@datarails-ai/dr-cli 1.6.185 → 1.6.187

package/README.md

@@ -332,9 +332,9 @@ are covered); a missing `--server`, or a missing `--account` in customer mode;
 `--user-id`); a host override (`--app-space-host`, `DR_APP_SPACE_HOST`,
 `--connectors-url`); in org mode, any command the scopes map does not prove
 read-only, plus the few read-scoped commands with side effects
-(`devices request-logs`, `desk smtp test`, `dashboards prepare`,
-`storyboards prepare`). A pin that is set but malformed refuses every command
-(`--help` and `--version` still print). A refusal exits 3, like a scope denial.
+(`devices request-logs`, `desk smtp test`, `dashboards prepare`). A pin that is
+set but malformed refuses every command (`--help` and `--version` still print).
+A refusal exits 3, like a scope denial.
 
 ### API keys (headless and CI)
 
@@ -465,6 +465,7 @@ dr skill print <name>     # print an embedded skill's SKILL.md
 | Connectors           | `connectors publish <dataqueryFile>`, `connectors query repoint <queryId>`, `connectors binding get <fileboxUuid>` (drives the connectors control-plane over VPN)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | Agent Studio         | `agents list/get/versions/test-link/refresh/pull/update/create/mcp-servers/cli-scopes/scope-registry`, `agents set-listed/set-global/set-visibility/archive` (two-step confirm), `agents models/catalog/system-entities`, `agents skills list/get/versions/bundle/pull/create/publish/delete` (`delete` two-step confirm). A CLI-exposed agent's `dr` sessions are capped by its CLI scopes (`resource:action`, default `*:read`): set with `update --cli-scopes <list>` / `--reset-cli-scopes [--cli-scopes-reason <text>]` or `create --expose-cli --cli-scopes <list>`, read with `cli-scopes`; the scope history and restore stay in the Backoffice (service-token only)                                     |
 | Agent release pins   | `agents served`, `agents pin/unpin` (two-step confirm): the version each deployment serves; `--server`, `--servers <keys>` or `--production`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| Agent schedules      | `agents schedules list/create/update/delete` (`delete` two-step confirm): ai-service cron runs of a managed agent, as the session user. `--agent-id` defaults to the token's `agent_id` claim. Like every `agents` command, an agent needs `managed-agents:write` in its CLI scopes (`managed-agents:destructive` for `delete`): `agents update --id <agentId> --cli-scopes '*:read,managed-agents:write,managed-agents:destructive'`                                                                                                                                                                                                                                                                            |
 | Skill                | `skill` — prints embedded `SKILL.md`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### Connectors: TLS over VPN

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.185",
+  version: "1.6.187",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-11-01T20:44:10.716Z";
+var BUILD_TIME = "2026-11-02T11:55:21.441Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -4390,7 +4390,11 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   "template-library|update",
   "template-library|unpublish",
   "template-library|archive",
-  "template-library|restore"
+  "template-library|restore",
+  // agent schedules (dr agents schedules delete). One org row; the plan prints its cron,
+  // timezone, agent, prompt and run-as user, and `dr agents schedules create` with them
+  // restores it (running as the re-creator: create cannot set the run-as user).
+  "managed-agent-schedule|delete"
 ]);
 var PROD_GATE_TIER_A = /* @__PURE__ */ new Set([
   // workflow / mec — soft-delete + cascade deletes. `archive` also covers the
@@ -5211,8 +5215,7 @@ var ORG_MODE_UNSCOPED_ALLOWED = /* @__PURE__ */ new Set([
 var ORG_MODE_READ_SCOPED_REFUSED = /* @__PURE__ */ new Set([
   "devices request-logs",
   "desk smtp test",
-  "dashboards prepare",
-  "storyboards prepare"
+  "dashboards prepare"
 ]);
 var LOCAL_COMMANDS_WITH_TARGET_FLAGS = /* @__PURE__ */ new Set([
   "app-space scaffold"
@@ -23605,7 +23608,7 @@ async function getById2(client, id, options) {
   return out;
 }
 function scenarioContextQuery(ctx) {
-  return `scenario=${encodeURIComponent(ctx.scenario)}&scenario_cycle=${encodeURIComponent(ctx.scenario_cycle)}&planning_scenario=${encodeURIComponent(ctx.planning_scenario)}`;
+  return `scenario=${encodeURIComponent(ctx.scenario)}&scenario_cycle=${encodeURIComponent(ctx.scenario_cycle)}&cycle_year=${ctx.cycle_year ?? ""}&planning_scenario=${encodeURIComponent(ctx.planning_scenario)}`;
 }
 var NO_DRIVER_404_RE = /: HTTP 404: \{\}\s*$/;
 async function getDriver(client, id, ctx, options) {
@@ -28323,27 +28326,54 @@ import { promises as fs14 } from "fs";
 var DEFAULT_SCENARIO = "Actuals";
 function addScenarioContextFlags(cmd) {
   return cmd.option("--scenario <name>", "Scenario name \u2014 free text, matched exactly", DEFAULT_SCENARIO).option("--cycle <label>", "Scenario cycle label \u2014 free text, matched exactly (default: none)").option(
+    "--cycle-year <yyyy>",
+    "Fiscal year of the --cycle, e.g. 2027 \u2014 required with --cycle, refused without it"
+  ).option(
     "--planning-scenario <name>",
     "Planning scenario name \u2014 free text, matched exactly (default: none)"
   );
 }
+function parseCycleYear(raw2) {
+  const s = raw2.trim();
+  if (!/^\d{4}$/.test(s)) {
+    throw new Error(`invalid --cycle-year "${raw2}" (expected a four-digit fiscal year, e.g. 2027)`);
+  }
+  return Number(s);
+}
 function resolveScenarioContext(opts) {
   const scenario = opts.scenario ?? "";
+  const cycle = opts.cycle ?? "";
+  const cycleYear = opts.cycleYear === void 0 ? null : parseCycleYear(opts.cycleYear);
+  if (cycle !== "" && cycleYear === null) {
+    throw new Error(
+      `--cycle ${JSON.stringify(cycle)} needs --cycle-year <yyyy>: a cycle name repeats every year, so the server addresses a cycle only with its fiscal year`
+    );
+  }
+  if (cycle === "" && cycleYear !== null) {
+    throw new Error("--cycle-year is given only with --cycle <label>");
+  }
   return {
     scenario: scenario === "" ? DEFAULT_SCENARIO : scenario,
-    scenario_cycle: opts.cycle ?? "",
+    scenario_cycle: cycle,
+    cycle_year: cycleYear,
     planning_scenario: opts.planningScenario ?? ""
   };
 }
 function formatScenarioContext(ctx) {
-  return `scenario=${JSON.stringify(ctx.scenario)} cycle=${JSON.stringify(ctx.scenario_cycle)} planning-scenario=${JSON.stringify(ctx.planning_scenario)}`;
+  return `scenario=${JSON.stringify(ctx.scenario)} cycle=${JSON.stringify(ctx.scenario_cycle)} ` + (ctx.cycle_year === null ? "" : `cycle-year=${ctx.cycle_year} `) + `planning-scenario=${JSON.stringify(ctx.planning_scenario)}`;
 }
 function sameScenarioContext(a, b) {
-  return a.scenario === b.scenario && a.scenario_cycle === b.scenario_cycle && a.planning_scenario === b.planning_scenario;
+  const yearUnknown = a.cycle_year === void 0 || b.cycle_year === void 0;
+  return a.scenario === b.scenario && a.scenario_cycle === b.scenario_cycle && (yearUnknown || a.cycle_year === b.cycle_year) && a.planning_scenario === b.planning_scenario;
+}
+function findScenarioContext(rows, ctx) {
+  const exact = rows.findIndex((r) => r.cycle_year !== void 0 && sameScenarioContext(r, ctx));
+  return exact >= 0 ? exact : rows.findIndex((r) => sameScenarioContext(r, ctx));
 }
 function scenarioContextFlags(ctx) {
   const parts = [`--scenario ${shellQuote(ctx.scenario)}`];
   if (ctx.scenario_cycle !== "") parts.push(`--cycle ${shellQuote(ctx.scenario_cycle)}`);
+  if (ctx.cycle_year !== null) parts.push(`--cycle-year ${ctx.cycle_year}`);
   if (ctx.planning_scenario !== "") {
     parts.push(`--planning-scenario ${shellQuote(ctx.planning_scenario)}`);
   }
@@ -28518,6 +28548,7 @@ function renderDriver(out, d) {
   writeRows4(out, [
     ["scenario", dash(d.scenario)],
     ["cycle", dash(d.scenario_cycle)],
+    ["cycle_year", dash(d.cycle_year)],
     ["planning_scenario", dash(d.planning_scenario)],
     ["unit", dash(d.unit)],
     ["is_additive", dash(d.is_additive)],
@@ -28546,12 +28577,15 @@ function renderCalculations(out, calcs) {
     out.write("(no scenario calculations)\n");
     return;
   }
-  const rows = [["ID", "SCENARIO", "CYCLE", "PLANNING_SCENARIO", "FORMULA"]];
+  const rows = [
+    ["ID", "SCENARIO", "CYCLE", "CYCLE_YEAR", "PLANNING_SCENARIO", "FORMULA"]
+  ];
   for (const c of calcs) {
     rows.push([
       dash(c.id),
       dash(c.scenario),
       dash(c.scenario_cycle),
+      dash(c.cycle_year),
       dash(c.planning_scenario),
       c.presented_formula
     ]);
@@ -28681,10 +28715,21 @@ function toCalcPayload(c) {
   return {
     scenario: c.scenario,
     scenario_cycle: c.scenario_cycle,
+    cycle_year: c.cycle_year ?? null,
     planning_scenario: c.planning_scenario,
     presented_formula: c.presented_formula
   };
 }
+function assertKeptRowsHaveYear(id, calculations, skip) {
+  if (!calculations.some((c) => c.cycle_year !== void 0)) return;
+  const bad = calculations.find(
+    (c, i) => i !== skip && c.scenario_cycle !== "" && (c.cycle_year ?? null) === null
+  );
+  if (bad === void 0) return;
+  throw new Error(
+    `metric ${id} keeps a calculation for ${formatScenarioContext({ ...bad, cycle_year: null })}${bad.id === void 0 ? "" : ` (id ${bad.id})`} with no cycle year; the server refuses any calculations list holding a cycle without its fiscal year, so nothing was changed. Fix or remove that calculation in the web app first.`
+  );
+}
 async function readCalculations(client, id, signal) {
   const m = decodeShape(await getById2(client, id, { signal }));
   return { name: m.name ?? "", calculations: m.calculations ?? [] };
@@ -28701,12 +28746,13 @@ async function runCalculationsAdd(cfg) {
   const presented_formula = toWireFormula(cfg.formula);
   const { calculations } = await readCalculations(cfg.client, cfg.id, cfg.signal);
   const current = calculations.map(toCalcPayload);
-  const idx = current.findIndex((c) => sameScenarioContext(c, cfg.ctx));
+  const idx = findScenarioContext(calculations, cfg.ctx);
   if (idx >= 0 && !cfg.replace) {
     throw new Error(
       `metric ${cfg.id} already has a calculation for ${formatScenarioContext(cfg.ctx)} (${current[idx].presented_formula}); pass --replace to overwrite it`
     );
   }
+  assertKeptRowsHaveYear(cfg.id, calculations, idx);
   const entry = { ...cfg.ctx, presented_formula };
   const next = idx >= 0 ? current.map((c, i) => i === idx ? entry : c) : [...current, entry];
   const updated = await update6(
@@ -28747,13 +28793,15 @@ async function runCalculationsRemove(cfg) {
     describe: async () => {
       const { name, calculations } = await readCalculations(cfg.client, cfg.id, cfg.signal);
       const all = calculations.map(toCalcPayload);
-      const hit = all.find((c) => sameScenarioContext(c, cfg.ctx));
+      const idx = findScenarioContext(calculations, cfg.ctx);
+      const hit = all[idx];
       if (hit === void 0) {
         throw new Error(
           `metric ${cfg.id} has no calculation for ${formatScenarioContext(cfg.ctx)}; list them with \`dr metrics calculations list ${cfg.id}\``
         );
       }
-      remaining = all.filter((c) => !sameScenarioContext(c, cfg.ctx));
+      assertKeptRowsHaveYear(cfg.id, calculations, idx);
+      remaining = all.filter((_, i) => i !== idx);
       return [
         `metric: ${JSON.stringify(name === "" ? "(unnamed)" : name)}`,
         `context: ${formatScenarioContext(cfg.ctx)}`,
@@ -28932,7 +28980,7 @@ function collectArray5(value, previous) {
 }
 function wireMetricsDrivers(metrics) {
   const driver = metrics.command("driver").description(
-    "Driver definition and values of a DRIVER metric, per scenario context (--scenario / --cycle / --planning-scenario: free-text names, matched exactly)"
+    "Driver definition and values of a DRIVER metric, per scenario context (--scenario / --cycle / --planning-scenario: free-text names, matched exactly; --cycle-year: the fiscal year, required with --cycle)"
   );
   const driverGetCmd = addScenarioContextFlags(
     driver.command("get").description("Show the driver definition for one scenario context").argument("<id>", "DRIVER metric id (positive integer)")
@@ -29068,7 +29116,7 @@ function wireMetricsDrivers(metrics) {
   addServerFlag(valuesSetCmd);
   addAccountFlag(valuesSetCmd);
   const calculations = metrics.command("calculations").description(
-    "Scenario-bound formulas of a CALC metric, one per scenario context (--scenario / --cycle / --planning-scenario: free-text names, matched exactly)"
+    "Scenario-bound formulas of a CALC metric, one per scenario context (--scenario / --cycle / --planning-scenario: free-text names, matched exactly; --cycle-year: the fiscal year, required with --cycle)"
   );
   const calcListCmd = calculations.command("list").description("List a CALC metric's scenario calculations").argument("<id>", "CALC metric id (positive integer)").option("--json", "Output raw JSON instead of a table", false).action(async (idStr, opts) => {
     const id = parseMetricIdArg(idStr);
@@ -55634,9 +55682,9 @@ async function listTemplates(client, params, options) {
   );
   return out ?? [];
 }
-async function getTemplate(client, id, options) {
+async function getTemplate(client, id, options, params) {
   const out = await client.getJSON(
-    `/api/processes/v2/process_templates/${id}`,
+    `/api/processes/v2/process_templates/${id}${buildQueryString(params)}`,
     options
   );
   if (out === null) {
@@ -55655,9 +55703,9 @@ async function createTemplate(client, payload, options) {
   }
   return out;
 }
-async function updateTemplate(client, id, payload, options) {
+async function updateTemplate(client, id, payload, options, params) {
   const out = await client.putJSON(
-    `/api/processes/v2/process_templates/${id}`,
+    `/api/processes/v2/process_templates/${id}${buildQueryString(params)}`,
     payload,
     options
   );
@@ -57123,6 +57171,10 @@ function validateTagsArray2(raw2) {
 }
 
 // src/commands/mecWorkflow.ts
+var MEC_DETAIL = { only_mec: true };
+function getMecTemplate(client, id, signal, params = {}) {
+  return getTemplate(client, id, { signal }, { ...params, ...MEC_DETAIL });
+}
 function dash6(s) {
   if (s === null || s === void 0) return "-";
   if (typeof s === "number") return String(s);
@@ -57258,7 +57310,7 @@ function renderMecWorkflowList(out, rows) {
 }
 async function runMecWorkflowGet(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
-  const tmpl = await withMec(() => getTemplate(cfg.client, cfg.id, { signal: cfg.signal }));
+  const tmpl = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, tmpl);
     return;
@@ -57743,9 +57795,7 @@ async function runMecWorkflowUpdate(cfg) {
     server: cfg.serverFlag,
     confirmCmd: `dr mec workflow update ${cfg.id} --file ${cfg.payloadFile} --server ${cfg.serverFlag}`,
     describe: async () => {
-      const current = await withMec(
-        () => getTemplate(cfg.client, cfg.id, { signal: cfg.signal })
-      );
+      const current = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
       const lines = [`current name: ${current.name}`];
       if (cfg.payload.config?.name !== void 0 && cfg.payload.config.name !== current.name) {
         lines.push(`new name: ${cfg.payload.config.name}`);
@@ -57760,9 +57810,7 @@ async function runMecWorkflowUpdate(cfg) {
     },
     execute: async () => {
       const updated = await withMec(
-        () => updateTemplate(cfg.client, cfg.id, cfg.payload, {
-          signal: cfg.signal
-        })
+        () => updateTemplate(cfg.client, cfg.id, cfg.payload, { signal: cfg.signal }, MEC_DETAIL)
       );
       if (cfg.asJson) {
         writeJSONIndented(cfg.out, updated);
@@ -57783,9 +57831,7 @@ async function runMecWorkflowState(cfg) {
   };
   await preflightConfirmToken(action, cfg.token);
   await requireMec(cfg.client, { signal: cfg.signal });
-  const current = await withMec(
-    () => getTemplate(cfg.client, cfg.id, { signal: cfg.signal })
-  );
+  const current = await withMec(() => getMecTemplate(cfg.client, cfg.id, cfg.signal));
   let cascadeWarning = [];
   if (cfg.active) {
     cascadeWarning = await collectMecActivationCascade(cfg.client, current, cfg.signal);
@@ -57835,8 +57881,8 @@ async function collectMecActivationCascade(client, template, signal) {
   const lines = [];
   const instancesAll = template.process_instances ?? [];
   if (instancesAll.length === 0) return lines;
-  const latest = instancesAll[instancesAll.length - 1];
-  if (latest === void 0) return lines;
+  const created = (p) => Date.parse(p.create_time ?? "") || 0;
+  const latest = instancesAll.reduce((a, b) => created(b) > created(a) ? b : a);
   let process2;
   try {
     process2 = await withMec(() => getProcess(client, latest.id, { signal }));
@@ -57865,7 +57911,9 @@ async function runMecWorkflowArchive(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
   let current = null;
   try {
-    current = await withMec(() => getTemplate(cfg.client, cfg.id, { signal: cfg.signal }));
+    current = await withMec(
+      () => getMecTemplate(cfg.client, cfg.id, cfg.signal, cfg.archive ? {} : { is_archive: true })
+    );
   } catch {
     current = null;
   }
@@ -57880,7 +57928,7 @@ async function runMecWorkflowArchive(cfg) {
         return [
           `id: ${cfg.id}`,
           `target archived: ${cfg.archive ? "yes" : "no"}`,
-          "(template not visible via active-list GET \u2014 likely already in the opposite state)"
+          `(template not visible via the ${cfg.archive ? "active" : "archived"}-template detail GET \u2014 likely already in the opposite state)`
         ];
       }
       return [
@@ -57916,9 +57964,7 @@ async function runMecWorkflowClone(cfg) {
     `cloning MEC workflow template ${cfg.templateId} (carries existing members forward)`
   );
   await requireMec(cfg.client, { signal: cfg.signal });
-  const current = await withMec(
-    () => getTemplate(cfg.client, cfg.templateId, { signal: cfg.signal })
-  );
+  const current = await withMec(() => getMecTemplate(cfg.client, cfg.templateId, cfg.signal));
   const dateConfig = resolveDateTagConfig(current);
   const source = resolveCopyFrom(current, cfg.copyFrom, dateConfig.id);
   const extraTags = resolveExtraTags(current, parseExtraTagFlags(cfg.tagFlags), dateConfig.id);
@@ -76527,6 +76573,9 @@ async function aiServicePost(client, path13, body, attribute, options) {
     const fresh = await tokenFor(client, signal, true);
     res = await sendOnce(url, fresh.token, payload, extra, signal);
   }
+  return parseResponse(rel, res);
+}
+async function parseResponse(rel, res) {
   const text2 = await res.text();
   if (!res.ok) {
     const envelope = parseErrorEnvelope(text2);
@@ -76633,6 +76682,26 @@ function listModels(client, options) {
 function getSystemEntities(client, options) {
   return read(client, "v1/ManagedAgents/getSystemEntities", {}, options);
 }
+async function writeSchedule(client, path13, body, options) {
+  const res = await write(client, path13, body, options);
+  const schedule = res !== null && typeof res === "object" ? res.schedule : void 0;
+  if (schedule === null || typeof schedule !== "object" || Array.isArray(schedule)) {
+    throw new Error(`POST /ai-service/external/${path13}: response has no schedule object`);
+  }
+  return res;
+}
+function listSchedules(client, body, options) {
+  return read(client, "v1/ManagedAgentSchedules/listSchedules", body, options);
+}
+function createSchedule(client, body, options) {
+  return writeSchedule(client, "v1/ManagedAgentSchedules/createSchedule", body, options);
+}
+function updateSchedule(client, body, options) {
+  return writeSchedule(client, "v1/ManagedAgentSchedules/updateSchedule", body, options);
+}
+function deleteSchedule(client, body, options) {
+  return write(client, "v1/ManagedAgentSchedules/deleteSchedule", body, options);
+}
 
 // src/commands/_agentCliScopes.ts
 var DEFAULT_CLI_SCOPES = ["*:read"];
@@ -77644,6 +77713,218 @@ function registerAgentPinCommands(agents) {
   withPinTargets(unpin);
 }
 
+// src/commands/agents_schedules.ts
+var SCHEDULE_ID = "<scheduleId>";
+function requirePrompt(prompt) {
+  if (prompt.trim() === "") {
+    throw new Error("--prompt must not be empty (omit it, or use update --clear-prompt)");
+  }
+  return prompt;
+}
+function tokenAgentId(client) {
+  try {
+    return firstString(decodeJwtClaims(client.session.jwtAccess ?? ""), "agent_id");
+  } catch {
+    return "";
+  }
+}
+function agentIdFor(flag, client) {
+  const id = (flag ?? "").trim();
+  return id !== "" ? id : tokenAgentId(client);
+}
+function scheduleLine(s) {
+  const state = s.enabled === void 0 ? "?" : s.enabled ? "enabled" : "disabled";
+  return [
+    s.id ?? "?",
+    state,
+    `cron "${s.crontab ?? "?"}" ${s.timezone ?? "UTC"}`,
+    `agent ${s.agentId ?? "?"}`,
+    `last ${s.lastRunStatus ?? "-"}`
+  ].join("  ");
+}
+function writeResult(cfg, verb, res) {
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, res);
+    return;
+  }
+  cfg.out.write(`${verb} ${scheduleLine(res.schedule)}
+`);
+}
+async function runSchedulesList(cfg) {
+  const agentId = agentIdFor(cfg.agentId, cfg.client);
+  const res = await listSchedules(cfg.client, agentId !== "" ? { agentId } : {}, {
+    signal: cfg.signal
+  });
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, res);
+    return;
+  }
+  const list29 = res.schedules ?? [];
+  if (list29.length === 0) {
+    cfg.out.write("(no schedules)\n");
+    return;
+  }
+  for (const s of list29) cfg.out.write(`${scheduleLine(s)}
+`);
+}
+async function runSchedulesCreate(cfg) {
+  const agentId = agentIdFor(cfg.agentId, cfg.client);
+  if (agentId === "") {
+    throw new Error(
+      "missing required option: --agent-id <agentId> (the session token names no agent)"
+    );
+  }
+  if (cfg.cron === void 0) throw new Error("missing required option: --cron <expr>");
+  const body = { agentId, crontab: parseCron(cfg.cron) };
+  if (cfg.tz !== void 0) body.timezone = cfg.tz;
+  if (cfg.prompt !== void 0) body.prompt = requirePrompt(cfg.prompt);
+  if (cfg.environmentId !== void 0) body.environmentId = cfg.environmentId;
+  if (cfg.enabled !== void 0) body.enabled = requireBool(cfg.enabled, "--enabled");
+  writeResult(cfg, "Created", await createSchedule(cfg.client, body, { signal: cfg.signal }));
+}
+async function runSchedulesUpdate(cfg) {
+  const id = requireId(cfg.id, SCHEDULE_ID);
+  if (cfg.prompt !== void 0 && cfg.clearPrompt === true) {
+    throw new Error("give --prompt or --clear-prompt, not both");
+  }
+  const body = { id };
+  if (cfg.cron !== void 0) body.crontab = parseCron(cfg.cron);
+  if (cfg.tz !== void 0) body.timezone = cfg.tz;
+  if (cfg.prompt !== void 0) body.prompt = requirePrompt(cfg.prompt);
+  if (cfg.clearPrompt === true) body.prompt = null;
+  if (cfg.environmentId !== void 0) body.environmentId = cfg.environmentId;
+  if (cfg.enabled !== void 0) body.enabled = requireBool(cfg.enabled, "--enabled");
+  if (Object.keys(body).length === 1) throw new Error("nothing to change: give at least one flag");
+  writeResult(cfg, "Updated", await updateSchedule(cfg.client, body, { signal: cfg.signal }));
+}
+async function runSchedulesDelete(cfg) {
+  const id = requireId(cfg.id, SCHEDULE_ID);
+  const serverKey = cfg.client.serverKey;
+  const action = {
+    resource: "managed-agent-schedule",
+    id: `${serverKey}:${id}`,
+    verb: "delete"
+  };
+  await preflightConfirmToken(action, cfg.token);
+  await twoStepConfirm({
+    out: proseStream(cfg),
+    action,
+    token: cfg.token,
+    server: serverKey,
+    confirmCmd: `dr agents schedules delete --id ${shellArg(id)} --server ${shellArg(serverKey)}`,
+    describe: async () => {
+      const agentId = tokenAgentId(cfg.client);
+      const res = await listSchedules(cfg.client, agentId !== "" ? { agentId } : {}, {
+        signal: cfg.signal
+      });
+      const s = (res.schedules ?? []).find((row) => row.id === id);
+      if (s === void 0) {
+        throw new Error(`no schedule ${id} in this org (see: dr agents schedules list)`);
+      }
+      return [
+        scheduleLine(s),
+        `prompt: ${JSON.stringify(s.prompt ?? null)}`,
+        `environment: ${s.environmentId ?? "(resolved per run)"}`,
+        // `create` cannot set this: a restored schedule runs as whoever re-creates it.
+        `runs as: user ${s.runAsUserId ?? "?"}`
+      ];
+    },
+    execute: async () => {
+      const res = await deleteSchedule(cfg.client, { id }, { signal: cfg.signal });
+      proseStream(cfg).write(`Deleted schedule ${id}.
+`);
+      if (cfg.asJson) writeJSONIndented(cfg.out, res);
+    }
+  });
+}
+var AGENT_ID_HELP = "Agent id (default: the session token's agent_id claim, which a managed agent's token carries).";
+function registerAgentSchedulesCommands(agents) {
+  const schedules = agents.command("schedules").description(
+    "Cron schedules that open a conversation with a managed agent, as the session user."
+  );
+  const list29 = schedules.command("list").description("List the org's schedules.").option(
+    "--agent-id <agentId>",
+    "Only this agent's (default: the session token's agent_id claim; without one, every agent's)."
+  ).option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesList({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        agentId: opts.agentId,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(list29);
+  const create20 = schedules.command("create").description("Schedule an agent; its runs act as you.").option("--agent-id <agentId>", AGENT_ID_HELP).option(
+    "--cron <expr>",
+    'Five-field cron line, runs at least 5 minutes apart, e.g. "0 8 * * 1".'
+  ).option("--tz <iana>", "Timezone the cron line is read in (default UTC).").option("--prompt <text>", "What each run is asked (default: a bare trigger turn).").option(
+    "--environment-id <id>",
+    "Anthropic environment for the runs (default: resolved per run)."
+  ).option("--enabled <true|false>", "Create it enabled (default true).").option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesCreate({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        agentId: opts.agentId,
+        cron: opts.cron,
+        tz: opts.tz,
+        prompt: opts.prompt,
+        environmentId: opts.environmentId,
+        enabled: opts.enabled,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(create20);
+  const update13 = schedules.command("update").description("Change a schedule (only the flags given change); its runs then act as you.").option("--id <scheduleId>", "Schedule id.").option("--cron <expr>", "New five-field cron line.").option("--tz <iana>", "New timezone.").option("--prompt <text>", "New prompt.").option("--clear-prompt", "Remove the prompt (runs get a bare trigger turn).").option("--environment-id <id>", "New Anthropic environment.").option("--enabled <true|false>", "Enable or disable it.").option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesUpdate({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        id: opts.id,
+        cron: opts.cron,
+        tz: opts.tz,
+        prompt: opts.prompt,
+        clearPrompt: opts.clearPrompt,
+        environmentId: opts.environmentId,
+        enabled: opts.enabled,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(update13);
+  const del = schedules.command("delete").description("Delete a schedule. (two-step confirm)").option("--id <scheduleId>", "Schedule id.").option("--confirm-token <token>", CONFIRM_HELP).option("--json", JSON_HELP).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runSchedulesDelete({
+        client: setup.client,
+        signal: setup.signal,
+        ...std(),
+        id: opts.id,
+        token: opts.confirmToken,
+        asJson: opts.json === true
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  withTarget(del);
+}
+
 // src/commands/agents_skills.ts
 import { mkdir as mkdir4, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname9, join as join17 } from "path";
@@ -79212,6 +79493,7 @@ function registerAgentsCommand(root) {
   registerAgentPinCommands(agents);
   registerAgentStudioCommands(agents);
   registerAgentSkillsCommand(agents);
+  registerAgentSchedulesCommands(agents);
 }
 
 // src/auth/versionCheck.ts

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.185",
+  "cliVersion": "1.6.187",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -695,7 +695,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -851,7 +851,7 @@
       "requires": [
         {
           "resource": "dashboards",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1067,7 +1067,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1075,7 +1075,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1083,7 +1083,7 @@
       "requires": [
         {
           "resource": "tables",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -1863,7 +1863,7 @@
       "requires": [
         {
           "resource": "integrations",
-          "action": "read"
+          "action": "write"
         }
       ]
     },
@@ -5220,6 +5220,38 @@
           "action": "destructive"
         }
       ]
+    },
+    "agents schedules list": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "read"
+        }
+      ]
+    },
+    "agents schedules create": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "write"
+        }
+      ]
+    },
+    "agents schedules update": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "write"
+        }
+      ]
+    },
+    "agents schedules delete": {
+      "requires": [
+        {
+          "resource": "managed-agents",
+          "action": "destructive"
+        }
+      ]
     }
   },
   "aliases": {

package/dist/skills/dr-cli/SKILL.md

@@ -241,7 +241,7 @@ area's gotchas.
 **Metrics (KPIs) & functions** → [reference/metrics.md](reference/metrics.md)
 - `metrics list|get|data|drilldown`
 - `metrics create base|calc|driver`, `metrics update|delete`
-- `metrics driver get|set|delete`, `metrics driver values get|set`, `metrics calculations list|add|remove`, `metrics what-if`: drivers, scenario-bound formulas and what-if runs, addressed per scenario context (`--scenario` / `--cycle` / `--planning-scenario`, matched exactly)
+- `metrics driver get|set|delete`, `metrics driver values get|set`, `metrics calculations list|add|remove`, `metrics what-if`: drivers, scenario-bound formulas and what-if runs, addressed per scenario context (`--scenario` / `--cycle` / `--planning-scenario`, matched exactly; `--cycle` needs `--cycle-year <yyyy>`)
 - `metrics re-aggregate` — rebuild pre-aggregated metric values (targeted ids, or `--all` org-wide); add `--wait [--timeout <s>]` on targeted ids to block until done (exits non-zero on failure/timeout)
 - `metrics migrate` — org-wide metrics+dimensions migration (V1→V2 backfill; `--dry-run` first)
 - `metrics categories list|get|create|update|delete`

package/dist/skills/dr-cli/reference/metrics.md

@@ -146,10 +146,14 @@ cycle management). When either is off it answers 400/403/405 with a message,
 and the CLI prints that message unchanged.
 
 **Scenario context.** `driver …` and `calculations add|remove` address one
-context with `--scenario <name>` (default `Actuals`), `--cycle <label>` and
-`--planning-scenario <name>`. All three are free-text names and must match
-exactly. A context never inherits from another one, so a driver set under
-`Budget` is a different row from the `Actuals` one.
+context with `--scenario <name>` (default `Actuals`), `--cycle <label>`,
+`--cycle-year <yyyy>` and `--planning-scenario <name>`. The three names are
+free text and must match exactly. A context never inherits from another one,
+so a driver set under `Budget` is a different row from the `Actuals` one.
+A cycle name repeats every year, so `--cycle` needs `--cycle-year` (the
+cycle's fiscal year, e.g. `--cycle "0+12" --cycle-year 2027`), and
+`--cycle-year` is refused without `--cycle`. The same cycle in another year
+is another context. `calculations list` shows the year in a CYCLE_YEAR column.
 
 - `metrics create driver --name <n> [--description] [--category <id>]
   [--dimensions <ids>]` creates a DRIVER metric. It has no table, value or

package/dist/skills/dr-cli/reference/safety.md

@@ -57,7 +57,9 @@ Reads never need confirmation. Gated **writes** fall into two tiers (full table:
   every server, because the agent and skill registry is shared by every
   environment (a write on DEV-1 changes production agents too).
 
-**Tier A is the smaller set:** every `delete` (across all resources), plus
+**Tier A is the smaller set:** every `delete` (across all resources, except
+`agents schedules delete`: one schedule row, which `create` restores, though
+the restored row runs as whoever re-creates it), plus
 `workflow`/`mec workflow` `archive` (and its `delete` alias), `process delete`,
 `step delete`, `task delete`; `forecast scenarios bulk-edit`; `cash rules
 delete-all`; `filebox archive` and `filebox data-query clear`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.185",
+  "version": "1.6.187",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {