@datarails-ai/dr-cli 1.6.142 → 1.6.144

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.142",
+  version: "1.6.144",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.15",
+    "@datarails-ai/dr-appspace-cli": "0.12.16",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-19T11:06:59.748Z";
+var BUILD_TIME = "2026-10-19T13:42:21.282Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -25214,7 +25214,7 @@ async function runMetricSuggestionsProfile(cfg) {
     );
   }
   const windowsByField = /* @__PURE__ */ new Map();
-  const collect = (plan, res) => {
+  const collect2 = (plan, res) => {
     if (res === void 0) return;
     for (const f of plan.sampleFields) {
       const key = `${plan.table.id}:${f.id}`;
@@ -25230,7 +25230,7 @@ async function runMetricSuggestionsProfile(cfg) {
     const r = firsts[i];
     if (r !== void 0 && r.ok) {
       rowCounts.set(p.table.id, r.value.totalRows);
-      collect(p, r.value);
+      collect2(p, r.value);
     } else {
       rowCounts.set(p.table.id, null);
       sampleErrors.set(p.table.id, r === void 0 ? "no result recorded" : errText(r.error));
@@ -25239,7 +25239,7 @@ async function runMetricSuggestionsProfile(cfg) {
   for (let i = 0; i < pending.length; i += 1) {
     const item = pending[i];
     const r = extras[i];
-    if (r !== void 0 && r.ok) collect(plans[item.planIndex], r.value);
+    if (r !== void 0 && r.ok) collect2(plans[item.planIndex], r.value);
   }
   const dateValues = /* @__PURE__ */ new Map();
   for (let i = 0; i < dateTargets.length; i += 1) {
@@ -33156,16 +33156,16 @@ function findArityViolations(entries) {
   for (const entry of entries) {
     if (typeof entry.formula !== "string") continue;
     const calls = findFunctionCalls(entry.formula);
-    for (const call of calls) {
-      const upper = call.name.toUpperCase();
+    for (const call2 of calls) {
+      const upper = call2.name.toUpperCase();
       const arity = KNOWN_FUNCTION_ARITIES[upper];
       if (arity === void 0) continue;
-      if (call.argCount >= arity.min && call.argCount <= arity.max) continue;
+      if (call2.argCount >= arity.min && call2.argCount <= arity.max) continue;
       const expected = arity.min === arity.max ? `exactly ${arity.min}` : `${arity.min}-${arity.max}`;
       violations.push({
         fieldName: entry.name === "" ? "(unnamed)" : entry.name,
-        functionName: call.name,
-        got: call.argCount,
+        functionName: call2.name,
+        got: call2.argCount,
         expected,
         note: arity.note
       });
@@ -45842,9 +45842,9 @@ function isNotPolled(err) {
 function isPollThrottled(err) {
   return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
 }
-async function explainNotPolled(filebox, call) {
+async function explainNotPolled(filebox, call2) {
   try {
-    return await call;
+    return await call2;
   } catch (err) {
     if (isNotPolled(err)) {
       throw new Error(
@@ -46685,6 +46685,467 @@ ${POLL_CONFIRM_HELP}`)
   addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
 }
 
+// src/commands/connectorsTasks.ts
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/api/scheduledTasks.ts
+var BASE2 = "/scheduled-tasks";
+async function call(method, path13, send, what) {
+  let out;
+  try {
+    out = await send();
+  } catch (err) {
+    throw toControlPlaneError(method, path13, err);
+  }
+  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
+  return out;
+}
+async function createTask(client, fields, reqOptions) {
+  return call(
+    "POST",
+    BASE2,
+    () => client.postJSON(BASE2, fields, reqOptions),
+    "task create"
+  );
+}
+async function listTasks(client, orgId, reqOptions) {
+  const path13 = orgId === void 0 ? BASE2 : `${BASE2}?org_id=${orgId}`;
+  return call("GET", path13, () => client.getJSON(path13, reqOptions), "task list");
+}
+async function getTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call("GET", path13, () => client.getJSON(path13, reqOptions), "task get");
+}
+async function updateTask(client, taskId, fields, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call(
+    "PATCH",
+    path13,
+    () => client.patchJSON(path13, fields, reqOptions),
+    "task update"
+  );
+}
+async function deleteTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  try {
+    await client.deleteJSON(path13, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("DELETE", path13, err);
+  }
+}
+async function runTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/run`;
+  return call(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task run"
+  );
+}
+async function pauseTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/pause`;
+  return call(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task pause"
+  );
+}
+async function resumeTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/resume`;
+  return call(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task resume"
+  );
+}
+async function listRuns(client, taskId, limit, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/runs?limit=${limit}`;
+  return call(
+    "GET",
+    path13,
+    () => client.getJSON(path13, reqOptions),
+    "task runs"
+  );
+}
+
+// src/commands/connectorsTasks.ts
+var DURATION_UNIT_SECONDS2 = { s: 1, m: 60, h: 3600, d: 86400 };
+var MIN_EVERY_SECONDS = 60;
+var MAX_EVERY_SECONDS = 2 ** 31 - 1;
+function parseEvery(raw) {
+  const m = /^(\d+)([smhd])?$/.exec(raw.trim());
+  const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS2[m[2] ?? "s"] ?? 1);
+  if (m === null)
+    throw new Error(`invalid --every "${raw}": expected a duration like 5m, 1h or 1d`);
+  if (!Number.isSafeInteger(seconds) || seconds < MIN_EVERY_SECONDS || seconds > MAX_EVERY_SECONDS) {
+    throw new Error(`invalid --every "${raw}": must be at least 1m`);
+  }
+  return seconds;
+}
+function parseCron(raw) {
+  const fields = raw.trim().split(/\s+/);
+  if (fields.length !== 5 || fields.some((f) => f === "")) {
+    throw new Error(`invalid --cron "${raw}": expected five fields, e.g. "15 * * * *"`);
+  }
+  return fields.join(" ");
+}
+var ROLE_RE = /^[a-z][a-z_]*$/;
+var DATASOURCE_ID_RE = /^[0-9]{1,18}$/;
+function parseDatasources(values) {
+  const out = {};
+  for (const raw of values) {
+    const eq = raw.indexOf("=");
+    const role = eq < 0 ? "" : raw.slice(0, eq).trim();
+    const id = eq < 0 ? "" : raw.slice(eq + 1).trim();
+    if (!ROLE_RE.test(role) || !DATASOURCE_ID_RE.test(id)) {
+      throw new Error(
+        `invalid --datasource "${raw}": expected <role>=<datasource id>, e.g. target=4242 (role: lowercase letters and _; id: digits)`
+      );
+    }
+    if (Object.hasOwn(out, role)) throw new Error(`--datasource role "${role}" given twice`);
+    out[role] = id;
+  }
+  const count = Object.keys(out).length;
+  if (count < 1 || count > 4) throw new Error("give between 1 and 4 --datasource roles");
+  return out;
+}
+function parseConfig(raw, readFile9 = readUtf8) {
+  const text2 = raw.startsWith("@") ? readFile9(raw.slice(1)) : raw;
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`invalid --config JSON: ${msg}`);
+  }
+  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2)) {
+    throw new Error("invalid --config: expected a JSON object");
+  }
+  return parsed2;
+}
+function readUtf8(p) {
+  return readFileSync3(p, "utf-8");
+}
+function collect(value, previous = []) {
+  return [...previous, value];
+}
+function parseScheduleFlags(opts) {
+  if (opts.every !== void 0 && opts.cron !== void 0) {
+    throw new Error("give --every or --cron, not both");
+  }
+  const fields = {};
+  if (opts.artifact !== void 0) fields.artifact_name = opts.artifact;
+  if (opts.flavor !== void 0) fields.runtime_flavor = opts.flavor;
+  if (opts.datasource !== void 0) fields.datasources = parseDatasources(opts.datasource);
+  if (opts.primaryRole !== void 0) fields.primary_role = opts.primaryRole;
+  if (opts.config !== void 0) fields.config = parseConfig(opts.config);
+  if (opts.every !== void 0) fields.every_seconds = parseEvery(opts.every);
+  if (opts.cron !== void 0) fields.cron = parseCron(opts.cron);
+  if (opts.tz !== void 0) fields.timezone = opts.tz;
+  if (fields.primary_role !== void 0 && fields.datasources !== void 0) {
+    if (!Object.hasOwn(fields.datasources, fields.primary_role)) {
+      throw new Error(
+        `--primary-role "${fields.primary_role}" is not one of the --datasource roles`
+      );
+    }
+  }
+  return fields;
+}
+function buildCreateFields(name, orgId, opts) {
+  const missing = [
+    ["--artifact", opts.artifact],
+    ["--flavor", opts.flavor],
+    ["--datasource", opts.datasource],
+    ["--config", opts.config]
+  ].filter(([, v]) => v === void 0).map(([flag]) => flag);
+  if (opts.every === void 0 && opts.cron === void 0) missing.push("--every or --cron");
+  if (missing.length > 0) throw new Error(`missing ${missing.join(", ")}`);
+  const fields = parseScheduleFlags(opts);
+  return {
+    org_id: orgId,
+    name,
+    artifact_name: fields.artifact_name,
+    runtime_flavor: fields.runtime_flavor,
+    datasources: fields.datasources,
+    config: fields.config,
+    ...fields.primary_role !== void 0 ? { primary_role: fields.primary_role } : {},
+    ...fields.every_seconds !== void 0 ? { every_seconds: fields.every_seconds } : {},
+    ...fields.cron !== void 0 ? { cron: fields.cron } : {},
+    ...fields.timezone !== void 0 ? { timezone: fields.timezone } : {},
+    ...opts.disabled === true ? { enabled: false } : {}
+  };
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveTaskId(client, task, signal) {
+  if (UUID_RE.test(task)) return task;
+  const tasks = await listTasks(client, void 0, { signal });
+  const match = tasks.find((t) => t.name === task);
+  if (match === void 0) {
+    throw new Error(
+      `no scheduled task named "${task}" in this org (see: dr connectors tasks list)`
+    );
+  }
+  return match.id;
+}
+function explainTaskError(err) {
+  const forbidden = err instanceof ControlPlaneError && err.status === 403 || err instanceof Error && /\bHTTP 403\b/.test(err.message);
+  if (forbidden) {
+    const message = err instanceof Error ? err.message : String(err);
+    const body = err instanceof ControlPlaneError ? err.body : (/HTTP 403[^:]*(?:\([^)]*\))?:\s*([\s\S]*)$/.exec(message)?.[1] ?? "").trim();
+    return withCause(
+      new ControlPlaneError(
+        403,
+        body,
+        `${message}
+Scheduled tasks need a support user or an org admin: log in as one (--account) \u2014 e.g. dr login-as the customer's support user.`
+      ),
+      err
+    );
+  }
+  if (!(err instanceof ControlPlaneError)) return err;
+  const detail = detailOf(err.body);
+  if (err.status === 404) {
+    const message = `scheduled task not found (${detail || err.message})`;
+    return withCause(new ControlPlaneError(404, err.body, message), err);
+  }
+  if (err.status === 409 || err.status === 422) {
+    return withCause(new ControlPlaneError(err.status, err.body, detail || err.message), err);
+  }
+  return err;
+}
+function withCause(error, cause) {
+  Object.defineProperty(error, "cause", { value: cause, enumerable: false, configurable: true });
+  return error;
+}
+function detailOf(body) {
+  try {
+    const parsed2 = JSON.parse(body);
+    const d = parsed2.detail;
+    if (typeof d === "string") return d;
+    if (Array.isArray(d)) {
+      return d.map(
+        (e) => `${Array.isArray(e.loc) ? e.loc.slice(1).join(".") : ""}: ${e.msg ?? ""}`.trim()
+      ).join("; ");
+    }
+  } catch {
+  }
+  return body;
+}
+function scheduleText(t) {
+  if (t.schedule_kind === "cron") return `cron "${t.cron ?? ""}" ${t.timezone}`;
+  const s = t.every_seconds ?? 0;
+  const unit = s % 86400 === 0 ? `${s / 86400}d` : s % 3600 === 0 ? `${s / 3600}h` : s % 60 === 0 ? `${s / 60}m` : `${s}s`;
+  return `every ${unit}`;
+}
+function stateText(t) {
+  if (!t.enabled) return "disabled";
+  if (t.paused_reason !== null) return `paused (${t.paused_reason})`;
+  return t.running ? "running" : "enabled";
+}
+function writeTask(out, t) {
+  const roles = Object.entries(t.datasources).map(([role, id]) => `${role}=${id}${role === t.primary_role ? " (primary)" : ""}`).join(", ");
+  out.write(`Task:        ${t.name}  (${t.id})
+`);
+  out.write(`  Org:       ${t.org_id}
+`);
+  out.write(`  State:     ${stateText(t)}
+`);
+  out.write(`  Artifact:  ${t.artifact_name}  [${t.runtime_flavor}]
+`);
+  out.write(`  Schedule:  ${scheduleText(t)}
+`);
+  out.write(`  Next run:  ${t.next_run_at}
+`);
+  out.write(`  Last run:  ${t.last_run_at ?? "-"}  ${t.last_run_status ?? ""}
+`);
+  if (t.consecutive_failures > 0) out.write(`  Failures:  ${t.consecutive_failures} in a row
+`);
+  out.write(`  Datasources: ${roles}
+`);
+  out.write(`  Config:    ${truncate3(JSON.stringify(t.config), 200)}
+`);
+}
+function writeTaskList(out, tasks) {
+  if (tasks.length === 0) {
+    out.write("No scheduled tasks.\n");
+    return;
+  }
+  for (const t of tasks) {
+    out.write(
+      `${t.name.padEnd(28)} ${stateText(t).padEnd(20)} ${scheduleText(t).padEnd(26)} next ${t.next_run_at}  last ${t.last_run_status ?? "-"}  ${t.id}
+`
+    );
+  }
+}
+function writeRuns(out, runs) {
+  if (runs.length === 0) {
+    out.write("No runs yet.\n");
+    return;
+  }
+  for (const r of runs) {
+    const tail = r.error !== null ? `  error: ${truncate3(r.error, 160)}` : r.summary !== null ? `  ${truncate3(JSON.stringify(r.summary), 160)}` : "";
+    out.write(
+      `${r.started_at}  ${r.status.padEnd(15)} ${r.trigger.padEnd(8)} attempt ${r.attempt}  ${r.artifact_version ?? "-"}${tail}
+`
+    );
+  }
+}
+function withFlags(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false);
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  addConnectorsUrlFlag(cmd);
+  return cmd;
+}
+function addScheduleFlags(cmd) {
+  return cmd.option("--artifact <name>", "published artifact name, e.g. sftp_export__daily_sales").option("--flavor <flavor>", "runner flavor the artifact was published for, e.g. sftp").option("--datasource <role=id>", "monolith datasource for a role (repeat per role)", collect).option(
+    "--primary-role <role>",
+    "the role passed as the primary datasource (default: the first)"
+  ).option("--config <json|@file>", "task config: a JSON object, or @path to a JSON file").option("--every <duration>", "run on an interval, e.g. 5m, 1h (at least 1m)").option("--cron <expr>", 'run on a five-field cron line, e.g. "15 * * * *"').option("--tz <iana>", "timezone the cron line is read in (default UTC)");
+}
+async function onTask(task, opts, act, print) {
+  await withConnectorsSetup(opts, async ({ client, signal }) => {
+    try {
+      const taskId = await resolveTaskId(client, task, signal);
+      const result = await act(client, taskId, signal);
+      if (opts.json === true) writeJSONIndented(process.stdout, result);
+      else print(process.stdout, result);
+    } catch (err) {
+      throw explainTaskError(err);
+    }
+  });
+}
+function registerConnectorsTasks(connectors) {
+  const tasks = connectors.command("tasks").description("DRIP scheduled tasks: run an artifact on a schedule (support user or org admin)");
+  withFlags(
+    addScheduleFlags(
+      tasks.command("create").description("Create a scheduled task").argument("<name>", "task name, unique in the org (a-z, 0-9, _ and -)").option("--org-id <id>", "org id (defaults to the JWT org)").option("--disabled", "create it disabled", false)
+    )
+  ).action(
+    async (name, opts) => {
+      const explicitOrg = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      const parsed2 = buildCreateFields(name, explicitOrg ?? 0, opts);
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        const fields = { ...parsed2, org_id: explicitOrg ?? client.getCurrentOrgId() };
+        try {
+          const t = await createTask(client, fields, { signal });
+          if (opts.json === true) writeJSONIndented(process.stdout, t);
+          else writeTask(process.stdout, t);
+        } catch (err) {
+          throw explainTaskError(err);
+        }
+      });
+    }
+  );
+  withFlags(
+    tasks.command("list").description("List the org's scheduled tasks").option("--org-id <id>", "org id (defaults to the JWT org)")
+  ).action(async (opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      try {
+        const list28 = await listTasks(client, orgId, { signal });
+        if (opts.json === true) writeJSONIndented(process.stdout, list28);
+        else writeTaskList(process.stdout, list28);
+      } catch (err) {
+        throw explainTaskError(err);
+      }
+    });
+  });
+  withFlags(
+    tasks.command("get").description("Show a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => getTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    addScheduleFlags(
+      tasks.command("update").description("Change a scheduled task (only the flags given change)").argument("<task>", "task id or name").option("--enable", "enable the task").option("--disable", "disable the task")
+    )
+  ).action(
+    async (task, opts) => {
+      if (opts.enable === true && opts.disable === true)
+        throw new Error("give --enable or --disable, not both");
+      const fields = parseScheduleFlags(opts);
+      if (opts.enable === true) fields.enabled = true;
+      if (opts.disable === true) fields.enabled = false;
+      if (Object.keys(fields).length === 0)
+        throw new Error("nothing to change: give at least one flag");
+      await onTask(
+        task,
+        opts,
+        (c, id, signal) => updateTask(c, id, fields, { signal }),
+        (o, r) => writeTask(o, r)
+      );
+    }
+  );
+  withFlags(
+    tasks.command("delete").description("Delete a scheduled task and its run history").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      async (c, id, signal) => {
+        await deleteTask(c, id, { signal });
+        return { deleted: id };
+      },
+      (o, r) => o.write(`Deleted scheduled task ${r.deleted}
+`)
+    )
+  );
+  withFlags(
+    tasks.command("run").description("Run a task now (does not move its schedule)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => runTask(c, id, { signal }),
+      (o, r) => {
+        const run = r;
+        o.write(`Queued run ${run.id} (${run.status}); see: dr connectors tasks runs ${task}
+`);
+      }
+    )
+  );
+  withFlags(
+    tasks.command("pause").description("Pause a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => pauseTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    tasks.command("resume").description("Resume a paused task (clears its failure count, schedules the next run)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => resumeTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    tasks.command("runs").description("A task's run history, newest first").argument("<task>", "task id or name").option("--limit <n>", "how many runs (1-200)", "20")
+  ).action(async (task, opts) => {
+    const limit = parsePositiveIntArg2(opts.limit, "--limit");
+    if (limit > 200) throw new Error("invalid --limit: at most 200");
+    await onTask(
+      task,
+      opts,
+      (c, id, signal) => listRuns(c, id, limit, { signal }),
+      (o, r) => writeRuns(o, r)
+    );
+  });
+}
+
 // src/commands/connectors.ts
 var CONTROL_PLANE_HOST = (subDomain) => `https://${subDomain}-connectors-control-plane.datarails.io`;
 function resolveConnectorsUrl(serverKey, connectorsUrlFlag) {
@@ -47342,6 +47803,7 @@ ${TLS_VPN_HELP}`);
   addConnectorsUrlFlag(activeGetCmd);
   registerDevFetch(connectors);
   registerConnectorsPoll(connectors);
+  registerConnectorsTasks(connectors);
 }
 
 // src/types/dashboards.ts
@@ -66382,13 +66844,13 @@ import { promises as fsPromises3 } from "fs";
 import * as nodePath3 from "path";
 
 // src/api/spendControl.ts
-var BASE2 = "/api/spend-control/v1";
+var BASE3 = "/api/spend-control/v1";
 var BASE_V2 = "/api/spend-control/v2";
 var MAX_BULK_STATUS_IDS = 50;
 var MAX_PAGE_SIZE = 100;
 async function listBillingFrequencies(client, options) {
   const out = await client.getJSON(
-    `${BASE2}/catalogs/billing-frequencies/`,
+    `${BASE3}/catalogs/billing-frequencies/`,
     options
   );
   return out ?? [];
@@ -66422,7 +66884,7 @@ function buildContractListQuery(params) {
 }
 async function listContracts(client, params = {}, options) {
   const qs = buildContractListQuery(params);
-  const path13 = qs === "" ? `${BASE2}/contracts/` : `${BASE2}/contracts/?${qs}`;
+  const path13 = qs === "" ? `${BASE3}/contracts/` : `${BASE3}/contracts/?${qs}`;
   const out = await client.getJSON(path13, options);
   if (out === null) {
     return { items: [], total: 0, page: null, size: null, pages: null };
@@ -66450,10 +66912,10 @@ async function getContract(client, contractId, params = {}, options) {
     qs.set("currency_code", params.convertTo);
   }
   const suffix = qs.toString() === "" ? "" : `?${qs.toString()}`;
-  return client.getJSON(`${BASE2}/contracts/${contractId}${suffix}`, options);
+  return client.getJSON(`${BASE3}/contracts/${contractId}${suffix}`, options);
 }
 async function deleteContract(client, contractId, options) {
-  await client.deleteJSON(`${BASE2}/contracts/${contractId}`, options);
+  await client.deleteJSON(`${BASE3}/contracts/${contractId}`, options);
 }
 async function uploadFilesWithAi(client, files, options = {}) {
   if (files.length === 0) return [];
@@ -66461,7 +66923,7 @@ async function uploadFilesWithAi(client, files, options = {}) {
     throw new Error(`uploadFilesWithAi: max 10 files per call, got ${files.length}`);
   }
   const out = await client.postMultipartFiles(
-    `${BASE2}/contracts/files-with-ai`,
+    `${BASE3}/contracts/files-with-ai`,
     { is_additional: options.isAdditional === true ? "true" : "false" },
     files,
     "files",
@@ -66471,7 +66933,7 @@ async function uploadFilesWithAi(client, files, options = {}) {
 }
 async function uploadContractFile(client, file, options = {}) {
   return client.postMultipartFiles(
-    `${BASE2}/contracts/file`,
+    `${BASE3}/contracts/file`,
     { is_additional: options.isAdditional === true ? "true" : "false" },
     [file],
     "file",
@@ -66484,7 +66946,7 @@ async function listContractFiles(client, contractId, params = {}, options) {
   if (params.size !== void 0) qs.set("size", String(params.size));
   const suffix = qs.toString() === "" ? "" : `?${qs.toString()}`;
   const out = await client.getJSON(
-    `${BASE2}/contracts/${contractId}/files${suffix}`,
+    `${BASE3}/contracts/${contractId}/files${suffix}`,
     options
   );
   if (out === null) {
@@ -66510,13 +66972,13 @@ async function listAllContractFiles(client, contractId, options) {
 }
 async function getContractFileDownload(client, fileId, options) {
   return client.postJSON(
-    `${BASE2}/contracts/files/${fileId}/download`,
+    `${BASE3}/contracts/files/${fileId}/download`,
     {},
     options
   );
 }
 async function deleteContractFile(client, fileId, options) {
-  await client.deleteJSON(`${BASE2}/contracts/files/${fileId}`, options);
+  await client.deleteJSON(`${BASE3}/contracts/files/${fileId}`, options);
 }
 async function uploadFileWithAiAsync(client, file, options = {}) {
   return client.postMultipartFiles(
@@ -66636,14 +67098,14 @@ async function bulkCreateContracts(client, body, options) {
     throw new Error(`bulkCreateContracts: max 10 contracts per call, got ${body.contracts.length}`);
   }
   const out = await client.postJSON(
-    `${BASE2}/contracts/bulk-create`,
+    `${BASE3}/contracts/bulk-create`,
     body,
     options
   );
   return out ?? { contracts: [] };
 }
 async function partialUpdateContract(client, contractId, body, options) {
-  return client.patchJSON(`${BASE2}/contracts/${contractId}`, body, options);
+  return client.patchJSON(`${BASE3}/contracts/${contractId}`, body, options);
 }
 
 // src/types/spendControl.ts
@@ -67063,7 +67525,7 @@ function chunkContracts(contracts, size = 10) {
 }
 
 // src/api/spendControlVendors.ts
-var BASE3 = "/api/spend-control/v1/vendors";
+var BASE4 = "/api/spend-control/v1/vendors";
 var MAX_PAGE_SIZE2 = 100;
 function buildVendorListQuery(params) {
   const qs = new URLSearchParams();
@@ -67094,19 +67556,19 @@ function emptyPage() {
   return { items: [], total: 0, page: null, size: null, pages: null };
 }
 async function listVendors(client, params = {}, options) {
-  const out = await client.getJSON(withQuery(`${BASE3}/`, params), options);
+  const out = await client.getJSON(withQuery(`${BASE4}/`, params), options);
   return out ?? emptyPage();
 }
 async function listAppStoreVendors(client, params = {}, options) {
   const out = await client.getJSON(
-    withQuery(`${BASE3}/app-store`, params),
+    withQuery(`${BASE4}/app-store`, params),
     options
   );
   return out ?? emptyPage();
 }
 async function listVendorsWithContracts(client, params = {}, options) {
   const out = await client.getJSON(
-    withQuery(`${BASE3}/with-contracts`, params),
+    withQuery(`${BASE4}/with-contracts`, params),
     options
   );
   return out ?? emptyPage();
@@ -67123,24 +67585,24 @@ async function listAllVendors(fetchPage, client, params = {}, options) {
   return collected;
 }
 async function listVendorCategories(client, options) {
-  const out = await client.getJSON(`${BASE3}/categories`, options);
+  const out = await client.getJSON(`${BASE4}/categories`, options);
   return out ?? [];
 }
 async function listVendorsWithMultipleContracts(client, options) {
-  const out = await client.getJSON(`${BASE3}/with-multiple-contracts`, options);
+  const out = await client.getJSON(`${BASE4}/with-multiple-contracts`, options);
   return out ?? [];
 }
 async function getVendorOwners(client, vendorId, options) {
-  return client.getJSON(`${BASE3}/${encodeURIComponent(vendorId)}/owners/`, options);
+  return client.getJSON(`${BASE4}/${encodeURIComponent(vendorId)}/owners/`, options);
 }
 async function createVendor(client, name, options) {
-  return client.postJSON(`${BASE3}/`, { name }, options);
+  return client.postJSON(`${BASE4}/`, { name }, options);
 }
 async function bulkUpdateVendorVisibility(client, vendors, options) {
   if (vendors.length === 0) {
     throw new Error("bulkUpdateVendorVisibility: at least one vendor is required");
   }
-  const out = await client.patchJSON(`${BASE3}/visibility`, { vendors }, options);
+  const out = await client.patchJSON(`${BASE4}/visibility`, { vendors }, options);
   return out ?? [];
 }
 
@@ -70369,8 +70831,8 @@ function querySuffix(domain) {
   if (domain === void 0 || domain === "") return "";
   return `?domain=${encodeURIComponent(domain)}`;
 }
-function required(out, call) {
-  if (out === null) throw new Error(`${call}: empty response body`);
+function required(out, call2) {
+  if (out === null) throw new Error(`${call2}: empty response body`);
   return out;
 }
 
@@ -72372,7 +72834,7 @@ import {
   linkSync,
   mkdirSync,
   openSync,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   unlinkSync,
   writeFileSync
 } from "fs";
@@ -72388,7 +72850,7 @@ function copySessionCredentials(mountPath = SESSION_AUTH_MOUNT, target = credent
   const temp = `${target}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
   let created = false;
   try {
-    const bytes = readFileSync3(mountPath);
+    const bytes = readFileSync4(mountPath);
     mkdirSync(dirname10(target), { recursive: true });
     const fd = openSync(temp, "wx", 384);
     created = true;

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.142",
+  "cliVersion": "1.6.144",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -2103,6 +2103,60 @@
         "until": "DR-53511"
       }
     },
+    "connectors tasks create": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks list": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks get": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks update": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks delete": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks run": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks pause": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks resume": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
+    "connectors tasks runs": {
+      "denied": {
+        "reason": "The connectors control plane runs no dr-auth-sdk guard and checks no scope, so the `integrations` ceiling this command declares would be enforced by nobody. Closed to scoped credentials until that control plane adopts the SDK.",
+        "until": "DR-53511"
+      }
+    },
     "filebox list": {
       "requires": [
         {

package/dist/skills/plugins.json

@@ -10,6 +10,7 @@
     "dr-error-enrichment-reconcile",
     "dr-filebox-api-setup",
     "drip-implement-connector",
+    "schedule-drip-task",
     "validate-workato-migration"
   ],
   "dr-cli": [

package/dist/skills/schedule-drip-task/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: schedule-drip-task
+description: Use when a customer needs files or data pushed OUT of Datarails on a schedule through DRIP (the connectors platform) - an SFTP export, "send this CSV to the customer's SFTP every hour", "push the file to their server", "schedule an export", "scheduled task", "dr connectors tasks", "sftp_export", "lib/sftp_export", or when operating an existing schedule - "is the export running", "why did the export fail", "the task is paused", "run the export now", "pause the export", "task runs", "consecutive failures", "paused (failures)", "paused (schedule)", "no active version", "newest source file is older than max_age_seconds", "the target must not be a customer org-*-sftp container", a 403 "scheduled tasks need a support user or an org admin". Not for pulling data INTO Datarails (drip-implement-connector) or for polled SFTP ingestion (dr connectors poll).
+---
+
+# Schedule a DRIP task
+
+A **scheduled task** runs a published DRIP artifact on a schedule, with the org's monolith
+datasources, and keeps a run history. The control plane only schedules; the runner runs the
+artifact's `process()`. The first task type is **SFTP Export** (`lib/sftp_export`): copy files from
+our hosted SFTP to a customer's SFTP under a name the customer wants.
+
+Commands: `dr connectors tasks create | list | get | update | delete | run | pause | resume | runs`.
+Every one takes `--server`, `--account` and `--json`; a `<task>` is its id or its name.
+
+## Identity
+
+The control plane allows these commands only to a **support user or an org admin** of the customer's
+org (`role` ADMIN, SUPER_ADMIN, SUPPORT_SUPER_ADMIN, DR_CONNECT_ADMIN, or `is_support`). Run them as
+the customer's support user: `dr login-as` it, then pass `--account <that email>`. A 403 means the
+identity is neither; an operator's own login lands in the wrong org.
+
+Like every `dr connectors` command, the control plane is reached over the VPN of the server's
+region (`fetch failed` = wrong WARP vnet).
+
+## Set up an SFTP Export
+
+1. **Source datasource**: an SFTP datasource for the folder the producer writes on **our hosted
+   SFTP** (host must be a Datarails-hosted SFTP host; any other host is refused). Create it as in
+   `drip-implement-connector` → `reference/sftp.md` §3 (host, port, username, password or key,
+   pinned `host_key`). Note its id.
+2. **Target datasource**: the same kind of SFTP datasource with the **customer's** server details.
+   Get the pinned key with `ssh-keyscan -p <port> <host>`; never trust on first use. A target on our
+   hosted SFTP whose login points at an `org-<id>-sftp` container is refused (a write there would
+   start an inbound sync).
+3. **Artifact**: a thin per-org artifact in dr-connectors over `lib/sftp_export`, published and
+   made active as in `drip-implement-connector` §2. Its name is `sftp_export__<name>`, flavor `sftp`.
+   The dataquery must set its OWN `CONNECTION` (the thin connection file's name): re-exporting the
+   lib's `CONNECTION = "base_connection"` makes the publisher look for a connection file the artifact
+   does not have, and publishing fails.
+
+```python
+# <dc>/<org>_(<domain>)/sftp_export/connections/sftp_export.py
+from lib.sftp_export.connections.base_connection import RUNTIME_FLAVOR, SftpExportConnection as CONNECTION  # noqa: F401
+
+# <dc>/<org>_(<domain>)/sftp_export/dataqueries/<name>.py
+from lib.sftp_export.dataqueries.export import OBJECT_TYPES, get_query_class  # noqa: F401
+
+CONNECTION = "sftp_export"
+```
+4. **Config**: write it to a file — the keys are in [reference/sftp-export.md](reference/sftp-export.md).
+   `objectType` must be `"export"`.
+5. **Sample first, then the real folder.** Create the task with `target_dir` set to a scratch
+   folder the customer agreed to, run it once, and get the customer's OK on the file. A disabled
+   task cannot be run, so do not create it `--disabled` for this. Then switch the config to the
+   real folder:
+
+```bash
+dr connectors tasks create <name> --artifact sftp_export__<name> --flavor sftp \
+  --datasource target=<target id> --datasource source=<source id> \
+  --config @config-sample.json --cron "15 * * * *" --tz UTC --server <SRV> --account <support email>
+dr connectors tasks run <name> ...      # one run now (refused within a minute of the last run)
+dr connectors tasks runs <name> ...     # status ok + summary.sent names the file
+# customer confirms the sample →
+dr connectors tasks update <name> --config @config.json ...
+```
+
+`target` is the primary role (the first `--datasource`, or `--primary-role`). Use `--every 1h` for
+an interval instead of a cron line; the minimum is 1m.
+
+## Operate
+
+| Want | Command |
+|---|---|
+| See all tasks and their state | `tasks list` |
+| Why did it fail | `tasks runs <task>` — each run's status and error |
+| Run now (does not move the schedule) | `tasks run <task>` |
+| Stop / restart | `tasks pause <task>` / `tasks resume <task>` |
+| Change schedule, config, datasources | `tasks update <task> --cron … / --config @f / --datasource …` |
+
+## Failures
+
+| Symptom | Meaning / fix |
+|---|---|
+| 403 support user or org admin | Wrong identity — `--account` the customer's support user |
+| State `paused (failures)` | 5 failed runs in a row. Read `runs`, fix the cause, `resume` |
+| State `paused (schedule)` | Its timing can no longer be computed. `update --cron/--every`, then `resume` |
+| Run `failed`: no active version / flavor differs | Publish and promote the artifact for that flavor |
+| Run `failed`: newest source file is older than max_age_seconds | The producer is late or stopped — check it, not the task |
+| Run `retry`: newest source file is still being written | Producer writing at run time; the run retries once after 60 s. Move the cron later |
+| Run `timed_out` | No answer within ~45 min — runner down or the job never started |
+| Host key refused / login failed | Datasource `host_key` or credentials are wrong — fix the datasource |
+| 409 on `run` | Disabled, paused, a run in flight, or it ran in the last minute |
+| 409 on `create` | Name taken, or the org already has 50 tasks |
+| 422 on `create` | Read the detail: a secret in `--config`, an unknown cron or timezone, no active artifact |

package/dist/skills/schedule-drip-task/reference/sftp-export.md

@@ -0,0 +1,44 @@
+# SFTP Export task config (`lib/sftp_export`)
+
+The task's `--config` JSON. It is validated before any login; a bad value fails the run with a
+message naming the key. Never put a password, key or token in it — credentials live only in the
+datasources (the control plane refuses secret-looking keys with a 422).
+
+| Key | Required | Default | Meaning |
+|---|---|---|---|
+| `objectType` | yes | — | Always `"export"` (selects the task in the artifact) |
+| `source_dir` | yes | — | Folder on our hosted SFTP to read. Not the login's home (`""`, `.`, `out/..`) |
+| `target_dir` | yes | — | Folder on the customer's SFTP to write. Same rule |
+| `pattern` | no | `*` | Glob on the file name. Dotfiles are skipped unless the pattern starts with `.` |
+| `select` | no | `all_new` | `newest`: the latest matching file, sent every run. `all_new`: each new or rewritten file once |
+| `target_name` | no | the source name | strftime template on the run's scheduled time, plus `{source_stem}` / `{source_ext}`. With `all_new` it must contain `{source_stem}` (else every file of a run gets one name) |
+| `target_timezone` | no | `UTC` | Zone for the `target_name` time codes. Non-UTC needs tzdata in the sftp runner image |
+| `settle_seconds` | no | 120 | Skip files modified more recently (the producer may still be writing). 0 to 7 days |
+| `max_age_seconds` | no | none | `newest` only: fail the run if the newest file is older than this before the scheduled time, or if no file matches (producer late or stopped) |
+| `max_files_per_run` | no | 50 | `all_new`: at most this many files per run (1 to 1000); the rest go next run |
+
+Behaviour worth knowing:
+
+- Upload is atomic: a random `.<name>.<hex>.part` is written, then renamed. The customer's login must
+  be allowed to create and rename files in `target_dir`. Stale parts of ours older than 2 h are swept.
+- The source is never written, moved or deleted. Cleaning it is the producer's job; with `all_new`,
+  a folder that keeps every sent file eventually fails the run with "archive or delete them".
+- A target that is the source folder (same login, same real path) is refused.
+
+## Example: an hourly snapshot to the customer, named by the hour (UTC)
+
+```json
+{
+  "objectType": "export",
+  "source_dir": "/home",
+  "pattern": "Daily_Snapshot_*.csv",
+  "select": "newest",
+  "target_dir": "/inbound",
+  "target_name": "Sales_%H%M_%m%d%Y.csv",
+  "target_timezone": "UTC",
+  "max_age_seconds": 3600
+}
+```
+
+With cron `15 * * * *`, the 13:15 run sends the newest snapshot (written no earlier than 12:15) as
+`Sales_1315_10192026.csv`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.142",
+  "version": "1.6.144",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.15",
+    "@datarails-ai/dr-appspace-cli": "0.12.16",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",