@datarails-ai/dr-cli 1.6.122 → 1.6.124

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.122",
+  version: "1.6.124",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-12T10:51:59.680Z";
+var BUILD_TIME = "2026-10-12T11:50:53.998Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -891,7 +891,7 @@ async function exchangeApiKey(host, apiKey, options) {
 }
 function describeApiKeyExchangeFailure(err, identity2) {
   if (err.httpStatus === 401) {
-    return `the server refused the API key for ${identity2} \u2014 it may be revoked or expired, API keys may not be enabled for your organization (ask an admin), or the server may be temporarily unable to evaluate that.`;
+    return `the server refused the API key for ${identity2} \u2014 it may be revoked or expired, API keys may not be enabled for your organization (ask an admin), or the server may be temporarily unable to evaluate that. If the key was revoked or expired, start a new session with a new key; retrying with this one will not help.`;
   }
   if (err.httpStatus === 404) {
     return `${identity2}: this server does not support API keys (the exchange endpoint answered 404).`;
@@ -4474,13 +4474,14 @@ function isBatchTimeoutClamped(callCount) {
   const n = Number.isFinite(callCount) ? Math.max(1, Math.floor(callCount)) : 1;
   return DEFAULT_CALL_TIMEOUT_MS + n * BATCH_PER_TARGET_TIMEOUT_MS > BATCH_MAX_TIMEOUT_MS;
 }
-function extendForBatch(extend, callCount) {
+var TIMEOUT_FLAG_REMEDY = "re-run it with --timeout <seconds> (a floor, so a larger value only ever widens the budget)";
+function extendForBatch(extend, callCount, remedy = TIMEOUT_FLAG_REMEDY) {
   extend?.(batchTimeoutMs(callCount));
   if (!isBatchTimeoutClamped(callCount)) return;
   const budgetS = BATCH_MAX_TIMEOUT_MS / 1e3;
   const perCallMs = Math.floor(BATCH_MAX_TIMEOUT_MS / Math.floor(callCount));
   process.stderr.write(
-    `warning: ${callCount} calls exceed the ${budgetS}s ceiling on the auto-sized budget \u2014 about ${perCallMs}ms per call. If the run aborts part-way, re-run it with --timeout <seconds> (a floor, so a larger value only ever widens the budget).
+    `warning: ${callCount} calls exceed the ${budgetS}s ceiling on the auto-sized budget \u2014 about ${perCallMs}ms per call. If the run aborts part-way, ${remedy}.
 `
   );
 }
@@ -5419,8 +5420,8 @@ async function openBrowser(url) {
 async function readLine(stdin) {
   return new Promise((resolve3, reject) => {
     let data4 = "";
-    const onData = (chunk) => {
-      data4 += chunk.toString();
+    const onData = (chunk2) => {
+      data4 += chunk2.toString();
       const i = data4.indexOf("\n");
       if (i >= 0) {
         cleanup();
@@ -5512,8 +5513,8 @@ async function readHiddenLineFromTty(prompt, stdin, out) {
       cleanup();
       reject(err);
     };
-    const onData = (chunk) => {
-      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const onData = (chunk2) => {
+      const s = typeof chunk2 === "string" ? chunk2 : chunk2.toString("utf8");
       for (const ch of s) {
         if (ch === "\r" || ch === "\n") {
           cleanup();
@@ -5561,8 +5562,8 @@ async function readFirstLineFromPipe(stdin) {
       cleanup();
       resolve3(line.endsWith("\r") ? line.slice(0, -1) : line);
     };
-    const onData = (chunk) => {
-      data4 += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const onData = (chunk2) => {
+      data4 += typeof chunk2 === "string" ? chunk2 : chunk2.toString("utf8");
       const i = data4.indexOf("\n");
       if (i >= 0) finish(data4.slice(0, i));
     };
@@ -6371,15 +6372,15 @@ async function commandDelete(client, id, options) {
 function strOr(s, fallback) {
   return s === "" ? fallback : s;
 }
-function parsePositiveIntsArgs(args) {
+function parsePositiveIntsArgs(args, label = "device id") {
   const out = [];
   for (const a of args) {
     const n = Number(a);
     if (!Number.isInteger(n) || String(n) !== a) {
-      throw new Error(`invalid device id "${a}": not a number`);
+      throw new Error(`invalid ${label} "${a}": not a number`);
     }
     if (n <= 0) {
-      throw new Error(`invalid device id "${a}": must be positive`);
+      throw new Error(`invalid ${label} "${a}": must be positive`);
     }
     out.push(n);
   }
@@ -6392,6 +6393,16 @@ function parsePositiveIntArg(raw, label) {
   }
   return n;
 }
+function chunk(items, size) {
+  if (!Number.isInteger(size) || size <= 0) {
+    throw new Error("chunk: size must be a positive integer");
+  }
+  const out = [];
+  for (let i = 0; i < items.length; i += size) {
+    out.push(items.slice(i, i + size));
+  }
+  return out;
+}
 
 // src/commands/_retry.ts
 var AMBIGUOUS_STATUSES = /* @__PURE__ */ new Set([502, 504, 524]);
@@ -19121,6 +19132,22 @@ async function updateAutoCalculateSettings(client, docId, body, reqOptions) {
 async function downloadVersion(client, versionId, reqOptions) {
   return client.do("GET", `/api/documents/versions/${versionId}/file`, void 0, reqOptions);
 }
+var KIND_EXPLANATION_PATH = "/api/workspace/documents/kind/explanation";
+var KIND_SUMMARY_PATH = "/api/workspace/documents/kind/summary";
+var KIND_EXPLAIN_MAX_IDS = 200;
+var KIND_EXPLAIN_MAX_IDS_WITH_HISTORY = 20;
+function kindExplanationPath(query) {
+  let path12 = `${KIND_EXPLANATION_PATH}?ids=${query.ids.join(",")}`;
+  if (query.asOf !== void 0) path12 += `&as_of=${encodeURIComponent(query.asOf)}`;
+  if (query.history === true) path12 += "&history=true";
+  return path12;
+}
+async function getKindExplanation(client, query, reqOptions) {
+  return client.do("GET", kindExplanationPath(query), void 0, reqOptions);
+}
+async function getKindSummary(client, reqOptions) {
+  return client.do("GET", KIND_SUMMARY_PATH, void 0, reqOptions);
+}
 async function listBucketTemplates(client, bucketId, reqOptions) {
   const out = await client.getJSON(
     `/api/buckets/${bucketId}/templates`,
@@ -35462,6 +35489,678 @@ function registerFileboxAdminCommands(fb, setupCall2, addServerFlag2, addAccount
   addAccountFlag2(vrSetCmd);
 }
 
+// src/commands/_reconciliationDate.ts
+function validateDateString(orig, flagName) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(orig)) {
+    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD)`);
+  }
+  const parts = orig.split("-").map(Number);
+  const [year, month1, day] = parts;
+  const probe = new Date(Date.UTC(year, month1 - 1, day));
+  if (probe.getUTCFullYear() !== year || probe.getUTCMonth() + 1 !== month1 || probe.getUTCDate() !== day) {
+    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD)`);
+  }
+  return { year, month1, day };
+}
+function parseDateFlag(orig, flagName) {
+  let normalized = orig;
+  if (/^\d{4}-\d{2}$/.test(orig)) {
+    normalized = `${orig}-01`;
+  }
+  let year;
+  let month1;
+  try {
+    ({ year, month1 } = validateDateString(normalized, flagName));
+  } catch {
+    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD or YYYY-MM)`);
+  }
+  return Math.floor(Date.UTC(year, month1, 0) / 1e3);
+}
+function parseDateFlagEpoch(orig, flagName) {
+  let normalized = orig;
+  if (/^\d{4}-\d{2}$/.test(orig)) {
+    normalized = `${orig}-01`;
+  }
+  let year;
+  let month1;
+  try {
+    ({ year, month1 } = validateDateString(normalized, flagName));
+  } catch {
+    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD or YYYY-MM)`);
+  }
+  return Math.floor(Date.UTC(year, month1 - 1, 1, 12) / 1e3);
+}
+function parseDateFlagDay(orig, flagName) {
+  const { year, month1, day } = validateDateString(orig, flagName);
+  return Math.floor(Date.UTC(year, month1 - 1, day) / 1e3);
+}
+
+// src/commands/filebox_kind.ts
+function parseKindExplainIds(args) {
+  const parts = args.flatMap((arg) => arg.split(","));
+  return [...new Set(parsePositiveIntsArgs(parts, "filebox id"))];
+}
+function parseKindAsOf(raw) {
+  if (raw === void 0) return void 0;
+  parseDateFlagDay(raw, "--as-of");
+  return raw;
+}
+var SUPPORT_ONLY_CODES = /* @__PURE__ */ new Set([
+  "kind_explanation_support_only",
+  "kind_summary_support_only"
+]);
+function jsonObject(text2) {
+  try {
+    const parsed2 = JSON.parse(text2);
+    if (typeof parsed2 === "object" && parsed2 !== null && !Array.isArray(parsed2)) {
+      return parsed2;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function describeKindErrorBody(text2) {
+  const raw = truncate3(text2.trim(), 200);
+  const body = jsonObject(text2);
+  if (body === void 0) return raw;
+  for (const key of ["message", "detail"]) {
+    const value = body[key];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  const parts = Object.entries(body).map(([field, value]) => {
+    const messages = (Array.isArray(value) ? value : [value]).map(
+      (m) => typeof m === "string" ? m : JSON.stringify(m)
+    );
+    return field === "non_field_errors" ? messages.join("; ") : `${field}: ${messages.join("; ")}`;
+  });
+  return parts.length > 0 ? parts.join("; ") : raw;
+}
+function kindReadError(status2, text2, ctx) {
+  const server = ctx.client.serverKey;
+  const body = jsonObject(text2);
+  const code = typeof body?.["code"] === "string" ? body["code"] : void 0;
+  if (status2 === 405 && code !== void 0 && SUPPORT_ONLY_CODES.has(code)) {
+    const scope = ctx.command === "kind-explain" ? "only the support seat of the fileboxes' own organization gets an answer" : "it answers the support seat of an organization, for that organization";
+    return new Error(
+      `${ctx.command}: the server refused ${ctx.client.email} (HTTP 405 ${code}: ${describeKindErrorBody(text2)}) \u2014 ${scope}. Log in as that organization's support seat, then run the command as it:
+  dr login-as <support seat email> --server ${server}
+  dr filebox ${ctx.command} \u2026 --server ${server} --account <support seat email>`
+    );
+  }
+  if (status2 === 404) {
+    return new Error(
+      `GET ${ctx.route}: HTTP 404 \u2014 ${server} most likely does not have the filebox-type endpoints yet. They ship with dr-datarails-server PR #8010 (DR-53666); until that change is deployed on ${server}, ${ctx.command} has nothing to ask.`
+    );
+  }
+  if (status2 === 400) {
+    return new Error(
+      `${ctx.command}: the server rejected the request (HTTP 400): ${describeKindErrorBody(text2)}`
+    );
+  }
+  if (status2 === 403) {
+    return new Error(
+      `${ctx.command}: the server refused ${ctx.client.email} (HTTP 403): ${describeKindErrorBody(text2)} \u2014 a blocked seat gets this answer. Check the seat with \`dr whoami --server ${server} --account ${ctx.client.email}\`.`
+    );
+  }
+  return new Error(`GET ${ctx.route}: HTTP ${status2}: ${truncate3(text2.trim(), 200)}`);
+}
+async function readKindAnswer(res, ctx) {
+  const text2 = await res.text();
+  if (res.status < 200 || res.status >= 300) throw kindReadError(res.status, text2, ctx);
+  return text2;
+}
+function parseKindBody(text2, route) {
+  try {
+    return JSON.parse(text2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`GET ${route}: decode: ${msg}`);
+  }
+}
+function answeredAsOf(body) {
+  if (typeof body !== "object" || body === null) return void 0;
+  const asOf = body["as_of"];
+  return typeof asOf === "string" ? asOf : void 0;
+}
+function withNewline(text2) {
+  return text2.endsWith("\n") ? text2 : `${text2}
+`;
+}
+function mergeKindBodies(bodies) {
+  const [first, ...rest] = bodies;
+  if (rest.length === 0) return first;
+  const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  if (!isObject(first)) throw new Error("kind-explain: the server answered with no JSON object");
+  const merged = {};
+  for (const [key, value] of Object.entries(first)) {
+    const lists = [value, ...rest.map((body) => isObject(body) ? body[key] : void 0)];
+    merged[key] = lists.every(Array.isArray) ? lists.flatMap((list28) => list28) : value;
+  }
+  return merged;
+}
+async function runFileboxKindExplain(cfg) {
+  if (cfg.ids.length === 0) throw new Error("kind-explain: at least one filebox id is required");
+  const ctx = {
+    command: "kind-explain",
+    route: KIND_EXPLANATION_PATH,
+    client: cfg.client
+  };
+  const batches = chunk(
+    cfg.ids,
+    cfg.history ? KIND_EXPLAIN_MAX_IDS_WITH_HISTORY : KIND_EXPLAIN_MAX_IDS
+  );
+  if (batches.length > 1) {
+    extendForBatch(
+      cfg.extendTimeout,
+      batches.length,
+      "split the ids over several runs (kind-explain has no --timeout)"
+    );
+  }
+  const needsParse = batches.length > 1 || !cfg.asJson;
+  const texts = [];
+  const bodies = [];
+  let asOf = cfg.asOf;
+  for (const [index, ids] of batches.entries()) {
+    const res = await getKindExplanation(
+      cfg.client,
+      { ids, asOf, history: cfg.history },
+      { signal: cfg.signal }
+    );
+    let text2;
+    try {
+      text2 = await readKindAnswer(res, ctx);
+    } catch (err) {
+      if (index === 0 || !(err instanceof Error)) throw err;
+      throw new Error(
+        `request ${index + 1} of ${batches.length} failed, nothing was printed: ${err.message}`
+      );
+    }
+    texts.push(text2);
+    if (!needsParse) continue;
+    const body = parseKindBody(text2, KIND_EXPLANATION_PATH);
+    bodies.push(body);
+    asOf ??= answeredAsOf(body);
+  }
+  if (cfg.asJson) {
+    cfg.out.write(
+      batches.length === 1 ? withNewline(texts[0] ?? "") : `${JSON.stringify(mergeKindBodies(bodies))}
+`
+    );
+    return;
+  }
+  const answer = decodeShape(mergeKindBodies(bodies));
+  renderKindExplanation(cfg.out, answer, { showAsOf: cfg.asOf !== void 0 });
+}
+var KIND_LABELS = {
+  manual_input: "Manual input",
+  model: "Model",
+  report: "Report",
+  lookup: "Lookup",
+  integration: "Integration"
+};
+var FORMAT_LABELS = { excel: "Excel", ppt: "PPT", pdf: "PDF" };
+var NO_SOURCE = "source not recorded";
+var SOURCE_WORDS = {
+  backfill: "migration",
+  creation_flow: "flow",
+  user: "user",
+  support: "support",
+  default: "default",
+  "(none)": NO_SOURCE
+};
+var SOURCE_PHRASES = {
+  backfill: "set by the migration",
+  creation_flow: "set by a flow (at creation, or a connection added later)",
+  user: "set by a user",
+  support: "set by support",
+  default: "set by default"
+};
+var SETTERS = {
+  backfill: "the migration",
+  creation_flow: "a flow",
+  user: "a user",
+  support: "support",
+  default: "default, at creation"
+};
+var UNSURE_PHRASES = {
+  non_latest_version_link_only: "Datarails data is linked only on an older version, not on the latest one",
+  mapper_with_data_source: "a mapper and a data source, but nothing pulled out of Datarails: an intake file or an integration",
+  empty_doc_type: "the file has no extension, so its format says nothing",
+  broken_dimension_tags_json: "the filebox's tags could not be read",
+  archived: "the filebox is archived",
+  format_signal_cannot_identify_a_deck: "neither its connections nor its extension say what it is"
+};
+var HISTORY_REASONS = {
+  lookup_attached_to_table: "a table attached it as a lookup",
+  // The old "Filebox type" setting and the report builder both record these.
+  use_type_set_to_lookup: "a LUT/FX label set",
+  use_type_relabelled_out_of_lookup: "a LUT/FX label removed",
+  data_source_connected: "a data source was connected while it was empty",
+  data_source_connected_to_a_report: "a data source was connected to a Report",
+  cloud_drive_connected: "a synced cloud-drive file was connected while it was empty",
+  cloud_drive_connected_to_a_report: "a synced cloud-drive file was connected to a Report",
+  email_upload_turned_on: "email upload turned on",
+  api_upload_turned_on: "API upload turned on",
+  report_format_from_first_file: "its first file set the Report's format"
+};
+var SELF_SERVE_KINDS = /* @__PURE__ */ new Set(["manual_input", "model", "report"]);
+var UPLOAD_CHANNEL_WORDS = { email: "email", api: "API" };
+var EVIDENCE_LABELS = [
+  ["mappers", "mapper"],
+  ["lookup_tables", "lookup"],
+  ["pulled_out", "pulled"],
+  ["read_into", "read into"],
+  ["data_query", "source"],
+  ["cloud_drive", "drive"],
+  ["budget_builder", "budget"],
+  ["upload_channels", "upload"]
+];
+var SEPARATOR = " | ";
+var LABEL_WIDTH = 10;
+var AGREES_COLUMN = 44;
+function kindLabel(token) {
+  return KIND_LABELS[token] ?? token;
+}
+function kindsText(kinds, reportFormat) {
+  if (kinds.length === 0) return "no type";
+  return kinds.map(
+    (kind) => kind === "report" && reportFormat !== null ? `Report (${FORMAT_LABELS[reportFormat] ?? reportFormat})` : kindLabel(kind)
+  ).join(" + ");
+}
+function setBy(source) {
+  if (source === null || source === void 0) return NO_SOURCE;
+  return SOURCE_PHRASES[source] ?? `set by ${source}`;
+}
+function storedText(stored) {
+  if (stored === null) return "no type yet";
+  const [firstSource] = stored.sources;
+  if (stored.sources.every((source) => source === firstSource)) {
+    return `${kindsText(stored.kinds, stored.report_format)}, ${setBy(firstSource)}`;
+  }
+  return stored.kinds.map((kind, i) => `${kindsText([kind], stored.report_format)}, ${setBy(stored.sources[i])}`).join("; ");
+}
+function flowNote(answer) {
+  if (answer.history !== void 0 || !answer.stored?.sources.includes("creation_flow")) return [];
+  return ["--history shows a connection added later; a creation records nothing"];
+}
+function slotsText(slots) {
+  if (slots === null || slots.primary === null) return "no type";
+  const kinds = [slots.primary, slots.secondary].filter((k) => k !== null);
+  return kindsText(kinds, slots.report_format);
+}
+function momentText(iso) {
+  const ms = Date.parse(iso);
+  return Number.isFinite(ms) ? formatUnixSeconds(Math.floor(ms / 1e3)) : iso;
+}
+function splitReasons(text2) {
+  return text2 === null || text2 === void 0 || text2 === "" ? [] : text2.split(SEPARATOR);
+}
+function reasonText(text2) {
+  const colon = text2.indexOf(": ");
+  const token = colon > 0 ? text2.slice(0, colon) : "";
+  const head = Object.hasOwn(KIND_LABELS, token) ? `${kindLabel(token)}${text2.slice(colon)}` : text2;
+  return head.replace(
+    /(does not fit beside )([a-z_+]+)$/,
+    (_match, lead2, slots) => `${lead2}${slots.split("+").map(kindLabel).join(" + ")}`
+  );
+}
+function lookUp(phrases, code) {
+  return (Object.hasOwn(phrases, code) ? phrases[code] : void 0) ?? code;
+}
+function isByHand(source) {
+  return source === "user" || source === "support";
+}
+function settersText(stored) {
+  const [firstSource] = stored.sources;
+  if (stored.sources.every((source) => source === firstSource)) {
+    return firstSource === null || firstSource === void 0 ? `, ${NO_SOURCE}` : ` by ${lookUp(SETTERS, firstSource)}`;
+  }
+  const slots = stored.kinds.map((kind, i) => {
+    const source = stored.sources[i];
+    return source === null || source === void 0 ? `${kindLabel(kind)} (${NO_SOURCE})` : `${kindLabel(kind)} by ${lookUp(SETTERS, source)}`;
+  });
+  return `, ${slots.join(" and ")}`;
+}
+function uploadText(channels) {
+  return `${channels.map((channel) => lookUp(UPLOAD_CHANNEL_WORDS, channel)).join(" and ")} upload`;
+}
+function integrationNotes(integration) {
+  if (integration === null || integration.counts_as_integration || integration.quiet !== true) {
+    return [];
+  }
+  return ["A data source is connected but quiet, so the content decided the type."];
+}
+function uploadKeptModelNotes(stored, derived, integration) {
+  const channels = integration?.upload_channels ?? [];
+  if (channels.length === 0 || !stored.kinds.includes("model") || !derived.includes("integration")) {
+    return [];
+  }
+  const upload2 = uploadText(channels);
+  const several = channels.length > 1;
+  return [
+    `${upload2.charAt(0).toUpperCase()}${upload2.slice(1)} ${several ? "are" : "is"} on: the migration puts Integration in place of a Model, but turning ${several ? "an" : "the"} upload on after it was typed keeps the Model, so the stored type stays ${kindsText(stored.kinds, stored.report_format)}.`
+  ];
+}
+function kindMoveNeedsSupport(current, next) {
+  const held = new Set(current);
+  const wanted = new Set(next);
+  const changed = [...held, ...wanted].filter((kind) => held.has(kind) !== wanted.has(kind));
+  const integrationStays = held.has("integration") && wanted.has("integration");
+  if (integrationStays && changed.every((kind) => kind === "report")) return false;
+  return [...held, ...wanted].some((kind) => !SELF_SERVE_KINDS.has(kind));
+}
+function whoMayChange(stored, derived) {
+  if (kindMoveNeedsSupport(stored, derived)) {
+    return "To change it: the support seat only, in the filebox settings, as Lookup or Integration is held before or after the move.";
+  }
+  return stored.includes("integration") ? "To change it: the owner or the support seat, in the filebox settings: Integration stays, only Report or its format changes." : "To change it: the owner or the support seat, in the filebox settings.";
+}
+function meaningLines(answer) {
+  const derived = kindsText(answer.derived.kinds, answer.derived.report_format);
+  const notes = integrationNotes(answer.integration);
+  if (answer.stored === null) {
+    const why = answer.rollout ? "No type stored yet: the migration has not reached this filebox." : "No type stored: the organization is outside the rollout.";
+    return [why, `The migration would make it ${derived}.`, ...notes];
+  }
+  const stored = `${kindsText(answer.stored.kinds, answer.stored.report_format)}${settersText(answer.stored)}`;
+  const byHand = answer.stored.sources.some(isByHand);
+  if (answer.agrees) {
+    return [
+      byHand ? `Set to ${stored}, and its connections say the same.` : `Typed ${stored}, and its connections still say so.`,
+      ...notes
+    ];
+  }
+  if (byHand) {
+    return [
+      `Set on purpose to ${stored}; its connections alone would make it ${derived}.`,
+      "A type set by hand stays: the migration never overwrites it."
+    ];
+  }
+  return [
+    `Typed ${stored}, but its connections now make it ${derived}.`,
+    "The connections changed after it was typed, and a type does not follow them by itself.",
+    ...uploadKeptModelNotes(answer.stored, answer.derived.kinds, answer.integration),
+    ...timeNotes(answer.integration),
+    whoMayChange(answer.stored.kinds, answer.derived.kinds),
+    ...notes
+  ];
+}
+function timeNotes(integration) {
+  if (integration === null || integration.quiet === null) return [];
+  if ((integration.upload_channels ?? []).length > 0) return [];
+  return [
+    `Time alone can change the answer too: a connected integration is quiet after ${integration.window_days} days with no file, sync attempt or schedule.`,
+    "To judge it as the migration did: --as-of <backfill day>."
+  ];
+}
+function writeField(out, label, values, indent = "  ") {
+  if (values.length === 0) return;
+  const head = label.length >= LABEL_WIDTH ? `${label}  ` : label.padEnd(LABEL_WIDTH);
+  const pad = " ".repeat(head.length);
+  values.forEach((value, i) => out.write(`${indent}${i === 0 ? head : pad}${value}
+`));
+}
+function labelledLines(rows) {
+  const width = Math.max(LABEL_WIDTH, ...rows.map(([label]) => label.length + 2));
+  return rows.flatMap(
+    ([label, items]) => items.map((item, i) => `${(i === 0 ? label : "").padEnd(width)}${item}`)
+  );
+}
+function evidenceLines(evidence) {
+  const rows = EVIDENCE_LABELS.map(
+    ([field, label]) => [label, splitReasons(evidence?.[field])]
+  ).filter(([, items]) => items.length > 0);
+  return rows.length === 0 ? ["none"] : labelledLines(rows);
+}
+function integrationLines(integration) {
+  const channels = integration.upload_channels ?? [];
+  const head = [
+    ...integration.quiet === null ? [] : [`${integration.quiet ? "quiet" : "live"} over the last ${integration.window_days} days`],
+    ...channels.length > 0 ? [`${uploadText(channels)} on, no quiet rule`] : [],
+    integration.counts_as_integration ? "counts as Integration" : "does not count as Integration"
+  ].join(" \xB7 ");
+  if (integration.quiet === null) return [head, "no data query or synced cloud drive connected"];
+  return [
+    head,
+    ...labelledLines([
+      [
+        "last file in window",
+        [integration.last_file_in_window ? momentText(integration.last_file_in_window) : "none"]
+      ],
+      [
+        "last sync attempt",
+        [integration.last_sync_attempt ? momentText(integration.last_sync_attempt) : "none"]
+      ],
+      ["schedule", [integration.schedule ?? "none"]],
+      ["auto sync", [integration.auto_sync ? "on" : "off"]]
+    ])
+  ];
+}
+function writeHistory(out, history) {
+  if (history.length === 0) {
+    writeField(out, "history", ["none recorded (or the audit server could not be read)"]);
+    return;
+  }
+  out.write("  history\n");
+  const indent = "    ";
+  const rows = [["WHEN", "BY", "OPERATOR", "BEFORE \u2192 AFTER", "REASON"]];
+  for (const entry of history) {
+    rows.push([
+      entry.at ? momentText(entry.at) : "-",
+      entry.by ?? "-",
+      entry.operator ?? "-",
+      `${slotsText(entry.before)} \u2192 ${slotsText(entry.after)}`,
+      entry.reason ? lookUp(HISTORY_REASONS, entry.reason) : "retyped in the filebox settings"
+    ]);
+  }
+  writeRows(
+    out,
+    rows.map(([first, ...others]) => [`${indent}${first ?? ""}`, ...others])
+  );
+}
+function writeFilebox(out, answer) {
+  const rollout = answer.rollout ? "" : " (outside the rollout)";
+  out.write(
+    `Filebox ${answer.id} "${answer.name}" \xB7 organization ${answer.organization_id}${rollout}
+`
+  );
+  writeField(out, "meaning", meaningLines(answer));
+  writeField(out, "stored", [storedText(answer.stored), ...flowNote(answer)]);
+  const derived = kindsText(answer.derived.kinds, answer.derived.report_format);
+  const mark = answer.agrees === null ? "" : answer.agrees ? "\u2713 agrees" : "\u2717 disagrees";
+  writeField(out, "rules", [
+    mark === "" ? derived : `${derived.padEnd(Math.max(AGREES_COLUMN, derived.length + 2))}${mark}`
+  ]);
+  writeField(out, "rule", [answer.derived.rule]);
+  if (answer.derived.unknown_reason) {
+    writeField(out, "unsure", [lookUp(UNSURE_PHRASES, answer.derived.unknown_reason)]);
+  }
+  writeField(
+    out,
+    "why",
+    [answer.why.primary, answer.why.secondary].filter((w) => !!w).map(reasonText)
+  );
+  writeField(out, "dropped", splitReasons(answer.why.dropped).map(reasonText));
+  writeField(out, "why not", splitReasons(answer.why.not).map(reasonText));
+  writeField(out, "evidence", evidenceLines(answer.evidence));
+  if (answer.integration) writeField(out, "integration", integrationLines(answer.integration));
+  if (answer.history !== void 0) writeHistory(out, answer.history);
+}
+var NOT_FOUND_HINT = "Not found also holds a filebox of another organization: only that organization's support seat gets its answer.\n";
+function renderKindExplanation(out, answer, opts) {
+  let first = true;
+  if (opts.showAsOf) {
+    out.write(`As of ${answer.as_of}
+`);
+    first = false;
+  }
+  for (const filebox of answer.fileboxes) {
+    if (!first) out.write("\n");
+    writeFilebox(out, filebox);
+    first = false;
+  }
+  if (answer.not_found.length > 0) {
+    if (!first) out.write("\n");
+    for (const id of answer.not_found) out.write(`Not found: filebox ${id}
+`);
+    out.write(NOT_FOUND_HINT);
+  }
+}
+async function runFileboxKindSummary(cfg) {
+  const ctx = {
+    command: "kind-summary",
+    route: KIND_SUMMARY_PATH,
+    client: cfg.client
+  };
+  const res = await getKindSummary(cfg.client, { signal: cfg.signal });
+  const text2 = await readKindAnswer(res, ctx);
+  if (cfg.asJson) {
+    cfg.out.write(withNewline(text2));
+    return;
+  }
+  renderKindSummary(
+    cfg.out,
+    decodeShape(parseKindBody(text2, KIND_SUMMARY_PATH))
+  );
+}
+function countText(n) {
+  return n.toLocaleString("en-US");
+}
+function countsLine(entries) {
+  return [...entries].sort(([a, x], [b, y]) => y - x || a.localeCompare(b)).map(([label, n]) => `${label} ${countText(n)}`).join(" \xB7 ");
+}
+var UNTYPED_KEY = "(untyped)";
+function renderKindSummary(out, summary) {
+  const rollout = summary.rollout ? "" : " (outside the rollout)";
+  out.write(`Organization ${summary.organization_id}${rollout}
+`);
+  const header = ["fileboxes", "typed", "untyped"];
+  const rows = ["live", "archived"].map(
+    (state) => [
+      state,
+      [summary[state].fileboxes, summary[state].typed, summary[state].untyped].map(countText)
+    ]
+  );
+  const widths = header.map(
+    (h, i) => Math.max(h.length, ...rows.map(([, v]) => (v[i] ?? "").length))
+  );
+  const line = (cells) => cells.map((cell, i) => cell.padStart(widths[i] ?? 0)).join("   ");
+  out.write(`${" ".repeat(2 + LABEL_WIDTH)}${line(header)}
+`);
+  for (const [state, values] of rows) out.write(`  ${state.padEnd(LABEL_WIDTH)}${line(values)}
+`);
+  const sources = Object.entries(summary.sources).map(
+    ([source, n]) => [lookUp(SOURCE_WORDS, source), n]
+  );
+  writeField(out, "set by", [sources.length === 0 ? "none" : countsLine(sources)]);
+  const kinds = Object.entries(summary.kinds);
+  const combinations = (pairs) => countsLine(
+    kinds.filter(([combination]) => combination.includes("+") === pairs).map(([combination, n]) => [kindsText(combination.split("+"), null), n])
+  );
+  const typeLines = [combinations(false), combinations(true)].filter((l) => l !== "");
+  writeField(out, "types", typeLines.length === 0 ? ["none"] : typeLines);
+  if (summary.upload_channel_kinds === void 0) return;
+  const uploads = Object.entries(summary.upload_channel_kinds).map(
+    ([combination, n]) => [
+      combination === UNTYPED_KEY ? "untyped" : kindsText(combination.split("+"), null),
+      n
+    ]
+  );
+  writeField(
+    out,
+    "uploads",
+    uploads.length === 0 ? ["no live filebox has email or API upload on"] : ["live fileboxes with email / API upload on, by stored type", countsLine(uploads)]
+  );
+}
+var SUPPORT_SEAT_HELP = [
+  "",
+  "Support seat only. The server answers the support seat of the organization",
+  "asked about and refuses any other seat (HTTP 405), even a support person",
+  "working in a customer user's seat. Log in as that seat, then run as it:",
+  "  dr login-as <support seat email> --server <S>"
+];
+function registerFileboxKindCommands(fb) {
+  const explainCmd = fb.command("kind-explain").description(
+    "Why fileboxes have their type: the stored type and who set it, what the migration's rules make of it, whether the two agree, the rule, why, and the evidence (read-only, support seat only)"
+  ).argument("<filebox_ids...>", 'filebox ids (positive integers; "12,34" also accepted)').option(
+    "--history",
+    `Also list the recorded type changes (${KIND_EXPLAIN_MAX_IDS_WITH_HISTORY} ids per request)`,
+    false
+  ).option(
+    "--as-of <date>",
+    "Judge a quiet integration as of this day (YYYY-MM-DD, its end UTC); every other signal is read as it is now"
+  ).option("--json", "Print the server's answer instead of the readable form (see below)", false).addHelpText(
+    "after",
+    [
+      ...SUPPORT_SEAT_HELP,
+      "  dr filebox kind-explain 48213 48999 --server <S> --account <support seat email>",
+      "A filebox of another organization, a folder, or an id that does not exist is",
+      'listed as "Not found". It changes nothing and answers whatever the',
+      "organization's feature flag; each filebox says whether it is in the rollout.",
+      "",
+      `More than ${KIND_EXPLAIN_MAX_IDS} ids (${KIND_EXPLAIN_MAX_IDS_WITH_HISTORY} with --history) are sent as several requests, one`,
+      "after another, the later ones pinned to the first answer's as_of. --json",
+      "prints a single request's body unchanged; for several it prints one body in",
+      "the server's shape: fileboxes and not_found concatenated in request order,",
+      "as_of from the first. Either way --json keeps the HTML entities the server",
+      'sends (a name reads "P&amp;L"): unlike `filebox list --json`, nothing is decoded.'
+    ].join("\n")
+  ).action(
+    async (idArgs, opts) => {
+      const ids = parseKindExplainIds(idArgs);
+      const asOf = parseKindAsOf(opts.asOf);
+      const setup = await setupCall(opts.server, opts.account);
+      try {
+        await runFileboxKindExplain({
+          client: setup.client,
+          ids,
+          asOf,
+          history: opts.history === true,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout,
+          extendTimeout: setup.extendTimeout
+        });
+      } finally {
+        setup.cleanup();
+      }
+    }
+  );
+  addServerFlag(explainCmd);
+  addAccountFlag(explainCmd);
+  const summaryCmd = fb.command("kind-summary").description(
+    "How far the seat's organization is typed: live and archived fileboxes, typed and untyped, who set the types, and every stored combination (read-only, support seat only)"
+  ).option("--json", "Print the server's answer unchanged", false).addHelpText(
+    "after",
+    [
+      ...SUPPORT_SEAT_HELP,
+      "  dr filebox kind-summary --server <S> --account <support seat email>",
+      'It answers for the organization of that seat. "set by" and "types" count',
+      'live and archived fileboxes together; in "set by", "flow" is a flow that',
+      "typed the filebox at creation or when a connection was added later (a table",
+      "attaching it as a lookup, a LUT/FX label, a data source or synced drive",
+      'connected, email / API upload turned on). "uploads" counts live fileboxes with',
+      "email or API upload on by their stored type: the rules make each an",
+      "Integration, dropping a Model, but turning an upload on keeps a Model, so a",
+      "Model counted there is expected drift (kind-explain says why)."
+    ].join("\n")
+  ).action(async (opts) => {
+    const setup = await setupCall(opts.server, opts.account);
+    try {
+      await runFileboxKindSummary({
+        client: setup.client,
+        asJson: opts.json === true,
+        signal: setup.signal,
+        out: process.stdout
+      });
+    } finally {
+      setup.cleanup();
+    }
+  });
+  addServerFlag(summaryCmd);
+  addAccountFlag(summaryCmd);
+}
+
 // src/commands/_typedError.ts
 function isTypedError(err) {
   return !(err instanceof Error) || err.constructor !== Error || "code" in err;
@@ -36148,11 +36847,11 @@ function classifyDataQuerySyncProgress(periods, baseline, versions, dataQueryRaw
   }
   return out;
 }
-async function captureDataQuerySyncBaseline(client, fileboxId, periods, signal) {
+async function captureDataQuerySyncBaseline(client, fileboxId, periods, signal, preRead) {
   try {
     const [versions, dataQuery] = await Promise.all([
       listVersions(client, fileboxId, {}, { signal }),
-      getDataQueryRaw(client, fileboxId, { signal })
+      preRead !== void 0 ? Promise.resolve(preRead.raw) : getDataQueryRaw(client, fileboxId, { signal })
     ]);
     return buildDataQuerySyncBaseline(periods, versions, dataQuery);
   } catch (err) {
@@ -36252,7 +36951,8 @@ function renderSummary2(cfg, progress, outcome, waitedSec) {
       })),
       unmatched_new_versions: progress.unmatchedNewVersions,
       error: progress.error ?? null,
-      waited_seconds: waitedSec
+      waited_seconds: waitedSec,
+      warnings: cfg.warnings ?? []
     });
     return;
   }
@@ -36310,6 +37010,63 @@ function failureMessage(fileboxId, progress, outcome, waitedSec) {
   return `data-query sync on filebox ${fileboxId} did not finish within ${waitedSec}s \u2014 ${pending.length} period(s) unfinished: ${pendingList}. Increase --timeout, or re-check with 'dr filebox versions ${fileboxId}'; do not blindly re-trigger.`;
 }
 
+// src/commands/_aggregatorBalance.ts
+var AGGREGATOR_TYPE_NAMES = /* @__PURE__ */ new Set([
+  "plaid",
+  "quiltt",
+  "saltedge",
+  "flinks"
+]);
+function asRecord2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
+}
+function parsedRecord(raw) {
+  if (typeof raw === "string") {
+    try {
+      return asRecord2(JSON.parse(raw));
+    } catch {
+      return void 0;
+    }
+  }
+  return asRecord2(raw);
+}
+async function detectAggregatorBalanceQuery(client, fileboxId, signal) {
+  let dataQueryRaw;
+  try {
+    dataQueryRaw = await getDataQueryRaw(client, fileboxId, { signal });
+  } catch {
+    if (signal.aborted) throw signal.reason ?? new Error("aborted");
+    return void 0;
+  }
+  const dataQuery = asRecord2(dataQueryRaw);
+  const config = parsedRecord(dataQuery?.["config"]);
+  const objectType = config?.["objectType"] ?? parsedRecord(config?.["query"])?.["objectType"];
+  const rawConnection = dataQuery?.["connection"];
+  const connectionId = typeof rawConnection === "number" || typeof rawConnection === "string" ? Number(rawConnection) : NaN;
+  if (typeof objectType !== "string" || objectType.toLowerCase() !== "balances" || !Number.isInteger(connectionId) || connectionId <= 0) {
+    return { dataQueryRaw };
+  }
+  let type;
+  try {
+    const integration = await getById2(client, connectionId, { signal });
+    type = asRecord2(integration.type);
+  } catch {
+    if (signal.aborted) throw signal.reason ?? new Error("aborted");
+    return { dataQueryRaw };
+  }
+  const name = type?.["name"];
+  if (typeof name !== "string" || !AGGREGATOR_TYPE_NAMES.has(name.toLowerCase())) {
+    return { dataQueryRaw };
+  }
+  const display = type?.["display_name"];
+  const aggregator = typeof display === "string" && display.trim() !== "" ? display.trim() : name;
+  return { dataQueryRaw, aggregator };
+}
+function aggregatorBalanceWarning(fileboxId, aggregator, periodCount) {
+  const what = periodCount > 1 ? `these ${periodCount} periods will all get today's balance (identical versions under different dates)` : "that period will get today's balance, labelled as if it were that period's";
+  return `filebox ${fileboxId} syncs balances from ${aggregator}, an aggregator: it returns today's balance whatever --date asks for, so ${what}. Backfill only transactions; for balances, sync the current period only and let the nightly schedule build the history. Multi-period balance backfill works only on a direct bank API connection.`;
+}
+
 // src/commands/filebox.ts
 async function fileToBlob(filePath) {
   const buf = await fsPromises.readFile(filePath);
@@ -36623,7 +37380,7 @@ ${JSON.stringify(result)}
 `
   );
 }
-function asRecord2(v) {
+function asRecord3(v) {
   return v !== null && typeof v === "object" ? v : void 0;
 }
 function numOf(r, k) {
@@ -36633,9 +37390,9 @@ function strOf(r, k) {
   return r !== void 0 && typeof r[k] === "string" ? r[k] : void 0;
 }
 function extractUploadedVersionMeta(result) {
-  const r = asRecord2(result);
-  const dv = asRecord2(r?.["document_version"]);
-  const docObj = asRecord2(r?.["document"]);
+  const r = asRecord3(result);
+  const dv = asRecord3(r?.["document_version"]);
+  const docObj = asRecord3(r?.["document"]);
   return {
     id: numOf(r, "id") ?? numOf(dv, "id") ?? numOf(docObj, "latest_version_id") ?? 0,
     version: numOf(r, "version") ?? numOf(dv, "version") ?? 0,
@@ -36794,7 +37551,7 @@ async function runFileboxUploadVersion(cfg) {
         ...cycleTagVerdictJSON(confirmation)
       });
     } else if (cfg.label !== void 0) {
-      cfg.out.write(JSON.stringify({ ...asRecord2(result), ...labelJSON }) + "\n");
+      cfg.out.write(JSON.stringify({ ...asRecord3(result), ...labelJSON }) + "\n");
     } else {
       cfg.out.write(JSON.stringify(result) + "\n");
     }
@@ -37600,22 +38357,68 @@ async function runFileboxSetVersionWorkflow(cfg) {
       `document ${cfg.docId} has no WORKFLOW tag in its config (available: ${availMsg})`
     );
   }
-  const tagsToUpdate = JSON.stringify([
-    { id: tag.id, value: cfg.status, name: "WORKFLOW", label: cfg.status }
-  ]);
-  const res = await setVersionTagsAndLabel(
-    cfg.client,
-    cfg.versionId,
-    { tags_to_update: tagsToUpdate },
-    { signal: cfg.signal }
-  );
-  if (res.status >= 200 && res.status < 300) {
-    cfg.out.write(`Set WORKFLOW tag on version ${cfg.versionId}: "${cfg.status}".
-`);
+  const err = cfg.err ?? process.stderr;
+  const { target } = await loadTargetVersion(cfg.client, cfg.docId, cfg.versionId, cfg.signal);
+  const current = tagValueOf(target.tags, tag.id);
+  const previous = typeof current === "string" ? current : null;
+  const writer = new FullTagSetWriter({
+    client: cfg.client,
+    docId: cfg.docId,
+    versionId: cfg.versionId,
+    snapshot: target.tags,
+    tag: { id: tag.id, value: cfg.status, name: tag.name, label: cfg.status },
+    action: "set version workflow",
+    signal: cfg.signal,
+    sleep: cfg.sleep,
+    settleMs: cfg.tagSettleDelayMs
+  });
+  await writer.write();
+  const kept = await keepDateTagValue({
+    writer,
+    seen: await writer.readBack(),
+    dateBefore: target.date_tag_value,
+    versionId: cfg.versionId,
+    docId: cfg.docId,
+    what: "WORKFLOW tag",
+    signal: cfg.signal,
+    err
+  });
+  const { seen, dateAfter, datePreserved } = kept;
+  const now = seen === null ? void 0 : tagValueOf(seen.tags, tag.id);
+  const verified = seen !== null && now === cfg.status;
+  if (seen === null) {
+    err.write(
+      `warning: could not read version ${cfg.versionId} back to verify its WORKFLOW tag \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
+`
+    );
+  } else if (!verified) {
+    err.write(
+      `warning: version ${cfg.versionId} reads WORKFLOW ${JSON.stringify(now ?? null)} after the write, not "${cfg.status}" \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
+`
+    );
+  }
+  if (cfg.asJson) {
+    writeJSONIndented(cfg.out, {
+      version_id: cfg.versionId,
+      doc_id: cfg.docId,
+      tag_id: tag.id,
+      previous,
+      status: cfg.status,
+      verified,
+      reapplied: kept.reapplied,
+      date_tag_value: dateAfter,
+      date_tag_value_preserved: datePreserved
+    });
     return;
   }
-  const body = await res.text();
-  throw new Error(`set version workflow refused (HTTP ${res.status}): ${body.trim()}`);
+  const verdict = !verified ? "unverified" : kept.reapplied ? "verified after one re-apply" : "verified";
+  cfg.out.write(
+    `Set WORKFLOW tag on version ${cfg.versionId}: ${JSON.stringify(previous ?? "(unset)")} -> "${cfg.status}" (${verdict}).
+`
+  );
+  if (datePreserved === false) {
+    cfg.out.write(dateNotPreservedLine(dateAfter, target.date_tag_value));
+  }
 }
 var FILE_STATUS_VALUES = ["Draft", "Final"];
 function parseFileStatus(raw) {
@@ -37716,6 +38519,110 @@ function fullTagSetWith(stored, write) {
   }
   return [...kept, write].sort((a, b) => a.id - b.id);
 }
+var FullTagSetWriter = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+    this.base = cfg.snapshot ?? [];
+  }
+  cfg;
+  base;
+  /** PUT the full set; a non-2xx answer throws `TagWriteRefusedError`. */
+  async write() {
+    const { cfg } = this;
+    const res = await setVersionTagsAndLabel(
+      cfg.client,
+      cfg.versionId,
+      { tags_to_update: JSON.stringify(fullTagSetWith(this.base, cfg.tag)) },
+      { signal: cfg.signal }
+    );
+    if (res.status < 200 || res.status >= 300) {
+      const body = (await res.text()).trim();
+      throw new TagWriteRefusedError(
+        `${cfg.action} refused (HTTP ${res.status}): ${body}`,
+        `(HTTP ${res.status}): ${body}`
+      );
+    }
+  }
+  /** Wait the settle delay, then read the version back (`null` = unreadable). */
+  async readBack() {
+    const { cfg } = this;
+    const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
+    await sleep3(cfg.settleMs ?? CYCLE_TAG_SETTLE_DELAY_MS, cfg.signal);
+    return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
+  }
+  /** Build the next write from this read-back instead of the earlier snapshot. */
+  refreshBase(v) {
+    if (v !== null && v.tags.length > 0) {
+      this.base = v.tags;
+    }
+  }
+};
+async function keepDateTagValue(cfg) {
+  const { dateBefore, err } = cfg;
+  let seen = cfg.seen;
+  const dateMoved = (v) => v !== null && typeof dateBefore === "number" && v.row.date_tag_value !== void 0 && v.row.date_tag_value !== dateBefore;
+  let reapplied = false;
+  let dateUnknown = false;
+  if (dateMoved(seen)) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} changed (${JSON.stringify(dateBefore)} -> ${JSON.stringify(seen.row.date_tag_value ?? null)}) when its ${cfg.what} was set; re-applying the full tag set once
+`
+    );
+    reapplied = true;
+    cfg.writer.refreshBase(seen);
+    let refused = false;
+    try {
+      await cfg.writer.write();
+    } catch (e) {
+      if (cfg.signal.aborted) {
+        throw e;
+      }
+      if (e instanceof TagWriteRefusedError) {
+        refused = true;
+        err.write(`warning: re-applying the full tag set was refused ${e.reason}
+`);
+      } else {
+        err.write(
+          `warning: re-applying the full tag set failed (${e instanceof Error ? e.message : String(e)}); its outcome is unknown, reading the version again
+`
+        );
+      }
+    }
+    const after = refused ? seen : await cfg.writer.readBack();
+    if (after === null) {
+      dateUnknown = true;
+      err.write(
+        `warning: could not read version ${cfg.versionId} back to confirm its date_tag_value after re-applying the full tag set \u2014 check it with \`dr filebox versions ${cfg.docId} --json\`
+`
+      );
+    } else {
+      seen = after;
+    }
+  }
+  const dateAfter = dateUnknown || seen === null || seen.row.date_tag_value === void 0 ? null : seen.row.date_tag_value;
+  const datePreserved = dateUnknown || seen === null || dateBefore === void 0 || seen.row.date_tag_value === void 0 ? null : !dateMoved(seen);
+  if (datePreserved === false) {
+    err.write(
+      `warning: date_tag_value on version ${cfg.versionId} is still ${JSON.stringify(dateAfter)} (was ${JSON.stringify(dateBefore)}) after one re-apply; its tags still carry the date. Restore it with \`dr filebox set-version-date-tag ${cfg.versionId} --doc ${cfg.docId} --<dimension> <date>\` (it sends the date tag alone; on a planning filebox use \`dr filebox set-version-cycle ${cfg.versionId} --doc ${cfg.docId} --date <date> --scenario <name>\` instead, which keeps the cycle), then check \`dr filebox versions ${cfg.docId} --json\`
+`
+    );
+  }
+  return { seen, reapplied, dateAfter, datePreserved };
+}
+function dateNotPreservedLine(dateAfter, dateBefore) {
+  return `date_tag_value NOT preserved: it reads ${JSON.stringify(dateAfter)}, was ${JSON.stringify(dateBefore)} (see the warning above).
+`;
+}
+async function loadTargetVersion(client, docId, versionId, signal) {
+  const rows = await listVersions(client, docId, { includeAutoSaves: true }, { signal });
+  const target = rows.find((r) => r.id === versionId);
+  if (target === void 0) {
+    throw new Error(
+      `version ${versionId} is not a version of filebox ${docId} \u2014 list them with \`dr filebox versions ${docId} --all\``
+    );
+  }
+  return { rows, target };
+}
 async function runFileboxSetVersionFileStatus(cfg) {
   if (cfg.docId <= 0) {
     throw new Error("document id must be positive");
@@ -37724,8 +38631,6 @@ async function runFileboxSetVersionFileStatus(cfg) {
     throw new Error("version id must be positive");
   }
   const err = cfg.err ?? process.stderr;
-  const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
-  const settleMs = cfg.tagSettleDelayMs ?? CYCLE_TAG_SETTLE_DELAY_MS;
   const details = await getDetails(cfg.client, cfg.docId, { signal: cfg.signal });
   const tag = (details.tags_config ?? []).find(isFileStatusTag);
   if (tag === void 0) {
@@ -37739,18 +38644,12 @@ async function runFileboxSetVersionFileStatus(cfg) {
       `File Status on document ${cfg.docId} does not allow "${cfg.status}" (allowed: ${tag.values.map((v) => JSON.stringify(v)).join(" | ")})`
     );
   }
-  const rows = await listVersions(
+  const { rows, target } = await loadTargetVersion(
     cfg.client,
     cfg.docId,
-    { includeAutoSaves: true },
-    { signal: cfg.signal }
+    cfg.versionId,
+    cfg.signal
   );
-  const target = rows.find((r) => r.id === cfg.versionId);
-  if (target === void 0) {
-    throw new Error(
-      `version ${cfg.versionId} is not a version of filebox ${cfg.docId} \u2014 list them with \`dr filebox versions ${cfg.docId} --all\``
-    );
-  }
   const current = tagValueOf(target.tags, tag.id);
   const previous = typeof current === "string" ? current : null;
   const options = tag.options ?? {};
@@ -37803,45 +38702,25 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
-  const statusWrite = {
-    id: tag.id,
-    value: cfg.status,
-    name: tag.name,
-    label: cfg.status
-  };
-  let base = target.tags ?? [];
-  const refreshBase = (v) => {
-    if (v !== null && v.tags.length > 0) {
-      base = v.tags;
-    }
-  };
-  const write = async () => {
-    const res = await setVersionTagsAndLabel(
-      cfg.client,
-      cfg.versionId,
-      { tags_to_update: JSON.stringify(fullTagSetWith(base, statusWrite)) },
-      { signal: cfg.signal }
-    );
-    if (res.status < 200 || res.status >= 300) {
-      const body = await res.text();
-      throw new TagWriteRefusedError(
-        `set version file status refused (HTTP ${res.status}): ${body.trim()}`,
-        `(HTTP ${res.status}): ${body.trim()}`
-      );
-    }
-  };
-  const readBack = async () => {
-    await sleep3(settleMs, cfg.signal);
-    return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
-  };
-  await write();
+  const writer = new FullTagSetWriter({
+    client: cfg.client,
+    docId: cfg.docId,
+    versionId: cfg.versionId,
+    snapshot: target.tags,
+    tag: { id: tag.id, value: cfg.status, name: tag.name, label: cfg.status },
+    action: "set version file status",
+    signal: cfg.signal,
+    sleep: cfg.sleep,
+    settleMs: cfg.tagSettleDelayMs
+  });
+  await writer.write();
   let reapplied = false;
-  let seen = await readBack();
+  let seen = await writer.readBack();
   if (seen !== null && tagValueOf(seen.tags, tag.id) !== cfg.status) {
     reapplied = true;
-    refreshBase(seen);
-    await write();
-    seen = await readBack();
+    writer.refreshBase(seen);
+    await writer.write();
+    seen = await writer.readBack();
     const now = seen === null ? void 0 : tagValueOf(seen.tags, tag.id);
     if (seen !== null && now !== cfg.status) {
       throw new Error(
@@ -37849,53 +38728,19 @@ async function runFileboxSetVersionFileStatus(cfg) {
       );
     }
   }
-  const dateBefore = target.date_tag_value;
-  const dateMoved = (v) => v !== null && typeof dateBefore === "number" && v.row.date_tag_value !== void 0 && v.row.date_tag_value !== dateBefore;
-  let dateUnknown = false;
-  if (dateMoved(seen)) {
-    err.write(
-      `warning: date_tag_value on version ${cfg.versionId} changed (${JSON.stringify(dateBefore)} -> ${JSON.stringify(seen.row.date_tag_value ?? null)}) when its File Status was set; re-applying the full tag set once
-`
-    );
-    reapplied = true;
-    refreshBase(seen);
-    let refused = false;
-    try {
-      await write();
-    } catch (e) {
-      if (cfg.signal.aborted) {
-        throw e;
-      }
-      if (e instanceof TagWriteRefusedError) {
-        refused = true;
-        err.write(`warning: re-applying the full tag set was refused ${e.reason}
-`);
-      } else {
-        err.write(
-          `warning: re-applying the full tag set failed (${e instanceof Error ? e.message : String(e)}); its outcome is unknown, reading the version again
-`
-        );
-      }
-    }
-    const after = refused ? seen : await readBack();
-    if (after === null) {
-      dateUnknown = true;
-      err.write(
-        `warning: could not read version ${cfg.versionId} back to confirm its date_tag_value after re-applying the full tag set \u2014 check it with \`dr filebox versions ${cfg.docId} --json\`
-`
-      );
-    } else {
-      seen = after;
-    }
-  }
-  const dateAfter = dateUnknown || seen === null || seen.row.date_tag_value === void 0 ? null : seen.row.date_tag_value;
-  const datePreserved = dateUnknown || seen === null || dateBefore === void 0 || seen.row.date_tag_value === void 0 ? null : !dateMoved(seen);
-  if (datePreserved === false) {
-    err.write(
-      `warning: date_tag_value on version ${cfg.versionId} is still ${JSON.stringify(dateAfter)} (was ${JSON.stringify(dateBefore)}) after one re-apply; its tags still carry the date. Restore it with \`dr filebox set-version-date-tag ${cfg.versionId} --doc ${cfg.docId} --<dimension> <date>\` (it sends the date tag alone; on a planning filebox use \`dr filebox set-version-cycle ${cfg.versionId} --doc ${cfg.docId} --date <date> --scenario <name>\` instead, which keeps the cycle), then check \`dr filebox versions ${cfg.docId} --json\`
-`
-    );
-  }
+  const kept = await keepDateTagValue({
+    writer,
+    seen,
+    dateBefore: target.date_tag_value,
+    versionId: cfg.versionId,
+    docId: cfg.docId,
+    what: "File Status",
+    signal: cfg.signal,
+    err
+  });
+  seen = kept.seen;
+  reapplied ||= kept.reapplied;
+  const { dateAfter, datePreserved } = kept;
   if (seen === null) {
     err.write(
       `warning: could not read version ${cfg.versionId} back to verify its File Status \u2014 confirm with \`dr filebox versions ${cfg.docId}\`
@@ -37934,10 +38779,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
 `
   );
   if (datePreserved === false) {
-    cfg.out.write(
-      `date_tag_value NOT preserved: it reads ${JSON.stringify(dateAfter)}, was ${JSON.stringify(dateBefore)} (see the warning above).
-`
-    );
+    cfg.out.write(dateNotPreservedLine(dateAfter, target.date_tag_value));
   }
   if (demotedIds.length > 0) {
     cfg.out.write(
@@ -38515,6 +39357,7 @@ async function runFileboxDataQuerySync(cfg) {
   const dateTargets = [];
   const periodLabels = [];
   const waitPeriods = [];
+  const pastOrFuturePeriods = /* @__PURE__ */ new Set();
   if (parsedDates.length > 0) {
     const details = await getDetails(cfg.client, cfg.id, {
       signal: cfg.signal
@@ -38535,6 +39378,11 @@ async function runFileboxDataQuerySync(cfg) {
         );
       }
     }
+    const now = cfg.today ?? /* @__PURE__ */ new Date();
+    const todays = [
+      { year: now.getFullYear(), month0: now.getMonth(), day: now.getDate() },
+      { year: now.getUTCFullYear(), month0: now.getUTCMonth(), day: now.getUTCDate() }
+    ].map((t) => dateTags.map((tag) => resolveDateForSubType(tagSubType(tag), t).value));
     for (const parsed2 of parsedDates) {
       const resolved = dateTags.map((tag) => {
         const { value, label: label2 } = resolveDateForSubType(tagSubType(tag), parsed2);
@@ -38543,6 +39391,8 @@ async function runFileboxDataQuerySync(cfg) {
       dateTargets.push(
         JSON.stringify(resolved.map(({ id, name, value }) => ({ id, name, value })))
       );
+      const isToday = todays.some((t) => resolved.every((r, i) => r.value === t[i]));
+      if (!isToday) pastOrFuturePeriods.add(resolved.map((r) => r.value).join("|"));
       const label = resolved.map((r) => r.label).join(" + ");
       periodLabels.push(label);
       waitPeriods.push({
@@ -38557,7 +39407,31 @@ async function runFileboxDataQuerySync(cfg) {
   if (waitPeriods.length === 0) {
     waitPeriods.push({ label: "latest sync", tags: [] });
   }
-  const baseline = cfg.wait === void 0 ? void 0 : await captureDataQuerySyncBaseline(cfg.client, cfg.id, waitPeriods, cfg.signal);
+  const warnings = [];
+  let preReadDataQuery;
+  if (pastOrFuturePeriods.size > 0) {
+    const detected = await detectAggregatorBalanceQuery(cfg.client, cfg.id, cfg.signal);
+    if (detected !== void 0) {
+      preReadDataQuery = { raw: detected.dataQueryRaw };
+      if (detected.aggregator !== void 0) {
+        warnings.push(
+          aggregatorBalanceWarning(cfg.id, detected.aggregator, pastOrFuturePeriods.size)
+        );
+      }
+    }
+  }
+  const errOut = cfg.err ?? cfg.wait?.err ?? process.stderr;
+  for (const w of warnings) {
+    errOut.write(`warning: ${w}
+`);
+  }
+  const baseline = cfg.wait === void 0 ? void 0 : await captureDataQuerySyncBaseline(
+    cfg.client,
+    cfg.id,
+    waitPeriods,
+    cfg.signal,
+    preReadDataQuery
+  );
   const multipleTags = [...rawTags, ...dateTargets];
   const body = {};
   if (multipleTags.length > 0) {
@@ -38600,6 +39474,7 @@ async function runFileboxDataQuerySync(cfg) {
     out: cfg.out,
     errOut: cfg.wait.err ?? process.stderr,
     signal: cfg.signal,
+    warnings,
     pollIntervalMs: cfg.wait.pollIntervalMs,
     maxPollIntervalMs: cfg.wait.maxPollIntervalMs,
     sleep: cfg.wait.sleep,
@@ -38707,9 +39582,9 @@ async function runFileboxDownload(cfg) {
   const fh = await fsPromises.open(target, "w");
   let total = 0;
   try {
-    for (const chunk of head) {
-      await fh.write(chunk);
-      total += chunk.length;
+    for (const chunk2 of head) {
+      await fh.write(chunk2);
+      total += chunk2.length;
     }
     if (!streamDone) {
       while (true) {
@@ -39635,33 +40510,41 @@ function registerFileboxCommand(root) {
   ).requiredOption(
     "--status <s>",
     "New WORKFLOW value: Not Started | In Progress | Pending | Approved | Rejected. Setting Approved requires the `approve_workflow` permission server-side."
-  ).action(async (idStr, opts) => {
-    const versionId = parseFileboxIdArg(idStr);
-    if (opts.doc === void 0 || opts.doc === "") {
-      throw new Error("--doc is required");
-    }
-    const docId = parseFileboxIdArg(opts.doc);
-    const raw = opts.status ?? "";
-    if (!WORKFLOW_STATUSES.includes(raw)) {
-      throw new Error(
-        `invalid --status "${raw}" (expected one of: ${WORKFLOW_STATUSES.map((s) => `"${s}"`).join(" | ")})`
-      );
-    }
-    const status2 = raw;
-    const setup = await setupCall(opts.server, opts.account);
-    try {
-      await runFileboxSetVersionWorkflow({
-        client: setup.client,
-        docId,
-        versionId,
-        status: status2,
-        signal: setup.signal,
-        out: process.stdout
-      });
-    } finally {
-      setup.cleanup();
+  ).option(
+    "--json",
+    "Output a JSON record describing the write instead of the human confirmation",
+    false
+  ).action(
+    async (idStr, opts) => {
+      const versionId = parseFileboxIdArg(idStr);
+      if (opts.doc === void 0 || opts.doc === "") {
+        throw new Error("--doc is required");
+      }
+      const docId = parseFileboxIdArg(opts.doc);
+      const raw = opts.status ?? "";
+      if (!WORKFLOW_STATUSES.includes(raw)) {
+        throw new Error(
+          `invalid --status "${raw}" (expected one of: ${WORKFLOW_STATUSES.map((s) => `"${s}"`).join(" | ")})`
+        );
+      }
+      const status2 = raw;
+      const setup = await setupCall(opts.server, opts.account, { timeoutMs: 5 * 6e4 });
+      try {
+        await runFileboxSetVersionWorkflow({
+          client: setup.client,
+          docId,
+          versionId,
+          status: status2,
+          asJson: opts.json === true,
+          signal: setup.signal,
+          out: process.stdout,
+          err: process.stderr
+        });
+      } finally {
+        setup.cleanup();
+      }
     }
-  });
+  );
   addServerFlag(setVersionWorkflowCmd);
   addAccountFlag(setVersionWorkflowCmd);
   const setVersionFileStatusCmd = fb.command("set-version-file-status").description(
@@ -39885,7 +40768,7 @@ function registerFileboxCommand(root) {
   addServerFlag(dqClearCmd);
   addAccountFlag(dqClearCmd);
   const dqSyncCmd = dataQuery.command("sync").description(
-    `Manually trigger a sync of the filebox's data-query (async on server). --date YYYY-MM-DD (repeatable) scopes the sync to that date, truncated to whatever granularity the filebox's own date tag uses \u2014 e.g. --date 2026-07-01 syncs "July 2026" on a monthly filebox, "Q3 2026" on a quarterly one, or the exact day/ISO week on a daily/weekly one. Repeat to backfill several periods in one call.`
+    `Manually trigger a sync of the filebox's data-query (async on server). --date YYYY-MM-DD (repeatable) scopes the sync to that date, truncated to whatever granularity the filebox's own date tag uses \u2014 e.g. --date 2026-07-01 syncs "July 2026" on a monthly filebox, "Q3 2026" on a quarterly one, or the exact day/ISO week on a daily/weekly one. Repeat to backfill several periods in one call. Balances from an aggregator (Plaid, Quiltt, Salt Edge, Flinks) are always today's balance whatever --date says, so backfilling them writes identical versions under different dates (the CLI warns): backfill only transactions, sync balances for the current period and let the nightly schedule build the history. Multi-period balance backfill works only on a direct bank API connection.`
   ).argument("<filebox_id>", "filebox id (positive integer)").option(
     "--date <YYYY-MM-DD>",
     "sync whatever date-tag period this date falls in, e.g. 2026-07-01. Repeatable.",
@@ -39932,6 +40815,7 @@ function registerFileboxCommand(root) {
   addServerFlag(dqSyncCmd);
   addAccountFlag(dqSyncCmd);
   registerFileboxAdminCommands(fb, setupCall, addServerFlag, addAccountFlag);
+  registerFileboxKindCommands(fb);
   registerFileboxRescanVersionCommand(fb);
 }
 
@@ -45587,52 +46471,6 @@ async function getAuditExportStatus(client, params, options) {
   return out ?? { job_id: params.jobId, status: "PENDING" };
 }
 
-// src/commands/_reconciliationDate.ts
-function validateDateString(orig, flagName) {
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(orig)) {
-    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD)`);
-  }
-  const parts = orig.split("-").map(Number);
-  const [year, month1, day] = parts;
-  const probe = new Date(Date.UTC(year, month1 - 1, day));
-  if (probe.getUTCFullYear() !== year || probe.getUTCMonth() + 1 !== month1 || probe.getUTCDate() !== day) {
-    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD)`);
-  }
-  return { year, month1, day };
-}
-function parseDateFlag(orig, flagName) {
-  let normalized = orig;
-  if (/^\d{4}-\d{2}$/.test(orig)) {
-    normalized = `${orig}-01`;
-  }
-  let year;
-  let month1;
-  try {
-    ({ year, month1 } = validateDateString(normalized, flagName));
-  } catch {
-    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD or YYYY-MM)`);
-  }
-  return Math.floor(Date.UTC(year, month1, 0) / 1e3);
-}
-function parseDateFlagEpoch(orig, flagName) {
-  let normalized = orig;
-  if (/^\d{4}-\d{2}$/.test(orig)) {
-    normalized = `${orig}-01`;
-  }
-  let year;
-  let month1;
-  try {
-    ({ year, month1 } = validateDateString(normalized, flagName));
-  } catch {
-    throw new Error(`invalid ${flagName} "${orig}" (expected YYYY-MM-DD or YYYY-MM)`);
-  }
-  return Math.floor(Date.UTC(year, month1 - 1, 1, 12) / 1e3);
-}
-function parseDateFlagDay(orig, flagName) {
-  const { year, month1, day } = validateDateString(orig, flagName);
-  return Math.floor(Date.UTC(year, month1 - 1, day) / 1e3);
-}
-
 // src/commands/_reconciliationSettingsFile.ts
 var ALLOWED_FREQUENCIES = /* @__PURE__ */ new Set(["Monthly", "Quarterly", "Yearly", "Exclude"]);
 var REQUIRED_FIELDS = [
@@ -47029,17 +47867,17 @@ async function runReconciliationAccountsUpdateSettings(cfg) {
     execute: async () => {
       extendForBatch(cfg.extendTimeout, chunks.length);
       let applied = 0;
-      for (const chunk of chunks) {
+      for (const chunk2 of chunks) {
         try {
-          await updateAccountSettings(cfg.client, chunk, { signal: cfg.signal });
+          await updateAccountSettings(cfg.client, chunk2, { signal: cfg.signal });
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           throw new Error(
-            `PATCH failed after ${applied} of ${changed.length} rows were written (rows ${applied + 1}\u2013${applied + chunk.length} may be partially applied): ${msg}
+            `PATCH failed after ${applied} of ${changed.length} rows were written (rows ${applied + 1}\u2013${applied + chunk2.length} may be partially applied): ${msg}
 Re-run the same command without --confirm-token: rows that landed plan as unchanged, so the new plan covers only the rest.`
           );
         }
-        applied += chunk.length;
+        applied += chunk2.length;
       }
       cfg.out.write(
         `Updated ${applied} account setting${plural(applied)} (${unchanged} unchanged).
@@ -47632,10 +48470,10 @@ async function writeMemberChunks(ctx, planned, items, chunkSize) {
   extendForBatch(ctx.extendTimeout, requests * 2);
   let applied = 0;
   for (let i = 0; i < items.length; i += chunkSize) {
-    const chunk = items.slice(i, i + chunkSize);
+    const chunk2 = items.slice(i, i + chunkSize);
     let drift;
     try {
-      drift = await chunkDrift(ctx, planned, chunk);
+      drift = await chunkDrift(ctx, planned, chunk2);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(
@@ -47651,23 +48489,23 @@ The tenant changed since the plan. Re-run the same command without --confirm-tok
       );
     }
     try {
-      await updateAccountMembers(ctx.client, chunk, { signal: ctx.signal });
+      await updateAccountMembers(ctx.client, chunk2, { signal: ctx.signal });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       throw new Error(
-        `PATCH failed after ${applied} of ${items.length} account${plural(items.length)} were written (accounts ${i + 1}\u2013${i + chunk.length} may be partially applied): ${msg}
+        `PATCH failed after ${applied} of ${items.length} account${plural(items.length)} were written (accounts ${i + 1}\u2013${i + chunk2.length} may be partially applied): ${msg}
 Re-run the same command without --confirm-token: rows that landed plan as unchanged, so the new plan covers only the rest.`
       );
     }
-    applied += chunk.length;
+    applied += chunk2.length;
   }
   return applied;
 }
-async function chunkDrift(cfg, planned, chunk) {
+async function chunkDrift(cfg, planned, chunk2) {
   const now = await getAccounts(cfg.client, { date: cfg.date }, { signal: cfg.signal });
   const nowById = new Map(now.map((a) => [a.account_id, a]));
   const drift = [];
-  for (const { account_id: id } of chunk) {
+  for (const { account_id: id } of chunk2) {
     const before = planned.get(id);
     const after = nowById.get(id);
     const label = `${before.account_name} (${id})`;
@@ -58649,8 +59487,8 @@ function captureVersion() {
   return new Promise((resolve3) => {
     const child2 = spawn2("dr", ["--version"], { shell: true });
     let out = "";
-    child2.stdout.on("data", (chunk) => {
-      out += chunk.toString();
+    child2.stdout.on("data", (chunk2) => {
+      out += chunk2.toString();
     });
     child2.on("close", (code) => {
       if (code !== 0) {
@@ -62882,7 +63720,7 @@ async function pollExtractionStatus(client, contractFileIds, options = {}) {
       if (outstanding.length === 0) break;
       if (now() > deadline || inner.signal.aborted) break;
       for (let i = 0; i < outstanding.length; i += MAX_BULK_STATUS_IDS) {
-        const chunk = outstanding.slice(i, i + MAX_BULK_STATUS_IDS);
+        const chunk2 = outstanding.slice(i, i + MAX_BULK_STATUS_IDS);
         const tickAc = new AbortController();
         const onInnerAbort = () => tickAc.abort(inner.signal.reason);
         if (inner.signal.aborted) {
@@ -62891,13 +63729,13 @@ async function pollExtractionStatus(client, contractFileIds, options = {}) {
           inner.signal.addEventListener("abort", onInnerAbort, { once: true });
         }
         try {
-          const resp = await getBulkProcessStatus(client, chunk, {
+          const resp = await getBulkProcessStatus(client, chunk2, {
             signal: tickAc.signal
           });
-          for (let j = 0; j < chunk.length; j++) {
+          for (let j = 0; j < chunk2.length; j++) {
             const entry = resp.results[j];
             if (entry !== void 0 && isTerminalAiStatus(entry.ai_processing_status)) {
-              resolved.set(chunk[j], entry);
+              resolved.set(chunk2[j], entry);
             }
           }
         } catch (err) {
@@ -64658,10 +65496,10 @@ async function extractSync(cfg, parts) {
   const chunked = chunkContracts([...parts], MAX_FILES_PER_BATCH);
   let abortedMidRun = false;
   for (let ci = 0; ci < chunked.length; ci++) {
-    const chunk = chunked[ci];
+    const chunk2 = chunked[ci];
     try {
       const results = await retryAsync(
-        () => uploadFilesWithAi(cfg.client, chunk, {
+        () => uploadFilesWithAi(cfg.client, chunk2, {
           isAdditional: cfg.isAdditional,
           signal: cfg.signal
         }),
@@ -64679,7 +65517,7 @@ async function extractSync(cfg, parts) {
         }
       );
       allResults.push(...results);
-      for (const part of chunk) {
+      for (const part of chunk2) {
         sourceFiles.push(part.sourcePath);
         outcomes.push({ path: part.sourcePath, ok: true, detail: "extracted" });
       }
@@ -64687,7 +65525,7 @@ async function extractSync(cfg, parts) {
       const msg = err instanceof Error ? err.message : String(err);
       const kind = classifyFailure(err);
       const detail = kind === "ambiguous" ? `${msg} \u2014 upstream may still be processing; check before re-sending` : msg;
-      for (const part of chunk) {
+      for (const part of chunk2) {
         outcomes.push({ path: part.sourcePath, ok: false, detail });
       }
       if (kind === "abort") {
@@ -67694,8 +68532,8 @@ Pipe it (printf '%s\\n' "$APP_PASSWORD" | dr desk smtp set \u2026) or use --pass
   }
   const chunks = [];
   let total = 0;
-  for await (const chunk of process.stdin) {
-    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+  for await (const chunk2 of process.stdin) {
+    const buf = Buffer.isBuffer(chunk2) ? chunk2 : Buffer.from(String(chunk2));
     total += buf.length;
     if (total > maxBytes) {
       throw new Error(