@datarails-ai/dr-cli 1.6.149 → 1.6.151

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.149",
+  version: "1.6.151",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.20",
+    "@datarails-ai/dr-appspace-cli": "0.12.21",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-20T13:20:59.293Z";
+var BUILD_TIME = "2026-10-22T09:31:33.112Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -512,6 +512,12 @@ function resolve(input) {
   return lookup(trimmed);
 }
 
+// src/auth/userAgent.ts
+var USER_AGENT = `dr-cli/${package_default.version} (${process.platform}; ${process.arch}; node/${process.versions.node})`;
+function withUserAgent(headers) {
+  return { "User-Agent": USER_AGENT, ...headers };
+}
+
 // src/auth/errors.ts
 var NotLoggedInError = class extends Error {
   code = "ERR_NOT_LOGGED_IN";
@@ -760,12 +766,12 @@ async function mintJwt(host, sessionId, csrfToken, options) {
   const base = trimTrailingSlash(host);
   const res = await fetch(`${base}/jwt/api/token/`, {
     method: "POST",
-    headers: {
+    headers: withUserAgent({
       "Content-Type": "application/json",
       Cookie: `sessionid=${sessionId}; csrftoken=${csrfToken}`,
       "X-CSRFToken": csrfToken,
       Referer: `${base}/`
-    },
+    }),
     body: "{}",
     signal: options?.signal
   });
@@ -789,10 +795,10 @@ async function refreshJwt(host, refreshToken, options) {
   const base = trimTrailingSlash(host);
   const res = await fetch(`${base}/jwt/api/token/refresh/`, {
     method: "POST",
-    headers: {
+    headers: withUserAgent({
       "Content-Type": "application/json",
       Referer: `${base}/`
-    },
+    }),
     body: JSON.stringify({ refresh: refreshToken }),
     signal: options?.signal
   });
@@ -816,7 +822,7 @@ async function refreshExternalJwt(host, refreshToken, options) {
   const base = trimTrailingSlash(host);
   const res = await fetch(`${base}/jwt/api/external/token/refresh/`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: withUserAgent({ "Content-Type": "application/json" }),
     body: JSON.stringify({ refresh: refreshToken }),
     signal: options?.signal
   });
@@ -855,7 +861,7 @@ async function exchangeApiKey(host, apiKey, options) {
   const base = trimTrailingSlash(host);
   const res = await fetch(`${base}/jwt/api/apikey/token/`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${key}`, Accept: "application/json" },
+    headers: withUserAgent({ Authorization: `Bearer ${key}`, Accept: "application/json" }),
     signal: options?.signal
   });
   const text2 = await res.text();
@@ -912,10 +918,10 @@ async function loginAs(host, operatorAccessToken, userId, options) {
   }
   const res = await fetch(`${base}/jwt/api/loginas/`, {
     method: "POST",
-    headers: {
+    headers: withUserAgent({
       "Content-Type": "application/json",
       Authorization: `Bearer ${operatorAccessToken}`
-    },
+    }),
     body: JSON.stringify(body),
     signal: options?.signal
   });
@@ -1075,7 +1081,7 @@ function exchangeForSession(store, serverKey, email, session, host, opts) {
   const deadline = AbortSignal.timeout(API_KEY_EXCHANGE_DEADLINE_MS);
   deadline.addEventListener("abort", () => controller.abort(deadline.reason), { once: true });
   const signal = controller.signal;
-  const run = (async () => {
+  const run2 = (async () => {
     if (host === "") {
       throw new SessionExpiredError(`${identity2} (no host to exchange the API key against)`);
     }
@@ -1148,20 +1154,20 @@ function exchangeForSession(store, serverKey, email, session, host, opts) {
     }
   })();
   const evict = () => {
-    if (inFlightExchanges.get(key)?.run === run) inFlightExchanges.delete(key);
+    if (inFlightExchanges.get(key)?.run === run2) inFlightExchanges.delete(key);
   };
   const entry = {
-    run,
+    run: run2,
     waiters: 0,
     abandon: () => {
-      if (inFlightExchanges.get(key)?.run !== run) return;
+      if (inFlightExchanges.get(key)?.run !== run2) return;
       evict();
       const reason = new Error(`${identity2} (api-key exchange abandoned by its last caller)`);
       reason.name = "AbortError";
       controller.abort(reason);
     }
   };
-  void run.then(evict, evict);
+  void run2.then(evict, evict);
   inFlightExchanges.set(key, entry);
   return joinExchange(entry, opts.signal);
 }
@@ -2150,6 +2156,7 @@ var AuthorizedClient = class _AuthorizedClient {
    * @internal
    */
   applyAuthHeaders(headers, hasBody, includeBearer) {
+    headers.set("User-Agent", USER_AGENT);
     if (!this.isCookieless()) {
       headers.set(
         "Cookie",
@@ -5607,11 +5614,11 @@ async function endCookieSession(base, session) {
     return res.status >= 200 && res.status < 400 ? void 0 : `HTTP ${res.status}`;
   });
 }
-async function withTimeout(run) {
+async function withTimeout(run2) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), REVOKE_TIMEOUT_MS);
   try {
-    return await run(controller.signal);
+    return await run2(controller.signal);
   } catch {
     return controller.signal.aborted ? "timed out" : "network error";
   } finally {
@@ -5652,7 +5659,7 @@ async function requestDeviceCode(host, options) {
   const body = new URLSearchParams({ client_id: CLIENT_ID, scope: paths.scope });
   const res = await fetch(`${base}${paths.code}`, {
     method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    headers: withUserAgent({ "Content-Type": "application/x-www-form-urlencoded" }),
     body: body.toString(),
     signal: options?.signal
   });
@@ -5780,7 +5787,7 @@ async function poll(host, path13, deviceCode, options, terminalHints, onSuccess)
     });
     const res = await fetch(`${base}${path13}`, {
       method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      headers: withUserAgent({ "Content-Type": "application/x-www-form-urlencoded" }),
       body: body.toString(),
       signal
     });
@@ -25922,14 +25929,14 @@ function wireDimensionSuggestions(dimensions) {
     refresh: runDimensionSuggestionsRefresh
   });
 }
-function wireSuggestionGroup(parent, r, run) {
+function wireSuggestionGroup(parent, r, run2) {
   const group = parent.command("suggestions").description(
     `AI-suggested ${r.noun}s \u2014 agent-generated; requires the ${r.flagName} Unleash flag and an org-admin user. \`profile\` is the exception: read-only table/field profiling, no flag needed`
   );
   const listCmd = group.command("list").description(`List AI ${r.noun} suggestions and the latest generation-run status (last_run)`).option("--json", "Output raw JSON instead of a table", false).action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
-      await run.list({
+      await run2.list({
         client: setup.client,
         asJson: opts.json === true,
         signal: setup.signal,
@@ -25959,7 +25966,7 @@ function wireSuggestionGroup(parent, r, run) {
         timeoutMs: suggestionsCallTimeoutMs(wait, timeoutSec)
       });
       try {
-        await run.refresh({
+        await run2.refresh({
           client: setup.client,
           asJson: opts.json === true,
           wait,
@@ -31281,16 +31288,16 @@ async function runEnrichmentTypesList(cfg) {
 function oneLine2(s, max) {
   return truncate3(s.replace(/\s+/g, " "), max);
 }
-async function runBatch(items, target, run, signal) {
+async function runBatch(items, target, run2, signal) {
   if (items.length === 1) {
     const only = items[0];
-    return [{ target: target(only, 0), ok: true, value: await run(only) }];
+    return [{ target: target(only, 0), ok: true, value: await run2(only) }];
   }
   const outcomes = [];
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
     try {
-      outcomes.push({ target: target(item, i), ok: true, value: await run(item) });
+      outcomes.push({ target: target(item, i), ok: true, value: await run2(item) });
     } catch (err) {
       outcomes.push({
         target: target(item, i),
@@ -33227,16 +33234,16 @@ function findArityViolations(entries) {
   for (const entry of entries) {
     if (typeof entry.formula !== "string") continue;
     const calls = findFunctionCalls(entry.formula);
-    for (const call2 of calls) {
-      const upper = call2.name.toUpperCase();
+    for (const call3 of calls) {
+      const upper = call3.name.toUpperCase();
       const arity = KNOWN_FUNCTION_ARITIES[upper];
       if (arity === void 0) continue;
-      if (call2.argCount >= arity.min && call2.argCount <= arity.max) continue;
+      if (call3.argCount >= arity.min && call3.argCount <= arity.max) continue;
       const expected = arity.min === arity.max ? `exactly ${arity.min}` : `${arity.min}-${arity.max}`;
       violations.push({
         fieldName: entry.name === "" ? "(unnamed)" : entry.name,
-        functionName: call2.name,
-        got: call2.argCount,
+        functionName: call3.name,
+        got: call3.argCount,
         expected,
         note: arity.note
       });
@@ -33373,13 +33380,20 @@ import { promises as fs16 } from "fs";
 import * as os3 from "os";
 import * as path7 from "path";
 var RESPONSE_BODY_MAX_BYTES = 8 * 1024;
+var MAX_NAME_SUFFIX = 99;
 async function writeErrorLog(opts) {
-  const filename = `dr-cli-error-${timestampStamp()}.md`;
+  const stamp2 = timestampStamp();
   const dir = await chooseDir(opts.dirOverride);
-  const filePath = path7.join(dir, filename);
   const md = formatLog(opts);
-  await fs16.writeFile(filePath, md, { encoding: "utf8" });
-  return filePath;
+  for (let n = 0; ; n++) {
+    const filePath = path7.join(dir, `dr-cli-error-${stamp2}${n === 0 ? "" : `-${n}`}.md`);
+    try {
+      await fs16.writeFile(filePath, md, { encoding: "utf8", mode: 384, flag: "wx" });
+      return filePath;
+    } catch (err) {
+      if (err.code !== "EEXIST" || n >= MAX_NAME_SUFFIX) throw err;
+    }
+  }
 }
 function timestampStamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
@@ -46207,557 +46221,1248 @@ function toControlPlaneError(method, path13, err) {
   );
 }
 
-// src/commands/connectorsDevFetch.ts
-import { promises as fs19 } from "fs";
-import * as path9 from "path";
-import { randomUUID as randomUUID2 } from "crypto";
-function buildDevEnvelope(i) {
-  const config = {
-    ...i.publicConfig,
-    ...i.queryConfig,
-    // Coerce absent values to null (not undefined) so JSON.stringify keeps the
-    // key — matches build_hook_job's dq.get(...) -> None; a dropped objectType
-    // becomes a cryptic KeyError in the runner's dispatch.
-    objectType: i.dataQuery.objectType ?? null,
-    type: i.dataQuery.type ?? null,
-    query: i.dataQuery.query
-  };
-  if (i.period) config.period = i.period;
-  return {
-    correlation_id: i.correlationId,
-    config,
-    secret_ref: i.secretRef,
-    cred_token: "dev-local",
-    output_sas: "file:///out/output.csv",
-    input_sas: null,
-    cursor: null,
-    contract_version: i.contractVersion,
-    metadata: {}
-  };
-}
-function asObject(v) {
-  if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-    return v;
+// src/api/awsConnections.ts
+async function call(method, path13, send, what) {
+  let out;
+  try {
+    out = await send();
+  } catch (err) {
+    throw toControlPlaneError(method, path13, err);
   }
-  return null;
+  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
+  return out;
 }
-function extractDataQueryFields(raw2) {
-  const root = asObject(decodeShape(raw2));
-  if (root === null || Object.keys(root).length === 0) {
-    throw new Error(
-      "no data-query attached to this filebox (empty data_query response) \u2014 attach one in the filebox UI first"
-    );
-  }
-  const cfg = asObject(root.config);
-  const src = cfg ?? root;
-  const query = src.query;
-  let queryObj;
-  if (query === void 0 || query === null) {
-    queryObj = {};
-  } else {
-    const asObj = asObject(query);
-    if (asObj === null) {
-      throw new Error(
-        `data-query \`query\` is not an object (got ${typeof query}) \u2014 expected the Sync-query field`
-      );
-    }
-    queryObj = asObj;
-  }
-  return { objectType: queryObj.objectType, type: src.type, query: queryObj };
+async function createAwsConnection(client, fields, reqOptions) {
+  const path13 = "/aws-connections";
+  return call(
+    "POST",
+    path13,
+    () => client.postJSON(path13, fields, reqOptions),
+    "aws connection create"
+  );
 }
-function extractCredentials(integration) {
-  const cfg = asObject(integration.config);
-  if (cfg === null || Object.keys(cfg).length === 0) {
-    throw new Error(
-      `datasource ${integration.id} has an empty/missing \`config\` \u2014 nothing to use as connector credentials`
-    );
-  }
-  return { ...cfg };
+async function listAwsConnections(client, secretRef, reqOptions) {
+  const path13 = secretRef === void 0 ? "/aws-connections" : `/aws-connections?secret_ref=${encodeURIComponent(secretRef)}`;
+  return call(
+    "GET",
+    path13,
+    () => client.getJSON(path13, reqOptions),
+    "aws connection list"
+  );
 }
-var ENV_FILE = "env.json";
-var SECRETS_FILE = "secrets.json";
-var CONNECTION_FILE = "connection.py";
-var QUERY_FILE = "query.py";
-async function writeRunDir(input) {
-  let connectionSource;
-  try {
-    connectionSource = await fs19.readFile(input.connectionPath, "utf-8");
-  } catch {
-    throw new Error(`${input.connectionPath}: connection source not found or unreadable`);
-  }
-  let querySource;
+async function getAwsConnection(client, id, reqOptions) {
+  const path13 = `/aws-connections/${id}`;
+  return call(
+    "GET",
+    path13,
+    () => client.getJSON(path13, reqOptions),
+    "aws connection get"
+  );
+}
+async function updateAwsConnection(client, id, fields, reqOptions) {
+  const path13 = `/aws-connections/${id}`;
+  return call(
+    "PATCH",
+    path13,
+    () => client.patchJSON(path13, fields, reqOptions),
+    "aws connection update"
+  );
+}
+
+// src/commands/connectorsTasks.ts
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/api/scheduledTasks.ts
+var BASE2 = "/scheduled-tasks";
+async function call2(method, path13, send, what) {
+  let out;
   try {
-    querySource = await fs19.readFile(input.queryPath, "utf-8");
-  } catch {
-    throw new Error(`${input.queryPath}: dataquery source not found or unreadable`);
+    out = await send();
+  } catch (err) {
+    throw toControlPlaneError(method, path13, err);
   }
-  await fs19.mkdir(input.outDir, { recursive: true });
-  await fs19.writeFile(
-    path9.join(input.outDir, ENV_FILE),
-    JSON.stringify(input.env, null, 2) + "\n",
-    "utf-8"
+  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
+  return out;
+}
+async function createTask(client, fields, reqOptions) {
+  return call2(
+    "POST",
+    BASE2,
+    () => client.postJSON(BASE2, fields, reqOptions),
+    "task create"
   );
-  const secretsPath = path9.join(input.outDir, SECRETS_FILE);
-  await fs19.writeFile(
-    secretsPath,
-    JSON.stringify({ [input.secretRef]: input.credentials }, null, 2) + "\n",
-    "utf-8"
+}
+async function listTasks(client, orgId, reqOptions) {
+  const path13 = orgId === void 0 ? BASE2 : `${BASE2}?org_id=${orgId}`;
+  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task list");
+}
+async function getTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task get");
+}
+async function updateTask(client, taskId, fields, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call2(
+    "PATCH",
+    path13,
+    () => client.patchJSON(path13, fields, reqOptions),
+    "task update"
   );
-  if (process.platform !== "win32") {
-    await fs19.chmod(secretsPath, 384);
-  }
-  await fs19.writeFile(path9.join(input.outDir, CONNECTION_FILE), connectionSource, "utf-8");
-  await fs19.writeFile(path9.join(input.outDir, QUERY_FILE), querySource, "utf-8");
 }
-async function ensureGitignored(entry) {
-  const gitignorePath = path9.join(process.cwd(), ".gitignore");
-  let current = "";
+async function deleteTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
   try {
-    current = await fs19.readFile(gitignorePath, "utf-8");
-  } catch {
+    await client.deleteJSON(path13, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("DELETE", path13, err);
   }
-  const normalized = entry.split("\\").join("/").replace(/\/+$/, "") + "/";
-  const lines = current.split(/\r?\n/).map((l) => l.trim());
-  if (lines.includes(normalized) || lines.includes(entry)) return;
-  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
-  await fs19.writeFile(gitignorePath, `${current}${sep}${normalized}
-`, "utf-8");
 }
-function parsePositiveInt3(raw2, label) {
-  const n = Number(raw2);
-  if (!Number.isInteger(n) || String(n) !== raw2.trim() || n <= 0) {
-    throw new Error(`invalid ${label}: "${raw2}"`);
-  }
-  return n;
+async function runTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/run`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task run"
+  );
 }
-function registerDevFetch(connectors) {
-  const cmd = connectors.command("dev-fetch").description(
-    "Assemble a local run dir (env.json + secrets.json + connection.py + query.py) for dev-run.sh"
-  ).argument("<fileboxUuid>", "filebox UUID of the connector binding").requiredOption(
-    "--datasource <id>",
-    "datasource (data-integration) id whose credentials to fetch"
-  ).requiredOption(
-    "--document-id <n>",
-    "numeric filebox document id (no uuid->id lookup exists; required)"
-  ).requiredOption("--connection <path>", "path to the connector's connection .py source").requiredOption("--query <path>", "path to the connector's dataquery .py source").option("--from <date>", "period start (paired with --to)").option("--to <date>", "period end (paired with --from)").option("-o, --output <dir>", "output run dir (default ./dev-run/<fileboxUuid>/)").action(async (fileboxUuid, opts) => {
-    const datasourceId = parsePositiveInt3(opts.datasource, "datasource id");
-    const documentId = parsePositiveInt3(opts.documentId, "document-id");
-    if (opts.from === void 0 !== (opts.to === void 0)) {
-      throw new Error("--from and --to must be provided together");
-    }
-    const defaultRoot = path9.join("dev-run", fileboxUuid);
-    const outDir = opts.output ?? defaultRoot;
-    const gitignoreEntry = opts.output ?? "dev-run";
-    const serverKey = resolveServer(opts.server);
-    const host = resolveConnectorsUrl(serverKey, opts.connectorsUrl);
-    const monolithHost = resolve(serverKey).host;
-    const cpSetup = await setupCall(opts.server, opts.account, { host, authHost: monolithHost });
-    try {
-      const binding = await getBinding(cpSetup.client, fileboxUuid, {
-        signal: cpSetup.signal
-      });
-      const monoSetup = await setupCall(opts.server, opts.account, {
-        host: monolithHost,
-        authHost: monolithHost
-      });
-      try {
-        const rawDataQuery = await getDataQueryRaw(monoSetup.client, documentId, {
-          signal: monoSetup.signal
-        });
-        const dataQuery = extractDataQueryFields(rawDataQuery);
-        if (dataQuery.objectType === void 0 || dataQuery.objectType === null || dataQuery.objectType === "") {
-          process.stderr.write(
-            'WARNING: objectType is not set inside the Sync-query (config.query.objectType). get_query_class will receive None \u2014 fine only if the connector has a single default dataset. Add it to the data-query, e.g. config.query.objectType = "<dataset>".\n'
-          );
-        }
-        const integration = await itGet(monoSetup.client, datasourceId, {
-          signal: monoSetup.signal
-        });
-        const credentials = extractCredentials(integration);
-        let period;
-        if (opts.from !== void 0 && opts.to !== void 0) {
-          period = { from: opts.from, to: opts.to };
-        }
-        const env = buildDevEnvelope({
-          correlationId: randomUUID2(),
-          secretRef: binding.secret_ref,
-          publicConfig: binding.public_config,
-          queryConfig: binding.query_config,
-          dataQuery,
-          ...period !== void 0 ? { period } : {},
-          // Deliberate sandbox stub: the fetch/dispatch path doesn't branch on
-          // contract_version, so a fixed "1" is sufficient for a local run.
-          contractVersion: "1"
-        });
-        await writeRunDir({
-          outDir,
-          env,
-          secretRef: binding.secret_ref,
-          credentials,
-          connectionPath: opts.connection,
-          queryPath: opts.query
-        });
-        await ensureGitignored(gitignoreEntry);
-        process.stdout.write(`Wrote run dir: ${outDir}
-`);
-        process.stdout.write(
-          `  env.json (secret_ref=${binding.secret_ref}, flavor=${binding.runtime_flavor})
-`
-        );
-        process.stdout.write("  secrets.json (credentials NOT shown)\n");
-        process.stdout.write("  connection.py, query.py\n");
-      } finally {
-        monoSetup.cleanup();
-      }
-    } catch (err) {
-      throw augmentTlsCertError(err);
-    } finally {
-      cpSetup.cleanup();
-    }
-  });
-  addServerFlag(cmd);
-  addAccountFlag(cmd);
-  cmd.option(
-    "--connectors-url <url>",
-    "Override the control-plane base URL (e.g. a kubectl port-forward http://localhost:8000)"
+async function pauseTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/pause`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task pause"
+  );
+}
+async function resumeTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/resume`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task resume"
+  );
+}
+async function listRuns(client, taskId, limit, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/runs?limit=${limit}`;
+  return call2(
+    "GET",
+    path13,
+    () => client.getJSON(path13, reqOptions),
+    "task runs"
   );
 }
 
-// src/commands/connectorsPoll.ts
-import * as readline2 from "readline";
-import { createHash as createHash11 } from "crypto";
-
-// src/types/connectors.ts
-var POLL_ITEM_STATES = [
-  "seen",
-  "new",
-  "dispatched",
-  "running",
-  "retry_wait",
-  "landed",
-  "failed",
-  "skipped",
-  "seeded",
-  "superseded"
-];
-
-// src/commands/connectorsPoll.ts
+// src/commands/connectorsTasks.ts
 var DURATION_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
-var DURATION_BOUNDS = {
-  "--interval": [300, 7 * 86400],
-  "--settle": [0, 86400]
-};
-var LOOKBACK_MAX_DAYS = 3650;
-function parseDurationSeconds(raw2, flag) {
+var MIN_EVERY_SECONDS = 60;
+var MAX_EVERY_SECONDS = 2 ** 31 - 1;
+function parseEvery(raw2) {
   const m = /^(\d+)([smhd])?$/.exec(raw2.trim());
   const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS[m[2] ?? "s"] ?? 1);
-  const [min, max] = DURATION_BOUNDS[flag] ?? [0, Number.MAX_SAFE_INTEGER];
-  if (m === null) {
-    throw new Error(`invalid ${flag} "${raw2}": expected a duration like 90s, 5m or 1h`);
-  }
-  if (!Number.isSafeInteger(seconds) || seconds < min || seconds > max) {
-    throw new Error(
-      `invalid ${flag} "${raw2}": must be between ${formatSeconds(min)} and ${formatSeconds(max)}`
-    );
+  if (m === null)
+    throw new Error(`invalid --every "${raw2}": expected a duration like 5m, 1h or 1d`);
+  if (!Number.isSafeInteger(seconds) || seconds < MIN_EVERY_SECONDS || seconds > MAX_EVERY_SECONDS) {
+    throw new Error(`invalid --every "${raw2}": must be at least 1m`);
   }
   return seconds;
 }
-function parseLookbackDays(raw2) {
-  const m = /^(\d+)d?$/.exec(raw2.trim());
-  const days = m === null ? 0 : Number(m[1]);
-  if (days < 1 || days > LOOKBACK_MAX_DAYS) {
-    throw new Error(
-      `invalid --lookback "${raw2}": must be between 1 and ${LOOKBACK_MAX_DAYS} days, e.g. 180d`
-    );
+function parseCron(raw2) {
+  const fields = raw2.trim().split(/\s+/);
+  if (fields.length !== 5 || fields.some((f) => f === "")) {
+    throw new Error(`invalid --cron "${raw2}": expected five fields, e.g. "15 * * * *"`);
   }
-  return days;
-}
-var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
-var DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
-function inRange(value, max, min = 0) {
-  const n = Number(value ?? "0");
-  return n >= min && n <= max;
+  return fields.join(" ");
 }
-function isCalendarDay(y, m, d) {
-  if (!inRange(m, 12, 1)) return false;
-  const daysInMonth3 = new Date(Date.UTC(Number(y), Number(m), 0)).getUTCDate();
-  return inRange(d, daysInMonth3, 1);
+var ROLE_RE = /^[a-z][a-z_]*$/;
+var DATASOURCE_ID_RE = /^[0-9]{1,18}$/;
+function parseDatasources(values) {
+  const out = {};
+  for (const raw2 of values) {
+    const eq = raw2.indexOf("=");
+    const role = eq < 0 ? "" : raw2.slice(0, eq).trim();
+    const id = eq < 0 ? "" : raw2.slice(eq + 1).trim();
+    if (!ROLE_RE.test(role) || !DATASOURCE_ID_RE.test(id)) {
+      throw new Error(
+        `invalid --datasource "${raw2}": expected <role>=<datasource id>, e.g. target=4242 (role: lowercase letters and _; id: digits)`
+      );
+    }
+    if (Object.hasOwn(out, role)) throw new Error(`--datasource role "${role}" given twice`);
+    out[role] = id;
+  }
+  const count = Object.keys(out).length;
+  if (count < 1 || count > 4) throw new Error("give between 1 and 4 --datasource roles");
+  return out;
 }
-function parseTimestampFlag(raw2, flag) {
-  const invalid = new Error(
-    `invalid ${flag} "${raw2}": expected YYYY-MM-DD or a timestamp with a zone (e.g. 2026-10-08T17:30:00+03:00)`
-  );
-  const value = raw2.trim();
-  const dateOnly = DATE_ONLY_RE.exec(value);
-  if (dateOnly !== null) {
-    if (!isCalendarDay(dateOnly[1], dateOnly[2], dateOnly[3])) throw invalid;
-    return (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString();
+function parseConfig(raw2, readFile9 = readUtf8) {
+  const text2 = raw2.startsWith("@") ? readFile9(raw2.slice(1)) : raw2;
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`invalid --config JSON: ${msg}`);
   }
-  const dt = DATE_TIME_RE.exec(value);
-  const valid = dt !== null && isCalendarDay(dt[1], dt[2], dt[3]) && inRange(dt[4], 23) && inRange(dt[5], 59) && inRange(dt[6], 59) && inRange(dt[7], 23) && inRange(dt[8], 59);
-  const ms = valid ? Date.parse(value) : NaN;
-  if (Number.isNaN(ms)) throw invalid;
-  return new Date(ms).toISOString();
+  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2)) {
+    throw new Error("invalid --config: expected a JSON object");
+  }
+  return parsed2;
 }
-function parseSameName(raw2) {
-  if (raw2 === "new-version") return "new_version";
-  if (raw2 === "ignore") return "ignore";
-  throw new Error(`--same-name must be new-version or ignore (got "${raw2}")`);
+function readUtf8(p) {
+  return readFileSync3(p, "utf-8");
 }
-function parseChoice(raw2, flag, choices) {
-  const match = choices.find((c) => c === raw2);
-  if (match === void 0) {
-    throw new Error(`${flag} must be ${choices.join(" or ")} (got "${raw2}")`);
-  }
-  return match;
+function collect(value, previous = []) {
+  return [...previous, value];
 }
-var WIDEN_CHOICES = ["seed", "land"];
-var POLICY_CHOICES = ["rekey", "seed", "land"];
-function parseSettings(opts) {
-  const fields = {};
-  if (opts.interval !== void 0) {
-    fields.interval_seconds = parseDurationSeconds(opts.interval, "--interval");
+function parseScheduleFlags(opts) {
+  if (opts.every !== void 0 && opts.cron !== void 0) {
+    throw new Error("give --every or --cron, not both");
   }
-  if (opts.since !== void 0) fields.since = parseTimestampFlag(opts.since, "--since");
-  if (opts.lookback !== void 0) fields.lookback_days = parseLookbackDays(opts.lookback);
-  if (opts.settle !== void 0) {
-    fields.settle_seconds = parseDurationSeconds(opts.settle, "--settle");
+  const fields = {};
+  if (opts.artifact !== void 0) fields.artifact_name = opts.artifact;
+  if (opts.flavor !== void 0) fields.runtime_flavor = opts.flavor;
+  if (opts.datasource !== void 0) fields.datasources = parseDatasources(opts.datasource);
+  if (opts.primaryRole !== void 0) fields.primary_role = opts.primaryRole;
+  if (opts.config !== void 0) fields.config = parseConfig(opts.config);
+  if (opts.every !== void 0) fields.every_seconds = parseEvery(opts.every);
+  if (opts.cron !== void 0) fields.cron = parseCron(opts.cron);
+  if (opts.tz !== void 0) fields.timezone = opts.tz;
+  if (fields.primary_role !== void 0 && fields.datasources !== void 0) {
+    if (!Object.hasOwn(fields.datasources, fields.primary_role)) {
+      throw new Error(
+        `--primary-role "${fields.primary_role}" is not one of the --datasource roles`
+      );
+    }
   }
-  if (opts.sameName !== void 0) fields.change_policy = parseSameName(opts.sameName);
   return fields;
 }
-function settingsArgs(opts) {
-  const pairs = [
-    ["--interval", opts.interval],
-    ["--since", opts.since],
-    ["--lookback", opts.lookback],
-    ["--settle", opts.settle],
-    ["--same-name", opts.sameName]
-  ];
-  return pairs.filter((p) => p[1] !== void 0).map(([flag, value]) => ` ${flag} ${value.trim()}`).join("");
+function buildCreateFields(name, orgId, opts) {
+  const missing = [
+    ["--artifact", opts.artifact],
+    ["--flavor", opts.flavor],
+    ["--datasource", opts.datasource],
+    ["--config", opts.config]
+  ].filter(([, v]) => v === void 0).map(([flag]) => flag);
+  if (opts.every === void 0 && opts.cron === void 0) missing.push("--every or --cron");
+  if (missing.length > 0) throw new Error(`missing ${missing.join(", ")}`);
+  const fields = parseScheduleFlags(opts);
+  return {
+    org_id: orgId,
+    name,
+    artifact_name: fields.artifact_name,
+    runtime_flavor: fields.runtime_flavor,
+    datasources: fields.datasources,
+    config: fields.config,
+    ...fields.primary_role !== void 0 ? { primary_role: fields.primary_role } : {},
+    ...fields.every_seconds !== void 0 ? { every_seconds: fields.every_seconds } : {},
+    ...fields.cron !== void 0 ? { cron: fields.cron } : {},
+    ...fields.timezone !== void 0 ? { timezone: fields.timezone } : {},
+    ...opts.disabled === true ? { enabled: false } : {}
+  };
 }
-async function resolvePollBinding(client, filebox, signal) {
-  const wanted = filebox.trim();
-  const byId = /^\d+$/.test(wanted);
-  const rows = await listQueries(client, { signal });
-  const matches = rows.filter(
-    (q) => byId ? q.filebox_id === Number(wanted) : q.filebox_uuid.toLowerCase() === wanted.toLowerCase()
-  );
-  const [first] = matches;
-  if (first === void 0) {
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveTaskId(client, task, signal) {
+  if (UUID_RE.test(task)) return task;
+  const tasks = await listTasks(client, void 0, { signal });
+  const match = tasks.find((t) => t.name === task);
+  if (match === void 0) {
     throw new Error(
-      `no connector binding for filebox ${wanted} in this org (see dr connectors query list)`
+      `no scheduled task named "${task}" in this org (see: dr connectors tasks list)`
     );
   }
-  if (matches.length > 1) {
-    const ids = matches.map((q) => `#${q.query_id}`).join(", ");
-    throw new Error(`filebox ${wanted} has several connector bindings (${ids})`);
-  }
-  return first;
+  return match.id;
 }
-function isNotPolled(err) {
-  return err instanceof ControlPlaneError && err.status === 404 && err.body.includes("not polled");
+function explainTaskError(err) {
+  const forbidden = err instanceof ControlPlaneError && err.status === 403 || err instanceof Error && /\bHTTP 403\b/.test(err.message);
+  if (forbidden) {
+    const message = err instanceof Error ? err.message : String(err);
+    const body = err instanceof ControlPlaneError ? err.body : (/HTTP 403[^:]*(?:\([^)]*\))?:\s*([\s\S]*)$/.exec(message)?.[1] ?? "").trim();
+    return withCause(
+      new ControlPlaneError(
+        403,
+        body,
+        `${message}
+Scheduled tasks need a support user or an org admin: log in as one (--account) \u2014 e.g. dr login-as the customer's support user.`
+      ),
+      err
+    );
+  }
+  if (!(err instanceof ControlPlaneError)) return err;
+  const detail = detailOf(err.body);
+  if (err.status === 404) {
+    const message = `scheduled task not found (${detail || err.message})`;
+    return withCause(new ControlPlaneError(404, err.body, message), err);
+  }
+  if (err.status === 409 || err.status === 422) {
+    return withCause(new ControlPlaneError(err.status, err.body, detail || err.message), err);
+  }
+  return err;
 }
-function isPollThrottled(err) {
-  return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
+function withCause(error, cause) {
+  Object.defineProperty(error, "cause", { value: cause, enumerable: false, configurable: true });
+  return error;
 }
-async function explainNotPolled(filebox, call2) {
+function detailOf(body) {
   try {
-    return await call2;
-  } catch (err) {
-    if (isNotPolled(err)) {
-      throw new Error(
-        `filebox ${filebox} is not set to polled ingestion; run dr connectors poll enable ${filebox}`,
-        { cause: err }
-      );
+    const parsed2 = JSON.parse(body);
+    const d = parsed2.detail;
+    if (typeof d === "string") return d;
+    if (Array.isArray(d)) {
+      return d.map(
+        (e) => `${Array.isArray(e.loc) ? e.loc.slice(1).join(".") : ""}: ${e.msg ?? ""}`.trim()
+      ).join("; ");
     }
-    throw err;
+  } catch {
   }
+  return body;
 }
-async function readFileboxDateTag(monolith, fileboxId, signal) {
-  const details = await getDetails(monolith, fileboxId, { signal });
-  const dateTags = (details.tags_config ?? []).filter((t) => t.type === "DATE");
-  const [only] = dateTags;
-  if (only === void 0) return {};
-  if (dateTags.length > 1) {
-    const names = dateTags.map((t) => t.name).join(", ");
-    throw new Error(
-      `filebox ${fileboxId} has several DATE tags (${names}); a polled filebox needs exactly one`
+function scheduleText(t) {
+  if (t.schedule_kind === "cron") return `cron "${t.cron ?? ""}" ${t.timezone}`;
+  const s = t.every_seconds ?? 0;
+  const unit = s % 86400 === 0 ? `${s / 86400}d` : s % 3600 === 0 ? `${s / 3600}h` : s % 60 === 0 ? `${s / 60}m` : `${s}s`;
+  return `every ${unit}`;
+}
+function stateText(t) {
+  if (!t.enabled) return "disabled";
+  if (t.paused_reason !== null) return `paused (${t.paused_reason})`;
+  return t.running ? "running" : "enabled";
+}
+function writeTask(out, t) {
+  const roles = Object.entries(t.datasources).map(([role, id]) => `${role}=${id}${role === t.primary_role ? " (primary)" : ""}`).join(", ");
+  out.write(`Task:        ${t.name}  (${t.id})
+`);
+  out.write(`  Org:       ${t.org_id}
+`);
+  out.write(`  State:     ${stateText(t)}
+`);
+  out.write(`  Artifact:  ${t.artifact_name}  [${t.runtime_flavor}]
+`);
+  out.write(`  Schedule:  ${scheduleText(t)}
+`);
+  out.write(`  Next run:  ${t.next_run_at}
+`);
+  out.write(`  Last run:  ${t.last_run_at ?? "-"}  ${t.last_run_status ?? ""}
+`);
+  if (t.consecutive_failures > 0) out.write(`  Failures:  ${t.consecutive_failures} in a row
+`);
+  out.write(`  Datasources: ${roles}
+`);
+  out.write(`  Config:    ${truncate3(JSON.stringify(t.config), 200)}
+`);
+}
+function writeTaskList(out, tasks) {
+  if (tasks.length === 0) {
+    out.write("No scheduled tasks.\n");
+    return;
+  }
+  for (const t of tasks) {
+    out.write(
+      `${t.name.padEnd(28)} ${stateText(t).padEnd(20)} ${scheduleText(t).padEnd(26)} next ${t.next_run_at}  last ${t.last_run_status ?? "-"}  ${t.id}
+`
     );
   }
-  return { id: only.id, name: only.name };
 }
-function formatSeconds(sec) {
-  if (sec > 0 && sec % 86400 === 0) return `${sec / 86400}d`;
-  if (sec > 0 && sec % 3600 === 0) return `${sec / 3600}h`;
-  if (sec > 0 && sec % 60 === 0) return `${sec / 60}m`;
-  return `${sec}s`;
+function writeRuns(out, runs) {
+  if (runs.length === 0) {
+    out.write("No runs yet.\n");
+    return;
+  }
+  for (const r of runs) {
+    const tail = r.error !== null ? `  error: ${truncate3(r.error, 160)}` : r.summary !== null ? `  ${truncate3(JSON.stringify(r.summary), 160)}` : "";
+    out.write(
+      `${r.started_at}  ${r.status.padEnd(15)} ${r.trigger.padEnd(8)} attempt ${r.attempt}  ${r.artifact_version ?? "-"}${tail}
+`
+    );
+  }
 }
-function oneLine3(s) {
-  return s.replace(/\s+/g, " ").trim();
+function withFlags(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false);
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  addConnectorsUrlFlag(cmd);
+  return cmd;
 }
-function sameNameLabel(policy) {
-  return policy === "new_version" ? "new-version" : String(policy);
+function addScheduleFlags(cmd) {
+  return cmd.option("--artifact <name>", "published artifact name, e.g. sftp_export__daily_sales").option("--flavor <flavor>", "runner flavor the artifact was published for, e.g. sftp").option("--datasource <role=id>", "monolith datasource for a role (repeat per role)", collect).option(
+    "--primary-role <role>",
+    "the role passed as the primary datasource (default: the first)"
+  ).option("--config <json|@file>", "task config: a JSON object, or @path to a JSON file").option("--every <duration>", "run on an interval, e.g. 5m, 1h (at least 1m)").option("--cron <expr>", 'run on a five-field cron line, e.g. "15 * * * *"').option("--tz <iana>", "timezone the cron line is read in (default UTC)");
 }
-function formatDateTag(tag) {
-  if (tag?.id === void 0) return "none (undated filebox)";
-  return `${tag.name ?? "?"} (id ${tag.id})`;
+async function onTask(task, opts, act, print) {
+  await withConnectorsSetup(opts, async ({ client, signal }) => {
+    try {
+      const taskId = await resolveTaskId(client, task, signal);
+      const result = await act(client, taskId, signal);
+      if (opts.json === true) writeJSONIndented(process.stdout, result);
+      else print(process.stdout, result);
+    } catch (err) {
+      throw explainTaskError(err);
+    }
+  });
 }
-function bindingTarget(binding) {
-  return `filebox ${binding.filebox_uuid} (query #${binding.query_id})`;
+function registerConnectorsTasks(connectors) {
+  const tasks = connectors.command("tasks").description("DRIP scheduled tasks: run an artifact on a schedule (support user or org admin)");
+  withFlags(
+    addScheduleFlags(
+      tasks.command("create").description("Create a scheduled task").argument("<name>", "task name, unique in the org (a-z, 0-9, _ and -)").option("--org-id <id>", "org id (defaults to the JWT org)").option("--disabled", "create it disabled", false)
+    )
+  ).action(
+    async (name, opts) => {
+      const explicitOrg = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      const parsed2 = buildCreateFields(name, explicitOrg ?? 0, opts);
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        const fields = { ...parsed2, org_id: explicitOrg ?? client.getCurrentOrgId() };
+        try {
+          const t = await createTask(client, fields, { signal });
+          if (opts.json === true) writeJSONIndented(process.stdout, t);
+          else writeTask(process.stdout, t);
+        } catch (err) {
+          throw explainTaskError(err);
+        }
+      });
+    }
+  );
+  withFlags(
+    tasks.command("list").description("List the org's scheduled tasks").option("--org-id <id>", "org id (defaults to the JWT org)")
+  ).action(async (opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      try {
+        const list28 = await listTasks(client, orgId, { signal });
+        if (opts.json === true) writeJSONIndented(process.stdout, list28);
+        else writeTaskList(process.stdout, list28);
+      } catch (err) {
+        throw explainTaskError(err);
+      }
+    });
+  });
+  withFlags(
+    tasks.command("get").description("Show a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => getTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    addScheduleFlags(
+      tasks.command("update").description("Change a scheduled task (only the flags given change)").argument("<task>", "task id or name").option("--enable", "enable the task").option("--disable", "disable the task")
+    )
+  ).action(
+    async (task, opts) => {
+      if (opts.enable === true && opts.disable === true)
+        throw new Error("give --enable or --disable, not both");
+      const fields = parseScheduleFlags(opts);
+      if (opts.enable === true) fields.enabled = true;
+      if (opts.disable === true) fields.enabled = false;
+      if (Object.keys(fields).length === 0)
+        throw new Error("nothing to change: give at least one flag");
+      await onTask(
+        task,
+        opts,
+        (c, id, signal) => updateTask(c, id, fields, { signal }),
+        (o, r) => writeTask(o, r)
+      );
+    }
+  );
+  withFlags(
+    tasks.command("delete").description("Delete a scheduled task and its run history").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      async (c, id, signal) => {
+        await deleteTask(c, id, { signal });
+        return { deleted: id };
+      },
+      (o, r) => o.write(`Deleted scheduled task ${r.deleted}
+`)
+    )
+  );
+  withFlags(
+    tasks.command("run").description("Run a task now (does not move its schedule)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => runTask(c, id, { signal }),
+      (o, r) => {
+        const run2 = r;
+        o.write(`Queued run ${run2.id} (${run2.status}); see: dr connectors tasks runs ${task}
+`);
+      }
+    )
+  );
+  withFlags(
+    tasks.command("pause").description("Pause a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => pauseTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    tasks.command("resume").description("Resume a paused task (clears its failure count, schedules the next run)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => resumeTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    tasks.command("runs").description("A task's run history, newest first").argument("<task>", "task id or name").option("--limit <n>", "how many runs (1-200)", "20")
+  ).action(async (task, opts) => {
+    const limit = parsePositiveIntArg2(opts.limit, "--limit");
+    if (limit > 200) throw new Error("invalid --limit: at most 200");
+    await onTask(
+      task,
+      opts,
+      (c, id, signal) => listRuns(c, id, limit, { signal }),
+      (o, r) => writeRuns(o, r)
+    );
+  });
 }
-function renderPoll(out, headline, binding, p) {
+
+// src/commands/connectorsAws.ts
+var ROLE_ARN_RE = /^arn:aws[a-z-]*:iam::\d{12}:role\/\S+$/;
+var OTHER_ORG_HINT = "if your session is valid, the connection or --org-id may belong to another org than the --account you are logged in as";
+function explainAwsError(err, id) {
+  if (!(err instanceof ControlPlaneError)) {
+    if (err instanceof Error && /\bHTTP 403\b/.test(err.message)) {
+      return withCause(
+        new ControlPlaneError(
+          403,
+          "",
+          `${err.message}
+${OTHER_ORG_HINT}`
+        ),
+        err
+      );
+    }
+    return err;
+  }
+  if (!hasDetail(err.body)) return err;
+  const detail = detailOf(err.body) || err.message;
+  const messages = {
+    403: `forbidden: ${detail} (${OTHER_ORG_HINT})`,
+    404: `AWS connection${id === void 0 ? "" : ` ${id}`} not found: ${detail}`,
+    409: `conflict: ${detail}`,
+    422: `rejected: ${detail}`,
+    503: `the control plane cannot broker AWS roles on this site: ${detail}`
+  };
+  const message = messages[err.status];
+  if (message === void 0) return err;
+  return withCause(new ControlPlaneError(err.status, err.body, message), err);
+}
+function hasDetail(body) {
+  try {
+    const parsed2 = JSON.parse(body);
+    return typeof parsed2 === "object" && parsed2 !== null && "detail" in parsed2;
+  } catch {
+    return false;
+  }
+}
+function oneLine3(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function writeConnection(out, c) {
   const row = (label, value) => {
-    out.write(`  ${`${label}:`.padEnd(15)}${value}
+    out.write(`  ${`${label}:`.padEnd(14)}${value}
 `);
   };
-  const status2 = `${p.enabled ? "enabled" : "disabled"}${p.paused_reason === null ? "" : `, paused: ${oneLine3(p.paused_reason)}`}`;
-  const counts = Object.entries(p.counts).sort(([a], [b]) => a.localeCompare(b)).map(([state, n]) => `${state}=${n}`).join("  ");
-  out.write(`${headline} for ${bindingTarget(binding)}
+  out.write(`AWS connection #${c.id} (org ${c.org_id})
+`);
+  row("Datasource", c.secret_ref);
+  row("Role ARN", c.role_arn);
+  row("Status", `${c.status}${c.enabled ? "" : " (disabled)"}`);
+  row("Broker ARN", c.broker_arn ?? "-");
+  row("External ID", c.external_id);
+  row("Expires", c.expires_at ?? "-");
+  row("Last assumed", c.last_assumed_at ?? "-");
+  row("Last error", c.last_error === null ? "-" : oneLine3(c.last_error));
+  row("Failures", String(c.consecutive_failures));
+  if (c.trust_statement === null) {
+    out.write("\nTrust statement: none returned by the control plane.\n");
+  } else {
+    out.write("\nTrust statement (add it to the customer role's trust policy):\n");
+    out.write(`${JSON.stringify(c.trust_statement, null, 2)}
 `);
-  row("Status", status2);
-  row("Interval", formatSeconds(p.interval_seconds));
-  row("Date tag", formatDateTag(p.date_tag));
-  row("Since", p.since ?? "-");
-  row("Lookback", `${p.lookback_days}d`);
-  row("Settle", formatSeconds(p.settle_seconds));
-  row("Same name", sameNameLabel(p.change_policy));
-  row("Max attempts", String(p.max_attempts));
-  row("Last poll", `${p.last_poll_at ?? "-"} ${oneLine3(p.last_poll_status ?? "")}`.trimEnd());
-  row("Next poll", p.next_poll_at);
-  row("Failures", String(p.consecutive_failures));
-  row("Discover", p.discover_in_flight ? `in flight since ${p.discover_sent_at ?? "?"}` : "-");
-  row("Last digest", p.last_digest ?? "-");
-  row("Pending seed", p.poll_run_seed_until ?? "-");
-  row(
-    "Pending rekey",
-    p.poll_run_rekey_to === null ? "-" : `to ${sameNameLabel(p.poll_run_rekey_to)}`
+  }
+  out.write(
+    "\nThe customer role's permissions should be read-only on their bucket/prefix (plus kms:Decrypt for a customer-managed KMS key).\n"
   );
-  row("Items", counts === "" ? "(none)" : counts);
 }
-function writeTable26(out, rows) {
-  const widths = [];
-  for (const r of rows) {
-    r.forEach((cell, i) => {
-      widths[i] = Math.max(widths[i] ?? 0, cell.length);
-    });
+function writeConnectionTable(out, list28) {
+  if (list28.length === 0) {
+    out.write("No AWS connections for this org.\n");
+    return;
+  }
+  const rows = [["ID", "SECRET_REF", "ROLE_ARN", "STATUS", "EXPIRES_AT", "LAST_ERROR"]];
+  for (const c of list28) {
+    rows.push([
+      String(c.id),
+      oneLine3(c.secret_ref),
+      oneLine3(c.role_arn),
+      c.status,
+      c.expires_at ?? "-",
+      c.last_error === null ? "-" : truncate3(oneLine3(c.last_error), 60)
+    ]);
   }
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
   for (const r of rows) {
-    const cells = r.map(
-      (cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)
+    out.write(
+      `${r.map((cell, i) => cell.padEnd(widths[i] + 2)).join("").trimEnd()}
+`
     );
-    out.write(`${cells.join("").trimEnd()}
-`);
   }
 }
-function renderItemTable(out, items) {
-  const rows = [["ID", "LABEL", "DATE", "STATE", "ATTEMPTS", "VERSION", "ERROR"]];
-  for (const it of items) {
-    const error = it.last_error ?? (it.skip_reason === null ? null : `skipped: ${it.skip_reason}`);
-    rows.push([
-      String(it.id),
-      oneLine3(it.label),
-      it.item_date ?? "-",
-      it.state,
-      String(it.attempts),
-      it.version_id === null ? "-" : String(it.version_id),
-      error === null ? "-" : truncate3(oneLine3(error), 80)
-    ]);
-  }
-  writeTable26(out, rows);
+function withFlags2(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false);
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  addConnectorsUrlFlag(cmd);
+  return cmd;
 }
-async function runPollEnable(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  let existing;
-  try {
-    existing = await getPoll(cfg.client, binding.query_id, { signal: cfg.signal });
-  } catch (err) {
-    if (!isNotPolled(err)) throw err;
-    existing = null;
-  }
-  const s = cfg.settings;
-  if (existing !== null && (s.since !== void 0 || s.lookback_days !== void 0 || s.change_policy !== void 0)) {
-    throw new Error(
-      `filebox ${cfg.filebox} is already polled; change --since, --lookback or --same-name with dr connectors poll set ${cfg.filebox}, which asks what to do with a wider window or a policy switch`
+async function run(opts, act, print, id) {
+  await withConnectorsSetup(opts, async (setup) => {
+    let result;
+    try {
+      result = await act(setup);
+    } catch (err) {
+      throw explainAwsError(err, id);
+    }
+    if (opts.json === true) writeJSONIndented(process.stdout, result);
+    else print(process.stdout, result);
+  });
+}
+function registerConnectorsAws(connectors) {
+  const aws = connectors.command("aws").description("Customer IAM roles DRIP assumes to read the customer's S3 (external ID, trust)");
+  withFlags2(
+    aws.command("create").description("Register a customer IAM role for a datasource; prints the trust statement").requiredOption("--secret-ref <datasourceId>", "monolith datasource id the role serves").requiredOption("--role-arn <arn>", "customer role, e.g. arn:aws:iam::123456789012:role/x").option("--org-id <id>", "org id (defaults to the JWT org)")
+  ).action(async (opts) => {
+    const secretRef = opts.secretRef.trim();
+    if (secretRef === "" || secretRef.length > 200) {
+      throw new Error(`invalid --secret-ref "${opts.secretRef}": expected 1-200 characters`);
+    }
+    if (!ROLE_ARN_RE.test(opts.roleArn)) {
+      throw new Error(
+        `invalid --role-arn "${opts.roleArn}": expected arn:aws:iam::<12-digit account>:role/<name>`
+      );
+    }
+    const orgId = opts.orgId === void 0 ? void 0 : parsePositiveIntArg2(opts.orgId, "--org-id");
+    const fields = {
+      secret_ref: secretRef,
+      role_arn: opts.roleArn,
+      ...orgId !== void 0 ? { org_id: orgId } : {}
+    };
+    await run(
+      opts,
+      ({ client, signal }) => createAwsConnection(client, fields, { signal }),
+      writeConnection
     );
-  }
-  if (binding.filebox_id <= 0) {
-    throw new Error(
-      `connector-query #${binding.query_id} has no filebox id recorded, so its date tag cannot be read; record it with dr connectors query repoint ${binding.query_id} --filebox-id <id>`
+  });
+  withFlags2(
+    aws.command("list").description("List the org's AWS connections").option("--secret-ref <datasourceId>", "only the connection of this datasource")
+  ).action(async (opts) => {
+    await run(
+      opts,
+      ({ client, signal }) => listAwsConnections(client, opts.secretRef, { signal }),
+      writeConnectionTable
+    );
+  });
+  withFlags2(
+    aws.command("get").description("Show an AWS connection and its trust statement").argument("<id>", "connection id")
+  ).action(async (idArg, opts) => {
+    const id = parsePositiveIntArg2(idArg, "connection id");
+    await run(
+      opts,
+      ({ client, signal }) => getAwsConnection(client, id, { signal }),
+      writeConnection,
+      id
+    );
+  });
+  for (const [verb, enabled, help] of [
+    ["enable", true, "Enable an AWS connection; also retries now (stored credentials are dropped)"],
+    ["disable", false, "Disable an AWS connection (stored credentials are dropped)"]
+  ]) {
+    withFlags2(aws.command(verb).description(help).argument("<id>", "connection id")).action(
+      async (idArg, opts) => {
+        const id = parsePositiveIntArg2(idArg, "connection id");
+        await run(
+          opts,
+          ({ client, signal }) => updateAwsConnection(client, id, { enabled }, { signal }),
+          (out, c) => {
+            writeConnection(out, c);
+            if (enabled)
+              out.write(
+                "\nStored credentials were dropped; the poller assumes the role again now.\n"
+              );
+          },
+          id
+        );
+      }
     );
   }
-  const dateTag = await readFileboxDateTag(cfg.monolith, binding.filebox_id, cfg.signal);
-  const stored = await putPoll(
-    cfg.client,
-    binding.query_id,
-    { enabled: true, date_tag: dateTag, ...s },
-    { signal: cfg.signal }
-  );
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, stored);
-    return;
-  }
-  renderPoll(cfg.out, "Polling enabled", binding, stored);
-}
-function windowStart(since, lookbackDays, now) {
-  const start = now - lookbackDays * 864e5;
-  return since === null ? start : Math.max(start, Date.parse(since));
-}
-function widening(current, changes, now) {
-  if (changes.since === void 0 && changes.lookback_days === void 0) return null;
-  const from = windowStart(current.since, current.lookback_days, now);
-  const to = windowStart(
-    changes.since ?? current.since,
-    changes.lookback_days ?? current.lookback_days,
-    now
-  );
-  if (to >= from) return null;
-  return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
 }
-async function ask(cfg, message, choices, defaultChoice) {
-  const answer = await cfg.prompt(message, choices, defaultChoice);
-  if (answer === null) throw new Error("poll set cancelled; nothing was changed");
-  return parseChoice(answer, "the answer", choices);
+
+// src/commands/connectorsDevFetch.ts
+import { promises as fs19 } from "fs";
+import * as path9 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+function buildDevEnvelope(i) {
+  const config = {
+    ...i.publicConfig,
+    ...i.queryConfig,
+    // Coerce absent values to null (not undefined) so JSON.stringify keeps the
+    // key — matches build_hook_job's dq.get(...) -> None; a dropped objectType
+    // becomes a cryptic KeyError in the runner's dispatch.
+    objectType: i.dataQuery.objectType ?? null,
+    type: i.dataQuery.type ?? null,
+    query: i.dataQuery.query
+  };
+  if (i.period) config.period = i.period;
+  return {
+    correlation_id: i.correlationId,
+    config,
+    secret_ref: i.secretRef,
+    cred_token: "dev-local",
+    output_sas: "file:///out/output.csv",
+    input_sas: null,
+    cursor: null,
+    contract_version: i.contractVersion,
+    metadata: {}
+  };
 }
-var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
-var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
-function pollSetConfirmVerb(widen, onPolicyChange) {
-  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+function asObject(v) {
+  if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+    return v;
+  }
+  return null;
 }
-async function runPollSet(cfg) {
-  if (Object.keys(cfg.changes).length === 0) {
+function extractDataQueryFields(raw2) {
+  const root = asObject(decodeShape(raw2));
+  if (root === null || Object.keys(root).length === 0) {
     throw new Error(
-      "poll set: pass at least one of --interval, --since, --lookback, --settle, --same-name"
+      "no data-query attached to this filebox (empty data_query response) \u2014 attach one in the filebox UI first"
     );
   }
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const current = await explainNotPolled(
-    cfg.filebox,
-    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
-  );
-  const body = { ...cfg.changes };
-  const detail = [`target:      ${bindingTarget(binding)}`];
-  const wider = widening(current, cfg.changes, cfg.now ?? Date.now());
-  if (wider !== null) {
-    const what = `the polling window widens (start ${wider.from} -> ${wider.to})`;
-    if (cfg.widen === void 0 && !cfg.interactive) {
-      throw new Error(`${what}; pass --widen seed or --widen land (${WIDEN_HELP})`);
+  const cfg = asObject(root.config);
+  const src = cfg ?? root;
+  const query = src.query;
+  let queryObj;
+  if (query === void 0 || query === null) {
+    queryObj = {};
+  } else {
+    const asObj = asObject(query);
+    if (asObj === null) {
+      throw new Error(
+        `data-query \`query\` is not an object (got ${typeof query}) \u2014 expected the Sync-query field`
+      );
     }
-    body.widen = cfg.widen ?? await ask(cfg, `${what}. ${WIDEN_HELP}.`, WIDEN_CHOICES);
-    detail.push(`window:      start ${wider.from} -> ${wider.to}, widen ${body.widen}`);
-  } else if (cfg.widen !== void 0) {
-    body.widen = cfg.widen;
+    queryObj = asObj;
   }
-  const newPolicy = cfg.changes.change_policy;
-  const policySwitch = newPolicy !== void 0 && newPolicy !== current.change_policy;
-  if (policySwitch) {
-    const change = `${sameNameLabel(current.change_policy)} -> ${sameNameLabel(newPolicy)}`;
-    const what = `--same-name changes ${change}`;
-    if (cfg.onPolicyChange === void 0 && !cfg.interactive) {
-      throw new Error(`${what}; pass --on-policy-change rekey, seed or land (${POLICY_HELP})`);
-    }
-    body.on_policy_change = cfg.onPolicyChange ?? await ask(cfg, `${what}. ${POLICY_HELP}.`, POLICY_CHOICES, "rekey");
-    detail.push(`same name:   ${change}, on policy change ${body.on_policy_change}`);
+  return { objectType: queryObj.objectType, type: src.type, query: queryObj };
+}
+function extractCredentials(integration) {
+  const cfg = asObject(integration.config);
+  if (cfg === null || Object.keys(cfg).length === 0) {
+    throw new Error(
+      `datasource ${integration.id} has an empty/missing \`config\` \u2014 nothing to use as connector credentials`
+    );
+  }
+  return { ...cfg };
+}
+var ENV_FILE = "env.json";
+var SECRETS_FILE = "secrets.json";
+var CONNECTION_FILE = "connection.py";
+var QUERY_FILE = "query.py";
+async function writeRunDir(input) {
+  let connectionSource;
+  try {
+    connectionSource = await fs19.readFile(input.connectionPath, "utf-8");
+  } catch {
+    throw new Error(`${input.connectionPath}: connection source not found or unreadable`);
+  }
+  let querySource;
+  try {
+    querySource = await fs19.readFile(input.queryPath, "utf-8");
+  } catch {
+    throw new Error(`${input.queryPath}: dataquery source not found or unreadable`);
+  }
+  await fs19.mkdir(input.outDir, { recursive: true });
+  await fs19.writeFile(
+    path9.join(input.outDir, ENV_FILE),
+    JSON.stringify(input.env, null, 2) + "\n",
+    "utf-8"
+  );
+  const secretsPath = path9.join(input.outDir, SECRETS_FILE);
+  await fs19.writeFile(
+    secretsPath,
+    JSON.stringify({ [input.secretRef]: input.credentials }, null, 2) + "\n",
+    "utf-8"
+  );
+  if (process.platform !== "win32") {
+    await fs19.chmod(secretsPath, 384);
+  }
+  await fs19.writeFile(path9.join(input.outDir, CONNECTION_FILE), connectionSource, "utf-8");
+  await fs19.writeFile(path9.join(input.outDir, QUERY_FILE), querySource, "utf-8");
+}
+async function ensureGitignored(entry) {
+  const gitignorePath = path9.join(process.cwd(), ".gitignore");
+  let current = "";
+  try {
+    current = await fs19.readFile(gitignorePath, "utf-8");
+  } catch {
+  }
+  const normalized = entry.split("\\").join("/").replace(/\/+$/, "") + "/";
+  const lines = current.split(/\r?\n/).map((l) => l.trim());
+  if (lines.includes(normalized) || lines.includes(entry)) return;
+  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
+  await fs19.writeFile(gitignorePath, `${current}${sep}${normalized}
+`, "utf-8");
+}
+function parsePositiveInt3(raw2, label) {
+  const n = Number(raw2);
+  if (!Number.isInteger(n) || String(n) !== raw2.trim() || n <= 0) {
+    throw new Error(`invalid ${label}: "${raw2}"`);
+  }
+  return n;
+}
+function registerDevFetch(connectors) {
+  const cmd = connectors.command("dev-fetch").description(
+    "Assemble a local run dir (env.json + secrets.json + connection.py + query.py) for dev-run.sh"
+  ).argument("<fileboxUuid>", "filebox UUID of the connector binding").requiredOption(
+    "--datasource <id>",
+    "datasource (data-integration) id whose credentials to fetch"
+  ).requiredOption(
+    "--document-id <n>",
+    "numeric filebox document id (no uuid->id lookup exists; required)"
+  ).requiredOption("--connection <path>", "path to the connector's connection .py source").requiredOption("--query <path>", "path to the connector's dataquery .py source").option("--from <date>", "period start (paired with --to)").option("--to <date>", "period end (paired with --from)").option("-o, --output <dir>", "output run dir (default ./dev-run/<fileboxUuid>/)").action(async (fileboxUuid, opts) => {
+    const datasourceId = parsePositiveInt3(opts.datasource, "datasource id");
+    const documentId = parsePositiveInt3(opts.documentId, "document-id");
+    if (opts.from === void 0 !== (opts.to === void 0)) {
+      throw new Error("--from and --to must be provided together");
+    }
+    const defaultRoot = path9.join("dev-run", fileboxUuid);
+    const outDir = opts.output ?? defaultRoot;
+    const gitignoreEntry = opts.output ?? "dev-run";
+    const serverKey = resolveServer(opts.server);
+    const host = resolveConnectorsUrl(serverKey, opts.connectorsUrl);
+    const monolithHost = resolve(serverKey).host;
+    const cpSetup = await setupCall(opts.server, opts.account, { host, authHost: monolithHost });
+    try {
+      const binding = await getBinding(cpSetup.client, fileboxUuid, {
+        signal: cpSetup.signal
+      });
+      const monoSetup = await setupCall(opts.server, opts.account, {
+        host: monolithHost,
+        authHost: monolithHost
+      });
+      try {
+        const rawDataQuery = await getDataQueryRaw(monoSetup.client, documentId, {
+          signal: monoSetup.signal
+        });
+        const dataQuery = extractDataQueryFields(rawDataQuery);
+        if (dataQuery.objectType === void 0 || dataQuery.objectType === null || dataQuery.objectType === "") {
+          process.stderr.write(
+            'WARNING: objectType is not set inside the Sync-query (config.query.objectType). get_query_class will receive None \u2014 fine only if the connector has a single default dataset. Add it to the data-query, e.g. config.query.objectType = "<dataset>".\n'
+          );
+        }
+        const integration = await itGet(monoSetup.client, datasourceId, {
+          signal: monoSetup.signal
+        });
+        const credentials = extractCredentials(integration);
+        let period;
+        if (opts.from !== void 0 && opts.to !== void 0) {
+          period = { from: opts.from, to: opts.to };
+        }
+        const env = buildDevEnvelope({
+          correlationId: randomUUID2(),
+          secretRef: binding.secret_ref,
+          publicConfig: binding.public_config,
+          queryConfig: binding.query_config,
+          dataQuery,
+          ...period !== void 0 ? { period } : {},
+          // Deliberate sandbox stub: the fetch/dispatch path doesn't branch on
+          // contract_version, so a fixed "1" is sufficient for a local run.
+          contractVersion: "1"
+        });
+        await writeRunDir({
+          outDir,
+          env,
+          secretRef: binding.secret_ref,
+          credentials,
+          connectionPath: opts.connection,
+          queryPath: opts.query
+        });
+        await ensureGitignored(gitignoreEntry);
+        process.stdout.write(`Wrote run dir: ${outDir}
+`);
+        process.stdout.write(
+          `  env.json (secret_ref=${binding.secret_ref}, flavor=${binding.runtime_flavor})
+`
+        );
+        process.stdout.write("  secrets.json (credentials NOT shown)\n");
+        process.stdout.write("  connection.py, query.py\n");
+      } finally {
+        monoSetup.cleanup();
+      }
+    } catch (err) {
+      throw augmentTlsCertError(err);
+    } finally {
+      cpSetup.cleanup();
+    }
+  });
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  cmd.option(
+    "--connectors-url <url>",
+    "Override the control-plane base URL (e.g. a kubectl port-forward http://localhost:8000)"
+  );
+}
+
+// src/commands/connectorsPoll.ts
+import * as readline2 from "readline";
+import { createHash as createHash11 } from "crypto";
+
+// src/types/connectors.ts
+var POLL_ITEM_STATES = [
+  "seen",
+  "new",
+  "dispatched",
+  "running",
+  "retry_wait",
+  "landed",
+  "failed",
+  "skipped",
+  "seeded",
+  "superseded"
+];
+
+// src/commands/connectorsPoll.ts
+var DURATION_UNIT_SECONDS2 = { s: 1, m: 60, h: 3600, d: 86400 };
+var DURATION_BOUNDS = {
+  "--interval": [300, 7 * 86400],
+  "--settle": [0, 86400]
+};
+var LOOKBACK_MAX_DAYS = 3650;
+function parseDurationSeconds(raw2, flag) {
+  const m = /^(\d+)([smhd])?$/.exec(raw2.trim());
+  const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS2[m[2] ?? "s"] ?? 1);
+  const [min, max] = DURATION_BOUNDS[flag] ?? [0, Number.MAX_SAFE_INTEGER];
+  if (m === null) {
+    throw new Error(`invalid ${flag} "${raw2}": expected a duration like 90s, 5m or 1h`);
+  }
+  if (!Number.isSafeInteger(seconds) || seconds < min || seconds > max) {
+    throw new Error(
+      `invalid ${flag} "${raw2}": must be between ${formatSeconds(min)} and ${formatSeconds(max)}`
+    );
+  }
+  return seconds;
+}
+function parseLookbackDays(raw2) {
+  const m = /^(\d+)d?$/.exec(raw2.trim());
+  const days = m === null ? 0 : Number(m[1]);
+  if (days < 1 || days > LOOKBACK_MAX_DAYS) {
+    throw new Error(
+      `invalid --lookback "${raw2}": must be between 1 and ${LOOKBACK_MAX_DAYS} days, e.g. 180d`
+    );
+  }
+  return days;
+}
+var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+var DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
+function inRange(value, max, min = 0) {
+  const n = Number(value ?? "0");
+  return n >= min && n <= max;
+}
+function isCalendarDay(y, m, d) {
+  if (!inRange(m, 12, 1)) return false;
+  const daysInMonth3 = new Date(Date.UTC(Number(y), Number(m), 0)).getUTCDate();
+  return inRange(d, daysInMonth3, 1);
+}
+function parseTimestampFlag(raw2, flag) {
+  const invalid = new Error(
+    `invalid ${flag} "${raw2}": expected YYYY-MM-DD or a timestamp with a zone (e.g. 2026-10-08T17:30:00+03:00)`
+  );
+  const value = raw2.trim();
+  const dateOnly = DATE_ONLY_RE.exec(value);
+  if (dateOnly !== null) {
+    if (!isCalendarDay(dateOnly[1], dateOnly[2], dateOnly[3])) throw invalid;
+    return (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString();
+  }
+  const dt = DATE_TIME_RE.exec(value);
+  const valid = dt !== null && isCalendarDay(dt[1], dt[2], dt[3]) && inRange(dt[4], 23) && inRange(dt[5], 59) && inRange(dt[6], 59) && inRange(dt[7], 23) && inRange(dt[8], 59);
+  const ms = valid ? Date.parse(value) : NaN;
+  if (Number.isNaN(ms)) throw invalid;
+  return new Date(ms).toISOString();
+}
+function parseSameName(raw2) {
+  if (raw2 === "new-version") return "new_version";
+  if (raw2 === "ignore") return "ignore";
+  throw new Error(`--same-name must be new-version or ignore (got "${raw2}")`);
+}
+function parseChoice(raw2, flag, choices) {
+  const match = choices.find((c) => c === raw2);
+  if (match === void 0) {
+    throw new Error(`${flag} must be ${choices.join(" or ")} (got "${raw2}")`);
+  }
+  return match;
+}
+var WIDEN_CHOICES = ["seed", "land"];
+var POLICY_CHOICES = ["rekey", "seed", "land"];
+function parseSettings(opts) {
+  const fields = {};
+  if (opts.interval !== void 0) {
+    fields.interval_seconds = parseDurationSeconds(opts.interval, "--interval");
+  }
+  if (opts.since !== void 0) fields.since = parseTimestampFlag(opts.since, "--since");
+  if (opts.lookback !== void 0) fields.lookback_days = parseLookbackDays(opts.lookback);
+  if (opts.settle !== void 0) {
+    fields.settle_seconds = parseDurationSeconds(opts.settle, "--settle");
+  }
+  if (opts.sameName !== void 0) fields.change_policy = parseSameName(opts.sameName);
+  return fields;
+}
+function settingsArgs(opts) {
+  const pairs = [
+    ["--interval", opts.interval],
+    ["--since", opts.since],
+    ["--lookback", opts.lookback],
+    ["--settle", opts.settle],
+    ["--same-name", opts.sameName]
+  ];
+  return pairs.filter((p) => p[1] !== void 0).map(([flag, value]) => ` ${flag} ${value.trim()}`).join("");
+}
+async function resolvePollBinding(client, filebox, signal) {
+  const wanted = filebox.trim();
+  const byId = /^\d+$/.test(wanted);
+  const rows = await listQueries(client, { signal });
+  const matches = rows.filter(
+    (q) => byId ? q.filebox_id === Number(wanted) : q.filebox_uuid.toLowerCase() === wanted.toLowerCase()
+  );
+  const [first] = matches;
+  if (first === void 0) {
+    throw new Error(
+      `no connector binding for filebox ${wanted} in this org (see dr connectors query list)`
+    );
+  }
+  if (matches.length > 1) {
+    const ids = matches.map((q) => `#${q.query_id}`).join(", ");
+    throw new Error(`filebox ${wanted} has several connector bindings (${ids})`);
+  }
+  return first;
+}
+function isNotPolled(err) {
+  return err instanceof ControlPlaneError && err.status === 404 && err.body.includes("not polled");
+}
+function isPollThrottled(err) {
+  return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
+}
+async function explainNotPolled(filebox, call3) {
+  try {
+    return await call3;
+  } catch (err) {
+    if (isNotPolled(err)) {
+      throw new Error(
+        `filebox ${filebox} is not set to polled ingestion; run dr connectors poll enable ${filebox}`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+}
+async function readFileboxDateTag(monolith, fileboxId, signal) {
+  const details = await getDetails(monolith, fileboxId, { signal });
+  const dateTags = (details.tags_config ?? []).filter((t) => t.type === "DATE");
+  const [only] = dateTags;
+  if (only === void 0) return {};
+  if (dateTags.length > 1) {
+    const names = dateTags.map((t) => t.name).join(", ");
+    throw new Error(
+      `filebox ${fileboxId} has several DATE tags (${names}); a polled filebox needs exactly one`
+    );
+  }
+  return { id: only.id, name: only.name };
+}
+function formatSeconds(sec) {
+  if (sec > 0 && sec % 86400 === 0) return `${sec / 86400}d`;
+  if (sec > 0 && sec % 3600 === 0) return `${sec / 3600}h`;
+  if (sec > 0 && sec % 60 === 0) return `${sec / 60}m`;
+  return `${sec}s`;
+}
+function oneLine4(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function sameNameLabel(policy) {
+  return policy === "new_version" ? "new-version" : String(policy);
+}
+function formatDateTag(tag) {
+  if (tag?.id === void 0) return "none (undated filebox)";
+  return `${tag.name ?? "?"} (id ${tag.id})`;
+}
+function bindingTarget(binding) {
+  return `filebox ${binding.filebox_uuid} (query #${binding.query_id})`;
+}
+function renderPoll(out, headline, binding, p) {
+  const row = (label, value) => {
+    out.write(`  ${`${label}:`.padEnd(15)}${value}
+`);
+  };
+  const status2 = `${p.enabled ? "enabled" : "disabled"}${p.paused_reason === null ? "" : `, paused: ${oneLine4(p.paused_reason)}`}`;
+  const counts = Object.entries(p.counts).sort(([a], [b]) => a.localeCompare(b)).map(([state, n]) => `${state}=${n}`).join("  ");
+  out.write(`${headline} for ${bindingTarget(binding)}
+`);
+  row("Status", status2);
+  row("Interval", formatSeconds(p.interval_seconds));
+  row("Date tag", formatDateTag(p.date_tag));
+  row("Since", p.since ?? "-");
+  row("Lookback", `${p.lookback_days}d`);
+  row("Settle", formatSeconds(p.settle_seconds));
+  row("Same name", sameNameLabel(p.change_policy));
+  row("Max attempts", String(p.max_attempts));
+  row("Last poll", `${p.last_poll_at ?? "-"} ${oneLine4(p.last_poll_status ?? "")}`.trimEnd());
+  row("Next poll", p.next_poll_at);
+  row("Failures", String(p.consecutive_failures));
+  row("Discover", p.discover_in_flight ? `in flight since ${p.discover_sent_at ?? "?"}` : "-");
+  row("Last digest", p.last_digest ?? "-");
+  row("Pending seed", p.poll_run_seed_until ?? "-");
+  row(
+    "Pending rekey",
+    p.poll_run_rekey_to === null ? "-" : `to ${sameNameLabel(p.poll_run_rekey_to)}`
+  );
+  row("Items", counts === "" ? "(none)" : counts);
+}
+function writeTable26(out, rows) {
+  const widths = [];
+  for (const r of rows) {
+    r.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
+  }
+  for (const r of rows) {
+    const cells = r.map(
+      (cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)
+    );
+    out.write(`${cells.join("").trimEnd()}
+`);
+  }
+}
+function renderItemTable(out, items) {
+  const rows = [["ID", "LABEL", "DATE", "STATE", "ATTEMPTS", "VERSION", "ERROR"]];
+  for (const it of items) {
+    const error = it.last_error ?? (it.skip_reason === null ? null : `skipped: ${it.skip_reason}`);
+    rows.push([
+      String(it.id),
+      oneLine4(it.label),
+      it.item_date ?? "-",
+      it.state,
+      String(it.attempts),
+      it.version_id === null ? "-" : String(it.version_id),
+      error === null ? "-" : truncate3(oneLine4(error), 80)
+    ]);
+  }
+  writeTable26(out, rows);
+}
+async function runPollEnable(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  let existing;
+  try {
+    existing = await getPoll(cfg.client, binding.query_id, { signal: cfg.signal });
+  } catch (err) {
+    if (!isNotPolled(err)) throw err;
+    existing = null;
+  }
+  const s = cfg.settings;
+  if (existing !== null && (s.since !== void 0 || s.lookback_days !== void 0 || s.change_policy !== void 0)) {
+    throw new Error(
+      `filebox ${cfg.filebox} is already polled; change --since, --lookback or --same-name with dr connectors poll set ${cfg.filebox}, which asks what to do with a wider window or a policy switch`
+    );
+  }
+  if (binding.filebox_id <= 0) {
+    throw new Error(
+      `connector-query #${binding.query_id} has no filebox id recorded, so its date tag cannot be read; record it with dr connectors query repoint ${binding.query_id} --filebox-id <id>`
+    );
+  }
+  const dateTag = await readFileboxDateTag(cfg.monolith, binding.filebox_id, cfg.signal);
+  const stored = await putPoll(
+    cfg.client,
+    binding.query_id,
+    { enabled: true, date_tag: dateTag, ...s },
+    { signal: cfg.signal }
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, stored);
+    return;
+  }
+  renderPoll(cfg.out, "Polling enabled", binding, stored);
+}
+function windowStart(since, lookbackDays, now) {
+  const start = now - lookbackDays * 864e5;
+  return since === null ? start : Math.max(start, Date.parse(since));
+}
+function widening(current, changes, now) {
+  if (changes.since === void 0 && changes.lookback_days === void 0) return null;
+  const from = windowStart(current.since, current.lookback_days, now);
+  const to = windowStart(
+    changes.since ?? current.since,
+    changes.lookback_days ?? current.lookback_days,
+    now
+  );
+  if (to >= from) return null;
+  return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
+}
+async function ask(cfg, message, choices, defaultChoice) {
+  const answer = await cfg.prompt(message, choices, defaultChoice);
+  if (answer === null) throw new Error("poll set cancelled; nothing was changed");
+  return parseChoice(answer, "the answer", choices);
+}
+var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
+var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
+function pollSetConfirmVerb(widen, onPolicyChange) {
+  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+}
+async function runPollSet(cfg) {
+  if (Object.keys(cfg.changes).length === 0) {
+    throw new Error(
+      "poll set: pass at least one of --interval, --since, --lookback, --settle, --same-name"
+    );
+  }
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const current = await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  );
+  const body = { ...cfg.changes };
+  const detail = [`target:      ${bindingTarget(binding)}`];
+  const wider = widening(current, cfg.changes, cfg.now ?? Date.now());
+  if (wider !== null) {
+    const what = `the polling window widens (start ${wider.from} -> ${wider.to})`;
+    if (cfg.widen === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --widen seed or --widen land (${WIDEN_HELP})`);
+    }
+    body.widen = cfg.widen ?? await ask(cfg, `${what}. ${WIDEN_HELP}.`, WIDEN_CHOICES);
+    detail.push(`window:      start ${wider.from} -> ${wider.to}, widen ${body.widen}`);
+  } else if (cfg.widen !== void 0) {
+    body.widen = cfg.widen;
+  }
+  const newPolicy = cfg.changes.change_policy;
+  const policySwitch = newPolicy !== void 0 && newPolicy !== current.change_policy;
+  if (policySwitch) {
+    const change = `${sameNameLabel(current.change_policy)} -> ${sameNameLabel(newPolicy)}`;
+    const what = `--same-name changes ${change}`;
+    if (cfg.onPolicyChange === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --on-policy-change rekey, seed or land (${POLICY_HELP})`);
+    }
+    body.on_policy_change = cfg.onPolicyChange ?? await ask(cfg, `${what}. ${POLICY_HELP}.`, POLICY_CHOICES, "rekey");
+    detail.push(`same name:   ${change}, on policy change ${body.on_policy_change}`);
   } else if (cfg.onPolicyChange !== void 0) {
     body.on_policy_change = cfg.onPolicyChange;
   }
@@ -47076,793 +47781,332 @@ async function withMonolith(opts, action) {
 function scopeOf(opts) {
   const serverKey = resolveServer(opts.server);
   return {
-    serverKey,
-    account: normaliseAccount(opts.account),
-    controlPlane: resolveConnectorsUrl(serverKey, opts.connectorsUrl)
-  };
-}
-function targetArgsOf(opts) {
-  const url = (opts.connectorsUrl ?? "").trim();
-  return ` --server ${resolveServer(opts.server)}${url === "" ? "" : ` --connectors-url ${url}`}`;
-}
-function addCommonFlags(cmd, jsonHelp) {
-  cmd.option("--json", jsonHelp, false);
-  addServerFlag(cmd);
-  addAccountFlag(cmd);
-  addConnectorsUrlFlag(cmd);
-}
-function addConfirmTokenFlag(cmd) {
-  return cmd.option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed");
-}
-function addSettingsFlags(cmd) {
-  return cmd.option("--interval <duration>", "how often to poll, 5m to 7d (default: per source)").option("--since <date>", "never pick up items modified before this date or timestamp").option("--lookback <days>", "window every poll lists, 1d to 3650d (default: per source)").option("--settle <duration>", "how long an item must stay unchanged before landing, 0s to 1d").option(
-    "--same-name <policy>",
-    "a changed file under the same name: new-version (lands again) or ignore"
-  );
-}
-function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.stdin, output: process.stderr }) {
-  return new Promise((resolvePrompt) => {
-    const rl = readline2.createInterface({
-      input: io.input,
-      output: io.output,
-      ...io.terminal !== void 0 ? { terminal: io.terminal } : {}
-    });
-    let settled = false;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      rl.close();
-      resolvePrompt(value);
-    };
-    rl.on("SIGINT", () => settle(null));
-    rl.on("close", () => settle(null));
-    io.output.write(`${message}
-`);
-    const question = defaultChoice === void 0 ? `[${choices.join("/")}]: ` : `[${choices.join("/")}] (Enter = ${defaultChoice}): `;
-    const askOnce = () => {
-      rl.question(question, (answer) => {
-        const picked = answer.trim().toLowerCase();
-        if (picked === "" && defaultChoice !== void 0) {
-          settle(defaultChoice);
-        } else if (choices.includes(picked)) {
-          settle(picked);
-        } else {
-          io.output.write(`Answer one of: ${choices.join(", ")}
-`);
-          askOnce();
-        }
-      });
-    };
-    askOnce();
-  });
-}
-var POLL_CONFIRM_HELP = [
-  "Confirmation:",
-  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
-  "  re-run the printed command, token included, to apply it.",
-  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
-  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
-  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
-  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
-  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
-  "  resume --source land) also asks a person to type a word in a dialog on production,",
-  "  even when the same set also seeds (--on-policy-change seed --widen land)."
-].join("\n");
-function registerConnectorsPoll(connectors) {
-  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
-${POLL_CONFIRM_HELP}`);
-  const enableCmd = addSettingsFlags(
-    poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
-  ).action(async (filebox, opts) => {
-    const settings = parseSettings(opts);
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await withMonolith(opts, async (monolith) => {
-        await runPollEnable({
-          client,
-          monolith,
-          filebox,
-          settings,
-          asJson: opts.json === true,
-          signal,
-          out: process.stdout
-        });
-      });
-    });
-  });
-  addCommonFlags(enableCmd, "Output the stored binding as JSON");
-  const setCmd = addConfirmTokenFlag(
-    addSettingsFlags(
-      poll2.command("set").description("Change polling settings (only the given flags change)").argument("<filebox>", "filebox id or uuid")
-    ).option(
-      "--widen <seed|land>",
-      "a wider window: seed (mark exposed items landed) or land them"
-    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
-${POLL_CONFIRM_HELP}`)
-  ).action(
-    async (filebox, opts) => {
-      const changes = parseSettings(opts);
-      const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
-      const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
-      await preflightConfirmToken(
-        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
-          ...changes,
-          ...widen !== void 0 ? { widen } : {},
-          ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
-        }),
-        opts.confirmToken
-      );
-      await withConnectorsSetup(opts, async (setup) => {
-        const deadline = {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        };
-        await runPollSet({
-          client: setup.client,
-          filebox,
-          changes,
-          settingsArgs: settingsArgs(opts),
-          ...widen !== void 0 ? { widen } : {},
-          ...onPolicyChange !== void 0 ? { onPolicyChange } : {},
-          interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
-          prompt: async (message, choices, defaultChoice) => {
-            deadline.pause();
-            try {
-              return await ttyChoicePrompt(message, choices, defaultChoice);
-            } finally {
-              deadline.resume();
-            }
-          },
-          deadline,
-          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-          scope: scopeOf(opts),
-          targetArgs: targetArgsOf(opts),
-          asJson: opts.json === true,
-          signal: setup.signal,
-          out: process.stdout
-        });
-      });
-    }
-  );
-  addCommonFlags(setCmd, "Output the stored binding as JSON");
-  const disableCmd = poll2.command("disable").description("Stop polling (an item already in flight still finishes)").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollDisable({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(disableCmd, "Output the stored binding as JSON");
-  const getCmd = poll2.command("get").description("Show polling settings, last poll, pending seed / rekey and item counts").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollGet({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(getCmd, "Output the raw binding as JSON");
-  const runCmd = poll2.command("run").description("Poll now").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollRun({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(runCmd, "Output the binding as JSON");
-  const resumeCmd = addConfirmTokenFlag(
-    poll2.command("resume").description("Resume a paused binding (after fixing credentials, or a source change)").argument("<filebox>", "filebox id or uuid").option(
-      "--source <seed|land>",
-      "after a source change: seed (mark present items landed) or land them"
-    )
-  ).action(async (filebox, opts) => {
-    const source = opts.source === void 0 ? void 0 : parseChoice(opts.source, "--source", WIDEN_CHOICES);
-    if (source === "land") {
-      await preflightConfirmToken(
-        pollConfirmAction(filebox, "resume-land", scopeOf(opts)),
-        opts.confirmToken
-      );
-    }
-    await withConnectorsSetup(opts, async (setup) => {
-      await runPollResume({
-        client: setup.client,
-        filebox,
-        ...source !== void 0 ? { source } : {},
-        deadline: {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        },
-        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-        scope: scopeOf(opts),
-        targetArgs: targetArgsOf(opts),
-        asJson: opts.json === true,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(resumeCmd, "Output the binding as JSON");
-  const itemsCmd = poll2.command("items").description("List the item ledger: label, date, state, attempts, version, error").argument("<filebox>", "filebox id or uuid").option("--state <state>", `only items in this state (${POLL_ITEM_STATES.join("|")})`).option("--limit <n>", "page size (default and maximum: the control-plane page size, 100)").option("--after <id>", "start after this item id (the next-page cursor)").action(
-    async (filebox, opts) => {
-      const state = opts.state === void 0 ? void 0 : POLL_ITEM_STATES.find((s) => s === opts.state);
-      if (opts.state !== void 0 && state === void 0) {
-        throw new Error(
-          `invalid --state "${opts.state}": expected one of ${POLL_ITEM_STATES.join(", ")}`
-        );
-      }
-      const limit = opts.limit === void 0 ? void 0 : parsePositiveIntArg2(opts.limit, "--limit");
-      const after = opts.after === void 0 ? void 0 : parsePositiveIntArg2(opts.after, "--after");
-      await withConnectorsSetup(opts, async ({ client, signal }) => {
-        await runPollItems({
-          client,
-          filebox,
-          ...state !== void 0 ? { state } : {},
-          ...limit !== void 0 ? { limit } : {},
-          ...after !== void 0 ? { after } : {},
-          asJson: opts.json === true,
-          signal,
-          out: process.stdout
-        });
-      });
-    }
-  );
-  addCommonFlags(itemsCmd, "Output the raw page as JSON");
-  const retryCmd = poll2.command("retry").description("Queue a failed, waiting or skipped item again").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)").action(async (filebox, item, opts) => {
-    const itemId = parsePositiveIntArg2(item, "item id");
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollRetry({
-        client,
-        filebox,
-        itemId,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(retryCmd, "Output the item as JSON");
-  const skipCmd = addConfirmTokenFlag(
-    poll2.command("skip").description("Skip an item so it is never landed (two-step confirmation)").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)")
-  ).action(async (filebox, item, opts) => {
-    const itemId = parsePositiveIntArg2(item, "item id");
-    await preflightConfirmToken(
-      pollItemConfirmAction(filebox, itemId, scopeOf(opts)),
-      opts.confirmToken
-    );
-    await withConnectorsSetup(opts, async (setup) => {
-      await runPollSkip({
-        client: setup.client,
-        filebox,
-        itemId,
-        deadline: {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        },
-        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-        scope: scopeOf(opts),
-        targetArgs: targetArgsOf(opts),
-        asJson: opts.json === true,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(skipCmd, "Output the item as JSON");
-  const seedCmd = addConfirmTokenFlag(
-    poll2.command("seed").description(
-      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
-    ).argument("<filebox>", "filebox id or uuid").requiredOption(
-      "--until <timestamp>",
-      "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
-    ).option(
-      "--dry-run",
-      "count the already-discovered items it would mark, without changing anything",
-      false
-    ).addHelpText("after", `
-${POLL_CONFIRM_HELP}`)
-  ).action(
-    async (filebox, opts) => {
-      const until = parseTimestampFlag(opts.until, "--until");
-      const dryRun = opts.dryRun === true;
-      if (!dryRun) {
-        await preflightConfirmToken(
-          pollConfirmAction(filebox, "seed", scopeOf(opts), { until }),
-          opts.confirmToken
-        );
-      }
-      await withConnectorsSetup(opts, async (setup) => {
-        await runPollSeed({
-          client: setup.client,
-          filebox,
-          until,
-          untilArg: opts.until.trim(),
-          dryRun,
-          deadline: {
-            pause: () => setup.pauseTimeout(),
-            resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-          },
-          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-          scope: scopeOf(opts),
-          targetArgs: targetArgsOf(opts),
-          asJson: opts.json === true,
-          signal: setup.signal,
-          out: process.stdout
-        });
-      });
-    }
-  );
-  addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
-}
-
-// src/commands/connectorsTasks.ts
-import { readFileSync as readFileSync3 } from "fs";
-
-// src/api/scheduledTasks.ts
-var BASE2 = "/scheduled-tasks";
-async function call(method, path13, send, what) {
-  let out;
-  try {
-    out = await send();
-  } catch (err) {
-    throw toControlPlaneError(method, path13, err);
-  }
-  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
-  return out;
-}
-async function createTask(client, fields, reqOptions) {
-  return call(
-    "POST",
-    BASE2,
-    () => client.postJSON(BASE2, fields, reqOptions),
-    "task create"
-  );
-}
-async function listTasks(client, orgId, reqOptions) {
-  const path13 = orgId === void 0 ? BASE2 : `${BASE2}?org_id=${orgId}`;
-  return call("GET", path13, () => client.getJSON(path13, reqOptions), "task list");
-}
-async function getTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
-  return call("GET", path13, () => client.getJSON(path13, reqOptions), "task get");
-}
-async function updateTask(client, taskId, fields, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
-  return call(
-    "PATCH",
-    path13,
-    () => client.patchJSON(path13, fields, reqOptions),
-    "task update"
-  );
-}
-async function deleteTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
-  try {
-    await client.deleteJSON(path13, reqOptions);
-  } catch (err) {
-    throw toControlPlaneError("DELETE", path13, err);
-  }
-}
-async function runTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/run`;
-  return call(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task run"
-  );
-}
-async function pauseTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/pause`;
-  return call(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task pause"
-  );
-}
-async function resumeTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/resume`;
-  return call(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task resume"
-  );
-}
-async function listRuns(client, taskId, limit, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/runs?limit=${limit}`;
-  return call(
-    "GET",
-    path13,
-    () => client.getJSON(path13, reqOptions),
-    "task runs"
-  );
-}
-
-// src/commands/connectorsTasks.ts
-var DURATION_UNIT_SECONDS2 = { s: 1, m: 60, h: 3600, d: 86400 };
-var MIN_EVERY_SECONDS = 60;
-var MAX_EVERY_SECONDS = 2 ** 31 - 1;
-function parseEvery(raw2) {
-  const m = /^(\d+)([smhd])?$/.exec(raw2.trim());
-  const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS2[m[2] ?? "s"] ?? 1);
-  if (m === null)
-    throw new Error(`invalid --every "${raw2}": expected a duration like 5m, 1h or 1d`);
-  if (!Number.isSafeInteger(seconds) || seconds < MIN_EVERY_SECONDS || seconds > MAX_EVERY_SECONDS) {
-    throw new Error(`invalid --every "${raw2}": must be at least 1m`);
-  }
-  return seconds;
-}
-function parseCron(raw2) {
-  const fields = raw2.trim().split(/\s+/);
-  if (fields.length !== 5 || fields.some((f) => f === "")) {
-    throw new Error(`invalid --cron "${raw2}": expected five fields, e.g. "15 * * * *"`);
-  }
-  return fields.join(" ");
-}
-var ROLE_RE = /^[a-z][a-z_]*$/;
-var DATASOURCE_ID_RE = /^[0-9]{1,18}$/;
-function parseDatasources(values) {
-  const out = {};
-  for (const raw2 of values) {
-    const eq = raw2.indexOf("=");
-    const role = eq < 0 ? "" : raw2.slice(0, eq).trim();
-    const id = eq < 0 ? "" : raw2.slice(eq + 1).trim();
-    if (!ROLE_RE.test(role) || !DATASOURCE_ID_RE.test(id)) {
-      throw new Error(
-        `invalid --datasource "${raw2}": expected <role>=<datasource id>, e.g. target=4242 (role: lowercase letters and _; id: digits)`
-      );
-    }
-    if (Object.hasOwn(out, role)) throw new Error(`--datasource role "${role}" given twice`);
-    out[role] = id;
-  }
-  const count = Object.keys(out).length;
-  if (count < 1 || count > 4) throw new Error("give between 1 and 4 --datasource roles");
-  return out;
-}
-function parseConfig(raw2, readFile9 = readUtf8) {
-  const text2 = raw2.startsWith("@") ? readFile9(raw2.slice(1)) : raw2;
-  let parsed2;
-  try {
-    parsed2 = JSON.parse(text2);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`invalid --config JSON: ${msg}`);
-  }
-  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2)) {
-    throw new Error("invalid --config: expected a JSON object");
-  }
-  return parsed2;
-}
-function readUtf8(p) {
-  return readFileSync3(p, "utf-8");
-}
-function collect(value, previous = []) {
-  return [...previous, value];
-}
-function parseScheduleFlags(opts) {
-  if (opts.every !== void 0 && opts.cron !== void 0) {
-    throw new Error("give --every or --cron, not both");
-  }
-  const fields = {};
-  if (opts.artifact !== void 0) fields.artifact_name = opts.artifact;
-  if (opts.flavor !== void 0) fields.runtime_flavor = opts.flavor;
-  if (opts.datasource !== void 0) fields.datasources = parseDatasources(opts.datasource);
-  if (opts.primaryRole !== void 0) fields.primary_role = opts.primaryRole;
-  if (opts.config !== void 0) fields.config = parseConfig(opts.config);
-  if (opts.every !== void 0) fields.every_seconds = parseEvery(opts.every);
-  if (opts.cron !== void 0) fields.cron = parseCron(opts.cron);
-  if (opts.tz !== void 0) fields.timezone = opts.tz;
-  if (fields.primary_role !== void 0 && fields.datasources !== void 0) {
-    if (!Object.hasOwn(fields.datasources, fields.primary_role)) {
-      throw new Error(
-        `--primary-role "${fields.primary_role}" is not one of the --datasource roles`
-      );
-    }
-  }
-  return fields;
-}
-function buildCreateFields(name, orgId, opts) {
-  const missing = [
-    ["--artifact", opts.artifact],
-    ["--flavor", opts.flavor],
-    ["--datasource", opts.datasource],
-    ["--config", opts.config]
-  ].filter(([, v]) => v === void 0).map(([flag]) => flag);
-  if (opts.every === void 0 && opts.cron === void 0) missing.push("--every or --cron");
-  if (missing.length > 0) throw new Error(`missing ${missing.join(", ")}`);
-  const fields = parseScheduleFlags(opts);
-  return {
-    org_id: orgId,
-    name,
-    artifact_name: fields.artifact_name,
-    runtime_flavor: fields.runtime_flavor,
-    datasources: fields.datasources,
-    config: fields.config,
-    ...fields.primary_role !== void 0 ? { primary_role: fields.primary_role } : {},
-    ...fields.every_seconds !== void 0 ? { every_seconds: fields.every_seconds } : {},
-    ...fields.cron !== void 0 ? { cron: fields.cron } : {},
-    ...fields.timezone !== void 0 ? { timezone: fields.timezone } : {},
-    ...opts.disabled === true ? { enabled: false } : {}
-  };
-}
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function resolveTaskId(client, task, signal) {
-  if (UUID_RE.test(task)) return task;
-  const tasks = await listTasks(client, void 0, { signal });
-  const match = tasks.find((t) => t.name === task);
-  if (match === void 0) {
-    throw new Error(
-      `no scheduled task named "${task}" in this org (see: dr connectors tasks list)`
-    );
-  }
-  return match.id;
-}
-function explainTaskError(err) {
-  const forbidden = err instanceof ControlPlaneError && err.status === 403 || err instanceof Error && /\bHTTP 403\b/.test(err.message);
-  if (forbidden) {
-    const message = err instanceof Error ? err.message : String(err);
-    const body = err instanceof ControlPlaneError ? err.body : (/HTTP 403[^:]*(?:\([^)]*\))?:\s*([\s\S]*)$/.exec(message)?.[1] ?? "").trim();
-    return withCause(
-      new ControlPlaneError(
-        403,
-        body,
-        `${message}
-Scheduled tasks need a support user or an org admin: log in as one (--account) \u2014 e.g. dr login-as the customer's support user.`
-      ),
-      err
-    );
-  }
-  if (!(err instanceof ControlPlaneError)) return err;
-  const detail = detailOf(err.body);
-  if (err.status === 404) {
-    const message = `scheduled task not found (${detail || err.message})`;
-    return withCause(new ControlPlaneError(404, err.body, message), err);
-  }
-  if (err.status === 409 || err.status === 422) {
-    return withCause(new ControlPlaneError(err.status, err.body, detail || err.message), err);
-  }
-  return err;
-}
-function withCause(error, cause) {
-  Object.defineProperty(error, "cause", { value: cause, enumerable: false, configurable: true });
-  return error;
-}
-function detailOf(body) {
-  try {
-    const parsed2 = JSON.parse(body);
-    const d = parsed2.detail;
-    if (typeof d === "string") return d;
-    if (Array.isArray(d)) {
-      return d.map(
-        (e) => `${Array.isArray(e.loc) ? e.loc.slice(1).join(".") : ""}: ${e.msg ?? ""}`.trim()
-      ).join("; ");
-    }
-  } catch {
-  }
-  return body;
-}
-function scheduleText(t) {
-  if (t.schedule_kind === "cron") return `cron "${t.cron ?? ""}" ${t.timezone}`;
-  const s = t.every_seconds ?? 0;
-  const unit = s % 86400 === 0 ? `${s / 86400}d` : s % 3600 === 0 ? `${s / 3600}h` : s % 60 === 0 ? `${s / 60}m` : `${s}s`;
-  return `every ${unit}`;
-}
-function stateText(t) {
-  if (!t.enabled) return "disabled";
-  if (t.paused_reason !== null) return `paused (${t.paused_reason})`;
-  return t.running ? "running" : "enabled";
-}
-function writeTask(out, t) {
-  const roles = Object.entries(t.datasources).map(([role, id]) => `${role}=${id}${role === t.primary_role ? " (primary)" : ""}`).join(", ");
-  out.write(`Task:        ${t.name}  (${t.id})
-`);
-  out.write(`  Org:       ${t.org_id}
-`);
-  out.write(`  State:     ${stateText(t)}
-`);
-  out.write(`  Artifact:  ${t.artifact_name}  [${t.runtime_flavor}]
-`);
-  out.write(`  Schedule:  ${scheduleText(t)}
-`);
-  out.write(`  Next run:  ${t.next_run_at}
-`);
-  out.write(`  Last run:  ${t.last_run_at ?? "-"}  ${t.last_run_status ?? ""}
-`);
-  if (t.consecutive_failures > 0) out.write(`  Failures:  ${t.consecutive_failures} in a row
-`);
-  out.write(`  Datasources: ${roles}
-`);
-  out.write(`  Config:    ${truncate3(JSON.stringify(t.config), 200)}
-`);
-}
-function writeTaskList(out, tasks) {
-  if (tasks.length === 0) {
-    out.write("No scheduled tasks.\n");
-    return;
-  }
-  for (const t of tasks) {
-    out.write(
-      `${t.name.padEnd(28)} ${stateText(t).padEnd(20)} ${scheduleText(t).padEnd(26)} next ${t.next_run_at}  last ${t.last_run_status ?? "-"}  ${t.id}
-`
-    );
-  }
-}
-function writeRuns(out, runs) {
-  if (runs.length === 0) {
-    out.write("No runs yet.\n");
-    return;
-  }
-  for (const r of runs) {
-    const tail = r.error !== null ? `  error: ${truncate3(r.error, 160)}` : r.summary !== null ? `  ${truncate3(JSON.stringify(r.summary), 160)}` : "";
-    out.write(
-      `${r.started_at}  ${r.status.padEnd(15)} ${r.trigger.padEnd(8)} attempt ${r.attempt}  ${r.artifact_version ?? "-"}${tail}
-`
-    );
-  }
+    serverKey,
+    account: normaliseAccount(opts.account),
+    controlPlane: resolveConnectorsUrl(serverKey, opts.connectorsUrl)
+  };
 }
-function withFlags(cmd) {
-  cmd.option("--json", "Output raw JSON instead of a summary", false);
+function targetArgsOf(opts) {
+  const url = (opts.connectorsUrl ?? "").trim();
+  return ` --server ${resolveServer(opts.server)}${url === "" ? "" : ` --connectors-url ${url}`}`;
+}
+function addCommonFlags(cmd, jsonHelp) {
+  cmd.option("--json", jsonHelp, false);
   addServerFlag(cmd);
   addAccountFlag(cmd);
   addConnectorsUrlFlag(cmd);
-  return cmd;
 }
-function addScheduleFlags(cmd) {
-  return cmd.option("--artifact <name>", "published artifact name, e.g. sftp_export__daily_sales").option("--flavor <flavor>", "runner flavor the artifact was published for, e.g. sftp").option("--datasource <role=id>", "monolith datasource for a role (repeat per role)", collect).option(
-    "--primary-role <role>",
-    "the role passed as the primary datasource (default: the first)"
-  ).option("--config <json|@file>", "task config: a JSON object, or @path to a JSON file").option("--every <duration>", "run on an interval, e.g. 5m, 1h (at least 1m)").option("--cron <expr>", 'run on a five-field cron line, e.g. "15 * * * *"').option("--tz <iana>", "timezone the cron line is read in (default UTC)");
+function addConfirmTokenFlag(cmd) {
+  return cmd.option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed");
 }
-async function onTask(task, opts, act, print) {
-  await withConnectorsSetup(opts, async ({ client, signal }) => {
-    try {
-      const taskId = await resolveTaskId(client, task, signal);
-      const result = await act(client, taskId, signal);
-      if (opts.json === true) writeJSONIndented(process.stdout, result);
-      else print(process.stdout, result);
-    } catch (err) {
-      throw explainTaskError(err);
-    }
+function addSettingsFlags(cmd) {
+  return cmd.option("--interval <duration>", "how often to poll, 5m to 7d (default: per source)").option("--since <date>", "never pick up items modified before this date or timestamp").option("--lookback <days>", "window every poll lists, 1d to 3650d (default: per source)").option("--settle <duration>", "how long an item must stay unchanged before landing, 0s to 1d").option(
+    "--same-name <policy>",
+    "a changed file under the same name: new-version (lands again) or ignore"
+  );
+}
+function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.stdin, output: process.stderr }) {
+  return new Promise((resolvePrompt) => {
+    const rl = readline2.createInterface({
+      input: io.input,
+      output: io.output,
+      ...io.terminal !== void 0 ? { terminal: io.terminal } : {}
+    });
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      resolvePrompt(value);
+    };
+    rl.on("SIGINT", () => settle(null));
+    rl.on("close", () => settle(null));
+    io.output.write(`${message}
+`);
+    const question = defaultChoice === void 0 ? `[${choices.join("/")}]: ` : `[${choices.join("/")}] (Enter = ${defaultChoice}): `;
+    const askOnce = () => {
+      rl.question(question, (answer) => {
+        const picked = answer.trim().toLowerCase();
+        if (picked === "" && defaultChoice !== void 0) {
+          settle(defaultChoice);
+        } else if (choices.includes(picked)) {
+          settle(picked);
+        } else {
+          io.output.write(`Answer one of: ${choices.join(", ")}
+`);
+          askOnce();
+        }
+      });
+    };
+    askOnce();
   });
 }
-function registerConnectorsTasks(connectors) {
-  const tasks = connectors.command("tasks").description("DRIP scheduled tasks: run an artifact on a schedule (support user or org admin)");
-  withFlags(
-    addScheduleFlags(
-      tasks.command("create").description("Create a scheduled task").argument("<name>", "task name, unique in the org (a-z, 0-9, _ and -)").option("--org-id <id>", "org id (defaults to the JWT org)").option("--disabled", "create it disabled", false)
-    )
+var POLL_CONFIRM_HELP = [
+  "Confirmation:",
+  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
+  "  re-run the printed command, token included, to apply it.",
+  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
+  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
+  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
+  "  resume --source land) also asks a person to type a word in a dialog on production,",
+  "  even when the same set also seeds (--on-policy-change seed --widen land)."
+].join("\n");
+function registerConnectorsPoll(connectors) {
+  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
+${POLL_CONFIRM_HELP}`);
+  const enableCmd = addSettingsFlags(
+    poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
+  ).action(async (filebox, opts) => {
+    const settings = parseSettings(opts);
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await withMonolith(opts, async (monolith) => {
+        await runPollEnable({
+          client,
+          monolith,
+          filebox,
+          settings,
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    });
+  });
+  addCommonFlags(enableCmd, "Output the stored binding as JSON");
+  const setCmd = addConfirmTokenFlag(
+    addSettingsFlags(
+      poll2.command("set").description("Change polling settings (only the given flags change)").argument("<filebox>", "filebox id or uuid")
+    ).option(
+      "--widen <seed|land>",
+      "a wider window: seed (mark exposed items landed) or land them"
+    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
   ).action(
-    async (name, opts) => {
-      const explicitOrg = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
-      const parsed2 = buildCreateFields(name, explicitOrg ?? 0, opts);
-      await withConnectorsSetup(opts, async ({ client, signal }) => {
-        const fields = { ...parsed2, org_id: explicitOrg ?? client.getCurrentOrgId() };
-        try {
-          const t = await createTask(client, fields, { signal });
-          if (opts.json === true) writeJSONIndented(process.stdout, t);
-          else writeTask(process.stdout, t);
-        } catch (err) {
-          throw explainTaskError(err);
-        }
+    async (filebox, opts) => {
+      const changes = parseSettings(opts);
+      const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
+      const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
+          ...changes,
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
+        }),
+        opts.confirmToken
+      );
+      await withConnectorsSetup(opts, async (setup) => {
+        const deadline = {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        };
+        await runPollSet({
+          client: setup.client,
+          filebox,
+          changes,
+          settingsArgs: settingsArgs(opts),
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { onPolicyChange } : {},
+          interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
+          prompt: async (message, choices, defaultChoice) => {
+            deadline.pause();
+            try {
+              return await ttyChoicePrompt(message, choices, defaultChoice);
+            } finally {
+              deadline.resume();
+            }
+          },
+          deadline,
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
       });
     }
   );
-  withFlags(
-    tasks.command("list").description("List the org's scheduled tasks").option("--org-id <id>", "org id (defaults to the JWT org)")
-  ).action(async (opts) => {
+  addCommonFlags(setCmd, "Output the stored binding as JSON");
+  const disableCmd = poll2.command("disable").description("Stop polling (an item already in flight still finishes)").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
     await withConnectorsSetup(opts, async ({ client, signal }) => {
-      const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
-      try {
-        const list28 = await listTasks(client, orgId, { signal });
-        if (opts.json === true) writeJSONIndented(process.stdout, list28);
-        else writeTaskList(process.stdout, list28);
-      } catch (err) {
-        throw explainTaskError(err);
-      }
+      await runPollDisable({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
     });
   });
-  withFlags(
-    tasks.command("get").description("Show a scheduled task").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => getTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
-  );
-  withFlags(
-    addScheduleFlags(
-      tasks.command("update").description("Change a scheduled task (only the flags given change)").argument("<task>", "task id or name").option("--enable", "enable the task").option("--disable", "disable the task")
+  addCommonFlags(disableCmd, "Output the stored binding as JSON");
+  const getCmd = poll2.command("get").description("Show polling settings, last poll, pending seed / rekey and item counts").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollGet({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(getCmd, "Output the raw binding as JSON");
+  const runCmd = poll2.command("run").description("Poll now").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRun({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(runCmd, "Output the binding as JSON");
+  const resumeCmd = addConfirmTokenFlag(
+    poll2.command("resume").description("Resume a paused binding (after fixing credentials, or a source change)").argument("<filebox>", "filebox id or uuid").option(
+      "--source <seed|land>",
+      "after a source change: seed (mark present items landed) or land them"
     )
-  ).action(
-    async (task, opts) => {
-      if (opts.enable === true && opts.disable === true)
-        throw new Error("give --enable or --disable, not both");
-      const fields = parseScheduleFlags(opts);
-      if (opts.enable === true) fields.enabled = true;
-      if (opts.disable === true) fields.enabled = false;
-      if (Object.keys(fields).length === 0)
-        throw new Error("nothing to change: give at least one flag");
-      await onTask(
-        task,
-        opts,
-        (c, id, signal) => updateTask(c, id, fields, { signal }),
-        (o, r) => writeTask(o, r)
+  ).action(async (filebox, opts) => {
+    const source = opts.source === void 0 ? void 0 : parseChoice(opts.source, "--source", WIDEN_CHOICES);
+    if (source === "land") {
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, "resume-land", scopeOf(opts)),
+        opts.confirmToken
       );
     }
-  );
-  withFlags(
-    tasks.command("delete").description("Delete a scheduled task and its run history").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      async (c, id, signal) => {
-        await deleteTask(c, id, { signal });
-        return { deleted: id };
-      },
-      (o, r) => o.write(`Deleted scheduled task ${r.deleted}
-`)
-    )
-  );
-  withFlags(
-    tasks.command("run").description("Run a task now (does not move its schedule)").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => runTask(c, id, { signal }),
-      (o, r) => {
-        const run = r;
-        o.write(`Queued run ${run.id} (${run.status}); see: dr connectors tasks runs ${task}
-`);
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollResume({
+        client: setup.client,
+        filebox,
+        ...source !== void 0 ? { source } : {},
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(resumeCmd, "Output the binding as JSON");
+  const itemsCmd = poll2.command("items").description("List the item ledger: label, date, state, attempts, version, error").argument("<filebox>", "filebox id or uuid").option("--state <state>", `only items in this state (${POLL_ITEM_STATES.join("|")})`).option("--limit <n>", "page size (default and maximum: the control-plane page size, 100)").option("--after <id>", "start after this item id (the next-page cursor)").action(
+    async (filebox, opts) => {
+      const state = opts.state === void 0 ? void 0 : POLL_ITEM_STATES.find((s) => s === opts.state);
+      if (opts.state !== void 0 && state === void 0) {
+        throw new Error(
+          `invalid --state "${opts.state}": expected one of ${POLL_ITEM_STATES.join(", ")}`
+        );
       }
-    )
-  );
-  withFlags(
-    tasks.command("pause").description("Pause a scheduled task").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => pauseTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
-  );
-  withFlags(
-    tasks.command("resume").description("Resume a paused task (clears its failure count, schedules the next run)").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => resumeTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
+      const limit = opts.limit === void 0 ? void 0 : parsePositiveIntArg2(opts.limit, "--limit");
+      const after = opts.after === void 0 ? void 0 : parsePositiveIntArg2(opts.after, "--after");
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        await runPollItems({
+          client,
+          filebox,
+          ...state !== void 0 ? { state } : {},
+          ...limit !== void 0 ? { limit } : {},
+          ...after !== void 0 ? { after } : {},
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    }
   );
-  withFlags(
-    tasks.command("runs").description("A task's run history, newest first").argument("<task>", "task id or name").option("--limit <n>", "how many runs (1-200)", "20")
-  ).action(async (task, opts) => {
-    const limit = parsePositiveIntArg2(opts.limit, "--limit");
-    if (limit > 200) throw new Error("invalid --limit: at most 200");
-    await onTask(
-      task,
-      opts,
-      (c, id, signal) => listRuns(c, id, limit, { signal }),
-      (o, r) => writeRuns(o, r)
+  addCommonFlags(itemsCmd, "Output the raw page as JSON");
+  const retryCmd = poll2.command("retry").description("Queue a failed, waiting or skipped item again").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)").action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRetry({
+        client,
+        filebox,
+        itemId,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(retryCmd, "Output the item as JSON");
+  const skipCmd = addConfirmTokenFlag(
+    poll2.command("skip").description("Skip an item so it is never landed (two-step confirmation)").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)")
+  ).action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await preflightConfirmToken(
+      pollItemConfirmAction(filebox, itemId, scopeOf(opts)),
+      opts.confirmToken
     );
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollSkip({
+        client: setup.client,
+        filebox,
+        itemId,
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
   });
+  addCommonFlags(skipCmd, "Output the item as JSON");
+  const seedCmd = addConfirmTokenFlag(
+    poll2.command("seed").description(
+      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
+    ).argument("<filebox>", "filebox id or uuid").requiredOption(
+      "--until <timestamp>",
+      "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
+    ).option(
+      "--dry-run",
+      "count the already-discovered items it would mark, without changing anything",
+      false
+    ).addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
+  ).action(
+    async (filebox, opts) => {
+      const until = parseTimestampFlag(opts.until, "--until");
+      const dryRun = opts.dryRun === true;
+      if (!dryRun) {
+        await preflightConfirmToken(
+          pollConfirmAction(filebox, "seed", scopeOf(opts), { until }),
+          opts.confirmToken
+        );
+      }
+      await withConnectorsSetup(opts, async (setup) => {
+        await runPollSeed({
+          client: setup.client,
+          filebox,
+          until,
+          untilArg: opts.until.trim(),
+          dryRun,
+          deadline: {
+            pause: () => setup.pauseTimeout(),
+            resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+          },
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
 }
 
 // src/commands/connectors.ts
@@ -48523,6 +48767,7 @@ ${TLS_VPN_HELP}`);
   registerDevFetch(connectors);
   registerConnectorsPoll(connectors);
   registerConnectorsTasks(connectors);
+  registerConnectorsAws(connectors);
 }
 
 // src/types/dashboards.ts
@@ -53994,13 +54239,13 @@ async function runReport(cfg) {
 function collectFile(value, previous) {
   return previous.concat([value]);
 }
-async function withOnboardingClient(opts, run, setupOptions = {}) {
+async function withOnboardingClient(opts, run2, setupOptions = {}) {
   const { serverKey, host } = resolveOnboardingTarget(opts.server);
   const callOptions = {};
   if (setupOptions.timeoutMs !== void 0) callOptions.timeoutMs = setupOptions.timeoutMs;
   const setup = await setupCall(serverKey, opts.account, callOptions);
   try {
-    await run(setup.client, host, setup.signal);
+    await run2(setup.client, host, setup.signal);
   } finally {
     setup.cleanup();
   }
@@ -69431,8 +69676,8 @@ async function runExtractFromFiles(cfg) {
     const p = await preflightFile(f);
     parts.push({ blob: p.blob, filename: p.filename, sourcePath: f });
   }
-  const run = cfg.useAsync === false ? await extractSync(cfg, parts) : await extractAsync(cfg, parts);
-  const { results: allResults, sourceFiles, outcomes, abortedMidRun } = run;
+  const run2 = cfg.useAsync === false ? await extractSync(cfg, parts) : await extractAsync(cfg, parts);
+  const { results: allResults, sourceFiles, outcomes, abortedMidRun } = run2;
   await emitExtractionDraft(cfg, allResults, sourceFiles, outcomes, abortedMidRun);
 }
 async function extractAsync(cfg, parts) {
@@ -71550,8 +71795,8 @@ function querySuffix(domain) {
   if (domain === void 0 || domain === "") return "";
   return `?domain=${encodeURIComponent(domain)}`;
 }
-function required(out, call2) {
-  if (out === null) throw new Error(`${call2}: empty response body`);
+function required(out, call3) {
+  if (out === null) throw new Error(`${call3}: empty response body`);
   return out;
 }
 
@@ -73428,6 +73673,175 @@ function registerPalettesCommand(root) {
   addAccountFlag(createCmd);
 }
 
+// src/api/businessCalendars.ts
+function buildAuditQs(q) {
+  if (q === void 0) return "";
+  const sp = new URLSearchParams();
+  if (q.since !== void 0) sp.set("since", q.since);
+  if (q.until !== void 0) sp.set("until", q.until);
+  if (q.action !== void 0) sp.set("action", q.action);
+  if (q.actor_user_id !== void 0) sp.set("actor_user_id", String(q.actor_user_id));
+  if (q.page !== void 0) sp.set("page", String(q.page));
+  if (q.page_size !== void 0) sp.set("page_size", String(q.page_size));
+  const s = sp.toString();
+  return s === "" ? "" : `?${s}`;
+}
+async function listAudit(client, calendarId, query, options) {
+  if (calendarId === "") {
+    throw new Error("calendarId must be a non-empty string");
+  }
+  const path13 = `/api/business-calendar/v1/business-calendars/${encodeURIComponent(
+    calendarId
+  )}/audit${buildAuditQs(query)}`;
+  const out = await client.getJSON(path13, options);
+  if (out === null) {
+    return { count: 0, results: [] };
+  }
+  return out;
+}
+
+// src/commands/calendars.ts
+var KNOWN_ACTIONS = /* @__PURE__ */ new Set([
+  "create",
+  "edit",
+  "archive",
+  "restore",
+  "add_exception",
+  "remove_exception"
+]);
+function parseAuditAction(v) {
+  if (!KNOWN_ACTIONS.has(v)) {
+    throw new Error(`invalid --action "${v}" (expected one of: ${[...KNOWN_ACTIONS].join(", ")})`);
+  }
+  return v;
+}
+function parsePositiveInt4(flag, v) {
+  const n = Number(v);
+  if (!Number.isInteger(n) || String(n) !== v || n <= 0) {
+    throw new Error(`invalid ${flag} "${v}" (expected: positive integer)`);
+  }
+  return n;
+}
+async function runCalendarsAuditList(cfg) {
+  if (cfg.calendarId === "") {
+    throw new Error("<calendar_id> is required");
+  }
+  const resp = await listAudit(
+    cfg.client,
+    cfg.calendarId,
+    {
+      since: cfg.since,
+      until: cfg.until,
+      action: cfg.action,
+      actor_user_id: cfg.actorUserId,
+      page: cfg.page,
+      page_size: cfg.limit
+    },
+    { signal: cfg.signal }
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, resp);
+    return;
+  }
+  renderAuditTable(cfg.out, resp);
+}
+function writeTable44(out, rows) {
+  if (rows.length === 0) return;
+  const widths = [];
+  for (const r of rows) {
+    for (let i = 0; i < r.cells.length; i++) {
+      const cell = r.cells[i] ?? "";
+      if ((widths[i] ?? 0) < cell.length) widths[i] = cell.length;
+    }
+  }
+  for (const r of rows) {
+    const parts = [];
+    for (let i = 0; i < r.cells.length; i++) {
+      const cell = r.cells[i] ?? "";
+      if (i === r.cells.length - 1) {
+        parts.push(cell);
+      } else {
+        parts.push(cell.padEnd((widths[i] ?? 0) + 2, " "));
+      }
+    }
+    out.write(parts.join("") + "\n");
+  }
+}
+function renderActor(row) {
+  const email = row.actor.email ?? "";
+  return email === "" ? `#${row.actor.id}` : `${email} (#${row.actor.id})`;
+}
+function renderFieldSummary(row) {
+  const n = row.field_changes.length;
+  if (n === 0) return "(none)";
+  if (n === 1) return row.field_changes[0]?.field ?? "(1 field)";
+  return `${n} fields`;
+}
+function renderAuditTable(out, resp) {
+  if (resp.results.length === 0) {
+    out.write(`(no audit rows; count=${resp.count})
+`);
+    return;
+  }
+  const rows = [{ cells: ["ID", "TIMESTAMP", "ACTION", "VERSION", "ACTOR", "CHANGES"] }];
+  for (const r of resp.results) {
+    rows.push({
+      cells: [
+        String(r.id),
+        r.timestamp,
+        r.action,
+        String(r.resulting_version),
+        renderActor(r),
+        renderFieldSummary(r)
+      ]
+    });
+  }
+  writeTable44(out, rows);
+  if (resp.count > resp.results.length) {
+    out.write(`
+(showing ${resp.results.length} of ${resp.count}; use --limit / --page)
+`);
+  }
+}
+function registerCalendarsCommand(root) {
+  const cmd = root.command("calendars").description("Business-calendar (dr-business-calendar) operations");
+  const audit = cmd.command("audit").description("Calendar-change audit log (FR-L13)");
+  const listCmd = audit.command("list").description(
+    "List calendar-change audit rows for one calendar (GET /v1/business-calendars/{id}/audit; isAdminOrSuperAdmin)"
+  ).argument("<calendar_id>", "Calendar id (UUID, any non-empty string)").option("--since <ISO>", "Only rows at or after this ISO timestamp").option("--until <ISO>", "Only rows strictly before this ISO timestamp").option(
+    "--action <enum>",
+    "Only rows for one action: create | edit | archive | restore | add_exception | remove_exception"
+  ).option("--actor-user-id <id>", "Only rows written by this user id (positive integer)").option("--limit <N>", "Max rows per page (positive integer; server page_size)").option("--page <N>", "Page number (positive integer; defaults to server page 1)").option("--json", "Output raw JSON instead of a table", false).action(async (calendarId, opts) => {
+    if (calendarId === "") {
+      throw new Error("<calendar_id> is required");
+    }
+    const action = opts.action === void 0 ? void 0 : parseAuditAction(opts.action);
+    const actorUserId = opts.actorUserId === void 0 ? void 0 : parsePositiveInt4("--actor-user-id", opts.actorUserId);
+    const limit = opts.limit === void 0 ? void 0 : parsePositiveInt4("--limit", opts.limit);
+    const page = opts.page === void 0 ? void 0 : parsePositiveInt4("--page", opts.page);
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runCalendarsAuditList({
+        client: setup.client,
+        calendarId,
+        since: opts.since,
+        until: opts.until,
+        action,
+        actorUserId,
+        limit,
+        page,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(listCmd);
+  addAccountFlag(listCmd);
+}
+
 // src/commands/appSpace.ts
 import { buildRootCommand as buildAppSpaceRoot } from "@datarails-ai/dr-appspace-cli/dist/cli.js";
 function registerAppSpaceCommand(root) {
@@ -74041,6 +74455,7 @@ function buildRootCommand() {
   registerMultiProductCommand(root);
   registerDeskCommand(root);
   registerPalettesCommand(root);
+  registerCalendarsCommand(root);
   registerAppSpaceCommand(root);
   return root;
 }