@datarails-ai/dr-cli 1.6.122 → 1.6.123

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.122",
+  version: "1.6.123",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-12T10:51:59.680Z";
+var BUILD_TIME = "2026-10-12T11:20:38.309Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -891,7 +891,7 @@ async function exchangeApiKey(host, apiKey, options) {
 }
 function describeApiKeyExchangeFailure(err, identity2) {
   if (err.httpStatus === 401) {
-    return `the server refused the API key for ${identity2} \u2014 it may be revoked or expired, API keys may not be enabled for your organization (ask an admin), or the server may be temporarily unable to evaluate that.`;
+    return `the server refused the API key for ${identity2} \u2014 it may be revoked or expired, API keys may not be enabled for your organization (ask an admin), or the server may be temporarily unable to evaluate that. If the key was revoked or expired, start a new session with a new key; retrying with this one will not help.`;
   }
   if (err.httpStatus === 404) {
     return `${identity2}: this server does not support API keys (the exchange endpoint answered 404).`;
@@ -37600,22 +37600,68 @@ async function runFileboxSetVersionWorkflow(cfg) {
       `document ${cfg.docId} has no WORKFLOW tag in its config (available: ${availMsg})`
     );
   }
-  const tagsToUpdate = JSON.stringify([
-    { id: tag.id, value: cfg.status, name: "WORKFLOW", label: cfg.status }
-  ]);
-  const res = await setVersionTagsAndLabel(
-    cfg.client,
-    cfg.versionId,
-    { tags_to_update: tagsToUpdate },
-    { signal: cfg.signal }
-  );
-  if (res.status >= 200 && res.status < 300) {
-    cfg.out.write(`Set WORKFLOW tag on version ${cfg.versionId}: "${cfg.status}".
-`);
+  const err = cfg.err ?? process.stderr;
+  const { target } = await loadTargetVersion(cfg.client, cfg.docId, cfg.versionId, cfg.signal);
+  const current = tagValueOf(target.tags, tag.id);
+  const previous = typeof current === "string" ? current : null;
+  const writer = new FullTagSetWriter({
+    client: cfg.client,
+    docId: cfg.docId,
+    versionId: cfg.versionId,
+    snapshot: target.tags,
+    tag: { id: tag.id, value: cfg.status, name: tag.name, label: cfg.status },
+    action: "set version workflow",
+    signal: cfg.signal,
+    sleep: cfg.sleep,
+    settleMs: cfg.tagSettleDelayMs
+  });
+  await writer.write();
+  const kept = await keepDateTagValue({
+    writer,
+    seen: await writer.readBack(),
+    dateBefore: target.date_tag_value,
+    versionId: cfg.versionId,
+    docId: cfg.docId,
+    what: "WORKFLOW tag",
+    signal: cfg.signal,
+    err
+  });
+  const { seen, dateAfter, datePreserved } = kept;
+  const now = seen === null ? void 0 : tagValueOf(seen.tags, tag.id);
+  const verified = seen !== null && now === cfg.status;
+  if (seen === null) {
+    err.write(
+      `warning: could not read version ${cfg.versionId} back to verify its WORKFLOW tag \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
+`
+    );
+  } else if (!verified) {
+    err.write(
+      `warning: version ${cfg.versionId} reads WORKFLOW ${JSON.stringify(now ?? null)} after the write, not "${cfg.status}" \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
+`
+    );
+  }
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, {
+      version_id: cfg.versionId,
+      doc_id: cfg.docId,
+      tag_id: tag.id,
+      previous,
+      status: cfg.status,
+      verified,
+      reapplied: kept.reapplied,
+      date_tag_value: dateAfter,
+      date_tag_value_preserved: datePreserved
+    });
     return;
   }
-  const body = await res.text();
-  throw new Error(`set version workflow refused (HTTP ${res.status}): ${body.trim()}`);
+  const verdict = !verified ? "unverified" : kept.reapplied ? "verified after one re-apply" : "verified";
+  cfg.out.write(
+    `Set WORKFLOW tag on version ${cfg.versionId}: ${JSON.stringify(previous ?? "(unset)")} -> "${cfg.status}" (${verdict}).
+`
+  );
+  if (datePreserved === false) {
+    cfg.out.write(dateNotPreservedLine(dateAfter, target.date_tag_value));
+  }
 }
 var FILE_STATUS_VALUES = ["Draft", "Final"];
 function parseFileStatus(raw) {
@@ -37716,6 +37762,110 @@ function fullTagSetWith(stored, write) {
   }
   return [...kept, write].sort((a, b) => a.id - b.id);
 }
+var FullTagSetWriter = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+    this.base = cfg.snapshot ?? [];
+  }
+  cfg;
+  base;
+  /** PUT the full set; a non-2xx answer throws `TagWriteRefusedError`. */
+  async write() {
+    const { cfg } = this;
+    const res = await setVersionTagsAndLabel(
+      cfg.client,
+      cfg.versionId,
+      { tags_to_update: JSON.stringify(fullTagSetWith(this.base, cfg.tag)) },
+      { signal: cfg.signal }
+    );
+    if (res.status < 200 || res.status >= 300) {
+      const body = (await res.text()).trim();
+      throw new TagWriteRefusedError(
+        `${cfg.action} refused (HTTP ${res.status}): ${body}`,
+        `(HTTP ${res.status}): ${body}`
+      );
+    }
+  }
+  /** Wait the settle delay, then read the version back (`null` = unreadable). */
+  async readBack() {
+    const { cfg } = this;
+    const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
+    await sleep3(cfg.settleMs ?? CYCLE_TAG_SETTLE_DELAY_MS, cfg.signal);
+    return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
+  }
+  /** Build the next write from this read-back instead of the earlier snapshot. */
+  refreshBase(v) {
+    if (v !== null && v.tags.length > 0) {
+      this.base = v.tags;
+    }
+  }
+};
+async function keepDateTagValue(cfg) {
+  const { dateBefore, err } = cfg;
+  let seen = cfg.seen;
+  const dateMoved = (v) => v !== null && typeof dateBefore === "number" && v.row.date_tag_value !== void 0 && v.row.date_tag_value !== dateBefore;
+  let reapplied = false;
+  let dateUnknown = false;
+  if (dateMoved(seen)) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} changed (${JSON.stringify(dateBefore)} -> ${JSON.stringify(seen.row.date_tag_value ?? null)}) when its ${cfg.what} was set; re-applying the full tag set once
+`
+    );
+    reapplied = true;
+    cfg.writer.refreshBase(seen);
+    let refused = false;
+    try {
+      await cfg.writer.write();
+    } catch (e) {
+      if (cfg.signal.aborted) {
+        throw e;
+      }
+      if (e instanceof TagWriteRefusedError) {
+        refused = true;
+        err.write(`warning: re-applying the full tag set was refused ${e.reason}
+`);
+      } else {
+        err.write(
+          `warning: re-applying the full tag set failed (${e instanceof Error ? e.message : String(e)}); its outcome is unknown, reading the version again
+`
+        );
+      }
+    }
+    const after = refused ? seen : await cfg.writer.readBack();
+    if (after === null) {
+      dateUnknown = true;
+      err.write(
+        `warning: could not read version ${cfg.versionId} back to confirm its date_tag_value after re-applying the full tag set \u2014 check it with \`dr filebox versions ${cfg.docId} --json\`
+`
+      );
+    } else {
+      seen = after;
+    }
+  }
+  const dateAfter = dateUnknown || seen === null || seen.row.date_tag_value === void 0 ? null : seen.row.date_tag_value;
+  const datePreserved = dateUnknown || seen === null || dateBefore === void 0 || seen.row.date_tag_value === void 0 ? null : !dateMoved(seen);
+  if (datePreserved === false) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} is still ${JSON.stringify(dateAfter)} (was ${JSON.stringify(dateBefore)}) after one re-apply; its tags still carry the date. Restore it with \`dr filebox set-version-date-tag ${cfg.versionId} --doc ${cfg.docId} --<dimension> <date>\` (it sends the date tag alone; on a planning filebox use \`dr filebox set-version-cycle ${cfg.versionId} --doc ${cfg.docId} --date <date> --scenario <name>\` instead, which keeps the cycle), then check \`dr filebox versions ${cfg.docId} --json\`
+`
+    );
+  }
+  return { seen, reapplied, dateAfter, datePreserved };
+}
+function dateNotPreservedLine(dateAfter, dateBefore) {
+  return `date_tag_value NOT preserved: it reads ${JSON.stringify(dateAfter)}, was ${JSON.stringify(dateBefore)} (see the warning above).
+`;
+}
+async function loadTargetVersion(client, docId, versionId, signal) {
+  const rows = await listVersions(client, docId, { includeAutoSaves: true }, { signal });
+  const target = rows.find((r) => r.id === versionId);
+  if (target === void 0) {
+    throw new Error(
+      `version ${versionId} is not a version of filebox ${docId} \u2014 list them with \`dr filebox versions ${docId} --all\``
+    );
+  }
+  return { rows, target };
+}
 async function runFileboxSetVersionFileStatus(cfg) {
   if (cfg.docId <= 0) {
     throw new Error("document id must be positive");
@@ -37724,8 +37874,6 @@ async function runFileboxSetVersionFileStatus(cfg) {
     throw new Error("version id must be positive");
   }
   const err = cfg.err ?? process.stderr;
-  const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
-  const settleMs = cfg.tagSettleDelayMs ?? CYCLE_TAG_SETTLE_DELAY_MS;
   const details = await getDetails(cfg.client, cfg.docId, { signal: cfg.signal });
   const tag = (details.tags_config ?? []).find(isFileStatusTag);
   if (tag === void 0) {
@@ -37739,18 +37887,12 @@ async function runFileboxSetVersionFileStatus(cfg) {
       `File Status on document ${cfg.docId} does not allow "${cfg.status}" (allowed: ${tag.values.map((v) => JSON.stringify(v)).join(" | ")})`
     );
   }
-  const rows = await listVersions(
+  const { rows, target } = await loadTargetVersion(
     cfg.client,
     cfg.docId,
-    { includeAutoSaves: true },
-    { signal: cfg.signal }
+    cfg.versionId,
+    cfg.signal
   );
-  const target = rows.find((r) => r.id === cfg.versionId);
-  if (target === void 0) {
-    throw new Error(
-      `version ${cfg.versionId} is not a version of filebox ${cfg.docId} \u2014 list them with \`dr filebox versions ${cfg.docId} --all\``
-    );
-  }
   const current = tagValueOf(target.tags, tag.id);
   const previous = typeof current === "string" ? current : null;
   const options = tag.options ?? {};
@@ -37803,45 +37945,25 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
-  const statusWrite = {
-    id: tag.id,
-    value: cfg.status,
-    name: tag.name,
-    label: cfg.status
-  };
-  let base = target.tags ?? [];
-  const refreshBase = (v) => {
-    if (v !== null && v.tags.length > 0) {
-      base = v.tags;
-    }
-  };
-  const write = async () => {
-    const res = await setVersionTagsAndLabel(
-      cfg.client,
-      cfg.versionId,
-      { tags_to_update: JSON.stringify(fullTagSetWith(base, statusWrite)) },
-      { signal: cfg.signal }
-    );
-    if (res.status < 200 || res.status >= 300) {
-      const body = await res.text();
-      throw new TagWriteRefusedError(
-        `set version file status refused (HTTP ${res.status}): ${body.trim()}`,
-        `(HTTP ${res.status}): ${body.trim()}`
-      );
-    }
-  };
-  const readBack = async () => {
-    await sleep3(settleMs, cfg.signal);
-    return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
-  };
-  await write();
+  const writer = new FullTagSetWriter({
+    client: cfg.client,
+    docId: cfg.docId,
+    versionId: cfg.versionId,
+    snapshot: target.tags,
+    tag: { id: tag.id, value: cfg.status, name: tag.name, label: cfg.status },
+    action: "set version file status",
+    signal: cfg.signal,
+    sleep: cfg.sleep,
+    settleMs: cfg.tagSettleDelayMs
+  });
+  await writer.write();
   let reapplied = false;
-  let seen = await readBack();
+  let seen = await writer.readBack();
   if (seen !== null && tagValueOf(seen.tags, tag.id) !== cfg.status) {
     reapplied = true;
-    refreshBase(seen);
-    await write();
-    seen = await readBack();
+    writer.refreshBase(seen);
+    await writer.write();
+    seen = await writer.readBack();
     const now = seen === null ? void 0 : tagValueOf(seen.tags, tag.id);
     if (seen !== null && now !== cfg.status) {
       throw new Error(
@@ -37849,53 +37971,19 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
-  const dateBefore = target.date_tag_value;
-  const dateMoved = (v) => v !== null && typeof dateBefore === "number" && v.row.date_tag_value !== void 0 && v.row.date_tag_value !== dateBefore;
-  let dateUnknown = false;
-  if (dateMoved(seen)) {
-    err.write(
-      `warning: date_tag_value on version ${cfg.versionId} changed (${JSON.stringify(dateBefore)} -> ${JSON.stringify(seen.row.date_tag_value ?? null)}) when its File Status was set; re-applying the full tag set once
-`
-    );
-    reapplied = true;
-    refreshBase(seen);
-    let refused = false;
-    try {
-      await write();
-    } catch (e) {
-      if (cfg.signal.aborted) {
-        throw e;
-      }
-      if (e instanceof TagWriteRefusedError) {
-        refused = true;
-        err.write(`warning: re-applying the full tag set was refused ${e.reason}
-`);
-      } else {
-        err.write(
-          `warning: re-applying the full tag set failed (${e instanceof Error ? e.message : String(e)}); its outcome is unknown, reading the version again
-`
-        );
-      }
-    }
-    const after = refused ? seen : await readBack();
-    if (after === null) {
-      dateUnknown = true;
-      err.write(
-        `warning: could not read version ${cfg.versionId} back to confirm its date_tag_value after re-applying the full tag set \u2014 check it with \`dr filebox versions ${cfg.docId} --json\`
-`
-      );
-    } else {
-      seen = after;
-    }
-  }
-  const dateAfter = dateUnknown || seen === null || seen.row.date_tag_value === void 0 ? null : seen.row.date_tag_value;
-  const datePreserved = dateUnknown || seen === null || dateBefore === void 0 || seen.row.date_tag_value === void 0 ? null : !dateMoved(seen);
-  if (datePreserved === false) {
-    err.write(
-      `warning: date_tag_value on version ${cfg.versionId} is still ${JSON.stringify(dateAfter)} (was ${JSON.stringify(dateBefore)}) after one re-apply; its tags still carry the date. Restore it with \`dr filebox set-version-date-tag ${cfg.versionId} --doc ${cfg.docId} --<dimension> <date>\` (it sends the date tag alone; on a planning filebox use \`dr filebox set-version-cycle ${cfg.versionId} --doc ${cfg.docId} --date <date> --scenario <name>\` instead, which keeps the cycle), then check \`dr filebox versions ${cfg.docId} --json\`
-`
-    );
-  }
+  const kept = await keepDateTagValue({
+    writer,
+    seen,
+    dateBefore: target.date_tag_value,
+    versionId: cfg.versionId,
+    docId: cfg.docId,
+    what: "File Status",
+    signal: cfg.signal,
+    err
+  });
+  seen = kept.seen;
+  reapplied ||= kept.reapplied;
+  const { dateAfter, datePreserved } = kept;
   if (seen === null) {
     err.write(
       `warning: could not read version ${cfg.versionId} back to verify its File Status \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
@@ -37934,10 +38022,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
 `
   );
   if (datePreserved === false) {
-    cfg.out.write(
-      `date_tag_value NOT preserved: it reads ${JSON.stringify(dateAfter)}, was ${JSON.stringify(dateBefore)} (see the warning above).
-`
-    );
+    cfg.out.write(dateNotPreservedLine(dateAfter, target.date_tag_value));
   }
   if (demotedIds.length > 0) {
     cfg.out.write(
@@ -39635,33 +39720,41 @@ function registerFileboxCommand(root) {
   ).requiredOption(
     "--status <s>",
     "New WORKFLOW value: Not Started | In Progress | Pending | Approved | Rejected. Setting Approved requires the `approve_workflow` permission server-side."
-  ).action(async (idStr, opts) => {
-    const versionId = parseFileboxIdArg(idStr);
-    if (opts.doc === void 0 || opts.doc === "") {
-      throw new Error("--doc is required");
-    }
-    const docId = parseFileboxIdArg(opts.doc);
-    const raw = opts.status ?? "";
-    if (!WORKFLOW_STATUSES.includes(raw)) {
-      throw new Error(
-        `invalid --status "${raw}" (expected one of: ${WORKFLOW_STATUSES.map((s) => `"${s}"`).join(" | ")})`
-      );
-    }
-    const status2 = raw;
-    const setup = await setupCall(opts.server, opts.account);
-    try {
-      await runFileboxSetVersionWorkflow({
-        client: setup.client,
-        docId,
-        versionId,
-        status: status2,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    } finally {
-      setup.cleanup();
+  ).option(
+    "--json",
+    "Output a JSON record describing the write instead of the human confirmation",
+    false
+  ).action(
+    async (idStr, opts) => {
+      const versionId = parseFileboxIdArg(idStr);
+      if (opts.doc === void 0 || opts.doc === "") {
+        throw new Error("--doc is required");
+      }
+      const docId = parseFileboxIdArg(opts.doc);
+      const raw = opts.status ?? "";
+      if (!WORKFLOW_STATUSES.includes(raw)) {
+        throw new Error(
+          `invalid --status "${raw}" (expected one of: ${WORKFLOW_STATUSES.map((s) => `"${s}"`).join(" | ")})`
+        );
+      }
+      const status2 = raw;
+      const setup = await setupCall(opts.server, opts.account, { timeoutMs: 5 * 6e4 });
+      try {
+        await runFileboxSetVersionWorkflow({
+          client: setup.client,
+          docId,
+          versionId,
+          status: status2,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout,
+          err: process.stderr
+        });
+      } finally {
+        setup.cleanup();
+      }
     }
-  });
+  );
   addServerFlag(setVersionWorkflowCmd);
   addAccountFlag(setVersionWorkflowCmd);
   const setVersionFileStatusCmd = fb.command("set-version-file-status").description(

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.122",
+  "cliVersion": "1.6.123",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/reference/filebox-documents.md

@@ -170,8 +170,16 @@ set-version-include` (below).
   control characters, and not `auto-calculated` (reserved by the server for
   versions it generates); pass the label as one quoted argument. Needs change
   rights on the filebox or to be the version's uploader (HTTP 405 otherwise).
-- `filebox set-version-workflow <vid> --doc <id> --status <Not Started|In Progress|Pending|Approved|Rejected>`
-  — set the workflow LIST-tag value (setting `Approved` requires `approve_workflow`).
+- `filebox set-version-workflow <vid> --doc <id> --status <Not Started|In Progress|Pending|Approved|Rejected>
+  [--json]` — set the workflow LIST-tag value (setting `Approved` requires
+  `approve_workflow`). Like `set-version-file-status` below, it sends the
+  version's **full tag set** with WORKFLOW replaced, and reads the version back:
+  the WORKFLOW value is checked, and `date_tag_value` is re-applied once and
+  reported exactly as that command does (`date_tag_value`,
+  `date_tag_value_preserved`, `verified`, `reapplied` and `previous` in
+  `--json`). A WORKFLOW-only body (CLI releases before DR-55186) left the
+  version's `date_tag_value` null while `tags` still held the month; repair such
+  a version the way the `set-version-file-status` entry describes.
 - `filebox set-version-file-status <vid> --doc <id> --status <Draft|Final> [--json]`
   — set the File Status LIST-tag value (other tags untouched). This is how a
   version uploaded with `upload-version` (always Draft) is made Final without the
@@ -226,6 +234,11 @@ set-version-include` (below).
   tag's `sub_type`/name; a forecast filebox's `Forecast (New)` tag has none, so
   only the tag's presence is checked there. The scenario tag is compared
   exactly.
+  It sends those two tags only, and the server rebuilds the version's
+  dimension value from them. That is right when the filebox's dimension tags
+  are exactly the date and the scenario, as on the planning fileboxes this
+  command is for; a third dimension tag would drop out of the dimension.
+  `upload-version --date --scenario` writes the same two-tag body.
   On an upload the confirmed row is also cross-checked against the upload
   response (version number, name, filebox) — if the response only carried a
   `latest_version_id` the cascade had already moved, the tag went to the wrong

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.122",
+  "version": "1.6.123",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {