@datarails-ai/dr-cli 1.6.164 → 1.6.166

package/README.md

@@ -457,6 +457,7 @@ dr skill print <name>     # print an embedded skill's SKILL.md
 | Desk                 | `desk teams list`, `desk support-email set <team> <email>`, `desk smtp set/rotate/get/test <team>`, `desk sendgrid register <domain>/status/verify`, `desk ticket create <team> --title --requester-email [--attach <path> ...] [--no-thread]` (`<team>` is an id, support email, or team name. `ticket create` **emails the requester**, so it is confirm-gated and keeps the word gate on prod — see `docs/how-to-create-a-desk-ticket.md`)                                                                                                                                                                                                                                                                    |
 | Connectors           | `connectors publish <dataqueryFile>`, `connectors query repoint <queryId>`, `connectors binding get <fileboxUuid>` (drives the connectors control-plane over VPN)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | Agent Studio         | `agents list/get/versions/test-link/refresh/pull/update/create/mcp-servers/cli-scopes/scope-registry`, `agents set-listed/set-global/set-visibility/archive` (two-step confirm), `agents models/catalog/system-entities`, `agents skills list/get/versions/bundle/pull/create/publish/delete` (`delete` two-step confirm). A CLI-exposed agent's `dr` sessions are capped by its CLI scopes (`resource:action`, default `*:read`): set with `update --cli-scopes <list>` / `--reset-cli-scopes [--cli-scopes-reason <text>]` or `create --expose-cli --cli-scopes <list>`, read with `cli-scopes`; the scope history and restore stay in the Backoffice (service-token only)                                     |
+| Agent release pins   | `agents served`, `agents pin/unpin` (two-step confirm): the version each deployment serves; `--server`, `--servers <keys>` or `--production`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | Skill                | `skill` — prints embedded `SKILL.md`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### Connectors: TLS over VPN

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.164",
+  version: "1.6.166",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.32",
+    "@datarails-ai/dr-appspace-cli": "0.12.33",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-26T10:42:12.958Z";
+var BUILD_TIME = "2026-10-26T13:44:23.917Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -707,6 +707,9 @@ function keys() {
   return ordered.map((s) => s.key);
 }
 var PROD_KEYS = /* @__PURE__ */ new Set(["US", "US2", "UK", "CA", "EU", "STUDIO", "DEMO"]);
+function prodKeys() {
+  return ordered.filter((s) => PROD_KEYS.has(s.key)).map((s) => s.key);
+}
 function isProdServer(input) {
   let server;
   try {
@@ -4371,6 +4374,11 @@ var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   "managed-agent|set-global",
   "managed-agent|set-visibility",
   "managed-agent|archive",
+  // Release pins (dr agents pin / unpin). A pin decides which agent version customers get on
+  // a deployment, and unpinning can jump it several versions at once; one run can cover every
+  // production server. The plan prints each server's current pin, which is the undo.
+  "managed-agent|pin",
+  "managed-agent|unpin",
   "agent-skill|delete",
   // template library: a published entry is offered to every customer org on the server.
   // Not `publish`: a Tier-A-only `publish` verb would make gen-scopes-map classify every
@@ -10050,14 +10058,14 @@ function parseRow3(cells, lineNo, seenSources, seenTargets) {
     );
   }
   seenSources.set(sourceKey2, lineNo);
-  const targetKey = target.toLowerCase();
-  const priorTarget = seenTargets.get(targetKey);
+  const targetKey2 = target.toLowerCase();
+  const priorTarget = seenTargets.get(targetKey2);
   if (priorTarget !== void 0) {
     throw new Error(
       `--file: line ${lineNo}: duplicate target "${target}" (already on line ${priorTarget})`
     );
   }
-  seenTargets.set(targetKey, lineNo);
+  seenTargets.set(targetKey2, lineNo);
   return { lineNo, source, target };
 }
 function requireEmail(value, lineNo, column) {
@@ -21600,7 +21608,7 @@ function registerRescanCommand(root) {
 }
 
 // src/commands/reports.ts
-import { isDeepStrictEqual } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 
 // src/api/reports.ts
 async function list17(client, options) {
@@ -21692,6 +21700,18 @@ function coerceOptionValue(value) {
   return value;
 }
 function buildCalculatedRow(params) {
+  return buildCalculatedValue(
+    params,
+    "--position is required (name of the existing row to anchor to; run `budget-builder build` to list the available anchors)"
+  );
+}
+function buildCalculatedColumn(params) {
+  return buildCalculatedValue(
+    params,
+    '--position is required (name of the existing column to anchor to, e.g. "01/31/2026/Actuals")'
+  );
+}
+function buildCalculatedValue(params, missingPositionMessage) {
   const name = params.name.trim();
   if (name === "") {
     throw new Error("--name is required");
@@ -21702,9 +21722,7 @@ function buildCalculatedRow(params) {
   }
   const positionValue = (params.positionValue ?? "").trim();
   if (positionValue === "") {
-    throw new Error(
-      "--position is required (name of the existing row to anchor to; run `budget-builder build` to list the available anchors)"
-    );
+    throw new Error(missingPositionMessage);
   }
   return {
     name,
@@ -21735,19 +21753,27 @@ function assertNoPeriodLabelRefs(formula) {
   );
 }
 function extractRowValidation(resp, rowName) {
+  return extractCustomValueValidation(resp, rowName, "rows");
+}
+function extractCustomValueValidation(resp, name, axis) {
+  const label = axis === "rows" ? "row" : "column";
+  const noVerdictMap = {
+    valid: false,
+    message: "server returned no custom_value_validation.cols verdict map"
+  };
   if (resp === null || typeof resp !== "object") {
-    return { valid: true, message: "" };
+    return axis === "cols" ? noVerdictMap : { valid: true, message: "" };
   }
   const obj = resp;
   const validation = obj["custom_value_validation"];
   if (validation !== null && typeof validation === "object") {
-    const rowsMap = validation["rows"];
-    if (rowsMap !== null && typeof rowsMap === "object") {
-      const entry = rowsMap[rowName];
+    const axisMap = validation[axis];
+    if (axisMap !== null && typeof axisMap === "object") {
+      const entry = axisMap[name];
       if (entry === void 0 || entry === null || typeof entry !== "object") {
         return {
           valid: false,
-          message: `server returned no verdict for row ${JSON.stringify(rowName)}`
+          message: `server returned no verdict for ${label} ${JSON.stringify(name)}`
         };
       }
       const verdict = entry;
@@ -21771,12 +21797,15 @@ function extractRowValidation(resp, rowName) {
       };
     }
   }
+  if (axis === "cols") {
+    return noVerdictMap;
+  }
   const rows = obj["calculatedRows"];
   if (Array.isArray(rows)) {
     for (const r of rows) {
       if (r === null || typeof r !== "object") continue;
       const row = r;
-      if (row["name"] !== rowName) continue;
+      if (row["name"] !== name) continue;
       if (row["invalid"] === true) {
         return { valid: false, message: tooltipOf(row) };
       }
@@ -21793,6 +21822,62 @@ function tooltipOf(obj) {
   return "server marked the formula invalid (no errorTooltip provided)";
 }
 
+// src/commands/_reportsShared.ts
+function parseReportIdArg(idStr) {
+  const n = Number(idStr);
+  if (!Number.isInteger(n) || String(n) !== idStr) {
+    throw new Error(`invalid report id: "${idStr}"`);
+  }
+  return n;
+}
+function regenerationError(resp) {
+  if (resp === null || typeof resp !== "object" || Array.isArray(resp)) return void 0;
+  const details = resp["generated_report_details"];
+  if (details === null || typeof details !== "object" || Array.isArray(details)) return void 0;
+  const err = details["error"];
+  return typeof err === "string" && err !== "" ? err : void 0;
+}
+
+// src/commands/reports_customColumns.ts
+import { isDeepStrictEqual } from "util";
+
+// src/api/budgetBuilder.ts
+import { randomUUID } from "crypto";
+var TREE_TO_REPORT_PATH = "/api/exreports/reports/tree_to_report";
+var VALIDATE_CUSTOM_VALUE_PATH = "/api/exreports/reports/validate_custom_value";
+var SAVE_REPORT_PATH = "/api/exreports/reports";
+function withTraceId(options) {
+  const { traceId, headers, ...rest } = options ?? {};
+  return {
+    ...rest,
+    headers: { "X-Trace-id": traceId ?? randomUUID(), ...headers }
+  };
+}
+async function treeToReport(client, definition, options) {
+  const out = await client.putJSON(TREE_TO_REPORT_PATH, definition, withTraceId(options));
+  if (out === null) {
+    throw new Error(`PUT ${TREE_TO_REPORT_PATH}: empty response from tree_to_report`);
+  }
+  return out;
+}
+async function validateCustomValue(client, definition, options) {
+  return client.putJSON(VALIDATE_CUSTOM_VALUE_PATH, definition, withTraceId(options));
+}
+async function save(client, definition, options) {
+  const { timeoutMs, pollIntervalMs, sleep: sleep3, now, ...requestOptions } = options ?? {};
+  const out = await writeWithCacheKeyPolling(client, "POST", SAVE_REPORT_PATH, definition, {
+    ...withTraceId(requestOptions),
+    timeoutMs,
+    pollIntervalMs,
+    sleep: sleep3,
+    now
+  });
+  if (out === null) {
+    throw new Error(`POST ${SAVE_REPORT_PATH}: empty response from budget-builder save`);
+  }
+  return out;
+}
+
 // src/commands/_reportWriteTimeout.ts
 var REPORT_WRITE_TIMEOUT_FLAG_HELP = 'Polling budget in milliseconds while the server answers "still running" (orgs with large-reports support process the write on a worker)';
 var REPORT_WRITE_TIMEOUT_DEFAULT = String(WRITE_POLL_TIMEOUT_MS);
@@ -21811,6 +21896,238 @@ function reportWriteCallTimeoutMs(timeoutMs) {
   return timeoutMs + REPORT_WRITE_SETUP_OVERHEAD_MS;
 }
 
+// src/commands/reports_customColumns.ts
+var MAX_ANCHORS_SHOWN = 20;
+function isPlainObject2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function extractColumnAnchors(resp) {
+  if (!isPlainObject2(resp)) return [];
+  const raw2 = resp["cols_position_options"];
+  if (!Array.isArray(raw2)) return [];
+  return raw2.map((o) => isPlainObject2(o) ? o["value"] : void 0).filter((v) => typeof v === "string" && v !== "").map((v) => decodeShape(v));
+}
+async function anchorsHint(client, definition, signal) {
+  let anchors;
+  try {
+    anchors = extractColumnAnchors(
+      await treeToReport(client, definition, { signal })
+    );
+  } catch {
+    return "";
+  }
+  if (anchors.length === 0) return "";
+  const shown = anchors.slice(0, MAX_ANCHORS_SHOWN);
+  const more = anchors.length - shown.length;
+  return ` Valid column names for --position and formula refs (${anchors.length}): ` + shown.map((a) => JSON.stringify(a)).join(", ") + (more > 0 ? `, \u2026 +${more} more` : "");
+}
+async function validateColumnAgainstServer(client, id, flags, signal) {
+  if (id <= 0) {
+    throw new Error("report id must be positive");
+  }
+  const column = buildCalculatedColumn({
+    name: flags.name,
+    formula: flags.formula,
+    ...flags.format !== void 0 ? { format: flags.format } : {},
+    ...flags.positionValue !== void 0 ? { positionValue: flags.positionValue } : {},
+    ...flags.before ? { afterPositionValue: false } : {}
+  });
+  const report = await get10(client, id, { signal });
+  const type = typeof report.type === "string" ? report.type : "";
+  if (type.toLowerCase() !== "financials") {
+    throw new Error(
+      `report ${id} is a ${JSON.stringify(type)} report \u2014 custom columns exist on Financials (Report Builder) reports only; budget columns are generated from the budget year and cycle`
+    );
+  }
+  const stored = isPlainObject2(report.payload) ? decodeShape(report.payload) : {};
+  const existing = Array.isArray(stored["calculatedCols"]) ? stored["calculatedCols"] : [];
+  if (existing.some((c) => isPlainObject2(c) && c["name"] === column.name)) {
+    throw new Error(
+      `report ${id} already has a custom column named ${JSON.stringify(column.name)} \u2014 pick a different --name`
+    );
+  }
+  const withColumn = {
+    ...stored,
+    calculatedCols: [...existing, column]
+  };
+  const resp = await validateCustomValue(client, withColumn, { signal });
+  const verdict = extractCustomValueValidation(resp, column.name, "cols");
+  if (!verdict.valid) {
+    throw new Error(
+      `custom column ${JSON.stringify(column.name)} rejected: ${verdict.message.replace(/\.+$/, "")}.` + await anchorsHint(client, stored, signal)
+    );
+  }
+  return { report, stored, existing, column, resp, warning: verdict.warning };
+}
+async function runReportsValidateColumn(cfg) {
+  const { column, resp, warning } = await validateColumnAgainstServer(
+    cfg.client,
+    cfg.id,
+    cfg.column,
+    cfg.signal
+  );
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, resp);
+    return;
+  }
+  if (warning !== void 0) {
+    cfg.out.write(`warning: ${warning}
+`);
+  }
+  cfg.out.write(`Custom column ${JSON.stringify(column.name)} is valid for report ${cfg.id}.
+`);
+}
+async function runReportsAddColumn(cfg) {
+  const { report, stored, existing, column, warning } = await validateColumnAgainstServer(
+    cfg.client,
+    cfg.id,
+    cfg.column,
+    cfg.signal
+  );
+  const savedColumn = { ...column, invalid: false, errorTooltip: "" };
+  const body = { calculatedCols: [...existing, savedColumn] };
+  const total = body.calculatedCols.length;
+  if (warning !== void 0 && !cfg.asJson) {
+    cfg.out.write(`warning: ${warning}
+`);
+  }
+  if (!cfg.confirm) {
+    if (cfg.asJson) {
+      writeJSONIndented(cfg.out, {
+        action: "add-column",
+        report_id: cfg.id,
+        dry_run: true,
+        ...warning !== void 0 ? { warning } : {},
+        body
+      });
+      return;
+    }
+    cfg.out.write(`Target: account ${cfg.client.serverKey}, operator ${cfg.client.email}
+`);
+    cfg.out.write(
+      `dry-run: would add custom column ${JSON.stringify(column.name)} to report ${cfg.id} ${JSON.stringify(report.name)} (${total} custom column${plural(total)} after). Re-run with --confirm to apply.
+`
+    );
+    cfg.out.write(`  formula:  ${column.formula}
+`);
+    cfg.out.write(
+      `  position: ${column.afterPositionValue ? "right of" : "left of"} ${JSON.stringify(column.positionValue)}
+`
+    );
+    cfg.out.write(`  format:   ${column.format}
+`);
+    return;
+  }
+  const current = await get10(cfg.client, cfg.id, { signal: cfg.signal });
+  const currentPayload = isPlainObject2(current.payload) ? decodeShape(current.payload) : {};
+  if (!isDeepStrictEqual(currentPayload, stored)) {
+    throw new Error(
+      `report ${cfg.id} changed while the column was being validated \u2014 nothing was written; re-run to validate against the current report`
+    );
+  }
+  let resp;
+  try {
+    resp = await update5(cfg.client, cfg.id, body, {
+      signal: cfg.signal,
+      timeoutMs: cfg.timeoutMs,
+      pollIntervalMs: cfg.pollIntervalMs
+    });
+  } catch (err) {
+    if (err instanceof CacheKeyWriteTimeoutError) {
+      throw new Error(
+        `${err.message}. The column may still be added \u2014 check with \`dr reports get ${cfg.id} --json\` before retrying, or raise --timeout.`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+  if (cfg.asJson) {
+    cfg.out.write(JSON.stringify(resp) + "\n");
+  } else {
+    cfg.out.write(
+      `Added custom column ${JSON.stringify(column.name)} to report ${cfg.id} ${JSON.stringify(report.name)} (${total} custom column${plural(total)}).
+`
+    );
+  }
+  const regenError = regenerationError(resp);
+  if (regenError !== void 0) {
+    throw new Error(
+      `report ${cfg.id} was updated, but the platform could not regenerate its Excel output: ` + regenError
+    );
+  }
+}
+function columnFlagsFromOpts(opts) {
+  return {
+    name: opts.name ?? "",
+    formula: opts.formula ?? "",
+    format: opts.format,
+    positionValue: opts.position,
+    before: opts.before === true
+  };
+}
+function addColumnFlags(cmd) {
+  return cmd.argument("<id>", "report id (positive integer)").requiredOption("--name <name>", "Custom column name (unique within the report)").requiredOption(
+    "--formula <formula>",
+    'Column formula using bracket-wrapped COLUMN names, e.g. "[01/31/2026/Actuals]-[01/31/2026/Budget]" (nested column levels are joined with /)'
+  ).option("--format <format>", "Display format for the column (default: '#,###')").requiredOption(
+    "--position <column-name>",
+    "Name of the EXISTING column to place this one next to \u2014 a rejected column lists the valid names"
+  ).option("--before", "Place the column LEFT of the --position anchor (default: right)", false);
+}
+function registerReportsColumnCommands(reports) {
+  const validateCmd = addColumnFlags(
+    reports.command("validate-column").description(
+      "Check a custom column against a Financials report (PUT validate_custom_value) without changing anything"
+    )
+  ).option("--json", "Output the raw validation response JSON", false).action(async (idStr, opts) => {
+    const id = parseReportIdArg(idStr);
+    const column = columnFlagsFromOpts(opts);
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runReportsValidateColumn({
+        client: setup.client,
+        id,
+        column,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(validateCmd);
+  addAccountFlag(validateCmd);
+  const addCmd = addColumnFlags(
+    reports.command("add-column").description(
+      "Validate a custom column and add it to a Financials report (validate_custom_value + PUT report; dry-run unless --confirm)"
+    )
+  ).option("--confirm", "Actually add the column (default is dry-run)", false).option("--timeout <ms>", REPORT_WRITE_TIMEOUT_FLAG_HELP, REPORT_WRITE_TIMEOUT_DEFAULT).option("--json", "Output JSON: the dry-run plan, or the raw server response", false).action(async (idStr, opts) => {
+    const id = parseReportIdArg(idStr);
+    const column = columnFlagsFromOpts(opts);
+    const timeoutMs = parseReportWriteTimeout(opts.timeout);
+    const setup = await setupCall(opts.server, opts.account, {
+      timeoutMs: reportWriteCallTimeoutMs(timeoutMs)
+    });
+    try {
+      await runReportsAddColumn({
+        client: setup.client,
+        id,
+        column,
+        confirm: opts.confirm === true,
+        asJson: opts.json === true,
+        timeoutMs,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(addCmd);
+  addAccountFlag(addCmd);
+}
+
 // src/commands/reports.ts
 async function runReportsList(cfg) {
   const all = await list17(cfg.client, { signal: cfg.signal });
@@ -21865,7 +22182,7 @@ ${JSON.stringify(resp)}
 var DATE_PICKER_PRESETS = ["today", "yesterday", "this_month", "prev_month"];
 var FILE_LINK_KEYS = ["document_data", "report_space_data", "workflow_data"];
 var NOTHING_TO_UPDATE = "nothing to update \u2014 pass --payload-file, --name, --option, or --date-picker-preset";
-function isPlainObject2(v) {
+function isPlainObject3(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function assertDatePickerPreset(value) {
@@ -21884,7 +22201,7 @@ async function readRequestedChanges(flags) {
   if (flags.payloadFile !== void 0) {
     const raw2 = await readJsonPayload(flags.payloadFile);
     const inner = raw2["payload"];
-    if (isPlainObject2(inner)) {
+    if (isPlainObject3(inner)) {
       Object.assign(changes, inner);
       if (typeof raw2["id"] === "number") sourceReportId = raw2["id"];
     } else {
@@ -21912,7 +22229,7 @@ async function readRequestedChanges(flags) {
 function previewValue(v) {
   if (v === void 0) return "(unset)";
   if (Array.isArray(v)) return `[${v.length} item${plural(v.length)}]`;
-  if (isPlainObject2(v)) {
+  if (isPlainObject3(v)) {
     const n = Object.keys(v).length;
     return `{${n} key${plural(n)}}`;
   }
@@ -21922,10 +22239,10 @@ function previewLines(stored, body) {
   const lines = [];
   for (const [key, next] of Object.entries(body)) {
     const prev = stored[key];
-    if (isPlainObject2(prev) && isPlainObject2(next)) {
+    if (isPlainObject3(prev) && isPlainObject3(next)) {
       const subKeys = /* @__PURE__ */ new Set([...Object.keys(prev), ...Object.keys(next)]);
       for (const sub2 of subKeys) {
-        if (isDeepStrictEqual(prev[sub2], next[sub2])) continue;
+        if (isDeepStrictEqual2(prev[sub2], next[sub2])) continue;
         lines.push(`${key}.${sub2}: ${previewValue(prev[sub2])} \u2192 ${previewValue(next[sub2])}`);
       }
       continue;
@@ -21934,13 +22251,6 @@ function previewLines(stored, body) {
   }
   return lines;
 }
-function regenerationError(resp) {
-  if (!isPlainObject2(resp)) return void 0;
-  const details = resp["generated_report_details"];
-  if (!isPlainObject2(details)) return void 0;
-  const err = details["error"];
-  return typeof err === "string" && err !== "" ? err : void 0;
-}
 async function runReportsUpdate(cfg) {
   if (cfg.id <= 0) {
     throw new Error("report id must be positive");
@@ -21957,15 +22267,15 @@ async function runReportsUpdate(cfg) {
       `report ${cfg.id} is a ${JSON.stringify(type)} report \u2014 \`reports update\` edits Financials (Report Builder) reports only; budget reports cannot be edited from the CLI (edit them in Budget management)`
     );
   }
-  const stored = isPlainObject2(report.payload) ? report.payload : {};
+  const stored = isPlainObject3(report.payload) ? report.payload : {};
   if (Object.keys(assignments).length > 0) {
     const fileOptions = changes["options"];
-    const base = isPlainObject2(fileOptions) ? fileOptions : isPlainObject2(stored["options"]) ? stored["options"] : {};
+    const base = isPlainObject3(fileOptions) ? fileOptions : isPlainObject3(stored["options"]) ? stored["options"] : {};
     changes["options"] = { ...base, ...assignments };
   }
   const body = {};
   for (const [key, value] of Object.entries(changes)) {
-    if (!isDeepStrictEqual(value, stored[key])) body[key] = value;
+    if (!isDeepStrictEqual2(value, stored[key])) body[key] = value;
   }
   const changedKeys = Object.keys(body);
   if (sourceReportId !== void 0 && sourceReportId !== cfg.id) {
@@ -22030,7 +22340,7 @@ async function runReportsUpdate(cfg) {
   if (cfg.asJson) {
     cfg.out.write(JSON.stringify(resp) + "\n");
   } else {
-    const respObj = isPlainObject2(resp) ? resp : {};
+    const respObj = isPlainObject3(resp) ? resp : {};
     const name = typeof respObj["name"] === "string" ? respObj["name"] : typeof body["name"] === "string" ? body["name"] : report.name;
     const updatedAt = strOr(
       typeof respObj["updated_at"] === "string" ? respObj["updated_at"] : "",
@@ -22141,13 +22451,6 @@ function renderReportsTable(out, reports) {
   }
   writeTable17(out, rows);
 }
-function parseReportIdArg(idStr) {
-  const n = Number(idStr);
-  if (!Number.isInteger(n) || String(n) !== idStr) {
-    throw new Error(`invalid report id: "${idStr}"`);
-  }
-  return n;
-}
 function parseTableIdFlag4(raw2) {
   if (raw2 === void 0 || raw2 === "") return void 0;
   const n = Number(raw2);
@@ -22293,49 +22596,11 @@ function registerReportsCommand(root) {
   });
   addServerFlag(deleteCmd);
   addAccountFlag(deleteCmd);
+  registerReportsColumnCommands(reports);
 }
 
 // src/commands/budgetBuilder.ts
 import { promises as fs12 } from "fs";
-
-// src/api/budgetBuilder.ts
-import { randomUUID } from "crypto";
-var TREE_TO_REPORT_PATH = "/api/exreports/reports/tree_to_report";
-var VALIDATE_CUSTOM_VALUE_PATH = "/api/exreports/reports/validate_custom_value";
-var SAVE_REPORT_PATH = "/api/exreports/reports";
-function withTraceId(options) {
-  const { traceId, headers, ...rest } = options ?? {};
-  return {
-    ...rest,
-    headers: { "X-Trace-id": traceId ?? randomUUID(), ...headers }
-  };
-}
-async function treeToReport(client, definition, options) {
-  const out = await client.putJSON(TREE_TO_REPORT_PATH, definition, withTraceId(options));
-  if (out === null) {
-    throw new Error(`PUT ${TREE_TO_REPORT_PATH}: empty response from tree_to_report`);
-  }
-  return out;
-}
-async function validateCustomValue(client, definition, options) {
-  return client.putJSON(VALIDATE_CUSTOM_VALUE_PATH, definition, withTraceId(options));
-}
-async function save(client, definition, options) {
-  const { timeoutMs, pollIntervalMs, sleep: sleep3, now, ...requestOptions } = options ?? {};
-  const out = await writeWithCacheKeyPolling(client, "POST", SAVE_REPORT_PATH, definition, {
-    ...withTraceId(requestOptions),
-    timeoutMs,
-    pollIntervalMs,
-    sleep: sleep3,
-    now
-  });
-  if (out === null) {
-    throw new Error(`POST ${SAVE_REPORT_PATH}: empty response from budget-builder save`);
-  }
-  return out;
-}
-
-// src/commands/budgetBuilder.ts
 function assertValidDesign(value, flag) {
   if (typeof value !== "string" || !BUDGET_DESIGN_STYLES.includes(value)) {
     throw new Error(
@@ -22379,7 +22644,7 @@ function designSummary(def) {
   const newDesign = def.options?.standardDesign === true ? "off" : "on";
   return `design=${design}, new design=${newDesign}`;
 }
-var MAX_ANCHORS_SHOWN = 20;
+var MAX_ANCHORS_SHOWN2 = 20;
 function extractRowAnchors(resp) {
   if (resp === null || typeof resp !== "object") return [];
   const raw2 = resp["rows_position_options"];
@@ -22405,7 +22670,7 @@ async function runBudgetBuilderBuild(cfg) {
 `);
   const anchors = extractRowAnchors(resp);
   if (anchors.length > 0) {
-    const shown = anchors.slice(0, MAX_ANCHORS_SHOWN);
+    const shown = anchors.slice(0, MAX_ANCHORS_SHOWN2);
     const more = anchors.length - shown.length;
     cfg.out.write(
       `Row anchors for --position (${anchors.length}): ` + shown.map((a) => JSON.stringify(a)).join(", ") + (more > 0 ? `, \u2026 +${more} more` : "") + "\n"
@@ -33639,7 +33904,7 @@ function describeValue(v) {
       return typeof v;
   }
 }
-function isPlainObject3(v) {
+function isPlainObject4(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function tableIdProblems(value) {
@@ -33655,7 +33920,7 @@ function tableIdProblems(value) {
     );
   }
   value.forEach((entry, i) => {
-    if (!isPlainObject3(entry)) {
+    if (!isPlainObject4(entry)) {
       out.push(`config.table_id[${i}] must be an object, got ${describeValue(entry)}.`);
     } else if (typeof entry["match_type"] !== "string") {
       out.push(
@@ -33667,7 +33932,7 @@ function tableIdProblems(value) {
 }
 function validateMapperConfigShape(config) {
   if (config === void 0) return;
-  if (!isPlainObject3(config)) {
+  if (!isPlainObject4(config)) {
     throw new Error(`config must be a JSON object, got ${describeValue(config)}. ${GET_HINT}`);
   }
   const problems = [];
@@ -33683,7 +33948,7 @@ function validateMapperConfigShape(config) {
       continue;
     }
     value.forEach((entry, i) => {
-      if (!isPlainObject3(entry)) {
+      if (!isPlainObject4(entry)) {
         problems.push(`config.${key}[${i}] must be an object, got ${describeValue(entry)}.`);
       }
     });
@@ -62481,7 +62746,7 @@ async function readHiddenRulesPayload(path13) {
   raw2.forEach((entry, idx) => {
     const ctx = `rules[${idx}]`;
     const base = validateCreate(entry, ctx);
-    if (!isPlainObject4(entry)) {
+    if (!isPlainObject5(entry)) {
       throw new Error(`--file: ${ctx} must be a JSON object`);
     }
     const ctxnId = entry["customer_transaction_id"];
@@ -62540,11 +62805,11 @@ function parseReorderShorthand(raw2) {
   }
   return { rules: entries };
 }
-function isPlainObject4(v) {
+function isPlainObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function validateCreate(raw2, ctx) {
-  if (!isPlainObject4(raw2)) {
+  if (!isPlainObject5(raw2)) {
     throw new Error(`--file: ${ctx} must be a JSON object`);
   }
   if (!Array.isArray(raw2["conditions"]) || raw2["conditions"].length === 0) {
@@ -62600,7 +62865,7 @@ function validateCreate(raw2, ctx) {
   return out;
 }
 function validateCondition(raw2, ctx) {
-  if (!isPlainObject4(raw2)) {
+  if (!isPlainObject5(raw2)) {
     throw new Error(`--file: ${ctx} must be a JSON object`);
   }
   const inputField = raw2["input_field"];
@@ -62665,7 +62930,7 @@ function validateArgsForOperation(op, args, ctx) {
   }
 }
 function validateReorder(raw2, ctx) {
-  if (!isPlainObject4(raw2)) {
+  if (!isPlainObject5(raw2)) {
     throw new Error(`--file: ${ctx} must be a JSON object`);
   }
   if (!Array.isArray(raw2["rules"]) || raw2["rules"].length === 0) {
@@ -62674,7 +62939,7 @@ function validateReorder(raw2, ctx) {
   const seenIds = /* @__PURE__ */ new Set();
   const entries = [];
   raw2["rules"].forEach((entry, idx) => {
-    if (!isPlainObject4(entry)) {
+    if (!isPlainObject5(entry)) {
       throw new Error(`--file: ${ctx}.rules[${idx}] must be a JSON object`);
     }
     const id = entry["id"];
@@ -75447,6 +75712,15 @@ function setAgentGlobal(client, body, options) {
 function setAgentVisibility(client, body, options) {
   return write(client, "v1/ManagedAgents/setAgentVisibility", body, options);
 }
+function getServedAgentVersion(client, body, options) {
+  return read(client, "v1/ManagedAgents/getServedAgentVersion", body, options);
+}
+function pinAgentVersion(client, body, options) {
+  return write(client, "v1/ManagedAgents/pinAgentVersion", body, options);
+}
+function unpinAgent(client, body, options) {
+  return write(client, "v1/ManagedAgents/unpinAgent", body, options);
+}
 function listSkills(client, body, options) {
   return read(client, "v1/ManagedAgents/listSkills", body, options);
 }
@@ -76138,6 +76412,356 @@ function renderToolsProposalText(proposal, resolved) {
   return lines.join("\n");
 }
 
+// src/commands/agents_pin.ts
+var AGENT_ID = "<agentId>";
+var REQUEST_BUDGET_MS = 3e4;
+function resolvePinTargets(opts) {
+  const named = opts.servers !== void 0;
+  const production = opts.production === true;
+  const chosen = [opts.server !== void 0, named, production].filter(Boolean).length;
+  if (chosen > 1) {
+    throw new Error("pass one of --server, --servers or --production");
+  }
+  if (production) return [...prodKeys()];
+  if (!named) return void 0;
+  const keys2 = splitList(opts.servers).map((k) => lookup(k).key);
+  if (keys2.length === 0) throw new Error("--servers: expected comma-separated server keys");
+  return [...new Set(keys2)];
+}
+function targetKey(t) {
+  try {
+    return lookup(t.client.serverKey).key;
+  } catch {
+    return t.client.serverKey;
+  }
+}
+function targetFlag(targets) {
+  const keys2 = targets.map((t) => targetKey(t));
+  const prod = prodKeys();
+  if (keys2.length === prod.length && keys2.every((k, i) => k === prod[i])) return "--production";
+  if (keys2.length === 1) return `--server ${shellArg(keys2[0] ?? "")}`;
+  return `--servers ${shellArg(keys2.join(","))}`;
+}
+function gateServer(targets) {
+  const keys2 = targets.map((t) => targetKey(t));
+  return keys2.find((k) => isProdServer(k)) ?? keys2[0] ?? "";
+}
+function versionText(v) {
+  return v !== void 0 ? `v${v}` : "nothing";
+}
+function describeServed(state) {
+  const serves = `serves ${versionText(state.servedVersion)}`;
+  const pin = state.pinnedVersion !== void 0 ? `pinned v${state.pinnedVersion}` + (state.pinnedBy !== void 0 ? ` by ${state.pinnedBy}` : "") + (state.pinnedAt !== void 0 ? ` on ${state.pinnedAt.slice(0, 10)}` : "") : "not pinned";
+  const reason = state.reason !== void 0 ? ` (${state.reason})` : "";
+  return `${serves} \xB7 ${pin}${reason}`;
+}
+function padKey(key, width) {
+  return key.padEnd(width, " ");
+}
+function keyWidth(targets) {
+  return Math.max(...targets.map((t) => targetKey(t).length));
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function summaryError(summary, causes) {
+  const refusal = causes.find((e) => e instanceof ScopeDeniedError || e instanceof TenantPinError);
+  const first = causes[0];
+  const oneClass = first instanceof Error && first.constructor !== Error && causes.every((e) => e instanceof Error && e.constructor === first.constructor);
+  const keep = refusal ?? (oneClass ? first : void 0);
+  if (keep instanceof Error) {
+    keep.message = summary;
+    return keep;
+  }
+  return new Error(summary, {
+    cause: causes.length === 1 ? first : new AggregateError(causes, summary)
+  });
+}
+function forJson(outcomes) {
+  return outcomes.map((o) => ({
+    server: o.server,
+    ...o.result !== void 0 && { result: o.result },
+    ...o.error !== void 0 && { error: o.error }
+  }));
+}
+function causesOf(outcomes) {
+  return outcomes.filter((o) => o.error !== void 0).map((o) => o.cause);
+}
+async function readServed(targets, agentId) {
+  const outcomes = [];
+  for (const t of targets) {
+    t.extendTimeout?.(REQUEST_BUDGET_MS);
+    try {
+      const result = await getServedAgentVersion(t.client, { agentId }, { signal: t.signal });
+      outcomes.push({ server: targetKey(t), result });
+    } catch (err) {
+      outcomes.push({ server: targetKey(t), error: errorText(err), cause: err });
+    } finally {
+      t.pauseTimeout?.();
+    }
+  }
+  return outcomes;
+}
+function failedServers(outcomes) {
+  return outcomes.filter((o) => o.error !== void 0).map((o) => o.server);
+}
+async function runAgentsServed(cfg) {
+  const agentId = requireId(cfg.id, AGENT_ID);
+  const outcomes = await readServed(cfg.targets, agentId);
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, forJson(outcomes));
+  } else {
+    const width = keyWidth(cfg.targets);
+    for (const o of outcomes) {
+      const line = o.error !== void 0 ? `could not read: ${o.error}` : describeServed(o.result ?? {});
+      cfg.out.write(`${padKey(o.server, width)}  ${line}
+`);
+    }
+  }
+  const failed = failedServers(outcomes);
+  if (failed.length > 0) {
+    throw summaryError(
+      `could not read ${failed.length} of ${outcomes.length} server(s): ${failed.join(", ")}`,
+      causesOf(outcomes)
+    );
+  }
+}
+async function writeEach(cfg, verb, write2) {
+  const prose = proseStream(cfg);
+  const width = keyWidth(cfg.targets);
+  const outcomes = [];
+  for (const t of cfg.targets) {
+    t.extendTimeout?.(REQUEST_BUDGET_MS);
+    try {
+      const result = await write2(t);
+      outcomes.push({ server: targetKey(t), result });
+      const after = result !== null ? describeServed(result) : "done";
+      prose.write(`${padKey(targetKey(t), width)}  ${verb} \u2014 ${after}
+`);
+    } catch (err) {
+      outcomes.push({ server: targetKey(t), error: errorText(err), cause: err });
+      prose.write(`${padKey(targetKey(t), width)}  FAILED \u2014 ${errorText(err)}
+`);
+    }
+  }
+  if (cfg.asJson) writeJSONIndented(cfg.out, forJson(outcomes));
+  const failed = failedServers(outcomes);
+  if (failed.length > 0) {
+    const done = outcomes.filter((o) => o.error === void 0).map((o) => o.server);
+    throw summaryError(
+      `${verb === "pinned" ? "pin" : "unpin"} failed on ${failed.join(", ")}` + (done.length > 0 ? ` but succeeded on ${done.join(", ")} \u2014 those now serve differently` : "") + ". Re-run for the failed server(s) only with --servers.",
+      causesOf(outcomes)
+    );
+  }
+}
+async function planLines(targets, agentId, change) {
+  const outcomes = await readServed(targets, agentId);
+  const failed = failedServers(outcomes);
+  if (failed.length > 0) {
+    const detail = outcomes.filter((o) => o.error !== void 0).map((o) => `${o.server}: ${o.error}`).join("; ");
+    throw summaryError(
+      `could not read the current pin on ${failed.join(", ")} \u2014 ${detail}`,
+      causesOf(outcomes)
+    );
+  }
+  const width = keyWidth(targets);
+  const lines = outcomes.map(
+    (o) => `${padKey(o.server, width)}  ${describeServed(o.result ?? {})} \u2192 ${change(o.result ?? {})}`
+  );
+  return lines;
+}
+async function assertVersionExists(target, agentId, version) {
+  target.extendTimeout?.(REQUEST_BUDGET_MS);
+  let res;
+  try {
+    res = await listAgentVersions(target.client, { agentId }, { signal: target.signal });
+  } finally {
+    target.pauseTimeout?.();
+  }
+  const data4 = res?.data;
+  if (!Array.isArray(data4)) return;
+  if (!data4.some((v) => v.version === version)) {
+    const known = data4.map((v) => v.version).filter((v) => typeof v === "number").sort((a, b) => b - a);
+    throw new Error(
+      `${agentId} has no version ${version}` + (known.length > 0 ? ` (latest is v${known[0]})` : "")
+    );
+  }
+}
+function requireVersion(version) {
+  if (version === void 0) throw new Error("missing required option: --version-number <n>");
+  return requirePositiveInt(version, "--version-number");
+}
+function pinAction(keys2, agentId, version) {
+  return { resource: "managed-agent", id: `${keys2.join(",")}:${agentId}:v${version}`, verb: "pin" };
+}
+function unpinAction(keys2, agentId) {
+  return { resource: "managed-agent", id: `${keys2.join(",")}:${agentId}`, verb: "unpin" };
+}
+async function runAgentsPin(cfg) {
+  const agentId = requireId(cfg.id, AGENT_ID);
+  const version = requireVersion(cfg.version);
+  const flag = targetFlag(cfg.targets);
+  const keys2 = cfg.targets.map((t) => targetKey(t));
+  const action = pinAction(keys2, agentId, version);
+  await preflightConfirmToken(action, cfg.token);
+  const first = cfg.targets[0];
+  if (first === void 0) throw new Error("no server to pin on");
+  await assertVersionExists(first, agentId, version);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: gateServer(cfg.targets),
+    confirmCmd: `dr agents pin --id ${shellArg(agentId)} --version-number ${version} ${flag}`,
+    describe: async () => [
+      `agent: ${agentId}`,
+      `pin: v${version} on ${keys2.join(", ")}`,
+      ...await planLines(cfg.targets, agentId, () => `pinned v${version}`),
+      "Each server keeps serving the pinned version until someone pins another or unpins it."
+    ],
+    execute: () => writeEach(
+      cfg,
+      "pinned",
+      (t) => pinAgentVersion(t.client, { agentId, version }, { signal: t.signal })
+    )
+  });
+}
+async function runAgentsUnpin(cfg) {
+  const agentId = requireId(cfg.id, AGENT_ID);
+  const flag = targetFlag(cfg.targets);
+  const keys2 = cfg.targets.map((t) => targetKey(t));
+  const action = unpinAction(keys2, agentId);
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: gateServer(cfg.targets),
+    confirmCmd: `dr agents unpin --id ${shellArg(agentId)} ${flag}`,
+    describe: async () => [
+      `agent: ${agentId}`,
+      `unpin on ${keys2.join(", ")}`,
+      ...await planLines(cfg.targets, agentId, () => "not pinned"),
+      "An unpinned server serves the newest version on its SDK track, which can be several versions ahead of the pin."
+    ],
+    execute: () => writeEach(cfg, "unpinned", (t) => unpinAgent(t.client, { agentId }, { signal: t.signal }))
+  });
+}
+async function openEach(keys2, open3) {
+  const setups = [];
+  const failures = [];
+  const causes = [];
+  for (const key of keys2) {
+    try {
+      setups.push(await open3(key));
+    } catch (err) {
+      failures.push(`${key}: ${errorText(err)}`);
+      causes.push(err);
+    }
+  }
+  if (failures.length > 0) {
+    for (const s of setups) s.cleanup();
+    throw summaryError(
+      `cannot open ${failures.length} of ${keys2.length} server(s) \u2014 nothing was read or written:
+  ` + failures.join("\n  "),
+      causes
+    );
+  }
+  return setups;
+}
+function knownKeys(opts) {
+  const keys2 = resolvePinTargets(opts);
+  if (keys2 !== void 0 || opts.server === void 0) return keys2;
+  try {
+    return [lookup(opts.server.trim()).key];
+  } catch {
+    return void 0;
+  }
+}
+async function preflightTargets(opts, token, action) {
+  if (token === void 0 || token.trim() === "") return;
+  const keys2 = knownKeys(opts);
+  if (keys2 !== void 0) await preflightConfirmToken(action(keys2), token);
+}
+async function openTargets(opts) {
+  const keys2 = resolvePinTargets(opts);
+  const open3 = async (key) => {
+    const setup = await setupCall(key, opts.account);
+    setup.pauseTimeout();
+    return setup;
+  };
+  const setups = keys2 === void 0 ? [await open3(opts.server)] : await openEach(keys2, open3);
+  const targets = setups.map((s) => ({
+    client: s.client,
+    signal: s.signal,
+    pauseTimeout: s.pauseTimeout,
+    extendTimeout: s.extendTimeout
+  }));
+  return { targets, setups };
+}
+function withPinTargets(cmd) {
+  withTarget(cmd);
+  cmd.option(
+    "--servers <keys>",
+    "Comma-separated server keys, e.g. US,UK. Each needs its own dr login."
+  );
+  cmd.option("--production", "Every production server: US, US2, UK, CA, EU, STUDIO, DEMO.");
+  return cmd;
+}
+function registerAgentPinCommands(agents) {
+  const served = agents.command("served").description(
+    "Show which version of an agent each server serves, and the release pin it holds, if any."
+  ).option("--id <agentId>", "Agent id.").option("--json", JSON_HELP).action(async (opts) => {
+    const { targets, setups } = await openTargets(opts);
+    try {
+      await runAgentsServed({ targets, ...std(), id: opts.id, asJson: opts.json === true });
+    } finally {
+      for (const s of setups) s.cleanup();
+    }
+  });
+  withPinTargets(served);
+  const pin = agents.command("pin").description(
+    "Hold a server on one agent version: it serves that version whatever is saved later. (two-step confirm)"
+  ).option("--id <agentId>", "Agent id.").option("--version-number <n>", "The version to serve.").option("--confirm-token <token>", CONFIRM_HELP).option("--json", JSON_HELP).action(async (opts) => {
+    const agentId = requireId(opts.id, AGENT_ID);
+    const version = requireVersion(opts.versionNumber);
+    await preflightTargets(opts, opts.confirmToken, (keys2) => pinAction(keys2, agentId, version));
+    const { targets, setups } = await openTargets(opts);
+    try {
+      await runAgentsPin({
+        targets,
+        ...std(),
+        id: opts.id,
+        version: opts.versionNumber,
+        token: opts.confirmToken,
+        asJson: opts.json === true
+      });
+    } finally {
+      for (const s of setups) s.cleanup();
+    }
+  });
+  withPinTargets(pin);
+  const unpin = agents.command("unpin").description(
+    "Drop a server's pin: it goes back to serving the newest version on its SDK track. (two-step confirm)"
+  ).option("--id <agentId>", "Agent id.").option("--confirm-token <token>", CONFIRM_HELP).option("--json", JSON_HELP).action(async (opts) => {
+    const agentId = requireId(opts.id, AGENT_ID);
+    await preflightTargets(opts, opts.confirmToken, (keys2) => unpinAction(keys2, agentId));
+    const { targets, setups } = await openTargets(opts);
+    try {
+      await runAgentsUnpin({
+        targets,
+        ...std(),
+        id: opts.id,
+        token: opts.confirmToken,
+        asJson: opts.json === true
+      });
+    } finally {
+      for (const s of setups) s.cleanup();
+    }
+  });
+  withPinTargets(unpin);
+}
+
 // src/commands/agents_skills.ts
 import { mkdir as mkdir4, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname9, join as join17 } from "path";
@@ -76707,7 +77331,7 @@ function registerAgentStudioCommands(agents) {
 }
 
 // src/commands/agents.ts
-var AGENT_ID = "<agentId>";
+var AGENT_ID2 = "<agentId>";
 function agentRef(agentId, version) {
   return version !== void 0 ? { agentId, version: requirePositiveInt(version, "--version-number") } : { agentId };
 }
@@ -76773,7 +77397,7 @@ async function runAgentsList(cfg) {
   }
 }
 async function runAgentsGet(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const ref2 = agentRef(agentId, cfg.version);
   const [res, cliScopes] = await Promise.all([
     getAgent(cfg.client, ref2, { signal: cfg.signal }),
@@ -76794,7 +77418,7 @@ async function tryFetchCliScopes(client, agentId, signal) {
   }
 }
 async function runAgentsVersions(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   writeJSONIndented(
     cfg.out,
     await listAgentVersions(cfg.client, { agentId }, { signal: cfg.signal })
@@ -76815,7 +77439,7 @@ async function runAgentsMcpServers(cfg) {
 `);
 }
 async function runAgentsCliScopes(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const res = await getAgentCliScopes(cfg.client, { agentId }, { signal: cfg.signal });
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, res);
@@ -76838,7 +77462,7 @@ async function runAgentsScopeRegistry(cfg) {
 `);
 }
 async function runAgentsTestLink(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const url = resolveTestChatLink({
     client: cfg.client,
     agentId,
@@ -76867,7 +77491,7 @@ async function runAgentsTestLink(cfg) {
   }
 }
 async function runAgentsRefresh(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const hasPlan = (cfg.plan ?? "").trim() !== "";
   if (cfg.apply === true && !hasPlan) {
     throw new Error(
@@ -76987,7 +77611,7 @@ Applied. ${agentId} (base v${version}) \u2192 v${res?.version ?? "?"}.
   }
 }
 async function runAgentsPull(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const agent = await getAgent(cfg.client, agentRef(agentId, cfg.version), {
     signal: cfg.signal
   });
@@ -77025,7 +77649,7 @@ async function runAgentsPull(cfg) {
   );
 }
 async function runAgentsUpdate(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const toggleCli = cfg.exposeCli !== void 0 ? parseExposureToggle("cli", cfg.exposeCli) : void 0;
   const removeSdk = cfg.exposeSdk !== void 0 ? requireExposureRemoval("sdk", cfg.exposeSdk) : void 0;
   const mcpServers = cfg.mcpServers !== void 0 ? parseMcpServers(cfg.mcpServers) : void 0;
@@ -77220,7 +77844,7 @@ function reachMessage(kind, agentId, value) {
 `;
 }
 async function runReachFlip(cfg, kind, write2) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const value = requireBool(cfg.value, "--value");
   const serverKey = cfg.client.serverKey;
   const action = {
@@ -77267,7 +77891,7 @@ async function runAgentsSetGlobal(cfg) {
   );
 }
 async function runAgentsSetVisibility(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const everyone = cfg.everyone === true;
   const grants = cfg.grant ?? [];
   if (everyone && grants.length > 0) {
@@ -77327,7 +77951,7 @@ function describeVisibility(visibility) {
   return `restricted to ${formatVisibilityGrants(visibility.grants)}`;
 }
 async function runAgentsArchive(cfg) {
-  const agentId = requireId(cfg.id, AGENT_ID);
+  const agentId = requireId(cfg.id, AGENT_ID2);
   const serverKey = cfg.client.serverKey;
   const action = {
     resource: "managed-agent",
@@ -77703,6 +78327,7 @@ function registerAgentsCommand(root) {
     }
   });
   withTarget(archive);
+  registerAgentPinCommands(agents);
   registerAgentStudioCommands(agents);
   registerAgentSkillsCommand(agents);
 }

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.164",
+  "cliVersion": "1.6.166",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -1047,6 +1047,22 @@
         }
       ]
     },
+    "reports validate-column": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "read"
+        }
+      ]
+    },
+    "reports add-column": {
+      "requires": [
+        {
+          "resource": "tables",
+          "action": "write"
+        }
+      ]
+    },
     "budget-builder build": {
       "requires": [
         {
@@ -4969,6 +4985,30 @@
         }
       ]
     },
+    "agents served": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "read"
+        }
+      ]
+    },
+    "agents pin": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "destructive"
+        }
+      ]
+    },
+    "agents unpin": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "destructive"
+        }
+      ]
+    },
     "agents catalog": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -273,6 +273,7 @@ area's gotchas.
   from the widget's own settings only.
 - `storyboards list|get|slides|prepare|delete`
 - `reports list|get|clone|update|delete` — `update <id>` edits a Financials (Report Builder) report: `--payload-file` (payload keys, or `reports get --json` output), `--name`, `--option k=v`, `--date-picker-preset`; dry-run unless `--confirm`
+- `reports validate-column|add-column <id> --name <s> --formula <s> --position <col> [--before] [--format <f>]` — custom (calculated) column on a Financials report, stored in `payload.calculatedCols`. Formula refs and `--position` are COLUMN names with nested levels joined by `/` (`[01/31/2026/Actuals]-[01/31/2026/Budget]`); a rejected column lists the valid names. `--before` = left of the anchor (default right). `add-column` is dry-run unless `--confirm`. Budget reports have no custom columns (their columns come from the budget year/cycle)
 - `extables list|get|clone|delete`
 
 **Budget Builder (Budget management templates)** → [reference/budget-builder.md](reference/budget-builder.md)

package/dist/skills/dr-cli/reference/budget-builder.md

@@ -111,7 +111,10 @@ dr reports get <new-id> --server <key> --json  # round-trip check; echo settings
 - `budget_info.scenario` wire values are lowercase: `budget` | `forecast` |
   `manual` (the UI's "leave empty / manual" option = `manual`).
 - Budget COLUMNS are auto-generated server-side from `budget_info` +
-  `date_picker` — leave `cols: []`; only rows are authored.
+  `date_picker` — leave `cols: []`; only rows are authored. There are no
+  custom columns on a budget template: the server ignores `calculatedCols`
+  for `type: "budget"` and the web Budget Builder has no control for them.
+  Custom columns exist on Financials reports only (`dr reports add-column`).
 - Row HIERARCHY is encoded by nesting, NOT by flat array order: the child
   field node goes in the parent node's `children: [...]` array (recursive).
   Flat siblings in `rows[]` render as independent top-level row fields.

package/dist/skills/dr-cli/reference/safety.md

@@ -64,6 +64,9 @@ delete-all`; `filebox archive` and `filebox data-query clear`;
 `agents archive` and the three agent-reach flips `agents set-listed` /
 `set-global` / `set-visibility` (each changes who can reach the agent for every
 organization at once);
+`agents pin` / `unpin` (decide which agent version customers get on a server; one
+run with `--production` covers every production server, so relay the plan's
+per-server lines — they are also the undo);
 `error-enrichments import` (replaces every rule on the server, zeroes all
 hits/feedback counters, and reassigns every rule id); and
 `dashboards push --override` / `filebox push --override`. `import` is **not** an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.164",
+  "version": "1.6.166",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.32",
+    "@datarails-ai/dr-appspace-cli": "0.12.33",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",