@datarails-ai/dr-cli 1.6.93 → 1.6.95

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.93",
+  version: "1.6.95",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -67,7 +67,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-01T13:51:17.711Z";
+var BUILD_TIME = "2026-10-02T15:08:38.411Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -4853,13 +4853,13 @@ function formatExpLine(claims) {
   } else {
     return String(raw);
   }
-  const stamp = formatUtc(unix);
+  const stamp2 = formatUtc(unix);
   const deltaMs = unix * 1e3 - Date.now();
   const roundedMs = roundToMinuteMs(deltaMs);
   if (roundedMs < 0) {
-    return `${stamp} (expired ${formatGoDuration(-roundedMs)} ago)`;
+    return `${stamp2} (expired ${formatGoDuration(-roundedMs)} ago)`;
   }
-  return `${stamp} (in ${formatGoDuration(roundedMs)})`;
+  return `${stamp2} (in ${formatGoDuration(roundedMs)})`;
 }
 function formatClaimValue(key, v) {
   if (key === "exp" || key === "iat" || key === "nbf") {
@@ -19305,9 +19305,9 @@ var PERIOD_LABEL_RE = /^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]*[
 function findPeriodLabelRefs(formula) {
   const bad = [];
   for (const m of formula.matchAll(BRACKET_REF_RE)) {
-    const ref = (m[1] ?? "").trim();
-    if (PERIOD_LABEL_RE.test(ref)) {
-      bad.push(ref);
+    const ref2 = (m[1] ?? "").trim();
+    if (PERIOD_LABEL_RE.test(ref2)) {
+      bad.push(ref2);
     }
   }
   return bad;
@@ -20374,7 +20374,7 @@ function toWireFormula(input) {
   }
   const wire = padded.replace(STASH_RE, (_m, i) => stash[Number(i)]);
   const hasMetricOperand = (wire.match(/'[^']*'/g) ?? []).some(
-    (ref) => !INTERNAL_FORMULA_TOKENS.includes(ref.slice(1, -1))
+    (ref2) => !INTERNAL_FORMULA_TOKENS.includes(ref2.slice(1, -1))
   );
   if (!hasMetricOperand) {
     throw new Error(`--formula must reference at least one metric, e.g. [Revenue]`);
@@ -25544,8 +25544,8 @@ async function fetchTemplate(client, id, signal) {
     throw err;
   }
 }
-function resolveFieldRef(template, ref) {
-  const trimmed = ref.trim();
+function resolveFieldRef(template, ref2) {
+  const trimmed = ref2.trim();
   if (/^\d+$/.test(trimmed)) {
     const id = Number(trimmed);
     const byId = template.fields.find((f) => f.id === id);
@@ -36423,6 +36423,249 @@ function matchesAny(buf, sigs) {
   return sigs.some((sig) => startsWith(buf, sig));
 }
 
+// src/commands/_dataQueryWait.ts
+var DQ_WAIT_POLL_INTERVAL_MS = 5e3;
+var DQ_WAIT_POLL_MAX_INTERVAL_MS = 3e4;
+var DQ_WAIT_DEFAULT_TIMEOUT_SEC = 1800;
+var DQ_WAIT_TIMEOUT_MAX_SEC = 86400;
+var DQ_WAIT_SETUP_OVERHEAD_MS = 6e4;
+function dataQuerySyncCallTimeoutMs(wait, timeoutSec) {
+  if (!wait) return void 0;
+  return timeoutSec * 1e3 + DQ_WAIT_SETUP_OVERHEAD_MS;
+}
+function parseDataQueryWaitTimeout(raw) {
+  const n = Number(raw ?? String(DQ_WAIT_DEFAULT_TIMEOUT_SEC));
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    throw new Error(`--timeout must be a positive integer number of seconds (got "${raw}")`);
+  }
+  if (n > DQ_WAIT_TIMEOUT_MAX_SEC) {
+    throw new Error(
+      `--timeout must be at most ${DQ_WAIT_TIMEOUT_MAX_SEC} seconds (24 hours; got "${raw}") \u2014 for longer runs, re-check later with 'dr filebox versions <id>' instead of waiting.`
+    );
+  }
+  return n;
+}
+function asRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+}
+function stamp(v) {
+  return JSON.stringify(v ?? null);
+}
+function belongsTo(v, period) {
+  return period.tags.every(
+    (want) => (v.tags ?? []).some((t) => t.id === want.id && want.inPeriod(t.value))
+  );
+}
+function maxId(rows) {
+  return rows.reduce((m, v) => Math.max(m, v.id), 0);
+}
+function ref(v) {
+  return { id: v.id, version: v.version };
+}
+function buildDataQuerySyncBaseline(periods, versions, dataQueryRaw) {
+  const dataQuery = asRecord(dataQueryRaw);
+  return {
+    periods: periods.map((p) => {
+      const rows = versions.filter((v) => belongsTo(v, p));
+      return {
+        maxId: maxId(rows),
+        lastSyncById: new Map(rows.map((v) => [v.id, stamp(v.last_sync)]))
+      };
+    }),
+    maxVersionId: maxId(versions),
+    updateTime: stamp(dataQuery["update_time"])
+  };
+}
+function classifyDataQuerySyncProgress(periods, baseline, versions, dataQueryRaw) {
+  const dataQuery = asRecord(dataQueryRaw);
+  const out = { periods: [], unmatchedNewVersions: [] };
+  periods.forEach((p, i) => {
+    const base = baseline.periods[i];
+    const rows = versions.filter((v) => belongsTo(v, p));
+    const created = rows.filter((v) => v.id > base.maxId);
+    if (created.length > 0) {
+      const newest = created.reduce((a, b) => b.id > a.id ? b : a);
+      out.periods.push({ period: p.label, result: "new_version", version: ref(newest) });
+      return;
+    }
+    const confirmed = rows.find(
+      (v) => base.lastSyncById.has(v.id) && stamp(v.last_sync) !== base.lastSyncById.get(v.id)
+    );
+    if (confirmed !== void 0) {
+      out.periods.push({ period: p.label, result: "no_change", version: ref(confirmed) });
+      return;
+    }
+    out.periods.push({ period: p.label, result: "pending" });
+  });
+  out.unmatchedNewVersions = versions.filter((v) => v.id > baseline.maxVersionId && !periods.some((p) => belongsTo(v, p))).map((v) => v.id);
+  if (dataQuery["status"] === "ERROR" && stamp(dataQuery["update_time"]) !== baseline.updateTime) {
+    const msg = dataQuery["last_sync_error"];
+    out.error = typeof msg === "string" && msg !== "" ? msg : "sync failed (no error text)";
+  }
+  return out;
+}
+async function captureDataQuerySyncBaseline(client, fileboxId, periods, signal) {
+  try {
+    const [versions, dataQuery] = await Promise.all([
+      listVersions(client, fileboxId, {}, { signal }),
+      getDataQueryRaw(client, fileboxId, { signal })
+    ]);
+    return buildDataQuerySyncBaseline(periods, versions, dataQuery);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `--wait: could not read filebox ${fileboxId}'s versions before syncing (${msg}); the sync was NOT triggered`
+    );
+  }
+}
+var defaultSleep8 = (ms, signal) => new Promise((resolve3, reject) => {
+  if (signal?.aborted) {
+    reject(signal.reason ?? new Error("aborted"));
+    return;
+  }
+  const onAbort = () => {
+    clearTimeout(t);
+    reject(signal?.reason ?? new Error("aborted"));
+  };
+  const t = setTimeout(() => {
+    signal?.removeEventListener("abort", onAbort);
+    resolve3();
+  }, ms);
+  signal?.addEventListener("abort", onAbort, { once: true });
+});
+async function waitForDataQuerySync(cfg) {
+  let interval = cfg.pollIntervalMs ?? DQ_WAIT_POLL_INTERVAL_MS;
+  const maxInterval = cfg.maxPollIntervalMs ?? DQ_WAIT_POLL_MAX_INTERVAL_MS;
+  const sleep4 = cfg.sleep ?? defaultSleep8;
+  const now = cfg.now ?? Date.now;
+  const start = now();
+  const deadline = start + cfg.timeoutSec * 1e3;
+  if (!cfg.asJson) {
+    const n = cfg.periods.length;
+    cfg.out.write(
+      `Waiting for the sync of ${n} period${plural(n)} on filebox ${cfg.fileboxId} (timeout ${cfg.timeoutSec}s)\u2026
+`
+    );
+  }
+  let progress;
+  let outcome;
+  for (; ; ) {
+    try {
+      const [versions, dataQuery] = await Promise.all([
+        listVersions(cfg.client, cfg.fileboxId, {}, { signal: cfg.signal }),
+        getDataQueryRaw(cfg.client, cfg.fileboxId, { signal: cfg.signal })
+      ]);
+      progress = classifyDataQuerySyncProgress(cfg.periods, cfg.baseline, versions, dataQuery);
+    } catch (err) {
+      if (cfg.signal.aborted) {
+        outcome = "cancelled";
+        break;
+      }
+      const msg = err instanceof Error ? err.message : String(err);
+      cfg.errOut.write(`warning: sync status poll failed (${msg}); retrying
+`);
+    }
+    if (progress?.error !== void 0) {
+      outcome = "failed";
+      break;
+    }
+    if (progress !== void 0 && progress.periods.every((p) => p.result !== "pending")) {
+      outcome = "completed";
+      break;
+    }
+    if (now() >= deadline) {
+      outcome = "timed_out";
+      break;
+    }
+    try {
+      await sleep4(interval, cfg.signal);
+    } catch {
+      outcome = "cancelled";
+      break;
+    }
+    interval = Math.min(interval * 1.5, maxInterval);
+  }
+  const final = progress ?? {
+    periods: cfg.periods.map((p) => ({ period: p.label, result: "pending" })),
+    unmatchedNewVersions: []
+  };
+  const waitedSec = Math.round((now() - start) / 1e3);
+  renderSummary2(cfg, final, outcome, waitedSec);
+  if (outcome !== "completed") {
+    throw new Error(failureMessage(cfg.fileboxId, final, outcome, waitedSec));
+  }
+}
+function renderSummary2(cfg, progress, outcome, waitedSec) {
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, {
+      filebox_id: cfg.fileboxId,
+      outcome,
+      periods: progress.periods.map((p) => ({
+        period: p.period,
+        result: p.result,
+        version_id: p.version?.id ?? null,
+        version: p.version?.version ?? null
+      })),
+      unmatched_new_versions: progress.unmatchedNewVersions,
+      error: progress.error ?? null,
+      waited_seconds: waitedSec
+    });
+    return;
+  }
+  const count = (r) => progress.periods.filter((p) => p.result === r).length;
+  const parts = [`${count("new_version")} new version${plural(count("new_version"))}`];
+  parts.push(`${count("no_change")} unchanged`);
+  if (count("pending") > 0) parts.push(`${count("pending")} unfinished`);
+  const headline = {
+    completed: "Sync finished",
+    failed: "Sync failed",
+    timed_out: `Sync did not finish within ${waitedSec}s`,
+    cancelled: "Sync wait cancelled"
+  }[outcome];
+  cfg.out.write(`${headline} for filebox ${cfg.fileboxId}: ${parts.join(", ")}.
+`);
+  if (progress.error !== void 0) {
+    cfg.out.write(`  error: ${progress.error}
+`);
+  }
+  for (const p of progress.periods) {
+    if (p.result === "new_version") {
+      cfg.out.write(`  ${p.period}: new version #${p.version.id} (v${p.version.version})
+`);
+    } else if (p.result === "no_change") {
+      cfg.out.write(
+        `  ${p.period}: unchanged \u2014 identical to version #${p.version.id} (v${p.version.version}), so no new version was written
+`
+      );
+    } else if (outcome === "timed_out") {
+      cfg.out.write(
+        `  ${p.period}: no new or re-confirmed version yet \u2014 still running, or the sync returned no rows (check 'dr filebox data-query get ${cfg.fileboxId}')
+`
+      );
+    } else {
+      cfg.out.write(`  ${p.period}: not finished
+`);
+    }
+  }
+  for (const id of progress.unmatchedNewVersions) {
+    cfg.out.write(
+      `  note: new version #${id} matches none of the requested periods \u2014 check its date tag with 'dr filebox versions ${cfg.fileboxId}'
+`
+    );
+  }
+}
+function failureMessage(fileboxId, progress, outcome, waitedSec) {
+  const pending = progress.periods.filter((p) => p.result === "pending").map((p) => p.period);
+  const pendingList = pending.join(", ") || "(none)";
+  if (outcome === "failed") {
+    return `data-query sync on filebox ${fileboxId} failed: ${progress.error}`;
+  }
+  if (outcome === "cancelled") {
+    return `data-query sync wait cancelled after ${waitedSec}s with ${pending.length} period(s) unfinished: ${pendingList}. The sync continues server-side; re-check with 'dr filebox versions ${fileboxId}' instead of re-triggering.`;
+  }
+  return `data-query sync on filebox ${fileboxId} did not finish within ${waitedSec}s \u2014 ${pending.length} period(s) unfinished: ${pendingList}. Increase --timeout, or re-check with 'dr filebox versions ${fileboxId}'; do not blindly re-trigger.`;
+}
+
 // src/commands/filebox.ts
 async function fileToBlob(filePath) {
   const buf = await fsPromises.readFile(filePath);
@@ -36732,7 +36975,7 @@ ${JSON.stringify(result)}
 `
   );
 }
-function asRecord(v) {
+function asRecord2(v) {
   return v !== null && typeof v === "object" ? v : void 0;
 }
 function numOf(r, k) {
@@ -36742,9 +36985,9 @@ function strOf(r, k) {
   return r !== void 0 && typeof r[k] === "string" ? r[k] : void 0;
 }
 function extractUploadedVersionMeta(result) {
-  const r = asRecord(result);
-  const dv = asRecord(r?.["document_version"]);
-  const docObj = asRecord(r?.["document"]);
+  const r = asRecord2(result);
+  const dv = asRecord2(r?.["document_version"]);
+  const docObj = asRecord2(r?.["document"]);
   return {
     id: numOf(r, "id") ?? numOf(dv, "id") ?? numOf(docObj, "latest_version_id") ?? 0,
     version: numOf(r, "version") ?? numOf(dv, "version") ?? 0,
@@ -38106,6 +38349,10 @@ async function runFileboxDataQueryGet(cfg) {
 `);
   cfg.out.write(`  Last sync:   ${orElse(renderCreateTime(q.last_sync), "never")}
 `);
+  if (q.last_general_sync !== void 0) {
+    cfg.out.write(`  Last start:  ${orElse(renderCreateTime(q.last_general_sync), "never")}
+`);
+  }
   if (q.last_sync_error !== null && q.last_sync_error !== void 0 && q.last_sync_error !== "") {
     cfg.out.write(`  Last error:  ${truncateField2(q.last_sync_error, 100)}
 `);
@@ -38300,6 +38547,12 @@ function isoMondayOfUTC(d) {
   monday.setUTCDate(d.getUTCDate() - isoDow);
   return monday;
 }
+function samePeriodAs(subType, stored, resolvedValue) {
+  if (typeof stored !== "number" || !Number.isFinite(stored)) return false;
+  const d = new Date(stored * 1e3);
+  const parsed2 = { year: d.getUTCFullYear(), month0: d.getUTCMonth(), day: d.getUTCDate() };
+  return resolveDateForSubType(subType, parsed2).value === resolvedValue;
+}
 function resolveDateForSubType(subType, parsed2) {
   const { year, month0, day } = parsed2;
   switch ((subType ?? "").toLowerCase()) {
@@ -38347,9 +38600,15 @@ async function runFileboxDataQuerySync(cfg) {
     const trimmed = t.trim();
     if (trimmed !== "") rawTags.push(trimmed);
   }
+  if (cfg.wait !== void 0 && rawTags.length > 0) {
+    throw new Error(
+      "--wait cannot be combined with --tag; use --date to name the periods to wait for"
+    );
+  }
   const parsedDates = cfg.dateArgs.map(parseCalendarDate);
   const dateTargets = [];
   const periodLabels = [];
+  const waitPeriods = [];
   if (parsedDates.length > 0) {
     const details = await getDetails(cfg.client, cfg.id, {
       signal: cfg.signal
@@ -38372,15 +38631,27 @@ async function runFileboxDataQuerySync(cfg) {
     }
     for (const parsed2 of parsedDates) {
       const resolved = dateTags.map((tag) => {
-        const { value, label } = resolveDateForSubType(tagSubType(tag), parsed2);
-        return { id: tag.id, name: tag.name, value, label };
+        const { value, label: label2 } = resolveDateForSubType(tagSubType(tag), parsed2);
+        return { id: tag.id, name: tag.name, value, label: label2 };
       });
       dateTargets.push(
         JSON.stringify(resolved.map(({ id, name, value }) => ({ id, name, value })))
       );
-      periodLabels.push(resolved.map((r) => r.label).join(" + "));
+      const label = resolved.map((r) => r.label).join(" + ");
+      periodLabels.push(label);
+      waitPeriods.push({
+        label,
+        tags: dateTags.map((tag, i) => ({
+          id: tag.id,
+          inPeriod: (stored) => samePeriodAs(tagSubType(tag), stored, resolved[i].value)
+        }))
+      });
     }
   }
+  if (waitPeriods.length === 0) {
+    waitPeriods.push({ label: "latest sync", tags: [] });
+  }
+  const baseline = cfg.wait === void 0 ? void 0 : await captureDataQuerySyncBaseline(cfg.client, cfg.id, waitPeriods, cfg.signal);
   const multipleTags = [...rawTags, ...dateTargets];
   const body = {};
   if (multipleTags.length > 0) {
@@ -38401,10 +38672,33 @@ async function runFileboxDataQuerySync(cfg) {
     summary.push(`tags=${rawTags.join(",")}`);
   }
   const tagInfo = summary.length > 0 ? ` (${summary.join("; ")})` : "";
-  cfg.out.write(`Sync queued for filebox ${cfg.id}${tagInfo} \u2014 server: ${detail}
+  if (cfg.wait === void 0 || baseline === void 0) {
+    cfg.out.write(`Sync queued for filebox ${cfg.id}${tagInfo} \u2014 server: ${detail}
 `);
-  cfg.out.write(`Check progress with: dr filebox data-query get ${cfg.id}
+    cfg.out.write(
+      `Check progress with: dr filebox data-query get ${cfg.id} (or re-run with --wait)
+`
+    );
+    return;
+  }
+  const progressOut = cfg.wait.asJson ? cfg.wait.err ?? process.stderr : cfg.out;
+  progressOut.write(`Sync queued for filebox ${cfg.id}${tagInfo} \u2014 server: ${detail}
 `);
+  await waitForDataQuerySync({
+    client: cfg.client,
+    fileboxId: cfg.id,
+    periods: waitPeriods,
+    baseline,
+    timeoutSec: cfg.wait.timeoutSec,
+    asJson: cfg.wait.asJson,
+    out: cfg.out,
+    errOut: cfg.wait.err ?? process.stderr,
+    signal: cfg.signal,
+    pollIntervalMs: cfg.wait.pollIntervalMs,
+    maxPollIntervalMs: cfg.wait.maxPollIntervalMs,
+    sleep: cfg.wait.sleep,
+    now: cfg.wait.now
+  });
 }
 async function runFileboxDownload(cfg) {
   if (cfg.fileboxId <= 0) {
@@ -39651,22 +39945,39 @@ function registerFileboxCommand(root) {
     `Advanced: raw server-shape tag JSON, e.g. '[{"id":6,"name":"Month","value":1782907200}]'. Prefer --date \u2014 this is an unvalidated escape hatch for tag dimensions --date doesn't cover (e.g. LIST tags). Repeatable.`,
     collectStrings,
     []
-  ).action(async (idStr, opts) => {
-    const id = parseFileboxIdArg(idStr);
-    const setup = await setupCall(opts.server, opts.account);
-    try {
-      await runFileboxDataQuerySync({
-        client: setup.client,
-        id,
-        tags: opts.tag ?? [],
-        dateArgs: opts.date ?? [],
-        signal: setup.signal,
-        out: process.stdout
+  ).option(
+    "--wait",
+    "After queueing, wait until every --date period has finished, and say whether each wrote a new version or was unchanged (identical output writes no version). Exits non-zero on a failed sync or a timeout. Not combinable with --tag.",
+    false
+  ).option(
+    "--timeout <seconds>",
+    `With --wait: how long to wait (default ${DQ_WAIT_DEFAULT_TIMEOUT_SEC}, max 86400)`
+  ).option("--json", "With --wait: print the result as one JSON object", false).action(
+    async (idStr, opts) => {
+      const id = parseFileboxIdArg(idStr);
+      const wait = opts.wait === true;
+      if (!wait && (opts.timeout !== void 0 || opts.json === true)) {
+        throw new Error("--timeout and --json only apply with --wait");
+      }
+      const timeoutSec = parseDataQueryWaitTimeout(opts.timeout);
+      const setup = await setupCall(opts.server, opts.account, {
+        timeoutMs: dataQuerySyncCallTimeoutMs(wait, timeoutSec)
       });
-    } finally {
-      setup.cleanup();
+      try {
+        await runFileboxDataQuerySync({
+          client: setup.client,
+          id,
+          tags: opts.tag ?? [],
+          dateArgs: opts.date ?? [],
+          signal: setup.signal,
+          out: process.stdout,
+          wait: wait ? { timeoutSec, asJson: opts.json === true } : void 0
+        });
+      } finally {
+        setup.cleanup();
+      }
     }
-  });
+  );
   addServerFlag(dqSyncCmd);
   addAccountFlag(dqSyncCmd);
   registerFileboxAdminCommands(fb, setupCall, addServerFlag, addAccountFlag);
@@ -42915,6 +43226,31 @@ async function runReconciliationAccountsSettings(cfg) {
   }
   renderAccountsSettings(cfg.out, items);
 }
+var SETTINGS_BATCH_MAX_BYTES = 256 * 1024;
+function settingsKey(s) {
+  return JSON.stringify([s.entity ?? "", s.account_group ?? "", s.name]);
+}
+function settingsFieldChanges(have, want) {
+  const fields = ["frequency", "threshold_from", "threshold_to"];
+  return fields.filter((f) => have[f] !== want[f]).map((f) => `${f} ${String(have[f])} \u2192 ${String(want[f])}`);
+}
+function chunkByJsonBytes(rows, maxBytes) {
+  const chunks = [];
+  let current = [];
+  let size = 2;
+  for (const row of rows) {
+    const rowBytes = Buffer.byteLength(JSON.stringify(row));
+    if (current.length > 0 && size + rowBytes + 1 > maxBytes) {
+      chunks.push(current);
+      current = [];
+      size = 2;
+    }
+    size += current.length === 0 ? rowBytes : rowBytes + 1;
+    current.push(row);
+  }
+  if (current.length > 0) chunks.push(current);
+  return chunks;
+}
 function settingsActionId(settings) {
   return createHash8("sha256").update(JSON.stringify(settings)).digest("hex").slice(0, 12);
 }
@@ -42926,6 +43262,32 @@ async function runReconciliationAccountsUpdateSettings(cfg) {
   };
   await preflightConfirmToken(action, cfg.token);
   const n = cfg.settings.length;
+  const current = await getAccountSettings(cfg.client, {}, { signal: cfg.signal });
+  const currentByKey = new Map(current.map((s) => [settingsKey(s), s]));
+  const changed = [];
+  const preview = [];
+  for (const want of cfg.settings) {
+    const have = currentByKey.get(settingsKey(want));
+    let what;
+    if (have === void 0) {
+      what = `new (frequency ${want.frequency})`;
+    } else {
+      const diffs = settingsFieldChanges(have, want);
+      if (diffs.length === 0) continue;
+      what = diffs.join(", ");
+    }
+    changed.push(want);
+    if (preview.length < 5) {
+      preview.push(`  ${want.entity ?? ""} / ${want.account_group ?? ""} / ${want.name}: ${what}`);
+    }
+  }
+  const unchanged = n - changed.length;
+  if (changed.length === 0) {
+    cfg.out.write(`Nothing to change: all ${n} row${plural(n)} already match the tenant.
+`);
+    return;
+  }
+  const chunks = chunkByJsonBytes(changed, cfg.maxBatchBytes ?? SETTINGS_BATCH_MAX_BYTES);
   await twoStepConfirm({
     out: cfg.out,
     action,
@@ -42933,19 +43295,42 @@ async function runReconciliationAccountsUpdateSettings(cfg) {
     server: cfg.serverFlag,
     confirmCmd: cfg.confirmCmd,
     describe: async () => {
-      const names = cfg.settings.map((s) => s.name);
-      const shown = names.slice(0, 5).join(", ");
-      return [
-        `rows:     ${n}`,
-        `accounts: ${shown}${names.length > 5 ? `, \u2026 (+${names.length - 5} more)` : ""}`
+      const byFrequency = /* @__PURE__ */ new Map();
+      for (const s of changed) {
+        byFrequency.set(s.frequency, (byFrequency.get(s.frequency) ?? 0) + 1);
+      }
+      const lines = [
+        `rows:      ${n}`,
+        `to change: ${changed.length} (${chunks.length} PATCH request${plural(chunks.length)})`,
+        `unchanged: ${unchanged} (already match the tenant \u2014 skipped)`,
+        `by frequency: ${[...byFrequency].map(([f, c]) => `${f} ${c}`).join(", ")}`,
+        "changes:",
+        ...preview
       ];
+      if (changed.length > preview.length) {
+        lines.push(`  \u2026 (+${changed.length - preview.length} more)`);
+      }
+      return lines;
     },
     execute: async () => {
-      await updateAccountSettings(cfg.client, cfg.settings, {
-        signal: cfg.signal
-      });
-      cfg.out.write(`Updated ${n} account setting${n === 1 ? "" : "s"}.
-`);
+      extendForBatch(cfg.extendTimeout, chunks.length);
+      let applied = 0;
+      for (const chunk of chunks) {
+        try {
+          await updateAccountSettings(cfg.client, chunk, { signal: cfg.signal });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw new Error(
+            `PATCH failed after ${applied} of ${changed.length} rows were written (rows ${applied + 1}\u2013${applied + chunk.length} may be partially applied): ${msg}
+Re-run the same command without --confirm-token: rows that landed plan as unchanged, so the new plan covers only the rest.`
+          );
+        }
+        applied += chunk.length;
+      }
+      cfg.out.write(
+        `Updated ${applied} account setting${plural(applied)} (${unchanged} unchanged).
+`
+      );
     }
   });
 }
@@ -43384,10 +43769,29 @@ verify the date matches the accounts' reporting period (try \`dr reconciliation
         account_id: id,
         members: applyAssignments(byId.get(id), changesByAccount.get(id))
       }));
-      extendForBatch(cfg.extendTimeout, requests);
+      extendForBatch(cfg.extendTimeout, requests * 2 - 1);
       let applied = 0;
       for (let i = 0; i < items.length; i += chunkSize) {
         const chunk = items.slice(i, i + chunkSize);
+        if (i > 0) {
+          let drift;
+          try {
+            drift = await chunkDrift(cfg, byId, chunk);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(
+              `re-read failed after ${applied} of ${items.length} account${plural(items.length)} were written; nothing more was sent: ${msg}
+Re-run the same command without --confirm-token: rows that landed plan as unchanged, so the new plan covers only the rest.`
+            );
+          }
+          if (drift.length > 0) {
+            throw new Error(
+              `halted after ${applied} of ${items.length} account${plural(items.length)} were written; nothing more was sent:
+  ` + drift.join("\n  ") + `
+The tenant changed since the plan. Re-run the same command without --confirm-token: rows that landed plan as unchanged. If accounts are gone, the trial balance was rebuilt and their ids changed \u2014 wait for it to settle and rebuild the file from \`dr reconciliation accounts list\`.`
+            );
+          }
+        }
         try {
           await updateAccountMembers(cfg.client, chunk, { signal: cfg.signal });
         } catch (err) {
@@ -43411,6 +43815,28 @@ Re-run the same command without --confirm-token: rows that landed plan as unchan
     }
   });
 }
+async function chunkDrift(cfg, planned, chunk) {
+  const now = await getAccounts(cfg.client, { date: cfg.date }, { signal: cfg.signal });
+  const nowById = new Map(now.map((a) => [a.account_id, a]));
+  const drift = [];
+  for (const { account_id: id } of chunk) {
+    const before = planned.get(id);
+    const after = nowById.get(id);
+    const label = `${before.account_name} (${id})`;
+    if (after === void 0) {
+      drift.push(`${label}: no longer at --date`);
+    } else if (!sameMemberSlots(before.members, after.members)) {
+      drift.push(`${label}: member slots changed since the plan`);
+    }
+  }
+  return drift;
+}
+function sameMemberSlots(a, b) {
+  const shape = (ms) => JSON.stringify(
+    ms.map((m) => [m.type, m.user_id, m.due_date, m.is_sign_off, m.sign_off_timestamp]).sort()
+  );
+  return shape(a) === shape(b);
+}
 function applyAssignments(account, changes) {
   const byType = new Map(changes.map((c) => [c.row.type, c]));
   const assigned = (type, dueDate) => {
@@ -43734,39 +44160,42 @@ function wireReconciliation(program) {
   ).requiredOption(
     "--file <path>",
     "JSON file with the array of settings (output of `dr reconciliation accounts settings --json`)"
-  ).option(
+  ).option("--timeout <seconds>", BATCH_TIMEOUT_FLAG_HELP).option(
     "--confirm-token <token>",
     "Token from a prior plan run \u2014 required to actually update",
     ""
-  ).action(async (opts) => {
-    const filePath = opts.file ?? "";
-    const raw = await fs18.readFile(filePath, "utf8");
-    const settings = parseReconciliationSettingsFile(raw);
-    await preflightConfirmToken(
-      {
-        resource: "recon-settings",
-        id: settingsActionId(settings),
-        verb: "update"
-      },
-      opts.confirmToken
-    );
-    const serverKey = resolveServer(opts.server);
-    const confirmCmd = `dr reconciliation accounts update-settings --file ${JSON.stringify(filePath)} --server ${serverKey}`;
-    const setup = await setupCall(opts.server, opts.account);
-    try {
-      await runReconciliationAccountsUpdateSettings({
-        client: setup.client,
-        settings,
-        token: opts.confirmToken,
-        confirmCmd,
-        serverFlag: serverKey,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    } finally {
-      setup.cleanup();
+  ).action(
+    async (opts) => {
+      const filePath = opts.file ?? "";
+      const raw = await fs18.readFile(filePath, "utf8");
+      const settings = parseReconciliationSettingsFile(raw);
+      await preflightConfirmToken(
+        {
+          resource: "recon-settings",
+          id: settingsActionId(settings),
+          verb: "update"
+        },
+        opts.confirmToken
+      );
+      const serverKey = resolveServer(opts.server);
+      const confirmCmd = `dr reconciliation accounts update-settings --file ${JSON.stringify(filePath)}` + (opts.timeout !== void 0 ? ` --timeout ${opts.timeout}` : "") + ` --server ${serverKey}`;
+      const setup = await setupCall(opts.server, opts.account, batchSetupOptions(opts.timeout));
+      try {
+        await runReconciliationAccountsUpdateSettings({
+          client: setup.client,
+          extendTimeout: setup.extendTimeout,
+          settings,
+          token: opts.confirmToken,
+          confirmCmd,
+          serverFlag: serverKey,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
     }
-  });
+  );
   addServerFlag(updateSettingsCmd);
   addAccountFlag(updateSettingsCmd);
   const setAssigneeCmd = accounts.command("set-assignee").summary(
@@ -58473,7 +58902,7 @@ var EXTRACT_POLL_TIMEOUT_MS = 10 * 60 * 1e3;
 function isTerminalAiStatus(status2) {
   return status2 === "PROCESSED" || status2 === "FAILED";
 }
-async function defaultSleep8(ms, signal) {
+async function defaultSleep9(ms, signal) {
   if (signal?.aborted === true) return;
   await new Promise((resolve3) => {
     const timer = setTimeout(resolve3, ms);
@@ -58490,7 +58919,7 @@ async function defaultSleep8(ms, signal) {
 async function pollExtractionStatus(client, contractFileIds, options = {}) {
   const interval = options.pollIntervalMs ?? EXTRACT_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? EXTRACT_POLL_TIMEOUT_MS;
-  const sleep4 = options.sleep ?? defaultSleep8;
+  const sleep4 = options.sleep ?? defaultSleep9;
   const now = options.now ?? Date.now;
   const resolved = /* @__PURE__ */ new Map();
   if (contractFileIds.length === 0) return { resolved, pending: [] };
@@ -60269,15 +60698,15 @@ async function extractAsync(cfg, parts) {
   return { results, sourceFiles, outcomes: ordered2, abortedMidRun };
 }
 function describeUnresolvedExtraction(contractFileId, lastError, commandAborted) {
-  const ref = `contract_file_id ${contractFileId}`;
+  const ref2 = `contract_file_id ${contractFileId}`;
   if (lastError !== void 0 && !isAbortError(lastError)) {
     const msg = lastError instanceof Error ? lastError.message : String(lastError);
-    return `extraction status could not be read (${ref}): ${msg}. The upload succeeded \u2014 re-check the status rather than re-uploading.`;
+    return `extraction status could not be read (${ref2}): ${msg}. The upload succeeded \u2014 re-check the status rather than re-uploading.`;
   }
   if (commandAborted || lastError !== void 0 && isAbortError(lastError)) {
-    return `the command budget expired before extraction finished (${ref}). Raise --timeout, then re-check the status rather than re-uploading.`;
+    return `the command budget expired before extraction finished (${ref2}). Raise --timeout, then re-check the status rather than re-uploading.`;
   }
-  return `still extracting when --poll-timeout expired (${ref}). Raise --poll-timeout, then re-check rather than re-uploading.`;
+  return `still extracting when --poll-timeout expired (${ref2}). Raise --poll-timeout, then re-check rather than re-uploading.`;
 }
 async function extractSync(cfg, parts) {
   const allResults = [];

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.93",
+  "cliVersion": "1.6.95",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/create-connector-lib/SKILL.md

@@ -60,12 +60,18 @@ parameter fails in `connect()` before the vendor is called.
   synthetic. Per-customer values (columns, category or custom-field names) live only in thin files.
   Before committing, grep the lib diff for the customer's name, domain and org id.
 - **Reuse before adding.** Use the SDK kit first (`from dr_integrations_sdk import kit`: logger, query
-  vars, HTTP client, CSV writer, paging, auth, dates), then `_core` helpers and an existing connection
+  vars, HTTP client, CSV writer, paging, auth, dates; on kit 1.1 also `config.is_unlimited`,
+  `http.json`, `http.same_origin`, `paging.gather_or_cancel`, `runtime.Deadline` and
+  `CsvWriter(block_bytes=)`), then `_core` helpers and an existing connection
   that fits; never a second copy. Name modules after what they do, never after who uses them. Hand the
   user a list of lib improvements you noticed (duplicated helpers, code that belongs in `_core`, a
-  hand-written copy of a kit helper), done in their own PR. The kit comes from the runner image at
-  runtime, not from `.sdk-ref`: publish a kit-based lib connector only once each hook's first log line
-  in that datacenter reads `INFO:dr.sdk: hook=… kit=<version>`.
+  hand-written copy of a kit helper), done in their own PR.
+- **Every new lib is built on the kit.** A new `lib/<vendor>/` module or thin file that defines its own
+  logger, query-vars merge, redaction, CSV block helper, date parser or retry loop is wrong; use the
+  kit call. The kit is live in every production ring, so that is never a reason to copy one. It comes
+  from the runner image at runtime, not from `.sdk-ref`: on a dev or test environment, check that each
+  hook's first log line reads `INFO:dr.sdk: hook=… kit=<version>` before publishing there, and if it
+  does not, get that environment's runner image updated rather than dropping the kit.
 - **Never change what another org lands.** A change to a module other orgs import must be proven
   output-neutral: their tests pass, and for text-only edits, each module's AST with docstrings stripped
   equals `origin/main`'s. A lib merge cuts new versions of every connector that bundles it; none moves
@@ -77,7 +83,9 @@ parameter fails in `connect()` before the vendor is called.
   the header-once, one-block-per-page writer and takes `csv.writer` dialect kwargs
   (`lineterminator="\n"`, `quoting=`), but writes each value as `csv.writer` does (`str()`, `None` as an
   empty cell), so the engine still pre-formats every cell the way the landed file shows (`true`, not
-  `True`).
+  `True`). Kit 1.1's `CsvWriter(cell=kit.csv.cell)` is a generic formatter, not a parity one: use it
+  only when its output matches the landed file byte for byte, else pass the engine's own function as
+  `cell=`.
 - **Credentials resolve at runtime from the datasource** (`get_credentials`), never from code, tests
   or logs (`tech/security.md` §4). Check a migrated credential's shape without printing it; a stored
   header value may carry its scheme (`Basic <base64>`).

package/dist/skills/datarails-connectors-onboard-connector/SKILL.md

@@ -187,28 +187,45 @@ Those carry org-specific config, may lag the current SDK/runtime contract, and c
 drift — the samples are the single maintained source of truth. At most read an existing one to sanity-check
 one behavior; never use it as the starting point to copy from.
 
-**Shared helpers come from the SDK's connector kit — never copy them, from a sample or anywhere else.**
-A template gives you the structure; the logger, config, retry, CSV and paging code comes from
+**Every new connector is built on the SDK's connector kit. Shared helpers come from the kit — never
+copy them, from a sample or anywhere else.** This is required, not a preference: a new connection or
+dataquery that defines its own `_get_logger`, `_query_vars`, `_safe_snippet`, `_csv_bytes` /
+`_csv_block`, `_parse_date` or a `for attempt in range` retry loop is wrong; replace it with the kit
+call below before it is reviewed. A template gives you the structure; the logger, config, retry, CSV
+and paging code comes from
 `from dr_integrations_sdk import kit` (import the package, not `kit.csv`/`kit.logging` by name — they
-would shadow the stdlib). `sample_http_vendor` uses it; `sample_streaming_fanout` and `lib/sample_vendor`
-still carry hand-written `_get_logger` / `_query_vars` / retry helpers, so swap those for the kit when you
-copy them. Reference: dr-connectors-runner `docs/connector-kit.md`.
+would shadow the stdlib). Every template is built on it (`sample_http_vendor`, `sample_streaming_fanout`,
+`lib/sample_vendor`), so a copy starts with no hand-written helpers. Reference: dr-connectors-runner
+`docs/connector-kit.md`.
 
 | Need | Kit |
 |---|---|
 | a logger whose lines survive the sandbox | `kit.logging.get_logger("<vendor>__<dq>")` |
 | the merged config channels, required variables | `kit.config.query_vars(req)`, `kit.config.require(vars, *names, context=)` (raises `PermanentError` naming each missing one) |
+| *(1.1)* a cap variable that may mean "no cap" | `kit.config.is_unlimited(value)`: `None`, `""`, `0` and the string `"0"` all mean unlimited |
 | vendor text in a log line or an error | `kit.redact.safe_snippet` / `log_safe` (redacts credentials); `one_line` for ids and cursors |
 | HTTP with retry and 4xx classification | `kit.http.client(...)`, an `httpx.AsyncClient` (every httpx kwarg passes through): retries 429 (honouring `Retry-After`), 500/502/503/504 and transport errors; 401/403 raise `AuthError`, any other 4xx or an unfollowed redirect `PermanentError`; a 429/5xx still failing after the last attempt raises `httpx.HTTPStatusError` (runtime retry). `raise_for_status=False` hands 4xx back to you |
+| *(1.1)* a JSON body you must not misread as an empty page | `kit.http.json(response, expect=list)`: `PermanentError` with a redacted snippet when the body is not JSON or not that type |
+| *(1.1)* a vendor next link fetched with the credential | `kit.paging.cursor_pages(page, same_origin=base_url)` refuses a link to another scheme, host or port before fetching it; `kit.http.same_origin(url, base)` / `require_same_origin` for links you follow yourself; *(1.2)* `kit.http.client(base_url=..., same_origin_only=True)` refuses every request off that origin, redirect hops included |
 | the CSV header once, one block per page | `kit.csv.CsvWriter(fields).blocks(req, pages)`; `.rows` counts rows written |
+| *(1.1)* many small pages | `CsvWriter(fields, block_bytes=kit.csv.BLOCK_BYTES)` coalesces them into ~4 MB blocks, far under Azure's 50,000-block limit |
+| *(1.1)* typed values as CSV cells | `CsvWriter(fields, cell=kit.csv.cell)`: bool `true`/`false`, `Decimal` without exponent, tz-aware datetime as naive UTC, bytes hex, dict/list compact JSON. Not on a Workato migration: there the cell shape comes from the landed file (see *create-connector-lib*) |
 | paging that fails loudly | `kit.paging.cursor_pages` / `offset_pages`; `kit.paging.waves(items, worker, concurrency=)` |
+| *(1.1)* a handful of concurrent vendor calls | `kit.paging.gather_or_cancel(awaitables)`: cancels the siblings on the first failure and re-raises it unwrapped. Never `asyncio.TaskGroup`: its `ExceptionGroup` turns a `PermanentError` into 5 retries |
+| *(1.1)* the hook's time budget | `deadline = kit.runtime.Deadline("<vendor> <dq>")` in `fetch`: *(1.2)* it counts from the runner's own start of the hook and stops 60 s short of the timeout the runner kills at, watching CPU time too. `deadline.check(progress)` per page, `await deadline.sleep(s, progress)` for poll waits, and `kit.http.client(deadline=deadline)` for retry waits. Each raises `PermanentError` naming the progress |
 | credentials and tokens | `kit.auth.credential(creds, *keys, vendor=)`, `client_credentials` / `password_grant` → `Token.header()`, `basic_header`, `bearer_header` |
 | a date window | `kit.dates.date_window(vars, start_keys=, end_keys=, required=)`, `DateWindow.chunks(days)`, `parse_date` |
 
-**Publish a kit connector only where the kit is live.** At runtime the kit comes from the **runner
-image**, not from `.sdk-ref` (that pins only what CI tests against). An image with the kit prints
-`INFO:dr.sdk: hook=… correlation_id=… kit=<version>` as each hook's first log line; until that line
-shows in the target datacenter, a connector that imports `kit` fails at import there.
+**Kit 1.2 is live in every production ring** (runner image `connectors-runner-base` v1.35.0, since
+2026-10-02), so every row above is usable there and the kit is never a reason to fall back to copied
+helpers. The *(1.1)* / *(1.2)* marks say which kit version a row needs, for an environment whose runner
+image is older.
+At runtime the kit comes from the **runner image**, not from `.sdk-ref` (that pins only what CI tests
+against). An image with the kit prints
+`INFO:dr.sdk: hook=… correlation_id=… kit=<version>` as each hook's first log line. On a dev or test
+environment, check for that line before publishing there; if it is missing, a connector that imports
+`kit` fails at import, so get that environment's runner image updated — do not rewrite the connector
+without the kit.
 
 **Batching & output — the non-negotiable pattern (get this right FIRST, before writing fetch).**
 
@@ -302,9 +319,10 @@ Two more sandbox ceilings worth knowing, both undocumented elsewhere:
   ThreadPoolExecutor **never reaps its threads** — so an unbounded pool can claim ~256 MB of the
   512 MB and never give it back. That is why a brief concurrency spike used to poison every *later*
   phase of a run with `RuntimeError: can't start new thread` and SSL allocation failures long after
-  the spike finished. Cap it once at the top of the fetch:
-  `asyncio.get_running_loop().set_default_executor(ThreadPoolExecutor(max_workers=4))`.
-- **`RLIMIT_CPU = 60s`** sits right next to the memory limit in `sandbox_entry.py`. Exceeding it
+  the spike finished. **The runner now caps it at 8 threads** before every hook
+  (`sandbox_entry.py` `SANDBOX_EXECUTOR_THREADS`, DR-53651), so a connector no longer installs its own
+  `set_default_executor(...)`; remove one when you touch the file.
+- **`RLIMIT_CPU = 2700s`** sits right next to the memory limit in `sandbox_entry.py`. Exceeding it
   SIGKILLs the hook (runner reports `sandbox exited -24`) with no `MemoryError` to explain it. Async
   I/O waiting is free, but TLS handshakes, gzip and JSON parsing are not — log
   `time.process_time()` alongside wall clock so you can see how close you are.
@@ -864,8 +882,8 @@ unmerged connector has no version to ingest, bind, or run.
 | Confused about publish vs ingest | CI publishes to JFrog on merge (cuts the git tag `vN`); the CLI ingests a published version into a DC | `dr connectors publish <path/to/dataqueries/<dq>.py> --server DEV --account <customer-user-email> --json` reads the newest git tag (`git fetch --tags` + max `vN`, or `--tag vN`) — **no local compose** — then the control-plane **pulls that tag from JFrog** (no upload) and registers it (needs `NODE_EXTRA_CA_CERTS`); returns `{name, version: "vN", digest}`. |
 | Run `Failed`, `connect` completion `verdict: ok` but `fetch` completion `verdict: retry`, error `'async for' requires an object with __aiter__ method, got function` | Passed the async-generator **function** to `write_output` — `write_output(req, gen)` instead of **calling** it `write_output(req, gen())`. `write_output` does `async for chunk in <arg>`, which needs an async **iterator**, not a function. (The connect gate passing but fetch dying instantly is the tell.) | Call the generator: `write_output(req, gen())`. The golden template already shows `write_output(req, rows())` / `write_output(req, blocks())` — match it exactly; the missing `()` is easy to drop. |
 | Vendor **4xx** (e.g. `402 Payment Required`, `401`, `403`, bad-symbol `404`) makes the `fetch` completion `verdict: retry` and the run **retries forever**; the HTTP status shows ONLY in the completion store, never in the Inngest run `output` (which is `null`). | A bare `r.raise_for_status()` raises `httpx.HTTPStatusError` for **every** status ≥ 400, and the runtime classifies that as **transient → retry**. But a plan/auth/bad-request 4xx will never succeed on retry. | Use `kit.http.client` (skill §1): 401/403 raise `AuthError` and any other 4xx `PermanentError`, each naming the status and a redacted body; 429 and 5xx are retried, then left to the runtime's retry (genuinely transient). Concrete case: FMP's free tier answers **402** when `limit` exceeds its historical allowance (dev key caps statements at the last **5** annual records) — a small `limit` or a paid key fixes that one; the PermanentError stops the infinite loop for the general case. The golden `sample_http_vendor` template is built on this client. |
-| Connector works perfectly in local/dev testing, then in production `fetch` dies with `MemoryError`, `MemoryError: Unable to allocate output buffer`, an SSL/crypto allocation failure, or `RuntimeError: can't start new thread` — often within a second of "fetch start", and deterministically on every one of the 5 attempts | The sandbox caps **virtual address space at `RLIMIT_AS` = 512 MB** (`dr-connectors-runner/src/runner/sandbox_entry.py`), and the runner pod's limit is also 512Mi. The guard is `if sys.platform != "win32"`, so **the ceiling does not exist on a Windows dev box** — a buffering connector cannot fail locally. Two causes, usually together: (a) the fetch accumulates the result set (a `rows` list, `asyncio.gather` over every parent, a full CSV string + its `.encode()` copy) — journal_lines measured **378 MB live to emit 67 MB**, 243 MB of it row dicts at 846 B/row; (b) asyncio's **default** DNS ThreadPoolExecutor grew to `min(32, node_cores + 4)` threads × 8 MB stack ≈ **256 MB of address space that is never reclaimed**, which is why a brief concurrency spike poisons every later phase of the run. | Stream: do the fetching **inside** the generator passed to `write_output`, replace gather-over-everything with a bounded worker pool feeding a bounded `asyncio.Queue`, format rows to CSV bytes immediately (never hold dicts), and re-batch to ~4 MB blocks. Cap the executor once: `asyncio.get_running_loop().set_default_executor(ThreadPoolExecutor(max_workers=4))`. Full rules in §1 *Memory*; working template `samples/sample_streaming_fanout/`. Reproduce locally in `python:3.12-slim` under the same rlimits — never trust a Windows run for this. |
-| Hook dies with no traceback and no `MemoryError`; runner reports `sandbox exited -24` | **`RLIMIT_CPU = 60s`** (`sandbox_entry.py`, right beside the memory limit) — 60 seconds of **CPU** time, then SIGXCPU/SIGKILL. Async I/O waiting is free, but TLS handshakes, gzip and JSON parsing across thousands of requests are not. | Cut CPU per row (fewer/larger vendor pages, `onlyData` where the vendor supports it, no per-row dict churn) and log `time.process_time()` next to wall clock so proximity to the cap is visible before it kills a run. |
+| Connector works perfectly in local/dev testing, then in production `fetch` dies with `MemoryError`, `MemoryError: Unable to allocate output buffer`, an SSL/crypto allocation failure, or `RuntimeError: can't start new thread` — often within a second of "fetch start", and deterministically on every one of the 5 attempts | The sandbox caps **virtual address space at `RLIMIT_AS` = 512 MB** (`dr-connectors-runner/src/runner/sandbox_entry.py`), and the runner pod's limit is also 512Mi. The guard is `if sys.platform != "win32"`, so **the ceiling does not exist on a Windows dev box** — a buffering connector cannot fail locally. Two causes, usually together: (a) the fetch accumulates the result set (a `rows` list, `asyncio.gather` over every parent, a full CSV string + its `.encode()` copy) — journal_lines measured **378 MB live to emit 67 MB**, 243 MB of it row dicts at 846 B/row; (b) asyncio's **default** DNS ThreadPoolExecutor grew to `min(32, node_cores + 4)` threads × 8 MB stack ≈ **256 MB of address space that is never reclaimed**, which is why a brief concurrency spike poisons every later phase of the run. | Stream: do the fetching **inside** the generator passed to `write_output`, replace gather-over-everything with a bounded worker pool feeding a bounded `asyncio.Queue`, format rows to CSV bytes immediately (never hold dicts), and re-batch to ~4 MB blocks (`kit.csv.CsvWriter(..., block_bytes=kit.csv.BLOCK_BYTES)` on kit 1.1). The executor cap (b) is now set by the runner (8 threads); a connector installs none. Full rules in §1 *Memory*; working template `samples/sample_streaming_fanout/`. Reproduce locally in `python:3.12-slim` under the same rlimits — never trust a Windows run for this. |
+| Hook dies with no traceback and no `MemoryError`; runner reports `sandbox exited -24` | **`RLIMIT_CPU = 2700s`** (`sandbox_entry.py`, right beside the memory limit) — 2700 seconds of **CPU** time, summed over all threads, then SIGXCPU/SIGKILL. Async I/O waiting is free, but TLS handshakes, gzip and JSON parsing across thousands of requests are not. | Cut CPU per row (fewer/larger vendor pages, `onlyData` where the vendor supports it, no per-row dict churn) and log `time.process_time()` next to wall clock so proximity to the cap is visible before it kills a run. |
 | A sync `Completed` and the file **looks** complete, but the customer's totals are short | A page-limit "safety cap" (`_LINE_PAGE_LIMIT`, `_HEADER_PAGE_LIMIT`, …) tripped and the code **logged a warning and returned what it had**, so a partial result landed as if whole. Same failure class as a missing offset follow-up: journal_lines silently dropped **113,171 rows** of one customer's month this way. | Caps must `raise PermanentError`, never warn-and-return — a failed sync is recoverable, a silently partial landing gets reconciled against and believed. Audit every `log.warning` that is followed by `return`. |
 
 ## Env quick reference (dev germany)

package/dist/skills/dr-cli/SKILL.md

@@ -611,7 +611,10 @@ network traffic or hand-edits JSON. Full recipes in the relevant reference file.
   date to whatever granularity the filebox's own DATE tag actually uses —
   no need to know if it's yearly/quarterly/monthly/daily/weekly. `--tag` is
   an unvalidated escape hatch that forwards straight to the server; a
-  malformed value 500s with no error body. See reference/filebox-documents.md.
+  malformed value 500s with no error body. To know when it finished, add
+  `--wait` — never poll `status` or the version count: an unchanged result
+  writes no new version and still reads `SYNCED`. See
+  reference/filebox-documents.md.
 - **"User has no table permissions" is almost always a misread.** To see which
   tables a user can access, use `dr users permissions get <id>` — never the raw
   `GET /api/it/users/<id>` object's `permissions` field. That field is Django

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -169,8 +169,12 @@ set-version-include` (below).
   only allow-listed keys are accepted (currently `is_bank_integration`); unknown
   keys are rejected client-side (the server silently accepts dead keys).
 - `filebox data-query get|set|clear|sync <fb_id>` — read/write/delete/poke the
-  Workato data-query. `get` shows `sync_interval` (cron) + `last_sync`; `set
-  --payload-file` PUTs a create/update body; `clear` is two-step.
+  Workato data-query. `get` shows `sync_interval` (cron), `last_sync` and
+  `Last start` (when the latest sync started); `set --payload-file` PUTs a
+  create/update body; `clear` is two-step. `last_sync` doubles as the
+  auto-sync debounce, so it can read minutes in the future. Older servers do
+  not return either timestamp: `last_sync` then reads `never` and `Last start`
+  is omitted.
 - `filebox data-query sync <fb_id> [--date YYYY-MM-DD]` — trigger an async
   sync, optionally scoped to specific period(s). `--date` is repeatable and
   takes one plain calendar date — the CLI reads the filebox's own DATE
@@ -195,6 +199,32 @@ set-version-include` (below).
   constant — varies per tenant) and the epoch just needs to fall within the
   target period (the server normalizes it). Prefer `--date`; reach for raw
   `--tag` only when it doesn't cover your case.
+- **Waiting for a sync: `filebox data-query sync <fb_id> --date … --wait`.**
+  Never poll `status` or the version count yourself — both lie:
+  - With `sync_only_changes` (the default), a sync whose output is identical
+    to the stored latest version for that period writes **no new version**.
+    `status` still goes to `SYNCED`, and the version count never moves. This
+    is not an error.
+  - Right after a sync is queued, `status` can still show the previous run's
+    value (or `-`) until the sync starts. A loop that waits for "not
+    SYNCING" exits at once.
+  - A multi-period sync flips `status` to `SYNCED` after each period, so
+    "status is SYNCED" can mean one period of several.
+  - A premature exit followed by `filebox download` silently returns the
+    **previous** version.
+
+  `--wait` snapshots each `--date` period's versions before triggering, then
+  polls until every period either gained a new version (**new version**) or
+  had its latest version re-confirmed — the server bumps that version's
+  `last_sync` instead of writing one (**unchanged**). It exits non-zero when
+  the data-query goes to `ERROR` (with the server's `last_sync_error`) or on
+  `--timeout <seconds>` (default 1800). `--json` prints one object:
+  `{outcome, periods: [{period, result: new_version|no_change|pending,
+  version_id, version}], unmatched_new_versions, error, waited_seconds}`.
+  Without `--date`, it waits for the first period to finish. It cannot be
+  combined with `--tag`. One blind spot: a sync that returns **no rows**
+  writes no version and re-confirms none, so it ends in a timeout whose
+  message says so — check `dr filebox data-query get <fb_id>`.
 - `filebox data-query set-sync-interval <fb_id> --cron "<expr>"` — change how
   often the data-query polls (Workato-backed **and** connector-platform /
   `DatarailsConnector` fileboxes both use this cron). **Use this for sync

package/dist/skills/dr-cli/reference/reconciliation-mec.md

@@ -22,7 +22,14 @@ Account assignment / sign-off (all take the bank-account UUID via
 
 - `reconciliation accounts update-settings --file <p>` — admin-only PATCH.
   Two-step confirm; the token binds to a hash of the file's rows, so editing
-  the file between plan and confirm invalidates it.
+  the file between plan and confirm invalidates it. Rows are matched to the
+  tenant by `(entity, account_group, name)`; only rows that differ are sent,
+  in PATCHes of at most 256 KB (one whole-tenant PATCH near 1 MB returns
+  HTTP 500). The plan reports rows to change, rows skipped as already
+  matching, and the changes by target frequency (`Exclude` is how an account
+  is excluded from reconciliation). If a PATCH fails, the error says how many
+  rows landed; re-run the same file without a token and the new plan covers
+  only the rest.
 - `reconciliation accounts set-assignee <account_uuid> --date <YYYY-MM-DD>
   --type Preparer|Reviewer --user-id <n> [--user-name <s> --user-email <s>]` —
   resets any prior sign-off; name/email are auto-fetched if not supplied.
@@ -38,7 +45,12 @@ Account assignment / sign-off (all take the bank-account UUID via
   resets. Every account is checked before anything is written, and the
   write goes out in PATCHes of 100 accounts. If one fails, the error says
   how many accounts landed; re-run the same file without a token and the
-  new plan covers only the rest. Do not script a loop of single
+  new plan covers only the rest. Before each PATCH after the first, the
+  accounts are re-read; if any account in the next chunk is gone (a
+  trial-balance rebuild re-mints account ids) or its member slots changed
+  since the plan, the run halts, says how many accounts landed, and names
+  the drifted accounts. Gone accounts mean the file must be rebuilt from
+  `accounts list` once the rebuild settles. Do not script a loop of single
   `set-assignee` calls for this.
 - `reconciliation accounts clear-assignee <account_uuid> --date <YYYY-MM-DD>
   --type Preparer|Reviewer` — unassigns (preserves due_date, resets sign-off).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.93",
+  "version": "1.6.95",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {