@datarails-ai/dr-cli 1.6.74 → 1.6.76

package/README.md

@@ -1,7 +1,7 @@
 # dr-cli
 
-Datarails CLI. Server keys: `US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`,
-`TEST` — or pass a full `https://<host>.datarails.com` URL to reach an
+Datarails CLI. Server keys: `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`,
+`DEV-1`, `TEST` — or pass a full `https://<host>.datarails.com` URL to reach an
 ad-hoc (e.g. PR-preview) environment. Credentials live in the OS keychain (Windows Credential Manager,
 macOS Keychain), or in a credential file when one is present — which wins over
 the keychain, and is how `dr` runs where no keychain exists (CI, headless hosts,

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.74",
+  version: "1.6.76",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -38,7 +38,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.9.5",
+    "@datarails-ai/dr-appspace-cli": "0.10.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -67,7 +67,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-09-30T12:03:03.518Z";
+var BUILD_TIME = "2026-09-30T13:02:37.064Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -412,6 +412,7 @@ var ordered = [
   { key: "UK", host: "https://ukapp.datarails.com", subDomain: "uk" },
   { key: "CA", host: "https://caapp.datarails.com", subDomain: "canada" },
   { key: "EU", host: "https://euapp.datarails.com", subDomain: "eu" },
+  { key: "STUDIO", host: "https://studio.datarails.com", subDomain: "studio" },
   { key: "DEV", host: "https://dev.datarails.com", subDomain: "dev" },
   { key: "DEV-1", host: "https://dev-1.datarails.com", subDomain: "dev-1" },
   { key: "TEST", host: "https://testapp.datarails.com", subDomain: "test" },
@@ -437,7 +438,7 @@ function list() {
 function keys() {
   return ordered.map((s) => s.key);
 }
-var PROD_KEYS = /* @__PURE__ */ new Set(["US", "US2", "UK", "CA", "EU", "DEMO"]);
+var PROD_KEYS = /* @__PURE__ */ new Set(["US", "US2", "UK", "CA", "EU", "STUDIO", "DEMO"]);
 function isProdServer(input) {
   let server;
   try {
@@ -5116,7 +5117,7 @@ async function poll(host, path11, deviceCode, options, onSuccess) {
   const interval = options.interval ?? 2e3;
   const maxWait = options.maxWait ?? 6e5;
   const now = options.now ?? Date.now;
-  const sleep3 = options.sleep ?? defaultSleep;
+  const sleep4 = options.sleep ?? defaultSleep;
   const signal = options.signal;
   const base = host.replace(/\/+$/, "");
   const deadline = now() + maxWait;
@@ -5144,7 +5145,7 @@ async function poll(host, path11, deviceCode, options, onSuccess) {
     }
     const errCode = tryParseErrorCode(text2);
     if (errCode === "authorization_pending" || errCode === "slow_down") {
-      await sleep3(interval, signal);
+      await sleep4(interval, signal);
       continue;
     }
     if (errCode) {
@@ -12048,7 +12049,7 @@ var defaultSleep2 = (ms, signal) => new Promise((resolve3, reject) => {
 async function pollTask(client, label, path11, options = {}) {
   const interval = options.pollIntervalMs ?? AGGREGATE_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? AGGREGATE_POLL_TIMEOUT_MS;
-  const sleep3 = options.sleep ?? defaultSleep2;
+  const sleep4 = options.sleep ?? defaultSleep2;
   const now = options.now ?? Date.now;
   const inner = new AbortController();
   const onOuterAbort = () => inner.abort(options.signal?.reason);
@@ -12090,7 +12091,7 @@ async function pollTask(client, label, path11, options = {}) {
         return result.env;
       }
       try {
-        await sleep3(interval, inner.signal);
+        await sleep4(interval, inner.signal);
       } catch {
         const reason = inner.signal.reason instanceof Error ? inner.signal.reason.message : String(inner.signal.reason ?? "aborted");
         throw new Error(`${label} polling timed out: ${reason}`);
@@ -16881,7 +16882,7 @@ var LUT_SAVE_POLL_TIMEOUT_MS = 3e5;
 async function saveMappings(client, documentId, body, options = {}) {
   const interval = options.pollIntervalMs ?? LUT_SAVE_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? LUT_SAVE_POLL_TIMEOUT_MS;
-  const sleep3 = options.sleep ?? defaultPollSleep;
+  const sleep4 = options.sleep ?? defaultPollSleep;
   const now = options.now ?? Date.now;
   const deadline = now() + timeout;
   const path11 = `/api/documents/${documentId}/web_update_lut`;
@@ -16903,7 +16904,7 @@ async function saveMappings(client, documentId, body, options = {}) {
         `lut save-mappings: the server is still writing after ${Math.round(timeout / 1e3)}s (task ${cacheKey}). The write is still running server-side \u2014 re-run the same command to rejoin it, or raise --timeout.`
       );
     }
-    await sleep3(interval, options.signal);
+    await sleep4(interval, options.signal);
     const tick = await postOnce(client, pollPath, payload, options.signal);
     if (tick.status === 200) {
       return toResult(tick.text);
@@ -17201,7 +17202,7 @@ async function exportDocument(client, id, destinationOrgIds, override, reqOption
 async function pollDocumentJob(client, basePath, label, requestId, options = {}) {
   const interval = options.pollIntervalMs ?? AUTO_CALC_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? AUTO_CALC_POLL_TIMEOUT_MS;
-  const sleep3 = options.sleep ?? defaultSleep3;
+  const sleep4 = options.sleep ?? defaultSleep3;
   const now = options.now ?? Date.now;
   const deadline = now() + timeout;
   for (; ; ) {
@@ -17229,7 +17230,7 @@ async function pollDocumentJob(client, basePath, label, requestId, options = {})
         `${label} polling timed out after ${timeout}ms (request ${requestId} still processing)`
       );
     }
-    await sleep3(interval, options.signal);
+    await sleep4(interval, options.signal);
   }
 }
 
@@ -20454,7 +20455,7 @@ async function waitForReAggregation(cfg) {
   let interval = cfg.pollIntervalMs ?? REAGG_POLL_INTERVAL_MS;
   const maxInterval = cfg.maxPollIntervalMs ?? REAGG_POLL_MAX_INTERVAL_MS;
   const timeout = cfg.timeoutMs ?? REAGG_POLL_TIMEOUT_MS;
-  const sleep3 = cfg.sleep ?? defaultSleep4;
+  const sleep4 = cfg.sleep ?? defaultSleep4;
   const now = cfg.now ?? Date.now;
   const accepted = [...cfg.accepted];
   const observedProcessing = /* @__PURE__ */ new Set();
@@ -20489,7 +20490,7 @@ async function waitForReAggregation(cfg) {
       break;
     }
     try {
-      await sleep3(interval, cfg.signal);
+      await sleep4(interval, cfg.signal);
     } catch {
       aborted = true;
       break;
@@ -23096,7 +23097,7 @@ async function waitForSuggestionRun(r, cfg, runId) {
   let interval = cfg.pollIntervalMs ?? SUGGESTIONS_POLL_INTERVAL_MS;
   const maxInterval = cfg.maxPollIntervalMs ?? SUGGESTIONS_POLL_MAX_INTERVAL_MS;
   const timeout = cfg.timeoutMs ?? SUGGESTIONS_POLL_TIMEOUT_MS;
-  const sleep3 = cfg.sleep ?? defaultSleep5;
+  const sleep4 = cfg.sleep ?? defaultSleep5;
   const now = cfg.now ?? Date.now;
   const errOut = cfg.errOut ?? process.stderr;
   const start = now();
@@ -23126,7 +23127,7 @@ async function waitForSuggestionRun(r, cfg, runId) {
       break;
     }
     try {
-      await sleep3(interval, cfg.signal);
+      await sleep4(interval, cfg.signal);
     } catch {
       aborted = true;
       break;
@@ -25321,7 +25322,7 @@ var defaultSleep6 = (ms, signal) => new Promise((resolve3, reject) => {
 });
 async function putDataWithPolling(client, dashboardId, id, payload, options = {}) {
   const interval = options.pollIntervalMs ?? WIDGET_DATA_POLL_INTERVAL_MS;
-  const sleep3 = options.sleep ?? defaultSleep6;
+  const sleep4 = options.sleep ?? defaultSleep6;
   const path11 = `/api/dashboards/${dashboardId}/widgets/${id}/data`;
   const body = JSON.stringify(payload);
   const first = await putDataOnce(client, path11, body, options);
@@ -25338,7 +25339,7 @@ async function putDataWithPolling(client, dashboardId, id, payload, options = {}
   const pollPath = `${path11}?cache_key=${encodeURIComponent(cacheKey)}`;
   for (; ; ) {
     try {
-      await sleep3(interval, options.signal);
+      await sleep4(interval, options.signal);
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       throw new Error(`widget data polling timed out: ${reason}`);
@@ -29099,6 +29100,9 @@ function registerSkillCommand(root) {
   });
 }
 
+// src/commands/datamappers.ts
+import { setTimeout as sleep3 } from "timers/promises";
+
 // src/api/datamappers.ts
 async function list20(client, tableId, options) {
   const out = await client.getJSON(`/api/templates/${tableId}/mappers`, options);
@@ -29116,6 +29120,14 @@ async function get14(client, tableId, id, options) {
   }
   return out;
 }
+async function getDetails2(client, id, options) {
+  const path11 = `/api/templates/mappers/${id}`;
+  const out = await client.getJSON(path11, options);
+  if (out === null) {
+    throw new Error(`GET ${path11}: empty response from datamapper details`);
+  }
+  return out;
+}
 async function create12(client, tableId, body, options) {
   const path11 = `/api/templates/${tableId}/mappers`;
   const out = await client.postJSON(path11, body, options);
@@ -29864,13 +29876,15 @@ async function runDatamappersUpdate(cfg) {
     body = decodedBody;
   }
   validateCalcFields(extractCalcFields(body));
+  const err = cfg.err ?? process.stderr;
+  const scanBaseline = rescanValue === "latest" && cfg.verifyScanDispatch !== void 0 ? await captureScanBaseline(cfg.client, cfg.id, cfg.signal, err) : void 0;
   let updated;
   try {
     updated = await update8(cfg.client, cfg.id, body, {
       signal: cfg.signal
     });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
     if (/HTTP 500/.test(msg)) {
       const hint = "hint: the server logs an `ETLError: Custom Columns: The creation of '<field>' field has failed due to incorrect formula syntax.` line for this case but the response body is a bare 500 HTML page. Common causes the client-side guard cannot detect: (1) a [field] reference in a calc formula that does not resolve to any header `map_to`, calc-field `name`, or system field (`[FileBox_ID]`, `[System_Year]`, `[Posting Date]`, \u2026), (2) an unsupported function name (try copying the function spelling from another working calc field via `dr datamappers get`), (3) a string literal that's a plain-English placeholder (e.g. `\"Customer or Client name\"`) which parses but the ETL refuses. Iterate on calc-field formulas one at a time. If every formula looks correct and PUT still 500s, fall back to the workaround: `dr datamappers create from-file <table> --file <new.json>` then `dr datamappers delete <old_id> --table <table>` (note: this orphans references \u2014 LUTs/dashboards/functions pointing at the old mapper id break).";
       const responseBody = extractResponseBodyFromError(msg);
@@ -29896,13 +29910,106 @@ Full request + response captured to: ${logPath}
 
 ${hint}${logSuffix}`);
     }
-    throw err;
+    throw err2;
   }
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, updated);
-    return;
+  } else {
+    renderMappersTable(cfg.out, [updated]);
+  }
+  if (scanBaseline !== void 0) {
+    const opts = cfg.verifyScanDispatch ?? {};
+    const started2 = await waitForNewScan(cfg.client, scanBaseline, cfg.signal, opts);
+    if (!started2) {
+      const docIds = await mappedDocumentIds(
+        cfg.client,
+        scanBaseline.templateId,
+        cfg.id,
+        cfg.signal
+      );
+      err.write(
+        formatNoScanWarning({
+          mapperId: cfg.id,
+          templateId: scanBaseline.templateId,
+          timeoutMs: opts.timeoutMs ?? DEFAULT_SCAN_DISPATCH_TIMEOUT_MS,
+          docIds
+        })
+      );
+    }
+  }
+}
+var DEFAULT_SCAN_DISPATCH_TIMEOUT_MS = 3e4;
+var DEFAULT_SCAN_DISPATCH_POLL_MS = 2e3;
+function scanFingerprint(report) {
+  let maxScanId = 0;
+  for (const doc of report.documents ?? []) {
+    for (const v of doc.versions ?? []) {
+      if (typeof v.scan_id === "number" && v.scan_id > maxScanId) maxScanId = v.scan_id;
+    }
+  }
+  return `${report.scans_status?.last_updated ?? ""}|${maxScanId}`;
+}
+async function captureScanBaseline(client, mapperId, signal, err) {
+  try {
+    const details = await getDetails2(client, mapperId, { signal });
+    const templateId = details.template.id;
+    const report = await getStatus(client, templateId, { signal });
+    return { templateId, fingerprint: scanFingerprint(report) };
+  } catch (e) {
+    if (signal.aborted) throw e;
+    err.write(
+      "note: could not read the scan status before the update, so dr cannot confirm a rescan starts. Check with `dr scans status <template_id>` afterwards.\n"
+    );
+    return void 0;
   }
-  renderMappersTable(cfg.out, [updated]);
+}
+async function waitForNewScan(client, baseline, signal, opts) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SCAN_DISPATCH_TIMEOUT_MS;
+  const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_SCAN_DISPATCH_POLL_MS;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    try {
+      const report = await getStatus(client, baseline.templateId, { signal });
+      if (scanFingerprint(report) !== baseline.fingerprint) return true;
+    } catch (e) {
+      if (signal.aborted) throw e;
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) return false;
+    await sleep3(Math.min(pollIntervalMs, remaining), void 0, { signal });
+  }
+}
+async function mappedDocumentIds(client, templateId, mapperId, signal) {
+  try {
+    const mapper = await get14(client, templateId, mapperId, { signal });
+    return Array.isArray(mapper.mapped_documents_ids) ? mapper.mapped_documents_ids : void 0;
+  } catch (e) {
+    if (signal.aborted) throw e;
+    return void 0;
+  }
+}
+function formatNoScanWarning(p) {
+  const secs = Math.round(p.timeoutMs / 1e3);
+  const lines = [
+    `warning: mapper ${p.mapperId} was saved, but no new scan showed up on template ${p.templateId} within ${secs}s.`,
+    '  Either the scan is still queued, or this server predates the DR-54200 fix and ignored rescan="latest", so existing data still has the old config.',
+    `  Check first: dr scans status ${p.templateId}`
+  ];
+  if (p.docIds !== void 0 && p.docIds.length === 0) {
+    lines.push("  The mapper has no bound documents, so there is nothing to scan.");
+  } else {
+    const docFlags = p.docIds !== void 0 ? p.docIds.map((d) => `--doc ${d}`).join(" ") : "--doc <doc_id> [--doc <doc_id> ...]";
+    lines.push(
+      "  If no new scan appears there, re-bind the mapper to its current documents with a rescan:"
+    );
+    if (p.docIds === void 0) {
+      lines.push(
+        `    dr datamappers get ${p.mapperId} --table ${p.templateId} --json   # read mapped_documents_ids`
+      );
+    }
+    lines.push(`    dr datamappers bind ${p.mapperId} ${docFlags} --rescan latest`);
+  }
+  return lines.join("\n") + "\n";
 }
 async function buildConveniencePayload(client, tableId, name, versionId, sheet, flags, signal) {
   const fieldTypes = parseFieldOverrides(flags.fieldOverrides);
@@ -30217,7 +30324,7 @@ function renderMappersTable(out, mappers) {
     }
   ];
   for (const m of mappers) {
-    const ordinal = m.ordinal === null ? "-" : String(m.ordinal);
+    const ordinal = m.ordinal == null ? "-" : String(m.ordinal);
     rows.push({
       cells: [
         String(m.id),
@@ -30515,7 +30622,7 @@ function registerDatamappersCommand(root) {
   addServerFlag(fromFileCmd);
   addAccountFlag(fromFileCmd);
   const updateCmd = dm.command("update").description(
-    'Update a datamapper (payload-file only \u2014 server accepts config+sheet_name+rescan). `--rescan latest` (the default) mirrors the UI "Publish and scan": it re-extracts only the LATEST document version onto the live template. For a full historical rescan (every calculated field re-executed against every document version ever uploaded), use `dr rescan table <template_id>` instead \u2014 that is far more expensive and higher-blast.'
+    "Update a datamapper in place (payload-file only \u2014 server accepts config+sheet_name+rescan). `--rescan latest` (the default) re-extracts the LATEST version of each document bound to the mapper. Servers without the DR-54200 fix save the config and start no scan, so after the update dr watches the template for a new scan and, when none shows up, prints how to check `dr scans status` and the `dr datamappers bind` fallback. For a full historical rescan (every calculated field re-executed against every document version ever uploaded), use `dr rescan table <template_id>` instead \u2014 that is far more expensive and higher-blast."
   ).argument("<mapper_id>", "mapper id (positive integer)").option("--payload-file <path>", "Path to a JSON file with the PUT body (required)", "").option(
     "--field <NAME:TYPE>",
     'Set a column type via fields_to_change (Text|Float|Date|Integer). Repeatable. Mirrors the UI "Publish and scan" so a calc column referencing a LUT-injected column materialises instead of 500ing on inferred types. Note: the server blocks a type change (HTTP 400) when the template has more than one mapper.',
@@ -30538,7 +30645,8 @@ function registerDatamappersCommand(root) {
           serverFlag: opts.server ?? "",
           asJson: opts.json === true,
           signal: setup.signal,
-          out: process.stdout
+          out: process.stdout,
+          verifyScanDispatch: {}
         });
       } finally {
         setup.cleanup();
@@ -32704,7 +32812,7 @@ async function runIntegrationsSync(cfg) {
     throw new Error("integration id must be positive");
   }
   const interval = cfg.pollIntervalMs ?? INTEGRATIONS_SYNC_POLL_INTERVAL_MS;
-  const sleep3 = cfg.sleep ?? defaultSleep7;
+  const sleep4 = cfg.sleep ?? defaultSleep7;
   const resp = await resync(cfg.client, cfg.id, {
     signal: cfg.signal
   });
@@ -32753,7 +32861,7 @@ async function runIntegrationsSync(cfg) {
         return;
       }
       try {
-        await sleep3(interval, inner.signal);
+        await sleep4(interval, inner.signal);
       } catch {
         cfg.out.write(
           `Timed out waiting for sync to finish \u2014 last status was ${orDash(lastStatus)}
@@ -37527,7 +37635,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
     throw new Error("version id must be positive");
   }
   const err = cfg.err ?? process.stderr;
-  const sleep3 = cfg.sleep ?? defaultCycleTagSleep;
+  const sleep4 = cfg.sleep ?? defaultCycleTagSleep;
   const settleMs = cfg.tagSettleDelayMs ?? CYCLE_TAG_SETTLE_DELAY_MS;
   const details = await getDetails(cfg.client, cfg.docId, { signal: cfg.signal });
   const tag = (details.tags_config ?? []).find(isFileStatusTag);
@@ -37620,7 +37728,7 @@ async function runFileboxSetVersionFileStatus(cfg) {
     }
   };
   const readBack = async () => {
-    await sleep3(settleMs, cfg.signal);
+    await sleep4(settleMs, cfg.signal);
     return readVersionForConfirm(cfg.client, cfg.versionId, cfg.docId, cfg.signal);
   };
   await write();
@@ -58372,7 +58480,7 @@ async function defaultSleep8(ms, signal) {
 async function pollExtractionStatus(client, contractFileIds, options = {}) {
   const interval = options.pollIntervalMs ?? EXTRACT_POLL_INTERVAL_MS;
   const timeout = options.timeoutMs ?? EXTRACT_POLL_TIMEOUT_MS;
-  const sleep3 = options.sleep ?? defaultSleep8;
+  const sleep4 = options.sleep ?? defaultSleep8;
   const now = options.now ?? Date.now;
   const resolved = /* @__PURE__ */ new Map();
   if (contractFileIds.length === 0) return { resolved, pending: [] };
@@ -58422,7 +58530,7 @@ async function pollExtractionStatus(client, contractFileIds, options = {}) {
       options.onTick?.(resolved.size, contractFileIds.length);
       if (resolved.size >= contractFileIds.length) break;
       if (now() > deadline || inner.signal.aborted) break;
-      await sleep3(interval, inner.signal);
+      await sleep4(interval, inner.signal);
     }
   } finally {
     clearTimeout(deadlineTimer);

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.74",
+  "cliVersion": "1.6.76",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/SKILL.md

@@ -23,7 +23,8 @@ for any command come from `dr <command> --help` (the binary is authoritative).
    `register-identity`, `bulk-create`, `bulk-set-email`, `bulk-permissions`,
    `set-email`, `set-email-notifications`, `bulk-set-email-notifications`,
    `set-password`, `set-field-type`) — on `US`, `US2`, `UK`, `CA`,
-   `EU`, `DEMO` (DEMO is a customer-facing prod tenant, not a sandbox) must be
+   `EU`, `STUDIO`, `DEMO` (DEMO is a customer-facing prod tenant, not a sandbox;
+   STUDIO is the free-tier environment and holds real prospects' data) must be
    confirmed by the user before you run them. `register-identity --confirm` in
    particular sends real invite emails to customers, so it counts as a prod
    write. Demonstrate on `DEV` / `DEV-1` / `TEST` / `TEST-1`..`TEST-7` first when
@@ -40,7 +41,7 @@ for any command come from `dr <command> --help` (the binary is authoritative).
    dialog (or TTY prompt) where the *user* types a fresh challenge word; in a
    headless shell it refuses non-zero. Don't add your own word ritual in chat.
    Non-prod (`DEV`/`DEV-1`/`TEST`/`TEST-1`..`TEST-7`) is token-only, a plain
-   "yes" suffices; `DEMO` counts as prod. Details in
+   "yes" suffices; `DEMO` and `STUDIO` count as prod. Details in
    [reference/safety.md](reference/safety.md).
 4. **Credentials are sensitive.** Sessions live in the OS keychain, or in a
    credential file where one is in use — never extract or echo JWTs or session
@@ -103,7 +104,7 @@ update it in the file alongside the key, or the warning keeps naming the old
 one.
 
 `--server <KEY>` is **required on every command that hits an API**. Valid keys:
-`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` (case-insensitive).
+`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` (case-insensitive).
 
 You can also pass a full **`https://<host>.datarails.com` URL** instead of a
 key to reach an ad-hoc / PR-preview environment, e.g.
@@ -539,8 +540,8 @@ returns the source rows behind the number.
 counts — and a token; re-run with `--confirm-token` to fire it) → poll `scans
 status` again. This is a **full historical** rescan (every calc field × every
 version). To only pick up a datamapper change on the live template, prefer
-`datamappers update <id> --rescan latest` (latest version only; mirrors "Publish
-and scan") — far cheaper and lower-blast.
+`datamappers update <id> --rescan latest` (latest version of the mapper's bound
+documents only) — far cheaper and lower-blast.
 
 **Build a `create` body from plain-English intent** (calc models, datamappers,
 metrics): you resolve names → integer IDs yourself against the tenant

package/dist/skills/dr-cli/reference/datamappers.md

@@ -67,6 +67,12 @@ value-inference behavior. `NAME` is the target **table field** name (the
 ## Update / preview / bind / delete
 
 - `datamappers update`, `datamappers delete` (two-step confirm).
+- `datamappers update --rescan latest` — after the PUT, dr watches the
+  template's scan status for up to 30s, because servers without the DR-54200 fix
+  save the config but ignore `rescan: "latest"`. If no new scan shows up, it
+  prints a warning with a ready `datamappers bind <id> --doc … --rescan latest`
+  command. Run `scans status <template_id>` first: the scan may only be queued,
+  and `bind` on a queued scan starts a second one. Don't re-run `update`.
 - `datamappers preview --payload-file <p>` — renders mapper output for sample
   input ("what would this extract?") before saving.
 - `datamappers bind <mapper_id> --doc <id> [--rescan latest|all]` — change which

package/dist/skills/dr-cli/reference/multi-product.md

@@ -117,7 +117,7 @@ org 99.
 
 Token TTL is 10 minutes — past that, re-run step 1.
 
-For prod (`US`/`US2`/`UK`/`CA`/`EU`/`DEMO`), get the user's in-chat "yes" before
+For prod (`US`/`US2`/`UK`/`CA`/`EU`/`STUDIO`/`DEMO`), get the user's in-chat "yes" before
 re-invoking with the token; the binary's interactive gate then has the user
 type a challenge word in a dialog, same as any other destructive write — see
 [safety.md](safety.md).

package/dist/skills/dr-cli/reference/safety.md

@@ -38,7 +38,8 @@ Reads never need confirmation. Gated **writes** fall into two tiers (full table:
 `src/commands/_prodGateTiers.ts`):
 
 - **Tier A — destructive / irreversible / org-wide.** On a prod tenant (`US`,
-  `US2`, `UK`, `CA`, `EU`, `DEMO` — DEMO is customer-facing) the binary requires a
+  `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` — DEMO is customer-facing, STUDIO holds
+  real prospects' data) the binary requires a
   live human to type a fresh challenge word in a desktop dialog / TTY (see
   "Binary-enforced interactive gate" below). Relay the plan output (target name
   + blast radius), get a clear in-chat "yes, do it", then re-invoke with
@@ -105,7 +106,7 @@ the LUT that 4 functions depend on" — before running.
 
 The human check is enforced **in the binary** — not by prose an agent could
 skip or forget. When a valid `--confirm-token` is redeemed for a **Tier-A**
-action against a prod tenant (`US`, `US2`, `UK`, `CA`, `EU`, `DEMO` — plus,
+action against a prod tenant (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` — plus,
 fail-closed, any server the CLI cannot positively classify as non-prod, and any
 action not positively classified as Tier B), the binary requires a live human:
 

package/dist/skills/dr-cli/reference/templates.md

@@ -150,7 +150,7 @@ except on `update`, which resolves the range's own table automatically.
   `--confirm-token` — token-only, no word gate even on prod (a rescan re-derives
   data, it doesn't delete it). To pick up a datamapper change on the live template
   **without** touching history, use `datamappers update <id> --rescan latest`
-  instead (mirrors the UI "Publish and scan"); a full rescan will re-run pre-existing
+  instead (re-extracts the latest version of the mapper's bound documents); a full rescan will re-run pre-existing
   calc fields against old rows, so a latent divide-by-null there fails the whole
   scan. Refuses `UsageStats` on every tenant (system data, not customer-owned).
 - `dataflow get` — the dependency graph: inputs → mappers → LUTs → table →

package/dist/skills/dr-error-enrichment/SKILL.md

@@ -67,7 +67,7 @@ These hold in every sub-skill; the detail is in
 [reference/safety-backup.md](reference/safety-backup.md).
 
 1. **Confirm the target server explicitly** — ask, never infer it from earlier
-   conversation. `US`, `US2`, `UK`, `CA`, `EU`, `DEMO` are all prod.
+   conversation. `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` are all prod.
 2. **Back up every reachable server before the first write** of a session, not
    just the target — the export is also the diff baseline. One command:
    `dr error-enrichments export --all-servers --out <dir>`. Tell the user the

package/dist/skills/dr-error-enrichment/reference/groundcover.md

@@ -64,9 +64,10 @@ Groundcover envs are not dr-cli server keys. Envs are `prod-us`, `prod-east-us`,
 | `DEMO` | `prod-demo` |
 | `US` / `US2` | **ambiguous** across `prod-us`, `prod-east-us`, `prod-west-us-2` |
 | `EU` | **unmapped** — resolve it before mining (see below) |
+| `STUDIO` | **unmapped** — resolve it before mining (see below) |
 
-`EU` was added to the registry after this table was written and its
-groundcover env has not been confirmed. Resolve it the same way as the US
+`EU` and `STUDIO` were added to the registry after this table was written and
+their groundcover envs have not been confirmed. Resolve them the same way as the US
 ambiguity before mining, and record the answer here once known.
 
 Resolve the US ambiguity with

package/dist/skills/dr-error-enrichment/reference/safety-backup.md

@@ -9,8 +9,8 @@ reading.
 
 **1. Confirm the target server explicitly.** Ask (AskUserQuestion) which server
 to change — never infer it from earlier context in the conversation. Prod keys
-are `US`, `US2`, `UK`, `CA`, `EU`, `DEMO` (DEMO is customer-facing prod, not a
-sandbox). Demonstrate on `DEV` / `TEST-*` first when the user is undecided.
+are `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO` (DEMO is customer-facing prod, not a
+sandbox; STUDIO is the free-tier environment and holds real prospects' data). Demonstrate on `DEV` / `TEST-*` first when the user is undecided.
 
 **2. Back up every reachable server first.** Before the first write of a
 session, one command — `export` takes the same sweep flags as `list` / `stats`,

package/dist/skills/dr-error-enrichment-improve/SKILL.md

@@ -44,7 +44,7 @@ fixing disliked rules is `dr-error-enrichment-maintain`.
 **1. Pick the region and the window, and prove they line up.** Ask which server
 the user intends to improve, then map it to the groundcover env before querying —
 `UK` is `prod-uk*`, `CA` is `prod-canada-central`, `DEMO` is `prod-demo`, and
-`US`/`US2` are ambiguous across the three US envs and `EU` is not mapped at
+`US`/`US2` are ambiguous across the three US envs and `EU` and `STUDIO` are not mapped at
 all, so resolve those explicitly (see the reference). Mining one region's logs to justify a rule you then write to
 another is the failure mode this step exists to prevent. Start with a tight
 window and widen only after it returns rows.

package/dist/skills/dr-filebox-api-setup/SKILL.md

@@ -23,7 +23,7 @@ Before issuing any commands, confirm the following with the user if not already
 | Input | How to resolve |
 |---|---|
 | **Target fileboxes** | IDs/names, or a folder name to expand — run `dr filebox list --server <S>` and filter by parent folder ID |
-| **Server** | Ask if not obvious from context (`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`) |
+| **Server** | Ask if not obvious from context (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`) |
 | **Connection** | Run `dr integrations list --server <S>` and show the WorkatoBased options; ask the user to pick |
 | **Object type** | Ask — commonly `table`; surface the value from a reference filebox if one exists |
 | **Start date / End date** | Ask — commonly "start of month" / "end of month", which maps to `{{date_tag|somonth}}` / `{{date_tag|eomonth}}` |
@@ -69,7 +69,7 @@ If no reference exists, build the payload from the gathered inputs (see Step 4).
 
 ## Step 3 — Enable Upload via API on all target fileboxes
 
-Run in parallel for efficiency. This is a prod write — confirm with the user before running on `US`, `US2`, `UK`, `CA`, `EU`, `DEMO`.
+Run in parallel for efficiency. This is a prod write — confirm with the user before running on `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO`.
 
 ```bash
 dr documents support-api set <id1> --on --server <S> &
@@ -152,7 +152,7 @@ Offer to export the table as a CSV if the user wants it.
 
 ## Guard rails
 
-- **Prod confirmation required.** `support_api` and `data-query set` are writes. On `US`, `US2`, `UK`, `CA`, `EU`, `DEMO`, confirm in-chat before running.
+- **Prod confirmation required.** `support_api` and `data-query set` are writes. On `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEMO`, confirm in-chat before running.
 - **Never read out tokens or JWTs.** The UUID returned is not a secret, but session tokens are — do not surface them.
 - **Always verify the integration ID from `dr integrations list`** — do not guess or reuse IDs from a prior session without confirming they match the current tenant.
 - **Always quote file paths** in `--payload-file` on Windows to handle spaces in directory names.

package/dist/skills/dr-switch-user/SKILL.md

@@ -53,7 +53,7 @@ The skill is invoked in one of these forms:
 
 ## Server keys (the universe to probe)
 
-`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` — case-insensitive.
+`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO` — case-insensitive.
 These are the only valid `--server` values dr-cli accepts.
 
 ---
@@ -82,7 +82,7 @@ across all servers wastes turns and can scope the default wrongly.
 Print verbatim, then wait for the user's reply. Do not guess from
 context, prior turns, or `userEmail`:
 
-> Which server should I switch to `<email>` on? (`US`, `US2`, `UK`, `CA`, `EU`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`)
+> Which server should I switch to `<email>` on? (`US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`, `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`, `TEST-6`, `TEST-7`, `DEMO`)
 
 ### 2.2. Probe that one server
 
@@ -226,7 +226,7 @@ Use the **single-loop pattern** (same reason as Section 2 — parallel
 tool calls cancel each other on the first non-zero exit):
 
 ```bash
-for srv in US US2 UK CA EU DEV DEV-1 TEST TEST-1 TEST-2 TEST-3 TEST-4 TEST-5 TEST-6 TEST-7 DEMO; do
+for srv in US US2 UK CA EU STUDIO DEV DEV-1 TEST TEST-1 TEST-2 TEST-3 TEST-4 TEST-5 TEST-6 TEST-7 DEMO; do
   echo "=== $srv ==="
   dr whoami --server "$srv" 2>&1 || true
 done

package/dist/skills/fx-conversion-matrix/SKILL.md

@@ -728,7 +728,7 @@ the package layout reaches every producer.
 
 - **Every write here is prod-tier.** Functions, filebox, mappers, lookups and custom
   currencies are all mutations. Confirm before running on `US`, `US2`, `UK`, `CA`,
-  `EU` — **and on `DEMO`**, which is a customer-facing demo tenant, not a sandbox.
+  `EU`, `STUDIO` — **and on `DEMO`**, which is a customer-facing demo tenant, not a sandbox.
   Prefer a `DEV`/`TEST*` rehearsal when the org is unstated.
 - **Never guess a currency, a base, or a missing pair.** Each is a question for the
   customer. A wrong rate mislabels real money and nobody downstream can tell.

package/dist/skills/mec-table-validation/SKILL.md

@@ -38,8 +38,8 @@ config before the operator wastes time debugging downstream symptoms.
 
 ## Inputs
 
-- `--server <key>` — required. Valid: `US`, `US2`, `UK`, `CA`, `EU`, `DEV`,
-  `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`,
+- `--server <key>` — required. Valid: `US`, `US2`, `UK`, `CA`, `EU`, `STUDIO`,
+  `DEV`, `DEV-1`, `TEST`, `TEST-1`, `TEST-2`, `TEST-3`, `TEST-4`, `TEST-5`,
   `TEST-6`, `TEST-7`, `DEMO` (case-insensitive). Default per project
   convention: `US`.
 - `--report` — optional. Writes a markdown report to cwd in addition to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.74",
+  "version": "1.6.76",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.9.5",
+    "@datarails-ai/dr-appspace-cli": "0.10.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",