@reporting-bi/cli 0.1.10 → 0.1.12

package/dist/index.js

@@ -30,91 +30,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../rp-client/dist/types.js
-var require_types = __commonJS({
-  "../rp-client/dist/types.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-  }
-});
-
-// ../rp-client/dist/cache.js
-var require_cache = __commonJS({
-  "../rp-client/dist/cache.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ServiceCache = void 0;
-    var ServiceCache = class {
-      constructor() {
-        this.cache = /* @__PURE__ */ new Map();
-      }
-      createKey(params3) {
-        let key = params3.path;
-        if (params3.params) {
-          const paramStrings = [];
-          for (const k of Object.keys(params3.params).sort()) {
-            paramStrings.push(`${k}=${params3.params[k]}`);
-          }
-          if (paramStrings.length > 0) {
-            key += `?${paramStrings.join("&")}`;
-          }
-        }
-        return key;
-      }
-      set(params3, data) {
-        const key = this.createKey(params3);
-        this.cache.set(key, data);
-      }
-      get(params3) {
-        const key = this.createKey(params3);
-        return this.cache.get(key);
-      }
-      has(params3) {
-        const key = this.createKey(params3);
-        return this.cache.has(key);
-      }
-      clear() {
-        this.cache.clear();
-      }
-    };
-    exports2.ServiceCache = ServiceCache;
-  }
-});
-
-// ../rp-client/dist/accountingProvider.js
-var require_accountingProvider = __commonJS({
-  "../rp-client/dist/accountingProvider.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.AccountingProvider = void 0;
-    var AccountingProvider2 = class {
-      constructor() {
-        this._a = null;
-        this._accounting = null;
-      }
-      get a() {
-        return this._a;
-      }
-      set a(a) {
-        this._a = a;
-        if (this.accounting?.accounting != a) {
-          this._accounting = null;
-        }
-      }
-      get accounting() {
-        return this._accounting;
-      }
-      set accounting(accounting2) {
-        if (accounting2) {
-          this._a = accounting2.accounting ?? null;
-        }
-        this._accounting = accounting2;
-      }
-    };
-    exports2.AccountingProvider = AccountingProvider2;
-  }
-});
-
 // ../../.yarn/cache/es-errors-npm-1.3.0-fda0c9b8a8-0a61325670.zip/node_modules/es-errors/type.js
 var require_type = __commonJS({
   "../../.yarn/cache/es-errors-npm-1.3.0-fda0c9b8a8-0a61325670.zip/node_modules/es-errors/type.js"(exports2, module2) {
@@ -2628,249 +2543,6 @@ var require_lib = __commonJS({
   }
 });
 
-// ../rp-client/dist/service.js
-var require_service = __commonJS({
-  "../rp-client/dist/service.js"(exports2) {
-    "use strict";
-    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.Service = exports2.ServiceAuthException = exports2.ServiceEvent = exports2.ServiceException = exports2.serializeRequestParams = void 0;
-    var qs_1 = __importDefault(require_lib());
-    var cache_js_1 = require_cache();
-    function isObject2(value) {
-      return value !== null && typeof value === "object" && !Array.isArray(value);
-    }
-    function serializeRequestParams(params3) {
-      const p = {};
-      for (const k in params3) {
-        switch (k) {
-          case "customParams":
-            p["p"] = JSON.stringify(params3.customParams);
-            break;
-          default:
-            p[k] = isObject2(params3[k]) || Array.isArray(params3[k]) ? JSON.stringify(params3[k]) : params3[k];
-            break;
-        }
-      }
-      return qs_1.default.stringify(p, { addQueryPrefix: false });
-    }
-    exports2.serializeRequestParams = serializeRequestParams;
-    var ServiceException = class extends Error {
-      constructor(args) {
-        super(args?.data?.message || "Unknown error");
-        Object.assign(this, args);
-      }
-    };
-    exports2.ServiceException = ServiceException;
-    var ServiceEvent2 = class extends Event {
-      constructor(name, args) {
-        super(name);
-        Object.assign(this, args);
-      }
-    };
-    exports2.ServiceEvent = ServiceEvent2;
-    var ServiceAuthException = class extends Error {
-    };
-    exports2.ServiceAuthException = ServiceAuthException;
-    var Service2 = class extends EventTarget {
-      get a() {
-        return this.accountingProvider?.a;
-      }
-      get name() {
-        return this.options.name;
-      }
-      get cache() {
-        if (!this._cache)
-          this._cache = new cache_js_1.ServiceCache();
-        return this._cache;
-      }
-      constructor(options) {
-        super();
-        this.accountingProvider = null;
-        this.tokenProvider = null;
-        this._cache = null;
-        this.options = { ...options };
-        if (!/^(https?|\/)/.test(this.options.baseUrl)) {
-          this.options.baseUrl = `https://${this.options.baseUrl}`;
-        }
-      }
-      createUrl(path9 = "", params3) {
-        if (this.options.xdebugSession) {
-          params3 = params3 || {};
-          params3.XDEBUG_SESSION = this.options.xdebugSession === true ? "1" : this.options.xdebugSession.toString();
-        }
-        if (this.options.params && Object.keys(this.options.params).length > 0) {
-          params3 = { ...this.options.params, ...params3 };
-        }
-        let queryString = params3 ? serializeRequestParams(params3) : "";
-        if (queryString)
-          queryString = `?${queryString}`;
-        const a = params3 && params3.accounting ? params3.accounting.toString() : this.a ? this.a.toString() : null;
-        path9 = path9.replace(/^\//, "");
-        const parts = [this.options.baseUrl, a, this.options.name, path9];
-        return parts.filter((p) => p != null && p !== "").join("/") + queryString;
-      }
-      async createHeaders(headers) {
-        const defaultHeaders = {};
-        if (this.tokenProvider) {
-          const token = await this.tokenProvider();
-          if (token) {
-            defaultHeaders["Authorization"] = `Bearer ${token}`;
-          }
-        }
-        return { ...defaultHeaders, ...headers };
-      }
-      get credentials() {
-        return this.tokenProvider ? void 0 : "include";
-      }
-      async handleError(response) {
-        const contentType = response.headers.get("Content-Type");
-        let error48;
-        if (contentType?.includes("application/json")) {
-          error48 = await response.json();
-          error48.status = response.status;
-        } else {
-          error48 = { status: response.status, message: "Unknown error", error: "unknown" };
-        }
-        if (this.options.throwExceptions) {
-          throw new ServiceException({ data: error48, url: response.url });
-        }
-      }
-      async handleResponse(response, parse3) {
-        if (!response.ok) {
-          await this.handleError(response);
-          return null;
-        }
-        const contentType = response.headers.get("Content-Type");
-        if (contentType?.includes("application/json") && parse3 !== false) {
-          return await response.json();
-        } else {
-          return await response.text();
-        }
-      }
-      async getRaw(path9, params3, options) {
-        const url2 = this.createUrl(path9, params3);
-        this.dispatchEvent(new ServiceEvent2("beforeRequest", { url: url2, params: params3, options, method: "GET" }));
-        return fetch(url2, {
-          headers: await this.createHeaders(options?.headers),
-          credentials: this.credentials
-        });
-      }
-      async get(path9, params3, options) {
-        if (options?.cache) {
-          const cachedData = this.cache.get({ path: path9, params: params3 });
-          if (cachedData)
-            return cachedData;
-        }
-        const response = await this.getRaw(path9, params3, options);
-        const responseData = await this.handleResponse(response, options?.parseResponse);
-        if (options?.cache && responseData) {
-          this.cache.set({ path: path9, params: params3 }, responseData);
-        }
-        return responseData;
-      }
-      async postRaw(path9, data, params3, options) {
-        const url2 = this.createUrl(path9, params3);
-        this.dispatchEvent(new ServiceEvent2("beforeRequest", { url: url2, params: params3, options, method: "POST" }));
-        const json3 = isObject2(data) || Array.isArray(data);
-        return fetch(url2, {
-          method: "POST",
-          body: json3 ? JSON.stringify(data) : data,
-          headers: await this.createHeaders({
-            ...options?.headers ?? {},
-            "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
-          }),
-          credentials: this.credentials
-        });
-      }
-      async post(path9, data, params3, options) {
-        const response = await this.postRaw(path9, data, params3, options);
-        return this.handleResponse(response);
-      }
-      async deleteRaw(path9, params3, options) {
-        const url2 = this.createUrl(path9, params3);
-        this.dispatchEvent(new ServiceEvent2("beforeRequest", { url: url2, params: params3, options, method: "DELETE" }));
-        return fetch(url2, {
-          method: "DELETE",
-          headers: await this.createHeaders(options?.headers),
-          credentials: this.credentials
-        });
-      }
-      async delete(path9, params3, options) {
-        const response = await this.deleteRaw(path9, params3, options);
-        return this.handleResponse(response);
-      }
-      async putRaw(path9, data, params3, options) {
-        const url2 = this.createUrl(path9, params3);
-        this.dispatchEvent(new ServiceEvent2("beforeRequest", { url: url2, params: params3, options, method: "PUT" }));
-        const json3 = isObject2(data) || Array.isArray(data);
-        return fetch(url2, {
-          method: "PUT",
-          body: json3 ? JSON.stringify(data) : data,
-          headers: await this.createHeaders({
-            ...options?.headers ?? {},
-            "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
-          }),
-          credentials: this.credentials
-        });
-      }
-      async put(path9, data, params3, options) {
-        const response = await this.putRaw(path9, data, params3, options);
-        return this.handleResponse(response);
-      }
-      async patchRaw(path9, data, params3, options) {
-        const url2 = this.createUrl(path9, params3);
-        this.dispatchEvent(new ServiceEvent2("beforeRequest", { url: url2, params: params3, options, method: "PATCH" }));
-        const json3 = isObject2(data) || Array.isArray(data);
-        return fetch(url2, {
-          method: "PATCH",
-          body: json3 ? JSON.stringify(data) : data,
-          headers: await this.createHeaders({
-            ...options?.headers ?? {},
-            "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
-          }),
-          credentials: this.credentials
-        });
-      }
-      async patch(path9, data, params3, options) {
-        const response = await this.patchRaw(path9, data, params3, options);
-        return this.handleResponse(response);
-      }
-    };
-    exports2.Service = Service2;
-  }
-});
-
-// ../rp-client/dist/index.js
-var require_dist = __commonJS({
-  "../rp-client/dist/index.js"(exports2) {
-    "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    } : function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    });
-    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
-    };
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    __exportStar(require_types(), exports2);
-    __exportStar(require_cache(), exports2);
-    __exportStar(require_accountingProvider(), exports2);
-    __exportStar(require_service(), exports2);
-  }
-});
-
 // ../../.yarn/cache/ajv-npm-8.18.0-6e5e062765-e7517c4261.zip/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
   "../../.yarn/cache/ajv-npm-8.18.0-6e5e062765-e7517c4261.zip/node_modules/ajv/dist/compile/codegen/code.js"(exports2) {
@@ -4776,9 +4448,9 @@ var require_keyword = __commonJS({
       if (Array.isArray(def2.keyword) ? !def2.keyword.includes(keyword) : def2.keyword !== keyword) {
         throw new Error("ajv implementation error");
       }
-      const deps = def2.dependencies;
-      if (deps === null || deps === void 0 ? void 0 : deps.some((kwd) => !Object.prototype.hasOwnProperty.call(schema, kwd))) {
-        throw new Error(`parent schema must have dependencies of ${keyword}: ${deps.join(",")}`);
+      const deps2 = def2.dependencies;
+      if (deps2 === null || deps2 === void 0 ? void 0 : deps2.some((kwd) => !Object.prototype.hasOwnProperty.call(schema, kwd))) {
+        throw new Error(`parent schema must have dependencies of ${keyword}: ${deps2.join(",")}`);
       }
       if (def2.validateSchema) {
         const valid = def2.validateSchema(schema[keyword]);
@@ -5822,7 +5494,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve7.call(this, root, ref);
+      let _sch = resolve8.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a2 = root.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref];
         const { schemaId } = this.opts;
@@ -5849,7 +5521,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve7(root, ref) {
+    function resolve8(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -6424,7 +6096,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve7(baseURI, relativeURI, options) {
+    function resolve8(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -6651,7 +6323,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve7,
+      resolve: resolve8,
       resolveComponent,
       equal,
       serialize,
@@ -8198,14 +7870,14 @@ var require_dependencies = __commonJS({
     var util_1 = require_util();
     var code_1 = require_code2();
     exports2.error = {
-      message: ({ params: { property, depsCount, deps } }) => {
+      message: ({ params: { property, depsCount, deps: deps2 } }) => {
         const property_ies = depsCount === 1 ? "property" : "properties";
-        return (0, codegen_1.str)`must have ${property_ies} ${deps} when property ${property} is present`;
+        return (0, codegen_1.str)`must have ${property_ies} ${deps2} when property ${property} is present`;
       },
-      params: ({ params: { property, depsCount, deps, missingProperty } }) => (0, codegen_1._)`{property: ${property},
+      params: ({ params: { property, depsCount, deps: deps2, missingProperty } }) => (0, codegen_1._)`{property: ${property},
     missingProperty: ${missingProperty},
     depsCount: ${depsCount},
-    deps: ${deps}}`
+    deps: ${deps2}}`
       // TODO change to reference
     };
     var def2 = {
@@ -8225,8 +7897,8 @@ var require_dependencies = __commonJS({
       for (const key in schema) {
         if (key === "__proto__")
           continue;
-        const deps = Array.isArray(schema[key]) ? propertyDeps : schemaDeps;
-        deps[key] = schema[key];
+        const deps2 = Array.isArray(schema[key]) ? propertyDeps : schemaDeps;
+        deps2[key] = schema[key];
       }
       return [propertyDeps, schemaDeps];
     }
@@ -8236,23 +7908,23 @@ var require_dependencies = __commonJS({
         return;
       const missing = gen.let("missing");
       for (const prop in propertyDeps) {
-        const deps = propertyDeps[prop];
-        if (deps.length === 0)
+        const deps2 = propertyDeps[prop];
+        if (deps2.length === 0)
           continue;
         const hasProperty = (0, code_1.propertyInData)(gen, data, prop, it.opts.ownProperties);
         cxt.setParams({
           property: prop,
-          depsCount: deps.length,
-          deps: deps.join(", ")
+          depsCount: deps2.length,
+          deps: deps2.join(", ")
         });
         if (it.allErrors) {
           gen.if(hasProperty, () => {
-            for (const depProp of deps) {
+            for (const depProp of deps2) {
               (0, code_1.checkReportMissingProp)(cxt, depProp);
             }
           });
         } else {
-          gen.if((0, codegen_1._)`${hasProperty} && (${(0, code_1.checkMissingProp)(cxt, deps, missing)})`);
+          gen.if((0, codegen_1._)`${hasProperty} && (${(0, code_1.checkMissingProp)(cxt, deps2, missing)})`);
           (0, code_1.reportMissingProp)(cxt, missing);
           gen.else();
         }
@@ -8978,7 +8650,7 @@ var require_draft7 = __commonJS({
 });
 
 // ../../.yarn/cache/ajv-npm-8.18.0-6e5e062765-e7517c4261.zip/node_modules/ajv/dist/vocabularies/discriminator/types.js
-var require_types2 = __commonJS({
+var require_types = __commonJS({
   "../../.yarn/cache/ajv-npm-8.18.0-6e5e062765-e7517c4261.zip/node_modules/ajv/dist/vocabularies/discriminator/types.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -8997,7 +8669,7 @@ var require_discriminator = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     var codegen_1 = require_codegen();
-    var types_1 = require_types2();
+    var types_1 = require_types();
     var compile_1 = require_compile();
     var ref_error_1 = require_ref_error();
     var util_1 = require_util();
@@ -9599,7 +9271,7 @@ var require_limit = __commonJS({
 });
 
 // ../../.yarn/__virtual__/ajv-formats-virtual-7723216a4c/0/cache/ajv-formats-npm-3.0.1-2662cf5b12-168d6bca1e.zip/node_modules/ajv-formats/dist/index.js
-var require_dist2 = __commonJS({
+var require_dist = __commonJS({
   "../../.yarn/__virtual__/ajv-formats-virtual-7723216a4c/0/cache/ajv-formats-npm-3.0.1-2662cf5b12-168d6bca1e.zip/node_modules/ajv-formats/dist/index.js"(exports2, module2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -9649,7 +9321,7 @@ var fs2 = __toESM(require("node:fs"));
 var path = __toESM(require("node:path"));
 var os2 = __toESM(require("node:os"));
 
-// ../rp-auth-client-v2/dist/client.js
+// ../rp-auth-client-v2/src/client.ts
 var DEFAULT_OPTIONS = {
   serviceUrl: null,
   redirectUrl: typeof window !== "undefined" ? window.location.href : null,
@@ -9663,8 +9335,7 @@ var ReportingAuthClientException = class extends Error {
   }
 };
 function accountingServiceUrl(serviceUrl, accounting2) {
-  if (accounting2 == null)
-    return serviceUrl;
+  if (accounting2 == null) return serviceUrl;
   const match = /^(.*)\/ms\/auth\/?$/.exec(serviceUrl);
   if (!match) {
     throw new ReportingAuthClientException({
@@ -9674,12 +9345,26 @@ function accountingServiceUrl(serviceUrl, accounting2) {
   return `${match[1]}/ms/${accounting2}/auth`;
 }
 var ReportingAuthClient = class {
+  constructor(options) {
+    this.options = DEFAULT_OPTIONS;
+    /**
+     * Body of the last response, already parsed. A fetch body may be read only once, so every
+     * method that consumes it parks the result here for readCredentials() to hand out — reading
+     * it a second time throws "Body is unusable", which used to cost rp-cli the tokens it had
+     * just been issued.
+     *
+     * Boxed because the parsed value may legitimately be null, and a body that never held
+     * credentials (token info, an error) parks { value: null } so it is not read again either.
+     */
+    this.parsedResponse = null;
+    this._expiresAt = null;
+    this.setOptions(options);
+  }
   get expiresAt() {
     return this._expiresAt;
   }
   get expiresIn() {
-    if (this._expiresAt === null)
-      return null;
+    if (this._expiresAt === null) return null;
     return this._expiresAt - Math.floor(Date.now() / 1e3);
   }
   async getAuthInit() {
@@ -9700,17 +9385,28 @@ var ReportingAuthClient = class {
       }
     });
   }
+  /** Keeps the parked body in step with the response it was read from */
+  setResponse(response) {
+    this.response = response;
+    this.parsedResponse = null;
+    return response;
+  }
+  /**
+   * Reads the error body of the last response. It carries no credentials and the body is spent
+   * afterwards, so it is parked as such. The HTTP status is attached because callers need to
+   * tell a rejected token (401) from a service that is merely unwell (5xx).
+   */
+  async readErrorBody() {
+    const body = await this.response.json();
+    this.parsedResponse = { value: null };
+    return { status: this.response.status, ...body };
+  }
   setOptions(options) {
     Object.assign(this.options, options);
     if (!/^(https?|\/)/.test(this.options.serviceUrl)) {
       this.options.serviceUrl = `https://${this.options.serviceUrl}`;
     }
   }
-  constructor(options) {
-    this.options = DEFAULT_OPTIONS;
-    this._expiresAt = null;
-    this.setOptions(options);
-  }
   /**
    * Issues a token for another user. Like impersonate(), the accounting belongs in the
    * URL: delegateToken checks the caller's Admin right against the accounting of the
@@ -9721,7 +9417,7 @@ var ReportingAuthClient = class {
     const scope = options.scope ? Array.isArray(options.scope) ? options.scope.join(" ") : options.scope : "";
     const accounting2 = options.accounting ?? this.options.accounting;
     const serviceUrl = accountingServiceUrl(this.options.serviceUrl, accounting2);
-    this.response = await this.fetchWithAuth(`${serviceUrl}/delegateToken`, {
+    this.setResponse(await this.fetchWithAuth(`${serviceUrl}/delegateToken`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -9734,8 +9430,10 @@ var ReportingAuthClient = class {
         "scope": scope,
         "accounting": accounting2
       }))
-    });
-    return await this.response.json();
+    }));
+    const credentials = await this.response.json();
+    this.parsedResponse = { value: credentials };
+    return credentials;
   }
   /**
    * Impersonates the given user. The accounting is required in practice: rights are
@@ -9778,7 +9476,7 @@ var ReportingAuthClient = class {
     }
   }
   async authorize(authorizationCode) {
-    this.response = await this.fetchWithAuth(`${this.options.serviceUrl}/token`, {
+    this.setResponse(await this.fetchWithAuth(`${this.options.serviceUrl}/token`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -9789,10 +9487,9 @@ var ReportingAuthClient = class {
         "grant_type": "code",
         "code": authorizationCode
       }))
-    });
+    }));
     if (!this.response.ok) {
-      const err = await this.response.json();
-      throw new ReportingAuthClientException(err);
+      throw new ReportingAuthClientException(await this.readErrorBody());
     }
     return this.response;
   }
@@ -9816,17 +9513,16 @@ var ReportingAuthClient = class {
     window.location.href = url2;
   }
   async getTokenInfo() {
-    this.response = await this.fetchWithAuth(`${this.options.serviceUrl}/info`, {
+    this.setResponse(await this.fetchWithAuth(`${this.options.serviceUrl}/info`, {
       method: "GET",
       headers: {
         "Content-Type": "application/json"
       }
-    });
+    }));
     this._expiresAt = null;
     if (!this.response.ok) {
       if (this.response.headers.get("content-type")?.includes("application/json")) {
-        const err = await this.response.json();
-        throw new ReportingAuthClientException(err);
+        throw new ReportingAuthClientException(await this.readErrorBody());
       } else {
         throw new ReportingAuthClientException({
           message: "Gateway communication error"
@@ -9834,6 +9530,7 @@ var ReportingAuthClient = class {
       }
     }
     const tokenInfo = await this.response.json();
+    this.parsedResponse = { value: null };
     if (tokenInfo.expires_in != null) {
       this._expiresAt = Math.floor(Date.now() / 1e3) + tokenInfo.expires_in;
     }
@@ -9848,10 +9545,8 @@ var ReportingAuthClient = class {
     });
   }
   redirectToLogin() {
-    if (typeof window === "undefined")
-      throw new Error("Not in browser environment");
-    if (!this.options.loginUrl)
-      throw new Error("Login URL not set");
+    if (typeof window === "undefined") throw new Error("Not in browser environment");
+    if (!this.options.loginUrl) throw new Error("Login URL not set");
     let url2 = this.options.loginUrl;
     const queryParams = [];
     if (this.options.clientId) {
@@ -9866,9 +9561,11 @@ var ReportingAuthClient = class {
     window.location.href = url2;
   }
   async readCredentials() {
-    if (!this.response)
-      return null;
-    return await this.response.json();
+    if (!this.response) return null;
+    if (!this.parsedResponse) {
+      this.parsedResponse = { value: await this.response.json() };
+    }
+    return this.parsedResponse.value;
   }
   async refreshToken() {
     const body = { grant_type: "refresh_token" };
@@ -9878,26 +9575,24 @@ var ReportingAuthClient = class {
         body.refresh_token = token.refresh_token;
       }
     }
-    if (this.options.clientId)
-      body.client_id = this.options.clientId;
-    if (this.options.clientSecret)
-      body.client_secret = this.options.clientSecret;
-    this.response = await fetch(`${this.options.serviceUrl}/token`, {
+    if (this.options.clientId) body.client_id = this.options.clientId;
+    if (this.options.clientSecret) body.client_secret = this.options.clientSecret;
+    this.setResponse(await fetch(`${this.options.serviceUrl}/token`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
       },
       credentials: body.refresh_token ? "omit" : "include",
       body: JSON.stringify(body)
-    });
+    }));
     if (this.response.ok) {
       const result = await this.response.json();
+      this.parsedResponse = { value: result };
       if (result?.expires_in) {
         this._expiresAt = Math.floor(Date.now() / 1e3) + result.expires_in;
       }
     } else {
-      const err = await this.response.json();
-      throw new ReportingAuthClientException(err);
+      throw new ReportingAuthClientException(await this.readErrorBody());
     }
     return this.response;
   }
@@ -9908,8 +9603,260 @@ var ReportingAuthClient = class {
   }
 };
 
-// src/config.ts
-var import_rp_client = __toESM(require_dist());
+// ../rp-client/src/cache.ts
+var ServiceCache = class {
+  constructor() {
+    this.cache = /* @__PURE__ */ new Map();
+  }
+  createKey(params3) {
+    let key = params3.path;
+    if (params3.params) {
+      const paramStrings = [];
+      for (const k of Object.keys(params3.params).sort()) {
+        paramStrings.push(`${k}=${params3.params[k]}`);
+      }
+      if (paramStrings.length > 0) {
+        key += `?${paramStrings.join("&")}`;
+      }
+    }
+    return key;
+  }
+  set(params3, data) {
+    const key = this.createKey(params3);
+    this.cache.set(key, data);
+  }
+  get(params3) {
+    const key = this.createKey(params3);
+    return this.cache.get(key);
+  }
+  has(params3) {
+    const key = this.createKey(params3);
+    return this.cache.has(key);
+  }
+  clear() {
+    this.cache.clear();
+  }
+};
+
+// ../rp-client/src/accountingProvider.ts
+var AccountingProvider = class {
+  constructor() {
+    this._a = null;
+    this._accounting = null;
+  }
+  get a() {
+    return this._a;
+  }
+  set a(a) {
+    this._a = a;
+    if (this.accounting?.accounting != a) {
+      this._accounting = null;
+    }
+  }
+  get accounting() {
+    return this._accounting;
+  }
+  set accounting(accounting2) {
+    if (accounting2) {
+      this._a = accounting2.accounting ?? null;
+    }
+    this._accounting = accounting2;
+  }
+};
+
+// ../rp-client/src/service.ts
+var import_qs = __toESM(require_lib());
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function serializeRequestParams(params3) {
+  const p = {};
+  for (const k in params3) {
+    switch (k) {
+      case "customParams":
+        p["p"] = JSON.stringify(params3.customParams);
+        break;
+      default:
+        p[k] = isObject(params3[k]) || Array.isArray(params3[k]) ? JSON.stringify(params3[k]) : params3[k];
+        break;
+    }
+  }
+  return import_qs.default.stringify(p, { addQueryPrefix: false });
+}
+var ServiceException = class extends Error {
+  constructor(args) {
+    super(args?.data?.message || "Unknown error");
+    Object.assign(this, args);
+  }
+};
+var ServiceEvent = class extends Event {
+  constructor(name, args) {
+    super(name);
+    Object.assign(this, args);
+  }
+};
+var Service = class extends EventTarget {
+  constructor(options) {
+    super();
+    this.accountingProvider = null;
+    this.tokenProvider = null;
+    this._cache = null;
+    this.options = { ...options };
+    if (!/^(https?|\/)/.test(this.options.baseUrl)) {
+      this.options.baseUrl = `https://${this.options.baseUrl}`;
+    }
+  }
+  get a() {
+    return this.accountingProvider?.a;
+  }
+  get name() {
+    return this.options.name;
+  }
+  get cache() {
+    if (!this._cache) this._cache = new ServiceCache();
+    return this._cache;
+  }
+  createUrl(path9 = "", params3) {
+    if (this.options.xdebugSession) {
+      params3 = params3 || {};
+      params3.XDEBUG_SESSION = this.options.xdebugSession === true ? "1" : this.options.xdebugSession.toString();
+    }
+    if (this.options.params && Object.keys(this.options.params).length > 0) {
+      params3 = { ...this.options.params, ...params3 };
+    }
+    let queryString = params3 ? serializeRequestParams(params3) : "";
+    if (queryString) queryString = `?${queryString}`;
+    const a = params3 && params3.accounting ? params3.accounting.toString() : this.a ? this.a.toString() : null;
+    path9 = path9.replace(/^\//, "");
+    const parts = [this.options.baseUrl, a, this.options.name, path9];
+    return parts.filter((p) => p != null && p !== "").join("/") + queryString;
+  }
+  async createHeaders(headers) {
+    const defaultHeaders = {};
+    if (this.tokenProvider) {
+      const token = await this.tokenProvider();
+      if (token) {
+        defaultHeaders["Authorization"] = `Bearer ${token}`;
+      }
+    }
+    return { ...defaultHeaders, ...headers };
+  }
+  get credentials() {
+    return this.tokenProvider ? void 0 : "include";
+  }
+  async handleError(response) {
+    const contentType = response.headers.get("Content-Type");
+    let error48;
+    if (contentType?.includes("application/json")) {
+      error48 = await response.json();
+      error48.status = response.status;
+    } else {
+      error48 = { status: response.status, message: "Unknown error", error: "unknown" };
+    }
+    if (this.options.throwExceptions) {
+      throw new ServiceException({ data: error48, url: response.url });
+    }
+  }
+  async handleResponse(response, parse3) {
+    if (!response.ok) {
+      await this.handleError(response);
+      return null;
+    }
+    const contentType = response.headers.get("Content-Type");
+    if (contentType?.includes("application/json") && parse3 !== false) {
+      return await response.json();
+    } else {
+      return await response.text();
+    }
+  }
+  async getRaw(path9, params3, options) {
+    const url2 = this.createUrl(path9, params3);
+    this.dispatchEvent(new ServiceEvent("beforeRequest", { url: url2, params: params3, options, method: "GET" }));
+    return fetch(url2, {
+      headers: await this.createHeaders(options?.headers),
+      credentials: this.credentials
+    });
+  }
+  async get(path9, params3, options) {
+    if (options?.cache) {
+      const cachedData = this.cache.get({ path: path9, params: params3 });
+      if (cachedData) return cachedData;
+    }
+    const response = await this.getRaw(path9, params3, options);
+    const responseData = await this.handleResponse(response, options?.parseResponse);
+    if (options?.cache && responseData) {
+      this.cache.set({ path: path9, params: params3 }, responseData);
+    }
+    return responseData;
+  }
+  async postRaw(path9, data, params3, options) {
+    const url2 = this.createUrl(path9, params3);
+    this.dispatchEvent(new ServiceEvent("beforeRequest", { url: url2, params: params3, options, method: "POST" }));
+    const json3 = isObject(data) || Array.isArray(data);
+    return fetch(url2, {
+      method: "POST",
+      body: json3 ? JSON.stringify(data) : data,
+      headers: await this.createHeaders({
+        ...options?.headers ?? {},
+        "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
+      }),
+      credentials: this.credentials
+    });
+  }
+  async post(path9, data, params3, options) {
+    const response = await this.postRaw(path9, data, params3, options);
+    return this.handleResponse(response);
+  }
+  async deleteRaw(path9, params3, options) {
+    const url2 = this.createUrl(path9, params3);
+    this.dispatchEvent(new ServiceEvent("beforeRequest", { url: url2, params: params3, options, method: "DELETE" }));
+    return fetch(url2, {
+      method: "DELETE",
+      headers: await this.createHeaders(options?.headers),
+      credentials: this.credentials
+    });
+  }
+  async delete(path9, params3, options) {
+    const response = await this.deleteRaw(path9, params3, options);
+    return this.handleResponse(response);
+  }
+  async putRaw(path9, data, params3, options) {
+    const url2 = this.createUrl(path9, params3);
+    this.dispatchEvent(new ServiceEvent("beforeRequest", { url: url2, params: params3, options, method: "PUT" }));
+    const json3 = isObject(data) || Array.isArray(data);
+    return fetch(url2, {
+      method: "PUT",
+      body: json3 ? JSON.stringify(data) : data,
+      headers: await this.createHeaders({
+        ...options?.headers ?? {},
+        "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
+      }),
+      credentials: this.credentials
+    });
+  }
+  async put(path9, data, params3, options) {
+    const response = await this.putRaw(path9, data, params3, options);
+    return this.handleResponse(response);
+  }
+  async patchRaw(path9, data, params3, options) {
+    const url2 = this.createUrl(path9, params3);
+    this.dispatchEvent(new ServiceEvent("beforeRequest", { url: url2, params: params3, options, method: "PATCH" }));
+    const json3 = isObject(data) || Array.isArray(data);
+    return fetch(url2, {
+      method: "PATCH",
+      body: json3 ? JSON.stringify(data) : data,
+      headers: await this.createHeaders({
+        ...options?.headers ?? {},
+        "Content-Type": `${json3 ? "application/json" : "text/plain"}; charset=UTF-8`
+      }),
+      credentials: this.credentials
+    });
+  }
+  async patch(path9, data, params3, options) {
+    const response = await this.patchRaw(path9, data, params3, options);
+    return this.handleResponse(response);
+  }
+};
 
 // src/crypto.ts
 var crypto = __toESM(require("node:crypto"));
@@ -9971,6 +9918,44 @@ var CONFIG_DIR = path.join(os2.homedir(), ".config", "reporting-bi");
 var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
 var CLIENT_ID = "0D6693D4-4358-4C08-BA80-A94A97B7F47C";
 var CLIENT_SECRET = "48481427819bb41798bd74fa109c90b184ca4d64d20e60dfbe8430299f06f73e";
+var EXIT_LOGIN_REQUIRED = 2;
+var LOGIN_REQUIRED_MARKER = "rpbi: login_required";
+var SPID_MARKER = "rpbi: spid";
+var LoginRequiredError = class extends Error {
+  constructor(domain2, detail) {
+    super(`Session expired. Run "rpbi login ${domain2}" again.`);
+    this.domain = domain2;
+    this.detail = detail;
+  }
+};
+var mcpMode = false;
+function setMcpMode() {
+  mcpMode = true;
+}
+function tokenExpiration(token) {
+  if (!token) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf-8"));
+    return typeof payload.exp === "number" ? payload.exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sessionExpiration(tokens) {
+  return tokens.refresh_expires_at ?? tokenExpiration(tokens.refresh_token);
+}
+function accessExpiration(tokens) {
+  return tokens.expires_at || tokenExpiration(tokens.access_token);
+}
+function sessionState(tokens, now = Math.floor(Date.now() / 1e3)) {
+  const accessEnd = accessExpiration(tokens);
+  const accessValid = accessEnd === void 0 || accessEnd > now;
+  if (!tokens.refresh_token) return accessValid ? "unknown" : "expired";
+  const sessionEnd = sessionExpiration(tokens);
+  if (sessionEnd === void 0) return "unknown";
+  if (sessionEnd <= now) return "expired";
+  return accessValid ? "ok" : "stale";
+}
 function loadCredentials() {
   try {
     const raw = fs2.readFileSync(CREDENTIALS_FILE, "utf-8");
@@ -9999,21 +9984,29 @@ function findLocalConfig(startDir) {
     dir = parent;
   }
 }
-function getActiveConnection(cwd) {
+function getActiveConnection(cwd, connection) {
   const creds = loadCredentials();
   const local = findLocalConfig(cwd);
-  const domain2 = local?.domain ?? creds.active;
+  const domain2 = connection ?? local?.domain ?? creds.active;
   if (!domain2 || !creds.connections[domain2]) return null;
   const tokens = { ...creds.connections[domain2] };
-  if (local?.accounting) {
+  if (local?.accounting && local.domain === domain2) {
     tokens.accounting = local.accounting;
   }
   return { domain: domain2, tokens };
 }
-function storeTokens(domain2, tokens) {
+function storeTokens(domain2, tokens, activate = true) {
   const creds = loadCredentials();
-  creds.connections[domain2] = tokens;
-  creds.active = domain2;
+  const previous = creds.connections[domain2];
+  creds.connections[domain2] = {
+    ...previous,
+    ...tokens,
+    // spelled out because both are optional: a refresh token with no readable expiry must
+    // not inherit the previous one, while an unspecified accounting keeps the current pick
+    refresh_expires_at: tokens.refresh_expires_at,
+    accounting: tokens.accounting ?? previous?.accounting
+  };
+  if (activate) creds.active = domain2;
   saveCredentials(creds);
 }
 function removeTokens(domain2) {
@@ -10035,6 +10028,31 @@ function setActive(domain2, accounting2) {
   saveCredentials(creds);
   return true;
 }
+function statusReport(cwd, now = Math.floor(Date.now() / 1e3)) {
+  const creds = loadCredentials();
+  const local = findLocalConfig(cwd);
+  const activeDomain = local?.domain ?? creds.active;
+  return {
+    active: creds.active,
+    local,
+    connections: Object.keys(creds.connections).map((domain2) => {
+      const tokens = creds.connections[domain2];
+      const accessEnd = accessExpiration(tokens);
+      const sessionEnd = sessionExpiration(tokens);
+      return {
+        domain: domain2,
+        active: domain2 === activeDomain,
+        accounting: tokens.accounting ?? null,
+        state: sessionState(tokens, now),
+        token_expires_at: accessEnd ?? null,
+        token_expires_in: accessEnd === void 0 ? null : accessEnd - now,
+        session_expires_at: sessionEnd ?? null,
+        session_expires_in: sessionEnd === void 0 ? null : sessionEnd - now,
+        has_refresh_token: !!tokens.refresh_token
+      };
+    })
+  };
+}
 function createAuthClient(domain2, tokens) {
   return new ReportingAuthClient({
     serviceUrl: `${domain2}/auth`,
@@ -10043,49 +10061,107 @@ function createAuthClient(domain2, tokens) {
     tokenProvider: tokens ? () => ({ access_token: tokens.access_token, refresh_token: tokens.refresh_token }) : void 0
   });
 }
+var DEAD_TOKEN_ERRORS = ["invalid_grant", "invalid_jwt", "invalid_token"];
+function isSessionRefused(err) {
+  return err.data?.status === 401 || DEAD_TOKEN_ERRORS.includes(err.data?.error ?? "");
+}
+function refusalReason(err) {
+  if (err instanceof ReportingAuthClientException) {
+    return err.message || err.data?.error_description || err.data?.error || "refresh refused";
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+async function awaitRotatedTokens(domain2, spentRefreshToken) {
+  for (let attempt = 0; attempt < 6; attempt++) {
+    const stored = loadCredentials().connections[domain2];
+    if (stored?.refresh_token && stored.refresh_token !== spentRefreshToken) return stored;
+    await new Promise((resolve8) => setTimeout(resolve8, 100));
+  }
+  return null;
+}
+async function refreshTokens(conn, now) {
+  const client = createAuthClient(conn.domain, conn.tokens);
+  await client.refreshToken();
+  const credentials = await client.readCredentials();
+  if (!credentials?.access_token) throw new LoginRequiredError(conn.domain, "no access token in the refresh response");
+  conn.tokens.access_token = credentials.access_token;
+  if (credentials.refresh_token) {
+    conn.tokens.refresh_token = credentials.refresh_token;
+    conn.tokens.refresh_expires_at = tokenExpiration(credentials.refresh_token);
+  }
+  conn.tokens.expires_at = credentials.expires_in ? now + credentials.expires_in : 0;
+  storeTokens(conn.domain, conn.tokens, false);
+}
 async function ensureValidToken(conn) {
   const now = Math.floor(Date.now() / 1e3);
   const margin = 60;
-  if (conn.tokens.expires_at && conn.tokens.expires_at > now + margin) return;
+  const accessEnd = accessExpiration(conn.tokens);
+  if (accessEnd !== void 0 && accessEnd > now + margin) return;
+  if (sessionState(conn.tokens, now) === "expired") throw new LoginRequiredError(conn.domain);
   if (!conn.tokens.refresh_token) return;
-  const client = createAuthClient(conn.domain, conn.tokens);
-  try {
-    await client.refreshToken();
-    const credentials = await client.readCredentials();
-    if (credentials?.access_token) {
-      conn.tokens.access_token = credentials.access_token;
-      if (credentials.refresh_token) conn.tokens.refresh_token = credentials.refresh_token;
-      conn.tokens.expires_at = credentials.expires_in ? now + credentials.expires_in : 0;
-      storeTokens(conn.domain, conn.tokens);
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await refreshTokens(conn, now);
+      return;
+    } catch (err) {
+      if (err instanceof LoginRequiredError) throw err;
+      if (!(err instanceof ReportingAuthClientException) || !isSessionRefused(err)) {
+        console.error("Token refresh failed:", refusalReason(err));
+        return;
+      }
+      const stored = await awaitRotatedTokens(conn.domain, conn.tokens.refresh_token);
+      if (!stored) throw new LoginRequiredError(conn.domain, refusalReason(err));
+      conn.tokens.access_token = stored.access_token;
+      conn.tokens.refresh_token = stored.refresh_token;
+      conn.tokens.expires_at = stored.expires_at;
+      conn.tokens.refresh_expires_at = stored.refresh_expires_at;
+      const adoptedEnd = accessExpiration(conn.tokens);
+      if (adoptedEnd !== void 0 && adoptedEnd > now + margin) return;
     }
-  } catch (err) {
-    console.error("Token refresh failed:", err instanceof Error ? err.message : err);
-    console.error(`Session expired. Run "rpbi login ${conn.domain}" again.`);
   }
+  throw new LoginRequiredError(conn.domain, "the refresh token was refused repeatedly");
+}
+function abort(message) {
+  if (mcpMode) throw new Error(message);
+  console.error(message);
+  process.exit(1);
+}
+function globalFlagValue(flag) {
+  const index = process.argv.indexOf(`--${flag}`);
+  if (index === -1) return void 0;
+  const value = process.argv[index + 1];
+  return value && !value.startsWith("-") ? value : void 0;
 }
 async function createService(name, options) {
   const cwd = typeof options === "object" ? options.cwd : void 0;
-  const conn = getActiveConnection(cwd);
+  const connection = (typeof options === "object" ? options.connection : void 0) ?? globalFlagValue("connection");
+  const conn = getActiveConnection(cwd, connection);
   if (!conn) {
-    console.error('Not logged in. Run "rpbi login" first.');
-    process.exit(1);
+    abort(connection ? `Not logged in to "${connection}". Run "rpbi login ${connection}" first.` : 'Not logged in. Run "rpbi login" first.');
   }
   const accountingOverride = typeof options === "number" ? options : void 0;
   const accountingOptional = typeof options === "object" && options.accountingOptional;
   const accounting2 = accountingOverride ?? conn.tokens.accounting;
-  if (!accounting2 && !accountingOptional) {
-    console.error('No accounting set. Run "rpbi use <domain> --accounting <id>" first.');
-    process.exit(1);
-  }
-  await ensureValidToken(conn);
-  const service = new import_rp_client.Service({
+  if (!accounting2 && !accountingOptional) abort('No accounting set. Run "rpbi use <domain> --accounting <id>" first.');
+  try {
+    await ensureValidToken(conn);
+  } catch (err) {
+    if (mcpMode || !(err instanceof LoginRequiredError)) throw err;
+    const detail = err.detail ? `Token refresh failed: ${err.detail}
+` : "";
+    fs2.writeSync(2, `${detail}${LOGIN_REQUIRED_MARKER} ${conn.domain}
+${err.message}
+`);
+    process.exit(EXIT_LOGIN_REQUIRED);
+  }
+  const service = new Service({
     name,
     baseUrl: `${conn.domain}/ms`,
     throwExceptions: true
   });
   service.tokenProvider = () => conn.tokens.access_token;
   if (accounting2) {
-    const ap = new import_rp_client.AccountingProvider();
+    const ap = new AccountingProvider();
     ap.a = accounting2;
     service.accountingProvider = ap;
   }
@@ -10309,6 +10385,8 @@ async function login(args) {
     access_token: credentials.access_token,
     refresh_token: credentials.refresh_token || "",
     expires_at: expiresAt,
+    // only the JWT carries the session length, the token response does not
+    refresh_expires_at: tokenExpiration(credentials.refresh_token),
     accounting: accounting2
   });
   console.log(`Logged in to ${domain2} successfully.`);
@@ -10324,12 +10402,12 @@ async function login(args) {
   }
 }
 function getAuthorizationCode(domain2) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let timeout;
     const done = (result) => {
       clearTimeout(timeout);
       server.close();
-      resolve7(result);
+      resolve8(result);
     };
     const server = http.createServer((req, res) => {
       const url2 = new URL(req.url || "", "http://localhost");
@@ -10400,41 +10478,47 @@ function printLogo() {
 }
 
 // src/commands/status.ts
-function status() {
+function formatDuration(seconds) {
+  const days = Math.floor(seconds / 86400);
+  const hours = Math.floor(seconds % 86400 / 3600);
+  const minutes = Math.floor(seconds % 3600 / 60);
+  if (days > 0) return `${days}d ${hours}h`;
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  return `${minutes}m`;
+}
+function tokenExpiry(expiresIn) {
+  if (expiresIn === null) return "unknown";
+  return expiresIn <= 0 ? "expired" : formatDuration(expiresIn);
+}
+function sessionExpiry(connection) {
+  if (connection.state === "expired") return `expired \u2014 run "rpbi login ${connection.domain}"`;
+  if (connection.session_expires_in === null) return "unknown";
+  return `${formatDuration(connection.session_expires_in)} left`;
+}
+function status(args = []) {
+  const { flags } = parseArgs(args);
+  const report2 = statusReport();
+  if (flags.json) {
+    console.log(JSON.stringify(report2, null, 2));
+    return;
+  }
   printLogo();
-  const creds = loadCredentials();
-  const local = findLocalConfig();
-  const domains = Object.keys(creds.connections);
-  if (local) {
+  if (report2.local) {
     console.log(`Local config (.rpbi/config.json):`);
-    console.log(`  domain:     ${local.domain}`);
-    console.log(`  accounting: ${local.accounting ?? "not set"}`);
+    console.log(`  domain:     ${report2.local.domain}`);
+    console.log(`  accounting: ${report2.local.accounting ?? "not set"}`);
     console.log();
   }
-  if (domains.length === 0) {
+  if (report2.connections.length === 0) {
     console.log("Not logged in.");
     return;
   }
-  for (const domain2 of domains) {
-    const tokens = creds.connections[domain2];
-    const isActive = local ? local.domain === domain2 : creds.active === domain2;
-    const now = Math.floor(Date.now() / 1e3);
-    const expiresIn = tokens.expires_at - now;
-    let expiry;
-    if (tokens.expires_at === 0) {
-      expiry = "unknown";
-    } else if (expiresIn <= 0) {
-      expiry = "expired";
-    } else {
-      const minutes = Math.floor(expiresIn / 60);
-      const hours = Math.floor(minutes / 60);
-      expiry = hours > 0 ? `${hours}h ${minutes % 60}m` : `${minutes}m`;
-    }
-    const marker = isActive ? " (active)" : "";
-    console.log(`${domain2}${marker}`);
-    console.log(`  accounting:    ${tokens.accounting ?? "not set"}`);
-    console.log(`  token expires: ${expiry}`);
-    console.log(`  refresh token: ${tokens.refresh_token ? "yes" : "no"}`);
+  for (const connection of report2.connections) {
+    console.log(`${connection.domain}${connection.active ? " (active)" : ""}`);
+    console.log(`  accounting:    ${connection.accounting ?? "not set"}`);
+    console.log(`  token expires: ${tokenExpiry(connection.token_expires_in)}`);
+    console.log(`  session:       ${sessionExpiry(connection)}`);
+    console.log(`  refresh token: ${connection.has_refresh_token ? "yes" : "no"}`);
   }
 }
 
@@ -10599,6 +10683,43 @@ function walkDir(dir, root, knownPaths, result) {
     }
   }
 }
+function removeEmptyDirs(dir, root) {
+  dir = path3.resolve(dir);
+  root = path3.resolve(root);
+  while (dir.startsWith(root) && dir !== root) {
+    try {
+      if (fs4.readdirSync(dir).length > 0) return;
+      fs4.rmdirSync(dir);
+    } catch {
+      return;
+    }
+    dir = path3.dirname(dir);
+  }
+}
+function removeVanishedFiles(root, previousIndex, serverPaths, computeCurrentHash) {
+  for (const entry of previousIndex) {
+    if (serverPaths.has(entry.path) || isInternalPath(entry.path)) continue;
+    const absPath = path3.join(root, entry.path);
+    if (!fs4.existsSync(absPath)) continue;
+    try {
+      if (computeCurrentHash(absPath, entry) !== entry.hash) {
+        console.log(`  Kept ${entry.path} (deleted on server, but modified locally)`);
+        continue;
+      }
+      fs4.rmSync(absPath);
+      removeEmptyDirs(path3.dirname(absPath), root);
+      console.log(`  Removed ${entry.path} (deleted on server)`);
+    } catch (err) {
+      console.error(`  Failed to remove ${entry.path}: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+}
+function entriesToDelete(root, index, relPath) {
+  const prefix = `${relPath}/`;
+  return index.filter(
+    (e) => (e.path === relPath || e.path.startsWith(prefix)) && !fs4.existsSync(path3.join(root, e.path))
+  );
+}
 function detectModifiedFiles(root, index, getPath, computeCurrentHash, getStoredHash) {
   const modified = [];
   for (const entry of index) {
@@ -10694,7 +10815,7 @@ function printRemoteStatus(label, root, config2, flags, result) {
   for (const key of Object.keys(result)) {
     result[key] = result[key].filter((f) => !isInternalPath(f));
   }
-  const { modifiedLocally, modifiedOnServer, conflict, new: newFiles, localOnly, serverOnly } = result;
+  const { modifiedLocally, modifiedOnServer, conflict, new: newFiles, deletedLocally, localOnly, serverOnly } = result;
   if (flags.json === "true") {
     console.log(JSON.stringify(result));
     return;
@@ -10702,7 +10823,7 @@ function printRemoteStatus(label, root, config2, flags, result) {
   console.log(`${label} workspace: ${root}`);
   console.log(`Domain: ${config2?.domain} | Accounting: ${config2?.accounting}`);
   console.log("");
-  const total = modifiedLocally.length + modifiedOnServer.length + conflict.length + newFiles.length + localOnly.length + serverOnly.length;
+  const total = modifiedLocally.length + modifiedOnServer.length + conflict.length + newFiles.length + deletedLocally.length + localOnly.length + serverOnly.length;
   if (total === 0) {
     console.log("In sync with server.");
     return;
@@ -10723,8 +10844,12 @@ function printRemoteStatus(label, root, config2, flags, result) {
     console.log("New (untracked):");
     for (const f of newFiles) console.log(`  + ${f}`);
   }
+  if (deletedLocally.length > 0) {
+    console.log("Deleted locally (push deletes them on the server):");
+    for (const f of deletedLocally) console.log(`  D ${f}`);
+  }
   if (localOnly.length > 0) {
-    console.log("Local only (deleted on server):");
+    console.log("Deleted on server (pull removes them locally):");
     for (const f of localOnly) console.log(`  - ${f}`);
   }
   if (serverOnly.length > 0) {
@@ -10770,7 +10895,9 @@ async function pull(flags) {
   const wikiService = await createService("wiki", { cwd: dir });
   const langs = flags.langs ? flags.langs.split(",") : SYNC_LANGS;
   console.log(`Pulling wiki to ${dir}...`);
+  const previousIndex = readIndex(dir);
   const index = [];
+  const serverPaths = /* @__PURE__ */ new Set();
   for (const lang of langs) {
     console.log(`Pulling pages for language: ${lang}`);
     const pages = await wikiService.get("pages", {
@@ -10783,6 +10910,7 @@ async function pull(flags) {
       if (!page.id_wiki_page || !page.name) continue;
       const relPath = pageToRelPath({ ...page, lang });
       const absPath = path4.join(dir, relPath);
+      serverPaths.add(relPath);
       try {
         const content4 = await wikiService.get(
           `pages/${page.id_wiki_page}/content`,
@@ -10817,6 +10945,7 @@ async function pull(flags) {
     const lang = file2.lang || "cs";
     const relPath = fileToRelPath({ ...file2, lang });
     const absPath = path4.join(dir, relPath);
+    serverPaths.add(relPath);
     try {
       const response = await wikiService.getRaw(`download/${file2.id_wiki_file}`);
       if (!response.ok) throw new Error(`HTTP ${response.status}`);
@@ -10836,6 +10965,18 @@ async function pull(flags) {
     }
   }
   console.log(`  Pulled ${pulledFiles} files`);
+  for (const entry of previousIndex) {
+    if (entry.type === "page" && !langs.includes(entry.lang)) {
+      index.push(entry);
+      serverPaths.add(entry.path);
+    }
+  }
+  removeVanishedFiles(
+    dir,
+    previousIndex,
+    serverPaths,
+    (absPath, entry) => entry.type === "page" ? computePageHash(absPath) : computeFileHash(absPath)
+  );
   writeConfig(dir, {
     domain: conn.domain,
     accounting: conn.tokens.accounting,
@@ -10874,8 +11015,12 @@ async function push(flags, files) {
   for (const relPath of filesToPush) {
     const absPath = path4.join(root, relPath);
     if (!fs5.existsSync(absPath)) {
-      const entry2 = indexMap.get(relPath);
-      if (entry2) {
+      const entries = entriesToDelete(root, index, relPath);
+      if (entries.length === 0) {
+        console.log(`  Skipping ${relPath} (file not found, not in index)`);
+        continue;
+      }
+      for (const entry2 of entries) {
         try {
           if (entry2.type === "page") {
             await wikiService.delete(`pages/${entry2.id}`, { lang: entry2.lang });
@@ -10884,13 +11029,11 @@ async function push(flags, files) {
           }
           const idx = index.indexOf(entry2);
           if (idx !== -1) index.splice(idx, 1);
-          indexMap.delete(relPath);
-          console.log(`  Deleted: ${relPath}`);
+          indexMap.delete(entry2.path);
+          console.log(`  Deleted: ${entry2.path}`);
         } catch (err) {
-          console.error(`  Failed to delete ${relPath}: ${err instanceof Error ? err.message : err}`);
+          console.error(`  Failed to delete ${entry2.path}: ${err instanceof Error ? err.message : err}`);
         }
-      } else {
-        console.log(`  Skipping ${relPath} (file not found, not in index)`);
       }
       continue;
     }
@@ -11023,6 +11166,7 @@ async function statusRemote(root, config2, index, flags) {
   const modifiedLocally = [];
   const modifiedOnServer = [];
   const conflict = [];
+  const deletedLocally = [];
   const localOnly = [];
   const serverOnly = [];
   for (const lang of langs) {
@@ -11040,7 +11184,11 @@ async function statusRemote(root, config2, index, flags) {
         serverOnly.push(relPath);
       } else {
         const absPath = path4.join(root, relPath);
-        const localChanged = fs5.existsSync(absPath) && computePageHash(absPath) !== localEntry.hash;
+        if (!fs5.existsSync(absPath)) {
+          deletedLocally.push(relPath);
+          continue;
+        }
+        const localChanged = computePageHash(absPath) !== localEntry.hash;
         const serverChanged = page.date_created != null && localEntry.serverDate != null && page.date_created !== localEntry.serverDate;
         if (localChanged && serverChanged) {
           conflict.push(relPath);
@@ -11052,7 +11200,7 @@ async function statusRemote(root, config2, index, flags) {
       }
     }
     for (const [relPath, entry] of localPages) {
-      if (entry.lang === lang && !serverPagePaths.has(relPath)) {
+      if (entry.lang === lang && !serverPagePaths.has(relPath) && fs5.existsSync(path4.join(root, relPath))) {
         localOnly.push(relPath);
       }
     }
@@ -11071,7 +11219,11 @@ async function statusRemote(root, config2, index, flags) {
       serverOnly.push(relPath);
     } else {
       const absPath = path4.join(root, relPath);
-      const localChanged = fs5.existsSync(absPath) && computeFileHash(absPath) !== localEntry.hash;
+      if (!fs5.existsSync(absPath)) {
+        deletedLocally.push(relPath);
+        continue;
+      }
+      const localChanged = computeFileHash(absPath) !== localEntry.hash;
       const serverChanged = file2.date_created != null && localEntry.serverDate != null && file2.date_created !== localEntry.serverDate;
       if (localChanged && serverChanged) {
         conflict.push(relPath);
@@ -11083,12 +11235,12 @@ async function statusRemote(root, config2, index, flags) {
     }
   }
   for (const [relPath] of localFiles) {
-    if (!serverFilePaths.has(relPath)) {
+    if (!serverFilePaths.has(relPath) && fs5.existsSync(path4.join(root, relPath))) {
       localOnly.push(relPath);
     }
   }
   const newFiles = detectNewFiles2(root, index);
-  printRemoteStatus("Wiki", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, localOnly, serverOnly });
+  printRemoteStatus("Wiki", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, deletedLocally, localOnly, serverOnly });
 }
 function watch3(flags) {
   return watch2("wiki", flags, push);
@@ -11126,11 +11278,11 @@ async function readContent(flags) {
     return flags.content;
   }
   if (!process.stdin.isTTY) {
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       let data = "";
       process.stdin.setEncoding("utf-8");
       process.stdin.on("data", (chunk) => data += chunk);
-      process.stdin.on("end", () => resolve7(data));
+      process.stdin.on("end", () => resolve8(data));
     });
   }
   console.error("No content provided. Use --file, --content, or pipe to stdin.");
@@ -11337,12 +11489,15 @@ async function pull2(flags) {
   if (allThreads.length > threads.length) {
     console.log(`  Skipped ${allThreads.length - threads.length} shared thread(s) from another accounting`);
   }
+  const previousIndex = readIndex(dir);
   const index = [];
+  const serverPaths = /* @__PURE__ */ new Set();
   let pulled = 0;
   for (const thread of threads) {
     if (!thread.id_thread || !thread.type || !thread.description) continue;
     const relPath = threadToRelPath(thread);
     const absPath = path5.join(dir, relPath);
+    serverPaths.add(relPath);
     try {
       const content4 = await etlService.get(
         `threads/${thread.id_thread}/content`,
@@ -11396,6 +11551,12 @@ async function pull2(flags) {
   if (!flags["no-context"]) {
     await pullContext(dir, etlService, defService);
   }
+  removeVanishedFiles(
+    dir,
+    previousIndex,
+    serverPaths,
+    (absPath) => computeHash(fs7.readFileSync(absPath, "utf-8"))
+  );
   writeConfig(dir, {
     domain: conn.domain,
     accounting: conn.tokens.accounting,
@@ -11449,19 +11610,21 @@ async function push2(flags, files) {
   for (const relPath of filesToPush) {
     const absPath = path5.join(root, relPath);
     if (!fs7.existsSync(absPath)) {
-      const entry2 = indexMap.get(relPath);
-      if (entry2) {
+      const entries = entriesToDelete(root, index, relPath);
+      if (entries.length === 0) {
+        console.log(`  Skipping ${relPath} (file not found, not in index)`);
+        continue;
+      }
+      for (const entry2 of entries) {
         try {
           await etlService.delete(`threads/${entry2.id_thread}`);
           const idx = index.indexOf(entry2);
           if (idx !== -1) index.splice(idx, 1);
-          indexMap.delete(relPath);
-          console.log(`  Deleted: ${relPath}`);
+          indexMap.delete(entry2.path);
+          console.log(`  Deleted: ${entry2.path}`);
         } catch (err) {
-          console.error(`  Failed to delete ${relPath}: ${err instanceof Error ? err.message : err}`);
+          console.error(`  Failed to delete ${entry2.path}: ${err instanceof Error ? err.message : err}`);
         }
-      } else {
-        console.log(`  Skipping ${relPath} (file not found, not in index)`);
       }
       continue;
     }
@@ -11599,6 +11762,7 @@ async function statusRemote2(root, config2, index, flags) {
   const modifiedLocally = [];
   const modifiedOnServer = [];
   const conflict = [];
+  const deletedLocally = [];
   const localOnly = [];
   const serverOnly = [];
   const serverPaths = /* @__PURE__ */ new Set();
@@ -11611,7 +11775,11 @@ async function statusRemote2(root, config2, index, flags) {
       serverOnly.push(relPath);
     } else {
       const absPath = path5.join(root, relPath);
-      const localChanged = fs7.existsSync(absPath) && computeHash(fs7.readFileSync(absPath, "utf-8")) !== localEntry.hash;
+      if (!fs7.existsSync(absPath)) {
+        deletedLocally.push(relPath);
+        continue;
+      }
+      const localChanged = computeHash(fs7.readFileSync(absPath, "utf-8")) !== localEntry.hash;
       const serverChanged = thread.date_created != null && localEntry.serverDate != null && thread.date_created !== localEntry.serverDate;
       if (localChanged && serverChanged) {
         conflict.push(relPath);
@@ -11623,12 +11791,12 @@ async function statusRemote2(root, config2, index, flags) {
     }
   }
   for (const entry of index) {
-    if (!serverPaths.has(entry.path)) {
+    if (!serverPaths.has(entry.path) && fs7.existsSync(path5.join(root, entry.path))) {
       localOnly.push(entry.path);
     }
   }
   const newFiles = detectNewFiles3(root, index);
-  printRemoteStatus("ETL", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, localOnly, serverOnly });
+  printRemoteStatus("ETL", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, deletedLocally, localOnly, serverOnly });
 }
 function watch4(flags) {
   return watch2("etl", flags, push2);
@@ -11664,8 +11832,14 @@ async function exec2(id, flags) {
       csv_delimiter: "	",
       csv_header: "1",
       csv_header_json: "1",
-      csv_null_value: "NULL"
+      csv_null_value: "NULL",
+      // makes the server flush the response headers before the query finishes, so X-Spid
+      // is readable while it still runs (IIS holds headers back until the first body flush)
+      flush_headers: "1"
     }, { headers: { accept: "text/csv" } });
+    const spid = response.headers.get("x-spid");
+    if (spid) fs8.writeSync(2, `${SPID_MARKER} ${spid}
+`);
     if (!response.ok) {
       const text3 = await response.text();
       console.error(text3);
@@ -11678,6 +11852,11 @@ async function exec2(id, flags) {
     process.stdout.write(result || "");
   }
 }
+async function abort2(spid, flags) {
+  const service = await createService("etl", { cwd: flags.dir || "." });
+  const result = await service.get(`abort/${spid}`);
+  output(result, flags);
+}
 async function search2(query, flags) {
   const service = await createService("etl");
   const results = await service.get("search", { ...getListParams(flags, DEFAULT_FIELDS), q: query });
@@ -11731,6 +11910,12 @@ async function etl(args) {
         process.exit(1);
       }
       return exec2(rest[0], flags);
+    case "abort":
+      if (!rest[0]) {
+        console.error("Usage: rpbi etl abort <spid>");
+        process.exit(1);
+      }
+      return abort2(rest[0], flags);
     case "search":
       if (!rest[0]) {
         console.error("Usage: rpbi etl search <query>");
@@ -11754,7 +11939,7 @@ async function etl(args) {
     case "watch":
       return watch4(flags);
     default:
-      console.log("Usage: rpbi etl <list|get|content|exec|search|params|pull|push|context|status|watch> [options]");
+      console.log("Usage: rpbi etl <list|get|content|exec|abort|search|params|pull|push|context|status|watch> [options]");
       break;
   }
 }
@@ -11822,12 +12007,15 @@ async function pull3(flags) {
     order: [["type", "asc"], ["description", "asc"]]
   }) || [];
   console.log(`Found ${threads.length} threads`);
+  const previousIndex = readIndex(dir);
   const index = [];
+  const serverPaths = /* @__PURE__ */ new Set();
   let pulled = 0;
   for (const thread of threads) {
     if (!thread.id_thread || !thread.type || !thread.description) continue;
     const relPath = threadToRelPath2(thread);
     const absPath = path6.join(dir, relPath);
+    serverPaths.add(relPath);
     try {
       const content4 = await service.get(
         `threads/${thread.id_thread}/content`,
@@ -11851,6 +12039,7 @@ async function pull3(flags) {
     }
     if (thread.has_doc) {
       const docPath = threadToDocPath(thread);
+      serverPaths.add(docPath);
       try {
         const doc2 = await service.get(
           `threads/${thread.id_thread}/doc`,
@@ -11874,6 +12063,12 @@ async function pull3(flags) {
       }
     }
   }
+  removeVanishedFiles(
+    dir,
+    previousIndex,
+    serverPaths,
+    (absPath) => computeHash(fs9.readFileSync(absPath, "utf-8"))
+  );
   writeConfig(dir, {
     domain: conn.domain,
     accounting: conn.tokens.accounting,
@@ -11913,25 +12108,28 @@ async function push3(flags, files) {
     const absPath = path6.join(root, relPath);
     const entry = indexMap.get(relPath);
     if (!fs9.existsSync(absPath)) {
-      if (!entry) {
+      const entries = entriesToDelete(root, index, relPath);
+      if (entries.length === 0) {
         console.log(`  Skipping ${relPath} (file not found, not in index)`);
         continue;
       }
-      try {
-        if (entry.kind === "doc") {
-          await service.patch(`threads/${entry.id_thread}/doc`, "", { accounting: entryAccounting(entry) });
-          console.log(`  Cleared doc: ${relPath}`);
-        } else {
-          const current = await service.get(`threads/${entry.id_thread}`, { fields: ["idz"] });
-          if (!current?.idz) throw new Error("Thread not found on server");
-          await service.delete(`threads/${current.idz}`, { accounting: entryAccounting(entry) });
-          console.log(`  Deleted: ${relPath}`);
-        }
-        const idx = index.indexOf(entry);
-        if (idx !== -1) index.splice(idx, 1);
-        indexMap.delete(relPath);
-      } catch (err) {
-        console.error(`  Failed to delete ${relPath}: ${err instanceof Error ? err.message : err}`);
+      for (const gone of entries) {
+        try {
+          if (gone.kind === "doc") {
+            await service.patch(`threads/${gone.id_thread}/doc`, "", { accounting: entryAccounting(gone) });
+            console.log(`  Cleared doc: ${gone.path}`);
+          } else {
+            const current = await service.get(`threads/${gone.id_thread}`, { fields: ["idz"] });
+            if (!current?.idz) throw new Error("Thread not found on server");
+            await service.delete(`threads/${current.idz}`, { accounting: entryAccounting(gone) });
+            console.log(`  Deleted: ${gone.path}`);
+          }
+          const idx = index.indexOf(gone);
+          if (idx !== -1) index.splice(idx, 1);
+          indexMap.delete(gone.path);
+        } catch (err) {
+          console.error(`  Failed to delete ${gone.path}: ${err instanceof Error ? err.message : err}`);
+        }
       }
       continue;
     }
@@ -12048,16 +12246,21 @@ async function statusRemote3(root, config2, index, flags) {
   const modifiedLocally = [];
   const modifiedOnServer = [];
   const conflict = [];
+  const deletedLocally = [];
   const localOnly = [];
   const serverOnly = [];
-  const compareEntry = (relPath, serverDate, isServerOnly) => {
+  const compareEntry = (relPath, serverDate, onServer) => {
     const localEntry = indexMap.get(relPath);
     if (!localEntry) {
-      if (isServerOnly) serverOnly.push(relPath);
+      if (onServer) serverOnly.push(relPath);
       return;
     }
     const absPath = path6.join(root, relPath);
-    const localChanged = fs9.existsSync(absPath) && computeHash(fs9.readFileSync(absPath, "utf-8")) !== localEntry.hash;
+    if (!fs9.existsSync(absPath)) {
+      if (onServer) deletedLocally.push(relPath);
+      return;
+    }
+    const localChanged = computeHash(fs9.readFileSync(absPath, "utf-8")) !== localEntry.hash;
     const serverChanged = serverDate != null && localEntry.serverDate != null && serverDate !== localEntry.serverDate;
     if (localChanged && serverChanged) {
       conflict.push(relPath);
@@ -12083,12 +12286,12 @@ async function statusRemote3(root, config2, index, flags) {
     }
   }
   for (const entry of index) {
-    if (!serverPaths.has(entry.path)) {
+    if (!serverPaths.has(entry.path) && fs9.existsSync(path6.join(root, entry.path))) {
       localOnly.push(entry.path);
     }
   }
   const newFiles = detectNewFiles4(root, index);
-  printRemoteStatus("Deployment", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, localOnly, serverOnly });
+  printRemoteStatus("Deployment", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, deletedLocally, localOnly, serverOnly });
 }
 function watch5(flags) {
   return watch2("deployment", flags, push3);
@@ -12282,7 +12485,9 @@ async function pull4(flags) {
   const projects2 = await fetchProjects(service);
   const projectNames = buildProjectMap(projects2);
   console.log(`Found ${projects2.length} projects`);
+  const previousIndex = readIndex(dir);
   const index = [];
+  const serverPaths = /* @__PURE__ */ new Set();
   const resources2 = await service.get("resources", {
     fields: RESOURCE_FIELDS,
     order: [["name", "asc"]]
@@ -12297,6 +12502,7 @@ async function pull4(flags) {
       continue;
     }
     const relPath = resourceToRelPath(projectName, resource);
+    serverPaths.add(relPath);
     try {
       const content4 = await service.get(
         `resourceContent/${resource.id_custom_resource}`,
@@ -12328,6 +12534,7 @@ async function pull4(flags) {
     const projectName = query.id_custom_page ? projectNames.get(query.id_custom_page) : void 0;
     if (!projectName) continue;
     const relPath = queryToRelPath(projectName, query);
+    serverPaths.add(relPath);
     try {
       const content4 = await service.get(
         `queryContent/${query.id_thread}`,
@@ -12354,6 +12561,12 @@ async function pull4(flags) {
     if (!project.id_custom_page || !project.name) continue;
     await refreshProjectMeta(service, dir, project, queries2.filter((q) => q.id_custom_page === project.id_custom_page));
   }
+  removeVanishedFiles(
+    dir,
+    previousIndex,
+    serverPaths,
+    (absPath) => computeHash(fs11.readFileSync(absPath, "utf-8"))
+  );
   writeConfig(dir, {
     domain: conn.domain,
     accounting: conn.tokens.accounting,
@@ -12406,18 +12619,21 @@ async function push4(flags, files) {
     const absPath = path7.join(root, relPath);
     const entry = indexMap.get(relPath);
     if (!fs11.existsSync(absPath)) {
-      if (!entry) {
+      const entries = entriesToDelete(root, index, relPath);
+      if (entries.length === 0) {
         console.log(`  Skipping ${relPath} (file not found, not in index)`);
         continue;
       }
-      try {
-        await service.delete(entry.kind === "query" ? `queries/${entry.id}` : `resources/${entry.id}`);
-        const idx = index.indexOf(entry);
-        if (idx !== -1) index.splice(idx, 1);
-        indexMap.delete(relPath);
-        console.log(`  Deleted: ${relPath}`);
-      } catch (err) {
-        console.error(`  Failed to delete ${relPath}: ${err instanceof Error ? err.message : err}`);
+      for (const gone of entries) {
+        try {
+          await service.delete(gone.kind === "query" ? `queries/${gone.id}` : `resources/${gone.id}`);
+          const idx = index.indexOf(gone);
+          if (idx !== -1) index.splice(idx, 1);
+          indexMap.delete(gone.path);
+          console.log(`  Deleted: ${gone.path}`);
+        } catch (err) {
+          console.error(`  Failed to delete ${gone.path}: ${err instanceof Error ? err.message : err}`);
+        }
       }
       continue;
     }
@@ -12532,6 +12748,7 @@ async function statusRemote4(root, config2, index, flags) {
   const modifiedLocally = [];
   const modifiedOnServer = [];
   const conflict = [];
+  const deletedLocally = [];
   const localOnly = [];
   const serverOnly = [];
   const compareEntry = (relPath, serverDate) => {
@@ -12541,7 +12758,11 @@ async function statusRemote4(root, config2, index, flags) {
       return;
     }
     const absPath = path7.join(root, relPath);
-    const localChanged = fs11.existsSync(absPath) && computeHash(fs11.readFileSync(absPath, "utf-8")) !== localEntry.hash;
+    if (!fs11.existsSync(absPath)) {
+      deletedLocally.push(relPath);
+      return;
+    }
+    const localChanged = computeHash(fs11.readFileSync(absPath, "utf-8")) !== localEntry.hash;
     const serverChanged = serverDate != null && localEntry.serverDate != null && serverDate !== localEntry.serverDate;
     if (localChanged && serverChanged) {
       conflict.push(relPath);
@@ -12571,12 +12792,12 @@ async function statusRemote4(root, config2, index, flags) {
     compareEntry(relPath, query.date_created);
   }
   for (const entry of index) {
-    if (!serverPaths.has(entry.path)) {
+    if (!serverPaths.has(entry.path) && fs11.existsSync(path7.join(root, entry.path))) {
       localOnly.push(entry.path);
     }
   }
   const newFiles = detectNewFiles5(root, index);
-  printRemoteStatus("Extensions", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, localOnly, serverOnly });
+  printRemoteStatus("Extensions", root, config2, flags, { modifiedLocally, modifiedOnServer, conflict, new: newFiles, deletedLocally, localOnly, serverOnly });
 }
 function watch6(flags) {
   return watch2("ext", flags, push4);
@@ -12607,18 +12828,24 @@ async function content3(id, flags) {
   const text2 = await service.get(endpoint, void 0, { parseResponse: false });
   process.stdout.write(text2 || "");
 }
+async function refreshMetaForProject(service, flags, idProject) {
+  if (!idProject) return;
+  const root = findProjectRoot(flags.dir || ".");
+  if (!root || readConfig(root)?.type !== "ext") return;
+  try {
+    const project = await service.get(`projects/${idProject}`);
+    if (!project?.name) return;
+    await refreshProjectMeta(service, root, project);
+    console.error(`Updated .rpbi/projects/${project.name}.yaml`);
+  } catch {
+  }
+}
 async function params2(id, flags) {
   const service = await createService("extensions", { cwd: flags.dir || "." });
   const refreshMeta = async () => {
-    const root = findProjectRoot(flags.dir || ".");
-    if (!root || readConfig(root)?.type !== "ext") return;
     try {
       const query = await service.get(`queries/${id}`, { fields: ["id_custom_page"] });
-      if (!query?.id_custom_page) return;
-      const project = await service.get(`projects/${query.id_custom_page}`);
-      if (!project?.name) return;
-      await refreshProjectMeta(service, root, project);
-      console.error(`Updated .rpbi/projects/${project.name}.yaml`);
+      await refreshMetaForProject(service, flags, query?.id_custom_page);
     } catch {
     }
   };
@@ -12637,6 +12864,53 @@ async function params2(id, flags) {
     output(result || [], flags);
   }
 }
+var DEFAULT_DEP_FIELDS = ["idz", "id_custom_page", "id_custom_resource", "resource_name", "id_thread", "thread_name"];
+async function deps(flags) {
+  const service = await createService("extensions", { cwd: flags.dir || "." });
+  if (flags.add) {
+    if (!flags.query && !flags.resource) {
+      console.error("Usage: rpbi ext deps --query <id> --add <resource_id>  |  --resource <id> --add <query_id>");
+      process.exit(1);
+    }
+    const idThread = flags.query ? parseInt(flags.query) : parseInt(flags.add);
+    const idResource = flags.resource ? parseInt(flags.resource) : parseInt(flags.add);
+    const created = await service.post("queryDependencies", {
+      id_thread: idThread,
+      id_custom_resource: idResource
+    });
+    try {
+      const query = await service.get(`queries/${idThread}`, { fields: ["id_custom_page"] });
+      await refreshMetaForProject(service, flags, query?.id_custom_page);
+    } catch {
+    }
+    output(created, flags);
+  } else if (flags.remove) {
+    let idProject;
+    try {
+      const rows = await service.get("queryDependencies", { where: { idz: parseInt(flags.remove) } });
+      idProject = rows?.[0]?.id_custom_page;
+    } catch {
+    }
+    await service.delete(`queryDependencies/${flags.remove}`);
+    await refreshMetaForProject(service, flags, idProject);
+    console.log(`Dependency ${flags.remove} deleted.`);
+  } else {
+    let where = null;
+    if (flags.query) where = { id_thread: parseInt(flags.query) };
+    else if (flags.resource) where = { id_custom_resource: parseInt(flags.resource) };
+    else if (flags.project) where = { id_custom_page: parseInt(flags.project) };
+    if (!where) {
+      console.error("Usage: rpbi ext deps --project <id> | --query <id> | --resource <id> [--add <id>] [--remove <idz>]");
+      process.exit(1);
+    }
+    const result = await service.get("queryDependencies", {
+      ...getListParams(flags, DEFAULT_DEP_FIELDS),
+      where,
+      order: [["resource_name", "asc"], ["thread_name", "asc"]]
+    });
+    output(result || [], flags);
+  }
+}
 async function exec4(id, flags) {
   const service = await createService("extensions", { cwd: flags.dir || "." });
   let body = void 0;
@@ -12650,8 +12924,14 @@ async function exec4(id, flags) {
       csv_delimiter: "	",
       csv_header: "1",
       csv_header_json: "1",
-      csv_null_value: "NULL"
+      csv_null_value: "NULL",
+      // makes the server flush the response headers before the query finishes, so X-Spid
+      // is readable while it still runs (IIS holds headers back until the first body flush)
+      flush_headers: "1"
     }, { headers: { accept: "text/csv" } });
+    const spid = response.headers.get("x-spid");
+    if (spid) fs12.writeSync(2, `${SPID_MARKER} ${spid}
+`);
     if (!response.ok) {
       const text3 = await response.text();
       console.error(text3);
@@ -12664,6 +12944,11 @@ async function exec4(id, flags) {
     process.stdout.write(result || "");
   }
 }
+async function abort3(spid, flags) {
+  const service = await createService("extensions", { cwd: flags.dir || "." });
+  const result = await service.get(`abort/${spid}`);
+  output(result, flags);
+}
 async function ext(args) {
   const { positional, flags } = parseArgs(args);
   const [subcommand, ...rest] = positional;
@@ -12686,12 +12971,20 @@ async function ext(args) {
         process.exit(1);
       }
       return exec4(rest[0], flags);
+    case "abort":
+      if (!rest[0]) {
+        console.error("Usage: rpbi ext abort <spid>");
+        process.exit(1);
+      }
+      return abort3(rest[0], flags);
     case "params":
       if (!rest[0]) {
         console.error("Usage: rpbi ext params <query_id> [--save <json file>] [--delete <idz>]");
         process.exit(1);
       }
       return params2(rest[0], flags);
+    case "deps":
+      return deps(flags);
     case "pull":
       return pull4(flags);
     case "push":
@@ -12701,7 +12994,7 @@ async function ext(args) {
     case "watch":
       return watch6(flags);
     default:
-      console.log("Usage: rpbi ext <projects|resources|queries|content|exec|params|pull|push|status|watch> [options]");
+      console.log("Usage: rpbi ext <projects|resources|queries|content|exec|abort|params|deps|pull|push|status|watch> [options]");
       break;
   }
 }
@@ -17311,7 +17604,7 @@ __export(util_exports, {
   getParsedType: () => getParsedType2,
   getSizableOrigin: () => getSizableOrigin,
   hexToUint8Array: () => hexToUint8Array,
-  isObject: () => isObject,
+  isObject: () => isObject2,
   isPlainObject: () => isPlainObject,
   issue: () => issue,
   joinValues: () => joinValues,
@@ -17481,7 +17774,7 @@ function slugify(input) {
 }
 var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {
 };
-function isObject(data) {
+function isObject2(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 var allowsEval = cached(() => {
@@ -17497,7 +17790,7 @@ var allowsEval = cached(() => {
   }
 });
 function isPlainObject(o) {
-  if (isObject(o) === false)
+  if (isObject2(o) === false)
     return false;
   const ctor = o.constructor;
   if (ctor === void 0)
@@ -17505,7 +17798,7 @@ function isPlainObject(o) {
   if (typeof ctor !== "function")
     return true;
   const prot = ctor.prototype;
-  if (isObject(prot) === false)
+  if (isObject2(prot) === false)
     return false;
   if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
     return false;
@@ -19663,13 +19956,13 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def2) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject3 = isObject2;
   const catchall = def2.catchall;
   let value;
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject3(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -19767,7 +20060,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def2) =
     return (payload, ctx) => fn(shape, payload, ctx);
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject3 = isObject2;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -19776,7 +20069,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def2) =
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject3(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -19954,7 +20247,7 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
   });
   inst._zod.parse = (payload, ctx) => {
     const input = payload.value;
-    if (!isObject(input)) {
+    if (!isObject2(input)) {
       payload.issues.push({
         code: "invalid_type",
         expected: "object",
@@ -34222,7 +34515,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve7) => setTimeout(resolve7, pollInterval));
+        await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error48) {
@@ -34239,7 +34532,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const earlyReject = (error48) => {
         reject(error48);
       };
@@ -34317,7 +34610,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve7(parseResult.data);
+            resolve8(parseResult.data);
           }
         } catch (error48) {
           reject(error48);
@@ -34578,12 +34871,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve7, interval);
+      const timeoutId = setTimeout(resolve8, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -34678,7 +34971,7 @@ function mergeCapabilities(base, additional) {
 
 // ../../.yarn/__virtual__/@modelcontextprotocol-sdk-virtual-4beea6215a/0/cache/@modelcontextprotocol-sdk-npm-1.26.0-380479a6f8-b4098789d9.zip/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
-var import_ajv_formats = __toESM(require_dist2(), 1);
+var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
   const ajv = new import_ajv.default({
     strict: false,
@@ -35542,7 +35835,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve7) => setTimeout(resolve7, pollInterval));
+      await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -36185,12 +36478,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve7) => {
+    return new Promise((resolve8) => {
       const json3 = serializeMessage(message);
       if (this._stdout.write(json3)) {
-        resolve7();
+        resolve8();
       } else {
-        this._stdout.once("drain", resolve7);
+        this._stdout.once("drain", resolve8);
       }
     });
   }
@@ -36228,31 +36521,19 @@ function text(data) {
   return { content: [{ type: "text", text: data }] };
 }
 async function mcp() {
+  setMcpMode();
   const server = new McpServer({
     name: "reporting-bi",
-    version: "0.1.10"
+    version: "0.1.12"
   });
   server.tool(
     "status",
-    "Show active connection, accounting, and token expiry for all logged-in domains",
+    "Show active connection, accounting, and token/session expiry for all logged-in domains",
     {},
     async () => {
-      const creds = loadCredentials();
-      const domains = Object.keys(creds.connections);
-      if (domains.length === 0) return text("Not logged in.");
-      const result = domains.map((domain2) => {
-        const tokens = creds.connections[domain2];
-        const now = Math.floor(Date.now() / 1e3);
-        const expiresIn = tokens.expires_at - now;
-        return {
-          domain: domain2,
-          active: creds.active === domain2,
-          accounting: tokens.accounting ?? null,
-          token_expires_in_seconds: tokens.expires_at === 0 ? null : expiresIn,
-          has_refresh_token: !!tokens.refresh_token
-        };
-      });
-      return json2(result);
+      const report2 = statusReport();
+      if (report2.connections.length === 0) return text("Not logged in.");
+      return json2(report2);
     }
   );
   server.tool(
@@ -36733,26 +37014,26 @@ function saveUpdateCheck(data) {
   fs13.writeFileSync(UPDATE_CHECK_FILE, JSON.stringify(data, null, 2));
 }
 function fetchLatestVersion() {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const req = https.get(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, { timeout: 5e3 }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        return resolve7(null);
+        return resolve8(null);
       }
       let body = "";
       res.on("data", (chunk) => body += chunk);
       res.on("end", () => {
         try {
-          resolve7(JSON.parse(body).version ?? null);
+          resolve8(JSON.parse(body).version ?? null);
         } catch {
-          resolve7(null);
+          resolve8(null);
         }
       });
     });
-    req.on("error", () => resolve7(null));
+    req.on("error", () => resolve8(null));
     req.on("timeout", () => {
       req.destroy();
-      resolve7(null);
+      resolve8(null);
     });
   });
 }
@@ -36776,10 +37057,10 @@ async function checkForUpdate() {
     saveUpdateCheck({ lastCheck: now });
     const latest = await fetchLatestVersion();
     if (!latest) return;
-    if (!isNewer(latest, "0.1.10")) return;
-    console.log(`\x1B[33mUpdating ${PACKAGE_NAME} ${"0.1.10"} \u2192 ${latest}...\x1B[0m`);
-    (0, import_node_child_process3.execSync)(npmInstallCmd(latest), { stdio: "inherit" });
-    console.log(`\x1B[32mUpdated to ${latest}.\x1B[0m`);
+    if (!isNewer(latest, "0.1.12")) return;
+    console.error(`\x1B[33mUpdating ${PACKAGE_NAME} ${"0.1.12"} \u2192 ${latest}...\x1B[0m`);
+    (0, import_node_child_process3.execSync)(npmInstallCmd(latest), { stdio: ["ignore", 2, 2] });
+    console.error(`\x1B[32mUpdated to ${latest}.\x1B[0m`);
   } catch {
   }
 }
@@ -36789,11 +37070,11 @@ async function forceUpdate() {
     console.error("Could not fetch latest version from npm.");
     process.exit(1);
   }
-  if (!isNewer(latest, "0.1.10")) {
-    console.log(`Already up to date (${"0.1.10"}).`);
+  if (!isNewer(latest, "0.1.12")) {
+    console.log(`Already up to date (${"0.1.12"}).`);
     return;
   }
-  console.log(`Updating ${PACKAGE_NAME} ${"0.1.10"} \u2192 ${latest}...`);
+  console.log(`Updating ${PACKAGE_NAME} ${"0.1.12"} \u2192 ${latest}...`);
   (0, import_node_child_process3.execSync)(npmInstallCmd(latest), { stdio: "inherit" });
   console.log(`\x1B[32mUpdated to ${latest}.\x1B[0m`);
   saveUpdateCheck({ lastCheck: Date.now() });
@@ -36804,11 +37085,20 @@ var USAGE_default = `Reporting.bi CLI
 
 Usage: rpbi <command> [options]
 
+Global options:
+  --connection <domain>                 Run against this login instead of the active one
+  --json                                Machine-readable output
+  --verbose                             Log every request to stderr
+
+Workspace sync (etl/wiki/deployment/ext pull, push, status) mirrors deletions both ways:
+pull removes local files deleted on the server (a locally modified file is kept), push
+deletes on the server what was deleted locally \u2014 single files or whole folders.
+
 Commands:
   login [domain] [--accounting <id>]    Login to a Reporting.bi instance (opens browser)
   logout [domain]                       Logout and revoke tokens (default: active connection)
   use <domain> [--accounting <id>]      Switch active connection and/or set accounting
-  status                                Show all connections and active status
+  status [--json]                       Show all connections, token and session expiry
   init [--connection <domain>] [--accounting <id>] [--type etl|wiki|deployment|ext]  Initialize .rpbi/config.json in current directory
   update                                Force update to latest version from npm
   mcp                                   Start MCP server (for AI agents, stdio transport)
@@ -36821,6 +37111,7 @@ ETL:
   etl get <id>                          Get thread metadata
   etl content <id>                      Get thread SQL content (plain text)
   etl exec <id> [--sql "..."|--file f]  Execute thread (optionally with custom SQL)
+  etl abort <spid>                      Abort a running exec (exec reports "rpbi: spid <n>" on stderr)
   etl search <query>                    Search threads
   etl params <id> [--save <json>|--delete <idz>]  List, save or delete thread parameters
   etl pull [--dir <path>] [--no-context]  Pull all ETL threads, parameters, metadata & schema to local files
@@ -36846,7 +37137,11 @@ Extensions (requires the "custom.define" right):
   ext queries                           List queries
   ext content <id> [--query]            Get resource content (--query for query SQL)
   ext exec <query_id> [--sql "..."|--file f]  Execute query (optionally with custom SQL)
+  ext abort <spid>                      Abort a running exec (exec reports "rpbi: spid <n>" on stderr)
   ext params <query_id> [--save <json>|--delete <idz>]  List, save or delete query parameters
+  ext deps --project <id>|--query <id>|--resource <id>  List SQL dependencies (resource \u2194 query links)
+  ext deps --query <id> --add <resource_id>   Link a query to a resource (or --resource <id> --add <query_id>)
+  ext deps --remove <idz>                     Unlink a dependency
   ext pull [--dir <path>]               Pull all projects (resources, queries & project metadata) to local files
   ext push [files...] [--dir <path>] [--force]  Push modified/new files back to server
   ext status [--dir <path>] [--remote] [--json]  Show local changes (--remote compares with server)
@@ -36967,7 +37262,7 @@ Examples:
 (async () => {
   const [command, ...args] = process.argv.slice(2);
   if (command === "--version" || command === "-v") {
-    console.log("0.1.10");
+    console.log("0.1.12");
     return;
   }
   await checkForUpdate();
@@ -37024,7 +37319,7 @@ Examples:
       helpdesk(args);
       break;
     case "status":
-      status();
+      status(args);
       break;
     case "mcp":
       mcp();