@datarails-ai/dr-cli 1.6.131 → 1.6.132

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.131",
+  version: "1.6.132",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-14T12:32:00.887Z";
+var BUILD_TIME = "2026-10-14T19:31:40.601Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -3895,7 +3895,27 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   "org-export|delete",
   // connectors poll item skip (dr connectors poll skip). The item is never landed,
   // but `dr connectors poll retry` queues it again, so the token alone is enough.
-  "connector-poll-item|skip"
+  "connector-poll-item|skip",
+  // connectors poll seeding (dr connectors poll seed, and a `poll set` whose answers seed
+  // and land nothing: `--on-policy-change seed`, with or without `--widen seed`). DR-55448.
+  // A seed marks items already in the source as seen, so a cut-over does not land them a
+  // second time beside the versions the old feed (Workato) already landed. It lands
+  // nothing, deletes nothing and touches no version in the filebox. It is a routine step of
+  // every cut-over (bind, seed --until <cut-over>, enable, pause the old feed), run once per
+  // filebox, often by an agent over hundreds of fileboxes, and the word dialog stalled every
+  // one of them. The token still binds the filebox, server, account, control-plane URL and
+  // the exact --until / settings, and the control-plane audits each call
+  // (`poll.seed` / `poll.put`: user, org, query).
+  // Judged, not free: a seeded item is not undone by `poll retry` (that covers failed,
+  // waiting and skipped items), so a cutoff set too late leaves files unlanded until a
+  // Tier-A land path (`set --on-policy-change land`, `resume --source land`) or an upload
+  // brings them in. Accepted because those files stay in the source and nothing in the
+  // filebox changes; the plan shows the filebox and the cutoff before the token is
+  // redeemed, and a separate `seed --dry-run` counts the already-discovered items it would
+  // mark (the plan does not). If a seed ever lands, deletes or rewrites a version,
+  // these keys move back to Tier A.
+  "connector-poll|seed",
+  "connector-poll|set-seed"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -4031,13 +4051,13 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // deletes whole organizations via the org-delete chord. The single most
   // destructive verb in the CLI; the word gate stays on prod unconditionally.
   "org-import|delete-orgs",
-  // connectors polled ingestion (dr connectors poll seed / set / resume --source land).
-  // A seed marks items landed so they never land; `set` is gated (as `set-land-or-seed`)
-  // only when it lands a wider window or seeds / lands on a change-policy switch;
-  // `resume --source land` lands everything a changed source holds. Versions landed in
-  // a customer filebox, or files hidden from it, cannot be taken back from the CLI.
-  "connector-poll|seed",
-  "connector-poll|set-land-or-seed",
+  // connectors polled ingestion writes that LAND files (dr connectors poll set / resume
+  // --source land). `set-land` is a `poll set` with any answer that lands: a wider window
+  // with `--widen land`, or `--on-policy-change land` (a seed alongside a land is still
+  // `set-land`). `resume --source land` lands everything a changed source holds. Versions
+  // landed in a customer filebox cannot be taken back from the CLI. Seeding is Tier B
+  // (`connector-poll|seed` / `|set-seed`, DR-55448).
+  "connector-poll|set-land",
   "connector-poll|resume-land"
 ]);
 function classifyTier(action) {
@@ -44119,6 +44139,9 @@ async function ask(cfg, message, choices, defaultChoice) {
 }
 var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
 var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
+function pollSetConfirmVerb(widen, onPolicyChange) {
+  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+}
 async function runPollSet(cfg) {
   if (Object.keys(cfg.changes).length === 0) {
     throw new Error(
@@ -44175,7 +44198,12 @@ async function runPollSet(cfg) {
   cfg.deadline?.pause();
   await twoStepConfirm({
     out: cfg.out,
-    action: pollConfirmAction(cfg.filebox, "set-land-or-seed", cfg.scope, { ...body }),
+    action: pollConfirmAction(
+      cfg.filebox,
+      pollSetConfirmVerb(body.widen, body.on_policy_change),
+      cfg.scope,
+      { ...body }
+    ),
     token: cfg.token,
     server: cfg.scope.serverKey,
     confirmCmd: `dr connectors poll set ${cfg.filebox}${cfg.settingsArgs}${flags}${cfg.targetArgs}`,
@@ -44526,8 +44554,21 @@ function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.
     askOnce();
   });
 }
+var POLL_CONFIRM_HELP = [
+  "Confirmation:",
+  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
+  "  re-run the printed command, token included, to apply it.",
+  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
+  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
+  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
+  "  resume --source land) also asks a person to type a word in a dialog on production,",
+  "  even when the same set also seeds (--on-policy-change seed --widen land)."
+].join("\n");
 function registerConnectorsPoll(connectors) {
-  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version");
+  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
+${POLL_CONFIRM_HELP}`);
   const enableCmd = addSettingsFlags(
     poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
   ).action(async (filebox, opts) => {
@@ -44553,14 +44594,15 @@ function registerConnectorsPoll(connectors) {
     ).option(
       "--widen <seed|land>",
       "a wider window: seed (mark exposed items landed) or land them"
-    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land")
+    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
   ).action(
     async (filebox, opts) => {
       const changes = parseSettings(opts);
       const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
       const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
       await preflightConfirmToken(
-        pollConfirmAction(filebox, "set-land-or-seed", scopeOf(opts), {
+        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
           ...changes,
           ...widen !== void 0 ? { widen } : {},
           ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
@@ -44735,14 +44777,17 @@ function registerConnectorsPoll(connectors) {
   });
   addCommonFlags(skipCmd, "Output the item as JSON");
   const seedCmd = addConfirmTokenFlag(
-    poll2.command("seed").description("Mark items modified at or before --until as already landed (cut-over)").argument("<filebox>", "filebox id or uuid").requiredOption(
+    poll2.command("seed").description(
+      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
+    ).argument("<filebox>", "filebox id or uuid").requiredOption(
       "--until <timestamp>",
       "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
     ).option(
       "--dry-run",
       "count the already-discovered items it would mark, without changing anything",
       false
-    )
+    ).addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
   ).action(
     async (filebox, opts) => {
       const until = parseTimestampFlag(opts.until, "--until");

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.131",
+  "cliVersion": "1.6.132",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.131",
+  "version": "1.6.132",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {