@datarails-ai/dr-cli 1.6.130 → 1.6.131

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.130",
+  "cliVersion": "1.6.131",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1435,6 +1435,22 @@
         }
       ]
     },
+    "error-enrichments types list": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "read"
+        }
+      ]
+    },
+    "error-enrichments types create": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "write"
+        }
+      ]
+    },
     "skill list": {
       "requires": []
     },
@@ -1851,6 +1867,22 @@
         }
       ]
     },
+    "integrations netsuite readiness": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "write"
+        }
+      ]
+    },
+    "integrations netsuite saved-search-sql": {
+      "requires": [
+        {
+          "resource": "integrations",
+          "action": "read"
+        }
+      ]
+    },
     "connectors publish": {
       "denied": {
         "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
@@ -2339,6 +2371,30 @@
         }
       ]
     },
+    "filebox custom-reports list": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "read"
+        }
+      ]
+    },
+    "filebox custom-reports create": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
+    "filebox custom-reports apply": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
     "widgets list": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -295,6 +295,7 @@ area's gotchas.
   and its dependent objects into other organizations (two-step confirm).
   Destinations must come from `organizations push-targets`.
 - `filebox data-query get|set|set-sync-interval|clear|sync` (alias `dq`)
+- `filebox custom-reports list|create|apply` — SuiteQL custom reports of the filebox's NetSuite connection; `create --name <n> --query-file <path>` and `apply <filebox_id> <report_id>` replace the filebox's query (two-step confirm)
 - `filebox validation-rules options|set`
 - `filebox kind-explain <id…> [--history] [--as-of DATE] [--json]` / `filebox kind-summary [--json]` —
   why a filebox has its type and whether it still matches its connections, and
@@ -323,14 +324,16 @@ area's gotchas.
 - `integrations share users|groups`
 - `integrations it list|get|add|update|delete|resync` (IT-admin file-sync; redacts secrets by default)
 - `integrations sftp create|provision` — self-serve SFTP fileboxes: `create --name <n>` makes a filebox and its SFTP folder `/<name>_<id>` in one step; `provision <filebox_id>` does it for an existing filebox
+- `integrations netsuite readiness|saved-search-sql` — NetSuite 3.0 -> SuiteQL migration: `readiness <id> [--dry-run]` probes the bundle and, on CONFIRMED, stamps `bundle_version` 3 (two-step confirm); `saved-search-sql <id> --saved-search <ssid> [--out <file>]` prints a saved search's SQL and its library match
 - `entities list|qbd-availability|netsuite-connections|rename|rename-group|delete|mark-completed` (alias `companies`)
 - `entities create qbo|xero|qbd|netsuite` (connected accounting systems)
-- `error-enrichments list|stats|get|create|update|delete|test-regex|export|import` — the
+- `error-enrichments list|stats|get|create|update|delete|test-regex|export|import|types list|types create` — the
   regex→readable-message rules shown when a sync fails. `get`/`update`/`delete` take
   one **or more** ids (`update` applies the same patch to each); `create` and
   `update` also accept an **array** `--payload-file` (rule objects for `create`,
   `{id, ...fields}` patches for `update`) for batch writes. Rules are **per server**;
-  `list`/`stats` take `--all-servers`, writes take one `--server`. `import` is
+  `list`/`stats` take `--all-servers`, writes take one `--server`. A rule's `classification`
+  is a server-managed type name: `types list` shows them, `types create --name` adds one. `import` is
   wipe-and-replace and zeroes hits/feedback counters — it is not the reconcile
   tool: fleet changes are batch `create`/`update`, and `import` runs only when the
   user names it and confirms the analytics loss and id reassignment. Start at the
@@ -640,10 +643,11 @@ network traffic or hand-edits JSON. Full recipes in the relevant reference file.
   an unvalidated escape hatch that forwards straight to the server; a
   malformed value 500s with no error body. To know when it finished, add
   `--wait` — never poll `status` or the version count: an unchanged result
-  writes no new version and still reads `SYNCED`. Never backfill
-  **balances** from an aggregator (Plaid, Quiltt, Salt Edge, Flinks): it
-  returns today's balance for every `--date`, so each period gets an
-  identical copy. Backfill transactions only; sync balances for the current
+  writes no new version and still reads `SYNCED`, and a period is reported
+  `empty` (exit 0) only when the server logged an empty response for it.
+  Never backfill **balances** from an aggregator (Plaid, Quiltt, Salt Edge,
+  Flinks): it returns today's balance for every `--date`, so each period gets
+  an identical copy. Backfill transactions only; sync balances for the current
   period and let the nightly schedule build the history. See
   reference/filebox-documents.md.
 - **"User has no table permissions" is almost always a misread.** To see which

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -428,16 +428,26 @@ set-version-include` (below).
   `--wait` snapshots each `--date` period's versions before triggering, then
   polls until every period either gained a new version (**new version**) or
   had its latest version re-confirmed — the server bumps that version's
-  `last_sync` instead of writing one (**unchanged**). It exits non-zero when
-  the data-query goes to `ERROR` (with the server's `last_sync_error`) or on
+  `last_sync` instead of writing one (**unchanged**). A sync that returns
+  **no rows** writes no version and re-confirms none; `--wait` reports such a
+  period as **empty** (exit 0) only when the server has logged its
+  empty-response event ("Sync completed successfully, but no new data was
+  retrieved … for <period>.") after the trigger, by the server's own clock
+  (the sync response's `Date` header), naming that period. An empty response
+  that another sync of the same period logs after the trigger (a scheduled
+  run, another user) also counts. The data-query's status is never taken as
+  proof: a period that failed can read `SYNCED` once a later period runs.
+  Without that event (events unreadable, which warns once on stderr; no
+  `Date` header; or a new version that matches no period) the period stays
+  unfinished and the wait times out. It exits non-zero when the data-query
+  goes to `ERROR` (with the server's `last_sync_error`) or on
   `--timeout <seconds>` (default 1800). `--json` prints one object:
-  `{outcome, periods: [{period, result: new_version|no_change|pending,
+  `{outcome, periods: [{period, result: new_version|no_change|empty|pending,
   version_id, version}], unmatched_new_versions, error, waited_seconds,
-  warnings}` — `warnings` repeats any pre-sync `warning:` lines (empty when none).
-  Without `--date`, it waits for the first period to finish. It cannot be
-  combined with `--tag`. One blind spot: a sync that returns **no rows**
-  writes no version and re-confirms none, so it ends in a timeout whose
-  message says so — check `dr filebox data-query get <fb_id>`.
+  warnings}` (`version_id`/`version` are `null` for `empty`; `warnings`
+  repeats any pre-sync `warning:` lines, empty when none). Without `--date`,
+  it waits for the first period to finish. It cannot be combined with
+  `--tag`. On a timeout, check `dr filebox data-query get <fb_id>`.
 - `filebox data-query set-sync-interval <fb_id> --cron "<expr>"` — change how
   often the data-query polls (Workato-backed **and** connector-platform /
   `DatarailsConnector` fileboxes both use this cron). **Use this for sync
@@ -468,6 +478,17 @@ set-version-include` (below).
     (If you hand-build a `data-query set --payload-file` body instead, you must
     include a non-empty `sync_offset_array` yourself — that path does no
     defaulting.)
+- `filebox custom-reports list|create|apply <fb_id>` — the SuiteQL custom reports of
+  the filebox's NetSuite connection: named queries shared by its fileboxes, unique by
+  name per connection. `list` shows id, name and how many fileboxes use each.
+  `create <fb_id> --name <n> --query-file <path>` creates a report from the SQL in the
+  file and links the filebox to it; `apply <fb_id> <report_id>` links the filebox to an
+  existing one. Both replace the filebox's query and are two-step (Tier B); the plan
+  shows the filebox name and its current query (objectType, library key or custom,
+  length). The
+  filebox's data query must already be SuiteQL (400 otherwise); 409 on `create` means
+  the name is taken (by a report or a library entry). Names and SQL are decoded in all
+  output, `--json` included.
 - `filebox set-auto-calc-frequency <doc_id> --cron "<expr>" [--enable]` —
   two-step. Controls Datarails **auto-calculate** scheduling, a **different**
   feature from the Workato sync cron. `--enable` bootstraps auto-calc if it's

package/dist/skills/dr-cli/reference/integrations.md

@@ -100,6 +100,42 @@ container, and files dropped there land in the filebox.
 - Do not copy SFTP settings from another filebox with `filebox data-query set`. That
   links the filebox but creates no folder, so the client has nowhere to drop files.
 
+## NetSuite 3.0 -> SuiteQL migration (`integrations netsuite`)
+
+Helpers for converting a NetSuite 3.0 connection's fileboxes to SuiteQL in place. `<id>`
+is the NetSuite connection (data integration) id, not a filebox id.
+
+- `integrations netsuite readiness <id> --dry-run` makes one live SuiteQL call and prints
+  the outcome: `CONFIRMED`, `PENDING` (the bundle role or permission is not added yet),
+  `NOT_CONNECTED` (no credentials), `SKIPPED_FLAG_OFF` (the org lacks
+  `netsuite_suiteql`) or `ERROR`, with the detail and the connection's current
+  `bundle_version`. Nothing is written, and no confirmation is needed.
+- Without `--dry-run` it is a write: a `CONFIRMED` probe stamps `bundle_version` 3 (the 3.0
+  bundle) on the connection config. Two-step confirm (Tier B): the first run prints the
+  connection and a token; re-run with `--confirm-token <tok>`. Any other outcome stamps
+  nothing: the outcome is printed, then the command exits non-zero with
+  `readiness probe did not confirm (<OUTCOME>): <detail>; nothing was stamped`. A
+  `--dry-run` exits 0 for every outcome.
+- `integrations netsuite saved-search-sql <id> --saved-search <ssid>` (read-only;
+  `<ssid>` is a numeric internal id, negative for NetSuite's standard searches, or a
+  `customsearch*` script id; anything else is refused before the call) prints
+  the saved search's name, the SuiteQL library entry it matches (`source_query_key`, or
+  `none — custom report`), and the bundle's SQL translation, decoded. `--out <file>` also
+  writes the decoded SQL to a file, owner-only (0600), overwriting a regular file and
+  refusing a symlink or a hard-linked file; feed it to
+  `filebox custom-reports create --query-file <file>` when there is no library match. If
+  the file cannot be written, the SQL is printed to stdout and the command exits
+  non-zero.
+- `--json` prints the response body (decoded) on both.
+- Errors print `<op> refused (409): <server detail>`. The server's 409 causes:
+  `Connection is SuiteQL-native or has no NetSuite 3.0 filebox` and
+  `connection account id is not a valid NetSuite account id` (both verbs), and
+  `connection has no credentials: <fields>` (`saved-search-sql` only; `readiness` reports
+  missing credentials as the `NOT_CONNECTED` outcome). 404 means the id is not a
+  NetSuite connection this account can see. 502 on `saved-search-sql` means the bundle
+  call failed, or the translated SQL is over the 100,000-character custom-report cap;
+  the detail says which.
+
 ## Entities — company data sources (`entities`, alias `companies`)
 
 The connected accounting systems (QuickBooks Online/Desktop, Xero, NetSuite) —

package/dist/skills/dr-error-enrichment/reference/core.md

@@ -37,8 +37,16 @@ dr error-enrichments test-regex --server S --pattern RE (--sample S... | --sampl
 dr error-enrichments export     [--server S | --all-servers | --servers A,B] [--include-test]
                                 [--out PATH]                          # PATH is a DIRECTORY when sweeping
 dr error-enrichments import     --server S --file backup.csv          # DESTRUCTIVE — see safety-backup.md
+dr error-enrichments types list [--server S | --all-servers | --servers A,B] [--include-test] [--json]
+dr error-enrichments types create --server S --name N [--description D]   # add a classification type
 ```
 
+`classification` is a server-managed **type name**, not a fixed list: read
+`types list` for what a server accepts (a rule write with an unknown name is a
+400), and `types create` to add one. `--classification` filters on reads are
+checked against the targeted server's live types, so a misspelling errors
+instead of returning an empty list.
+
 An array `--payload-file` on `create` / `update` takes neither positional ids nor
 field flags — array mode carries every field inside each entry, and the command
 rejects the combination rather than guessing which one wins.

package/dist/skills/dr-error-enrichment-author/SKILL.md

@@ -72,8 +72,9 @@ to spread to the fleet.
    message. The server shifts the sibling rows to make room — pass the rank you
    want and never renumber siblings by hand.
 
-7. **Set `classification`** (`DataSource` | `Filebox` | `Unclassified`) and
-   decide `approved`. Create as a draft (`--approved false`) only when the
+7. **Set `classification`** to a managed type (`dr error-enrichments types list
+   --server <S>`; omitted means `Unclassified`) and decide `approved`. Create as
+   a draft (`--approved false`) only when the
    pattern still needs field validation, and say out loud what that costs: a
    draft steals the hit from any lower-ranked approved rule and shows the user
    nothing, so a draft left in place is an active user-facing gap, not a

package/dist/skills/dr-error-enrichment-reconcile/SKILL.md

@@ -94,7 +94,10 @@ JSON
 dr error-enrichments update --payload-file /tmp/uk-patches.json --server UK
 ```
 
-For rules missing on the target — an array of full rule objects:
+For rules missing on the target — an array of full rule objects. Classification
+types are per server: run `dr error-enrichments types list --all-servers` first and
+`types create` any name the target lacks, or every rule using it fails with a 400.
+The `classification` below is illustrative:
 
 ```bash
 cat > /tmp/uk-new.json <<'JSON'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.130",
+  "version": "1.6.131",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.8",
+    "@datarails-ai/dr-appspace-cli": "0.12.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",