@datarails-ai/dr-cli 1.6.130 → 1.6.132

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.130",
+  version: "1.6.132",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.8",
+    "@datarails-ai/dr-appspace-cli": "0.12.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-13T13:04:51.581Z";
+var BUILD_TIME = "2026-10-14T19:31:40.601Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -2268,6 +2268,13 @@ var AuthorizedClient = class _AuthorizedClient {
   async postJSON(path12, payload, options) {
     return this.requestJson("POST", path12, payload, options);
   }
+  /**
+   * {@link AuthorizedClient.postJSON}, also returning the final response's headers. Same
+   * recovery ladder and error messages.
+   */
+  async postJSONWithHeaders(path12, payload, options) {
+    return this.requestJsonWithHeaders("POST", path12, payload, options);
+  }
   /**
    * Issues a `PUT` with `payload` JSON-encoded as the body and decodes the
    * JSON response into `T`. Mirrors `client.go:148` `PutJSON`.
@@ -2498,6 +2505,10 @@ var AuthorizedClient = class _AuthorizedClient {
    * replayable); they go through `do()` directly. See Task 1.14.
    */
   async requestJson(method, path12, payload, options) {
+    return (await this.requestJsonWithHeaders(method, path12, payload, options)).data;
+  }
+  /** {@link AuthorizedClient.requestJson}, also returning the final response's headers. */
+  async requestJsonWithHeaders(method, path12, payload, options) {
     const body = payload === void 0 ? void 0 : JSON.stringify(payload);
     const sentBearer = this.hasBearer();
     let res = await this.doWithAuth(method, path12, body, options, true);
@@ -2545,9 +2556,9 @@ var AuthorizedClient = class _AuthorizedClient {
       await this._store.touch(this._serverKey, this._email);
     } catch {
     }
-    if (text2 === "" || text2 === '""') return null;
+    if (text2 === "" || text2 === '""') return { data: null, headers: res.headers };
     try {
-      return JSON.parse(text2);
+      return { data: JSON.parse(text2), headers: res.headers };
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(`${method} ${path12}: decode: ${msg}`);
@@ -3699,6 +3710,9 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   // the pre-write `export` backup restores any rule the batch got wrong.
   "error-enrichment-batch|create",
   "error-enrichment-batch|update",
+  // A new classification type is additive: it changes no existing rule and
+  // only widens the names a rule may be filed under.
+  "error-enrichment-type|create",
   // cash (dr cash …). rules delete / delete-all / hidden-rules delete → Tier A.
   "cash-rule|update",
   "cash-rules|reorder",
@@ -3754,6 +3768,16 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   "filebox|set-sync-frequency",
   "filebox|lock",
   "filebox-date-tag|lock",
+  // SuiteQL custom reports (dr filebox custom-reports create / apply). Both rewrite one
+  // filebox's query, as the ungated `filebox data-query set` does, and are undone by
+  // re-applying the previous query; create also adds a report row the UI can delete.
+  "filebox-custom-report|create",
+  "filebox-custom-report|apply",
+  // NetSuite readiness stamp (dr integrations netsuite readiness). Writes one config key,
+  // bundle_version 3, on one connection, only after a CONFIRMED probe; the server refuses a
+  // connection that is not a 3.0 migration candidate (409), and the ungated
+  // `integrations update` can rewrite the key.
+  "netsuite-bundle-version|stamp",
   // collection-processes (dr collection-processes …).
   "collection-process|create",
   "collection-process|set-tag-config",
@@ -3871,7 +3895,27 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   "org-export|delete",
   // connectors poll item skip (dr connectors poll skip). The item is never landed,
   // but `dr connectors poll retry` queues it again, so the token alone is enough.
-  "connector-poll-item|skip"
+  "connector-poll-item|skip",
+  // connectors poll seeding (dr connectors poll seed, and a `poll set` whose answers seed
+  // and land nothing: `--on-policy-change seed`, with or without `--widen seed`). DR-55448.
+  // A seed marks items already in the source as seen, so a cut-over does not land them a
+  // second time beside the versions the old feed (Workato) already landed. It lands
+  // nothing, deletes nothing and touches no version in the filebox. It is a routine step of
+  // every cut-over (bind, seed --until <cut-over>, enable, pause the old feed), run once per
+  // filebox, often by an agent over hundreds of fileboxes, and the word dialog stalled every
+  // one of them. The token still binds the filebox, server, account, control-plane URL and
+  // the exact --until / settings, and the control-plane audits each call
+  // (`poll.seed` / `poll.put`: user, org, query).
+  // Judged, not free: a seeded item is not undone by `poll retry` (that covers failed,
+  // waiting and skipped items), so a cutoff set too late leaves files unlanded until a
+  // Tier-A land path (`set --on-policy-change land`, `resume --source land`) or an upload
+  // brings them in. Accepted because those files stay in the source and nothing in the
+  // filebox changes; the plan shows the filebox and the cutoff before the token is
+  // redeemed, and a separate `seed --dry-run` counts the already-discovered items it would
+  // mark (the plan does not). If a seed ever lands, deletes or rewrites a version,
+  // these keys move back to Tier A.
+  "connector-poll|seed",
+  "connector-poll|set-seed"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -4007,13 +4051,13 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // deletes whole organizations via the org-delete chord. The single most
   // destructive verb in the CLI; the word gate stays on prod unconditionally.
   "org-import|delete-orgs",
-  // connectors polled ingestion (dr connectors poll seed / set / resume --source land).
-  // A seed marks items landed so they never land; `set` is gated (as `set-land-or-seed`)
-  // only when it lands a wider window or seeds / lands on a change-policy switch;
-  // `resume --source land` lands everything a changed source holds. Versions landed in
-  // a customer filebox, or files hidden from it, cannot be taken back from the CLI.
-  "connector-poll|seed",
-  "connector-poll|set-land-or-seed",
+  // connectors polled ingestion writes that LAND files (dr connectors poll set / resume
+  // --source land). `set-land` is a `poll set` with any answer that lands: a wider window
+  // with `--widen land`, or `--on-policy-change land` (a seed alongside a land is still
+  // `set-land`). `resume --source land` lands everything a changed source holds. Versions
+  // landed in a customer filebox cannot be taken back from the CLI. Seeding is Tier B
+  // (`connector-poll|seed` / `|set-seed`, DR-55448).
+  "connector-poll|set-land",
   "connector-poll|resume-land"
 ]);
 function classifyTier(action) {
@@ -5843,6 +5887,52 @@ function isBadGatewayError(err) {
   if (/^\S+ \S+: HTTP 502(?::|\s|$)/.test(err.message)) return true;
   return /\(HTTP 502\)$/.test(err.message);
 }
+async function readRawJson(res) {
+  const rawText = await res.text();
+  let body = null;
+  try {
+    body = rawText ? JSON.parse(rawText) : null;
+  } catch {
+    body = null;
+  }
+  return { status: res.status, body, rawText };
+}
+var DETAIL_MAX_CHARS = 300;
+function isSuccess(status2) {
+  return status2 >= 200 && status2 < 300;
+}
+function rawErrorDetail(res) {
+  return truncate4(uncappedErrorDetail(res), DETAIL_MAX_CHARS);
+}
+function uncappedErrorDetail(res) {
+  const { body } = res;
+  if (typeof body === "string") return body;
+  if (body !== null && typeof body === "object" && !Array.isArray(body)) {
+    const detail = body.detail;
+    if (typeof detail === "string") return detail;
+    const fields = [];
+    for (const [field, value] of Object.entries(body)) {
+      const messages = Array.isArray(value) ? value : [value];
+      if (messages.length > 0 && messages.every((m) => typeof m === "string")) {
+        fields.push(`${field}: ${messages.join(" ")}`);
+      }
+    }
+    if (fields.length > 0) return fields.join("; ");
+  }
+  return res.rawText.trim();
+}
+var FAILURE_PHRASES = {
+  400: "rejected",
+  403: "refused",
+  404: "not found, or not visible to this account",
+  409: "refused",
+  502: "failed upstream"
+};
+function describeRawFailure(what, res, overrides = {}) {
+  const detail = decodeShape(rawErrorDetail(res));
+  const phrase = overrides[res.status] ?? FAILURE_PHRASES[res.status];
+  return phrase === void 0 ? `${what}: unexpected status ${res.status}: ${detail}` : `${what} ${phrase} (${res.status}): ${detail}`;
+}
 
 // src/api/users.ts
 async function list2(client, options) {
@@ -19114,12 +19204,52 @@ async function clearDataQuery(client, id, reqOptions) {
   return client.do("DELETE", `/api/documents/${id}/data_query`, void 0, reqOptions);
 }
 async function syncDataQuery(client, id, body, reqOptions) {
-  const out = await client.postJSON(
+  return (await syncDataQueryTimed(client, id, body, reqOptions)).body;
+}
+async function syncDataQueryTimed(client, id, body, reqOptions) {
+  const { data: data4, headers } = await client.postJSONWithHeaders(
     `/api/documents/${id}/data_query_sync`,
     body,
     reqOptions
   );
-  return out ?? {};
+  const serverTimeMs = Date.parse(headers.get("date") ?? "");
+  return {
+    body: data4 !== null && typeof data4 === "object" && !Array.isArray(data4) ? data4 : {},
+    serverTimeMs: Number.isFinite(serverTimeMs) ? serverTimeMs : void 0
+  };
+}
+async function listDocumentEvents(client, id, action, page, reqOptions) {
+  return client.getJSON(
+    `/api/documents/${id}/logs?action=${encodeURIComponent(action)}&skip=${page.skip}&limit=${page.limit}`,
+    reqOptions
+  );
+}
+async function listCustomReports(client, id, reqOptions) {
+  const res = await client.do(
+    "GET",
+    `/api/documents/${id}/data_query_custom_reports`,
+    void 0,
+    reqOptions
+  );
+  return readRawJson(res);
+}
+async function createCustomReport(client, id, body, reqOptions) {
+  const res = await client.do(
+    "POST",
+    `/api/documents/${id}/data_query_custom_reports`,
+    JSON.stringify(body),
+    reqOptions
+  );
+  return readRawJson(res);
+}
+async function applyCustomReport(client, id, reportId, reqOptions) {
+  const res = await client.do(
+    "POST",
+    `/api/documents/${id}/data_query_custom_reports/${reportId}/apply`,
+    JSON.stringify({}),
+    reqOptions
+  );
+  return readRawJson(res);
 }
 async function getAutoCalculateSettings(client, docId, reqOptions) {
   const path12 = `/api/documents/${docId}/auto_calculate_settings`;
@@ -28878,6 +29008,7 @@ import * as path5 from "path";
 
 // src/api/errorEnrichments.ts
 var BASE = "/api/v3/data_integrations/error-enrichments/";
+var TYPES_BASE = "/api/v3/data_integrations/error-enrichment-types/";
 function filtersQuery(filters) {
   if (filters === void 0) return "";
   const params = new URLSearchParams();
@@ -28964,9 +29095,31 @@ async function testRegex(client, regex, samples, options) {
   }
   return out;
 }
-
-// src/types/errorEnrichment.ts
-var ENRICHMENT_CLASSIFICATIONS = ["DataSource", "Filebox", "Unclassified"];
+async function listTypes(client, options) {
+  const res = await client.do("GET", TYPES_BASE, void 0, options);
+  const text2 = await res.text();
+  if (res.status === 404) return null;
+  if (res.status !== 200) {
+    throw new Error(`GET ${TYPES_BASE}: HTTP ${res.status}: ${text2.trim().slice(0, 200)}`);
+  }
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text2);
+  } catch {
+    parsed2 = void 0;
+  }
+  if (!Array.isArray(parsed2)) {
+    throw new Error(`GET ${TYPES_BASE}: unexpected response: ${text2.trim().slice(0, 200)}`);
+  }
+  return parsed2;
+}
+async function createType(client, type, options) {
+  const out = await client.postJSON(TYPES_BASE, type, options);
+  if (out === null) {
+    throw new Error("error-enrichment-types create: empty response");
+  }
+  return out;
+}
 
 // src/commands/errorEnrichments.ts
 function writeTable22(out, rows) {
@@ -29176,7 +29329,10 @@ async function runEnrichmentsList(cfg) {
   const results = await sweep(
     cfg.servers,
     cfg.makeSetup,
-    (client, signal) => list19(client, cfg.filters, { signal }),
+    async (client, signal) => {
+      await requireKnownClassifications(client, cfg.filters, signal);
+      return list19(client, cfg.filters, { signal });
+    },
     cfg.errOut
   );
   const single = cfg.servers.length === 1;
@@ -29204,7 +29360,10 @@ async function runEnrichmentsStats(cfg) {
   const results = await sweep(
     cfg.servers,
     cfg.makeSetup,
-    (client, signal) => stats(client, cfg.filters, { signal }),
+    async (client, signal) => {
+      await requireKnownClassifications(client, cfg.filters, signal);
+      return stats(client, cfg.filters, { signal });
+    },
     cfg.errOut
   );
   const single = cfg.servers.length === 1;
@@ -29232,6 +29391,47 @@ async function runEnrichmentsStats(cfg) {
   }
   requireSweepSuccess(results);
 }
+function renderTypesTable(out, types) {
+  if (types.length === 0) {
+    out.write("(no types)\n");
+    return;
+  }
+  const rows = [{ cells: ["NAME", "DESCRIPTION"] }];
+  for (const t of types) rows.push({ cells: [t.name, oneLine2(t.description, 80)] });
+  writeTable22(out, rows);
+}
+async function runEnrichmentTypesList(cfg) {
+  const results = await sweep(
+    cfg.servers,
+    cfg.makeSetup,
+    async (client, signal) => {
+      const types = await listTypes(client, { signal });
+      if (types === null) throw new Error("this server does not serve error-enrichment types yet");
+      return types;
+    },
+    cfg.errOut
+  );
+  const single = cfg.servers.length === 1;
+  const only = results[0];
+  if (cfg.asJson) {
+    if (single) {
+      if (only?.status === "ok") writeJSONIndented(cfg.out, only.value ?? []);
+    } else {
+      writeJSONIndented(cfg.out, sweepJson(results, "types"));
+    }
+  } else {
+    for (const r of results) {
+      if (!single) {
+        const suffix = r.status === "ok" ? `${(r.value ?? []).length} type${plural((r.value ?? []).length)}` : `${r.status}: ${r.message ?? ""}`;
+        cfg.out.write(`== ${r.server} \u2014 ${suffix} ==
+`);
+      }
+      if (r.status === "ok") renderTypesTable(cfg.out, r.value ?? []);
+      if (!single) cfg.out.write("\n");
+    }
+  }
+  requireSweepSuccess(results);
+}
 function oneLine2(s, max) {
   return truncate3(s.replace(/\s+/g, " "), max);
 }
@@ -29726,6 +29926,45 @@ async function runEnrichmentsImport(cfg) {
     }
   });
 }
+function requireTypeName(name) {
+  if (name.trim() === "") {
+    throw new Error("--name must not be empty");
+  }
+}
+async function runEnrichmentTypesCreate(cfg) {
+  requireTypeName(cfg.name);
+  const action = {
+    resource: "error-enrichment-type",
+    id: cfg.name,
+    verb: "create"
+  };
+  await preflightConfirmToken(action, cfg.token);
+  const description = cfg.description === void 0 ? "" : ` --description ${shellQuote(cfg.description)}`;
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: `dr error-enrichments types create --name ${shellQuote(cfg.name)}${description} ${cmdTail(cfg.serverFlag, cfg.accountFlag, void 0)}`,
+    describe: async () => [
+      `type: ${cfg.name}`,
+      ...cfg.description === void 0 ? [] : [`description: ${truncate3(cfg.description, 120)}`],
+      `adds a classification type on ${cfg.serverFlag}; this CLI has no verb to rename or remove it`
+    ],
+    execute: async () => {
+      const created = await createType(
+        cfg.client,
+        {
+          name: cfg.name,
+          ...cfg.description === void 0 ? {} : { description: cfg.description }
+        },
+        { signal: cfg.signal }
+      );
+      cfg.out.write(`Created error-enrichment type ${created.name} on ${cfg.serverFlag}.
+`);
+    }
+  });
+}
 function collectArray6(value, previous) {
   return [...previous, value];
 }
@@ -29908,18 +30147,20 @@ function resolveUpdateTargets(idArgs, entries, rule) {
   }
   return { patches: ids.map((id) => ({ id, patch: rule })), mode: "shared" };
 }
-function requireKnownClassifications(values) {
-  const unknown = (values ?? []).filter(
-    (v) => !ENRICHMENT_CLASSIFICATIONS.includes(v)
-  );
+async function requireKnownClassifications(client, filters, signal) {
+  const wanted = filters.classifications ?? [];
+  if (wanted.length === 0) return;
+  const types = await listTypes(client, { signal });
+  if (types === null) return;
+  const known = new Set(types.map((t) => t.name));
+  const unknown = wanted.filter((v) => !known.has(v));
   if (unknown.length > 0) {
     throw new Error(
-      `unknown --classification ${unknown.map((v) => JSON.stringify(v)).join(", ")}. Valid: ${ENRICHMENT_CLASSIFICATIONS.join(", ")}`
+      `unknown --classification ${unknown.map((v) => JSON.stringify(v)).join(", ")}. Valid: ${types.map((t) => t.name).join(", ")} (see dr error-enrichments types list)`
     );
   }
 }
 function filtersFromOpts(opts) {
-  requireKnownClassifications(opts.classification);
   return {
     integrationTypes: opts.integrationType,
     classifications: opts.classification,
@@ -29938,7 +30179,10 @@ function addRuleFieldFlags(cmd, payloadHelp) {
     'Raw error example (repeatable). To clear all examples, use --payload-file with {"examples": []}',
     collectArray6,
     []
-  ).option("--classification <c>", "DataSource | Filebox | Unclassified").option("--approved <bool>", "true | false");
+  ).option(
+    "--classification <c>",
+    "Classification type name (see `dr error-enrichments types list`)"
+  ).option("--approved <bool>", "true | false");
 }
 function addSweepFlags(cmd) {
   return cmd.option(
@@ -29953,7 +30197,12 @@ function addFilterFlags(cmd) {
     "Filter by integration type (repeatable)",
     collectArray6,
     []
-  ).option("--classification <c>", "Filter by classification (repeatable)", collectArray6, []).option("--approved <bool>", "Filter by approved state (true | false)").option("--search <q>", "Search pattern / description / type name");
+  ).option(
+    "--classification <c>",
+    "Filter by classification type name (repeatable; see `dr error-enrichments types list`)",
+    collectArray6,
+    []
+  ).option("--approved <bool>", "Filter by approved state (true | false)").option("--search <q>", "Search pattern / description / type name");
 }
 function defaultSweepSetup(accountFlag) {
   return (serverKey) => setupCall(serverKey, accountFlag);
@@ -30204,6 +30453,49 @@ function registerErrorEnrichmentsCommand(root) {
   });
   addServerFlag(importCmd);
   addAccountFlag(importCmd);
+  const types = group.command("types").description("Manage the classification types rules can be filed under (per-server)");
+  const typesListCmd = types.command("list").description("List classification types on one server or across servers").option("--json", "Output raw JSON instead of tables", false).action(
+    async (opts) => {
+      const servers = resolveTargetServers({
+        server: opts.server,
+        allServers: opts.allServers === true,
+        serversCsv: opts.servers,
+        includeTest: opts.includeTest === true
+      });
+      await runEnrichmentTypesList({
+        servers,
+        makeSetup: defaultSweepSetup(normaliseAccount(opts.account)),
+        asJson: opts.json === true,
+        out: process.stdout,
+        errOut: process.stderr
+      });
+    }
+  );
+  addServerFlag(typesListCmd);
+  addAccountFlag(typesListCmd);
+  addSweepFlags(typesListCmd);
+  const typesCreateCmd = types.command("create").description("Add a classification type (two-step confirm)").requiredOption("--name <name>", "Type name, e.g. Data-source:Timeout").option("--description <text>", "What the type covers").option("--confirm-token <token>", "Token from the plan step").action(
+    async (opts) => {
+      requireTypeName(opts.name);
+      const setup = await setupCall(opts.server, normaliseAccount(opts.account));
+      try {
+        await runEnrichmentTypesCreate({
+          client: setup.client,
+          name: opts.name,
+          description: opts.description,
+          token: opts.confirmToken,
+          serverFlag: resolveServer(opts.server),
+          accountFlag: normaliseAccount(opts.account),
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(typesCreateCmd);
+  addAccountFlag(typesCreateCmd);
 }
 
 // src/commands/skill.ts
@@ -34143,6 +34435,8 @@ function registerDocumentsCommand(root) {
 
 // src/commands/integrations.ts
 import { Option as Option2 } from "commander";
+import { constants as fsConstants } from "fs";
+import { lstat, open as open2 } from "fs/promises";
 
 // src/api/integrations.ts
 async function list23(client, opts, reqOptions) {
@@ -34167,7 +34461,7 @@ async function getDataSourcesPage(client, page, reqOptions) {
   const out = await client.getJSON(path12, reqOptions);
   return out ?? { next: null, results: [] };
 }
-async function listTypes(client, search, reqOptions) {
+async function listTypes2(client, search, reqOptions) {
   let path12 = "/api/v3/data_integrations/types/";
   const s = (search ?? "").trim();
   if (s !== "") {
@@ -34272,14 +34566,25 @@ async function sftpProvision(client, fileboxId, body, reqOptions) {
     JSON.stringify(body),
     reqOptions
   );
-  const rawText = await res.text();
-  let parsed2 = null;
-  try {
-    parsed2 = rawText ? JSON.parse(rawText) : null;
-  } catch {
-    parsed2 = null;
-  }
-  return { status: res.status, body: parsed2, rawText };
+  return readRawJson(res);
+}
+async function netsuiteBundleReadiness(client, id, dryRun, reqOptions) {
+  const res = await client.do(
+    "POST",
+    `/api/v3/data_integrations/data-sources/${id}/netsuite/bundle-readiness`,
+    JSON.stringify({ dry_run: dryRun }),
+    reqOptions
+  );
+  return readRawJson(res);
+}
+async function netsuiteSavedSearchSql(client, id, savedSearchId, reqOptions) {
+  const res = await client.do(
+    "GET",
+    `/api/v3/data_integrations/data-sources/${id}/netsuite/saved-search-sql?saved_search_id=${encodeURIComponent(savedSearchId)}`,
+    void 0,
+    reqOptions
+  );
+  return readRawJson(res);
 }
 async function shareUsers2(client, id, emails, reqOptions) {
   const out = await client.postJSON(
@@ -34356,7 +34661,7 @@ async function itResync(client, id, reqOptions) {
 // src/commands/filebox.ts
 import { promises as fsPromises, existsSync as existsSync2 } from "fs";
 import * as nodePath from "path";
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 
 // src/commands/filebox_admin.ts
 import { promises as fs15 } from "fs";
@@ -36420,6 +36725,290 @@ function registerFileboxRescanVersionCommand(fb) {
   addAccountFlag(cmd);
 }
 
+// src/commands/filebox_customReports.ts
+import { createHash as createHash9 } from "crypto";
+import { readFile as readFile5 } from "fs/promises";
+function shortHash4(input) {
+  return createHash9("sha256").update(input).digest("hex").slice(0, 12);
+}
+function isCustomReport(v) {
+  if (v === null || typeof v !== "object") return false;
+  const r = v;
+  return typeof r.id === "number" && typeof r.name === "string";
+}
+async function fetchCustomReports(client, fileboxId, signal) {
+  const res = await listCustomReports(client, fileboxId, { signal });
+  if (!isSuccess(res.status)) {
+    throw new Error(describeRawFailure("list custom reports", res));
+  }
+  const body = decodeShape(res.body);
+  const reports = body?.custom_reports;
+  if (!Array.isArray(reports) || !reports.every(isCustomReport)) {
+    throw new Error(
+      `list custom reports: unexpected ${res.status} response: ${truncate3(res.rawText.trim(), 300)}`
+    );
+  }
+  return { body, reports };
+}
+function usedBy(n) {
+  const count = typeof n === "number" ? n : 0;
+  return `${count} filebox${count === 1 ? "" : "es"}`;
+}
+function writeLinkResult(cfg, what, res, headline) {
+  if (!isSuccess(res.status)) {
+    throw new Error(describeRawFailure(what, res));
+  }
+  const body = decodeShape(res.body);
+  if (body === null || typeof body !== "object" || !isCustomReport(body.custom_report)) {
+    throw new Error(
+      `${what}: unexpected ${res.status} response: ${truncate3(res.rawText.trim(), 300)}`
+    );
+  }
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, body);
+    return;
+  }
+  const report = body.custom_report;
+  cfg.out.write(`${headline(report)} (used by ${usedBy(report.usage_count)}).
+`);
+}
+function describeCurrentQuery(raw) {
+  let config = raw?.config;
+  if (typeof config === "string") {
+    try {
+      config = JSON.parse(config);
+    } catch {
+      config = null;
+    }
+  }
+  if (config === null || typeof config !== "object") return "no data query";
+  const c = config;
+  const type = typeof c["objectType"] === "string" && c["objectType"] !== "" ? c["objectType"] : "-";
+  const key = c["source_query_key"];
+  const reportId = c["custom_report_id"];
+  const source = typeof key === "string" && key !== "" ? `library ${key}` : typeof reportId === "number" ? `custom report #${reportId}` : "custom";
+  const query = c["query"];
+  const length = typeof query === "string" ? `${query.length} chars` : "none";
+  return `objectType ${type}, source ${source}, query ${length}`;
+}
+async function describeFileboxTarget(client, fileboxId, signal) {
+  const details = decodeShape(await getDetails(client, fileboxId, { signal }));
+  const dataQuery = decodeShape(await getDataQueryRaw(client, fileboxId, { signal }));
+  return [`filebox: ${fileboxId} "${details.name}"`, `current: ${describeCurrentQuery(dataQuery)}`];
+}
+async function runFileboxCustomReportsList(cfg) {
+  const { body, reports } = await fetchCustomReports(cfg.client, cfg.fileboxId, cfg.signal);
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, body);
+    return;
+  }
+  if (reports.length === 0) {
+    cfg.out.write(`No custom reports on the connection of filebox ${cfg.fileboxId}.
+`);
+    return;
+  }
+  const rows = [
+    ["ID", "NAME", "USED BY"],
+    ...reports.map((r) => [String(r.id), r.name, usedBy(r.usage_count)])
+  ];
+  const widths = [0, 1].map((i) => Math.max(...rows.map((row) => (row[i] ?? "").length)));
+  for (const row of rows) {
+    const [id = "", name = "", used = ""] = row;
+    cfg.out.write(
+      `${id.padEnd((widths[0] ?? 0) + 2)}${name.padEnd((widths[1] ?? 0) + 2)}${used}
+`
+    );
+  }
+  cfg.out.write(`${reports.length} custom report${plural(reports.length)}
+`);
+}
+function customReportCreateAction(fileboxId, name, query) {
+  const hash = shortHash4(JSON.stringify([name.trim(), query]));
+  return { resource: "filebox-custom-report", id: `${fileboxId}:${hash}`, verb: "create" };
+}
+async function readCustomReportQueryFile(path12) {
+  if (path12.trim() === "") {
+    throw new Error("--query-file is required");
+  }
+  const query = await readFile5(path12, "utf8");
+  if (query.trim() === "") {
+    throw new Error(`--query-file ${path12} is empty`);
+  }
+  return query;
+}
+async function runFileboxCustomReportsCreate(cfg) {
+  const name = cfg.name.trim();
+  if (name === "") {
+    throw new Error("--name is required");
+  }
+  const action = customReportCreateAction(cfg.fileboxId, name, cfg.query);
+  await preflightConfirmToken(action, cfg.token);
+  const firstLine = cfg.query.trim().split("\n")[0] ?? "";
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: `dr filebox custom-reports create ${cfg.fileboxId} --name ${shellQuote(name)} --query-file ${shellQuote(cfg.queryFile)} --server ${cfg.serverFlag}`,
+    describe: async () => [
+      ...await describeFileboxTarget(cfg.client, cfg.fileboxId, cfg.signal),
+      `name:    "${name}" (unique on the filebox's NetSuite connection)`,
+      `query:   ${cfg.query.length} chars, starting "${truncate3(firstLine, 60)}"`,
+      "effect:  creates the custom report and links this filebox to it, replacing the filebox's query"
+    ],
+    execute: async () => {
+      const res = await createCustomReport(
+        cfg.client,
+        cfg.fileboxId,
+        { name, query: cfg.query },
+        { signal: cfg.signal }
+      );
+      writeLinkResult(
+        cfg,
+        "create custom report",
+        res,
+        (r) => `Created custom report #${r.id} "${r.name}" and linked filebox ${cfg.fileboxId} to it`
+      );
+    }
+  });
+}
+function customReportApplyAction(fileboxId, reportId, query) {
+  return {
+    resource: "filebox-custom-report",
+    id: `${fileboxId}:${reportId}:${shortHash4(query)}`,
+    verb: "apply"
+  };
+}
+async function runFileboxCustomReportsApply(cfg) {
+  const { reports } = await fetchCustomReports(cfg.client, cfg.fileboxId, cfg.signal);
+  const report = reports.find((r) => r.id === cfg.reportId);
+  if (report === void 0) {
+    throw new Error(
+      `custom report ${cfg.reportId} is not on the connection of filebox ${cfg.fileboxId}; see dr filebox custom-reports list ${cfg.fileboxId}`
+    );
+  }
+  const query = typeof report.query === "string" ? report.query : "";
+  const action = customReportApplyAction(cfg.fileboxId, cfg.reportId, query);
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: `dr filebox custom-reports apply ${cfg.fileboxId} ${cfg.reportId} --server ${cfg.serverFlag}`,
+    describe: async () => [
+      ...await describeFileboxTarget(cfg.client, cfg.fileboxId, cfg.signal),
+      `report:  #${report.id} "${report.name}" (used by ${usedBy(report.usage_count)})`,
+      `sql:     ${query.length} chars, sha256 ${shortHash4(query)}`,
+      "effect:  links this filebox to the report, replacing the filebox's query with the report's"
+    ],
+    execute: async () => {
+      const res = await applyCustomReport(cfg.client, cfg.fileboxId, cfg.reportId, {
+        signal: cfg.signal
+      });
+      writeLinkResult(
+        cfg,
+        "apply custom report",
+        res,
+        (r) => `Linked filebox ${cfg.fileboxId} to custom report #${r.id} "${r.name}"`
+      );
+    }
+  });
+}
+function registerFileboxCustomReportsCommands(fb) {
+  const reports = fb.command("custom-reports").description(
+    "SuiteQL custom reports of a filebox's NetSuite connection: named queries its fileboxes share"
+  );
+  const listCmd = reports.command("list").description(
+    "List the custom reports of the filebox's NetSuite connection, with how many fileboxes use each"
+  ).argument("<filebox_id>", "filebox id (positive integer)").option("--json", "Output the raw response as JSON (decoded)", false).action(async (idStr, opts) => {
+    const fileboxId = parsePositiveIntArg(idStr, "<filebox_id>");
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runFileboxCustomReportsList({
+        client: setup.client,
+        fileboxId,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(listCmd);
+  addAccountFlag(listCmd);
+  const createCmd = reports.command("create").description(
+    "Create a custom report on the filebox's NetSuite connection and link the filebox to it, replacing its query (two-step confirmation). The filebox's data query must already be SuiteQL. 409 means the name is taken."
+  ).argument("<filebox_id>", "filebox id (positive integer)").requiredOption("--name <name>", "Report name, unique on the connection (required)").requiredOption("--query-file <path>", "File holding the SuiteQL query (required)").option(
+    "--confirm-token <token>",
+    "Token from a prior plan run - required to actually create",
+    ""
+  ).option("--json", "Output the raw response as JSON (decoded)", false).action(
+    async (idStr, opts) => {
+      const fileboxId = parsePositiveIntArg(idStr, "<filebox_id>");
+      if (opts.name.trim() === "") {
+        throw new Error("--name is required");
+      }
+      const query = await readCustomReportQueryFile(opts.queryFile);
+      await preflightConfirmToken(
+        customReportCreateAction(fileboxId, opts.name, query),
+        opts.confirmToken
+      );
+      const serverKey = resolveServer(opts.server);
+      const setup = await setupCall(opts.server, opts.account);
+      try {
+        await runFileboxCustomReportsCreate({
+          client: setup.client,
+          fileboxId,
+          name: opts.name,
+          query,
+          token: opts.confirmToken,
+          serverFlag: serverKey,
+          queryFile: opts.queryFile,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(createCmd);
+  addAccountFlag(createCmd);
+  const applyCmd = reports.command("apply").description(
+    "Link the filebox to an existing custom report of its connection, replacing its query with the report's (two-step confirmation)"
+  ).argument("<filebox_id>", "filebox id (positive integer)").argument("<report_id>", "custom report id (from custom-reports list)").option(
+    "--confirm-token <token>",
+    "Token from a prior plan run - required to actually apply",
+    ""
+  ).option("--json", "Output the raw response as JSON (decoded)", false).action(
+    async (idStr, reportIdStr, opts) => {
+      const fileboxId = parsePositiveIntArg(idStr, "<filebox_id>");
+      const reportId = parsePositiveIntArg(reportIdStr, "<report_id>");
+      const serverKey = resolveServer(opts.server);
+      const setup = await setupCall(opts.server, opts.account);
+      try {
+        await runFileboxCustomReportsApply({
+          client: setup.client,
+          fileboxId,
+          reportId,
+          token: opts.confirmToken,
+          serverFlag: serverKey,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(applyCmd);
+  addAccountFlag(applyCmd);
+}
+
 // src/api/forecast.ts
 var SCENARIO_PARAM = "Forecast";
 async function listScenarios(client, filter = {}, options) {
@@ -36804,6 +37393,11 @@ var DQ_WAIT_POLL_INTERVAL_MS = 5e3;
 var DQ_WAIT_POLL_MAX_INTERVAL_MS = 3e4;
 var DQ_WAIT_DEFAULT_TIMEOUT_SEC = 1800;
 var DQ_WAIT_TIMEOUT_MAX_SEC = 86400;
+var SYNC_EVENT_ACTION = "integration_query_status_changed";
+var EMPTY_SYNC_EVENT_PREFIX = "Sync completed successfully, but no new data was retrieved due to an empty response";
+var SYNC_EVENT_LIMIT = 50;
+var SYNC_EVENT_MAX_PAGES = 10;
+var DATE_HEADER_RESOLUTION_MS = 1e3;
 var DQ_WAIT_SETUP_OVERHEAD_MS = 6e4;
 function dataQuerySyncCallTimeoutMs(wait, timeoutSec) {
   if (!wait) return void 0;
@@ -36838,7 +37432,7 @@ function maxId(rows) {
 function ref(v) {
   return { id: v.id, version: v.version };
 }
-function buildDataQuerySyncBaseline(periods, versions, dataQueryRaw) {
+function buildDataQuerySyncBaseline(periods, versions, dataQueryRaw, eventsRaw = null) {
   const dataQuery = asRecord(dataQueryRaw);
   return {
     periods: periods.map((p) => {
@@ -36849,7 +37443,8 @@ function buildDataQuerySyncBaseline(periods, versions, dataQueryRaw) {
       };
     }),
     maxVersionId: maxId(versions),
-    updateTime: stamp(dataQuery["update_time"])
+    updateTime: stamp(dataQuery["update_time"]),
+    emptyEventIds: Array.isArray(eventsRaw) ? new Set(emptySyncEvents(eventsRaw).map((e) => e.id)) : null
   };
 }
 function classifyDataQuerySyncProgress(periods, baseline, versions, dataQueryRaw) {
@@ -36882,11 +37477,12 @@ function classifyDataQuerySyncProgress(periods, baseline, versions, dataQueryRaw
 }
 async function captureDataQuerySyncBaseline(client, fileboxId, periods, signal, preRead) {
   try {
-    const [versions, dataQuery] = await Promise.all([
+    const [versions, dataQuery, events] = await Promise.all([
       listVersions(client, fileboxId, {}, { signal }),
-      preRead !== void 0 ? Promise.resolve(preRead.raw) : getDataQueryRaw(client, fileboxId, { signal })
+      preRead !== void 0 ? Promise.resolve(preRead.raw) : getDataQueryRaw(client, fileboxId, { signal }),
+      readSyncEvents(client, fileboxId, signal)
     ]);
-    return buildDataQuerySyncBaseline(periods, versions, dataQuery);
+    return buildDataQuerySyncBaseline(periods, versions, dataQuery, events);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(
@@ -36894,6 +37490,61 @@ async function captureDataQuerySyncBaseline(client, fileboxId, periods, signal,
     );
   }
 }
+function emptySyncEvents(eventsRaw) {
+  const out = [];
+  for (const raw of eventsRaw) {
+    const e = asRecord(raw);
+    const id = e["_id"];
+    const text2 = e["text"];
+    if (typeof id !== "string" || id === "" || typeof text2 !== "string") continue;
+    const decoded = decodeShape(text2);
+    if (!decoded.startsWith(EMPTY_SYNC_EVENT_PREFIX)) continue;
+    const at = decoded.lastIndexOf(" for ");
+    const label = at >= 0 && decoded.endsWith(".") ? decoded.slice(at + " for ".length, -1) : void 0;
+    const datetime = typeof e["datetime"] === "number" ? e["datetime"] : void 0;
+    out.push({ id, datetime, label });
+  }
+  return out;
+}
+function findEmptyPeriods(periods, baseline, progress, eventsRaw, sinceMs) {
+  const empty = /* @__PURE__ */ new Set();
+  const known = baseline.emptyEventIds;
+  if (known === null || sinceMs === void 0 || !Array.isArray(eventsRaw)) return empty;
+  if (progress.error !== void 0 || progress.unmatchedNewVersions.length > 0) return empty;
+  const fresh = emptySyncEvents(eventsRaw).filter(
+    (e) => !known.has(e.id) && e.datetime !== void 0 && e.datetime >= sinceMs
+  );
+  periods.forEach((p, i) => {
+    if (progress.periods[i]?.result !== "pending") return;
+    const matches = fresh.some(
+      (e) => p.eventLabel === void 0 ? periods.length === 1 : e.label === p.eventLabel || e.label === void 0 && periods.length === 1
+    );
+    if (matches) empty.add(i);
+  });
+  return empty;
+}
+async function readSyncEvents(client, fileboxId, signal, sinceMs) {
+  const events = [];
+  try {
+    for (let page = 0; page < SYNC_EVENT_MAX_PAGES; page++) {
+      const rows = await listDocumentEvents(
+        client,
+        fileboxId,
+        SYNC_EVENT_ACTION,
+        { skip: page * SYNC_EVENT_LIMIT, limit: SYNC_EVENT_LIMIT },
+        { signal }
+      );
+      if (!Array.isArray(rows)) return null;
+      events.push(...rows);
+      if (sinceMs === void 0 || rows.length < SYNC_EVENT_LIMIT) break;
+      const oldest = asRecord(rows[rows.length - 1])["datetime"];
+      if (typeof oldest !== "number" || oldest < sinceMs) break;
+    }
+  } catch {
+    return null;
+  }
+  return events;
+}
 var defaultSleep6 = (ms, signal) => new Promise((resolve3, reject) => {
   if (signal?.aborted) {
     reject(signal.reason ?? new Error("aborted"));
@@ -36923,15 +37574,42 @@ async function waitForDataQuerySync(cfg) {
 `
     );
   }
+  const sinceMs = cfg.triggerServerTimeMs === void 0 ? void 0 : cfg.triggerServerTimeMs - DATE_HEADER_RESOLUTION_MS;
+  let warnedEvents = false;
+  const warnEvents = (why) => {
+    if (warnedEvents) return;
+    warnedEvents = true;
+    cfg.errOut.write(
+      `warning: ${why} \u2014 a period whose sync returns no rows cannot be confirmed and will time out
+`
+    );
+  };
+  if (sinceMs === void 0) warnEvents("the sync response carried no Date header");
+  if (cfg.baseline.emptyEventIds === null) warnEvents("the filebox's sync events are unreadable");
+  const settledEmpty = /* @__PURE__ */ new Set();
   let progress;
   let outcome;
   for (; ; ) {
     try {
-      const [versions, dataQuery] = await Promise.all([
+      const [versions, dataQuery, events] = await Promise.all([
         listVersions(cfg.client, cfg.fileboxId, {}, { signal: cfg.signal }),
-        getDataQueryRaw(cfg.client, cfg.fileboxId, { signal: cfg.signal })
+        getDataQueryRaw(cfg.client, cfg.fileboxId, { signal: cfg.signal }),
+        readSyncEvents(cfg.client, cfg.fileboxId, cfg.signal, sinceMs)
       ]);
-      progress = classifyDataQuerySyncProgress(cfg.periods, cfg.baseline, versions, dataQuery);
+      if (events === null) warnEvents("the filebox's sync events are unreadable");
+      else if (emptySyncEvents(events).some((e) => e.datetime === void 0)) {
+        warnEvents("a sync event carries no numeric timestamp");
+      }
+      const polled = classifyDataQuerySyncProgress(cfg.periods, cfg.baseline, versions, dataQuery);
+      for (const i of findEmptyPeriods(cfg.periods, cfg.baseline, polled, events, sinceMs)) {
+        settledEmpty.add(i);
+      }
+      progress = {
+        ...polled,
+        periods: polled.periods.map(
+          (p, i) => p.result === "pending" && settledEmpty.has(i) ? { period: p.period, result: "empty" } : p
+        )
+      };
     } catch (err) {
       if (cfg.signal.aborted) {
         outcome = "cancelled";
@@ -36992,6 +37670,7 @@ function renderSummary2(cfg, progress, outcome, waitedSec) {
   const count = (r) => progress.periods.filter((p) => p.result === r).length;
   const parts = [`${count("new_version")} new version${plural(count("new_version"))}`];
   parts.push(`${count("no_change")} unchanged`);
+  if (count("empty") > 0) parts.push(`${count("empty")} empty`);
   if (count("pending") > 0) parts.push(`${count("pending")} unfinished`);
   const headline = {
     completed: "Sync finished",
@@ -37012,6 +37691,11 @@ function renderSummary2(cfg, progress, outcome, waitedSec) {
     } else if (p.result === "no_change") {
       cfg.out.write(
         `  ${p.period}: unchanged \u2014 identical to version #${p.version.id} (v${p.version.version}), so no new version was written
+`
+      );
+    } else if (p.result === "empty") {
+      cfg.out.write(
+        `  ${p.period}: empty \u2014 the server logged an empty response for this period, so nothing was written
 `
       );
     } else if (outcome === "timed_out") {
@@ -37991,7 +38675,7 @@ function buildIncludeBatchAction(docId, include, targets) {
   const canonical = `${docId}|${include ? "on" : "off"}|${targets.map((v) => v.id).slice().sort((a, b) => a - b).join(",")}`;
   return {
     resource: "filebox-version-batch",
-    id: createHash9("sha256").update(canonical).digest("hex").slice(0, 12),
+    id: createHash10("sha256").update(canonical).digest("hex").slice(0, 12),
     verb: includeStateWords(include).verb
   };
 }
@@ -39338,23 +40022,30 @@ function resolveDateForSubType(subType, parsed2) {
   const { year, month0, day } = parsed2;
   switch ((subType ?? "").toLowerCase()) {
     case "year":
-      return { value: utcDateToNoonEpoch(year, 0, 1), label: String(year) };
+      return {
+        value: utcDateToNoonEpoch(year, 0, 1),
+        label: String(year),
+        eventLabel: String(year)
+      };
     case "quarter": {
       const q = Math.floor(month0 / 3) + 1;
       return {
         value: utcDateToNoonEpoch(year, (q - 1) * 3, 1),
-        label: `Q${q} ${year}`
+        label: `Q${q} ${year}`,
+        eventLabel: `Q${q} ${year}`
       };
     }
     case "month":
       return {
         value: utcDateToNoonEpoch(year, month0, 1),
-        label: `${MONTH_NAMES[month0] ?? ""} ${year}`
+        label: `${MONTH_NAMES[month0] ?? ""} ${year}`,
+        eventLabel: `${MONTH_NAMES[month0] ?? ""} ${year}`
       };
     case "day":
       return {
         value: utcDateToNoonEpoch(year, month0, day),
-        label: `${MONTH_NAMES_SHORT[month0] ?? ""} ${day}, ${year}`
+        label: `${MONTH_NAMES_SHORT[month0] ?? ""} ${day}, ${year}`,
+        eventLabel: `${String(month0 + 1).padStart(2, "0")}/${String(day).padStart(2, "0")}/${year}`
       };
     case "week": {
       const date = new Date(Date.UTC(year, month0, day));
@@ -39365,7 +40056,8 @@ function resolveDateForSubType(subType, parsed2) {
       return {
         // Noon-UTC convention, same as the other branches.
         value: Math.floor(monday.getTime() / 1e3) + 12 * 60 * 60,
-        label: `Week ${week} ${isoYear}`
+        label: `Week ${week} ${isoYear}`,
+        eventLabel: `W${String(week).padStart(2, "0")} ${isoYear}`
       };
     }
     default:
@@ -39418,8 +40110,8 @@ async function runFileboxDataQuerySync(cfg) {
     ].map((t) => dateTags.map((tag) => resolveDateForSubType(tagSubType(tag), t).value));
     for (const parsed2 of parsedDates) {
       const resolved = dateTags.map((tag) => {
-        const { value, label: label2 } = resolveDateForSubType(tagSubType(tag), parsed2);
-        return { id: tag.id, name: tag.name, value, label: label2 };
+        const { value, label: label2, eventLabel } = resolveDateForSubType(tagSubType(tag), parsed2);
+        return { id: tag.id, name: tag.name, value, label: label2, eventLabel };
       });
       dateTargets.push(
         JSON.stringify(resolved.map(({ id, name, value }) => ({ id, name, value })))
@@ -39430,6 +40122,8 @@ async function runFileboxDataQuerySync(cfg) {
       periodLabels.push(label);
       waitPeriods.push({
         label,
+        // The server joins a version's DATE labels in tag-id order.
+        eventLabel: [...resolved].sort((a, b) => a.id - b.id).map((r) => r.eventLabel).join(", "),
         tags: dateTags.map((tag, i) => ({
           id: tag.id,
           inPeriod: (stored) => samePeriodAs(tagSubType(tag), stored, resolved[i].value)
@@ -39470,9 +40164,17 @@ async function runFileboxDataQuerySync(cfg) {
   if (multipleTags.length > 0) {
     body["multiple_tags"] = multipleTags;
   }
-  const resp = await syncDataQuery(cfg.client, cfg.id, body, {
-    signal: cfg.signal
-  });
+  let resp;
+  let triggerServerTimeMs;
+  if (cfg.wait === void 0) {
+    resp = await syncDataQuery(cfg.client, cfg.id, body, { signal: cfg.signal });
+  } else {
+    const timed = await syncDataQueryTimed(cfg.client, cfg.id, body, {
+      signal: cfg.signal
+    });
+    resp = timed.body;
+    triggerServerTimeMs = timed.serverTimeMs;
+  }
   let detail = "OK";
   if (typeof resp["details"] === "string" && resp["details"] !== "") {
     detail = resp["details"];
@@ -39500,6 +40202,7 @@ async function runFileboxDataQuerySync(cfg) {
   await waitForDataQuerySync({
     client: cfg.client,
     fileboxId: cfg.id,
+    triggerServerTimeMs,
     periods: waitPeriods,
     baseline,
     timeoutSec: cfg.wait.timeoutSec,
@@ -40814,7 +41517,7 @@ function registerFileboxCommand(root) {
     []
   ).option(
     "--wait",
-    "After queueing, wait until every --date period has finished, and say whether each wrote a new version or was unchanged (identical output writes no version). Exits non-zero on a failed sync or a timeout. Not combinable with --tag.",
+    "After queueing, wait until every --date period has finished, and say whether each wrote a new version, was unchanged (identical output writes no version), or was empty (the server logged an empty response for that period). Exits non-zero on a failed sync or a timeout. Not combinable with --tag.",
     false
   ).option(
     "--timeout <seconds>",
@@ -40850,6 +41553,7 @@ function registerFileboxCommand(root) {
   registerFileboxAdminCommands(fb, setupCall, addServerFlag, addAccountFlag);
   registerFileboxKindCommands(fb);
   registerFileboxRescanVersionCommand(fb);
+  registerFileboxCustomReportsCommands(fb);
 }
 
 // src/commands/integrations.ts
@@ -41055,7 +41759,7 @@ function parseDataSourceIntegration(raw) {
   return i;
 }
 async function runIntegrationsTypes(cfg) {
-  const items = await listTypes(cfg.client, cfg.search, {
+  const items = await listTypes2(cfg.client, cfg.search, {
     signal: cfg.signal
   });
   if (cfg.asJson) {
@@ -41669,6 +42373,172 @@ Finish it with: dr integrations sftp provision ${id} (plus the same --date-*/--b
 `);
   writeSftpKit(cfg.out, kit);
 }
+var NETSUITE_CALL_TIMEOUT_MS = 12e4;
+function netsuiteStampAction(id) {
+  return { resource: "netsuite-bundle-version", id: String(id), verb: "stamp" };
+}
+function describeNetSuiteFailure(what, id, res) {
+  return describeRawFailure(what, res, {
+    404: `found no NetSuite connection ${id} visible to this account`
+  });
+}
+var SAVED_SEARCH_ID_RE = /^(?:-?[0-9]+|customsearch[A-Za-z0-9_]*)$/;
+function parseSavedSearchId(raw) {
+  const id = raw.trim();
+  if (id === "") {
+    throw new Error("--saved-search is required");
+  }
+  if (id.length > 64 || !SAVED_SEARCH_ID_RE.test(id)) {
+    throw new Error(
+      `invalid --saved-search "${id}" (expected a numeric internal id, optionally negative, or a customsearch* script id)`
+    );
+  }
+  return id;
+}
+async function writeSqlFile(path12, sql) {
+  const existing = await lstat(path12).catch((err) => {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  });
+  if (existing !== void 0 && !existing.isFile()) {
+    throw new Error(
+      existing.isSymbolicLink() ? "it is a symlink" : "it exists and is not a regular file"
+    );
+  }
+  const flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | (fsConstants.O_NOFOLLOW ?? 0);
+  const handle = await open2(path12, flags, 384);
+  try {
+    const st = await handle.stat();
+    if (!st.isFile() || st.nlink !== 1) throw new Error("it is hard-linked or not a regular file");
+    if (existing !== void 0 && (st.ino !== existing.ino || st.dev !== existing.dev)) {
+      throw new Error("it changed while being opened");
+    }
+    await handle.chmod(384);
+    await handle.truncate(0);
+    await handle.writeFile(sql);
+  } finally {
+    await handle.close();
+  }
+}
+async function probeNetSuiteReadiness(cfg) {
+  const res = await netsuiteBundleReadiness(cfg.client, cfg.id, cfg.dryRun, {
+    signal: cfg.signal
+  });
+  if (!isSuccess(res.status)) {
+    throw new Error(describeNetSuiteFailure("bundle readiness", cfg.id, res));
+  }
+  const body = decodeShape(res.body);
+  if (body === null || typeof body !== "object" || typeof body.outcome !== "string") {
+    throw new Error(
+      `bundle readiness: unexpected ${res.status} response: ${truncate3(res.rawText.trim(), 300)}`
+    );
+  }
+  const detail = typeof body.detail === "string" ? body.detail : "";
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, body);
+  } else {
+    const version = typeof body.bundle_version === "number" ? String(body.bundle_version) : "none";
+    cfg.out.write(`NetSuite bundle readiness for integration ${cfg.id}: ${body.outcome}
+`);
+    cfg.out.write(`  Detail:          ${orDash2(detail)}
+`);
+    cfg.out.write(`  Bundle version:  ${version}
+`);
+    if (body.dry_run === true) {
+      cfg.out.write("  Dry run:         nothing was stamped\n");
+    }
+  }
+  if (!cfg.dryRun && body.outcome !== "CONFIRMED") {
+    throw new Error(
+      `readiness probe did not confirm (${body.outcome}): ${orDash2(detail)}; nothing was stamped`
+    );
+  }
+}
+async function runIntegrationsNetSuiteReadiness(cfg) {
+  if (cfg.id <= 0) {
+    throw new Error("integration id must be positive");
+  }
+  if (cfg.dryRun) {
+    if (!isPlanPhase(cfg.token)) {
+      throw new Error("--confirm-token does not apply to --dry-run, which writes nothing");
+    }
+    await probeNetSuiteReadiness(cfg);
+    return;
+  }
+  const action = netsuiteStampAction(cfg.id);
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: `dr integrations netsuite readiness ${cfg.id} --server ${cfg.serverFlag}`,
+    describe: async () => {
+      const i = decodeShape(
+        await getById2(cfg.client, cfg.id, { signal: cfg.signal })
+      );
+      return [
+        `name: "${i.name}"`,
+        `type: ${integrationTypeName(i)}`,
+        `org:  ${orDash2(i.organization_name)} (id=${i.organization})`,
+        "probe:  one live SuiteQL call that checks the bundle role and permissions",
+        "effect: on CONFIRMED, stamps bundle_version 3 (the 3.0 bundle) on the connection config",
+        "preview without writing: re-run with --dry-run"
+      ];
+    },
+    execute: () => probeNetSuiteReadiness(cfg)
+  });
+}
+async function runIntegrationsNetSuiteSavedSearchSql(cfg) {
+  if (cfg.id <= 0) {
+    throw new Error("integration id must be positive");
+  }
+  const savedSearchId = parseSavedSearchId(cfg.savedSearchId);
+  const res = await netsuiteSavedSearchSql(cfg.client, cfg.id, savedSearchId, {
+    signal: cfg.signal
+  });
+  if (!isSuccess(res.status)) {
+    throw new Error(describeNetSuiteFailure("saved-search SQL", cfg.id, res));
+  }
+  const body = decodeShape(res.body);
+  if (body === null || typeof body !== "object" || typeof body.sql !== "string") {
+    throw new Error(
+      `saved-search SQL: unexpected ${res.status} response: ${truncate3(res.rawText.trim(), 300)}`
+    );
+  }
+  const sql = body.sql;
+  const outPath = cfg.outPath !== void 0 && cfg.outPath !== "" ? cfg.outPath : void 0;
+  let writeError;
+  if (outPath !== void 0) {
+    try {
+      await writeSqlFile(outPath, sql);
+    } catch (err) {
+      writeError = err instanceof Error ? err.message : String(err);
+    }
+  }
+  const written = outPath !== void 0 && writeError === void 0;
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, body);
+  } else {
+    const name = typeof body.saved_search_name === "string" && body.saved_search_name !== "" ? body.saved_search_name : "(not listed by the bundle)";
+    const key = typeof body.source_query_key === "string" ? body.source_query_key : "";
+    cfg.out.write(`Saved search ${savedSearchId}: ${name}
+`);
+    cfg.out.write(`  Library match:  ${key || "none \u2014 custom report"}
+`);
+    if (written) {
+      cfg.out.write(`  SQL:            written to ${outPath} (${sql.length} chars)
+`);
+    } else {
+      cfg.out.write("  SQL:\n");
+      cfg.out.write(sql.endsWith("\n") ? sql : `${sql}
+`);
+    }
+  }
+  if (writeError !== void 0) {
+    throw new Error(`could not write --out ${outPath}: ${writeError} (the SQL is printed above)`);
+  }
+}
 async function runIntegrationsITList(cfg) {
   if (cfg.page < 1) {
     throw new Error("--page must be >= 1");
@@ -42257,6 +43127,80 @@ function registerIntegrationsCommand(root) {
   addAccountFlag(shareGroupsCmd);
   registerITCommands(integrations);
   registerSftpCommands(integrations);
+  registerNetSuiteCommands(integrations);
+}
+function registerNetSuiteCommands(parent) {
+  const netsuite = parent.command("netsuite").description("NetSuite 3.0 -> SuiteQL in-place migration helpers");
+  const readinessCmd = netsuite.command("readiness").description(
+    'Probe whether a NetSuite 3.0 connection is ready for SuiteQL (one live SuiteQL call). On CONFIRMED it stamps bundle_version 3 on the connection (two-step confirmation); --dry-run probes without writing. Any other outcome stamps nothing and, without --dry-run, exits non-zero. 409 (refused) causes, from the server: "Connection is SuiteQL-native or has no NetSuite 3.0 filebox", "connection account id is not a valid NetSuite account id"; missing credentials are the NOT_CONNECTED outcome, not a 409.'
+  ).argument("<integration_id>", "NetSuite connection (data integration) id").option("--dry-run", "Probe only: never stamp the connection, no confirmation needed", false).option(
+    "--confirm-token <token>",
+    "Token from a prior plan run - required to actually stamp",
+    ""
+  ).option("--json", "Output the raw response as JSON", false).action(
+    async (idStr, opts) => {
+      const id = parseIntegrationIdArg(idStr);
+      const dryRun = opts.dryRun === true;
+      if (dryRun && !isPlanPhase(opts.confirmToken)) {
+        throw new Error("--confirm-token does not apply to --dry-run, which writes nothing");
+      }
+      if (!dryRun) {
+        await preflightConfirmToken(netsuiteStampAction(id), opts.confirmToken);
+      }
+      const serverKey = resolveServer(opts.server);
+      await withSetup(
+        opts.server,
+        opts.account,
+        async ({ client, signal }) => {
+          await runIntegrationsNetSuiteReadiness({
+            client,
+            id,
+            dryRun,
+            token: opts.confirmToken,
+            serverFlag: serverKey,
+            asJson: opts.json === true,
+            signal,
+            out: process.stdout
+          });
+        },
+        NETSUITE_CALL_TIMEOUT_MS
+      );
+    }
+  );
+  addServerFlag(readinessCmd);
+  addAccountFlag(readinessCmd);
+  const savedSearchSqlCmd = netsuite.command("saved-search-sql").description(
+    `Show a saved search's SQL as translated by the connection's 3.0 bundle, its name, and the SuiteQL library entry it matches (none: create a custom report instead). Read-only. 409 (refused) causes, from the server: "Connection is SuiteQL-native or has no NetSuite 3.0 filebox", "connection account id is not a valid NetSuite account id", "connection has no credentials: <fields>". 502: the bundle call failed, or the SQL is over 100,000 characters.`
+  ).argument("<integration_id>", "NetSuite connection (data integration) id").requiredOption(
+    "--saved-search <id>",
+    "NetSuite saved search id: a numeric internal id (negative for standard searches) or a customsearch* script id (required)"
+  ).option(
+    "--out <path>",
+    "Also write the decoded SQL to this file, owner-only (0600); a regular file is overwritten, a symlink or hard-linked file is refused. If the write fails the SQL is printed and the command exits non-zero (e.g. for filebox custom-reports create --query-file)"
+  ).option("--json", "Output the raw response as JSON", false).action(
+    async (idStr, opts) => {
+      const id = parseIntegrationIdArg(idStr);
+      parseSavedSearchId(opts.savedSearch);
+      await withSetup(
+        opts.server,
+        opts.account,
+        async ({ client, signal }) => {
+          await runIntegrationsNetSuiteSavedSearchSql({
+            client,
+            id,
+            savedSearchId: opts.savedSearch,
+            outPath: opts.out,
+            asJson: opts.json === true,
+            signal,
+            out: process.stdout
+          });
+        },
+        NETSUITE_CALL_TIMEOUT_MS
+      );
+    }
+  );
+  addServerFlag(savedSearchSqlCmd);
+  addAccountFlag(savedSearchSqlCmd);
 }
 function registerSftpCommands(parent) {
   const sftp = parent.command("sftp").description("Self-serve SFTP fileboxes (the embedded SFTP integration)");
@@ -42899,7 +43843,7 @@ function registerDevFetch(connectors) {
 
 // src/commands/connectorsPoll.ts
 import * as readline2 from "readline";
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 
 // src/types/connectors.ts
 var POLL_ITEM_STATES = [
@@ -43195,6 +44139,9 @@ async function ask(cfg, message, choices, defaultChoice) {
 }
 var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
 var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
+function pollSetConfirmVerb(widen, onPolicyChange) {
+  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+}
 async function runPollSet(cfg) {
   if (Object.keys(cfg.changes).length === 0) {
     throw new Error(
@@ -43251,7 +44198,12 @@ async function runPollSet(cfg) {
   cfg.deadline?.pause();
   await twoStepConfirm({
     out: cfg.out,
-    action: pollConfirmAction(cfg.filebox, "set-land-or-seed", cfg.scope, { ...body }),
+    action: pollConfirmAction(
+      cfg.filebox,
+      pollSetConfirmVerb(body.widen, body.on_policy_change),
+      cfg.scope,
+      { ...body }
+    ),
     token: cfg.token,
     server: cfg.scope.serverKey,
     confirmCmd: `dr connectors poll set ${cfg.filebox}${cfg.settingsArgs}${flags}${cfg.targetArgs}`,
@@ -43269,7 +44221,7 @@ function confirmDigest(scope, payload) {
     controlPlane: scope.controlPlane,
     payload: Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a.localeCompare(b)))
   });
-  return createHash10("sha256").update(canonical).digest("hex").slice(0, 12);
+  return createHash11("sha256").update(canonical).digest("hex").slice(0, 12);
 }
 function pollConfirmAction(filebox, verb, scope, payload = {}) {
   return {
@@ -43602,8 +44554,21 @@ function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.
     askOnce();
   });
 }
+var POLL_CONFIRM_HELP = [
+  "Confirmation:",
+  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
+  "  re-run the printed command, token included, to apply it.",
+  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
+  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
+  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
+  "  resume --source land) also asks a person to type a word in a dialog on production,",
+  "  even when the same set also seeds (--on-policy-change seed --widen land)."
+].join("\n");
 function registerConnectorsPoll(connectors) {
-  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version");
+  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
+${POLL_CONFIRM_HELP}`);
   const enableCmd = addSettingsFlags(
     poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
   ).action(async (filebox, opts) => {
@@ -43629,14 +44594,15 @@ function registerConnectorsPoll(connectors) {
     ).option(
       "--widen <seed|land>",
       "a wider window: seed (mark exposed items landed) or land them"
-    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land")
+    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
   ).action(
     async (filebox, opts) => {
       const changes = parseSettings(opts);
       const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
       const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
       await preflightConfirmToken(
-        pollConfirmAction(filebox, "set-land-or-seed", scopeOf(opts), {
+        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
           ...changes,
           ...widen !== void 0 ? { widen } : {},
           ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
@@ -43811,14 +44777,17 @@ function registerConnectorsPoll(connectors) {
   });
   addCommonFlags(skipCmd, "Output the item as JSON");
   const seedCmd = addConfirmTokenFlag(
-    poll2.command("seed").description("Mark items modified at or before --until as already landed (cut-over)").argument("<filebox>", "filebox id or uuid").requiredOption(
+    poll2.command("seed").description(
+      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
+    ).argument("<filebox>", "filebox id or uuid").requiredOption(
       "--until <timestamp>",
       "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
     ).option(
       "--dry-run",
       "count the already-discovered items it would mark, without changing anything",
       false
-    )
+    ).addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
   ).action(
     async (filebox, opts) => {
       const until = parseTimestampFlag(opts.until, "--until");
@@ -46256,7 +47225,7 @@ function registerWidgetsCommand(root) {
 }
 
 // src/commands/reconciliation.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { promises as fs18 } from "fs";
 
 // src/api/reconciliation.ts
@@ -46785,7 +47754,7 @@ function wireReconciliationProcesses(parent) {
 }
 
 // src/commands/reconciliation_evidences.ts
-import { readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
 import { basename as basename6 } from "path";
 
 // src/commands/_processResolver.ts
@@ -46912,7 +47881,7 @@ async function runReconciliationEvidencesCreate(cfg) {
   }
   let buf;
   try {
-    buf = await readFile5(cfg.filePath);
+    buf = await readFile6(cfg.filePath);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
     throw new Error(`read --file: ${m}`);
@@ -47837,7 +48806,7 @@ function chunkByJsonBytes(rows, maxBytes) {
   return chunks;
 }
 function settingsActionId(settings) {
-  return createHash11("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 12);
+  return createHash12("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsUpdateSettings(cfg) {
   const action = {
@@ -48215,7 +49184,7 @@ async function runReconciliationAccountsSetAssignee(cfg) {
 var ASSIGNEE_BATCH_CHUNK_SIZE = 100;
 function assigneeBatchActionId(date, rows) {
   const canonical = rows.map((r) => [r.accountId, r.type, r.userId, r.userName, r.userEmail]);
-  return createHash11("sha256").update(JSON.stringify([date, canonical])).digest("hex").slice(0, 12);
+  return createHash12("sha256").update(JSON.stringify([date, canonical])).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsSetAssigneeBatch(cfg) {
   const action = {
@@ -48369,7 +49338,7 @@ verify the date matches the accounts' reporting period (try \`dr reconciliation
 }
 function clearBatchActionId(date, rows) {
   const canonical = rows.map((r) => [r.accountId, r.type]);
-  return createHash11("sha256").update(JSON.stringify(["clear", date, canonical])).digest("hex").slice(0, 12);
+  return createHash12("sha256").update(JSON.stringify(["clear", date, canonical])).digest("hex").slice(0, 12);
 }
 async function runReconciliationAccountsClearAssigneeBatch(cfg) {
   const action = {
@@ -49692,7 +50661,7 @@ function applyProse(data4, overlay, warn2 = () => {
 }
 
 // src/commands/_validateReportRender.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { join as join13 } from "path";
 var MARKER = "<!--__DATA_BLOCK__-->";
 function renderReportHtml(data4, templateHtml) {
@@ -49707,7 +50676,7 @@ function reportTemplatePath() {
   return join13(findSkillDir("dr-validate"), "report-template.html");
 }
 async function readReportTemplate() {
-  return readFile6(reportTemplatePath(), "utf8");
+  return readFile7(reportTemplatePath(), "utf8");
 }
 
 // src/commands/validate.ts
@@ -50259,7 +51228,7 @@ function renderForError(v) {
 }
 
 // src/commands/mecWorkflow.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 
 // src/api/workflow.ts
 function buildQueryString(params) {
@@ -52351,13 +53320,13 @@ async function runMecAccountsTaskStatuses(cfg) {
   }
   renderMecAccountsTasksOrStatuses(cfg.out, resp, "statuses");
 }
-function shortHash4(input) {
-  return createHash12("sha256").update(input).digest("hex").slice(0, 12);
+function shortHash5(input) {
+  return createHash13("sha256").update(input).digest("hex").slice(0, 12);
 }
 async function runMecWorkflowCreate(cfg) {
   const action = {
     resource: "mec-workflow-template",
-    id: shortHash4(JSON.stringify(cfg.payload)),
+    id: shortHash5(JSON.stringify(cfg.payload)),
     verb: "create"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -53004,7 +53973,7 @@ async function runMecTaskDelete(cfg) {
   const sortedIds = [...cfg.ids].map((r) => r.id).sort((a, b) => a - b);
   const action = {
     resource: "mec-workflow-task-batch",
-    id: `${cfg.stepId}:${shortHash4(sortedIds.join(","))}`,
+    id: `${cfg.stepId}:${shortHash5(sortedIds.join(","))}`,
     verb: "bulk-delete"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -53167,7 +54136,7 @@ async function runMecTaskSignOff(cfg) {
   const sortedIds = [...cfg.ids].sort((a, b) => a - b);
   const action = {
     resource: "mec-workflow-task",
-    id: `${cfg.stepId}:${shortHash4(sortedIds.join(","))}`,
+    id: `${cfg.stepId}:${shortHash5(sortedIds.join(","))}`,
     verb: cfg.isSignOff ? "sign-off" : "reopen"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -53366,7 +54335,7 @@ async function runMecMemberGrantBulk(cfg) {
   const hashInput = cfg.payload.emails.join(",") + "|" + cfg.payload.entities_ids.join(",") + "|" + cfg.payload.role;
   const action = {
     resource: "mec-workflow-member-grant",
-    id: shortHash4(hashInput),
+    id: shortHash5(hashInput),
     verb: "bulk"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -53522,7 +54491,7 @@ async function runMecGroupGrantBulk(cfg) {
   const hashInput = cfg.payload.permission_groups.join(",") + "|" + cfg.payload.entities_ids.join(",") + "|" + cfg.payload.role;
   const action = {
     resource: "mec-workflow-group-grant",
-    id: shortHash4(hashInput),
+    id: shortHash5(hashInput),
     verb: "bulk"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -54736,7 +55705,7 @@ function wireMec(program) {
 }
 
 // src/commands/workflow.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 function dash6(s) {
   if (s === null || s === void 0) return "-";
   if (typeof s === "number") return String(s);
@@ -55204,13 +56173,13 @@ function renderGroupList(out, rows) {
 (${rows.length} group${plural(rows.length)})
 `);
 }
-function shortHash5(input) {
-  return createHash13("sha256").update(input).digest("hex").slice(0, 12);
+function shortHash6(input) {
+  return createHash14("sha256").update(input).digest("hex").slice(0, 12);
 }
 async function runWorkflowCreate(cfg) {
   const action = {
     resource: "workflow-template",
-    id: shortHash5(JSON.stringify(cfg.payload)),
+    id: shortHash6(JSON.stringify(cfg.payload)),
     verb: "create"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -55852,7 +56821,7 @@ async function runTaskDelete(cfg) {
   const sortedIds = [...cfg.ids].map((r) => r.id).sort((a, b) => a - b);
   const action = {
     resource: "workflow-task-batch",
-    id: `${cfg.stepId}:${shortHash5(sortedIds.join(","))}`,
+    id: `${cfg.stepId}:${shortHash6(sortedIds.join(","))}`,
     verb: "bulk-delete"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -56015,7 +56984,7 @@ async function runTaskSignOff(cfg) {
   const sortedIds = [...cfg.ids].sort((a, b) => a - b);
   const action = {
     resource: "workflow-task",
-    id: `${cfg.stepId}:${shortHash5(sortedIds.join(","))}`,
+    id: `${cfg.stepId}:${shortHash6(sortedIds.join(","))}`,
     verb: cfg.isSignOff ? "sign-off" : "reopen"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -56212,7 +57181,7 @@ async function runMemberGrantBulk(cfg) {
   const hashInput = cfg.payload.emails.join(",") + "|" + cfg.payload.entities_ids.join(",") + "|" + cfg.payload.role;
   const action = {
     resource: "workflow-member-grant",
-    id: shortHash5(hashInput),
+    id: shortHash6(hashInput),
     verb: "bulk"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -56368,7 +57337,7 @@ async function runGroupGrantBulk(cfg) {
   const hashInput = cfg.payload.permission_groups.join(",") + "|" + cfg.payload.entities_ids.join(",") + "|" + cfg.payload.role;
   const action = {
     resource: "workflow-group-grant",
-    id: shortHash5(hashInput),
+    id: shortHash6(hashInput),
     verb: "bulk"
   };
   await preflightConfirmToken(action, cfg.token);
@@ -57364,7 +58333,7 @@ function wireWorkflow(root) {
 }
 
 // src/commands/cash.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { promises as fs25 } from "fs";
 
 // src/api/cash.ts
@@ -58455,7 +59424,7 @@ async function runCashRulesDeleteAll(cfg) {
     return;
   }
   const ids = targets.map((r) => r.id).sort((a, b) => a - b);
-  const sha = createHash14("sha256").update(ids.join(",")).digest("hex").slice(0, 12);
+  const sha = createHash15("sha256").update(ids.join(",")).digest("hex").slice(0, 12);
   const action = {
     resource: "cash-rules-batch",
     id: `${templateId}:${sha}`,
@@ -68173,7 +69142,7 @@ function parseDueDate(raw) {
   }
   return trimmed;
 }
-async function readTicketDescription(inline, file, readFile8 = (p) => fs31.readFile(p, "utf8")) {
+async function readTicketDescription(inline, file, readFile9 = (p) => fs31.readFile(p, "utf8")) {
   if (inline !== void 0 && file !== void 0) {
     throw new Error("pass --description or --description-file, not both.");
   }
@@ -68181,7 +69150,7 @@ async function readTicketDescription(inline, file, readFile8 = (p) => fs31.readF
     if (file.trim() === "") throw new Error("--description-file needs a path.");
     let body;
     try {
-      body = await readFile8(file);
+      body = await readFile9(file);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(`--description-file ${file}: ${msg}`);
@@ -69880,7 +70849,7 @@ function commandPath(actionCommand) {
 // src/telemetry/config.ts
 import { homedir as homedir6 } from "os";
 import { join as join16 } from "path";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 var TELEMETRY_ENV = "DR_CLI_TELEMETRY";
 var DISABLED_VALUES = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
 function isTelemetryEnabled(env = process.env) {
@@ -69918,7 +70887,7 @@ function remoteSettingsPath() {
 async function readCollectorConfig(path12 = remoteSettingsPath()) {
   let raw;
   try {
-    raw = await readFile7(path12, "utf8");
+    raw = await readFile8(path12, "utf8");
   } catch {
     return null;
   }