimeout: setup.pauseTimeout,
+      extendTimeout: setup.extendTimeout
+    });
   } catch (err) {
     throw augmentTlsCertError(err);
   } finally {
@@ -41808,6 +43075,7 @@ ${TLS_VPN_HELP}`);
   addAccountFlag(activeGetCmd);
   addConnectorsUrlFlag(activeGetCmd);
   registerDevFetch(connectors);
+  registerConnectorsPoll(connectors);
 }
 
 // src/types/dashboards.ts
@@ -43088,7 +44356,7 @@ async function buildFiltersForCfg(resolver, cfg) {
     dateFlags: cfg.dateFlags
   });
 }
-function writeTable26(out, rows) {
+function writeTable27(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -43122,7 +44390,7 @@ function renderWidgetsTable(out, widgets) {
       ]
     });
   }
-  writeTable26(out, rows);
+  writeTable27(out, rows);
 }
 function registerWidgetsCommand(root) {
   const widgets = root.command("widgets").alias("widget").description("Operations on Datarails dashboard widgets");
@@ -43554,7 +44822,7 @@ function registerWidgetsCommand(root) {
 }
 
 // src/commands/reconciliation.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { promises as fs18 } from "fs";
 
 // src/api/reconciliation.ts
@@ -44298,7 +45566,7 @@ function dash(v) {
   if (typeof v === "string" && v === "") return "-";
   return String(v);
 }
-function writeTable27(out, rows) {
+function writeTable28(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -44336,7 +45604,7 @@ function renderEvidenceList(out, items) {
       dash(e.note ?? null)
     ]);
   }
-  writeTable27(out, rows);
+  writeTable28(out, rows);
   const word = items.length === 1 ? "evidence" : "evidences";
   out.write(`
 (${items.length} ${word})
@@ -44355,7 +45623,7 @@ function renderEvidenceSingle(out, e) {
       dash(e.file_url ?? null)
     ]
   ];
-  writeTable27(out, rows);
+  writeTable28(out, rows);
 }
 function renderSupportingItemsList(out, items) {
   if (items.length === 0) {
@@ -44372,7 +45640,7 @@ function renderSupportingItemsList(out, items) {
       dash(e.url)
     ]);
   }
-  writeTable27(out, rows);
+  writeTable28(out, rows);
   const word = items.length === 1 ? "supporting item" : "supporting items";
   out.write(`
 (${items.length} ${word})
@@ -44749,7 +46017,7 @@ function dash2(v) {
   if (typeof v === "string" && v === "") return "-";
   return String(v);
 }
-function writeTable28(out, rows) {
+function writeTable29(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -44790,7 +46058,7 @@ function renderConnectionList(out, items) {
       String(c.sync_progress_percentage)
     ]);
   }
-  writeTable28(out, rows);
+  writeTable29(out, rows);
   out.write(`
 (${items.length} connection${plural(items.length)})
 `);
@@ -44818,7 +46086,7 @@ function renderConnectionSingle(out, c) {
       String(c.initial_sync_total_files)
     ]
   ];
-  writeTable28(out, rows);
+  writeTable29(out, rows);
 }
 function renderSyncProgress(out, resp) {
   out.write(`Status:           ${dash2(resp.status)}
@@ -45181,7 +46449,7 @@ function chunkByJsonBytes(rows, maxBytes) {
   return chunks;
 }
 function settingsActionId(settings) {
-  return createHash10("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 12);
+  return createHash11("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsUpdateSettings(cfg) {
   const action = {
@@ -45268,7 +46536,7 @@ function dash4(v) {
   if (typeof v === "string" && v === "") return "-";
   return String(v);
 }
-function writeTable29(out, rows) {
+function writeTable30(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -45308,7 +46576,7 @@ function renderAccountsList(out, items) {
       dash4(a.frequency)
     ]);
   }
-  writeTable29(out, rows);
+  writeTable30(out, rows);
   out.write(`
 (${items.length} account${plural(items.length)})
 `);
@@ -45337,7 +46605,7 @@ function renderEntityCurrencies(out, resp) {
   for (const e of resp.entities) {
     rows.push([dash4(e.name), dash4(e.currency)]);
   }
-  writeTable29(out, rows);
+  writeTable30(out, rows);
 }
 function renderAccountsInfo(out, items) {
   if (items.length === 0) {
@@ -45348,7 +46616,7 @@ function renderAccountsInfo(out, items) {
   for (const a of items) {
     rows.push([dash4(a.id), dash4(a.name), dash4(a.account_group ?? null), dash4(a.entity ?? null)]);
   }
-  writeTable29(out, rows);
+  writeTable30(out, rows);
   out.write(`
 (${items.length} account${plural(items.length)})
 `);
@@ -45399,7 +46667,7 @@ function renderAccountsSettings(out, items) {
       String(a.threshold_to)
     ]);
   }
-  writeTable29(out, rows);
+  writeTable30(out, rows);
   out.write(`
 (${items.length} account${plural(items.length)})
 `);
@@ -45559,7 +46827,7 @@ async function runReconciliationAccountsSetAssignee(cfg) {
 var ASSIGNEE_BATCH_CHUNK_SIZE = 100;
 function assigneeBatchActionId(date, rows) {
   const canonical = rows.map((r) => [r.accountId, r.type, r.userId, r.userName, r.userEmail]);
-  return createHash10("sha256").update(JSON.stringify([date, canonical])).digest("hex").slice(0, 12);
+  return createHash11("sha256").update(JSON.stringify([date, canonical])).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsSetAssigneeBatch(cfg) {
   const action = {
@@ -45713,7 +46981,7 @@ verify the date matches the accounts' reporting period (try \`dr reconciliation
 }
 function clearBatchActionId(date, rows) {
   const canonical = rows.map((r) => [r.accountId, r.type]);
-  return createHash10("sha256").update(JSON.stringify(["clear", date, canonical])).digest("hex").slice(0, 12);
+  return createHash11("sha256").update(JSON.stringify(["clear", date, canonical])).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsClearAssigneeBatch(cfg) {
   const action = {
@@ -47603,7 +48871,7 @@ function renderForError(v) {
 }
 
 // src/commands/mecWorkflow.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 
 // src/api/workflow.ts
 function buildQueryString(params) {
@@ -49095,7 +50363,7 @@ function dash5(s) {
   if (s === "") return "-";
   return s;
 }
-function writeTable30(out, rows) {
+function writeTable31(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -49217,7 +50485,7 @@ function renderMecWorkflowList(out, rows) {
       dash5(r.update_time)
     ]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
   out.write(`
 (${rows.length} MEC workflow${plural(rows.length)})
 `);
@@ -49245,7 +50513,7 @@ function renderMecWorkflowDetail(out, t) {
     ["updated:", dash5(t.update_time)],
     ["process_start_time:", dash5(t.process_start_time)]
   ];
-  writeTable30(out, rows);
+  writeTable31(out, rows);
   out.write("\n");
   const perms = t.permissions ?? [];
   out.write("permissions: ");
@@ -49260,7 +50528,7 @@ function renderMecWorkflowDetail(out, t) {
     for (const tag of tags) {
       tagRows.push([`  ${tag.id}`, dash5(tag.name), dash5(tag.label), String(tag.value)]);
     }
-    writeTable30(out, tagRows);
+    writeTable31(out, tagRows);
   }
   out.write("\nprocess_instances:\n");
   const instances = t.process_instances ?? [];
@@ -49277,7 +50545,7 @@ function renderMecWorkflowDetail(out, t) {
         dash5(pi.create_time)
       ]);
     }
-    writeTable30(out, piRows);
+    writeTable31(out, piRows);
   }
 }
 async function runMecProcessList(cfg) {
@@ -49311,7 +50579,7 @@ function renderMecProcessList(out, rows) {
       dash5(r.create_time)
     ]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
   out.write(`
 (${rows.length} MEC process${rows.length === 1 ? "" : "es"})
 `);
@@ -49337,7 +50605,7 @@ function renderMecProcessDetail(out, p) {
     ["active:", p.is_active === true ? "yes" : p.is_active === false ? "no" : "-"],
     ["created:", dash5(p.create_time)]
   ];
-  writeTable30(out, rows);
+  writeTable31(out, rows);
   out.write("\nsteps:\n");
   const steps = p.steps ?? [];
   if (steps.length === 0) {
@@ -49355,7 +50623,7 @@ function renderMecProcessDetail(out, p) {
       dash5(s.due_date)
     ]);
   }
-  writeTable30(out, stepRows);
+  writeTable31(out, stepRows);
 }
 async function runMecStepGet(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
@@ -49384,7 +50652,7 @@ function renderMecStepDetail(out, s) {
     ["starting_date:", dash5(s.starting_date)],
     ["due_date:", dash5(s.due_date)]
   ];
-  writeTable30(out, rows);
+  writeTable31(out, rows);
   out.write("\ntasks:\n");
   const tasks = allStepTasks(s);
   if (tasks.length === 0) {
@@ -49409,7 +50677,7 @@ function renderMecTaskTable(out, tasks, indent) {
       reconciliationTagsSummary(t.reconciliation_tags)
     ]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
 }
 async function runMecTaskList(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
@@ -49475,7 +50743,7 @@ function renderMecTaskDetail(out, t) {
     rows.push(["description:", dash5(nf.description)]);
     rows.push(["display_reviewer:", nf.display_reviewer ? "yes" : "no"]);
   }
-  writeTable30(out, rows);
+  writeTable31(out, rows);
 }
 async function runMecMemberList(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
@@ -49497,7 +50765,7 @@ function renderMecMemberList(out, rows) {
   for (const r of rows) {
     tableRows.push([dash5(r.id), dash5(r.email), memberRoleName(r.role), memberRoleId(r.role)]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
   out.write(`
 (${rows.length} member${plural(rows.length)})
 `);
@@ -49533,7 +50801,7 @@ async function runMecMemberCheck(cfg) {
   for (const d of docs) {
     tableRows.push([String(d.id), dash5(d.name)]);
   }
-  writeTable30(cfg.out, tableRows);
+  writeTable31(cfg.out, tableRows);
   cfg.out.write(`
 (${docs.length} doc${plural(docs.length)})
 `);
@@ -49562,7 +50830,7 @@ function renderMecGroupList(out, rows) {
       dash5(typeof r.role === "string" ? r.role : r.role)
     ]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
   out.write(`
 (${rows.length} group${plural(rows.length)})
 `);
@@ -49585,7 +50853,7 @@ function renderMecPeriods(out, rows) {
   for (const r of rows) {
     tableRows.push([String(r), unixSecondsToYmd(r)]);
   }
-  writeTable30(out, tableRows);
+  writeTable31(out, tableRows);
   out.write(`
 (${rows.length} period${plural(rows.length)})
 `);
@@ -49654,7 +50922,7 @@ async function runMecAccountsTaskStatuses(cfg) {
   renderMecAccountsTasksOrStatuses(cfg.out, resp, "statuses");
 }
 function shortHash4(input) {
-  return createHash11("sha256").update(input).digest("hex").slice(0, 12);
+  return createHash12("sha256").update(input).digest("hex").slice(0, 12);
 }
 async function runMecWorkflowCreate(cfg) {
   const action = {
@@ -51907,7 +53175,7 @@ async function runMecCloseDatesSet(cfg) {
   cfg.out.write(`Updated ${monthCount} ${monthWord} across ${yearCount} ${yearWord}.
 `);
 }
-function writeTable31(out, rows) {
+function writeTable32(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -51960,7 +53228,7 @@ function renderCloseDatesTable(out, map) {
       tableRows.push([String(r.year), String(r.month), String(r.rawValue), "-"]);
     }
   }
-  writeTable31(out, tableRows);
+  writeTable32(out, tableRows);
   const word = rows.length === 1 ? "month" : "months";
   out.write(`
 (${rows.length} ${word})
@@ -52038,14 +53306,14 @@ function wireMec(program) {
 }
 
 // src/commands/workflow.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 function dash6(s) {
   if (s === null || s === void 0) return "-";
   if (typeof s === "number") return String(s);
   if (s === "") return "-";
   return s;
 }
-function writeTable32(out, rows) {
+function writeTable33(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -52146,7 +53414,7 @@ function renderWorkflowList(out, rows) {
       dash6(r.update_time)
     ]);
   }
-  writeTable32(out, tableRows);
+  writeTable33(out, tableRows);
   out.write(`
 (${rows.length} workflow${plural(rows.length)})
 `);
@@ -52176,7 +53444,7 @@ function renderWorkflowDetail(out, t) {
     ["updated:", dash6(t.update_time)],
     ["process_start_time:", dash6(t.process_start_time)]
   ];
-  writeTable32(out, rows);
+  writeTable33(out, rows);
   out.write("\n");
   const perms = t.permissions ?? [];
   out.write("permissions: ");
@@ -52191,7 +53459,7 @@ function renderWorkflowDetail(out, t) {
     for (const tag of tags) {
       tagRows.push([`  ${tag.id}`, dash6(tag.name), dash6(tag.label), String(tag.value)]);
     }
-    writeTable32(out, tagRows);
+    writeTable33(out, tagRows);
   }
   out.write("\nprocess_instances:\n");
   const instances = t.process_instances ?? [];
@@ -52207,7 +53475,7 @@ function renderWorkflowDetail(out, t) {
         dash6(pi.create_time)
       ]);
     }
-    writeTable32(out, piRows);
+    writeTable33(out, piRows);
   }
 }
 async function runProcessList(cfg) {
@@ -52240,7 +53508,7 @@ function renderProcessList(out, rows) {
       dash6(r.create_time)
     ]);
   }
-  writeTable32(out, tableRows);
+  writeTable33(out, tableRows);
   out.write(`
 (${rows.length} process${rows.length === 1 ? "" : "es"})
 `);
@@ -52268,7 +53536,7 @@ function renderProcessDetail(out, p) {
     ["active:", p.is_active === true ? "yes" : p.is_active === false ? "no" : "-"],
     ["created:", dash6(p.create_time)]
   ];
-  writeTable32(out, rows);
+  writeTable33(out, rows);
   out.write("\nsteps:\n");
   const steps = p.steps ?? [];
   if (steps.length === 0) {
@@ -52286,7 +53554,7 @@ function renderProcessDetail(out, p) {
       dash6(s.due_date)
     ]);
   }
-  writeTable32(out, stepRows);
+  writeTable33(out, stepRows);
 }
 async function runStepGet(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
@@ -52317,7 +53585,7 @@ function renderStepDetail(out, s) {
     ["starting_date:", dash6(s.starting_date)],
     ["due_date:", dash6(s.due_date)]
   ];
-  writeTable32(out, rows);
+  writeTable33(out, rows);
   out.write("\ntasks:\n");
   const tasks = allStepTasks2(s);
   if (tasks.length === 0) {
@@ -52341,7 +53609,7 @@ function renderTaskTable(out, tasks, indent) {
       dash6(t.task_status)
     ]);
   }
-  writeTable32(out, tableRows);
+  writeTable33(out, tableRows);
 }
 async function runTaskList(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
@@ -52408,7 +53676,7 @@ function renderTaskDetail(out, t) {
     rows.push(["description:", dash6(nf.description)]);
     rows.push(["display_reviewer:", nf.display_reviewer ? "yes" : "no"]);
   }
-  writeTable32(out, rows);
+  writeTable33(out, rows);
 }
 async function runMemberList(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
@@ -52432,7 +53700,7 @@ function renderMemberList(out, rows) {
   for (const r of rows) {
     tableRows.push([dash6(r.id), dash6(r.email), memberRoleName2(r.role), memberRoleId2(r.role)]);
   }
-  writeTable32(out, tableRows);
+  writeTable33(out, tableRows);
   out.write(`
 (${rows.length} member${plural(rows.length)})
 `);
@@ -52470,7 +53738,7 @@ async function runMemberCheck(cfg) {
   for (const d of docs) {
     tableRows.push([String(d.id), dash6(d.name)]);
   }
-  writeTable32(cfg.out, tableRows);
+  writeTable33(cfg.out, tableRows);
   cfg.out.write(`
 (${docs.length} doc${plural(docs.length)})
 `);
@@ -52501,13 +53769,13 @@ function renderGroupList(out, rows) {
       dash6(typeof r.role === "string" ? r.role : r.role)
     ]);
   }
-  writeTable32(out, tableRows);
+  writeTable33(out, tableRows);
   out.write(`
 (${rows.length} group${plural(rows.length)})
 `);
 }
 function shortHash5(input) {
-  return createHash12("sha256").update(input).digest("hex").slice(0, 12);
+  return createHash13("sha256").update(input).digest("hex").slice(0, 12);
 }
 async function runWorkflowCreate(cfg) {
   const action = {
@@ -54666,7 +55934,7 @@ function wireWorkflow(root) {
 }
 
 // src/commands/cash.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { promises as fs25 } from "fs";
 
 // src/api/cash.ts
@@ -55346,7 +56614,7 @@ function truncate7(s, max) {
 function dash7(s) {
   return s === null || s === void 0 || s === "" ? "-" : s;
 }
-function writeTable33(out, rows) {
+function writeTable34(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -55401,7 +56669,7 @@ async function runCashCurrenciesList(cfg) {
     }
     const tableRows = [["CODE", "FULL_NAME"]];
     for (const r of rows) tableRows.push([r.code, r.full_name]);
-    writeTable33(cfg.out, tableRows);
+    writeTable34(cfg.out, tableRows);
     cfg.out.write(`
 (${rows.length} currenc${rows.length === 1 ? "y" : "ies"})
 `);
@@ -55470,7 +56738,7 @@ function renderOrgCurrencies(out, rows) {
       r.is_system_default ? "yes" : ""
     ]);
   }
-  writeTable33(out, tableRows);
+  writeTable34(out, tableRows);
   out.write(`
 (${rows.length} currenc${rows.length === 1 ? "y" : "ies"})
 `);
@@ -55506,7 +56774,7 @@ function renderTransactions(out, resp) {
       })
     );
   }
-  writeTable33(out, tableRows);
+  writeTable34(out, tableRows);
   const shown = resp.results.length;
   const pageHint = resp.next !== null ? ` \u2014 next page: ${resp.next}` : "";
   out.write(`
@@ -55757,7 +57025,7 @@ async function runCashRulesDeleteAll(cfg) {
     return;
   }
   const ids = targets.map((r) => r.id).sort((a, b) => a - b);
-  const sha = createHash13("sha256").update(ids.join(",")).digest("hex").slice(0, 12);
+  const sha = createHash14("sha256").update(ids.join(",")).digest("hex").slice(0, 12);
   const action = {
     resource: "cash-rules-batch",
     id: `${templateId}:${sha}`,
@@ -56131,7 +57399,7 @@ function renderRulesTable2(out, rules) {
       truncate3(dash7(r.description), 40)
     ]);
   }
-  writeTable33(out, rows);
+  writeTable34(out, rows);
   out.write(`
 (${rules.length} rule${plural(rules.length)})
 `);
@@ -56935,7 +58203,7 @@ function renderManageCompanies(out, resp) {
     out.write("Groups:\n");
     const rows = [["NAME", "DOCUMENTS"]];
     for (const g of resp.groups) rows.push([dash8(g.name), formatDocs(g.documents)]);
-    writeTable34(out, rows);
+    writeTable35(out, rows);
     out.write("\n");
   }
   if (resp.companies.length > 0) {
@@ -56950,7 +58218,7 @@ function renderManageCompanies(out, resp) {
         dashOrNull(e.group)
       ]);
     }
-    writeTable34(out, rows);
+    writeTable35(out, rows);
     out.write(`
 (${resp.companies.length} entit${resp.companies.length === 1 ? "y" : "ies"})
 `);
@@ -56967,7 +58235,7 @@ function dashOrNull(s) {
   if (typeof s !== "string" || s === "") return "-";
   return s;
 }
-function writeTable34(out, rows) {
+function writeTable35(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -57653,7 +58921,7 @@ async function runCalcmodelsDelete(cfg) {
     }
   });
 }
-function writeTable35(out, rows) {
+function writeTable36(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -57709,7 +58977,7 @@ function renderCalcmodelTable(out, models) {
       ]
     });
   }
-  writeTable35(out, rows);
+  writeTable36(out, rows);
 }
 function parseCalcmodelIdArg(idStr) {
   const n = Number(idStr);
@@ -58069,7 +59337,7 @@ async function runCalcValsDelete(cfg) {
     }
   });
 }
-function writeTable36(out, rows) {
+function writeTable37(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -58107,7 +59375,7 @@ function renderCalcValTable(out, vals) {
       ]
     });
   }
-  writeTable36(out, rows);
+  writeTable37(out, rows);
 }
 function parseCalcValIdArg(idStr) {
   const n = Number(idStr);
@@ -58408,7 +59676,7 @@ async function runCyclesList(cfg) {
       ]
     });
   }
-  writeTable37(cfg.out, tableRows);
+  writeTable38(cfg.out, tableRows);
 }
 async function runCyclesGet(cfg) {
   const allScenarios = await listScenarios(cfg.client, {}, { signal: cfg.signal });
@@ -58451,7 +59719,7 @@ async function runCyclesGet(cfg) {
         ]
       });
     }
-    writeTable37(cfg.out, rows);
+    writeTable38(cfg.out, rows);
   }
   cfg.out.write("\nRelated documents:\n");
   if (docIds.length === 0) {
@@ -58488,7 +59756,7 @@ async function runCyclesDocuments(cfg) {
     }
     rows.push({ cells: [String(id), name] });
   }
-  writeTable37(cfg.out, rows);
+  writeTable38(cfg.out, rows);
 }
 async function runScenariosList(cfg) {
   const scenarios = await listScenarios(
@@ -58525,7 +59793,7 @@ async function runScenariosList(cfg) {
       ]
     });
   }
-  writeTable37(cfg.out, rows);
+  writeTable38(cfg.out, rows);
 }
 async function runScenariosVersions(cfg) {
   const found = await findScenarioById(cfg.client, cfg.scenarioId, cfg.signal);
@@ -58561,7 +59829,7 @@ async function runScenariosVersions(cfg) {
       ]
     });
   }
-  writeTable37(cfg.out, rows);
+  writeTable38(cfg.out, rows);
 }
 async function runScenariosGet(cfg) {
   const found = await findScenarioById(cfg.client, cfg.scenarioId, cfg.signal);
@@ -58635,7 +59903,7 @@ async function runScenariosGet(cfg) {
           ]
         });
       }
-      writeTable37(cfg.out, rows);
+      writeTable38(cfg.out, rows);
       cfg.out.write("\n");
     }
   }
@@ -59196,7 +60464,7 @@ async function runScenariosBulkEdit(cfg) {
     }
   });
 }
-function writeTable37(out, rows) {
+function writeTable38(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -61640,7 +62908,7 @@ function printVendorRows(out, items) {
     }
     rows.push({ cells });
   }
-  writeTable38(out, rows);
+  writeTable39(out, rows);
 }
 var LISTING_FETCH = {
   all: listVendors,
@@ -61720,7 +62988,7 @@ async function runVendorCategories(cfg) {
   }
   const rows = [{ cells: ["VALUE", "DISPLAY NAME"] }];
   for (const c of items) rows.push({ cells: [c.value, c.display_name] });
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
   cfg.out.write(`
 ${items.length} categor${items.length === 1 ? "y" : "ies"}.
 `);
@@ -61745,7 +63013,7 @@ async function runVendorOwners(cfg) {
   }
   const rows = [{ cells: ["VENDOR ID", "OWNER ID"] }];
   for (const o of ids) rows.push({ cells: [owners.id, String(o.owner_id)] });
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
   cfg.out.write(`
 ${ids.length} owner(s).
 `);
@@ -62147,7 +63415,7 @@ function printAlertRows(out, items) {
       ]
     });
   }
-  writeTable38(out, rows);
+  writeTable39(out, rows);
 }
 async function runAlertsList(cfg) {
   if (cfg.params.status === void 0) {
@@ -62242,7 +63510,7 @@ async function runAlertsDismiss(cfg) {
           });
         }
       }
-      writeTable38(cfg.out, rows);
+      writeTable39(cfg.out, rows);
       cfg.out.write(
         `
 dismiss: ${cfg.alertIds.length - failed.length} ok, ${failed.length} failed.
@@ -62287,7 +63555,7 @@ async function runAlertSettingsGet(cfg) {
   rows.push({
     cells: ["user_ids", (s.user_ids ?? []).join(", ") || "(none)"]
   });
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
 }
 async function runAlertSettingsUpdate(cfg) {
   if (Object.keys(cfg.changes).length === 0) {
@@ -62372,7 +63640,7 @@ async function runContractCategories(cfg) {
   }
   const rows = [{ cells: ["VALUE", "DISPLAY NAME"] }];
   for (const c of items) rows.push({ cells: [c.value, c.display_name] });
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
   cfg.out.write(`
 ${items.length} categor${items.length === 1 ? "y" : "ies"}.
 `);
@@ -62401,7 +63669,7 @@ async function runContractHistory(cfg) {
       ]
     });
   }
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
   cfg.out.write(`
 ${items.length} change(s).
 `);
@@ -62611,7 +63879,7 @@ var MIME_MAGIC = {
 function magicMatches(buf, mime) {
   return matchesAny(buf, MIME_MAGIC[mime] ?? []);
 }
-function writeTable38(out, rows) {
+function writeTable39(out, rows) {
   if (rows.length === 0) return;
   const header = rows[0];
   const cols = header.cells.length;
@@ -62705,7 +63973,7 @@ async function runBillingFrequenciesList(cfg) {
   for (const bf of items) {
     rows.push({ cells: [bf.name, String(bf.period_months), bf.id] });
   }
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
 }
 async function runExtractFromFiles(cfg) {
   if (cfg.files.length === 0) {
@@ -62937,7 +64205,7 @@ function printFileRows(out, items) {
       ]
     });
   }
-  writeTable38(out, rows);
+  writeTable39(out, rows);
 }
 async function runFilesUpload(cfg) {
   if (cfg.files.length === 0) {
@@ -62978,7 +64246,7 @@ async function runFilesUpload(cfg) {
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, { uploaded, failed: failures });
   } else {
-    writeTable38(cfg.out, rows);
+    writeTable39(cfg.out, rows);
     cfg.out.write(`
 ${uploaded.length} uploaded, ${failedPaths.length} failed.
 `);
@@ -63111,7 +64379,7 @@ per-file results (${outcomes.length - failed.length} ok, ${failed.length} failed
   for (const o of outcomes) {
     rows.push({ cells: [o.path, o.ok ? "ok" : "FAILED", o.detail] });
   }
-  writeTable38(err, rows);
+  writeTable39(err, rows);
   if (abortedMidRun) {
     err.write(
       `
@@ -63250,7 +64518,7 @@ batch ${i + 1}/${batches.length} failed: ${msg}
           ]
         });
       }
-      writeTable38(cfg.out, rows);
+      writeTable39(cfg.out, rows);
     }
   });
 }
@@ -63302,7 +64570,7 @@ async function runContractUpdate(cfg) {
       String(updated.status)
     ]
   });
-  writeTable38(cfg.out, rows);
+  writeTable39(cfg.out, rows);
 }
 var DESCRIBE_PREVIEW_ROWS3 = 5;
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
@@ -63492,7 +64760,7 @@ function printContractRows(out, items) {
       ]
     });
   }
-  writeTable38(out, rows);
+  writeTable39(out, rows);
 }
 async function runContractsGet(cfg) {
   const contract = await getContract(
@@ -63516,7 +64784,7 @@ function reportIdOutcomes(out, outcomes, verb) {
   for (const o of outcomes) {
     rows.push({ cells: [o.id, o.ok ? "ok" : "FAILED", o.detail] });
   }
-  writeTable38(out, rows);
+  writeTable39(out, rows);
   const failed = outcomes.filter((o) => !o.ok);
   const okCount = outcomes.length - failed.length;
   out.write(`
@@ -64268,7 +65536,7 @@ async function runRhConfigVersionTemplates(cfg) {
   }
   renderTemplateTable2(cfg.out, filteredData);
 }
-function writeTable39(out, rows) {
+function writeTable40(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -64317,7 +65585,7 @@ function renderConfigInfo(out, info) {
   for (const t of info.tables) {
     rows.push({ cells: [t] });
   }
-  writeTable39(out, rows);
+  writeTable40(out, rows);
   const n = info.tables.length;
   out.write(`
 (${n} table${n === 1 ? "" : "s"})
@@ -64340,7 +65608,7 @@ function renderTemplateTable2(out, templates) {
       ]
     });
   }
-  writeTable39(out, rows);
+  writeTable40(out, rows);
 }
 function parsePositiveIdArg(label, raw) {
   const n = Number(raw);
@@ -64496,7 +65764,7 @@ async function runProductContentList(cfg) {
   }
   const rows = [["ID", "NAME", "TYPE"]];
   for (const pc of resp) rows.push([String(pc.id), pc.name, pc.type]);
-  writeTable40(cfg.out, rows);
+  writeTable41(cfg.out, rows);
   cfg.out.write(`
 (${resp.length} row${plural(resp.length)})
 `);
@@ -64584,7 +65852,7 @@ function countItems(body) {
   for (const g of body) items += g.items.length;
   return { items, groups: body.length };
 }
-function writeTable40(out, rows) {
+function writeTable41(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -64888,7 +66156,7 @@ function writeWarnings(out, warnings) {
   for (const w of warnings) out.write(`warning: ${w}
 `);
 }
-function writeTable41(out, rows) {
+function writeTable42(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -64923,7 +66191,7 @@ async function runTeamsList(cfg) {
   for (const t of resp.teams) {
     rows.push([String(t.team_id), t.name ?? "", t.support_email ?? "(none set)"]);
   }
-  writeTable41(cfg.out, rows);
+  writeTable42(cfg.out, rows);
   cfg.out.write(`
 (${resp.teams.length} team${plural(resp.teams.length)})
 `);
@@ -65346,7 +66614,7 @@ function renderSendgridStatus(out, resp, asJson) {
         r.valid === true ? "yes" : r.valid === false ? "NO" : "-"
       ]);
     }
-    writeTable41(out, rows);
+    writeTable42(out, rows);
     for (const r of resp.records) {
       if (r.valid === false && r.reason !== void 0 && r.reason !== null && r.reason !== "") {
         out.write(`  ${r.name}: ${r.reason}
@@ -66126,7 +67394,7 @@ function writeCloneReport(out, report) {
       String(t.members_added.length) + (t.members_unmapped.length > 0 ? ` (${t.members_unmapped.length} unmapped)` : "")
     ]);
   }
-  writeTable41(out, rows);
+  writeTable42(out, rows);
   const tables = report.import_result.tables;
   const counts = Object.entries(tables).filter(([, c]) => c.imported + c.skipped + c.updated > 0).map(([name, c]) => `${name}: ${c.imported} imported, ${c.skipped} skipped`);
   out.write(`
@@ -66581,7 +67849,7 @@ function parsePaletteFile(raw) {
   }
   return payload;
 }
-function writeTable42(out, rows) {
+function writeTable43(out, rows) {
   if (rows.length === 0) return;
   const widths = [];
   for (const r of rows) {
@@ -66621,7 +67889,7 @@ function renderPalettesTable(out, palettes) {
       ]
     });
   }
-  writeTable42(out, rows);
+  writeTable43(out, rows);
 }
 function renderColorsPreview(colors) {
   if (colors.length === 0) return "(none)";