@datarails-ai/dr-cli 1.6.152 → 1.6.154

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.152",
+  version: "1.6.154",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-22T10:56:58.559Z";
+var BUILD_TIME = "2026-10-22T15:15:19.668Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -4317,6 +4317,13 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // (`connector-poll|seed` / `|set-seed`, DR-55448).
   "connector-poll|set-land",
   "connector-poll|resume-land",
+  // connectors AWS role (dr connectors aws delete / rotate-external-id, DR-56412). A delete
+  // drops the role and its stored credentials; re-creating it mints a new external ID. A
+  // rotation discards the old external ID for good. Either way AWS refuses the connection
+  // until the customer edits their role's trust policy, the same outside-Datarails step as
+  // `integration|revoke`.
+  "aws-connection|delete",
+  "aws-connection|rotate-external-id",
   // Agent Studio (dr agents …, DR-55958). An agent's reach is not per-tenant: listing
   // offers it to every consumer, global makes it exist in every environment, and
   // visibility decides who sees it across this one, so each flip moves access for every
@@ -46546,1845 +46553,1993 @@ async function updateAwsConnection(client, id, fields, reqOptions) {
     "aws connection update"
   );
 }
-
-// src/commands/connectorsTasks.ts
-import { readFileSync as readFileSync3 } from "fs";
-
-// src/api/scheduledTasks.ts
-var BASE2 = "/scheduled-tasks";
-async function call2(method, path13, send, what) {
-  let out;
-  try {
-    out = await send();
-  } catch (err) {
-    throw toControlPlaneError(method, path13, err);
-  }
-  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
-  return out;
-}
-async function createTask(client, fields, reqOptions) {
-  return call2(
+async function rotateAwsExternalId(client, id, reqOptions) {
+  const path13 = `/aws-connections/${id}/rotate-external-id`;
+  return call(
     "POST",
-    BASE2,
-    () => client.postJSON(BASE2, fields, reqOptions),
-    "task create"
-  );
-}
-async function listTasks(client, orgId, reqOptions) {
-  const path13 = orgId === void 0 ? BASE2 : `${BASE2}?org_id=${orgId}`;
-  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task list");
-}
-async function getTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
-  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task get");
-}
-async function updateTask(client, taskId, fields, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
-  return call2(
-    "PATCH",
     path13,
-    () => client.patchJSON(path13, fields, reqOptions),
-    "task update"
+    () => client.postJSON(path13, {}, reqOptions),
+    "aws connection rotate-external-id"
   );
 }
-async function deleteTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+async function deleteAwsConnection(client, id, reqOptions) {
+  const path13 = `/aws-connections/${id}`;
   try {
     await client.deleteJSON(path13, reqOptions);
   } catch (err) {
     throw toControlPlaneError("DELETE", path13, err);
   }
 }
-async function runTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/run`;
-  return call2(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task run"
-  );
-}
-async function pauseTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/pause`;
-  return call2(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task pause"
-  );
-}
-async function resumeTask(client, taskId, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/resume`;
-  return call2(
-    "POST",
-    path13,
-    () => client.postJSON(path13, {}, reqOptions),
-    "task resume"
-  );
-}
-async function listRuns(client, taskId, limit, reqOptions) {
-  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/runs?limit=${limit}`;
-  return call2(
-    "GET",
-    path13,
-    () => client.getJSON(path13, reqOptions),
-    "task runs"
-  );
-}
 
-// src/commands/connectorsTasks.ts
+// src/commands/connectorsPoll.ts
+import * as readline2 from "readline";
+import { createHash as createHash12 } from "crypto";
+
+// src/types/connectors.ts
+var POLL_ITEM_STATES = [
+  "seen",
+  "new",
+  "dispatched",
+  "running",
+  "retry_wait",
+  "landed",
+  "failed",
+  "skipped",
+  "seeded",
+  "superseded"
+];
+
+// src/commands/connectorsPoll.ts
 var DURATION_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
-var MIN_EVERY_SECONDS = 60;
-var MAX_EVERY_SECONDS = 2 ** 31 - 1;
-function parseEvery(raw2) {
+var DURATION_BOUNDS = {
+  "--interval": [300, 7 * 86400],
+  "--settle": [0, 86400]
+};
+var LOOKBACK_MAX_DAYS = 3650;
+function parseDurationSeconds(raw2, flag) {
   const m = /^(\d+)([smhd])?$/.exec(raw2.trim());
   const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS[m[2] ?? "s"] ?? 1);
-  if (m === null)
-    throw new Error(`invalid --every "${raw2}": expected a duration like 5m, 1h or 1d`);
-  if (!Number.isSafeInteger(seconds) || seconds < MIN_EVERY_SECONDS || seconds > MAX_EVERY_SECONDS) {
-    throw new Error(`invalid --every "${raw2}": must be at least 1m`);
+  const [min, max] = DURATION_BOUNDS[flag] ?? [0, Number.MAX_SAFE_INTEGER];
+  if (m === null) {
+    throw new Error(`invalid ${flag} "${raw2}": expected a duration like 90s, 5m or 1h`);
+  }
+  if (!Number.isSafeInteger(seconds) || seconds < min || seconds > max) {
+    throw new Error(
+      `invalid ${flag} "${raw2}": must be between ${formatSeconds(min)} and ${formatSeconds(max)}`
+    );
   }
   return seconds;
 }
-function parseCron(raw2) {
-  const fields = raw2.trim().split(/\s+/);
-  if (fields.length !== 5 || fields.some((f) => f === "")) {
-    throw new Error(`invalid --cron "${raw2}": expected five fields, e.g. "15 * * * *"`);
+function parseLookbackDays(raw2) {
+  const m = /^(\d+)d?$/.exec(raw2.trim());
+  const days = m === null ? 0 : Number(m[1]);
+  if (days < 1 || days > LOOKBACK_MAX_DAYS) {
+    throw new Error(
+      `invalid --lookback "${raw2}": must be between 1 and ${LOOKBACK_MAX_DAYS} days, e.g. 180d`
+    );
   }
-  return fields.join(" ");
+  return days;
 }
-var ROLE_RE = /^[a-z][a-z_]*$/;
-var DATASOURCE_ID_RE = /^[0-9]{1,18}$/;
-function parseDatasources(values) {
-  const out = {};
-  for (const raw2 of values) {
-    const eq = raw2.indexOf("=");
-    const role = eq < 0 ? "" : raw2.slice(0, eq).trim();
-    const id = eq < 0 ? "" : raw2.slice(eq + 1).trim();
-    if (!ROLE_RE.test(role) || !DATASOURCE_ID_RE.test(id)) {
-      throw new Error(
-        `invalid --datasource "${raw2}": expected <role>=<datasource id>, e.g. target=4242 (role: lowercase letters and _; id: digits)`
-      );
-    }
-    if (Object.hasOwn(out, role)) throw new Error(`--datasource role "${role}" given twice`);
-    out[role] = id;
-  }
-  const count = Object.keys(out).length;
-  if (count < 1 || count > 4) throw new Error("give between 1 and 4 --datasource roles");
-  return out;
+var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+var DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
+function inRange(value, max, min = 0) {
+  const n = Number(value ?? "0");
+  return n >= min && n <= max;
 }
-function parseConfig(raw2, readFile10 = readUtf8) {
-  const text2 = raw2.startsWith("@") ? readFile10(raw2.slice(1)) : raw2;
-  let parsed2;
-  try {
-    parsed2 = JSON.parse(text2);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`invalid --config JSON: ${msg}`);
-  }
-  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2)) {
-    throw new Error("invalid --config: expected a JSON object");
-  }
-  return parsed2;
+function isCalendarDay(y, m, d) {
+  if (!inRange(m, 12, 1)) return false;
+  const daysInMonth3 = new Date(Date.UTC(Number(y), Number(m), 0)).getUTCDate();
+  return inRange(d, daysInMonth3, 1);
 }
-function readUtf8(p) {
-  return readFileSync3(p, "utf-8");
+function parseTimestampFlag(raw2, flag) {
+  const invalid = new Error(
+    `invalid ${flag} "${raw2}": expected YYYY-MM-DD or a timestamp with a zone (e.g. 2026-10-08T17:30:00+03:00)`
+  );
+  const value = raw2.trim();
+  const dateOnly = DATE_ONLY_RE.exec(value);
+  if (dateOnly !== null) {
+    if (!isCalendarDay(dateOnly[1], dateOnly[2], dateOnly[3])) throw invalid;
+    return (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString();
+  }
+  const dt = DATE_TIME_RE.exec(value);
+  const valid = dt !== null && isCalendarDay(dt[1], dt[2], dt[3]) && inRange(dt[4], 23) && inRange(dt[5], 59) && inRange(dt[6], 59) && inRange(dt[7], 23) && inRange(dt[8], 59);
+  const ms = valid ? Date.parse(value) : NaN;
+  if (Number.isNaN(ms)) throw invalid;
+  return new Date(ms).toISOString();
 }
-function collect(value, previous = []) {
-  return [...previous, value];
+function parseSameName(raw2) {
+  if (raw2 === "new-version") return "new_version";
+  if (raw2 === "ignore") return "ignore";
+  throw new Error(`--same-name must be new-version or ignore (got "${raw2}")`);
 }
-function parseScheduleFlags(opts) {
-  if (opts.every !== void 0 && opts.cron !== void 0) {
-    throw new Error("give --every or --cron, not both");
+function parseChoice(raw2, flag, choices) {
+  const match = choices.find((c) => c === raw2);
+  if (match === void 0) {
+    throw new Error(`${flag} must be ${choices.join(" or ")} (got "${raw2}")`);
   }
+  return match;
+}
+var WIDEN_CHOICES = ["seed", "land"];
+var POLICY_CHOICES = ["rekey", "seed", "land"];
+function parseSettings(opts) {
   const fields = {};
-  if (opts.artifact !== void 0) fields.artifact_name = opts.artifact;
-  if (opts.flavor !== void 0) fields.runtime_flavor = opts.flavor;
-  if (opts.datasource !== void 0) fields.datasources = parseDatasources(opts.datasource);
-  if (opts.primaryRole !== void 0) fields.primary_role = opts.primaryRole;
-  if (opts.config !== void 0) fields.config = parseConfig(opts.config);
-  if (opts.every !== void 0) fields.every_seconds = parseEvery(opts.every);
-  if (opts.cron !== void 0) fields.cron = parseCron(opts.cron);
-  if (opts.tz !== void 0) fields.timezone = opts.tz;
-  if (fields.primary_role !== void 0 && fields.datasources !== void 0) {
-    if (!Object.hasOwn(fields.datasources, fields.primary_role)) {
-      throw new Error(
-        `--primary-role "${fields.primary_role}" is not one of the --datasource roles`
-      );
-    }
+  if (opts.interval !== void 0) {
+    fields.interval_seconds = parseDurationSeconds(opts.interval, "--interval");
   }
+  if (opts.since !== void 0) fields.since = parseTimestampFlag(opts.since, "--since");
+  if (opts.lookback !== void 0) fields.lookback_days = parseLookbackDays(opts.lookback);
+  if (opts.settle !== void 0) {
+    fields.settle_seconds = parseDurationSeconds(opts.settle, "--settle");
+  }
+  if (opts.sameName !== void 0) fields.change_policy = parseSameName(opts.sameName);
   return fields;
 }
-function buildCreateFields(name, orgId, opts) {
-  const missing = [
-    ["--artifact", opts.artifact],
-    ["--flavor", opts.flavor],
-    ["--datasource", opts.datasource],
-    ["--config", opts.config]
-  ].filter(([, v]) => v === void 0).map(([flag]) => flag);
-  if (opts.every === void 0 && opts.cron === void 0) missing.push("--every or --cron");
-  if (missing.length > 0) throw new Error(`missing ${missing.join(", ")}`);
-  const fields = parseScheduleFlags(opts);
-  return {
-    org_id: orgId,
-    name,
-    artifact_name: fields.artifact_name,
-    runtime_flavor: fields.runtime_flavor,
-    datasources: fields.datasources,
-    config: fields.config,
-    ...fields.primary_role !== void 0 ? { primary_role: fields.primary_role } : {},
-    ...fields.every_seconds !== void 0 ? { every_seconds: fields.every_seconds } : {},
-    ...fields.cron !== void 0 ? { cron: fields.cron } : {},
-    ...fields.timezone !== void 0 ? { timezone: fields.timezone } : {},
-    ...opts.disabled === true ? { enabled: false } : {}
-  };
+function settingsArgs(opts) {
+  const pairs = [
+    ["--interval", opts.interval],
+    ["--since", opts.since],
+    ["--lookback", opts.lookback],
+    ["--settle", opts.settle],
+    ["--same-name", opts.sameName]
+  ];
+  return pairs.filter((p) => p[1] !== void 0).map(([flag, value]) => ` ${flag} ${value.trim()}`).join("");
 }
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function resolveTaskId(client, task, signal) {
-  if (UUID_RE.test(task)) return task;
-  const tasks = await listTasks(client, void 0, { signal });
-  const match = tasks.find((t) => t.name === task);
-  if (match === void 0) {
+async function resolvePollBinding(client, filebox, signal) {
+  const wanted = filebox.trim();
+  const byId = /^\d+$/.test(wanted);
+  const rows = await listQueries(client, { signal });
+  const matches = rows.filter(
+    (q) => byId ? q.filebox_id === Number(wanted) : q.filebox_uuid.toLowerCase() === wanted.toLowerCase()
+  );
+  const [first] = matches;
+  if (first === void 0) {
     throw new Error(
-      `no scheduled task named "${task}" in this org (see: dr connectors tasks list)`
-    );
-  }
-  return match.id;
-}
-function explainTaskError(err) {
-  const forbidden = err instanceof ControlPlaneError && err.status === 403 || err instanceof Error && /\bHTTP 403\b/.test(err.message);
-  if (forbidden) {
-    const message = err instanceof Error ? err.message : String(err);
-    const body = err instanceof ControlPlaneError ? err.body : (/HTTP 403[^:]*(?:\([^)]*\))?:\s*([\s\S]*)$/.exec(message)?.[1] ?? "").trim();
-    return withCause(
-      new ControlPlaneError(
-        403,
-        body,
-        `${message}
-Scheduled tasks need a support user or an org admin: log in as one (--account) \u2014 e.g. dr login-as the customer's support user.`
-      ),
-      err
+      `no connector binding for filebox ${wanted} in this org (see dr connectors query list)`
     );
   }
-  if (!(err instanceof ControlPlaneError)) return err;
-  const detail = detailOf(err.body);
-  if (err.status === 404) {
-    const message = `scheduled task not found (${detail || err.message})`;
-    return withCause(new ControlPlaneError(404, err.body, message), err);
-  }
-  if (err.status === 409 || err.status === 422) {
-    return withCause(new ControlPlaneError(err.status, err.body, detail || err.message), err);
+  if (matches.length > 1) {
+    const ids = matches.map((q) => `#${q.query_id}`).join(", ");
+    throw new Error(`filebox ${wanted} has several connector bindings (${ids})`);
   }
-  return err;
+  return first;
 }
-function withCause(error, cause) {
-  Object.defineProperty(error, "cause", { value: cause, enumerable: false, configurable: true });
-  return error;
+function isNotPolled(err) {
+  return err instanceof ControlPlaneError && err.status === 404 && err.body.includes("not polled");
 }
-function detailOf(body) {
+function isPollThrottled(err) {
+  return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
+}
+async function explainNotPolled(filebox, call3) {
   try {
-    const parsed2 = JSON.parse(body);
-    const d = parsed2.detail;
-    if (typeof d === "string") return d;
-    if (Array.isArray(d)) {
-      return d.map(
-        (e) => `${Array.isArray(e.loc) ? e.loc.slice(1).join(".") : ""}: ${e.msg ?? ""}`.trim()
-      ).join("; ");
+    return await call3;
+  } catch (err) {
+    if (isNotPolled(err)) {
+      throw new Error(
+        `filebox ${filebox} is not set to polled ingestion; run dr connectors poll enable ${filebox}`,
+        { cause: err }
+      );
     }
-  } catch {
+    throw err;
   }
-  return body;
 }
-function scheduleText(t) {
-  if (t.schedule_kind === "cron") return `cron "${t.cron ?? ""}" ${t.timezone}`;
-  const s = t.every_seconds ?? 0;
-  const unit = s % 86400 === 0 ? `${s / 86400}d` : s % 3600 === 0 ? `${s / 3600}h` : s % 60 === 0 ? `${s / 60}m` : `${s}s`;
-  return `every ${unit}`;
+async function readFileboxDateTag(monolith, fileboxId, signal) {
+  const details = await getDetails(monolith, fileboxId, { signal });
+  const dateTags = (details.tags_config ?? []).filter((t) => t.type === "DATE");
+  const [only] = dateTags;
+  if (only === void 0) return {};
+  if (dateTags.length > 1) {
+    const names = dateTags.map((t) => t.name).join(", ");
+    throw new Error(
+      `filebox ${fileboxId} has several DATE tags (${names}); a polled filebox needs exactly one`
+    );
+  }
+  return { id: only.id, name: only.name };
 }
-function stateText(t) {
-  if (!t.enabled) return "disabled";
-  if (t.paused_reason !== null) return `paused (${t.paused_reason})`;
-  return t.running ? "running" : "enabled";
+function formatSeconds(sec) {
+  if (sec > 0 && sec % 86400 === 0) return `${sec / 86400}d`;
+  if (sec > 0 && sec % 3600 === 0) return `${sec / 3600}h`;
+  if (sec > 0 && sec % 60 === 0) return `${sec / 60}m`;
+  return `${sec}s`;
 }
-function writeTask(out, t) {
-  const roles = Object.entries(t.datasources).map(([role, id]) => `${role}=${id}${role === t.primary_role ? " (primary)" : ""}`).join(", ");
-  out.write(`Task:        ${t.name}  (${t.id})
-`);
-  out.write(`  Org:       ${t.org_id}
-`);
-  out.write(`  State:     ${stateText(t)}
-`);
-  out.write(`  Artifact:  ${t.artifact_name}  [${t.runtime_flavor}]
-`);
-  out.write(`  Schedule:  ${scheduleText(t)}
-`);
-  out.write(`  Next run:  ${t.next_run_at}
-`);
-  out.write(`  Last run:  ${t.last_run_at ?? "-"}  ${t.last_run_status ?? ""}
-`);
-  if (t.consecutive_failures > 0) out.write(`  Failures:  ${t.consecutive_failures} in a row
-`);
-  out.write(`  Datasources: ${roles}
+function oneLine3(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function sameNameLabel(policy) {
+  return policy === "new_version" ? "new-version" : String(policy);
+}
+function formatDateTag(tag) {
+  if (tag?.id === void 0) return "none (undated filebox)";
+  return `${tag.name ?? "?"} (id ${tag.id})`;
+}
+function bindingTarget(binding) {
+  return `filebox ${binding.filebox_uuid} (query #${binding.query_id})`;
+}
+function renderPoll(out, headline, binding, p) {
+  const row = (label, value) => {
+    out.write(`  ${`${label}:`.padEnd(15)}${value}
 `);
-  out.write(`  Config:    ${truncate3(JSON.stringify(t.config), 200)}
+  };
+  const status2 = `${p.enabled ? "enabled" : "disabled"}${p.paused_reason === null ? "" : `, paused: ${oneLine3(p.paused_reason)}`}`;
+  const counts = Object.entries(p.counts).sort(([a], [b]) => a.localeCompare(b)).map(([state, n]) => `${state}=${n}`).join("  ");
+  out.write(`${headline} for ${bindingTarget(binding)}
 `);
+  row("Status", status2);
+  row("Interval", formatSeconds(p.interval_seconds));
+  row("Date tag", formatDateTag(p.date_tag));
+  row("Since", p.since ?? "-");
+  row("Lookback", `${p.lookback_days}d`);
+  row("Settle", formatSeconds(p.settle_seconds));
+  row("Same name", sameNameLabel(p.change_policy));
+  row("Max attempts", String(p.max_attempts));
+  row("Last poll", `${p.last_poll_at ?? "-"} ${oneLine3(p.last_poll_status ?? "")}`.trimEnd());
+  row("Next poll", p.next_poll_at);
+  row("Failures", String(p.consecutive_failures));
+  row("Discover", p.discover_in_flight ? `in flight since ${p.discover_sent_at ?? "?"}` : "-");
+  row("Last digest", p.last_digest ?? "-");
+  row("Pending seed", p.poll_run_seed_until ?? "-");
+  row(
+    "Pending rekey",
+    p.poll_run_rekey_to === null ? "-" : `to ${sameNameLabel(p.poll_run_rekey_to)}`
+  );
+  row("Items", counts === "" ? "(none)" : counts);
 }
-function writeTaskList(out, tasks) {
-  if (tasks.length === 0) {
-    out.write("No scheduled tasks.\n");
-    return;
+function writeTable26(out, rows) {
+  const widths = [];
+  for (const r of rows) {
+    r.forEach((cell, i) => {
+      widths[i] = Math.max(widths[i] ?? 0, cell.length);
+    });
   }
-  for (const t of tasks) {
-    out.write(
-      `${t.name.padEnd(28)} ${stateText(t).padEnd(20)} ${scheduleText(t).padEnd(26)} next ${t.next_run_at}  last ${t.last_run_status ?? "-"}  ${t.id}
-`
+  for (const r of rows) {
+    const cells = r.map(
+      (cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)
     );
+    out.write(`${cells.join("").trimEnd()}
+`);
   }
 }
-function writeRuns(out, runs) {
-  if (runs.length === 0) {
-    out.write("No runs yet.\n");
-    return;
+function renderItemTable(out, items) {
+  const rows = [["ID", "LABEL", "DATE", "STATE", "ATTEMPTS", "VERSION", "ERROR"]];
+  for (const it of items) {
+    const error = it.last_error ?? (it.skip_reason === null ? null : `skipped: ${it.skip_reason}`);
+    rows.push([
+      String(it.id),
+      oneLine3(it.label),
+      it.item_date ?? "-",
+      it.state,
+      String(it.attempts),
+      it.version_id === null ? "-" : String(it.version_id),
+      error === null ? "-" : truncate3(oneLine3(error), 80)
+    ]);
   }
-  for (const r of runs) {
-    const tail = r.error !== null ? `  error: ${truncate3(r.error, 160)}` : r.summary !== null ? `  ${truncate3(JSON.stringify(r.summary), 160)}` : "";
-    out.write(
-      `${r.started_at}  ${r.status.padEnd(15)} ${r.trigger.padEnd(8)} attempt ${r.attempt}  ${r.artifact_version ?? "-"}${tail}
-`
+  writeTable26(out, rows);
+}
+async function runPollEnable(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  let existing;
+  try {
+    existing = await getPoll(cfg.client, binding.query_id, { signal: cfg.signal });
+  } catch (err) {
+    if (!isNotPolled(err)) throw err;
+    existing = null;
+  }
+  const s = cfg.settings;
+  if (existing !== null && (s.since !== void 0 || s.lookback_days !== void 0 || s.change_policy !== void 0)) {
+    throw new Error(
+      `filebox ${cfg.filebox} is already polled; change --since, --lookback or --same-name with dr connectors poll set ${cfg.filebox}, which asks what to do with a wider window or a policy switch`
     );
   }
+  if (binding.filebox_id <= 0) {
+    throw new Error(
+      `connector-query #${binding.query_id} has no filebox id recorded, so its date tag cannot be read; record it with dr connectors query repoint ${binding.query_id} --filebox-id <id>`
+    );
+  }
+  const dateTag = await readFileboxDateTag(cfg.monolith, binding.filebox_id, cfg.signal);
+  const stored = await putPoll(
+    cfg.client,
+    binding.query_id,
+    { enabled: true, date_tag: dateTag, ...s },
+    { signal: cfg.signal }
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, stored);
+    return;
+  }
+  renderPoll(cfg.out, "Polling enabled", binding, stored);
 }
-function withFlags(cmd) {
-  cmd.option("--json", "Output raw JSON instead of a summary", false);
-  addServerFlag(cmd);
-  addAccountFlag(cmd);
-  addConnectorsUrlFlag(cmd);
-  return cmd;
-}
-function addScheduleFlags(cmd) {
-  return cmd.option("--artifact <name>", "published artifact name, e.g. sftp_export__daily_sales").option("--flavor <flavor>", "runner flavor the artifact was published for, e.g. sftp").option("--datasource <role=id>", "monolith datasource for a role (repeat per role)", collect).option(
-    "--primary-role <role>",
-    "the role passed as the primary datasource (default: the first)"
-  ).option("--config <json|@file>", "task config: a JSON object, or @path to a JSON file").option("--every <duration>", "run on an interval, e.g. 5m, 1h (at least 1m)").option("--cron <expr>", 'run on a five-field cron line, e.g. "15 * * * *"').option("--tz <iana>", "timezone the cron line is read in (default UTC)");
+function windowStart(since, lookbackDays, now) {
+  const start = now - lookbackDays * 864e5;
+  return since === null ? start : Math.max(start, Date.parse(since));
 }
-async function onTask(task, opts, act, print) {
-  await withConnectorsSetup(opts, async ({ client, signal }) => {
-    try {
-      const taskId = await resolveTaskId(client, task, signal);
-      const result = await act(client, taskId, signal);
-      if (opts.json === true) writeJSONIndented(process.stdout, result);
-      else print(process.stdout, result);
-    } catch (err) {
-      throw explainTaskError(err);
-    }
-  });
+function widening(current, changes, now) {
+  if (changes.since === void 0 && changes.lookback_days === void 0) return null;
+  const from = windowStart(current.since, current.lookback_days, now);
+  const to = windowStart(
+    changes.since ?? current.since,
+    changes.lookback_days ?? current.lookback_days,
+    now
+  );
+  if (to >= from) return null;
+  return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
 }
-function registerConnectorsTasks(connectors) {
-  const tasks = connectors.command("tasks").description("DRIP scheduled tasks: run an artifact on a schedule (support user or org admin)");
-  withFlags(
-    addScheduleFlags(
-      tasks.command("create").description("Create a scheduled task").argument("<name>", "task name, unique in the org (a-z, 0-9, _ and -)").option("--org-id <id>", "org id (defaults to the JWT org)").option("--disabled", "create it disabled", false)
-    )
-  ).action(
-    async (name, opts) => {
-      const explicitOrg = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
-      const parsed2 = buildCreateFields(name, explicitOrg ?? 0, opts);
-      await withConnectorsSetup(opts, async ({ client, signal }) => {
-        const fields = { ...parsed2, org_id: explicitOrg ?? client.getCurrentOrgId() };
-        try {
-          const t = await createTask(client, fields, { signal });
-          if (opts.json === true) writeJSONIndented(process.stdout, t);
-          else writeTask(process.stdout, t);
-        } catch (err) {
-          throw explainTaskError(err);
-        }
-      });
-    }
+async function ask(cfg, message, choices, defaultChoice) {
+  const answer = await cfg.prompt(message, choices, defaultChoice);
+  if (answer === null) throw new Error("poll set cancelled; nothing was changed");
+  return parseChoice(answer, "the answer", choices);
+}
+var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
+var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
+function pollSetConfirmVerb(widen, onPolicyChange) {
+  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+}
+async function runPollSet(cfg) {
+  if (Object.keys(cfg.changes).length === 0) {
+    throw new Error(
+      "poll set: pass at least one of --interval, --since, --lookback, --settle, --same-name"
+    );
+  }
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const current = await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
   );
-  withFlags(
-    tasks.command("list").description("List the org's scheduled tasks").option("--org-id <id>", "org id (defaults to the JWT org)")
-  ).action(async (opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
-      try {
-        const list28 = await listTasks(client, orgId, { signal });
-        if (opts.json === true) writeJSONIndented(process.stdout, list28);
-        else writeTaskList(process.stdout, list28);
-      } catch (err) {
-        throw explainTaskError(err);
-      }
+  const body = { ...cfg.changes };
+  const detail = [`target:      ${bindingTarget(binding)}`];
+  const wider = widening(current, cfg.changes, cfg.now ?? Date.now());
+  if (wider !== null) {
+    const what = `the polling window widens (start ${wider.from} -> ${wider.to})`;
+    if (cfg.widen === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --widen seed or --widen land (${WIDEN_HELP})`);
+    }
+    body.widen = cfg.widen ?? await ask(cfg, `${what}. ${WIDEN_HELP}.`, WIDEN_CHOICES);
+    detail.push(`window:      start ${wider.from} -> ${wider.to}, widen ${body.widen}`);
+  } else if (cfg.widen !== void 0) {
+    body.widen = cfg.widen;
+  }
+  const newPolicy = cfg.changes.change_policy;
+  const policySwitch = newPolicy !== void 0 && newPolicy !== current.change_policy;
+  if (policySwitch) {
+    const change = `${sameNameLabel(current.change_policy)} -> ${sameNameLabel(newPolicy)}`;
+    const what = `--same-name changes ${change}`;
+    if (cfg.onPolicyChange === void 0 && !cfg.interactive) {
+      throw new Error(`${what}; pass --on-policy-change rekey, seed or land (${POLICY_HELP})`);
+    }
+    body.on_policy_change = cfg.onPolicyChange ?? await ask(cfg, `${what}. ${POLICY_HELP}.`, POLICY_CHOICES, "rekey");
+    detail.push(`same name:   ${change}, on policy change ${body.on_policy_change}`);
+  } else if (cfg.onPolicyChange !== void 0) {
+    body.on_policy_change = cfg.onPolicyChange;
+  }
+  const put = async () => {
+    const stored = await putPoll(cfg.client, binding.query_id, body, {
+      signal: cfg.signal
     });
-  });
-  withFlags(
-    tasks.command("get").description("Show a scheduled task").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => getTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
-  );
-  withFlags(
-    addScheduleFlags(
-      tasks.command("update").description("Change a scheduled task (only the flags given change)").argument("<task>", "task id or name").option("--enable", "enable the task").option("--disable", "disable the task")
-    )
-  ).action(
-    async (task, opts) => {
-      if (opts.enable === true && opts.disable === true)
-        throw new Error("give --enable or --disable, not both");
-      const fields = parseScheduleFlags(opts);
-      if (opts.enable === true) fields.enabled = true;
-      if (opts.disable === true) fields.enabled = false;
-      if (Object.keys(fields).length === 0)
-        throw new Error("nothing to change: give at least one flag");
-      await onTask(
-        task,
-        opts,
-        (c, id, signal) => updateTask(c, id, fields, { signal }),
-        (o, r) => writeTask(o, r)
-      );
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, stored);
+      return;
     }
+    renderPoll(cfg.out, "Polling settings updated", binding, stored);
+  };
+  const landsOrHides = wider !== null && body.widen === "land" || policySwitch && (body.on_policy_change === "seed" || body.on_policy_change === "land");
+  if (!landsOrHides) {
+    await put();
+    return;
+  }
+  const flags = `${body.widen === void 0 ? "" : ` --widen ${body.widen}`}${body.on_policy_change === void 0 ? "" : ` --on-policy-change ${body.on_policy_change}`}`;
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(
+      cfg.filebox,
+      pollSetConfirmVerb(body.widen, body.on_policy_change),
+      cfg.scope,
+      { ...body }
+    ),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll set ${cfg.filebox}${cfg.settingsArgs}${flags}${cfg.targetArgs}`,
+    describe: async () => detail,
+    execute: async () => {
+      cfg.deadline?.resume();
+      await put();
+    }
+  });
+}
+function confirmDigest(scope, payload) {
+  const canonical = JSON.stringify({
+    server: scope.serverKey,
+    account: scope.account ?? "",
+    controlPlane: scope.controlPlane,
+    payload: Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a.localeCompare(b)))
+  });
+  return createHash12("sha256").update(canonical).digest("hex").slice(0, 12);
+}
+function pollConfirmAction(filebox, verb, scope, payload = {}) {
+  return {
+    resource: "connector-poll",
+    id: `${filebox.trim()}#${confirmDigest(scope, payload)}`,
+    verb
+  };
+}
+function pollItemConfirmAction(filebox, item, scope) {
+  return {
+    resource: "connector-poll-item",
+    id: `${filebox.trim()}/${item}#${confirmDigest(scope, {})}`,
+    verb: "skip"
+  };
+}
+async function runPollDisable(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
   );
-  withFlags(
-    tasks.command("delete").description("Delete a scheduled task and its run history").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      async (c, id, signal) => {
-        await deleteTask(c, id, { signal });
-        return { deleted: id };
-      },
-      (o, r) => o.write(`Deleted scheduled task ${r.deleted}
-`)
-    )
-  );
-  withFlags(
-    tasks.command("run").description("Run a task now (does not move its schedule)").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => runTask(c, id, { signal }),
-      (o, r) => {
-        const run2 = r;
-        o.write(`Queued run ${run2.id} (${run2.status}); see: dr connectors tasks runs ${task}
-`);
-      }
-    )
-  );
-  withFlags(
-    tasks.command("pause").description("Pause a scheduled task").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => pauseTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
+  const stored = await putPoll(
+    cfg.client,
+    binding.query_id,
+    { enabled: false },
+    { signal: cfg.signal }
   );
-  withFlags(
-    tasks.command("resume").description("Resume a paused task (clears its failure count, schedules the next run)").argument("<task>", "task id or name")
-  ).action(
-    async (task, opts) => onTask(
-      task,
-      opts,
-      (c, id, signal) => resumeTask(c, id, { signal }),
-      (o, r) => writeTask(o, r)
-    )
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, stored);
+    return;
+  }
+  renderPoll(cfg.out, "Polling disabled", binding, stored);
+}
+async function runPollGet(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const p = await explainNotPolled(
+    cfg.filebox,
+    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
   );
-  withFlags(
-    tasks.command("runs").description("A task's run history, newest first").argument("<task>", "task id or name").option("--limit <n>", "how many runs (1-200)", "20")
-  ).action(async (task, opts) => {
-    const limit = parsePositiveIntArg2(opts.limit, "--limit");
-    if (limit > 200) throw new Error("invalid --limit: at most 200");
-    await onTask(
-      task,
-      opts,
-      (c, id, signal) => listRuns(c, id, limit, { signal }),
-      (o, r) => writeRuns(o, r)
-    );
-  });
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, p);
+    return;
+  }
+  renderPoll(cfg.out, "Polling", binding, p);
 }
-
-// src/commands/connectorsAws.ts
-var ROLE_ARN_RE = /^arn:aws[a-z-]*:iam::\d{12}:role\/\S+$/;
-var OTHER_ORG_HINT = "if your session is valid, the connection or --org-id may belong to another org than the --account you are logged in as";
-function explainAwsError(err, id) {
-  if (!(err instanceof ControlPlaneError)) {
-    if (err instanceof Error && /\bHTTP 403\b/.test(err.message)) {
-      return withCause(
-        new ControlPlaneError(
-          403,
-          "",
-          `${err.message}
-${OTHER_ORG_HINT}`
-        ),
-        err
+async function runPollRun(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  let p;
+  try {
+    p = await explainNotPolled(
+      cfg.filebox,
+      runPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+    );
+  } catch (err) {
+    if (isPollThrottled(err)) {
+      throw new Error(
+        `a poll of filebox ${cfg.filebox} is running or ran less than a minute ago; try again shortly`,
+        { cause: err }
       );
     }
-    return err;
+    throw err;
   }
-  if (!hasDetail(err.body)) return err;
-  const detail = detailOf(err.body) || err.message;
-  const messages = {
-    403: `forbidden: ${detail} (${OTHER_ORG_HINT})`,
-    404: `AWS connection${id === void 0 ? "" : ` ${id}`} not found: ${detail}`,
-    409: `conflict: ${detail}`,
-    422: `rejected: ${detail}`,
-    503: `the control plane cannot broker AWS roles on this site: ${detail}`
-  };
-  const message = messages[err.status];
-  if (message === void 0) return err;
-  return withCause(new ControlPlaneError(err.status, err.body, message), err);
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, p);
+    return;
+  }
+  renderPoll(cfg.out, "Poll requested", binding, p);
 }
-function hasDetail(body) {
-  try {
-    const parsed2 = JSON.parse(body);
-    return typeof parsed2 === "object" && parsed2 !== null && "detail" in parsed2;
-  } catch {
-    return false;
+async function runPollResume(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const resume = async () => {
+    const p = await explainNotPolled(
+      cfg.filebox,
+      resumePoll(
+        cfg.client,
+        binding.query_id,
+        cfg.source === void 0 ? {} : { source: cfg.source },
+        { signal: cfg.signal }
+      )
+    );
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, p);
+      return;
+    }
+    renderPoll(cfg.out, "Polling resumed", binding, p);
+  };
+  if (cfg.source !== "land") {
+    await resume();
+    return;
   }
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(cfg.filebox, "resume-land", cfg.scope),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll resume ${cfg.filebox} --source land${cfg.targetArgs}`,
+    describe: async () => [
+      `target:      ${bindingTarget(binding)}`,
+      "source:      land every item the changed source holds now"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      await resume();
+    }
+  });
 }
-function oneLine3(s) {
-  return s.replace(/\s+/g, " ").trim();
+async function countSeedable(cfg, binding) {
+  const untilMs = Date.parse(cfg.until);
+  let count = 0;
+  for (const state of ["seen", "new"]) {
+    let after = null;
+    do {
+      cfg.deadline?.resume();
+      const page = await explainNotPolled(
+        cfg.filebox,
+        listPollItems(
+          cfg.client,
+          binding.query_id,
+          { state, ...after === null ? {} : { after } },
+          { signal: cfg.signal }
+        )
+      );
+      count += page.items.filter(
+        (it) => it.source_modified_at !== null && Date.parse(it.source_modified_at) <= untilMs
+      ).length;
+      after = page.next_after;
+    } while (after !== null);
+  }
+  return count;
 }
-function writeConnection(out, c) {
-  const row = (label, value) => {
-    out.write(`  ${`${label}:`.padEnd(14)}${value}
-`);
-  };
-  out.write(`AWS connection #${c.id} (org ${c.org_id})
-`);
-  row("Datasource", c.secret_ref);
-  row("Role ARN", c.role_arn);
-  row("Status", `${c.status}${c.enabled ? "" : " (disabled)"}`);
-  row("Broker ARN", c.broker_arn ?? "-");
-  row("External ID", c.external_id);
-  row("Expires", c.expires_at ?? "-");
-  row("Last assumed", c.last_assumed_at ?? "-");
-  row("Last error", c.last_error === null ? "-" : oneLine3(c.last_error));
-  row("Failures", String(c.consecutive_failures));
-  if (c.trust_statement === null) {
-    out.write("\nTrust statement: none returned by the control plane.\n");
-  } else {
-    out.write("\nTrust statement (add it to the customer role's trust policy):\n");
-    out.write(`${JSON.stringify(c.trust_statement, null, 2)}
+async function runPollSeed(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  if (cfg.dryRun) {
+    const wouldSeed = await countSeedable(cfg, binding);
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, { dry_run: true, until: cfg.until, would_seed: wouldSeed });
+      return;
+    }
+    cfg.out.write(`Seed dry run for ${bindingTarget(binding)}: nothing was changed.
 `);
+    cfg.out.write(
+      `${wouldSeed} already-discovered items would be seeded (items not yet discovered are not counted).
+`
+    );
+    return;
   }
-  out.write(
-    "\nThe customer role's permissions should be read-only on their bucket/prefix (plus kms:Decrypt for a customer-managed KMS key).\n"
-  );
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollConfirmAction(cfg.filebox, "seed", cfg.scope, { until: cfg.until }),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll seed ${cfg.filebox} --until ${cfg.untilArg}${cfg.targetArgs}`,
+    describe: async () => [
+      `target:      ${bindingTarget(binding)}`,
+      `until:       ${cfg.until}`,
+      "effect:      items modified at or before it are marked landed and never land"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      const p = await explainNotPolled(
+        cfg.filebox,
+        seedPoll(
+          cfg.client,
+          binding.query_id,
+          { until: cfg.until },
+          {
+            signal: cfg.signal
+          }
+        )
+      );
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, p);
+        return;
+      }
+      renderPoll(cfg.out, "Seed requested", binding, p);
+    }
+  });
 }
-function writeConnectionTable(out, list28) {
-  if (list28.length === 0) {
-    out.write("No AWS connections for this org.\n");
+async function runPollItems(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const page = await explainNotPolled(
+    cfg.filebox,
+    listPollItems(
+      cfg.client,
+      binding.query_id,
+      {
+        ...cfg.state !== void 0 ? { state: cfg.state } : {},
+        ...cfg.limit !== void 0 ? { limit: cfg.limit } : {},
+        ...cfg.after !== void 0 ? { after: cfg.after } : {}
+      },
+      { signal: cfg.signal }
+    )
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, page);
     return;
   }
-  const rows = [["ID", "SECRET_REF", "ROLE_ARN", "STATUS", "EXPIRES_AT", "LAST_ERROR"]];
-  for (const c of list28) {
-    rows.push([
-      String(c.id),
-      oneLine3(c.secret_ref),
-      oneLine3(c.role_arn),
-      c.status,
-      c.expires_at ?? "-",
-      c.last_error === null ? "-" : truncate3(oneLine3(c.last_error), 60)
-    ]);
+  if (page.items.length === 0) {
+    cfg.out.write(`No items${cfg.state === void 0 ? "" : ` in state ${cfg.state}`}.
+`);
+    return;
   }
-  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
-  for (const r of rows) {
-    out.write(
-      `${r.map((cell, i) => cell.padEnd(widths[i] + 2)).join("").trimEnd()}
+  renderItemTable(cfg.out, page.items);
+  if (page.next_after !== null) {
+    const state = cfg.state === void 0 ? "" : ` --state ${cfg.state}`;
+    const limit = cfg.limit === void 0 ? "" : ` --limit ${cfg.limit}`;
+    cfg.out.write(
+      `
+More: dr connectors poll items ${cfg.filebox}${state}${limit} --after ${page.next_after}
 `
     );
   }
 }
-function withFlags2(cmd) {
-  cmd.option("--json", "Output raw JSON instead of a summary", false);
+function renderItemResult(cfg, binding, headline, item) {
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, item);
+    return;
+  }
+  cfg.out.write(`${headline} (${bindingTarget(binding)})
+`);
+  renderItemTable(cfg.out, [item]);
+}
+async function runPollRetry(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  const item = await explainNotPolled(
+    cfg.filebox,
+    retryPollItem(cfg.client, binding.query_id, cfg.itemId, { signal: cfg.signal })
+  );
+  renderItemResult(cfg, binding, `Item ${cfg.itemId} queued for retry`, item);
+}
+async function runPollSkip(cfg) {
+  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
+  cfg.deadline?.pause();
+  await twoStepConfirm({
+    out: cfg.out,
+    action: pollItemConfirmAction(cfg.filebox, cfg.itemId, cfg.scope),
+    token: cfg.token,
+    server: cfg.scope.serverKey,
+    confirmCmd: `dr connectors poll skip ${cfg.filebox} ${cfg.itemId}${cfg.targetArgs}`,
+    describe: async () => [
+      `item:        ${cfg.itemId} of ${bindingTarget(binding)}`,
+      "effect:      the item is never landed (dr connectors poll retry queues it again)"
+    ],
+    execute: async () => {
+      cfg.deadline?.resume();
+      const item = await explainNotPolled(
+        cfg.filebox,
+        skipPollItem(cfg.client, binding.query_id, cfg.itemId, {
+          signal: cfg.signal
+        })
+      );
+      renderItemResult(cfg, binding, `Item ${cfg.itemId} skipped`, item);
+    }
+  });
+}
+async function withMonolith(opts, action) {
+  const monolithHost = resolve(resolveServer(opts.server)).host;
+  const setup = await setupCall(opts.server, opts.account, {
+    host: monolithHost,
+    authHost: monolithHost
+  });
+  try {
+    await action(setup.client);
+  } finally {
+    setup.cleanup();
+  }
+}
+function scopeOf(opts) {
+  const serverKey = resolveServer(opts.server);
+  return {
+    serverKey,
+    account: normaliseAccount(opts.account),
+    controlPlane: resolveConnectorsUrl(serverKey, opts.connectorsUrl)
+  };
+}
+function targetArgsOf(opts) {
+  const url = (opts.connectorsUrl ?? "").trim();
+  return ` --server ${resolveServer(opts.server)}${url === "" ? "" : ` --connectors-url ${url}`}`;
+}
+function addCommonFlags(cmd, jsonHelp) {
+  cmd.option("--json", jsonHelp, false);
   addServerFlag(cmd);
   addAccountFlag(cmd);
   addConnectorsUrlFlag(cmd);
-  return cmd;
 }
-async function run(opts, act, print, id) {
-  await withConnectorsSetup(opts, async (setup) => {
-    let result;
-    try {
-      result = await act(setup);
-    } catch (err) {
-      throw explainAwsError(err, id);
-    }
-    if (opts.json === true) writeJSONIndented(process.stdout, result);
-    else print(process.stdout, result);
+function addConfirmTokenFlag(cmd) {
+  return cmd.option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed");
+}
+function addSettingsFlags(cmd) {
+  return cmd.option("--interval <duration>", "how often to poll, 5m to 7d (default: per source)").option("--since <date>", "never pick up items modified before this date or timestamp").option("--lookback <days>", "window every poll lists, 1d to 3650d (default: per source)").option("--settle <duration>", "how long an item must stay unchanged before landing, 0s to 1d").option(
+    "--same-name <policy>",
+    "a changed file under the same name: new-version (lands again) or ignore"
+  );
+}
+function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.stdin, output: process.stderr }) {
+  return new Promise((resolvePrompt) => {
+    const rl = readline2.createInterface({
+      input: io.input,
+      output: io.output,
+      ...io.terminal !== void 0 ? { terminal: io.terminal } : {}
+    });
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      resolvePrompt(value);
+    };
+    rl.on("SIGINT", () => settle(null));
+    rl.on("close", () => settle(null));
+    io.output.write(`${message}
+`);
+    const question = defaultChoice === void 0 ? `[${choices.join("/")}]: ` : `[${choices.join("/")}] (Enter = ${defaultChoice}): `;
+    const askOnce = () => {
+      rl.question(question, (answer) => {
+        const picked = answer.trim().toLowerCase();
+        if (picked === "" && defaultChoice !== void 0) {
+          settle(defaultChoice);
+        } else if (choices.includes(picked)) {
+          settle(picked);
+        } else {
+          io.output.write(`Answer one of: ${choices.join(", ")}
+`);
+          askOnce();
+        }
+      });
+    };
+    askOnce();
   });
 }
-function registerConnectorsAws(connectors) {
-  const aws = connectors.command("aws").description("Customer IAM roles DRIP assumes to read the customer's S3 (external ID, trust)");
-  withFlags2(
-    aws.command("create").description("Register a customer IAM role for a datasource; prints the trust statement").requiredOption("--secret-ref <datasourceId>", "monolith datasource id the role serves").requiredOption("--role-arn <arn>", "customer role, e.g. arn:aws:iam::123456789012:role/x").option("--org-id <id>", "org id (defaults to the JWT org)")
-  ).action(async (opts) => {
-    const secretRef = opts.secretRef.trim();
-    if (secretRef === "" || secretRef.length > 200) {
-      throw new Error(`invalid --secret-ref "${opts.secretRef}": expected 1-200 characters`);
+var POLL_CONFIRM_HELP = [
+  "Confirmation:",
+  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
+  "  re-run the printed command, token included, to apply it.",
+  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
+  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
+  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
+  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
+  "  resume --source land) also asks a person to type a word in a dialog on production,",
+  "  even when the same set also seeds (--on-policy-change seed --widen land)."
+].join("\n");
+function registerConnectorsPoll(connectors) {
+  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
+${POLL_CONFIRM_HELP}`);
+  const enableCmd = addSettingsFlags(
+    poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
+  ).action(async (filebox, opts) => {
+    const settings = parseSettings(opts);
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await withMonolith(opts, async (monolith) => {
+        await runPollEnable({
+          client,
+          monolith,
+          filebox,
+          settings,
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    });
+  });
+  addCommonFlags(enableCmd, "Output the stored binding as JSON");
+  const setCmd = addConfirmTokenFlag(
+    addSettingsFlags(
+      poll2.command("set").description("Change polling settings (only the given flags change)").argument("<filebox>", "filebox id or uuid")
+    ).option(
+      "--widen <seed|land>",
+      "a wider window: seed (mark exposed items landed) or land them"
+    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
+  ).action(
+    async (filebox, opts) => {
+      const changes = parseSettings(opts);
+      const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
+      const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
+          ...changes,
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
+        }),
+        opts.confirmToken
+      );
+      await withConnectorsSetup(opts, async (setup) => {
+        const deadline = {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        };
+        await runPollSet({
+          client: setup.client,
+          filebox,
+          changes,
+          settingsArgs: settingsArgs(opts),
+          ...widen !== void 0 ? { widen } : {},
+          ...onPolicyChange !== void 0 ? { onPolicyChange } : {},
+          interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
+          prompt: async (message, choices, defaultChoice) => {
+            deadline.pause();
+            try {
+              return await ttyChoicePrompt(message, choices, defaultChoice);
+            } finally {
+              deadline.resume();
+            }
+          },
+          deadline,
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      });
     }
-    if (!ROLE_ARN_RE.test(opts.roleArn)) {
-      throw new Error(
-        `invalid --role-arn "${opts.roleArn}": expected arn:aws:iam::<12-digit account>:role/<name>`
+  );
+  addCommonFlags(setCmd, "Output the stored binding as JSON");
+  const disableCmd = poll2.command("disable").description("Stop polling (an item already in flight still finishes)").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollDisable({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(disableCmd, "Output the stored binding as JSON");
+  const getCmd = poll2.command("get").description("Show polling settings, last poll, pending seed / rekey and item counts").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollGet({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(getCmd, "Output the raw binding as JSON");
+  const runCmd = poll2.command("run").description("Poll now").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRun({
+        client,
+        filebox,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
+  });
+  addCommonFlags(runCmd, "Output the binding as JSON");
+  const resumeCmd = addConfirmTokenFlag(
+    poll2.command("resume").description("Resume a paused binding (after fixing credentials, or a source change)").argument("<filebox>", "filebox id or uuid").option(
+      "--source <seed|land>",
+      "after a source change: seed (mark present items landed) or land them"
+    )
+  ).action(async (filebox, opts) => {
+    const source = opts.source === void 0 ? void 0 : parseChoice(opts.source, "--source", WIDEN_CHOICES);
+    if (source === "land") {
+      await preflightConfirmToken(
+        pollConfirmAction(filebox, "resume-land", scopeOf(opts)),
+        opts.confirmToken
       );
     }
-    const orgId = opts.orgId === void 0 ? void 0 : parsePositiveIntArg2(opts.orgId, "--org-id");
-    const fields = {
-      secret_ref: secretRef,
-      role_arn: opts.roleArn,
-      ...orgId !== void 0 ? { org_id: orgId } : {}
-    };
-    await run(
-      opts,
-      ({ client, signal }) => createAwsConnection(client, fields, { signal }),
-      writeConnection
-    );
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollResume({
+        client: setup.client,
+        filebox,
+        ...source !== void 0 ? { source } : {},
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
   });
-  withFlags2(
-    aws.command("list").description("List the org's AWS connections").option("--secret-ref <datasourceId>", "only the connection of this datasource")
-  ).action(async (opts) => {
-    await run(
-      opts,
-      ({ client, signal }) => listAwsConnections(client, opts.secretRef, { signal }),
-      writeConnectionTable
-    );
+  addCommonFlags(resumeCmd, "Output the binding as JSON");
+  const itemsCmd = poll2.command("items").description("List the item ledger: label, date, state, attempts, version, error").argument("<filebox>", "filebox id or uuid").option("--state <state>", `only items in this state (${POLL_ITEM_STATES.join("|")})`).option("--limit <n>", "page size (default and maximum: the control-plane page size, 100)").option("--after <id>", "start after this item id (the next-page cursor)").action(
+    async (filebox, opts) => {
+      const state = opts.state === void 0 ? void 0 : POLL_ITEM_STATES.find((s) => s === opts.state);
+      if (opts.state !== void 0 && state === void 0) {
+        throw new Error(
+          `invalid --state "${opts.state}": expected one of ${POLL_ITEM_STATES.join(", ")}`
+        );
+      }
+      const limit = opts.limit === void 0 ? void 0 : parsePositiveIntArg2(opts.limit, "--limit");
+      const after = opts.after === void 0 ? void 0 : parsePositiveIntArg2(opts.after, "--after");
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        await runPollItems({
+          client,
+          filebox,
+          ...state !== void 0 ? { state } : {},
+          ...limit !== void 0 ? { limit } : {},
+          ...after !== void 0 ? { after } : {},
+          asJson: opts.json === true,
+          signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(itemsCmd, "Output the raw page as JSON");
+  const retryCmd = poll2.command("retry").description("Queue a failed, waiting or skipped item again").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)").action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      await runPollRetry({
+        client,
+        filebox,
+        itemId,
+        asJson: opts.json === true,
+        signal,
+        out: process.stdout
+      });
+    });
   });
-  withFlags2(
-    aws.command("get").description("Show an AWS connection and its trust statement").argument("<id>", "connection id")
-  ).action(async (idArg, opts) => {
-    const id = parsePositiveIntArg2(idArg, "connection id");
-    await run(
-      opts,
-      ({ client, signal }) => getAwsConnection(client, id, { signal }),
-      writeConnection,
-      id
+  addCommonFlags(retryCmd, "Output the item as JSON");
+  const skipCmd = addConfirmTokenFlag(
+    poll2.command("skip").description("Skip an item so it is never landed (two-step confirmation)").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)")
+  ).action(async (filebox, item, opts) => {
+    const itemId = parsePositiveIntArg2(item, "item id");
+    await preflightConfirmToken(
+      pollItemConfirmAction(filebox, itemId, scopeOf(opts)),
+      opts.confirmToken
     );
+    await withConnectorsSetup(opts, async (setup) => {
+      await runPollSkip({
+        client: setup.client,
+        filebox,
+        itemId,
+        deadline: {
+          pause: () => setup.pauseTimeout(),
+          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+        },
+        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+        scope: scopeOf(opts),
+        targetArgs: targetArgsOf(opts),
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    });
   });
-  for (const [verb, enabled, help] of [
-    ["enable", true, "Enable an AWS connection; also retries now (stored credentials are dropped)"],
-    ["disable", false, "Disable an AWS connection (stored credentials are dropped)"]
-  ]) {
-    withFlags2(aws.command(verb).description(help).argument("<id>", "connection id")).action(
-      async (idArg, opts) => {
-        const id = parsePositiveIntArg2(idArg, "connection id");
-        await run(
-          opts,
-          ({ client, signal }) => updateAwsConnection(client, id, { enabled }, { signal }),
-          (out, c) => {
-            writeConnection(out, c);
-            if (enabled)
-              out.write(
-                "\nStored credentials were dropped; the poller assumes the role again now.\n"
-              );
-          },
-          id
+  addCommonFlags(skipCmd, "Output the item as JSON");
+  const seedCmd = addConfirmTokenFlag(
+    poll2.command("seed").description(
+      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
+    ).argument("<filebox>", "filebox id or uuid").requiredOption(
+      "--until <timestamp>",
+      "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
+    ).option(
+      "--dry-run",
+      "count the already-discovered items it would mark, without changing anything",
+      false
+    ).addHelpText("after", `
+${POLL_CONFIRM_HELP}`)
+  ).action(
+    async (filebox, opts) => {
+      const until = parseTimestampFlag(opts.until, "--until");
+      const dryRun = opts.dryRun === true;
+      if (!dryRun) {
+        await preflightConfirmToken(
+          pollConfirmAction(filebox, "seed", scopeOf(opts), { until }),
+          opts.confirmToken
         );
       }
-    );
-  }
+      await withConnectorsSetup(opts, async (setup) => {
+        await runPollSeed({
+          client: setup.client,
+          filebox,
+          until,
+          untilArg: opts.until.trim(),
+          dryRun,
+          deadline: {
+            pause: () => setup.pauseTimeout(),
+            resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
+          },
+          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
+          scope: scopeOf(opts),
+          targetArgs: targetArgsOf(opts),
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      });
+    }
+  );
+  addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
 }
 
-// src/commands/connectorsDevFetch.ts
-import { promises as fs19 } from "fs";
-import * as path9 from "path";
-import { randomUUID as randomUUID2 } from "crypto";
-function buildDevEnvelope(i) {
-  const config = {
-    ...i.publicConfig,
-    ...i.queryConfig,
-    // Coerce absent values to null (not undefined) so JSON.stringify keeps the
-    // key — matches build_hook_job's dq.get(...) -> None; a dropped objectType
-    // becomes a cryptic KeyError in the runner's dispatch.
-    objectType: i.dataQuery.objectType ?? null,
-    type: i.dataQuery.type ?? null,
-    query: i.dataQuery.query
-  };
-  if (i.period) config.period = i.period;
-  return {
-    correlation_id: i.correlationId,
-    config,
-    secret_ref: i.secretRef,
-    cred_token: "dev-local",
-    output_sas: "file:///out/output.csv",
-    input_sas: null,
-    cursor: null,
-    contract_version: i.contractVersion,
-    metadata: {}
-  };
-}
-function asObject(v) {
-  if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-    return v;
+// src/commands/connectorsTasks.ts
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/api/scheduledTasks.ts
+var BASE2 = "/scheduled-tasks";
+async function call2(method, path13, send, what) {
+  let out;
+  try {
+    out = await send();
+  } catch (err) {
+    throw toControlPlaneError(method, path13, err);
   }
-  return null;
+  if (out === null) throw new Error(`${method} ${path13}: empty response from control-plane ${what}`);
+  return out;
 }
-function extractDataQueryFields(raw2) {
-  const root = asObject(decodeShape(raw2));
-  if (root === null || Object.keys(root).length === 0) {
-    throw new Error(
-      "no data-query attached to this filebox (empty data_query response) \u2014 attach one in the filebox UI first"
-    );
-  }
-  const cfg = asObject(root.config);
-  const src = cfg ?? root;
-  const query = src.query;
-  let queryObj;
-  if (query === void 0 || query === null) {
-    queryObj = {};
-  } else {
-    const asObj = asObject(query);
-    if (asObj === null) {
-      throw new Error(
-        `data-query \`query\` is not an object (got ${typeof query}) \u2014 expected the Sync-query field`
-      );
-    }
-    queryObj = asObj;
-  }
-  return { objectType: queryObj.objectType, type: src.type, query: queryObj };
+async function createTask(client, fields, reqOptions) {
+  return call2(
+    "POST",
+    BASE2,
+    () => client.postJSON(BASE2, fields, reqOptions),
+    "task create"
+  );
 }
-function extractCredentials(integration) {
-  const cfg = asObject(integration.config);
-  if (cfg === null || Object.keys(cfg).length === 0) {
-    throw new Error(
-      `datasource ${integration.id} has an empty/missing \`config\` \u2014 nothing to use as connector credentials`
-    );
-  }
-  return { ...cfg };
+async function listTasks(client, orgId, reqOptions) {
+  const path13 = orgId === void 0 ? BASE2 : `${BASE2}?org_id=${orgId}`;
+  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task list");
 }
-var ENV_FILE = "env.json";
-var SECRETS_FILE = "secrets.json";
-var CONNECTION_FILE = "connection.py";
-var QUERY_FILE = "query.py";
-async function writeRunDir(input) {
-  let connectionSource;
-  try {
-    connectionSource = await fs19.readFile(input.connectionPath, "utf-8");
-  } catch {
-    throw new Error(`${input.connectionPath}: connection source not found or unreadable`);
-  }
-  let querySource;
-  try {
-    querySource = await fs19.readFile(input.queryPath, "utf-8");
-  } catch {
-    throw new Error(`${input.queryPath}: dataquery source not found or unreadable`);
-  }
-  await fs19.mkdir(input.outDir, { recursive: true });
-  await fs19.writeFile(
-    path9.join(input.outDir, ENV_FILE),
-    JSON.stringify(input.env, null, 2) + "\n",
-    "utf-8"
-  );
-  const secretsPath = path9.join(input.outDir, SECRETS_FILE);
-  await fs19.writeFile(
-    secretsPath,
-    JSON.stringify({ [input.secretRef]: input.credentials }, null, 2) + "\n",
-    "utf-8"
+async function getTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call2("GET", path13, () => client.getJSON(path13, reqOptions), "task get");
+}
+async function updateTask(client, taskId, fields, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
+  return call2(
+    "PATCH",
+    path13,
+    () => client.patchJSON(path13, fields, reqOptions),
+    "task update"
   );
-  if (process.platform !== "win32") {
-    await fs19.chmod(secretsPath, 384);
-  }
-  await fs19.writeFile(path9.join(input.outDir, CONNECTION_FILE), connectionSource, "utf-8");
-  await fs19.writeFile(path9.join(input.outDir, QUERY_FILE), querySource, "utf-8");
 }
-async function ensureGitignored(entry) {
-  const gitignorePath = path9.join(process.cwd(), ".gitignore");
-  let current = "";
+async function deleteTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}`;
   try {
-    current = await fs19.readFile(gitignorePath, "utf-8");
-  } catch {
+    await client.deleteJSON(path13, reqOptions);
+  } catch (err) {
+    throw toControlPlaneError("DELETE", path13, err);
   }
-  const normalized = entry.split("\\").join("/").replace(/\/+$/, "") + "/";
-  const lines = current.split(/\r?\n/).map((l) => l.trim());
-  if (lines.includes(normalized) || lines.includes(entry)) return;
-  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
-  await fs19.writeFile(gitignorePath, `${current}${sep}${normalized}
-`, "utf-8");
 }
-function parsePositiveInt3(raw2, label) {
-  const n = Number(raw2);
-  if (!Number.isInteger(n) || String(n) !== raw2.trim() || n <= 0) {
-    throw new Error(`invalid ${label}: "${raw2}"`);
-  }
-  return n;
+async function runTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/run`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task run"
+  );
 }
-function registerDevFetch(connectors) {
-  const cmd = connectors.command("dev-fetch").description(
-    "Assemble a local run dir (env.json + secrets.json + connection.py + query.py) for dev-run.sh"
-  ).argument("<fileboxUuid>", "filebox UUID of the connector binding").requiredOption(
-    "--datasource <id>",
-    "datasource (data-integration) id whose credentials to fetch"
-  ).requiredOption(
-    "--document-id <n>",
-    "numeric filebox document id (no uuid->id lookup exists; required)"
-  ).requiredOption("--connection <path>", "path to the connector's connection .py source").requiredOption("--query <path>", "path to the connector's dataquery .py source").option("--from <date>", "period start (paired with --to)").option("--to <date>", "period end (paired with --from)").option("-o, --output <dir>", "output run dir (default ./dev-run/<fileboxUuid>/)").action(async (fileboxUuid, opts) => {
-    const datasourceId = parsePositiveInt3(opts.datasource, "datasource id");
-    const documentId = parsePositiveInt3(opts.documentId, "document-id");
-    if (opts.from === void 0 !== (opts.to === void 0)) {
-      throw new Error("--from and --to must be provided together");
-    }
-    const defaultRoot = path9.join("dev-run", fileboxUuid);
-    const outDir = opts.output ?? defaultRoot;
-    const gitignoreEntry = opts.output ?? "dev-run";
-    const serverKey = resolveServer(opts.server);
-    const host = resolveConnectorsUrl(serverKey, opts.connectorsUrl);
-    const monolithHost = resolve(serverKey).host;
-    const cpSetup = await setupCall(opts.server, opts.account, { host, authHost: monolithHost });
-    try {
-      const binding = await getBinding(cpSetup.client, fileboxUuid, {
-        signal: cpSetup.signal
-      });
-      const monoSetup = await setupCall(opts.server, opts.account, {
-        host: monolithHost,
-        authHost: monolithHost
-      });
-      try {
-        const rawDataQuery = await getDataQueryRaw(monoSetup.client, documentId, {
-          signal: monoSetup.signal
-        });
-        const dataQuery = extractDataQueryFields(rawDataQuery);
-        if (dataQuery.objectType === void 0 || dataQuery.objectType === null || dataQuery.objectType === "") {
-          process.stderr.write(
-            'WARNING: objectType is not set inside the Sync-query (config.query.objectType). get_query_class will receive None \u2014 fine only if the connector has a single default dataset. Add it to the data-query, e.g. config.query.objectType = "<dataset>".\n'
-          );
-        }
-        const integration = await itGet(monoSetup.client, datasourceId, {
-          signal: monoSetup.signal
-        });
-        const credentials = extractCredentials(integration);
-        let period;
-        if (opts.from !== void 0 && opts.to !== void 0) {
-          period = { from: opts.from, to: opts.to };
-        }
-        const env = buildDevEnvelope({
-          correlationId: randomUUID2(),
-          secretRef: binding.secret_ref,
-          publicConfig: binding.public_config,
-          queryConfig: binding.query_config,
-          dataQuery,
-          ...period !== void 0 ? { period } : {},
-          // Deliberate sandbox stub: the fetch/dispatch path doesn't branch on
-          // contract_version, so a fixed "1" is sufficient for a local run.
-          contractVersion: "1"
-        });
-        await writeRunDir({
-          outDir,
-          env,
-          secretRef: binding.secret_ref,
-          credentials,
-          connectionPath: opts.connection,
-          queryPath: opts.query
-        });
-        await ensureGitignored(gitignoreEntry);
-        process.stdout.write(`Wrote run dir: ${outDir}
-`);
-        process.stdout.write(
-          `  env.json (secret_ref=${binding.secret_ref}, flavor=${binding.runtime_flavor})
-`
-        );
-        process.stdout.write("  secrets.json (credentials NOT shown)\n");
-        process.stdout.write("  connection.py, query.py\n");
-      } finally {
-        monoSetup.cleanup();
-      }
-    } catch (err) {
-      throw augmentTlsCertError(err);
-    } finally {
-      cpSetup.cleanup();
-    }
-  });
-  addServerFlag(cmd);
-  addAccountFlag(cmd);
-  cmd.option(
-    "--connectors-url <url>",
-    "Override the control-plane base URL (e.g. a kubectl port-forward http://localhost:8000)"
+async function pauseTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/pause`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task pause"
+  );
+}
+async function resumeTask(client, taskId, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/resume`;
+  return call2(
+    "POST",
+    path13,
+    () => client.postJSON(path13, {}, reqOptions),
+    "task resume"
+  );
+}
+async function listRuns(client, taskId, limit, reqOptions) {
+  const path13 = `/scheduled-tasks/${encodeURIComponent(taskId)}/runs?limit=${limit}`;
+  return call2(
+    "GET",
+    path13,
+    () => client.getJSON(path13, reqOptions),
+    "task runs"
   );
 }
 
-// src/commands/connectorsPoll.ts
-import * as readline2 from "readline";
-import { createHash as createHash12 } from "crypto";
-
-// src/types/connectors.ts
-var POLL_ITEM_STATES = [
-  "seen",
-  "new",
-  "dispatched",
-  "running",
-  "retry_wait",
-  "landed",
-  "failed",
-  "skipped",
-  "seeded",
-  "superseded"
-];
-
-// src/commands/connectorsPoll.ts
+// src/commands/connectorsTasks.ts
 var DURATION_UNIT_SECONDS2 = { s: 1, m: 60, h: 3600, d: 86400 };
-var DURATION_BOUNDS = {
-  "--interval": [300, 7 * 86400],
-  "--settle": [0, 86400]
-};
-var LOOKBACK_MAX_DAYS = 3650;
-function parseDurationSeconds(raw2, flag) {
+var MIN_EVERY_SECONDS = 60;
+var MAX_EVERY_SECONDS = 2 ** 31 - 1;
+function parseEvery(raw2) {
   const m = /^(\d+)([smhd])?$/.exec(raw2.trim());
   const seconds = m === null ? NaN : Number(m[1]) * (DURATION_UNIT_SECONDS2[m[2] ?? "s"] ?? 1);
-  const [min, max] = DURATION_BOUNDS[flag] ?? [0, Number.MAX_SAFE_INTEGER];
-  if (m === null) {
-    throw new Error(`invalid ${flag} "${raw2}": expected a duration like 90s, 5m or 1h`);
-  }
-  if (!Number.isSafeInteger(seconds) || seconds < min || seconds > max) {
-    throw new Error(
-      `invalid ${flag} "${raw2}": must be between ${formatSeconds(min)} and ${formatSeconds(max)}`
-    );
+  if (m === null)
+    throw new Error(`invalid --every "${raw2}": expected a duration like 5m, 1h or 1d`);
+  if (!Number.isSafeInteger(seconds) || seconds < MIN_EVERY_SECONDS || seconds > MAX_EVERY_SECONDS) {
+    throw new Error(`invalid --every "${raw2}": must be at least 1m`);
   }
   return seconds;
 }
-function parseLookbackDays(raw2) {
-  const m = /^(\d+)d?$/.exec(raw2.trim());
-  const days = m === null ? 0 : Number(m[1]);
-  if (days < 1 || days > LOOKBACK_MAX_DAYS) {
-    throw new Error(
-      `invalid --lookback "${raw2}": must be between 1 and ${LOOKBACK_MAX_DAYS} days, e.g. 180d`
-    );
-  }
-  return days;
-}
-var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
-var DATE_TIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
-function inRange(value, max, min = 0) {
-  const n = Number(value ?? "0");
-  return n >= min && n <= max;
-}
-function isCalendarDay(y, m, d) {
-  if (!inRange(m, 12, 1)) return false;
-  const daysInMonth3 = new Date(Date.UTC(Number(y), Number(m), 0)).getUTCDate();
-  return inRange(d, daysInMonth3, 1);
-}
-function parseTimestampFlag(raw2, flag) {
-  const invalid = new Error(
-    `invalid ${flag} "${raw2}": expected YYYY-MM-DD or a timestamp with a zone (e.g. 2026-10-08T17:30:00+03:00)`
-  );
-  const value = raw2.trim();
-  const dateOnly = DATE_ONLY_RE.exec(value);
-  if (dateOnly !== null) {
-    if (!isCalendarDay(dateOnly[1], dateOnly[2], dateOnly[3])) throw invalid;
-    return (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString();
-  }
-  const dt = DATE_TIME_RE.exec(value);
-  const valid = dt !== null && isCalendarDay(dt[1], dt[2], dt[3]) && inRange(dt[4], 23) && inRange(dt[5], 59) && inRange(dt[6], 59) && inRange(dt[7], 23) && inRange(dt[8], 59);
-  const ms = valid ? Date.parse(value) : NaN;
-  if (Number.isNaN(ms)) throw invalid;
-  return new Date(ms).toISOString();
-}
-function parseSameName(raw2) {
-  if (raw2 === "new-version") return "new_version";
-  if (raw2 === "ignore") return "ignore";
-  throw new Error(`--same-name must be new-version or ignore (got "${raw2}")`);
-}
-function parseChoice(raw2, flag, choices) {
-  const match = choices.find((c) => c === raw2);
-  if (match === void 0) {
-    throw new Error(`${flag} must be ${choices.join(" or ")} (got "${raw2}")`);
+function parseCron(raw2) {
+  const fields = raw2.trim().split(/\s+/);
+  if (fields.length !== 5 || fields.some((f) => f === "")) {
+    throw new Error(`invalid --cron "${raw2}": expected five fields, e.g. "15 * * * *"`);
   }
-  return match;
+  return fields.join(" ");
 }
-var WIDEN_CHOICES = ["seed", "land"];
-var POLICY_CHOICES = ["rekey", "seed", "land"];
-function parseSettings(opts) {
-  const fields = {};
-  if (opts.interval !== void 0) {
-    fields.interval_seconds = parseDurationSeconds(opts.interval, "--interval");
-  }
-  if (opts.since !== void 0) fields.since = parseTimestampFlag(opts.since, "--since");
-  if (opts.lookback !== void 0) fields.lookback_days = parseLookbackDays(opts.lookback);
-  if (opts.settle !== void 0) {
-    fields.settle_seconds = parseDurationSeconds(opts.settle, "--settle");
+var ROLE_RE = /^[a-z][a-z_]*$/;
+var DATASOURCE_ID_RE = /^[0-9]{1,18}$/;
+function parseDatasources(values) {
+  const out = {};
+  for (const raw2 of values) {
+    const eq = raw2.indexOf("=");
+    const role = eq < 0 ? "" : raw2.slice(0, eq).trim();
+    const id = eq < 0 ? "" : raw2.slice(eq + 1).trim();
+    if (!ROLE_RE.test(role) || !DATASOURCE_ID_RE.test(id)) {
+      throw new Error(
+        `invalid --datasource "${raw2}": expected <role>=<datasource id>, e.g. target=4242 (role: lowercase letters and _; id: digits)`
+      );
+    }
+    if (Object.hasOwn(out, role)) throw new Error(`--datasource role "${role}" given twice`);
+    out[role] = id;
   }
-  if (opts.sameName !== void 0) fields.change_policy = parseSameName(opts.sameName);
-  return fields;
-}
-function settingsArgs(opts) {
-  const pairs = [
-    ["--interval", opts.interval],
-    ["--since", opts.since],
-    ["--lookback", opts.lookback],
-    ["--settle", opts.settle],
-    ["--same-name", opts.sameName]
-  ];
-  return pairs.filter((p) => p[1] !== void 0).map(([flag, value]) => ` ${flag} ${value.trim()}`).join("");
+  const count = Object.keys(out).length;
+  if (count < 1 || count > 4) throw new Error("give between 1 and 4 --datasource roles");
+  return out;
 }
-async function resolvePollBinding(client, filebox, signal) {
-  const wanted = filebox.trim();
-  const byId = /^\d+$/.test(wanted);
-  const rows = await listQueries(client, { signal });
-  const matches = rows.filter(
-    (q) => byId ? q.filebox_id === Number(wanted) : q.filebox_uuid.toLowerCase() === wanted.toLowerCase()
-  );
-  const [first] = matches;
-  if (first === void 0) {
-    throw new Error(
-      `no connector binding for filebox ${wanted} in this org (see dr connectors query list)`
-    );
+function parseConfig(raw2, readFile10 = readUtf8) {
+  const text2 = raw2.startsWith("@") ? readFile10(raw2.slice(1)) : raw2;
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(text2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`invalid --config JSON: ${msg}`);
   }
-  if (matches.length > 1) {
-    const ids = matches.map((q) => `#${q.query_id}`).join(", ");
-    throw new Error(`filebox ${wanted} has several connector bindings (${ids})`);
+  if (typeof parsed2 !== "object" || parsed2 === null || Array.isArray(parsed2)) {
+    throw new Error("invalid --config: expected a JSON object");
   }
-  return first;
+  return parsed2;
 }
-function isNotPolled(err) {
-  return err instanceof ControlPlaneError && err.status === 404 && err.body.includes("not polled");
+function readUtf8(p) {
+  return readFileSync3(p, "utf-8");
 }
-function isPollThrottled(err) {
-  return err instanceof ControlPlaneError && err.status === 409 && (err.body.includes("discover is in flight") || err.body.includes("polled less than"));
+function collect(value, previous = []) {
+  return [...previous, value];
 }
-async function explainNotPolled(filebox, call3) {
-  try {
-    return await call3;
-  } catch (err) {
-    if (isNotPolled(err)) {
+function parseScheduleFlags(opts) {
+  if (opts.every !== void 0 && opts.cron !== void 0) {
+    throw new Error("give --every or --cron, not both");
+  }
+  const fields = {};
+  if (opts.artifact !== void 0) fields.artifact_name = opts.artifact;
+  if (opts.flavor !== void 0) fields.runtime_flavor = opts.flavor;
+  if (opts.datasource !== void 0) fields.datasources = parseDatasources(opts.datasource);
+  if (opts.primaryRole !== void 0) fields.primary_role = opts.primaryRole;
+  if (opts.config !== void 0) fields.config = parseConfig(opts.config);
+  if (opts.every !== void 0) fields.every_seconds = parseEvery(opts.every);
+  if (opts.cron !== void 0) fields.cron = parseCron(opts.cron);
+  if (opts.tz !== void 0) fields.timezone = opts.tz;
+  if (fields.primary_role !== void 0 && fields.datasources !== void 0) {
+    if (!Object.hasOwn(fields.datasources, fields.primary_role)) {
       throw new Error(
-        `filebox ${filebox} is not set to polled ingestion; run dr connectors poll enable ${filebox}`,
-        { cause: err }
+        `--primary-role "${fields.primary_role}" is not one of the --datasource roles`
       );
     }
-    throw err;
   }
+  return fields;
 }
-async function readFileboxDateTag(monolith, fileboxId, signal) {
-  const details = await getDetails(monolith, fileboxId, { signal });
-  const dateTags = (details.tags_config ?? []).filter((t) => t.type === "DATE");
-  const [only] = dateTags;
-  if (only === void 0) return {};
-  if (dateTags.length > 1) {
-    const names = dateTags.map((t) => t.name).join(", ");
+function buildCreateFields(name, orgId, opts) {
+  const missing = [
+    ["--artifact", opts.artifact],
+    ["--flavor", opts.flavor],
+    ["--datasource", opts.datasource],
+    ["--config", opts.config]
+  ].filter(([, v]) => v === void 0).map(([flag]) => flag);
+  if (opts.every === void 0 && opts.cron === void 0) missing.push("--every or --cron");
+  if (missing.length > 0) throw new Error(`missing ${missing.join(", ")}`);
+  const fields = parseScheduleFlags(opts);
+  return {
+    org_id: orgId,
+    name,
+    artifact_name: fields.artifact_name,
+    runtime_flavor: fields.runtime_flavor,
+    datasources: fields.datasources,
+    config: fields.config,
+    ...fields.primary_role !== void 0 ? { primary_role: fields.primary_role } : {},
+    ...fields.every_seconds !== void 0 ? { every_seconds: fields.every_seconds } : {},
+    ...fields.cron !== void 0 ? { cron: fields.cron } : {},
+    ...fields.timezone !== void 0 ? { timezone: fields.timezone } : {},
+    ...opts.disabled === true ? { enabled: false } : {}
+  };
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveTaskId(client, task, signal) {
+  if (UUID_RE.test(task)) return task;
+  const tasks = await listTasks(client, void 0, { signal });
+  const match = tasks.find((t) => t.name === task);
+  if (match === void 0) {
     throw new Error(
-      `filebox ${fileboxId} has several DATE tags (${names}); a polled filebox needs exactly one`
+      `no scheduled task named "${task}" in this org (see: dr connectors tasks list)`
     );
   }
-  return { id: only.id, name: only.name };
+  return match.id;
 }
-function formatSeconds(sec) {
-  if (sec > 0 && sec % 86400 === 0) return `${sec / 86400}d`;
-  if (sec > 0 && sec % 3600 === 0) return `${sec / 3600}h`;
-  if (sec > 0 && sec % 60 === 0) return `${sec / 60}m`;
-  return `${sec}s`;
+function explainTaskError(err) {
+  const forbidden = err instanceof ControlPlaneError && err.status === 403 || err instanceof Error && /\bHTTP 403\b/.test(err.message);
+  if (forbidden) {
+    const message = err instanceof Error ? err.message : String(err);
+    const body = err instanceof ControlPlaneError ? err.body : (/HTTP 403[^:]*(?:\([^)]*\))?:\s*([\s\S]*)$/.exec(message)?.[1] ?? "").trim();
+    return withCause(
+      new ControlPlaneError(
+        403,
+        body,
+        `${message}
+Scheduled tasks need a support user or an org admin: log in as one (--account) \u2014 e.g. dr login-as the customer's support user.`
+      ),
+      err
+    );
+  }
+  if (!(err instanceof ControlPlaneError)) return err;
+  const detail = detailOf(err.body);
+  if (err.status === 404) {
+    const message = `scheduled task not found (${detail || err.message})`;
+    return withCause(new ControlPlaneError(404, err.body, message), err);
+  }
+  if (err.status === 409 || err.status === 422) {
+    return withCause(new ControlPlaneError(err.status, err.body, detail || err.message), err);
+  }
+  return err;
 }
-function oneLine4(s) {
-  return s.replace(/\s+/g, " ").trim();
+function withCause(error, cause) {
+  Object.defineProperty(error, "cause", { value: cause, enumerable: false, configurable: true });
+  return error;
 }
-function sameNameLabel(policy) {
-  return policy === "new_version" ? "new-version" : String(policy);
+function detailOf(body) {
+  try {
+    const parsed2 = JSON.parse(body);
+    const d = parsed2.detail;
+    if (typeof d === "string") return d;
+    if (Array.isArray(d)) {
+      return d.map(
+        (e) => `${Array.isArray(e.loc) ? e.loc.slice(1).join(".") : ""}: ${e.msg ?? ""}`.trim()
+      ).join("; ");
+    }
+  } catch {
+  }
+  return body;
 }
-function formatDateTag(tag) {
-  if (tag?.id === void 0) return "none (undated filebox)";
-  return `${tag.name ?? "?"} (id ${tag.id})`;
+function scheduleText(t) {
+  if (t.schedule_kind === "cron") return `cron "${t.cron ?? ""}" ${t.timezone}`;
+  const s = t.every_seconds ?? 0;
+  const unit = s % 86400 === 0 ? `${s / 86400}d` : s % 3600 === 0 ? `${s / 3600}h` : s % 60 === 0 ? `${s / 60}m` : `${s}s`;
+  return `every ${unit}`;
 }
-function bindingTarget(binding) {
-  return `filebox ${binding.filebox_uuid} (query #${binding.query_id})`;
+function stateText(t) {
+  if (!t.enabled) return "disabled";
+  if (t.paused_reason !== null) return `paused (${t.paused_reason})`;
+  return t.running ? "running" : "enabled";
 }
-function renderPoll(out, headline, binding, p) {
-  const row = (label, value) => {
-    out.write(`  ${`${label}:`.padEnd(15)}${value}
+function writeTask(out, t) {
+  const roles = Object.entries(t.datasources).map(([role, id]) => `${role}=${id}${role === t.primary_role ? " (primary)" : ""}`).join(", ");
+  out.write(`Task:        ${t.name}  (${t.id})
 `);
-  };
-  const status2 = `${p.enabled ? "enabled" : "disabled"}${p.paused_reason === null ? "" : `, paused: ${oneLine4(p.paused_reason)}`}`;
-  const counts = Object.entries(p.counts).sort(([a], [b]) => a.localeCompare(b)).map(([state, n]) => `${state}=${n}`).join("  ");
-  out.write(`${headline} for ${bindingTarget(binding)}
+  out.write(`  Org:       ${t.org_id}
+`);
+  out.write(`  State:     ${stateText(t)}
+`);
+  out.write(`  Artifact:  ${t.artifact_name}  [${t.runtime_flavor}]
+`);
+  out.write(`  Schedule:  ${scheduleText(t)}
+`);
+  out.write(`  Next run:  ${t.next_run_at}
+`);
+  out.write(`  Last run:  ${t.last_run_at ?? "-"}  ${t.last_run_status ?? ""}
+`);
+  if (t.consecutive_failures > 0) out.write(`  Failures:  ${t.consecutive_failures} in a row
+`);
+  out.write(`  Datasources: ${roles}
+`);
+  out.write(`  Config:    ${truncate3(JSON.stringify(t.config), 200)}
 `);
-  row("Status", status2);
-  row("Interval", formatSeconds(p.interval_seconds));
-  row("Date tag", formatDateTag(p.date_tag));
-  row("Since", p.since ?? "-");
-  row("Lookback", `${p.lookback_days}d`);
-  row("Settle", formatSeconds(p.settle_seconds));
-  row("Same name", sameNameLabel(p.change_policy));
-  row("Max attempts", String(p.max_attempts));
-  row("Last poll", `${p.last_poll_at ?? "-"} ${oneLine4(p.last_poll_status ?? "")}`.trimEnd());
-  row("Next poll", p.next_poll_at);
-  row("Failures", String(p.consecutive_failures));
-  row("Discover", p.discover_in_flight ? `in flight since ${p.discover_sent_at ?? "?"}` : "-");
-  row("Last digest", p.last_digest ?? "-");
-  row("Pending seed", p.poll_run_seed_until ?? "-");
-  row(
-    "Pending rekey",
-    p.poll_run_rekey_to === null ? "-" : `to ${sameNameLabel(p.poll_run_rekey_to)}`
-  );
-  row("Items", counts === "" ? "(none)" : counts);
 }
-function writeTable26(out, rows) {
-  const widths = [];
-  for (const r of rows) {
-    r.forEach((cell, i) => {
-      widths[i] = Math.max(widths[i] ?? 0, cell.length);
-    });
+function writeTaskList(out, tasks) {
+  if (tasks.length === 0) {
+    out.write("No scheduled tasks.\n");
+    return;
   }
-  for (const r of rows) {
-    const cells = r.map(
-      (cell, i) => i === r.length - 1 ? cell : cell.padEnd((widths[i] ?? 0) + 2)
+  for (const t of tasks) {
+    out.write(
+      `${t.name.padEnd(28)} ${stateText(t).padEnd(20)} ${scheduleText(t).padEnd(26)} next ${t.next_run_at}  last ${t.last_run_status ?? "-"}  ${t.id}
+`
     );
-    out.write(`${cells.join("").trimEnd()}
-`);
-  }
-}
-function renderItemTable(out, items) {
-  const rows = [["ID", "LABEL", "DATE", "STATE", "ATTEMPTS", "VERSION", "ERROR"]];
-  for (const it of items) {
-    const error = it.last_error ?? (it.skip_reason === null ? null : `skipped: ${it.skip_reason}`);
-    rows.push([
-      String(it.id),
-      oneLine4(it.label),
-      it.item_date ?? "-",
-      it.state,
-      String(it.attempts),
-      it.version_id === null ? "-" : String(it.version_id),
-      error === null ? "-" : truncate3(oneLine4(error), 80)
-    ]);
   }
-  writeTable26(out, rows);
 }
-async function runPollEnable(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  let existing;
-  try {
-    existing = await getPoll(cfg.client, binding.query_id, { signal: cfg.signal });
-  } catch (err) {
-    if (!isNotPolled(err)) throw err;
-    existing = null;
-  }
-  const s = cfg.settings;
-  if (existing !== null && (s.since !== void 0 || s.lookback_days !== void 0 || s.change_policy !== void 0)) {
-    throw new Error(
-      `filebox ${cfg.filebox} is already polled; change --since, --lookback or --same-name with dr connectors poll set ${cfg.filebox}, which asks what to do with a wider window or a policy switch`
-    );
+function writeRuns(out, runs) {
+  if (runs.length === 0) {
+    out.write("No runs yet.\n");
+    return;
   }
-  if (binding.filebox_id <= 0) {
-    throw new Error(
-      `connector-query #${binding.query_id} has no filebox id recorded, so its date tag cannot be read; record it with dr connectors query repoint ${binding.query_id} --filebox-id <id>`
+  for (const r of runs) {
+    const tail = r.error !== null ? `  error: ${truncate3(r.error, 160)}` : r.summary !== null ? `  ${truncate3(JSON.stringify(r.summary), 160)}` : "";
+    out.write(
+      `${r.started_at}  ${r.status.padEnd(15)} ${r.trigger.padEnd(8)} attempt ${r.attempt}  ${r.artifact_version ?? "-"}${tail}
+`
     );
   }
-  const dateTag = await readFileboxDateTag(cfg.monolith, binding.filebox_id, cfg.signal);
-  const stored = await putPoll(
-    cfg.client,
-    binding.query_id,
-    { enabled: true, date_tag: dateTag, ...s },
-    { signal: cfg.signal }
-  );
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, stored);
-    return;
-  }
-  renderPoll(cfg.out, "Polling enabled", binding, stored);
-}
-function windowStart(since, lookbackDays, now) {
-  const start = now - lookbackDays * 864e5;
-  return since === null ? start : Math.max(start, Date.parse(since));
-}
-function widening(current, changes, now) {
-  if (changes.since === void 0 && changes.lookback_days === void 0) return null;
-  const from = windowStart(current.since, current.lookback_days, now);
-  const to = windowStart(
-    changes.since ?? current.since,
-    changes.lookback_days ?? current.lookback_days,
-    now
-  );
-  if (to >= from) return null;
-  return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
 }
-async function ask(cfg, message, choices, defaultChoice) {
-  const answer = await cfg.prompt(message, choices, defaultChoice);
-  if (answer === null) throw new Error("poll set cancelled; nothing was changed");
-  return parseChoice(answer, "the answer", choices);
+function withFlags(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false);
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  addConnectorsUrlFlag(cmd);
+  return cmd;
 }
-var WIDEN_HELP = "seed = mark the newly exposed items as already landed, land = land them all";
-var POLICY_HELP = "rekey = re-key the ledger from a fresh listing (nothing lands again), seed = mark everything in the window as landed, land = land everything in the window";
-function pollSetConfirmVerb(widen, onPolicyChange) {
-  return widen === "land" || onPolicyChange === "land" ? "set-land" : "set-seed";
+function addScheduleFlags(cmd) {
+  return cmd.option("--artifact <name>", "published artifact name, e.g. sftp_export__daily_sales").option("--flavor <flavor>", "runner flavor the artifact was published for, e.g. sftp").option("--datasource <role=id>", "monolith datasource for a role (repeat per role)", collect).option(
+    "--primary-role <role>",
+    "the role passed as the primary datasource (default: the first)"
+  ).option("--config <json|@file>", "task config: a JSON object, or @path to a JSON file").option("--every <duration>", "run on an interval, e.g. 5m, 1h (at least 1m)").option("--cron <expr>", 'run on a five-field cron line, e.g. "15 * * * *"').option("--tz <iana>", "timezone the cron line is read in (default UTC)");
 }
-async function runPollSet(cfg) {
-  if (Object.keys(cfg.changes).length === 0) {
-    throw new Error(
-      "poll set: pass at least one of --interval, --since, --lookback, --settle, --same-name"
-    );
-  }
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const current = await explainNotPolled(
-    cfg.filebox,
-    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
-  );
-  const body = { ...cfg.changes };
-  const detail = [`target:      ${bindingTarget(binding)}`];
-  const wider = widening(current, cfg.changes, cfg.now ?? Date.now());
-  if (wider !== null) {
-    const what = `the polling window widens (start ${wider.from} -> ${wider.to})`;
-    if (cfg.widen === void 0 && !cfg.interactive) {
-      throw new Error(`${what}; pass --widen seed or --widen land (${WIDEN_HELP})`);
-    }
-    body.widen = cfg.widen ?? await ask(cfg, `${what}. ${WIDEN_HELP}.`, WIDEN_CHOICES);
-    detail.push(`window:      start ${wider.from} -> ${wider.to}, widen ${body.widen}`);
-  } else if (cfg.widen !== void 0) {
-    body.widen = cfg.widen;
-  }
-  const newPolicy = cfg.changes.change_policy;
-  const policySwitch = newPolicy !== void 0 && newPolicy !== current.change_policy;
-  if (policySwitch) {
-    const change = `${sameNameLabel(current.change_policy)} -> ${sameNameLabel(newPolicy)}`;
-    const what = `--same-name changes ${change}`;
-    if (cfg.onPolicyChange === void 0 && !cfg.interactive) {
-      throw new Error(`${what}; pass --on-policy-change rekey, seed or land (${POLICY_HELP})`);
-    }
-    body.on_policy_change = cfg.onPolicyChange ?? await ask(cfg, `${what}. ${POLICY_HELP}.`, POLICY_CHOICES, "rekey");
-    detail.push(`same name:   ${change}, on policy change ${body.on_policy_change}`);
-  } else if (cfg.onPolicyChange !== void 0) {
-    body.on_policy_change = cfg.onPolicyChange;
-  }
-  const put = async () => {
-    const stored = await putPoll(cfg.client, binding.query_id, body, {
-      signal: cfg.signal
-    });
-    if (cfg.asJson) {
-      writeJSONIndented(cfg.out, stored);
-      return;
-    }
-    renderPoll(cfg.out, "Polling settings updated", binding, stored);
-  };
-  const landsOrHides = wider !== null && body.widen === "land" || policySwitch && (body.on_policy_change === "seed" || body.on_policy_change === "land");
-  if (!landsOrHides) {
-    await put();
-    return;
-  }
-  const flags = `${body.widen === void 0 ? "" : ` --widen ${body.widen}`}${body.on_policy_change === void 0 ? "" : ` --on-policy-change ${body.on_policy_change}`}`;
-  cfg.deadline?.pause();
-  await twoStepConfirm({
-    out: cfg.out,
-    action: pollConfirmAction(
-      cfg.filebox,
-      pollSetConfirmVerb(body.widen, body.on_policy_change),
-      cfg.scope,
-      { ...body }
-    ),
-    token: cfg.token,
-    server: cfg.scope.serverKey,
-    confirmCmd: `dr connectors poll set ${cfg.filebox}${cfg.settingsArgs}${flags}${cfg.targetArgs}`,
-    describe: async () => detail,
-    execute: async () => {
-      cfg.deadline?.resume();
-      await put();
+async function onTask(task, opts, act, print) {
+  await withConnectorsSetup(opts, async ({ client, signal }) => {
+    try {
+      const taskId = await resolveTaskId(client, task, signal);
+      const result = await act(client, taskId, signal);
+      if (opts.json === true) writeJSONIndented(process.stdout, result);
+      else print(process.stdout, result);
+    } catch (err) {
+      throw explainTaskError(err);
     }
   });
 }
-function confirmDigest(scope, payload) {
-  const canonical = JSON.stringify({
-    server: scope.serverKey,
-    account: scope.account ?? "",
-    controlPlane: scope.controlPlane,
-    payload: Object.fromEntries(Object.entries(payload).sort(([a], [b]) => a.localeCompare(b)))
+function registerConnectorsTasks(connectors) {
+  const tasks = connectors.command("tasks").description("DRIP scheduled tasks: run an artifact on a schedule (support user or org admin)");
+  withFlags(
+    addScheduleFlags(
+      tasks.command("create").description("Create a scheduled task").argument("<name>", "task name, unique in the org (a-z, 0-9, _ and -)").option("--org-id <id>", "org id (defaults to the JWT org)").option("--disabled", "create it disabled", false)
+    )
+  ).action(
+    async (name, opts) => {
+      const explicitOrg = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      const parsed2 = buildCreateFields(name, explicitOrg ?? 0, opts);
+      await withConnectorsSetup(opts, async ({ client, signal }) => {
+        const fields = { ...parsed2, org_id: explicitOrg ?? client.getCurrentOrgId() };
+        try {
+          const t = await createTask(client, fields, { signal });
+          if (opts.json === true) writeJSONIndented(process.stdout, t);
+          else writeTask(process.stdout, t);
+        } catch (err) {
+          throw explainTaskError(err);
+        }
+      });
+    }
+  );
+  withFlags(
+    tasks.command("list").description("List the org's scheduled tasks").option("--org-id <id>", "org id (defaults to the JWT org)")
+  ).action(async (opts) => {
+    await withConnectorsSetup(opts, async ({ client, signal }) => {
+      const orgId = opts.orgId !== void 0 ? parsePositiveIntArg2(opts.orgId, "--org-id") : void 0;
+      try {
+        const list28 = await listTasks(client, orgId, { signal });
+        if (opts.json === true) writeJSONIndented(process.stdout, list28);
+        else writeTaskList(process.stdout, list28);
+      } catch (err) {
+        throw explainTaskError(err);
+      }
+    });
   });
-  return createHash12("sha256").update(canonical).digest("hex").slice(0, 12);
-}
-function pollConfirmAction(filebox, verb, scope, payload = {}) {
-  return {
-    resource: "connector-poll",
-    id: `${filebox.trim()}#${confirmDigest(scope, payload)}`,
-    verb
-  };
-}
-function pollItemConfirmAction(filebox, item, scope) {
-  return {
-    resource: "connector-poll-item",
-    id: `${filebox.trim()}/${item}#${confirmDigest(scope, {})}`,
-    verb: "skip"
-  };
-}
-async function runPollDisable(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  await explainNotPolled(
-    cfg.filebox,
-    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  withFlags(
+    tasks.command("get").description("Show a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => getTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
+  );
+  withFlags(
+    addScheduleFlags(
+      tasks.command("update").description("Change a scheduled task (only the flags given change)").argument("<task>", "task id or name").option("--enable", "enable the task").option("--disable", "disable the task")
+    )
+  ).action(
+    async (task, opts) => {
+      if (opts.enable === true && opts.disable === true)
+        throw new Error("give --enable or --disable, not both");
+      const fields = parseScheduleFlags(opts);
+      if (opts.enable === true) fields.enabled = true;
+      if (opts.disable === true) fields.enabled = false;
+      if (Object.keys(fields).length === 0)
+        throw new Error("nothing to change: give at least one flag");
+      await onTask(
+        task,
+        opts,
+        (c, id, signal) => updateTask(c, id, fields, { signal }),
+        (o, r) => writeTask(o, r)
+      );
+    }
+  );
+  withFlags(
+    tasks.command("delete").description("Delete a scheduled task and its run history").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      async (c, id, signal) => {
+        await deleteTask(c, id, { signal });
+        return { deleted: id };
+      },
+      (o, r) => o.write(`Deleted scheduled task ${r.deleted}
+`)
+    )
+  );
+  withFlags(
+    tasks.command("run").description("Run a task now (does not move its schedule)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => runTask(c, id, { signal }),
+      (o, r) => {
+        const run2 = r;
+        o.write(`Queued run ${run2.id} (${run2.status}); see: dr connectors tasks runs ${task}
+`);
+      }
+    )
   );
-  const stored = await putPoll(
-    cfg.client,
-    binding.query_id,
-    { enabled: false },
-    { signal: cfg.signal }
+  withFlags(
+    tasks.command("pause").description("Pause a scheduled task").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => pauseTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
   );
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, stored);
-    return;
-  }
-  renderPoll(cfg.out, "Polling disabled", binding, stored);
-}
-async function runPollGet(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const p = await explainNotPolled(
-    cfg.filebox,
-    getPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  withFlags(
+    tasks.command("resume").description("Resume a paused task (clears its failure count, schedules the next run)").argument("<task>", "task id or name")
+  ).action(
+    async (task, opts) => onTask(
+      task,
+      opts,
+      (c, id, signal) => resumeTask(c, id, { signal }),
+      (o, r) => writeTask(o, r)
+    )
   );
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, p);
-    return;
-  }
-  renderPoll(cfg.out, "Polling", binding, p);
-}
-async function runPollRun(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  let p;
-  try {
-    p = await explainNotPolled(
-      cfg.filebox,
-      runPoll(cfg.client, binding.query_id, { signal: cfg.signal })
+  withFlags(
+    tasks.command("runs").description("A task's run history, newest first").argument("<task>", "task id or name").option("--limit <n>", "how many runs (1-200)", "20")
+  ).action(async (task, opts) => {
+    const limit = parsePositiveIntArg2(opts.limit, "--limit");
+    if (limit > 200) throw new Error("invalid --limit: at most 200");
+    await onTask(
+      task,
+      opts,
+      (c, id, signal) => listRuns(c, id, limit, { signal }),
+      (o, r) => writeRuns(o, r)
     );
-  } catch (err) {
-    if (isPollThrottled(err)) {
-      throw new Error(
-        `a poll of filebox ${cfg.filebox} is running or ran less than a minute ago; try again shortly`,
-        { cause: err }
+  });
+}
+
+// src/commands/connectorsAws.ts
+var ROLE_ARN_RE = /^arn:aws[a-z-]*:iam::\d{12}:role\/\S+$/;
+var OTHER_ORG_HINT = "if your session is valid, the connection or --org-id may belong to another org than the --account you are logged in as";
+function explainAwsError(err, id) {
+  if (!(err instanceof ControlPlaneError)) {
+    if (err instanceof Error && /\bHTTP 403\b/.test(err.message)) {
+      return withCause(
+        new ControlPlaneError(
+          403,
+          "",
+          `${err.message}
+${OTHER_ORG_HINT}`
+        ),
+        err
       );
     }
-    throw err;
-  }
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, p);
-    return;
+    return err;
   }
-  renderPoll(cfg.out, "Poll requested", binding, p);
-}
-async function runPollResume(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const resume = async () => {
-    const p = await explainNotPolled(
-      cfg.filebox,
-      resumePoll(
-        cfg.client,
-        binding.query_id,
-        cfg.source === void 0 ? {} : { source: cfg.source },
-        { signal: cfg.signal }
-      )
-    );
-    if (cfg.asJson) {
-      writeJSONIndented(cfg.out, p);
-      return;
-    }
-    renderPoll(cfg.out, "Polling resumed", binding, p);
+  if (!hasDetail(err.body)) return err;
+  const detail = detailOf(err.body) || err.message;
+  const messages = {
+    403: `forbidden: ${detail} (${OTHER_ORG_HINT})`,
+    404: `AWS connection${id === void 0 ? "" : ` ${id}`} not found: ${detail}`,
+    409: `conflict: ${detail}`,
+    422: `rejected: ${detail}`,
+    503: `the control plane cannot broker AWS roles on this site: ${detail}`
   };
-  if (cfg.source !== "land") {
-    await resume();
-    return;
-  }
-  cfg.deadline?.pause();
-  await twoStepConfirm({
-    out: cfg.out,
-    action: pollConfirmAction(cfg.filebox, "resume-land", cfg.scope),
-    token: cfg.token,
-    server: cfg.scope.serverKey,
-    confirmCmd: `dr connectors poll resume ${cfg.filebox} --source land${cfg.targetArgs}`,
-    describe: async () => [
-      `target:      ${bindingTarget(binding)}`,
-      "source:      land every item the changed source holds now"
-    ],
-    execute: async () => {
-      cfg.deadline?.resume();
-      await resume();
-    }
-  });
+  const message = messages[err.status];
+  if (message === void 0) return err;
+  return withCause(new ControlPlaneError(err.status, err.body, message), err);
 }
-async function countSeedable(cfg, binding) {
-  const untilMs = Date.parse(cfg.until);
-  let count = 0;
-  for (const state of ["seen", "new"]) {
-    let after = null;
-    do {
-      cfg.deadline?.resume();
-      const page = await explainNotPolled(
-        cfg.filebox,
-        listPollItems(
-          cfg.client,
-          binding.query_id,
-          { state, ...after === null ? {} : { after } },
-          { signal: cfg.signal }
-        )
-      );
-      count += page.items.filter(
-        (it) => it.source_modified_at !== null && Date.parse(it.source_modified_at) <= untilMs
-      ).length;
-      after = page.next_after;
-    } while (after !== null);
+function hasDetail(body) {
+  try {
+    const parsed2 = JSON.parse(body);
+    return typeof parsed2 === "object" && parsed2 !== null && "detail" in parsed2;
+  } catch {
+    return false;
   }
-  return count;
 }
-async function runPollSeed(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  if (cfg.dryRun) {
-    const wouldSeed = await countSeedable(cfg, binding);
-    if (cfg.asJson) {
-      writeJSONIndented(cfg.out, { dry_run: true, until: cfg.until, would_seed: wouldSeed });
-      return;
-    }
-    cfg.out.write(`Seed dry run for ${bindingTarget(binding)}: nothing was changed.
+function oneLine4(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function writeConnection(out, c) {
+  const row = (label, value) => {
+    out.write(`  ${`${label}:`.padEnd(14)}${value}
+`);
+  };
+  out.write(`AWS connection #${c.id} (org ${c.org_id})
+`);
+  row("Datasource", c.secret_ref);
+  row("Role ARN", c.role_arn);
+  row("Status", `${c.status}${c.enabled ? "" : " (disabled)"}`);
+  row("Broker ARN", c.broker_arn ?? "-");
+  row("External ID", c.external_id);
+  row("Expires", c.expires_at ?? "-");
+  row("Last assumed", c.last_assumed_at ?? "-");
+  row("Last error", c.last_error === null ? "-" : oneLine4(c.last_error));
+  row("Failures", String(c.consecutive_failures));
+  if (c.trust_statement === null) {
+    out.write("\nTrust statement: none returned by the control plane.\n");
+  } else {
+    out.write("\nTrust statement (add it to the customer role's trust policy):\n");
+    out.write(`${JSON.stringify(c.trust_statement, null, 2)}
 `);
-    cfg.out.write(
-      `${wouldSeed} already-discovered items would be seeded (items not yet discovered are not counted).
-`
-    );
-    return;
   }
-  cfg.deadline?.pause();
-  await twoStepConfirm({
-    out: cfg.out,
-    action: pollConfirmAction(cfg.filebox, "seed", cfg.scope, { until: cfg.until }),
-    token: cfg.token,
-    server: cfg.scope.serverKey,
-    confirmCmd: `dr connectors poll seed ${cfg.filebox} --until ${cfg.untilArg}${cfg.targetArgs}`,
-    describe: async () => [
-      `target:      ${bindingTarget(binding)}`,
-      `until:       ${cfg.until}`,
-      "effect:      items modified at or before it are marked landed and never land"
-    ],
-    execute: async () => {
-      cfg.deadline?.resume();
-      const p = await explainNotPolled(
-        cfg.filebox,
-        seedPoll(
-          cfg.client,
-          binding.query_id,
-          { until: cfg.until },
-          {
-            signal: cfg.signal
-          }
-        )
-      );
-      if (cfg.asJson) {
-        writeJSONIndented(cfg.out, p);
-        return;
-      }
-      renderPoll(cfg.out, "Seed requested", binding, p);
-    }
-  });
-}
-async function runPollItems(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const page = await explainNotPolled(
-    cfg.filebox,
-    listPollItems(
-      cfg.client,
-      binding.query_id,
-      {
-        ...cfg.state !== void 0 ? { state: cfg.state } : {},
-        ...cfg.limit !== void 0 ? { limit: cfg.limit } : {},
-        ...cfg.after !== void 0 ? { after: cfg.after } : {}
-      },
-      { signal: cfg.signal }
-    )
+  out.write(
+    "\nThe customer role's permissions should be read-only on their bucket/prefix (plus kms:Decrypt for a customer-managed KMS key).\n"
   );
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, page);
+}
+function writeConnectionTable(out, list28) {
+  if (list28.length === 0) {
+    out.write("No AWS connections for this org.\n");
     return;
   }
-  if (page.items.length === 0) {
-    cfg.out.write(`No items${cfg.state === void 0 ? "" : ` in state ${cfg.state}`}.
-`);
-    return;
+  const rows = [["ID", "SECRET_REF", "ROLE_ARN", "STATUS", "EXPIRES_AT", "LAST_ERROR"]];
+  for (const c of list28) {
+    rows.push([
+      String(c.id),
+      oneLine4(c.secret_ref),
+      oneLine4(c.role_arn),
+      c.status,
+      c.expires_at ?? "-",
+      c.last_error === null ? "-" : truncate3(oneLine4(c.last_error), 60)
+    ]);
   }
-  renderItemTable(cfg.out, page.items);
-  if (page.next_after !== null) {
-    const state = cfg.state === void 0 ? "" : ` --state ${cfg.state}`;
-    const limit = cfg.limit === void 0 ? "" : ` --limit ${cfg.limit}`;
-    cfg.out.write(
-      `
-More: dr connectors poll items ${cfg.filebox}${state}${limit} --after ${page.next_after}
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const r of rows) {
+    out.write(
+      `${r.map((cell, i) => cell.padEnd(widths[i] + 2)).join("").trimEnd()}
 `
     );
   }
 }
-function renderItemResult(cfg, binding, headline, item) {
-  if (cfg.asJson) {
-    writeJSONIndented(cfg.out, item);
-    return;
-  }
-  cfg.out.write(`${headline} (${bindingTarget(binding)})
+function writeRotated(out, c) {
+  out.write(`External ID rotated for AWS connection #${c.id} (org ${c.org_id}).
 `);
-  renderItemTable(cfg.out, [item]);
-}
-async function runPollRetry(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  const item = await explainNotPolled(
-    cfg.filebox,
-    retryPollItem(cfg.client, binding.query_id, cfg.itemId, { signal: cfg.signal })
+  out.write(`New external ID: ${c.external_id}
+`);
+  out.write(
+    `AWS refuses this connection until the customer replaces the trust statement in the trust policy of ${oneLine4(c.role_arn)} with the one below; the old external ID no longer works.
+
+`
   );
-  renderItemResult(cfg, binding, `Item ${cfg.itemId} queued for retry`, item);
-}
-async function runPollSkip(cfg) {
-  const binding = await resolvePollBinding(cfg.client, cfg.filebox, cfg.signal);
-  cfg.deadline?.pause();
-  await twoStepConfirm({
-    out: cfg.out,
-    action: pollItemConfirmAction(cfg.filebox, cfg.itemId, cfg.scope),
-    token: cfg.token,
-    server: cfg.scope.serverKey,
-    confirmCmd: `dr connectors poll skip ${cfg.filebox} ${cfg.itemId}${cfg.targetArgs}`,
-    describe: async () => [
-      `item:        ${cfg.itemId} of ${bindingTarget(binding)}`,
-      "effect:      the item is never landed (dr connectors poll retry queues it again)"
-    ],
-    execute: async () => {
-      cfg.deadline?.resume();
-      const item = await explainNotPolled(
-        cfg.filebox,
-        skipPollItem(cfg.client, binding.query_id, cfg.itemId, {
-          signal: cfg.signal
-        })
-      );
-      renderItemResult(cfg, binding, `Item ${cfg.itemId} skipped`, item);
-    }
-  });
-}
-async function withMonolith(opts, action) {
-  const monolithHost = resolve(resolveServer(opts.server)).host;
-  const setup = await setupCall(opts.server, opts.account, {
-    host: monolithHost,
-    authHost: monolithHost
-  });
-  try {
-    await action(setup.client);
-  } finally {
-    setup.cleanup();
+  if (c.trust_statement === null) {
+    out.write("New trust statement: none returned by the control plane.\n");
+  } else {
+    out.write(`New trust statement:
+${JSON.stringify(c.trust_statement, null, 2)}
+`);
   }
 }
-function scopeOf(opts) {
-  const serverKey = resolveServer(opts.server);
-  return {
-    serverKey,
-    account: normaliseAccount(opts.account),
-    controlPlane: resolveConnectorsUrl(serverKey, opts.connectorsUrl)
-  };
-}
-function targetArgsOf(opts) {
-  const url = (opts.connectorsUrl ?? "").trim();
-  return ` --server ${resolveServer(opts.server)}${url === "" ? "" : ` --connectors-url ${url}`}`;
-}
-function addCommonFlags(cmd, jsonHelp) {
-  cmd.option("--json", jsonHelp, false);
+function withFlags2(cmd) {
+  cmd.option("--json", "Output raw JSON instead of a summary", false);
   addServerFlag(cmd);
   addAccountFlag(cmd);
   addConnectorsUrlFlag(cmd);
+  return cmd;
 }
-function addConfirmTokenFlag(cmd) {
-  return cmd.option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed");
-}
-function addSettingsFlags(cmd) {
-  return cmd.option("--interval <duration>", "how often to poll, 5m to 7d (default: per source)").option("--since <date>", "never pick up items modified before this date or timestamp").option("--lookback <days>", "window every poll lists, 1d to 3650d (default: per source)").option("--settle <duration>", "how long an item must stay unchanged before landing, 0s to 1d").option(
-    "--same-name <policy>",
-    "a changed file under the same name: new-version (lands again) or ignore"
-  );
+function parseRoleArn(arn) {
+  if (!ROLE_ARN_RE.test(arn)) {
+    throw new Error(
+      `invalid --role-arn "${arn}": expected arn:aws:iam::<12-digit account>:role/<name>`
+    );
+  }
+  return arn;
 }
-function ttyChoicePrompt(message, choices, defaultChoice, io = { input: process.stdin, output: process.stderr }) {
-  return new Promise((resolvePrompt) => {
-    const rl = readline2.createInterface({
-      input: io.input,
-      output: io.output,
-      ...io.terminal !== void 0 ? { terminal: io.terminal } : {}
-    });
-    let settled = false;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      rl.close();
-      resolvePrompt(value);
-    };
-    rl.on("SIGINT", () => settle(null));
-    rl.on("close", () => settle(null));
-    io.output.write(`${message}
-`);
-    const question = defaultChoice === void 0 ? `[${choices.join("/")}]: ` : `[${choices.join("/")}] (Enter = ${defaultChoice}): `;
-    const askOnce = () => {
-      rl.question(question, (answer) => {
-        const picked = answer.trim().toLowerCase();
-        if (picked === "" && defaultChoice !== void 0) {
-          settle(defaultChoice);
-        } else if (choices.includes(picked)) {
-          settle(picked);
-        } else {
-          io.output.write(`Answer one of: ${choices.join(", ")}
-`);
-          askOnce();
-        }
-      });
-    };
-    askOnce();
-  });
+function awsConfirmAction(verb, id, opts, c) {
+  const state = { role_arn: c.role_arn, external_id: c.external_id };
+  return {
+    resource: "aws-connection",
+    id: `${id}#${confirmDigest(scopeOf(opts), state)}`,
+    verb
+  };
 }
-var POLL_CONFIRM_HELP = [
-  "Confirmation:",
-  "  seed, skip and set --on-policy-change seed print a plan and a --confirm-token;",
-  "  re-run the printed command, token included, to apply it.",
-  "  No dialog opens on production, so an agent or script can run a cut-over unattended:",
-  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod>",
-  "    dr connectors poll seed <filebox> --until <cut-over> --server <prod> --confirm-token <token>",
-  "  (seed --dry-run counts the already-discovered items a seed would mark.)",
-  "  A write with any answer that lands files (set --widen land, set --on-policy-change land,",
-  "  resume --source land) also asks a person to type a word in a dialog on production,",
-  "  even when the same set also seeds (--on-policy-change seed --widen land)."
-].join("\n");
-function registerConnectorsPoll(connectors) {
-  const poll2 = connectors.command("poll").description("Polled file ingestion: the control-plane lands each new file as one version").addHelpText("after", `
-${POLL_CONFIRM_HELP}`);
-  const enableCmd = addSettingsFlags(
-    poll2.command("enable").description("Poll a filebox's binding (dated with the filebox's DATE tag)").argument("<filebox>", "filebox id or uuid")
-  ).action(async (filebox, opts) => {
-    const settings = parseSettings(opts);
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await withMonolith(opts, async (monolith) => {
-        await runPollEnable({
-          client,
-          monolith,
-          filebox,
-          settings,
-          asJson: opts.json === true,
-          signal,
-          out: process.stdout
-        });
-      });
-    });
-  });
-  addCommonFlags(enableCmd, "Output the stored binding as JSON");
-  const setCmd = addConfirmTokenFlag(
-    addSettingsFlags(
-      poll2.command("set").description("Change polling settings (only the given flags change)").argument("<filebox>", "filebox id or uuid")
-    ).option(
-      "--widen <seed|land>",
-      "a wider window: seed (mark exposed items landed) or land them"
-    ).option("--on-policy-change <rekey|seed|land>", "a --same-name switch: rekey, seed or land").addHelpText("after", `
-${POLL_CONFIRM_HELP}`)
-  ).action(
-    async (filebox, opts) => {
-      const changes = parseSettings(opts);
-      const widen = opts.widen === void 0 ? void 0 : parseChoice(opts.widen, "--widen", WIDEN_CHOICES);
-      const onPolicyChange = opts.onPolicyChange === void 0 ? void 0 : parseChoice(opts.onPolicyChange, "--on-policy-change", POLICY_CHOICES);
-      await preflightConfirmToken(
-        pollConfirmAction(filebox, pollSetConfirmVerb(widen, onPolicyChange), scopeOf(opts), {
-          ...changes,
-          ...widen !== void 0 ? { widen } : {},
-          ...onPolicyChange !== void 0 ? { on_policy_change: onPolicyChange } : {}
-        }),
-        opts.confirmToken
-      );
-      await withConnectorsSetup(opts, async (setup) => {
-        const deadline = {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        };
-        await runPollSet({
-          client: setup.client,
-          filebox,
-          changes,
-          settingsArgs: settingsArgs(opts),
-          ...widen !== void 0 ? { widen } : {},
-          ...onPolicyChange !== void 0 ? { onPolicyChange } : {},
-          interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
-          prompt: async (message, choices, defaultChoice) => {
-            deadline.pause();
-            try {
-              return await ttyChoicePrompt(message, choices, defaultChoice);
-            } finally {
-              deadline.resume();
-            }
-          },
-          deadline,
-          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-          scope: scopeOf(opts),
-          targetArgs: targetArgsOf(opts),
-          asJson: opts.json === true,
-          signal: setup.signal,
-          out: process.stdout
-        });
-      });
-    }
-  );
-  addCommonFlags(setCmd, "Output the stored binding as JSON");
-  const disableCmd = poll2.command("disable").description("Stop polling (an item already in flight still finishes)").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollDisable({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
-  });
-  addCommonFlags(disableCmd, "Output the stored binding as JSON");
-  const getCmd = poll2.command("get").description("Show polling settings, last poll, pending seed / rekey and item counts").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollGet({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
+async function verifyAgainstCurrent(action, token, verb, id) {
+  try {
+    await preflightConfirmToken(action, token);
+  } catch (err) {
+    if (!(err instanceof Error) || err.message !== ERR_TOKEN_MISMATCH) throw err;
+    throw new Error(
+      `confirm token does not match ${verb} of AWS connection ${id} as it is now: the connection changed since the plan (role or external ID); plan again. (A token planned for another verb, connection, server, account or --connectors-url is refused the same way.)`,
+      { cause: err }
+    );
+  }
+}
+async function runGated(verb, id, opts, effect, act, print) {
+  await withConnectorsSetup(opts, async (setup) => {
+    try {
+      const c = await getAwsConnection(setup.client, id, { signal: setup.signal });
+      const action = awsConfirmAction(verb, id, opts, c);
+      await verifyAgainstCurrent(action, opts.confirmToken, verb, id);
+      const detail = [
+        `connection:   #${c.id} (org ${c.org_id})`,
+        `datasource:   ${oneLine4(c.secret_ref)}`,
+        `role:         ${oneLine4(c.role_arn)}`,
+        `status:       ${c.status}${c.enabled ? "" : " (disabled)"}`,
+        `external ID:  ${c.external_id}`,
+        `effect:       ${effect}`
+      ];
+      setup.pauseTimeout();
+      await twoStepConfirm({
+        out: process.stdout,
+        action,
+        token: opts.confirmToken,
+        server: scopeOf(opts).serverKey,
+        confirmCmd: `dr connectors aws ${verb} ${id}${targetArgsOf(opts)}`,
+        describe: async () => detail,
+        execute: async () => {
+          setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS);
+          const now = await getAwsConnection(setup.client, id, { signal: setup.signal });
+          if (now.role_arn !== c.role_arn || now.external_id !== c.external_id) {
+            throw new Error(
+              `AWS connection ${id} changed while waiting for confirmation (role or external ID); nothing was sent. Plan again.`
+            );
+          }
+          const result = await act(setup);
+          if (opts.json === true) writeJSONIndented(process.stdout, result);
+          else print(process.stdout, result);
+        }
       });
-    });
+    } catch (err) {
+      throw explainAwsError(err, id);
+    }
   });
-  addCommonFlags(getCmd, "Output the raw binding as JSON");
-  const runCmd = poll2.command("run").description("Poll now").argument("<filebox>", "filebox id or uuid").action(async (filebox, opts) => {
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollRun({
-        client,
-        filebox,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
-      });
-    });
+}
+async function run(opts, act, print, id) {
+  await withConnectorsSetup(opts, async (setup) => {
+    let result;
+    try {
+      result = await act(setup);
+    } catch (err) {
+      throw explainAwsError(err, id);
+    }
+    if (opts.json === true) writeJSONIndented(process.stdout, result);
+    else print(process.stdout, result);
   });
-  addCommonFlags(runCmd, "Output the binding as JSON");
-  const resumeCmd = addConfirmTokenFlag(
-    poll2.command("resume").description("Resume a paused binding (after fixing credentials, or a source change)").argument("<filebox>", "filebox id or uuid").option(
-      "--source <seed|land>",
-      "after a source change: seed (mark present items landed) or land them"
-    )
-  ).action(async (filebox, opts) => {
-    const source = opts.source === void 0 ? void 0 : parseChoice(opts.source, "--source", WIDEN_CHOICES);
-    if (source === "land") {
-      await preflightConfirmToken(
-        pollConfirmAction(filebox, "resume-land", scopeOf(opts)),
-        opts.confirmToken
-      );
+}
+function registerConnectorsAws(connectors) {
+  const aws = connectors.command("aws").description("Customer IAM roles DRIP assumes to read the customer's S3 (external ID, trust)");
+  withFlags2(
+    aws.command("create").description("Register a customer IAM role for a datasource; prints the trust statement").requiredOption("--secret-ref <datasourceId>", "monolith datasource id the role serves").requiredOption("--role-arn <arn>", "customer role, e.g. arn:aws:iam::123456789012:role/x").option("--org-id <id>", "org id (defaults to the JWT org)")
+  ).action(async (opts) => {
+    const secretRef = opts.secretRef.trim();
+    if (secretRef === "" || secretRef.length > 200) {
+      throw new Error(`invalid --secret-ref "${opts.secretRef}": expected 1-200 characters`);
     }
-    await withConnectorsSetup(opts, async (setup) => {
-      await runPollResume({
-        client: setup.client,
-        filebox,
-        ...source !== void 0 ? { source } : {},
-        deadline: {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        },
-        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-        scope: scopeOf(opts),
-        targetArgs: targetArgsOf(opts),
-        asJson: opts.json === true,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    });
+    parseRoleArn(opts.roleArn);
+    const orgId = opts.orgId === void 0 ? void 0 : parsePositiveIntArg2(opts.orgId, "--org-id");
+    const fields = {
+      secret_ref: secretRef,
+      role_arn: opts.roleArn,
+      ...orgId !== void 0 ? { org_id: orgId } : {}
+    };
+    await run(
+      opts,
+      ({ client, signal }) => createAwsConnection(client, fields, { signal }),
+      writeConnection
+    );
   });
-  addCommonFlags(resumeCmd, "Output the binding as JSON");
-  const itemsCmd = poll2.command("items").description("List the item ledger: label, date, state, attempts, version, error").argument("<filebox>", "filebox id or uuid").option("--state <state>", `only items in this state (${POLL_ITEM_STATES.join("|")})`).option("--limit <n>", "page size (default and maximum: the control-plane page size, 100)").option("--after <id>", "start after this item id (the next-page cursor)").action(
-    async (filebox, opts) => {
-      const state = opts.state === void 0 ? void 0 : POLL_ITEM_STATES.find((s) => s === opts.state);
-      if (opts.state !== void 0 && state === void 0) {
-        throw new Error(
-          `invalid --state "${opts.state}": expected one of ${POLL_ITEM_STATES.join(", ")}`
+  withFlags2(
+    aws.command("list").description("List the org's AWS connections").option("--secret-ref <datasourceId>", "only the connection of this datasource")
+  ).action(async (opts) => {
+    await run(
+      opts,
+      ({ client, signal }) => listAwsConnections(client, opts.secretRef, { signal }),
+      writeConnectionTable
+    );
+  });
+  withFlags2(
+    aws.command("get").description("Show an AWS connection and its trust statement").argument("<id>", "connection id")
+  ).action(async (idArg, opts) => {
+    const id = parsePositiveIntArg2(idArg, "connection id");
+    await run(
+      opts,
+      ({ client, signal }) => getAwsConnection(client, id, { signal }),
+      writeConnection,
+      id
+    );
+  });
+  for (const [verb, enabled, help] of [
+    ["enable", true, "Enable an AWS connection; also retries now (stored credentials are dropped)"],
+    ["disable", false, "Disable an AWS connection (stored credentials are dropped)"]
+  ]) {
+    withFlags2(aws.command(verb).description(help).argument("<id>", "connection id")).action(
+      async (idArg, opts) => {
+        const id = parsePositiveIntArg2(idArg, "connection id");
+        await run(
+          opts,
+          ({ client, signal }) => updateAwsConnection(client, id, { enabled }, { signal }),
+          (out, c) => {
+            writeConnection(out, c);
+            if (enabled)
+              out.write(
+                "\nStored credentials were dropped; the poller assumes the role again now.\n"
+              );
+          },
+          id
         );
       }
-      const limit = opts.limit === void 0 ? void 0 : parsePositiveIntArg2(opts.limit, "--limit");
-      const after = opts.after === void 0 ? void 0 : parsePositiveIntArg2(opts.after, "--after");
-      await withConnectorsSetup(opts, async ({ client, signal }) => {
-        await runPollItems({
-          client,
-          filebox,
-          ...state !== void 0 ? { state } : {},
-          ...limit !== void 0 ? { limit } : {},
-          ...after !== void 0 ? { after } : {},
-          asJson: opts.json === true,
-          signal,
-          out: process.stdout
-        });
-      });
+    );
+  }
+  withFlags2(
+    aws.command("set-role").description("Point an AWS connection at another customer role (stored credentials dropped)").argument("<id>", "connection id").requiredOption("--role-arn <arn>", "customer role, e.g. arn:aws:iam::123456789012:role/x")
+  ).action(async (idArg, opts) => {
+    const id = parsePositiveIntArg2(idArg, "connection id");
+    const roleArn = parseRoleArn(opts.roleArn);
+    await run(
+      opts,
+      ({ client, signal }) => updateAwsConnection(client, id, { role_arn: roleArn }, { signal }),
+      (out, c) => {
+        writeConnection(out, c);
+        out.write(
+          `
+The new role must trust the broker with the same external ID (${c.external_id}): add the trust statement above to its trust policy. Stored credentials were dropped; the poller assumes the new role next.
+`
+        );
+      },
+      id
+    );
+  });
+  const confirmHelp = "\nPrints a plan and a --confirm-token; re-run the printed command, token included, to apply it.\nOn production a person must also type a word in a dialog.";
+  withFlags2(
+    aws.command("rotate-external-id").description("Issue a new external ID; AWS refuses the role until the customer updates it").argument("<id>", "connection id").option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed").addHelpText("after", confirmHelp)
+  ).action(async (idArg, opts) => {
+    const id = parsePositiveIntArg2(idArg, "connection id");
+    await runGated(
+      "rotate-external-id",
+      id,
+      opts,
+      "a new external ID; AWS refuses the role until the customer updates its trust policy",
+      ({ client, signal }) => rotateAwsExternalId(client, id, { signal }),
+      writeRotated
+    );
+  });
+  withFlags2(
+    aws.command("delete").description("Delete an AWS connection: the role and its stored credentials").argument("<id>", "connection id").option("--confirm-token <token>", "Token from a prior plan run \u2014 required to proceed").addHelpText("after", confirmHelp)
+  ).action(async (idArg, opts) => {
+    const id = parsePositiveIntArg2(idArg, "connection id");
+    await runGated(
+      "delete",
+      id,
+      opts,
+      "removes the role and its stored credentials; the connector can no longer read S3",
+      async ({ client, signal }) => {
+        await deleteAwsConnection(client, id, { signal });
+        return { deleted: id };
+      },
+      (out, r) => out.write(`Deleted AWS connection ${r.deleted}
+`)
+    );
+  });
+}
+
+// src/commands/connectorsDevFetch.ts
+import { promises as fs19 } from "fs";
+import * as path9 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+function buildDevEnvelope(i) {
+  const config = {
+    ...i.publicConfig,
+    ...i.queryConfig,
+    // Coerce absent values to null (not undefined) so JSON.stringify keeps the
+    // key — matches build_hook_job's dq.get(...) -> None; a dropped objectType
+    // becomes a cryptic KeyError in the runner's dispatch.
+    objectType: i.dataQuery.objectType ?? null,
+    type: i.dataQuery.type ?? null,
+    query: i.dataQuery.query
+  };
+  if (i.period) config.period = i.period;
+  return {
+    correlation_id: i.correlationId,
+    config,
+    secret_ref: i.secretRef,
+    cred_token: "dev-local",
+    output_sas: "file:///out/output.csv",
+    input_sas: null,
+    cursor: null,
+    contract_version: i.contractVersion,
+    metadata: {}
+  };
+}
+function asObject(v) {
+  if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+    return v;
+  }
+  return null;
+}
+function extractDataQueryFields(raw2) {
+  const root = asObject(decodeShape(raw2));
+  if (root === null || Object.keys(root).length === 0) {
+    throw new Error(
+      "no data-query attached to this filebox (empty data_query response) \u2014 attach one in the filebox UI first"
+    );
+  }
+  const cfg = asObject(root.config);
+  const src = cfg ?? root;
+  const query = src.query;
+  let queryObj;
+  if (query === void 0 || query === null) {
+    queryObj = {};
+  } else {
+    const asObj = asObject(query);
+    if (asObj === null) {
+      throw new Error(
+        `data-query \`query\` is not an object (got ${typeof query}) \u2014 expected the Sync-query field`
+      );
     }
+    queryObj = asObj;
+  }
+  return { objectType: queryObj.objectType, type: src.type, query: queryObj };
+}
+function extractCredentials(integration) {
+  const cfg = asObject(integration.config);
+  if (cfg === null || Object.keys(cfg).length === 0) {
+    throw new Error(
+      `datasource ${integration.id} has an empty/missing \`config\` \u2014 nothing to use as connector credentials`
+    );
+  }
+  return { ...cfg };
+}
+var ENV_FILE = "env.json";
+var SECRETS_FILE = "secrets.json";
+var CONNECTION_FILE = "connection.py";
+var QUERY_FILE = "query.py";
+async function writeRunDir(input) {
+  let connectionSource;
+  try {
+    connectionSource = await fs19.readFile(input.connectionPath, "utf-8");
+  } catch {
+    throw new Error(`${input.connectionPath}: connection source not found or unreadable`);
+  }
+  let querySource;
+  try {
+    querySource = await fs19.readFile(input.queryPath, "utf-8");
+  } catch {
+    throw new Error(`${input.queryPath}: dataquery source not found or unreadable`);
+  }
+  await fs19.mkdir(input.outDir, { recursive: true });
+  await fs19.writeFile(
+    path9.join(input.outDir, ENV_FILE),
+    JSON.stringify(input.env, null, 2) + "\n",
+    "utf-8"
   );
-  addCommonFlags(itemsCmd, "Output the raw page as JSON");
-  const retryCmd = poll2.command("retry").description("Queue a failed, waiting or skipped item again").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)").action(async (filebox, item, opts) => {
-    const itemId = parsePositiveIntArg2(item, "item id");
-    await withConnectorsSetup(opts, async ({ client, signal }) => {
-      await runPollRetry({
-        client,
-        filebox,
-        itemId,
-        asJson: opts.json === true,
-        signal,
-        out: process.stdout
+  const secretsPath = path9.join(input.outDir, SECRETS_FILE);
+  await fs19.writeFile(
+    secretsPath,
+    JSON.stringify({ [input.secretRef]: input.credentials }, null, 2) + "\n",
+    "utf-8"
+  );
+  if (process.platform !== "win32") {
+    await fs19.chmod(secretsPath, 384);
+  }
+  await fs19.writeFile(path9.join(input.outDir, CONNECTION_FILE), connectionSource, "utf-8");
+  await fs19.writeFile(path9.join(input.outDir, QUERY_FILE), querySource, "utf-8");
+}
+async function ensureGitignored(entry) {
+  const gitignorePath = path9.join(process.cwd(), ".gitignore");
+  let current = "";
+  try {
+    current = await fs19.readFile(gitignorePath, "utf-8");
+  } catch {
+  }
+  const normalized = entry.split("\\").join("/").replace(/\/+$/, "") + "/";
+  const lines = current.split(/\r?\n/).map((l) => l.trim());
+  if (lines.includes(normalized) || lines.includes(entry)) return;
+  const sep = current === "" || current.endsWith("\n") ? "" : "\n";
+  await fs19.writeFile(gitignorePath, `${current}${sep}${normalized}
+`, "utf-8");
+}
+function parsePositiveInt3(raw2, label) {
+  const n = Number(raw2);
+  if (!Number.isInteger(n) || String(n) !== raw2.trim() || n <= 0) {
+    throw new Error(`invalid ${label}: "${raw2}"`);
+  }
+  return n;
+}
+function registerDevFetch(connectors) {
+  const cmd = connectors.command("dev-fetch").description(
+    "Assemble a local run dir (env.json + secrets.json + connection.py + query.py) for dev-run.sh"
+  ).argument("<fileboxUuid>", "filebox UUID of the connector binding").requiredOption(
+    "--datasource <id>",
+    "datasource (data-integration) id whose credentials to fetch"
+  ).requiredOption(
+    "--document-id <n>",
+    "numeric filebox document id (no uuid->id lookup exists; required)"
+  ).requiredOption("--connection <path>", "path to the connector's connection .py source").requiredOption("--query <path>", "path to the connector's dataquery .py source").option("--from <date>", "period start (paired with --to)").option("--to <date>", "period end (paired with --from)").option("-o, --output <dir>", "output run dir (default ./dev-run/<fileboxUuid>/)").action(async (fileboxUuid, opts) => {
+    const datasourceId = parsePositiveInt3(opts.datasource, "datasource id");
+    const documentId = parsePositiveInt3(opts.documentId, "document-id");
+    if (opts.from === void 0 !== (opts.to === void 0)) {
+      throw new Error("--from and --to must be provided together");
+    }
+    const defaultRoot = path9.join("dev-run", fileboxUuid);
+    const outDir = opts.output ?? defaultRoot;
+    const gitignoreEntry = opts.output ?? "dev-run";
+    const serverKey = resolveServer(opts.server);
+    const host = resolveConnectorsUrl(serverKey, opts.connectorsUrl);
+    const monolithHost = resolve(serverKey).host;
+    const cpSetup = await setupCall(opts.server, opts.account, { host, authHost: monolithHost });
+    try {
+      const binding = await getBinding(cpSetup.client, fileboxUuid, {
+        signal: cpSetup.signal
       });
-    });
-  });
-  addCommonFlags(retryCmd, "Output the item as JSON");
-  const skipCmd = addConfirmTokenFlag(
-    poll2.command("skip").description("Skip an item so it is never landed (two-step confirmation)").argument("<filebox>", "filebox id or uuid").argument("<item>", "item id (from poll items)")
-  ).action(async (filebox, item, opts) => {
-    const itemId = parsePositiveIntArg2(item, "item id");
-    await preflightConfirmToken(
-      pollItemConfirmAction(filebox, itemId, scopeOf(opts)),
-      opts.confirmToken
-    );
-    await withConnectorsSetup(opts, async (setup) => {
-      await runPollSkip({
-        client: setup.client,
-        filebox,
-        itemId,
-        deadline: {
-          pause: () => setup.pauseTimeout(),
-          resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-        },
-        ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-        scope: scopeOf(opts),
-        targetArgs: targetArgsOf(opts),
-        asJson: opts.json === true,
-        signal: setup.signal,
-        out: process.stdout
+      const monoSetup = await setupCall(opts.server, opts.account, {
+        host: monolithHost,
+        authHost: monolithHost
       });
-    });
-  });
-  addCommonFlags(skipCmd, "Output the item as JSON");
-  const seedCmd = addConfirmTokenFlag(
-    poll2.command("seed").description(
-      "Mark items modified at or before --until as already landed (cut-over; token, no dialog)"
-    ).argument("<filebox>", "filebox id or uuid").requiredOption(
-      "--until <timestamp>",
-      "date or timestamp with a zone, e.g. 2026-10-08T17:30:00Z"
-    ).option(
-      "--dry-run",
-      "count the already-discovered items it would mark, without changing anything",
-      false
-    ).addHelpText("after", `
-${POLL_CONFIRM_HELP}`)
-  ).action(
-    async (filebox, opts) => {
-      const until = parseTimestampFlag(opts.until, "--until");
-      const dryRun = opts.dryRun === true;
-      if (!dryRun) {
-        await preflightConfirmToken(
-          pollConfirmAction(filebox, "seed", scopeOf(opts), { until }),
-          opts.confirmToken
+      try {
+        const rawDataQuery = await getDataQueryRaw(monoSetup.client, documentId, {
+          signal: monoSetup.signal
+        });
+        const dataQuery = extractDataQueryFields(rawDataQuery);
+        if (dataQuery.objectType === void 0 || dataQuery.objectType === null || dataQuery.objectType === "") {
+          process.stderr.write(
+            'WARNING: objectType is not set inside the Sync-query (config.query.objectType). get_query_class will receive None \u2014 fine only if the connector has a single default dataset. Add it to the data-query, e.g. config.query.objectType = "<dataset>".\n'
+          );
+        }
+        const integration = await itGet(monoSetup.client, datasourceId, {
+          signal: monoSetup.signal
+        });
+        const credentials = extractCredentials(integration);
+        let period;
+        if (opts.from !== void 0 && opts.to !== void 0) {
+          period = { from: opts.from, to: opts.to };
+        }
+        const env = buildDevEnvelope({
+          correlationId: randomUUID2(),
+          secretRef: binding.secret_ref,
+          publicConfig: binding.public_config,
+          queryConfig: binding.query_config,
+          dataQuery,
+          ...period !== void 0 ? { period } : {},
+          // Deliberate sandbox stub: the fetch/dispatch path doesn't branch on
+          // contract_version, so a fixed "1" is sufficient for a local run.
+          contractVersion: "1"
+        });
+        await writeRunDir({
+          outDir,
+          env,
+          secretRef: binding.secret_ref,
+          credentials,
+          connectionPath: opts.connection,
+          queryPath: opts.query
+        });
+        await ensureGitignored(gitignoreEntry);
+        process.stdout.write(`Wrote run dir: ${outDir}
+`);
+        process.stdout.write(
+          `  env.json (secret_ref=${binding.secret_ref}, flavor=${binding.runtime_flavor})
+`
         );
+        process.stdout.write("  secrets.json (credentials NOT shown)\n");
+        process.stdout.write("  connection.py, query.py\n");
+      } finally {
+        monoSetup.cleanup();
       }
-      await withConnectorsSetup(opts, async (setup) => {
-        await runPollSeed({
-          client: setup.client,
-          filebox,
-          until,
-          untilArg: opts.until.trim(),
-          dryRun,
-          deadline: {
-            pause: () => setup.pauseTimeout(),
-            resume: () => setup.extendTimeout(DEFAULT_CALL_TIMEOUT_MS)
-          },
-          ...opts.confirmToken !== void 0 ? { token: opts.confirmToken } : {},
-          scope: scopeOf(opts),
-          targetArgs: targetArgsOf(opts),
-          asJson: opts.json === true,
-          signal: setup.signal,
-          out: process.stdout
-        });
-      });
+    } catch (err) {
+      throw augmentTlsCertError(err);
+    } finally {
+      cpSetup.cleanup();
     }
+  });
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+  cmd.option(
+    "--connectors-url <url>",
+    "Override the control-plane base URL (e.g. a kubectl port-forward http://localhost:8000)"
   );
-  addCommonFlags(seedCmd, "Output the binding (or the dry-run count) as JSON");
 }
 
 // src/commands/connectors.ts
@@ -69877,18 +70032,18 @@ async function preflightFile(filePath) {
       `${filePath}: unsupported file type "${ext}". Supported: ${[...EXT_TO_MIME.keys()].join(", ")}`
     );
   }
-  let stat3;
+  let stat4;
   try {
-    stat3 = await fsPromises3.stat(filePath);
+    stat4 = await fsPromises3.stat(filePath);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
     throw new Error(`${filePath}: ${m}`);
   }
-  if (!stat3.isFile()) {
+  if (!stat4.isFile()) {
     throw new Error(`${filePath}: not a regular file`);
   }
-  if (stat3.size > MAX_FILE_BYTES) {
-    const mb = (stat3.size / (1024 * 1024)).toFixed(1);
+  if (stat4.size > MAX_FILE_BYTES) {
+    const mb = (stat4.size / (1024 * 1024)).toFixed(1);
     throw new Error(
       `${filePath}: file is ${mb}MB, exceeds ${MAX_FILE_BYTES / (1024 * 1024)}MB limit`
     );
@@ -72634,7 +72789,7 @@ async function resolveTicketTeam(client, team, signal) {
 function errText2(err) {
   return err instanceof Error ? err.message : String(err);
 }
-async function planAttachments(paths, stat3 = async (p) => {
+async function planAttachments(paths, stat4 = async (p) => {
   const st = await fs34.stat(p);
   return { size: st.size, isFile: st.isFile() };
 }) {
@@ -72657,7 +72812,7 @@ async function planAttachments(paths, stat3 = async (p) => {
     }
     let info;
     try {
-      info = await stat3(filePath);
+      info = await stat4(filePath);
     } catch (err) {
       throw new Error(`--attach ${filePath}: ${errText2(err)}`);
     }
@@ -73045,8 +73200,8 @@ async function readAppPassword(src, stdinReader) {
   let raw2;
   if (fromFile) {
     try {
-      const stat3 = await fs34.stat(src.file);
-      if (!stat3.isFile()) {
+      const stat4 = await fs34.stat(src.file);
+      if (!stat4.isFile()) {
         throw new Error(
           "--password-file must be a regular file: a device or pipe can yield without end, and its reported size means nothing"
         );
@@ -74132,7 +74287,7 @@ function registerAppSpaceCommand(root) {
 
 // src/commands/agents.ts
 import { mkdir as mkdir5, writeFile as writeFile8 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/api/aiService.ts
 import { z as z3 } from "zod";
@@ -74500,13 +74655,26 @@ function renderScopeRegistry(registry) {
   const lines = [
     `Actions: ${[...actions, "*"].join(" | ")} (* = every action). Resource * = every resource.`
   ];
+  const unenforced = [];
   for (const product of Array.isArray(registry?.products) ? registry.products : []) {
-    lines.push("", product.name ?? product.key ?? "?");
+    const productName = product.name ?? product.key ?? "?";
+    const accepted = [];
     for (const resource of product.resources ?? []) {
-      const note = resource.enforced === false ? " (not enforced yet)" : "";
       const description = resource.description ? ` \u2014 ${resource.description}` : "";
-      lines.push(`  ${resource.name ?? "?"}${note}${description}`);
+      if (resource.enforced === false) {
+        unenforced.push(`  ${resource.name ?? "?"} (${productName})${description}`);
+      } else {
+        accepted.push(`  ${resource.name ?? "?"}${description}`);
+      }
     }
+    if (accepted.length > 0) lines.push("", productName, ...accepted);
+  }
+  if (unenforced.length > 0) {
+    lines.push(
+      "",
+      "Not enforced yet \u2014 listed for reference; --cli-scopes does not accept these until their product checks them:",
+      ...unenforced
+    );
   }
   return lines.join("\n");
 }
@@ -74526,10 +74694,13 @@ function cliScopesWriteLine(requested, after) {
   if (requested === null && after !== null) {
     return `WARNING: CLI scopes reset was sent but a ceiling is still stored: ${after.join(", ")}.`;
   }
+  if (requested !== null && requested.length > 0 && after === null) {
+    return `WARNING: CLI scopes ${requested.join(", ")} were sent but nothing is stored: the requested ceiling did not land, and the read-only default (${DEFAULT_CLI_SCOPES.join(", ")}) applies.`;
+  }
   return `CLI scopes: ${cliScopesLabel(after)}. Applies from the agent's next session; running sessions keep the ceiling they started with.`;
 }
 var SCOPE_ERROR_HINTS = {
-  INVALID_CLI_SCOPES: "run `agents scope-registry` for the resources and actions this environment knows.",
+  INVALID_CLI_SCOPES: 'run `agents scope-registry` for the resources and actions this environment knows; resources it marks "not enforced yet" are not accepted.',
   CLI_SCOPES_WITHOUT_CLI: "CLI scopes only apply to a CLI-exposed agent. Add `--expose-cli true` (update) or `--expose-cli` (create), or use --reset-cli-scopes to clear them."
 };
 function describeCliScopesError(err) {
@@ -75080,10 +75251,11 @@ function renderToolsProposalText(proposal, resolved) {
 
 // src/commands/agents_skills.ts
 import { mkdir as mkdir4, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname9, join as join16 } from "path";
+import { dirname as dirname9, join as join17 } from "path";
 
 // src/commands/_agentSkillBundle.ts
-import { extname as extname5 } from "path";
+import { readdir as readdir4, stat as stat3 } from "fs/promises";
+import { extname as extname5, join as join16 } from "path";
 function inferContentType(filename) {
   switch (extname5(filename).toLowerCase()) {
     case ".md":
@@ -75121,7 +75293,60 @@ function inferContentType(filename) {
       return void 0;
   }
 }
-async function dirToFiles(baseDir) {
+var SKILL_BUNDLE_LIMITS = {
+  maxFileBytes: 20 * 1024 * 1024,
+  maxTotalBytes: 14 * 1024 * 1024
+};
+var SKILL_ENTRY_OVERHEAD_BYTES = 128;
+async function statSkillFiles(skillRoot) {
+  const out = [];
+  async function walk(dir, prefix) {
+    for (const e of await readdir4(dir, { withFileTypes: true })) {
+      if (isIgnoredSkillEntry(e.name)) continue;
+      const childAbs = join16(dir, e.name);
+      const childRel = prefix === "" ? e.name : `${prefix}/${e.name}`;
+      if (e.isDirectory()) {
+        await walk(childAbs, childRel);
+      } else if (e.isFile()) {
+        out.push({ relPath: childRel, size: (await stat3(childAbs)).size });
+      }
+    }
+  }
+  await walk(skillRoot, "");
+  out.sort((a, b) => a.relPath.localeCompare(b.relPath));
+  return out;
+}
+function assertUploadableSizes(files, limits) {
+  const oversized = files.find((f) => f.size > limits.maxFileBytes);
+  if (oversized !== void 0) {
+    throw new Error(
+      `skill file "${oversized.relPath}" is ${oversized.size} bytes; ai-service accepts at most ${limits.maxFileBytes} bytes per file`
+    );
+  }
+  const empty = files.filter((f) => f.size === 0).map((f) => `"${f.relPath}"`);
+  if (empty.length === 1) {
+    throw new Error(
+      `skill file ${empty[0]} is empty; ai-service rejects empty files \u2014 add content or remove it`
+    );
+  }
+  if (empty.length > 1) {
+    throw new Error(
+      `skill files ${empty.join(", ")} are empty; ai-service rejects empty files \u2014 add content or remove them`
+    );
+  }
+  const total = files.reduce(
+    (sum, f) => sum + f.size + Buffer.byteLength(f.relPath) + SKILL_ENTRY_OVERHEAD_BYTES,
+    0
+  );
+  if (total > limits.maxTotalBytes) {
+    const largest = files.reduce((a, b) => b.size > a.size ? b : a);
+    throw new Error(
+      `skill bundle is ${total} bytes counting its paths (${SKILL_ENTRY_OVERHEAD_BYTES} bytes per file on top); ai-service accepts at most ${limits.maxTotalBytes} bytes in one upload (${files.length} files; largest: "${largest.relPath}", ${largest.size} bytes)`
+    );
+  }
+}
+async function dirToFiles(baseDir, limits = SKILL_BUNDLE_LIMITS) {
+  assertUploadableSizes(await statSkillFiles(baseDir), limits);
   return (await readSkillFiles(baseDir)).map(({ relPath, bytes }) => {
     const contentType = inferContentType(relPath);
     return {
@@ -75289,7 +75514,7 @@ async function runSkillsPull(cfg) {
   const folder = bundleFolder(files);
   const targets = files.map((file) => ({
     file,
-    outPath: join16(baseDir, ...folder, ...relSegments(file.path))
+    outPath: join17(baseDir, ...folder, ...relSegments(file.path))
   }));
   await assertNoOverwrite(
     targets.map((t) => t.outPath),
@@ -75537,6 +75762,11 @@ async function runAgentsSystemEntities(cfg) {
   const ids = (list28) => (list28 ?? []).length > 0 ? (list28 ?? []).join(", ") : "(none)";
   cfg.out.write(`agents:       ${ids(res.agentIds)}
 `);
+  const protectedIds = res.protectedAgentIds;
+  cfg.out.write(
+    Array.isArray(protectedIds) ? `protected:    ${ids(protectedIds)}  (no archive or reach change; content stays editable)
+` : "protected:    (not reported by this ai-service)\n"
+  );
   cfg.out.write(`environments: ${ids(res.environmentIds)}
 `);
   cfg.out.write(`skills:       ${ids(res.skillIds)}
@@ -75773,6 +76003,11 @@ async function runAgentsRefresh(cfg) {
   const apis = toCatalogEntries(catalog.apis ?? []);
   const name = agent.name ?? agentId;
   const v = versionLabel2(agent.version);
+  if (!Array.isArray(agent.tools)) {
+    throw new Error(
+      `getAgent returned no tools list for ${agentId} ${v}; refusing to plan or write a tools change`
+    );
+  }
   if (proposal === void 0) {
     const plan = computeRefreshPlan(agent.tools, apis, topN);
     if (cfg.asJson) {
@@ -75886,15 +76121,15 @@ async function runAgentsPull(cfg) {
     throw new Error(`${agentId}: the response carried no system prompt, tools or skills to pull`);
   }
   await assertNoOverwrite(
-    files.map((f) => join17(baseDir, f.name)),
+    files.map((f) => join18(baseDir, f.name)),
     cfg.force === true
   );
   await mkdir5(baseDir, { recursive: true });
-  for (const f of files) await writeFile8(join17(baseDir, f.name), f.content);
+  for (const f of files) await writeFile8(join18(baseDir, f.name), f.content);
   cfg.out.write(`Wrote ${files.map((f) => f.name).join(", ")} to ${baseDir}/
 `);
   const base = typeof agent.version === "number" ? ` --version-number ${agent.version}` : "";
-  const fileFlags = files.map((f) => `${f.flag} ${shellArg(join17(baseDir, f.name))}`).join(" ");
+  const fileFlags = files.map((f) => `${f.flag} ${shellArg(join18(baseDir, f.name))}`).join(" ");
   cfg.out.write(
     `Edit, then: dr agents update --id ${shellArg(agentId)}${base} ${fileFlags} ${serverFlagText(cfg.client)}
 `
@@ -76486,7 +76721,7 @@ function registerAgentsCommand(root) {
   });
   withTarget(cliScopes);
   const scopeRegistry = agents.command("scope-registry").description(
-    "List the resources and actions a CLI scope may name in this environment \u2014 what --cli-scopes accepts."
+    'List the resources and actions a CLI scope may name in this environment. Resources listed under "Not enforced yet" are not accepted by --cli-scopes.'
   ).option("--json", JSON_HELP).action(async (opts) => {
     const setup = await setupCall(opts.server, opts.account);
     try {
@@ -76891,7 +77126,7 @@ function commandPath(actionCommand) {
 
 // src/telemetry/config.ts
 import { homedir as homedir7 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { readFile as readFile9 } from "fs/promises";
 var TELEMETRY_ENV = "DR_CLI_TELEMETRY";
 var DISABLED_VALUES = /* @__PURE__ */ new Set(["0", "false", "off", "no"]);
@@ -76925,7 +77160,7 @@ function parseCollectorConfig(raw2) {
   return { endpoint, headerName, headerValue };
 }
 function remoteSettingsPath() {
-  return join19(homedir7(), ".claude", "remote-settings.json");
+  return join20(homedir7(), ".claude", "remote-settings.json");
 }
 async function readCollectorConfig(path13 = remoteSettingsPath()) {
   let raw2;