@datarails-ai/dr-cli 1.6.119 → 1.6.121

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.119",
+  version: "1.6.121",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-12T09:44:27.404Z";
+var BUILD_TIME = "2026-10-12T10:41:54.439Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -3798,6 +3798,11 @@ var PROD_GATE_TIER_B = /* @__PURE__ */ new Set([
   // no interactive word gate. If a rescan ever gains a destructive side effect,
   // this key moves to Tier A.
   "table|rescan",
+  // dr filebox rescan-version (DR-54137): the same reasoning at the scale of one
+  // version — the UI's per-version Rescan. It re-extracts that version with the
+  // tables' current datamappers and replaces its rows; it never deletes rows it
+  // does not re-load, and it is re-runnable. Token-only.
+  "filebox-version|rescan",
   // spend-control (dr spend-control contracts bulk-create). `archive` and its
   // inverse `restore` are a single PATCH of `is_archived` — each undoes the
   // other exactly, so token-only. The hard `delete` verb is Tier A.
@@ -19116,6 +19121,24 @@ async function updateAutoCalculateSettings(client, docId, body, reqOptions) {
 async function downloadVersion(client, versionId, reqOptions) {
   return client.do("GET", `/api/documents/versions/${versionId}/file`, void 0, reqOptions);
 }
+async function listBucketTemplates(client, bucketId, reqOptions) {
+  const out = await client.getJSON(
+    `/api/buckets/${bucketId}/templates`,
+    reqOptions
+  );
+  return Array.isArray(out) ? out : [];
+}
+async function listDocumentTables(client, docId, reqOptions) {
+  const out = await client.getJSON(
+    `/api/documents/${docId}/bucket`,
+    reqOptions
+  );
+  const list28 = out?.templates;
+  return Array.isArray(list28) ? list28 : [];
+}
+async function rescanBucketVersions(client, bucketId, body, reqOptions) {
+  await client.postJSON(`/api/buckets/${bucketId}/rescan_versions`, body, reqOptions);
+}
 
 // src/commands/_lutMappings.ts
 var ROW_FIELDS = ["create", "update", "delete"];
@@ -35341,6 +35364,232 @@ function registerFileboxAdminCommands(fb, setupCall2, addServerFlag2, addAccount
   addAccountFlag2(vrSetCmd);
 }
 
+// src/commands/_typedError.ts
+function isTypedError(err) {
+  return !(err instanceof Error) || err.constructor !== Error || "code" in err;
+}
+function withErrorContext(context, err) {
+  if (isTypedError(err)) return err;
+  const e = err;
+  return new Error(`${context}: ${e.message}`, { cause: e });
+}
+
+// src/commands/filebox_rescanVersion.ts
+function sortedUnique(ids) {
+  return [...new Set(ids)].sort((a, b) => a - b);
+}
+function rescanVersionAction(versionId, tableIds) {
+  return {
+    resource: "filebox-version",
+    id: `${versionId}:tables=${sortedUnique(tableIds).join(",")}`,
+    verb: "rescan"
+  };
+}
+function buildRescanVersionConfirmCmd(versionId, tableIds, serverFlag, asJson) {
+  const tableFlags = sortedUnique(tableIds).map((t) => ` --table ${t}`).join("");
+  const jsonFlag = asJson ? " --json" : "";
+  return `dr filebox rescan-version ${versionId}${tableFlags} --server ${serverFlag}${jsonFlag}`;
+}
+function describeVersionTags(tags) {
+  if (!Array.isArray(tags) || tags.length === 0) return "(none)";
+  const parts = [];
+  for (const t of tags) {
+    if (t === null || typeof t !== "object") continue;
+    const r = t;
+    const name = typeof r["name"] === "string" && r["name"] !== "" ? r["name"] : `tag ${String(r["id"])}`;
+    const label = r["label"];
+    const value = typeof label === "string" && label !== "" ? label : r["value"] === void 0 || r["value"] === null ? "?" : String(r["value"]);
+    parts.push(`${name}: ${value}`);
+  }
+  return parts.length === 0 ? "(none)" : parts.join(", ");
+}
+async function step(context, p) {
+  try {
+    return await p;
+  } catch (err) {
+    throw withErrorContext(context, err);
+  }
+}
+async function resolveRescan2(cfg) {
+  const opts = { signal: cfg.signal };
+  const version = await step(
+    `load version ${cfg.versionId}`,
+    getVersion(cfg.client, cfg.versionId, opts)
+  );
+  if (version.auto_save === true) {
+    throw new Error(
+      `version ${cfg.versionId} is archived; the server only rescans non-archived versions (restore it first with \`dr filebox restore-version ${cfg.versionId}\`)`
+    );
+  }
+  if (version.include_file === false) {
+    throw new Error(
+      `version ${cfg.versionId} is excluded from the database; a rescan would extract nothing (include it with \`dr filebox set-version-include ${cfg.versionId} --include on\`, which itself queues the extraction)`
+    );
+  }
+  const doc = await step(
+    `load filebox ${version.document} of version ${cfg.versionId}`,
+    getDetails(cfg.client, version.document, opts)
+  );
+  const bucketId = typeof doc.bucket === "number" && doc.bucket > 0 ? doc.bucket : void 0;
+  if (bucketId === void 0) {
+    throw new Error(
+      `filebox ${version.document} has no bucket; the per-version rescan endpoint is bucket-scoped and cannot address this version`
+    );
+  }
+  const [bucketTables, docTables] = await Promise.all([
+    step(
+      `list tables of filebox ${version.document}`,
+      listBucketTemplates(cfg.client, bucketId, opts)
+    ),
+    step(
+      `list tables filebox ${version.document} is mapped into`,
+      listDocumentTables(cfg.client, version.document, opts)
+    )
+  ]);
+  const mappedIds = new Set(docTables.map((t) => t.id));
+  const eligible = bucketTables.filter((t) => mappedIds.has(t.id));
+  let tables;
+  if (cfg.tableIds.length === 0) {
+    tables = eligible;
+  } else {
+    const byId = new Map(eligible.map((t) => [t.id, t]));
+    const unknown = sortedUnique(cfg.tableIds).filter((id) => !byId.has(id));
+    if (unknown.length > 0) {
+      throw new Error(
+        `--table ${unknown.join(", ")}: not an active table that filebox ${version.document} is mapped into, so the server would skip it` + (eligible.length > 0 ? ` (eligible tables: ${eligible.map((t) => t.id).join(", ")})` : "")
+      );
+    }
+    tables = sortedUnique(cfg.tableIds).map((id) => byId.get(id));
+  }
+  if (tables.length === 0) {
+    throw new Error(
+      `filebox ${version.document} is not mapped into any active table; there is nothing to re-extract version ${cfg.versionId} into`
+    );
+  }
+  return { version, doc, bucketId, tables };
+}
+function tableLabel(t) {
+  return t.name !== "" ? `${t.name} (${t.id})` : String(t.id);
+}
+async function runFileboxRescanVersion(cfg) {
+  if (cfg.versionId <= 0) {
+    throw new Error("version id must be positive");
+  }
+  for (const id of cfg.tableIds) {
+    if (!Number.isInteger(id) || id <= 0) {
+      throw new Error(`invalid --table value: "${id}"`);
+    }
+  }
+  if (cfg.tableIds.length > 0) {
+    await preflightConfirmToken(rescanVersionAction(cfg.versionId, cfg.tableIds), cfg.token);
+  }
+  const r = await resolveRescan2(cfg);
+  const tableIds = r.tables.map((t) => t.id);
+  const action = rescanVersionAction(cfg.versionId, tableIds);
+  await preflightConfirmToken(action, cfg.token);
+  const docLabel = r.doc.name !== "" ? `${r.doc.name} (${r.doc.id})` : String(r.doc.id);
+  await twoStepConfirm({
+    out: cfg.out,
+    action,
+    token: cfg.token,
+    server: cfg.serverFlag,
+    confirmCmd: buildRescanVersionConfirmCmd(
+      cfg.versionId,
+      cfg.tableIds,
+      cfg.serverFlag,
+      cfg.asJson
+    ),
+    describe: async () => [
+      `version:   ${cfg.versionId} (v${r.version.version}, ${r.version.name})`,
+      `filebox:   ${docLabel}, bucket ${r.bucketId}`,
+      `tags:      ${describeVersionTags(r.version.tags)} (unchanged)`,
+      `tables:    ${r.tables.map(tableLabel).join(", ")}`,
+      "effect:    re-extracts THIS version only, in place, with the tables\u2019 current datamappers; its existing rows in each table are replaced, not duplicated",
+      "scope:     other versions of the filebox or collection process are not touched; the token is bound to these tables"
+    ],
+    execute: async () => {
+      await step(
+        `rescan version ${cfg.versionId}`,
+        rescanBucketVersions(
+          cfg.client,
+          r.bucketId,
+          { versions: [cfg.versionId], templates: tableIds },
+          { signal: cfg.signal }
+        )
+      );
+      if (cfg.asJson) {
+        writeJSONIndented(cfg.out, {
+          version_id: cfg.versionId,
+          version: r.version.version,
+          doc_id: r.doc.id,
+          bucket_id: r.bucketId,
+          tables: r.tables.map((t) => ({ id: t.id, name: t.name })),
+          queued: true
+        });
+        return;
+      }
+      cfg.out.write(
+        `Rescan queued for version ${cfg.versionId} (v${r.version.version}) into ${r.tables.length} table(s). Poll with: dr scans status ${tableIds[0]} --server ${cfg.serverFlag}
+`
+      );
+    }
+  });
+}
+function parseVersionIdArg(arg) {
+  const n = Number(arg);
+  if (!Number.isInteger(n) || String(n) !== arg || n <= 0) {
+    throw new Error(`invalid version id: "${arg}"`);
+  }
+  return n;
+}
+function collectTableId(value, previous) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || String(n) !== value || n <= 0) {
+    throw new Error(`invalid --table value: "${value}"`);
+  }
+  return previous.concat([n]);
+}
+function registerFileboxRescanVersionCommand(fb) {
+  const cmd = fb.command("rescan-version").description(
+    'Re-extract ONE filebox version in place, without changing its tags \u2014 the UI version "three dots > Rescan". Only this version is re-extracted (not the rest of its filebox or collection process), with the tables\u2019 current datamappers; its rows in each table are replaced, not duplicated. Two-step confirmation: run once to see the version, filebox, tags and tables and get a token, then re-run with --confirm-token.'
+  ).argument("<version_id>", "document version id (global)").option(
+    "--table <table_id>",
+    "Re-extract into this table only (repeatable). Default: every active table the filebox is mapped into.",
+    collectTableId,
+    []
+  ).option(
+    "--confirm-token <token>",
+    "Token from a prior plan run \u2014 required to actually trigger the rescan",
+    ""
+  ).option("--json", "Output the queued rescan as JSON instead of prose", false).action(
+    async (idStr, opts) => {
+      const versionId = parseVersionIdArg(idStr);
+      const tableIds = opts.table ?? [];
+      if (tableIds.length > 0) {
+        await preflightConfirmToken(rescanVersionAction(versionId, tableIds), opts.confirmToken);
+      }
+      const serverKey = resolveServer(opts.server);
+      const setup = await setupCall(opts.server, opts.account);
+      try {
+        await runFileboxRescanVersion({
+          client: setup.client,
+          versionId,
+          tableIds,
+          token: opts.confirmToken,
+          serverFlag: serverKey,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(cmd);
+  addAccountFlag(cmd);
+}
+
 // src/api/forecast.ts
 var SCENARIO_PARAM = "Forecast";
 async function listScenarios(client, filter = {}, options) {
@@ -36979,7 +37228,7 @@ function parseVersionAddressing(positional, opts, latestFlag) {
     );
   }
   if (hasPositional) {
-    return { mode: "direct", versionId: parseVersionIdArg(positional) };
+    return { mode: "direct", versionId: parseVersionIdArg2(positional) };
   }
   if (hasNumber && hasLatest) {
     throw new Error(`pass either --version-number <n> or ${latestFlag}, not both`);
@@ -37159,9 +37408,6 @@ function parseVersionLabelFlags(label, clear) {
   }
   return validateVersionLabel(label);
 }
-function isTypedError(err) {
-  return !(err instanceof Error) || err.constructor !== Error || "code" in err;
-}
 async function writeVersionLabel(client, versionId, label, signal) {
   const res = await setVersionNameLabel(client, versionId, label, { signal });
   if (res.status < 200 || res.status >= 300) {
@@ -37344,6 +37590,34 @@ function requireTagPermission(details, perm, docId, action) {
     );
   }
 }
+var TagWriteRefusedError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "TagWriteRefusedError";
+  }
+  reason;
+};
+function fullTagSetWith(stored, write) {
+  const kept = [];
+  for (const raw of stored ?? []) {
+    if (typeof raw !== "object" || raw === null) {
+      continue;
+    }
+    const t = raw;
+    const id = typeof t.id === "string" && t.id.trim() !== "" ? Number(t.id) : t.id;
+    if (typeof id !== "number" || !Number.isInteger(id) || id === write.id || kept.some((k) => k.id === id) || t.value === void 0 || t.value === null) {
+      continue;
+    }
+    kept.push({
+      id,
+      value: t.value,
+      ...typeof t.name === "string" ? { name: t.name } : {},
+      ...typeof t.label === "string" ? { label: t.label } : {}
+    });
+  }
+  return [...kept, write].sort((a, b) => a.id - b.id);
+}
 async function runFileboxSetVersionFileStatus(cfg) {
   if (cfg.docId <= 0) {
     throw new Error("document id must be positive");
@@ -37398,6 +37672,8 @@ async function runFileboxSetVersionFileStatus(cfg) {
         changed: false,
         verified: true,
         reapplied: false,
+        date_tag_value: target.date_tag_value ?? null,
+        date_tag_value_preserved: true,
         demoted_version_ids: [],
         rescan_queued: false
       });
@@ -37429,19 +37705,31 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
-  const tagsToUpdate = JSON.stringify([
-    { id: tag.id, value: cfg.status, name: tag.name, label: cfg.status }
-  ]);
+  const statusWrite = {
+    id: tag.id,
+    value: cfg.status,
+    name: tag.name,
+    label: cfg.status
+  };
+  let base = target.tags ?? [];
+  const refreshBase = (v) => {
+    if (v !== null && v.tags.length > 0) {
+      base = v.tags;
+    }
+  };
   const write = async () => {
     const res = await setVersionTagsAndLabel(
       cfg.client,
       cfg.versionId,
-      { tags_to_update: tagsToUpdate },
+      { tags_to_update: JSON.stringify(fullTagSetWith(base, statusWrite)) },
       { signal: cfg.signal }
     );
     if (res.status < 200 || res.status >= 300) {
       const body = await res.text();
-      throw new Error(`set version file status refused (HTTP ${res.status}): ${body.trim()}`);
+      throw new TagWriteRefusedError(
+        `set version file status refused (HTTP ${res.status}): ${body.trim()}`,
+        `(HTTP ${res.status}): ${body.trim()}`
+      );
     }
   };
   const readBack = async () => {
@@ -37453,6 +37741,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
   let seen = await readBack();
   if (seen !== null && tagValueOf(seen.tags, tag.id) !== cfg.status) {
     reapplied = true;
+    refreshBase(seen);
     await write();
     seen = await readBack();
     const now = seen === null ? void 0 : tagValueOf(seen.tags, tag.id);
@@ -37462,6 +37751,53 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
+  const dateBefore = target.date_tag_value;
+  const dateMoved = (v) => v !== null && typeof dateBefore === "number" && v.row.date_tag_value !== void 0 && v.row.date_tag_value !== dateBefore;
+  let dateUnknown = false;
+  if (dateMoved(seen)) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} changed (${JSON.stringify(dateBefore)} -> ${JSON.stringify(seen.row.date_tag_value ?? null)}) when its File Status was set; re-applying the full tag set once
+`
+    );
+    reapplied = true;
+    refreshBase(seen);
+    let refused = false;
+    try {
+      await write();
+    } catch (e) {
+      if (cfg.signal.aborted) {
+        throw e;
+      }
+      if (e instanceof TagWriteRefusedError) {
+        refused = true;
+        err.write(`warning: re-applying the full tag set was refused ${e.reason}
+`);
+      } else {
+        err.write(
+          `warning: re-applying the full tag set failed (${e instanceof Error ? e.message : String(e)}); its outcome is unknown, reading the version again
+`
+        );
+      }
+    }
+    const after = refused ? seen : await readBack();
+    if (after === null) {
+      dateUnknown = true;
+      err.write(
+        `warning: could not read version ${cfg.versionId} back to confirm its date_tag_value after re-applying the full tag set \u2014 check it with \`dr filebox versions ${cfg.docId} --json\`
+`
+      );
+    } else {
+      seen = after;
+    }
+  }
+  const dateAfter = dateUnknown || seen === null || seen.row.date_tag_value === void 0 ? null : seen.row.date_tag_value;
+  const datePreserved = dateUnknown || seen === null || dateBefore === void 0 || seen.row.date_tag_value === void 0 ? null : !dateMoved(seen);
+  if (datePreserved === false) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} is still ${JSON.stringify(dateAfter)} (was ${JSON.stringify(dateBefore)}) after one re-apply; its tags still carry the date. Restore it with \`dr filebox set-version-date-tag ${cfg.versionId} --doc ${cfg.docId} --<dimension> <date>\` (it sends the date tag alone; on a planning filebox use \`dr filebox set-version-cycle ${cfg.versionId} --doc ${cfg.docId} --date <date> --scenario <name>\` instead, which keeps the cycle), then check \`dr filebox versions ${cfg.docId} --json\`
+`
+    );
+  }
   if (seen === null) {
     err.write(
       `warning: could not read version ${cfg.versionId} back to verify its File Status \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
@@ -37487,6 +37823,8 @@ async function runFileboxSetVersionFileStatus(cfg) {
       changed: true,
       verified,
       reapplied,
+      date_tag_value: dateAfter,
+      date_tag_value_preserved: datePreserved,
       demoted_version_ids: demotedIds,
       rescan_queued: true
     });
@@ -37497,6 +37835,12 @@ async function runFileboxSetVersionFileStatus(cfg) {
     `Set File Status on version ${cfg.versionId}: ${JSON.stringify(previous ?? "(unset)")} -> "${cfg.status}" (${verdict}).
 `
   );
+  if (datePreserved === false) {
+    cfg.out.write(
+      `date_tag_value NOT preserved: it reads ${JSON.stringify(dateAfter)}, was ${JSON.stringify(dateBefore)} (see the warning above).
+`
+    );
+  }
   if (demotedIds.length > 0) {
     cfg.out.write(
       `Only one version per period can be ${cfg.status}: ${plural2(demotedIds.length, "version", "versions")} ${demotedIds.join(", ")} ${plural2(demotedIds.length, "was", "were")} moved to Draft by the server.
@@ -38583,7 +38927,7 @@ function parseFileboxIdArg(arg) {
   }
   return n;
 }
-function parseVersionIdArg(arg) {
+function parseVersionIdArg2(arg) {
   const n = Number(arg);
   if (!Number.isInteger(n) || String(n) !== arg) {
     throw new Error(`invalid version id: "${arg}"`);
@@ -38684,7 +39028,7 @@ function registerFileboxCommand(root) {
   addServerFlag(tagsCmd);
   addAccountFlag(tagsCmd);
   const sheetsCmd = fb.command("sheets").description("List sheets in a filebox version (names, indices, row/col counts)").argument("<version_id>", "version id (positive integer)").option("--json", "Output raw JSON instead of a table", false).action(async (vidStr, opts) => {
-    const versionId = parseVersionIdArg(vidStr);
+    const versionId = parseVersionIdArg2(vidStr);
     const setup = await setupCall(opts.server, opts.account);
     try {
       await runFileboxSheets({
@@ -38702,7 +39046,7 @@ function registerFileboxCommand(root) {
   addAccountFlag(sheetsCmd);
   const previewCmd = fb.command("preview").description("Preview raw cell data of a filebox version (row 1 is headers)").argument("<version_id>", "version id (positive integer)").option("--sheet <name>", "Sheet name. Defaults to first sheet from /desc.", "").option("--sheet-ind <n>", "Sheet index (0-based). Defaults to 0.", "0").option("--start <n>", "First row to read (1-based)", "1").option("--rows <n>", "Number of rows to return (start..start+rows-1)", "100").option("--data-only", "Return evaluated values only; omit raw formulas", false).option("--json", "Output raw JSON instead of a table", false).action(
     async (vidStr, opts) => {
-      const versionId = parseVersionIdArg(vidStr);
+      const versionId = parseVersionIdArg2(vidStr);
       const sheetInd = parsePositiveIntFlag2(opts.sheetInd, "--sheet-ind", 0);
       const start = parsePositiveIntFlag2(opts.start, "--start", 1);
       const rows = parsePositiveIntFlag2(opts.rows, "--rows", 100);
@@ -39490,6 +39834,7 @@ function registerFileboxCommand(root) {
   addServerFlag(dqSyncCmd);
   addAccountFlag(dqSyncCmd);
   registerFileboxAdminCommands(fb, setupCall, addServerFlag, addAccountFlag);
+  registerFileboxRescanVersionCommand(fb);
 }
 
 // src/commands/integrations.ts
@@ -50743,14 +51088,14 @@ function renderMecProcessDetail(out, p) {
 }
 async function runMecStepGet(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
-  const step = await withMec(
+  const step2 = await withMec(
     () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
   );
   if (cfg.asJson) {
-    writeJSONIndented(cfg.out, step);
+    writeJSONIndented(cfg.out, step2);
     return;
   }
-  renderMecStepDetail(cfg.out, step);
+  renderMecStepDetail(cfg.out, step2);
 }
 function renderMecStepDetail(out, s) {
   const rows = [
@@ -50797,10 +51142,10 @@ function renderMecTaskTable(out, tasks, indent) {
 }
 async function runMecTaskList(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
-  const step = await withMec(
+  const step2 = await withMec(
     () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
   );
-  const tasks = allStepTasks(step);
+  const tasks = allStepTasks(step2);
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, tasks);
     return;
@@ -50816,10 +51161,10 @@ async function runMecTaskList(cfg) {
 }
 async function runMecTaskGet(cfg) {
   await requireMec(cfg.client, { signal: cfg.signal });
-  const step = await withMec(
+  const step2 = await withMec(
     () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
   );
-  const tasks = allStepTasks(step);
+  const tasks = allStepTasks(step2);
   const match = tasks.find((t) => t.id === cfg.taskId);
   if (match === void 0) {
     throw new Error(
@@ -51194,11 +51539,11 @@ async function collectMecActivationCascade(client, template, signal) {
     return lines;
   }
   const steps = process2.steps ?? [];
-  for (const step of steps) {
-    if (step.notify_automatically !== true) continue;
-    const tasks = allStepTasks(step);
+  for (const step2 of steps) {
+    if (step2.notify_automatically !== true) continue;
+    const tasks = allStepTasks(step2);
     if (tasks.length === 0) continue;
-    lines.push(`  step "${step.name}":`);
+    lines.push(`  step "${step2.name}":`);
     for (const t of tasks) {
       lines.push(`    \u2192 ${userLabel(t.assignee)}  (task: ${taskDisplayName(t)})`);
     }
@@ -51695,9 +52040,9 @@ async function runMecTaskDelete(cfg) {
   };
   await preflightConfirmToken(action, cfg.token);
   await requireMec(cfg.client, { signal: cfg.signal });
-  let step;
+  let step2;
   try {
-    step = await withMec(
+    step2 = await withMec(
       () => getStep(cfg.client, cfg.processId, cfg.stepId, {
         signal: cfg.signal
       })
@@ -51713,11 +52058,11 @@ async function runMecTaskDelete(cfg) {
     describe: async () => {
       const lines = [
         `process: ${cfg.processId}`,
-        `step: ${cfg.stepId}${step !== void 0 ? ` ("${step.name}")` : ""}`,
+        `step: ${cfg.stepId}${step2 !== void 0 ? ` ("${step2.name}")` : ""}`,
         `tasks to delete: ${cfg.ids.length}`
       ];
       const tasksById = new Map(
-        (step === void 0 ? [] : allStepTasks(step)).map((t) => [t.id, t])
+        (step2 === void 0 ? [] : allStepTasks(step2)).map((t) => [t.id, t])
       );
       for (const { id } of cfg.ids) {
         const found = tasksById.get(id);
@@ -52322,8 +52667,8 @@ function wireMecWorkflow(mecCmd) {
   });
   addServerFlag(procGetCmd);
   addAccountFlag(procGetCmd);
-  const step = workflow.command("step").description("MEC workflow steps");
-  const stepGetCmd = step.command("get").description("Show a step with embedded tasks").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--json", "Output raw JSON", false).action(
+  const step2 = workflow.command("step").description("MEC workflow steps");
+  const stepGetCmd = step2.command("get").description("Show a step with embedded tasks").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--json", "Output raw JSON", false).action(
     async (processIdRaw, stepIdRaw, opts) => {
       const processId = parsePositiveIntId(processIdRaw, "process id");
       const stepId = parsePositiveIntId(stepIdRaw, "step id");
@@ -52705,7 +53050,7 @@ function wireMecWorkflow(mecCmd) {
   });
   addServerFlag(procDeleteCmd);
   addAccountFlag(procDeleteCmd);
-  const stepCreateCmd = step.command("create").description("Create a new step on a MEC process instance").argument("<process-id>", "numeric process instance id").requiredOption("--file <path>", "JSON file matching the step-create shape").option("--json", "Output the created step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepCreateCmd = step2.command("create").description("Create a new step on a MEC process instance").argument("<process-id>", "numeric process instance id").requiredOption("--file <path>", "JSON file matching the step-create shape").option("--json", "Output the created step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, opts) => {
       const processId = parsePositiveIntId(pidRaw, "process id");
       const payload = await readStepCreatePayload(opts.file ?? "");
@@ -52729,7 +53074,7 @@ function wireMecWorkflow(mecCmd) {
   );
   addServerFlag(stepCreateCmd);
   addAccountFlag(stepCreateCmd);
-  const stepUpdateCmd = step.command("update").description("Edit a MEC step").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").requiredOption("--file <path>", "JSON file with partial step shape").option("--json", "Output the updated step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepUpdateCmd = step2.command("update").description("Edit a MEC step").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").requiredOption("--file <path>", "JSON file with partial step shape").option("--json", "Output the updated step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, sidRaw, opts) => {
       const processId = parsePositiveIntId(pidRaw, "process id");
       const stepId = parsePositiveIntId(sidRaw, "step id");
@@ -52755,7 +53100,7 @@ function wireMecWorkflow(mecCmd) {
   );
   addServerFlag(stepUpdateCmd);
   addAccountFlag(stepUpdateCmd);
-  const stepDeleteCmd = step.command("delete").description("Delete a MEC step (cascades to all its tasks)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepDeleteCmd = step2.command("delete").description("Delete a MEC step (cascades to all its tasks)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, sidRaw, opts) => {
       const processId = parsePositiveIntId(pidRaw, "process id");
       const stepId = parsePositiveIntId(sidRaw, "step id");
@@ -52777,7 +53122,7 @@ function wireMecWorkflow(mecCmd) {
   );
   addServerFlag(stepDeleteCmd);
   addAccountFlag(stepDeleteCmd);
-  const stepReorderCmd = step.command("reorder").description("Reorder steps on a MEC template").argument("<template-id>", "numeric template id").option("--file <path>", "JSON array of {id, index, y_index}").option("--order <pairs>", 'Shorthand: "id:n,id2:n2,..." (mutually exclusive with --file)').option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepReorderCmd = step2.command("reorder").description("Reorder steps on a MEC template").argument("<template-id>", "numeric template id").option("--file <path>", "JSON array of {id, index, y_index}").option("--order <pairs>", 'Shorthand: "id:n,id2:n2,..." (mutually exclusive with --file)').option("--confirm-token <token>", "Token from a prior plan step").action(
     async (tidRaw, opts) => {
       const templateId = parsePositiveIntId(tidRaw, "template id");
       if ((opts.file === void 0 || opts.file === "") && (opts.order === void 0 || opts.order === "")) {
@@ -53674,16 +54019,16 @@ function renderProcessDetail(out, p) {
 }
 async function runStepGet(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
-  const step = decodeShape(
+  const step2 = decodeShape(
     await withWorkflowV2(
       () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
     )
   );
   if (cfg.asJson) {
-    writeJSONIndented(cfg.out, step);
+    writeJSONIndented(cfg.out, step2);
     return;
   }
-  renderStepDetail(cfg.out, step);
+  renderStepDetail(cfg.out, step2);
 }
 function renderStepDetail(out, s) {
   const rows = [
@@ -53729,12 +54074,12 @@ function renderTaskTable(out, tasks, indent) {
 }
 async function runTaskList(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
-  const step = decodeShape(
+  const step2 = decodeShape(
     await withWorkflowV2(
       () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
     )
   );
-  const tasks = allStepTasks2(step);
+  const tasks = allStepTasks2(step2);
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, tasks);
     return;
@@ -53750,12 +54095,12 @@ async function runTaskList(cfg) {
 }
 async function runTaskGet(cfg) {
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
-  const step = decodeShape(
+  const step2 = decodeShape(
     await withWorkflowV2(
       () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
     )
   );
-  const tasks = allStepTasks2(step);
+  const tasks = allStepTasks2(step2);
   const match = tasks.find((t) => t.id === cfg.taskId);
   if (match === void 0) {
     throw new Error(
@@ -54045,11 +54390,11 @@ async function collectActivationCascade(client, template, signal) {
     return lines;
   }
   const steps = process2.steps ?? [];
-  for (const step of steps) {
-    if (step.notify_automatically !== true) continue;
-    const tasks = allStepTasks2(step);
+  for (const step2 of steps) {
+    if (step2.notify_automatically !== true) continue;
+    const tasks = allStepTasks2(step2);
     if (tasks.length === 0) continue;
-    lines.push(`  step "${step.name}":`);
+    lines.push(`  step "${step2.name}":`);
     for (const t of tasks) {
       const assignee = userLabel2(t.assignee);
       const taskName = taskDisplayName2(t);
@@ -54543,9 +54888,9 @@ async function runTaskDelete(cfg) {
   };
   await preflightConfirmToken(action, cfg.token);
   await requireWorkflowV2(cfg.client, { signal: cfg.signal });
-  let step;
+  let step2;
   try {
-    step = decodeShape(
+    step2 = decodeShape(
       await withWorkflowV2(
         () => getStep(cfg.client, cfg.processId, cfg.stepId, { signal: cfg.signal })
       )
@@ -54561,11 +54906,11 @@ async function runTaskDelete(cfg) {
     describe: async () => {
       const lines = [
         `process: ${cfg.processId}`,
-        `step: ${cfg.stepId}${step !== void 0 ? ` ("${step.name}")` : ""}`,
+        `step: ${cfg.stepId}${step2 !== void 0 ? ` ("${step2.name}")` : ""}`,
         `tasks to delete: ${cfg.ids.length}`
       ];
       const tasksById = new Map(
-        (step === void 0 ? [] : allStepTasks2(step)).map((t) => [t.id, t])
+        (step2 === void 0 ? [] : allStepTasks2(step2)).map((t) => [t.id, t])
       );
       for (const { id } of cfg.ids) {
         const found = tasksById.get(id);
@@ -55191,8 +55536,8 @@ function wireWorkflow(root) {
   });
   addServerFlag(processGetCmd);
   addAccountFlag(processGetCmd);
-  const step = workflow.command("step").description("Workflow steps");
-  const stepGetCmd = step.command("get").description("Show a step with embedded tasks (`GET /processes/v2/<pid>/step/<sid>`)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--json", "Output raw JSON", false).action(
+  const step2 = workflow.command("step").description("Workflow steps");
+  const stepGetCmd = step2.command("get").description("Show a step with embedded tasks (`GET /processes/v2/<pid>/step/<sid>`)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--json", "Output raw JSON", false).action(
     async (processIdRaw, stepIdRaw, opts) => {
       const processId = parsePositiveIntId2(processIdRaw, "process id");
       const stepId = parsePositiveIntId2(stepIdRaw, "step id");
@@ -55495,7 +55840,7 @@ function wireWorkflow(root) {
   });
   addServerFlag(processDeleteCmd);
   addAccountFlag(processDeleteCmd);
-  const stepCreateCmd = step.command("create").description("Create a new step on a process instance").argument("<process-id>", "numeric process instance id").requiredOption("--file <path>", "JSON file matching the step-create shape").option("--json", "Output the created step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepCreateCmd = step2.command("create").description("Create a new step on a process instance").argument("<process-id>", "numeric process instance id").requiredOption("--file <path>", "JSON file matching the step-create shape").option("--json", "Output the created step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, opts) => {
       const processId = parsePositiveIntId2(pidRaw, "process id");
       const payload = await readStepCreatePayload(opts.file ?? "");
@@ -55519,7 +55864,7 @@ function wireWorkflow(root) {
   );
   addServerFlag(stepCreateCmd);
   addAccountFlag(stepCreateCmd);
-  const stepUpdateCmd = step.command("update").description("Edit a step").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").requiredOption("--file <path>", "JSON file with partial step shape").option("--json", "Output the updated step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepUpdateCmd = step2.command("update").description("Edit a step").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").requiredOption("--file <path>", "JSON file with partial step shape").option("--json", "Output the updated step as JSON", false).option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, sidRaw, opts) => {
       const processId = parsePositiveIntId2(pidRaw, "process id");
       const stepId = parsePositiveIntId2(sidRaw, "step id");
@@ -55545,7 +55890,7 @@ function wireWorkflow(root) {
   );
   addServerFlag(stepUpdateCmd);
   addAccountFlag(stepUpdateCmd);
-  const stepDeleteCmd = step.command("delete").description("Delete a step (cascades to all its tasks)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepDeleteCmd = step2.command("delete").description("Delete a step (cascades to all its tasks)").argument("<process-id>", "numeric process instance id").argument("<step-id>", "numeric step id").option("--confirm-token <token>", "Token from a prior plan step").action(
     async (pidRaw, sidRaw, opts) => {
       const processId = parsePositiveIntId2(pidRaw, "process id");
       const stepId = parsePositiveIntId2(sidRaw, "step id");
@@ -55567,7 +55912,7 @@ function wireWorkflow(root) {
   );
   addServerFlag(stepDeleteCmd);
   addAccountFlag(stepDeleteCmd);
-  const stepReorderCmd = step.command("reorder").description("Reorder steps on a template").argument("<template-id>", "numeric template id").option("--file <path>", "JSON array of {id, index, y_index}").option("--order <pairs>", 'Shorthand: "id:n,id2:n2,..." (mutually exclusive with --file)').option("--confirm-token <token>", "Token from a prior plan step").action(
+  const stepReorderCmd = step2.command("reorder").description("Reorder steps on a template").argument("<template-id>", "numeric template id").option("--file <path>", "JSON array of {id, index, y_index}").option("--order <pairs>", 'Shorthand: "id:n,id2:n2,..." (mutually exclusive with --file)').option("--confirm-token <token>", "Token from a prior plan step").action(
     async (tidRaw, opts) => {
       const templateId = parsePositiveIntId2(tidRaw, "template id");
       if ((opts.file === void 0 || opts.file === "") && (opts.order === void 0 || opts.order === "")) {
@@ -66253,15 +66598,15 @@ var MAX_ATTACHMENT_FILENAME_LENGTH = 500;
 function writeManualSteps(out, steps) {
   if (steps.length === 0) return;
   out.write("\nManual steps:\n");
-  for (const step of steps) {
-    const mark = step.done ? "x" : " ";
-    out.write(`  [${mark}] ${step.n}. (${step.done_by}) ${step.title}
+  for (const step2 of steps) {
+    const mark = step2.done ? "x" : " ";
+    out.write(`  [${mark}] ${step2.n}. (${step2.done_by}) ${step2.title}
 `);
-    if (step.detail !== void 0 && step.detail !== null && step.detail !== "") {
-      out.write(`        ${step.detail}
+    if (step2.detail !== void 0 && step2.detail !== null && step2.detail !== "") {
+      out.write(`        ${step2.detail}
 `);
     }
-    for (const rec of step.records ?? []) {
+    for (const rec of step2.records ?? []) {
       const type = (rec.type ?? "cname").toUpperCase();
       out.write(`        ${type}  ${rec.host ?? "?"}  ->  ${rec.value ?? "?"}
 `);
@@ -66471,9 +66816,9 @@ function renderSmtpResponse(out, resp, asJson) {
     writeJSONIndented(out, resp);
     return;
   }
-  for (const step of resp.steps) {
-    const detail = step.detail === void 0 || step.detail === null || step.detail === "" ? "" : ` - ${step.detail}`;
-    out.write(`${step.status.padEnd(8, " ")}${step.step}${detail}
+  for (const step2 of resp.steps) {
+    const detail = step2.detail === void 0 || step2.detail === null || step2.detail === "" ? "" : ` - ${step2.detail}`;
+    out.write(`${step2.status.padEnd(8, " ")}${step2.step}${detail}
 `);
   }
   const scope = resp.team_id === null ? "org-wide" : `team ${resp.team_id}`;

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.119",
+  "cliVersion": "1.6.121",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {
@@ -2315,6 +2315,14 @@
         }
       ]
     },
+    "filebox rescan-version": {
+      "requires": [
+        {
+          "resource": "fileboxes",
+          "action": "write"
+        }
+      ]
+    },
     "widgets list": {
       "requires": [
         {

package/dist/skills/dr-cli/SKILL.md

@@ -285,7 +285,8 @@ area's gotchas.
 
 **Fileboxes & documents** → [reference/filebox-documents.md](reference/filebox-documents.md)
 - `filebox list|get|versions|tags|sheets|preview|create|upload|upload-version|update|download` (alias `fileboxes`)
-- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-label|set-version-workflow|set-version-file-status|set-version-cycle`
+- `filebox archive|archive-version|restore-version|set-version-include|set-version-date-tag|set-version-label|set-version-workflow|set-version-file-status|set-version-cycle|rescan-version`
+  - _re-extract one version in place (UI version "Rescan"): `rescan-version <vid>` (two-step confirm; only that version, current datamappers, tags unchanged, rows replaced not doubled) — the way to redo a live version that is not the newest_
   - _archived versions (opt-in; defaults unchanged): `versions --archived|--all` to discover them; `archive-version`/`restore-version` also take `--doc` + `--version-number <n>` or `--latest-archived`/`--latest-active`_
   - _include in database: `versions --included` lists the versions whose `include_file` flag is on (intent, not delivered rows); `set-version-include <vid> --include on|off` writes the flag (two-step confirm both ways — off deletes the version's table rows, on queues an ETL scan). `--doc <id> --all-except-latest` is the bulk cleanup; it never targets the latest, and warns in the plan if the latest is itself excluded_
 - `filebox share|shares|set-option|set-tag-config|set-parent|lock|unlock|lock-date-tag|unlock-date-tag|locked-date-tags`
@@ -561,7 +562,9 @@ status` again. This is a **full historical** rescan (every calc field × every
 version). To only pick up a datamapper change on the live template, prefer
 `datamappers update <id> --payload-file <p> --rescan latest` (latest version of
 the mapper's bound documents only) — far cheaper and lower-blast. It publishes a
-new mapper version, so the mapper gets a **new id**, which dr prints.
+new mapper version, so the mapper gets a **new id**, which dr prints. To redo
+**one version** (e.g. a live version that is not the newest), use `filebox
+rescan-version <vid>` — the UI's per-version Rescan, no new mapper id.
 
 **Build a `create` body from plain-English intent** (calc models, datamappers,
 metrics): you resolve names → integer IDs yourself against the tenant

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -114,11 +114,51 @@ set-version-include` (below).
     damage, then `filebox set-version-include --doc <doc> --all-except-latest
     --include off`.
 
+### Re-extract one version (rescan-version)
+
+- `filebox rescan-version <vid> [--table <table_id> …] [--json]` — re-extract
+  **one** version into its tables **in place**, without changing its tags: the
+  UI's version row "three dots > Rescan". It sends the same request the UI does
+  (`POST /api/buckets/<bucket>/rescan_versions` with that one version id and the
+  filebox's tables), so the server does all the work:
+  - **Which versions:** only the one you name. The server does not widen it to
+    the other versions of the filebox or of a collection process; to redo
+    several, run it once per version. It runs with the tables' **current**
+    datamappers — no datamapper is published, no mapper gets a new id, no tag
+    changes.
+  - **Rows are replaced, not doubled:** the load deletes that version's existing
+    rows in each table before writing the new ones.
+  - **Tables:** by default every active table this filebox is mapped into —
+    the tables the server will actually re-extract into (the UI offers every
+    table of the bucket, and the server silently drops the ones this filebox
+    does not feed). `--table` (repeatable) narrows it; an id this filebox does
+    not feed is refused rather than sent and skipped.
+  - This is the way to re-extract a live version that is **not the newest** in
+    its filebox — `datamappers update|bind --rescan latest` only reach the
+    newest, and `rescan table` redoes the whole table.
+  - **Two-step confirm** (Tier B, like `rescan table`: token only): the first
+    run prints the version, its filebox and bucket, its tags, the tables, and a
+    token; re-run with `--confirm-token`. The token is bound to the version and
+    to the exact table set the plan showed: if a table starts or stops being fed
+    in between, the token no longer matches — re-run the plan. Then poll `scans
+    status <table_id>`.
+  - Refused up front, with the remedy: an **archived** version
+    (`restore-version` first) and a version **excluded from the database**
+    (`set-version-include <vid> --include on`, which queues the extraction
+    itself). The server answers `"ok"` even when it filtered everything out, so
+    the success line means "queued", not "rows written" — check `scans status`.
+  - Needs read access to the filebox; a scoped credential needs
+    `fileboxes:write`.
+
 ### Version tagging
 
 - `filebox set-version-date-tag <vid> --doc <id> --month|--quarter|--day|--year|--week …
   [--json]` — set the date tag on one version (resolves the tag id from the doc's
-  config; other tags untouched).
+  config; other tags untouched in `tags`). It sends the date tag alone, and the
+  server rebuilds the version's dimension value from the submitted tags, so on
+  a filebox with a second dimension tag (a cycle or plan LIST tag) that tag
+  drops out of the dimension. On a planning filebox use `set-version-cycle`,
+  which sends the date and the cycle together.
 - `filebox set-version-label <vid> --label "<text>" | --clear [--json]` — set or
   remove a version's free-text label; name, date and dimension tags are
   untouched, and a locked date tag does not block it. No confirm step. Address it
@@ -140,6 +180,27 @@ set-version-include` (below).
   moves that version to Draft (the output names it). The status is read back and
   re-applied once if it did not stick. The write queues a rescan of the version,
   so mapped tables show the new `File Status` only after it finishes.
+  Like the UI, it sends the version's **full tag set** with File Status
+  replaced, not File Status alone. The server merges the submitted tags into
+  `tags` but rebuilds the version's dimension value, and with it the
+  `date_tag_value` that `filebox versions --json` shows, from the submitted tags
+  only. A File Status-only body (CLI releases before DR-54157) therefore left
+  `date_tag_value` null while `tags` still held the month. That is not harmless:
+  the server uses the dimension value to pick the latest version per period, to
+  apply date locks and in rescan events. The command reads `date_tag_value` back,
+  re-applies the full set once if it changed, and otherwise reports it: a stderr
+  warning, a `date_tag_value NOT preserved` line, and
+  `date_tag_value_preserved: false` in `--json`. `--json` also returns
+  `date_tag_value`, and `date_tag_value_preserved: null` when the server does
+  not serve it. **To repair a version left with a null date**, run
+  `set-version-date-tag` with the period its `tags` hold. That writes the date
+  tag, and the server rebuilds the dimension from it. It sends the date tag
+  alone, so use it only when the date is the filebox's only dimension tag. On a
+  planning filebox, run `set-version-cycle` with the version's existing date
+  and scenario instead, which sends both. Re-running
+  `set-version-file-status` with the same status does not repair it, because
+  it writes nothing. A real status change does restore it, because it re-sends
+  the date tag.
 - `filebox set-version-cycle <vid> --doc <id> --date <date> --scenario <name>
   [--date-tag-name <n>] [--json]` — **forecast/budget (planning) fileboxes only.**
   Sets the cycle date tag and the scenario LIST-tag together (both flags

package/dist/skills/dr-cli/reference/safety.md

@@ -27,7 +27,8 @@ delete`, `devices command-delete`, `validate onboarding session delete`,
 `cash hidden-rules upsert|delete`, `forecast` lock/unlock/default/delete/clone
 verbs, `workflow`/`mec workflow` create/update/activate/delete and friends,
 `collection-processes` create/mutate verbs, and the non-`delete` mutations
-`templates set-field-type`, `rescan table`, `features orgs add|remove`,
+`templates set-field-type`, `rescan table`, `filebox rescan-version`,
+`features orgs add|remove`,
 `dashboards push`, `filebox push`, and `reconciliation accounts
 set-assignee|clear-assignee|set-due-date|sign|update-settings`. When
 in doubt, run the command without a token and read the plan output.
@@ -82,7 +83,9 @@ stop it, so check the destination afterwards.
 Everything else gated is Tier B (all `create`/`update`/`reorder`/`set-*`/`lock`/
 `unlock` verbs, `templates set-field-type`, `rescan table` (a full historical
 rescan — expensive/high-blast but reversible, so token-only; the plan step shows
-the document + version counts), `metrics re-aggregate`, `metrics migrate` (the
+the document + version counts), `filebox rescan-version` (the same, for one
+version: re-extracts it in place and replaces its rows, never deletes; the plan
+shows the version, filebox, tags and tables), `metrics re-aggregate`, `metrics migrate` (the
 org-wide V1→V2 backfill — deletes nothing, but **overwrites**
 `category`/`time_aggregation` with the name-derived mapping, hand-set values
 included; per-metric before→after is in the response `details[]`. A

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.119",
+  "version": "1.6.121",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {