@gravity-rail/cli 0.15.0 → 0.17.0

package/dist/lib.js

@@ -59,6 +59,19 @@ var COMMON_ARGS = [
   { name: "id", description: "Entity ID" },
   { name: "uuid", description: "Entity UUID" }
 ];
+var ORG_UUID_ARG = {
+  name: "org-uuid",
+  aliases: ["org"],
+  description: "Organization UUID or ID",
+  required: true
+};
+function requireOrgRef(args) {
+  const val = args["org-uuid"] ?? args.org;
+  if (typeof val !== "string" || !val) {
+    throw new CLIError("Missing required argument: --org-uuid");
+  }
+  return val;
+}
 function parseArgs(defs, argv) {
   const allDefs = [...defs, ...COMMON_ARGS];
   const result2 = {};
@@ -838,8 +851,8 @@ var CommandRegistry = class {
     const key = cmd.path.join(" ");
     this.commands.set(key, cmd);
   }
-  registerCommands(commands3) {
-    for (const cmd of commands3) {
+  registerCommands(commands4) {
+    for (const cmd of commands4) {
       this.registerCommand(cmd);
     }
   }
@@ -1215,6 +1228,43 @@ var agentTasksDomain = {
 
 // src/domains/agents.ts
 var COLUMNS = [COL.id(), COL.uuid(), COL.name(), COL.status(), COL.created()];
+var AGENT_FIELD_REFERENCE = `
+Field reference for --data JSON (create/update):
+
+Required on create
+  name (string)                         Display name
+  chatModelId (string)                  Text chat model ID (see \`gr ai-models chat\`)
+                                        e.g. "aws:bedrock:claude-4-5-haiku"
+
+Optional
+  description (string)                  Short summary shown in listings
+  systemPrompt (string)                 Base instructions / identity
+  chatModelConfig (object|null)         Chat model overrides (temperature, thinking, \u2026)
+  realtimeModelId (string|null)         Voice/realtime model (see \`gr ai-models realtime\`)
+                                        e.g. "xai:realtime:voice-agent-2" (Grok Voice Think Fast 2)
+                                        Native models auto-fill tts=native + default voice when
+                                        realtimeModelConfig is omitted.
+  realtimeModelConfig (object|null)     Realtime config. Native example:
+                                        {"ttsModel":"native","voiceModel":"xai:voice:eve"}
+                                        Composable (custom:realtime:composable) needs
+                                        voiceModel + ttsModel + inferenceModel.
+  memberRoleId (number)                 Role id (omit to use the default Agent role)
+  email / phone / externalId            Optional contact fields
+  labelIds (number[])                   Member label ids
+  codeInterpreterEnabled (bool)
+  maxDailyActions (number|null)
+
+Attach an agent\u2019s models/identity to a workflow (draft), then publish:
+  gr workflows update --id <wf> -d '{"copyFromAgentId": <agentId>}'
+  gr workflows publish --id <wf>
+
+One-shot workflow voice WITHOUT creating an agent (preferred for "use Grok Voice 2"):
+  gr workflows update --id <wf> -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'
+  gr workflows publish --id <wf>
+
+List models:
+  gr ai-models chat | realtime | voice
+`;
 var agentsDomain = {
   name: "agents",
   description: "Manage agents",
@@ -1231,9 +1281,16 @@ var agentsDomain = {
       unarchiveMethod: "unarchiveAgent",
       columns: COLUMNS,
       paginationSupport: "full",
-      updateHelp: "Update an agent. Body schema (JSON via --data/--file/stdin), all fields optional:\n  name              string   display name\n  description       string   short summary shown in listings\n  systemPrompt      string   base instructions for the agent\n  model             string   AI model slug (see `gr ai-models list`)\n  temperature       number   sampling temperature (0-2)\n  avatarFileId      number   workspace file ID for the avatar\n  config            object   AgentConfig overrides (advanced)\nWorkflow abilities are managed with `gr abilities`.",
+      createHelp: `Create an agent
+${AGENT_FIELD_REFERENCE}`,
+      updateHelp: `Update an agent. All fields optional.
+${AGENT_FIELD_REFERENCE}`,
+      createExamples: [
+        `gr agents create -d '{"name":"Support","chatModelId":"aws:bedrock:claude-4-5-haiku","realtimeModelId":"xai:realtime:voice-agent-2"}'`,
+        "gr agents create --file agent.json"
+      ],
       updateExamples: [
-        `gr agents update --id 42 --data '{"name":"Scheduler","temperature":0.4}'`,
+        `gr agents update --id 42 -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'`,
         "gr agents update --id 42 --file agent.json"
       ]
     })
@@ -1307,6 +1364,42 @@ var FEEDBACK_COLUMNS = [
   },
   COL.created()
 ];
+async function respondWithValue(ctx, workspace, args) {
+  const chatId = requireIdOrUuidFrom(args, "chat-id", "id");
+  const chat = await requireAuth(ctx).apiClient.getChat(workspace, chatId);
+  const interrupt = chat?.interrupt;
+  if (!interrupt || !interrupt.interruptId) {
+    throw new Error("No pending interrupt on this chat.");
+  }
+  const raw = args.value;
+  if (typeof raw !== "string" || !raw.length) {
+    throw new Error(
+      `A --value is required. For a form pass the field map as JSON, e.g. --value '{"channels":"sms,voice","days":"2"}'; for a choice list pass the chosen value.`
+    );
+  }
+  const url = `${ctx.envConfig.apiUrl}/api/v2/w/${workspace}/chats/${chat.id}/inference/hitl`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${requireAuth(ctx).accessToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ chosenValue: raw, interruptId: interrupt.interruptId })
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Resume failed (${response.status}): ${(await response.text()).slice(0, 400)}`
+    );
+  }
+  outputSingle(
+    {
+      status: "resumed",
+      chatId: chat.id,
+      next: `gr chats inspect --id ${chat.id} -w ${workspace}`
+    },
+    ctx
+  );
+}
 async function respondToInterrupt(ctx, workspace, args, decisionType) {
   const chatId = requireIdOrUuidFrom(args, "chat-id", "id");
   const chat = await requireAuth(ctx).apiClient.getChat(workspace, chatId);
@@ -1339,6 +1432,27 @@ async function respondToInterrupt(ctx, workspace, args, decisionType) {
   if (streamError) throw new Error(`Inference error: ${streamError}`);
   outputSingle({ role: "assistant", content: buffered }, ctx, MESSAGE_COLUMNS2);
 }
+function isDevProfile(env) {
+  return env === "dev" || env === "development" || env === "local";
+}
+function isLocalApiOrigin(apiUrl) {
+  if (!apiUrl) return false;
+  try {
+    const host = new URL(apiUrl).hostname.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".gravityrail.test");
+  } catch {
+    return false;
+  }
+}
+async function shouldRedactChatContent(ctx, apiClient, workspace) {
+  if (isDevProfile(ctx.env) && isLocalApiOrigin(ctx.envConfig?.apiUrl)) return false;
+  try {
+    const ws = await apiClient.getWorkspace(workspace);
+    return ws.phiPostureDecision !== "allow_non_phi";
+  } catch {
+    return true;
+  }
+}
 var chatsDomain = {
   name: "chats",
   description: "Manage chats",
@@ -1535,6 +1649,28 @@ var chatsDomain = {
         await respondToInterrupt(ctx, workspace, args, decisionType);
       }
     },
+    {
+      path: ["chats", "interrupt", "respond"],
+      description: "Answer a chat's pending UI interrupt (form or choice list) with a value, and stream the continued reply.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "chat-id",
+          aliases: ["id"],
+          description: "Chat ID (numeric id preferred; uuid accepted)",
+          required: true
+        },
+        {
+          name: "value",
+          description: `The answer. For a form, the field map as JSON (e.g. '{"channels":"sms,voice","days":"2"}'); for a choice list, the chosen value.`,
+          required: true
+        }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        await respondWithValue(ctx, workspace, args);
+      }
+    },
     {
       path: ["chats", "interrupt", "deny"],
       description: "Reject a chat's pending approval request with a reason.",
@@ -1565,7 +1701,17 @@ var chatsDomain = {
           description: "Chat ID (numeric id preferred; uuid accepted)",
           required: true
         },
-        { name: "stream", description: "Stream the AI response via AG-UI", isFlag: true }
+        { name: "stream", description: "Stream the AI response via AG-UI", isFlag: true },
+        {
+          // Read by the handler below since this command was written, but
+          // never declared — so `--auto-approve` parsed as nothing and the
+          // turn stopped on every tool call anyway. Driving a manager turn
+          // from the CLI meant approving each exec by hand, which is why
+          // multi-turn QA was impractical.
+          name: "auto-approve",
+          description: "Approve tool calls automatically for this turn (development QA). Capability round-trips (screenshots, browser, forms) still prompt.",
+          isFlag: true
+        }
       ],
       handler: async ({ ctx, workspace, args, data }) => {
         const content = typeof data === "string" ? data : data?.content;
@@ -1600,7 +1746,11 @@ var chatsDomain = {
           );
           process.stdout.write("\n");
           if (!streamed.trim()) {
-            await printPendingApproval(ctx, workspace, chatId);
+            if (!await printPendingApproval(ctx, workspace, chatId)) {
+              throw new Error(
+                `No response was produced for chat ${chatId}, and no approval is pending. The inference stream ended without emitting anything \u2014 usually the turn never started.`
+              );
+            }
           }
         } else {
           const aguiClient = new AGUIClient({
@@ -1630,6 +1780,9 @@ var chatsDomain = {
               chatId
             );
             if (await printPendingApproval(ctx, workspace, chatId, chat)) return;
+            throw new Error(
+              `No response was produced for chat ${chatId}, and no approval is pending. The inference stream ended without emitting anything \u2014 usually the turn never started. Check the API log for "Inference stream timed out for key inference:${workspace}:${chatId}" and the temporal-worker log for an "inference-${workspace}-${chatId}" workflow.`
+            );
           }
           outputSingle(
             {
@@ -1772,6 +1925,8 @@ var chatsDomain = {
           authed.apiClient.getChat(workspace, chatId),
           authed.apiClient.getChatMessages(workspace, chatId)
         ]);
+        const redact = await shouldRedactChatContent(ctx, authed.apiClient, workspace);
+        const hide = (value) => redact ? "[REDACTED]" : value;
         const result2 = {
           chat: {
             id: chat.id,
@@ -1787,7 +1942,7 @@ var chatsDomain = {
             // field projections (#20262). Always an array so the key
             // survives JSON serialization even when the API omits it.
             participants: (chat.participants ?? []).map((p) => ({
-              name: "[REDACTED]",
+              name: hide(p.name),
               role: p.role,
               memberId: p.memberId ?? null,
               memberType: p.memberType ?? null
@@ -1795,11 +1950,13 @@ var chatsDomain = {
           },
           // Deliberate allow-list — never spread the API message. PHI
           // lives in content and (if ever added) sttMetadata.words
-          // (#21973); both must stay out of inspect output.
+          // (#21973), so nothing beyond these three keys is emitted; the
+          // content itself is gated on posture (see
+          // shouldRedactChatContent), not blanket-hidden.
           messages: messages.map((m) => ({
             id: m.id,
             role: m.role,
-            content: "[REDACTED]"
+            content: hide(m.content)
           }))
         };
         const assignmentId = chat.assignmentId;
@@ -1817,7 +1974,7 @@ var chatsDomain = {
             dataRecords: assignment.dataRecords?.map((dr) => ({
               id: dr.id,
               dataTypeId: dr.dataTypeId,
-              fieldValues: "[REDACTED]"
+              fieldValues: hide(dr.fieldValues)
             }))
           };
         }
@@ -2205,8 +2362,26 @@ Core
   name (string)                         Display name
   description (string, optional)
   defaultPhoneNumberId (number|null)    Outbound caller ID (workspace phone id)
+  defaultInboxId (number|null)          Default inbox for inbound messaging
   permissions (object, optional)        Workflow-level permission flags
 
+Assistant / models (live on the DRAFT revision \u2014 publish to go live)
+  assistantName (string)                Display name for the workflow assistant
+  assistantIdentity (string)            Persona / identity instructions
+  chatModelId (string)                  Text chat model (see \`gr ai-models chat\`)
+  chatModelConfig (object|null)         Chat model overrides
+  realtimeModelId (string|null)         Voice/realtime model (see \`gr ai-models realtime\`)
+                                        One-shot voice example:
+                                        {"realtimeModelId":"xai:realtime:voice-agent-2"}
+                                        Native models auto-fill tts=native + default voice
+                                        (xAI \u2192 xai:voice:eve). Optional explicit config:
+                                        {"realtimeModelId":"xai:realtime:voice-agent-2",
+                                         "realtimeModelConfig":{"ttsModel":"native",
+                                           "voiceModel":"xai:voice:ara"}}
+  realtimeModelConfig (object|null)     Realtime config; omit for provider defaults
+  copyFromAgentId (number)              Copy full assistant settings from an agent
+  copyFromWorkflowRevisionId (number)   Copy assistant settings from a revision
+
 Member role access (memberRoleAccess)
   Array of objects, NOT bare role ids:
   [{"memberRoleId": 6, "accessMode": 1}]
@@ -2232,6 +2407,9 @@ Use the dedicated commands:
   workflows revisions edit     Branch a published revision back into the draft
   workflows revisions diff     Compare two revisions
   workflows revisions update   Edit a revision's label / publish notes
+
+After changing assistant/realtime fields, publish so live traffic picks them up:
+  gr workflows publish --id <workflowId>
 `;
 
 // src/domains/workflows.ts
@@ -3142,8 +3320,6 @@ Provisioning started. Watch it come up with:
             "inboxes",
             "routines",
             "memberFilters",
-            "milestones",
-            "milestoneGoals",
             "customToolkits",
             "customTools",
             "pages",
@@ -3224,8 +3400,6 @@ Provisioning started. Watch it come up with:
             "inboxes",
             "routines",
             "memberFilters",
-            "milestones",
-            "milestoneGoals",
             "customToolkits",
             "customTools",
             "pages",
@@ -5617,8 +5791,156 @@ var journeysDomain = {
   ]
 };
 
-// src/domains/personas.ts
+// src/domains/metrics.ts
 var COLUMNS11 = [
+  COL.id(),
+  COL.name(),
+  { header: "SLUG", getValue: (item) => item.slug ?? "" },
+  { header: "TYPE", getValue: (item) => item.metricType ?? "" },
+  { header: "SOURCE", getValue: (item) => item.source ?? "" },
+  { header: "UNIT", getValue: (item) => item.unit ?? "" },
+  {
+    header: "ENABLED",
+    getValue: (item) => item.enabled ? "yes" : "no"
+  },
+  COL.created()
+];
+var OBS_COLUMNS = [
+  COL.id(),
+  { header: "VALUE", getValue: (item) => String(item.value ?? "") },
+  { header: "OBSERVED_AT", getValue: (item) => item.observedAt ?? "" },
+  {
+    header: "CHAT_ID",
+    getValue: (item) => item.chatId != null ? String(item.chatId) : ""
+  },
+  {
+    header: "MEMBER_ID",
+    getValue: (item) => item.memberId != null ? String(item.memberId) : ""
+  }
+];
+var metricsDomain = {
+  name: "metrics",
+  description: "Customer-defined outcome metrics (CEL expression or LLM rubric) with time-series readout",
+  commands: [
+    ...crudCommands({
+      prefix: ["metrics"],
+      entityName: "metric",
+      listMethod: "listMetrics",
+      getMethod: "getMetric",
+      createMethod: "createMetric",
+      updateMethod: "updateMetric",
+      deleteMethod: "deleteMetric",
+      columns: COLUMNS11,
+      paginationSupport: "full",
+      createExamples: [
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"SMS Channel Rate","metricType":"expression","celExpression":"chat.channel == \\"phone-sms\\"","unit":"rate"}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Qualified Engagement","metricType":"rubric","evaluationPrompt":"Did the user show buying intent?","unit":"rate"}'`
+      ],
+      createHelp: "Create a metric definition. metricType is expression (CEL) or rubric (LLM). MVP source is chat only."
+    }),
+    {
+      path: ["metrics", "observations"],
+      description: "List raw observations for a metric in a date range (may include PHI reason)",
+      args: [
+        { name: "id", required: true, description: "Metric ID" },
+        {
+          name: "start",
+          required: true,
+          description: "ISO-8601 inclusive lower bound on observed_at"
+        },
+        {
+          name: "end",
+          required: true,
+          description: "ISO-8601 exclusive upper bound on observed_at"
+        },
+        { name: "page", description: "Page number (default 1)" },
+        { name: "page-size", description: "Page size (default 100)" }
+      ],
+      requiresWorkspace: true,
+      examples: [
+        "yarn gr metrics observations --id 1 --start 2026-07-01T00:00:00Z --end 2026-08-01T00:00:00Z"
+      ],
+      handler: async (hctx) => {
+        const client = requireAuth(hctx.ctx).apiClient;
+        const id = requireNumber(hctx.args, "id");
+        const start = requireString(hctx.args, "start");
+        const end = requireString(hctx.args, "end");
+        const page = hctx.args["page"] != null ? Number(hctx.args["page"]) : void 0;
+        const pageSize = hctx.args["page-size"] != null ? Number(hctx.args["page-size"]) : void 0;
+        const result2 = await client.listMetricObservations(hctx.workspace, id, {
+          start,
+          end,
+          page,
+          pageSize
+        });
+        outputData(result2.items ?? result2, hctx.ctx, OBS_COLUMNS);
+      }
+    },
+    {
+      path: ["metrics", "series"],
+      description: "Time-bucketed aggregation for a metric (numeric only)",
+      args: [
+        { name: "id", required: true, description: "Metric ID" },
+        {
+          name: "start",
+          required: true,
+          description: "ISO-8601 inclusive lower bound on observed_at"
+        },
+        {
+          name: "end",
+          required: true,
+          description: "ISO-8601 exclusive upper bound on observed_at"
+        },
+        { name: "bucket", description: "day | week (default day)" },
+        {
+          name: "aggregation",
+          description: "avg | sum | count | rate (default avg)"
+        }
+      ],
+      requiresWorkspace: true,
+      examples: [
+        "yarn gr metrics series --id 1 --start 2026-07-01T00:00:00Z --end 2026-08-01T00:00:00Z --bucket day"
+      ],
+      handler: async (hctx) => {
+        const client = requireAuth(hctx.ctx).apiClient;
+        const id = requireNumber(hctx.args, "id");
+        const result2 = await client.getMetricSeries(hctx.workspace, id, {
+          start: requireString(hctx.args, "start"),
+          end: requireString(hctx.args, "end"),
+          bucket: hctx.args["bucket"] ?? "day",
+          aggregation: hctx.args["aggregation"] ?? "avg"
+        });
+        outputSingle(result2, hctx.ctx);
+      }
+    },
+    {
+      path: ["metrics", "compute-for-chat"],
+      description: "On-demand evaluate enabled chat-source metrics for one chat (writes observations + dual-write feedback)",
+      args: [
+        {
+          name: "chat-id",
+          required: true,
+          description: "Chat ID to evaluate"
+        }
+      ],
+      requiresWorkspace: true,
+      mutates: true,
+      examples: ["yarn gr metrics compute-for-chat --chat-id 42 --allow-write"],
+      handler: async (hctx) => {
+        const client = requireAuth(hctx.ctx).apiClient;
+        const chatId = requireNumber(hctx.args, "chat-id");
+        if (chatId < 1) {
+          throw new CLIError("--chat-id must be a positive number");
+        }
+        const result2 = await client.computeChatMetrics(hctx.workspace, { chatId });
+        outputSingle(result2, hctx.ctx);
+      }
+    }
+  ]
+};
+
+// src/domains/personas.ts
+var COLUMNS12 = [
   COL.id(),
   COL.name(),
   { header: "AGE", getValue: (item) => item.age != null ? String(item.age) : "" },
@@ -5648,7 +5970,7 @@ var personasDomain = {
       createMethod: "createPersona",
       updateMethod: "updatePersona",
       deleteMethod: "deletePersona",
-      columns: COLUMNS11,
+      columns: COLUMNS12,
       paginationSupport: "full"
     })
   ]
@@ -5708,11 +6030,11 @@ function shuffleInPlace(items) {
   }
   return items;
 }
-function buildModelEvalBatchJobs(scenarios, models, rounds, warmup) {
+function buildModelEvalBatchJobs(scenarios, models, rounds, warmup, realtimeModels = []) {
   if (scenarios.length === 0) {
     throw new CLIError("At least one scenario is required");
   }
-  if (models.length === 0) {
+  if (models.length === 0 && realtimeModels.length === 0) {
     throw new CLIError("At least one model is required");
   }
   if (rounds < 1) {
@@ -5733,12 +6055,60 @@ function buildModelEvalBatchJobs(scenarios, models, rounds, warmup) {
           modelId
         });
       }
+      for (const modelId of realtimeModels) {
+        roundJobs.push({
+          round,
+          warmup: warm,
+          scenarioId: scenario.id,
+          scenarioSlug: scenario.slug,
+          scenarioName: scenario.name,
+          modelId,
+          realtime: true
+        });
+      }
     }
     shuffleInPlace(roundJobs);
     jobs.push(...roundJobs);
   }
   return jobs;
 }
+var REALTIME_AUDIO_USD_PER_MIN = {
+  "xai:realtime:voice-agent": 0.05,
+  // Grok Voice Think Fast 1
+  "xai:realtime:voice-agent-2": 0.08
+  // Grok Voice Think Fast 2
+};
+var DEFAULT_REALTIME_AUDIO_USD_PER_MIN = 0.08;
+var EST_AUDIO_MIN_PER_RUN = 3;
+var EST_TEXT_USD_PER_RUN = 0.012;
+function realtimeAudioUsdPerMin(modelId) {
+  return REALTIME_AUDIO_USD_PER_MIN[modelId] ?? DEFAULT_REALTIME_AUDIO_USD_PER_MIN;
+}
+function estimateRealtimeRunCostUsd(modelId) {
+  return EST_AUDIO_MIN_PER_RUN * realtimeAudioUsdPerMin(modelId) + EST_TEXT_USD_PER_RUN;
+}
+function projectRealtimeBatchCostUsd(jobs) {
+  return jobs.filter((j) => j.realtime).reduce((sum, j) => sum + estimateRealtimeRunCostUsd(j.modelId), 0);
+}
+function actualRealtimeRowCostUsd(row, modelId) {
+  const summary = row.timing_summary;
+  const audioMs = summary ? summary["audio_output_ms_total"] : void 0;
+  if (typeof audioMs === "number" && Number.isFinite(audioMs) && audioMs >= 0) {
+    return audioMs / 6e4 * realtimeAudioUsdPerMin(modelId) + EST_TEXT_USD_PER_RUN;
+  }
+  return estimateRealtimeRunCostUsd(modelId);
+}
+function parseMaxBudgetUsd(raw, flagName) {
+  if (raw === void 0 || raw === null || raw === "") {
+    return void 0;
+  }
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new CLIError(`${flagName} must be a positive number of USD`);
+  }
+  return value;
+}
+var REALTIME_MAX_CONCURRENCY = 4;
 function summarizeCriterionResults(run) {
   if (!run.criterionResults?.length) return void 0;
   return run.criterionResults.map((c) => ({
@@ -5747,7 +6117,7 @@ function summarizeCriterionResults(run) {
     score: c.score ?? null
   }));
 }
-function runToBatchRow(job, workflowId, run, error) {
+function runToBatchRow(job, workflowId, run, error, batchLabel) {
   return {
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     round: job.round,
@@ -5757,6 +6127,8 @@ function runToBatchRow(job, workflowId, run, error) {
     scenario_slug: job.scenarioSlug,
     scenario_name: job.scenarioName,
     model_id: job.modelId,
+    ...job.realtime ? { realtime_model_id: job.modelId } : {},
+    ...batchLabel ? { batch_label: batchLabel } : {},
     run_id: run?.id,
     error,
     failure_reason: run?.failureReason ?? null,
@@ -5811,7 +6183,10 @@ async function executeModelEvalJob(api, options, job, waitTimeoutMs, pollMs, sle
     const started = await api.startTestChatRun(options.workspace, options.workflowId, {
       scenarioId: job.scenarioId,
       driver: DriverMode.AUTO,
-      assistantChatModelId: job.modelId
+      ...job.realtime ? {
+        assistantRealtimeModelId: job.modelId,
+        ...options.realtimeConfig ? { assistantRealtimeModelConfig: options.realtimeConfig } : {}
+      } : { assistantChatModelId: job.modelId }
     });
     let run = await waitForRunTerminal(
       api,
@@ -5832,10 +6207,10 @@ async function executeModelEvalJob(api, options, job, waitTimeoutMs, pollMs, sle
         sleep2
       );
     }
-    return runToBatchRow(job, options.workflowId, run);
+    return runToBatchRow(job, options.workflowId, run, void 0, options.batchLabel);
   } catch (e) {
     const message = e instanceof Error ? e.message : String(e);
-    return runToBatchRow(job, options.workflowId, null, message);
+    return runToBatchRow(job, options.workflowId, null, message, options.batchLabel);
   }
 }
 function createSpacingGate(spacingSec, sleep2) {
@@ -5853,56 +6228,99 @@ function createSpacingGate(spacingSec, sleep2) {
 }
 async function executeModelEvalBatch(api, options) {
   const sleep2 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const concurrency = options.concurrency ?? 1;
   const jobs = buildModelEvalBatchJobs(
     options.scenarios,
     options.models,
     options.rounds,
-    options.warmup
+    options.warmup,
+    options.realtimeModels ?? []
   );
   const waitTimeoutMs = options.waitTimeoutSec * 1e3;
   const pollMs = options.pollIntervalSec * 1e3;
   const rows = [];
   let stopBatch = false;
+  let budgetStopped = false;
+  let actualSpendUsd = 0;
   const awaitSpacing = createSpacingGate(options.spacingSec, sleep2);
+  const emitProgress = (line) => {
+    if (options.onProgress) {
+      options.onProgress(line);
+    } else {
+      process.stdout.write(`${line}
+`);
+    }
+  };
+  const realtimeJobCount = jobs.filter((j) => j.realtime).length;
+  let concurrency = options.concurrency ?? 1;
+  if (realtimeJobCount > 0 && concurrency > REALTIME_MAX_CONCURRENCY) {
+    emitProgress(
+      `concurrency clamped ${concurrency} -> ${REALTIME_MAX_CONCURRENCY} (realtime models share the provider session pool)`
+    );
+    concurrency = REALTIME_MAX_CONCURRENCY;
+  }
+  if (realtimeJobCount > 0) {
+    const projectedUsd = projectRealtimeBatchCostUsd(jobs);
+    const cap = options.maxBudgetUsd;
+    emitProgress(
+      `realtime budget: projected ~$${projectedUsd.toFixed(2)} for ${realtimeJobCount} realtime run(s)${cap != null ? ` (cap $${cap.toFixed(2)})` : ""}`
+    );
+    if (cap != null && projectedUsd > cap) {
+      throw new CLIError(
+        `Batch aborted before dispatch: projected realtime cost $${projectedUsd.toFixed(2)} exceeds --max-budget-usd $${cap.toFixed(2)}. Reduce rounds/scenarios/models or raise the cap.`
+      );
+    }
+  }
   const recordRow = (job, row) => {
     rows.push(row);
     if (options.outPath) {
       appendFileSync(options.outPath, `${JSON.stringify(row)}
 `);
     }
-    const progress = formatBatchProgressLine(job, row);
-    if (options.onProgress) {
-      options.onProgress(progress);
-    } else {
-      process.stdout.write(`${progress}
-`);
-    }
+    emitProgress(formatBatchProgressLine(job, row));
   };
+  const makeSkippedRow = (job) => ({
+    ...runToBatchRow(
+      job,
+      options.workflowId,
+      null,
+      budgetStopped ? "batch stopped: realtime budget cap reached" : "batch aborted before start",
+      options.batchLabel
+    ),
+    batch_skipped: true
+  });
   const runOne = async (job) => {
     await awaitSpacing();
     if (stopBatch) {
-      return {
-        ...runToBatchRow(job, options.workflowId, null, "batch aborted before start"),
-        batch_skipped: true
-      };
+      return makeSkippedRow(job);
     }
     const row = await executeModelEvalJob(api, options, job, waitTimeoutMs, pollMs, sleep2);
     if (isConfigurationBlockerFailure(row.failure_reason)) {
       stopBatch = true;
     }
+    if (job.realtime && !row.batch_skipped) {
+      actualSpendUsd += actualRealtimeRowCostUsd(row, job.modelId);
+      if (options.maxBudgetUsd != null && actualSpendUsd >= options.maxBudgetUsd && !stopBatch) {
+        stopBatch = true;
+        budgetStopped = true;
+        emitProgress(
+          `realtime budget: actual spend ~$${actualSpendUsd.toFixed(2)} reached cap $${options.maxBudgetUsd.toFixed(2)} \u2014 stopping dispatch`
+        );
+      }
+    }
     return row;
   };
   if (concurrency <= 1) {
-    for (const job of jobs) {
+    let stoppedAt = jobs.length;
+    for (const [index, job] of jobs.entries()) {
       if (stopBatch) {
+        stoppedAt = index;
         break;
       }
       const row = await runOne(job);
       recordRow(job, row);
-      if (stopBatch) {
-        break;
-      }
+    }
+    for (const job of jobs.slice(stoppedAt)) {
+      recordRow(job, makeSkippedRow(job));
     }
   } else {
     const results = new Array(jobs.length);
@@ -5918,6 +6336,9 @@ async function executeModelEvalBatch(api, options) {
           return;
         }
         const job = jobs[index];
+        if (job === void 0) {
+          return;
+        }
         const row = await runOne(job);
         results[index] = row;
         recordRow(job, row);
@@ -5926,20 +6347,19 @@ async function executeModelEvalBatch(api, options) {
     const workers = Array.from({ length: Math.min(concurrency, jobs.length) }, () => worker());
     await Promise.all(workers);
     if (stopBatch) {
-      for (let index = 0; index < jobs.length; index++) {
+      jobs.forEach((job, index) => {
         if (results[index] !== void 0) {
-          continue;
+          return;
         }
-        const job = jobs[index];
-        const skipped = {
-          ...runToBatchRow(job, options.workflowId, null, "batch aborted before start"),
-          batch_skipped: true
-        };
+        const skipped = makeSkippedRow(job);
         results[index] = skipped;
         recordRow(job, skipped);
-      }
+      });
     }
   }
+  if (realtimeJobCount > 0) {
+    emitProgress(`realtime budget: total actual spend ~$${actualSpendUsd.toFixed(2)}`);
+  }
   const blockerRow = rows.find((r) => isConfigurationBlockerFailure(r.failure_reason));
   if (blockerRow) {
     throw new CLIError(
@@ -6241,9 +6661,29 @@ var qualificationsDomain = {
         { name: "workflow-id", description: "Workflow ID", required: true },
         {
           name: "models",
-          description: "Comma-separated assistant chat model IDs",
+          description: "Comma-separated assistant chat model IDs (optional with --realtime-models)",
           alias: "m",
-          required: true
+          required: false
+        },
+        {
+          name: "realtime-models",
+          description: "Comma-separated native realtime model IDs (each forwarded as assistantRealtimeModelId)",
+          required: false
+        },
+        {
+          name: "realtime-config",
+          description: "JSON object forwarded as assistantRealtimeModelConfig on realtime jobs",
+          required: false
+        },
+        {
+          name: "batch-label",
+          description: "Label recorded on every JSONL row for cross-batch comparison",
+          required: false
+        },
+        {
+          name: "max-budget-usd",
+          description: "Dispatch cap in USD on realtime spend: abort if pre-flight projection exceeds it, stop dispatching when actuals cross it (in-flight runs still finish and bill)",
+          required: false
         },
         {
           name: "scenario-ids",
@@ -6283,7 +6723,31 @@ var qualificationsDomain = {
         { name: "out", description: "Append JSONL rows to this file" }
       ],
       handler: async ({ ctx, workspace, args }) => {
-        const models = parseCommaSeparatedList(requireString(args, "models"), "--models");
+        const models = args.models ? parseCommaSeparatedList(String(args.models), "--models") : [];
+        const realtimeModels = args["realtime-models"] ? parseCommaSeparatedList(String(args["realtime-models"]), "--realtime-models") : [];
+        if (models.length === 0 && realtimeModels.length === 0) {
+          throw new CLIError("Specify --models and/or --realtime-models");
+        }
+        let realtimeConfig;
+        if (args["realtime-config"]) {
+          if (realtimeModels.length === 0) {
+            throw new CLIError("--realtime-config requires --realtime-models");
+          }
+          let parsed;
+          try {
+            parsed = JSON.parse(String(args["realtime-config"]));
+          } catch {
+            throw new CLIError("--realtime-config is not valid JSON");
+          }
+          if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new CLIError(
+              "--realtime-config must be a JSON object (not an array or null)"
+            );
+          }
+          realtimeConfig = parsed;
+        }
+        const batchLabel = args["batch-label"] ? String(args["batch-label"]) : void 0;
+        const maxBudgetUsd = parseMaxBudgetUsd(args["max-budget-usd"], "--max-budget-usd");
         const allScenarios = Boolean(args["all-scenarios"]);
         const scenarioIdsRaw = args["scenario-ids"];
         if (allScenarios && scenarioIdsRaw) {
@@ -6324,6 +6788,10 @@ var qualificationsDomain = {
           workspace,
           workflowId,
           models,
+          realtimeModels,
+          realtimeConfig,
+          batchLabel,
+          maxBudgetUsd,
           scenarios,
           rounds,
           warmup,
@@ -6638,7 +7106,7 @@ Relations (relationMatch): ${relations.join(", ")}`);
 
 // src/domains/sites.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-var COLUMNS12 = [
+var COLUMNS13 = [
   COL.id(),
   COL.name(),
   { header: "SLUG", getValue: (item) => item.slug ?? "" },
@@ -6692,7 +7160,7 @@ var sitesDomain = {
       createMethod: "createSite",
       updateMethod: "updateSite",
       deleteMethod: "deleteSite",
-      columns: COLUMNS12
+      columns: COLUMNS13
     }),
     // Pages sub-resource
     {
@@ -7363,7 +7831,7 @@ var abilitiesDomain = {
 };
 
 // src/domains/access-grants.ts
-var COLUMNS13 = [
+var COLUMNS14 = [
   COL.id(),
   COL.status(),
   { header: "GRANTOR", getValue: (item) => String(item.grantorMemberId ?? "") },
@@ -7380,7 +7848,7 @@ var accessGrantsDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.getAccessGrants(workspace);
-        outputData(listResult(result2, false), ctx, COLUMNS13);
+        outputData(listResult(result2, false), ctx, COLUMNS14);
       }
     },
     {
@@ -7393,7 +7861,7 @@ var accessGrantsDomain = {
           workspace,
           requireString(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS13);
+        outputSingle(result2, ctx, COLUMNS14);
       }
     },
     {
@@ -7406,7 +7874,7 @@ var accessGrantsDomain = {
           workspace,
           data
         );
-        outputSingle(result2, ctx, COLUMNS13);
+        outputSingle(result2, ctx, COLUMNS14);
       }
     },
     {
@@ -7417,7 +7885,7 @@ var accessGrantsDomain = {
         const result2 = await requireAuth(ctx).apiClient.getMyReceivedGrants(workspace, {
           pageSize: 200
         });
-        outputData(listResult(result2, false), ctx, COLUMNS13);
+        outputData(listResult(result2, false), ctx, COLUMNS14);
       }
     },
     {
@@ -7428,7 +7896,7 @@ var accessGrantsDomain = {
         const result2 = await requireAuth(ctx).apiClient.getMyGivenGrants(workspace, {
           pageSize: 200
         });
-        outputData(listResult(result2, false), ctx, COLUMNS13);
+        outputData(listResult(result2, false), ctx, COLUMNS14);
       }
     },
     {
@@ -7443,7 +7911,7 @@ var accessGrantsDomain = {
           requireString(args, "id"),
           data ?? {}
         );
-        outputSingle(result2, ctx, COLUMNS13);
+        outputSingle(result2, ctx, COLUMNS14);
       }
     },
     {
@@ -7458,7 +7926,7 @@ var accessGrantsDomain = {
           requireString(args, "id"),
           data ?? {}
         );
-        outputSingle(result2, ctx, COLUMNS13);
+        outputSingle(result2, ctx, COLUMNS14);
       }
     },
     {
@@ -7471,7 +7939,7 @@ var accessGrantsDomain = {
           workspace,
           requireNumber(args, "member-id")
         );
-        outputData(listResult(result2, false), ctx, COLUMNS13);
+        outputData(listResult(result2, false), ctx, COLUMNS14);
       }
     },
     {
@@ -7496,14 +7964,14 @@ var accessGrantsDomain = {
             pageSize: 200
           }
         );
-        outputData(listResult(result2, false), ctx, COLUMNS13);
+        outputData(listResult(result2, false), ctx, COLUMNS14);
       }
     }
   ]
 };
 
 // src/domains/ai-models.ts
-var COLUMNS14 = [
+var COLUMNS15 = [
   { header: "ID", getValue: (item) => String(item.id ?? item.modelId ?? "") },
   { header: "NAME", getValue: (item) => item.name ?? item.displayName ?? "" },
   { header: "PROVIDER", getValue: (item) => item.provider ?? "" },
@@ -7511,7 +7979,7 @@ var COLUMNS14 = [
 ];
 var aiModelsDomain = {
   name: "ai-models",
-  description: "List available AI models",
+  description: `List available AI models (chat, realtime/voice stacks, speaker voices). Use realtime ids as workflow/agent realtimeModelId; voice ids go in realtimeModelConfig.voiceModel. One-shot workflow voice: gr workflows update -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}' then publish.`,
   commands: [
     {
       path: ["ai-models", "list"],
@@ -7519,41 +7987,41 @@ var aiModelsDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getAllModels();
-        outputData(result2, ctx, COLUMNS14);
+        outputData(result2, ctx, COLUMNS15);
       }
     },
     {
       path: ["ai-models", "chat"],
-      description: "List chat models",
+      description: "List chat models (use as chatModelId on agents/workflows)",
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getChatModels();
-        outputData(result2, ctx, COLUMNS14);
+        outputData(result2, ctx, COLUMNS15);
       }
     },
     {
       path: ["ai-models", "realtime"],
-      description: "List realtime models",
+      description: "List realtime/voice stacks (use as realtimeModelId). e.g. xai:realtime:voice-agent-2 = Grok Voice Think Fast 2",
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getRealtimeModels();
-        outputData(result2, ctx, COLUMNS14);
+        outputData(result2, ctx, COLUMNS15);
       }
     },
     {
       path: ["ai-models", "voice"],
-      description: "List voice models",
+      description: "List speaker voices (use as realtimeModelConfig.voiceModel). Match provider to the realtime model (xai:voice:* with xAI realtime)",
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getVoiceModels();
-        outputData(result2, ctx, COLUMNS14);
+        outputData(result2, ctx, COLUMNS15);
       }
     }
   ]
 };
 
 // src/domains/api-keys.ts
-var COLUMNS15 = [
+var COLUMNS16 = [
   COL.id(),
   COL.name(),
   { header: "PREFIX", getValue: (item) => item.prefix ?? "" },
@@ -7576,7 +8044,7 @@ var apiKeysDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.getApiKeys(workspace);
-        outputData(result2, ctx, COLUMNS15);
+        outputData(result2, ctx, COLUMNS16);
       }
     },
     {
@@ -7611,7 +8079,7 @@ var apiKeysDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getGlobalApiKeys();
-        outputData(result2, ctx, COLUMNS15);
+        outputData(result2, ctx, COLUMNS16);
       }
     },
     {
@@ -8261,7 +8729,7 @@ var conciergeDomain = {
 };
 
 // src/domains/custom-toolkits.ts
-var COLUMNS16 = [COL.id(), COL.name(), COL.description(), COL.enabled()];
+var COLUMNS17 = [COL.id(), COL.name(), COL.description(), COL.enabled()];
 var TOOL_COLUMNS2 = [COL.id(), COL.name(), COL.description()];
 var customToolkitsDomain = {
   name: "custom-toolkits",
@@ -8275,7 +8743,7 @@ var customToolkitsDomain = {
       createMethod: "createCustomToolkit",
       updateMethod: "updateCustomToolkit",
       deleteMethod: "deleteCustomToolkit",
-      columns: COLUMNS16
+      columns: COLUMNS17
     }),
     {
       path: ["custom-toolkits", "enable"],
@@ -8288,7 +8756,7 @@ var customToolkitsDomain = {
           workspace,
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS16);
+        outputSingle(result2, ctx, COLUMNS17);
       }
     },
     {
@@ -8302,7 +8770,7 @@ var customToolkitsDomain = {
           workspace,
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS16);
+        outputSingle(result2, ctx, COLUMNS17);
       }
     },
     // Tools — nested resource requiring toolkitId
@@ -8414,7 +8882,7 @@ var docsDomain = {
 };
 
 // src/domains/features.ts
-var COLUMNS17 = [
+var COLUMNS18 = [
   { header: "SLUG", getValue: (item) => item.slug ?? "" },
   COL.name(),
   COL.description()
@@ -8429,7 +8897,7 @@ var featuresDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getFeatureRegistry();
-        outputData(result2, ctx, COLUMNS17);
+        outputData(result2, ctx, COLUMNS18);
       }
     },
     {
@@ -8441,7 +8909,7 @@ var featuresDomain = {
         const result2 = await requireAuth(ctx).apiClient.getFeatureBySlug(
           requireString(args, "slug")
         );
-        outputSingle(result2, ctx, COLUMNS17);
+        outputSingle(result2, ctx, COLUMNS18);
       }
     },
     {
@@ -8450,14 +8918,14 @@ var featuresDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getAvailableWorkspaceFeatures();
-        outputData(result2, ctx, COLUMNS17);
+        outputData(result2, ctx, COLUMNS18);
       }
     }
   ]
 };
 
 // src/domains/inboxes.ts
-var COLUMNS18 = [
+var COLUMNS19 = [
   COL.id(),
   COL.name(),
   { header: "EMAIL", getValue: (item) => item.emailAddress ?? "" },
@@ -8482,7 +8950,7 @@ var inboxesDomain = {
       createMethod: "createInbox",
       updateMethod: "updateInbox",
       deleteMethod: "deleteInbox",
-      columns: COLUMNS18
+      columns: COLUMNS19
     }),
     {
       path: ["inboxes", "emails", "list"],
@@ -8567,7 +9035,7 @@ var inboxesDomain = {
 };
 
 // src/domains/mcp-servers.ts
-var COLUMNS19 = [
+var COLUMNS20 = [
   COL.id(),
   COL.name(),
   { header: "URL", getValue: (item) => item.url ?? "" },
@@ -8585,7 +9053,7 @@ var mcpServersDomain = {
       createMethod: "createMcpServer",
       updateMethod: "updateMcpServer",
       deleteMethod: "deleteMcpServer",
-      columns: COLUMNS19
+      columns: COLUMNS20
     }),
     {
       path: ["mcp-servers", "enable"],
@@ -8598,7 +9066,7 @@ var mcpServersDomain = {
           workspace,
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS19);
+        outputSingle(result2, ctx, COLUMNS20);
       }
     },
     {
@@ -8612,7 +9080,7 @@ var mcpServersDomain = {
           workspace,
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS19);
+        outputSingle(result2, ctx, COLUMNS20);
       }
     },
     {
@@ -8632,7 +9100,7 @@ var mcpServersDomain = {
 };
 
 // src/domains/member-memories.ts
-var COLUMNS20 = [
+var COLUMNS21 = [
   { header: "KEY", getValue: (item) => item.key ?? "" },
   { header: "TYPE", getValue: (item) => item.type ?? "basic" },
   { header: "DESCRIPTION", getValue: (item) => truncate(item.description ?? "", 60) },
@@ -8666,7 +9134,7 @@ var memberMemoriesDomain = {
           type,
           query
         });
-        outputData(listResult(result2, false), ctx, COLUMNS20);
+        outputData(listResult(result2, false), ctx, COLUMNS21);
       }
     },
     {
@@ -8685,7 +9153,7 @@ var memberMemoriesDomain = {
           memberId,
           key
         );
-        outputData(result2, ctx, COLUMNS20);
+        outputData(result2, ctx, COLUMNS21);
       }
     },
     {
@@ -8716,7 +9184,7 @@ var memberMemoriesDomain = {
             ...priority !== void 0 && { priority }
           }
         );
-        outputData(result2, ctx, COLUMNS20);
+        outputData(result2, ctx, COLUMNS21);
       }
     },
     {
@@ -8749,33 +9217,56 @@ var memberMemoriesDomain = {
   ]
 };
 
-// src/domains/milestones.ts
-var COLUMNS21 = [
+// src/domains/intervention-requests.ts
+var COLUMNS22 = [
   COL.id(),
-  COL.name(),
-  COL.status(),
-  { header: "DUE DATE", getValue: (item) => item.dueDate ?? "" }
+  { header: "KIND", getValue: (item) => item.kind ?? "" },
+  { header: "CHAT", getValue: (item) => item.chatId ?? "" },
+  {
+    header: "STATUS",
+    getValue: (item) => item.resolvedAt ? item.resolution ?? "resolved" : "open"
+  },
+  // Zero is the interesting value: the intervention was requested and nobody
+  // was told, which is what `--unrouted` filters for.
+  { header: "NOTIFIED", getValue: (item) => item.notifiedCount ?? 0 },
+  { header: "REASON", getValue: (item) => item.reasonCode ?? "" },
+  { header: "CREATED", getValue: (item) => item.createdAt ?? "" }
 ];
-var milestonesDomain = {
-  name: "milestones",
-  description: "Manage milestones",
+var interventionRequestsDomain = {
+  name: "interventions",
+  description: "Inspect intervention requests \u2014 escalations and other asks for a person",
   commands: [
-    ...crudCommands({
-      prefix: ["milestones"],
-      entityName: "milestone",
-      listMethod: "getMilestones",
-      getMethod: "getMilestone",
-      createMethod: "createMilestone",
-      updateMethod: "updateMilestone",
-      deleteMethod: "deleteMilestone",
-      columns: COLUMNS21,
-      paginationSupport: "full"
-    })
+    {
+      path: ["interventions", "list"],
+      description: "List intervention requests (escalations etc). Newest first. Read-only.",
+      requiresWorkspace: true,
+      args: [
+        { name: "kind", description: "escalation | contributor_input | approval" },
+        { name: "open", description: "Only unresolved requests", isFlag: true },
+        { name: "chat-id", description: "Only requests for this chat" },
+        {
+          name: "unrouted",
+          description: "Only requests that notified NOBODY \u2014 escalations that reached no one",
+          isFlag: true
+        },
+        { name: "limit", description: "Max rows (default 50, max 200)" }
+      ],
+      handler: async ({ ctx, workspace, args, requireAuth: requireAuth2, outputData: outputData2 }) => {
+        const result2 = await requireAuth2(ctx).apiClient.getInterventionRequests(workspace, {
+          kind: args["kind"],
+          openOnly: Boolean(args["open"]),
+          chatId: args["chat-id"] ? Number(args["chat-id"]) : void 0,
+          unroutedOnly: Boolean(args["unrouted"]),
+          limit: args["limit"] ? Number(args["limit"]) : void 0
+        });
+        outputData2(result2, ctx, COLUMNS22);
+      }
+    }
   ]
 };
 
 // src/domains/notification-rules.ts
-var COLUMNS22 = [
+var COLUMNS23 = [
   COL.id(),
   COL.name(),
   { header: "TYPE", getValue: (item) => item.noticeType ?? "" },
@@ -8792,7 +9283,7 @@ var notificationRulesDomain = {
       createMethod: "createNotificationRule",
       updateMethod: "updateNotificationRule",
       deleteMethod: "deleteNotificationRule",
-      columns: COLUMNS22
+      columns: COLUMNS23
     })
   ]
 };
@@ -8852,7 +9343,7 @@ var oauthDomain = {
 };
 
 // src/domains/operator-groups.ts
-var COLUMNS23 = [COL.id(), COL.name(), COL.description()];
+var COLUMNS24 = [COL.id(), COL.name(), COL.description()];
 var operatorGroupsDomain = {
   name: "operator-groups",
   description: "Manage operator groups",
@@ -8865,7 +9356,7 @@ var operatorGroupsDomain = {
       createMethod: "createOperatorGroup",
       updateMethod: "updateOperatorGroup",
       deleteMethod: "deleteOperatorGroup",
-      columns: COLUMNS23
+      columns: COLUMNS24
     }),
     {
       path: ["operator-groups", "add-member"],
@@ -8943,13 +9434,6 @@ var ORG_DOMAIN_COLUMNS = [
     maxWidth: 80
   }
 ];
-function requireOrgId(args) {
-  const val = args["org-uuid"] ?? args.org;
-  if (typeof val !== "string" || !val) {
-    throw new CLIError("Missing required argument: --org-uuid");
-  }
-  return val;
-}
 function requireDomainUuid(args) {
   const val = args["domain-uuid"] ?? args.uuid;
   if (typeof val !== "string" || !val) {
@@ -8964,7 +9448,7 @@ function requireDomain(args) {
   }
   return val;
 }
-var ORG_UUID_ARG = {
+var ORG_UUID_ARG2 = {
   name: "org-uuid",
   aliases: ["org"],
   description: "Organization UUID or ID",
@@ -8985,13 +9469,13 @@ function emailVerifyCommand(path4, description) {
     description,
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainEmail(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9004,13 +9488,13 @@ function siteVerifyCommand(path4, description) {
     description,
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainSite(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9024,7 +9508,7 @@ function registerDomainCommand(path4) {
     mutates: true,
     requiresWorkspace: false,
     args: [
-      ORG_UUID_ARG,
+      ORG_UUID_ARG2,
       { name: "domain", description: "Domain to register, e.g. example.com", required: true }
     ],
     examples: [
@@ -9032,7 +9516,7 @@ function registerDomainCommand(path4) {
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.registerOrgDomain(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomain(hctx.args)
       );
       outputSingle(result2, hctx.ctx, ORG_DOMAIN_COLUMNS);
@@ -9044,11 +9528,11 @@ var domainCommands = [
     path: ["org", "domains", "list"],
     description: "List domains registered to an organization",
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG],
+    args: [ORG_UUID_ARG2],
     examples: ["yarn gr org domains list --org-uuid $ORG_UUID"],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.listOrgDomains(
-        requireOrgId(hctx.args)
+        requireOrgRef(hctx.args)
       );
       outputData(result2, hctx.ctx, ORG_DOMAIN_COLUMNS);
     }
@@ -9057,11 +9541,11 @@ var domainCommands = [
     path: ["org", "domains", "get"],
     description: "Get a registered organization domain",
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: ["yarn gr org domains get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.getOrgDomain(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx, ORG_DOMAIN_COLUMNS);
@@ -9074,13 +9558,13 @@ var domainCommands = [
     description: "Verify domain ownership by checking the _gravity-verify TXT record",
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       "yarn gr org domains verify-ownership --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainOwnership(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9091,13 +9575,16 @@ var domainCommands = [
     description: "Delete a registered organization domain",
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       "yarn gr org domains delete --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
     ],
     handler: async (hctx) => {
       const domainUuid = requireDomainUuid(hctx.args);
-      await requireAuth(hctx.ctx).apiClient.deleteOrgDomain(requireOrgId(hctx.args), domainUuid);
+      await requireAuth(hctx.ctx).apiClient.deleteOrgDomain(
+        requireOrgRef(hctx.args),
+        domainUuid
+      );
       process.stdout.write(`Deleted org domain ${domainUuid}
 `);
     }
@@ -9107,13 +9594,13 @@ var domainCommands = [
     description: "Enable email DNS records on a verified organization domain",
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       "yarn gr org domains email enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.enableOrgDomainEmail(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9123,11 +9610,11 @@ var domainCommands = [
     path: ["org", "domains", "email", "get"],
     description: "Get email DNS setup and status for an organization domain",
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: ["yarn gr org domains email get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.getOrgDomainEmail(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9147,7 +9634,7 @@ var domainCommands = [
     mutates: true,
     requiresWorkspace: false,
     args: [
-      ORG_UUID_ARG,
+      ORG_UUID_ARG2,
       DOMAIN_UUID_ARG,
       {
         name: "confirm",
@@ -9161,7 +9648,7 @@ var domainCommands = [
     handler: async (hctx) => {
       const domainUuid = requireDomainUuid(hctx.args);
       const result2 = await requireAuth(hctx.ctx).apiClient.disableOrgDomainEmail(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         domainUuid,
         hctx.args.confirm === true
       );
@@ -9184,13 +9671,13 @@ var domainCommands = [
     description: "Enable custom site CNAME verification on a verified organization domain",
     mutates: true,
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: [
       "yarn gr org domains site enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.enableOrgDomainSite(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9200,11 +9687,11 @@ var domainCommands = [
     path: ["org", "domains", "site", "get"],
     description: "Get custom site CNAME setup and status for an organization domain",
     requiresWorkspace: false,
-    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    args: [ORG_UUID_ARG2, DOMAIN_UUID_ARG],
     examples: ["yarn gr org domains site get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.getOrgDomainSite(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         requireDomainUuid(hctx.args)
       );
       outputSingle(result2, hctx.ctx);
@@ -9224,7 +9711,7 @@ var domainCommands = [
     mutates: true,
     requiresWorkspace: false,
     args: [
-      ORG_UUID_ARG,
+      ORG_UUID_ARG2,
       DOMAIN_UUID_ARG,
       {
         name: "confirm",
@@ -9238,7 +9725,7 @@ var domainCommands = [
     handler: async (hctx) => {
       const domainUuid = requireDomainUuid(hctx.args);
       const result2 = await requireAuth(hctx.ctx).apiClient.disableOrgDomainSite(
-        requireOrgId(hctx.args),
+        requireOrgRef(hctx.args),
         domainUuid,
         hctx.args.confirm === true
       );
@@ -9273,6 +9760,226 @@ var orgDomain = {
   ]
 };
 
+// src/domains/org-legal-entities.ts
+var LEGAL_ENTITY_COLUMNS = [
+  { header: "UUID", getValue: (e) => e.uuid ?? "" },
+  { header: "LEGAL NAME", getValue: (e) => e.legalName ?? "" },
+  { header: "PRIMARY", getValue: (e) => e.isPrimary ? "yes" : "" },
+  { header: "ID TYPE", getValue: (e) => e.registrationIdentifierType ?? "" },
+  { header: "PROFILE SID", getValue: (e) => e.customerProfileSid ?? "" },
+  // The CACHED status hint. `org business-profile get` reads Twilio live.
+  { header: "PROFILE STATUS (cached)", getValue: (e) => e.customerProfileStatus ?? "" }
+];
+var LEGAL_ENTITY_UUID_ARG = {
+  name: "legal-entity-uuid",
+  aliases: ["legal-entity", "entity-uuid"],
+  description: "Legal entity UUID (omit to use the org primary entity)",
+  required: false
+};
+var TRUST_PRODUCT_ENTITY_UUID_ARG = { ...LEGAL_ENTITY_UUID_ARG, required: true };
+var TRUST_PRODUCT_COLUMNS = [
+  { header: "PRODUCT", getValue: (p) => p.product ?? "" },
+  { header: "STATUS", getValue: (p) => p.status ?? "(none)" },
+  { header: "TRUST PRODUCT SID", getValue: (p) => p.trustProductSid ?? "(none)" },
+  // CNAM only; blank for the other two rather than absent, so the column lines up.
+  { header: "DISPLAY NAME", getValue: (p) => p.displayName ?? "" }
+];
+function optionalEntityUuid(args) {
+  const val = args["legal-entity-uuid"] ?? args["legal-entity"] ?? args["entity-uuid"];
+  return typeof val === "string" && val ? val : void 0;
+}
+function requireEntityUuid(args) {
+  const val = optionalEntityUuid(args);
+  if (!val) {
+    throw new CLIError("Missing required argument: --legal-entity-uuid");
+  }
+  return val;
+}
+function requireBody(data) {
+  if (data && typeof data === "object" && !Array.isArray(data)) return data;
+  throw new CLIError(
+    `Missing or invalid --data. Pass a JSON object, e.g. --data '{"key":"value"}' (or --file body.json). Arrays are not accepted.`
+  );
+}
+function submittability(profile) {
+  if (profile.evaluationStatus === "compliant") return "yes";
+  if (profile.evaluationStatus === "noncompliant") return "no (noncompliant)";
+  if (profile.status && profile.status !== "draft") return `n/a (${profile.status})`;
+  return "no (never evaluated)";
+}
+var commands2 = [
+  {
+    path: ["org", "legal-entities", "list"],
+    description: "List an org's legal entities (one Twilio Customer Profile each). Requires org admin \u2014 staff join via `gr admin organizations join --role platform_support`.",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG],
+    examples: ["yarn gr org legal-entities list --org-uuid $ORG_UUID"],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.listLegalEntities(
+        requireOrgRef(hctx.args)
+      );
+      outputData(result2.legalEntities ?? [], hctx.ctx, LEGAL_ENTITY_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "legal-entities", "get"],
+    description: "Get one legal entity",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, { ...LEGAL_ENTITY_UUID_ARG, required: true }],
+    examples: [
+      "yarn gr org legal-entities get --org-uuid $ORG_UUID --legal-entity-uuid $ENTITY_UUID"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.getLegalEntity(
+        requireOrgRef(hctx.args),
+        requireEntityUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "legal-entities", "create"],
+    description: "Create a legal entity (its business profile is filled in separately)",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG],
+    examples: [
+      `yarn gr org legal-entities create --org-uuid $ORG_UUID --data '{"legalName":"Acme Health"}' --allow-write`
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.createLegalEntity(
+        requireOrgRef(hctx.args),
+        requireBody(hctx.data)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "business-profile", "get"],
+    description: "Read a legal entity's business profile LIVE from Twilio. SUBMITTABLE is derived from evaluationStatus, not status.",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, LEGAL_ENTITY_UUID_ARG],
+    examples: ["yarn gr org business-profile get --org-uuid $ORG_UUID"],
+    handler: async (hctx) => {
+      const profile = await requireAuth(hctx.ctx).apiClient.getBusinessProfile(
+        requireOrgRef(hctx.args),
+        optionalEntityUuid(hctx.args)
+      );
+      outputSingle(
+        hctx.ctx.outputFormat === "json" ? profile : {
+          status: profile.status ?? "(none)",
+          evaluationStatus: profile.evaluationStatus ?? "(not evaluated)",
+          SUBMITTABLE: submittability(profile),
+          customerProfileSid: profile.customerProfileSid ?? "(none)",
+          legalName: profile.businessInfo?.legalName ?? "(missing)",
+          authorizedReps: (profile.authorizedReps ?? []).length,
+          hasAddress: profile.address ? "yes" : "no",
+          failureReasons: (profile.failureReasons ?? []).join("; ") || "(none)",
+          profileRecoveryFailed: profile.profileRecoveryFailed ? "YES" : "no"
+        },
+        hctx.ctx
+      );
+    }
+  },
+  {
+    path: ["org", "business-profile", "update"],
+    description: "Upsert the business profile (idempotent via cached SIDs). Returns the fresh compliance evaluation.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, LEGAL_ENTITY_UUID_ARG],
+    examples: [
+      "yarn gr org business-profile update --org-uuid $ORG_UUID --file profile.json --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.updateBusinessProfile(
+        requireOrgRef(hctx.args),
+        requireBody(hctx.data),
+        optionalEntityUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "business-profile", "submit"],
+    description: "Submit the business profile to Twilio for review. Free \u2014 the paid step is brand registration, which is separate. 412 if not currently compliant, 409 if a review is already in flight.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, LEGAL_ENTITY_UUID_ARG],
+    examples: ["yarn gr org business-profile submit --org-uuid $ORG_UUID --allow-write"],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.submitBusinessProfile(
+        requireOrgRef(hctx.args),
+        optionalEntityUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "business-profile", "cancel"],
+    description: "Cancel an in-flight Twilio review, resetting the profile to draft so it can be edited and resubmitted",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, LEGAL_ENTITY_UUID_ARG],
+    examples: ["yarn gr org business-profile cancel --org-uuid $ORG_UUID --allow-write"],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.cancelBusinessProfile(
+        requireOrgRef(hctx.args),
+        optionalEntityUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "trust-products", "list"],
+    description: "Read an entity's CACHED voice trust product state (CNAM / SHAKEN-STIR / Voice Integrity) from trust_hub_state. No Twilio calls \u2014 run `sync` to reconcile.",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, TRUST_PRODUCT_ENTITY_UUID_ARG],
+    examples: [
+      "yarn gr org trust-products list --org-uuid $ORG_UUID --legal-entity-uuid $ENTITY_UUID --env prod"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.getVoiceTrustProducts(
+        requireOrgRef(hctx.args),
+        requireEntityUuid(hctx.args)
+      );
+      outputData(result2.products, hctx.ctx, TRUST_PRODUCT_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "trust-products", "sync"],
+    description: "Reconcile voice trust products against Twilio: claim products staged outside the app and refresh non-terminal statuses. This is the prerequisite for `admin phone-numbers migrate`, whose preflight reads the cached state. 409 if another Trust Hub operation holds the org lock \u2014 retry shortly.",
+    // Writes trust_hub_state and calls Twilio. Read-only in business terms
+    // (it discovers, it does not create or submit), but it mutates our cache,
+    // so it takes --allow-write like every other state-changing verb.
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, TRUST_PRODUCT_ENTITY_UUID_ARG],
+    examples: [
+      "yarn gr org trust-products sync --org-uuid $ORG_UUID --legal-entity-uuid $ENTITY_UUID --env prod --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.syncVoiceTrustProducts(
+        requireOrgRef(hctx.args),
+        requireEntityUuid(hctx.args)
+      );
+      if (hctx.ctx.outputFormat !== "table") {
+        outputSingle(result2, hctx.ctx);
+        return;
+      }
+      const discovered = result2.discovered ?? [];
+      console.log(
+        discovered.length > 0 ? `Discovered ${discovered.length} product(s): ${discovered.join(", ")}` : "No new products discovered \u2014 already up to date."
+      );
+      outputData(result2.products, hctx.ctx, TRUST_PRODUCT_COLUMNS);
+    }
+  }
+];
+var orgLegalEntitiesDomain = {
+  name: "org",
+  description: "Legal entities and business profiles (Twilio Customer Profiles)",
+  commands: commands2
+};
+
 // src/domains/org-phone-numbers.ts
 import { OrgApi } from "@gravity-rail/sdk";
 function getOrgApi(hctx) {
@@ -9294,14 +10001,7 @@ var AVAILABLE_PHONE_COLUMNS = [
   { header: "Region", getValue: (p) => p.region ?? "" },
   { header: "Type", getValue: (p) => p.phoneNumberType ?? "" }
 ];
-function requireOrgUuid(args) {
-  const val = args["org-uuid"] ?? args["org"];
-  if (typeof val !== "string" || !val) {
-    throw new CLIError("Missing required argument: --org-uuid");
-  }
-  return val;
-}
-var commands2 = [
+var commands3 = [
   {
     path: ["org", "phone-numbers", "list"],
     description: "List all phone numbers owned by an organization",
@@ -9311,7 +10011,7 @@ var commands2 = [
     requiresWorkspace: false,
     columns: PROVIDER_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const result2 = await getOrgApi(hctx).listPhoneNumbers(orgUuid);
       outputData(result2, hctx.ctx, PROVIDER_PHONE_COLUMNS);
     }
@@ -9334,7 +10034,7 @@ var commands2 = [
     requiresWorkspace: false,
     columns: AVAILABLE_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const result2 = await getOrgApi(hctx).searchPhoneNumbers(orgUuid, {
         country: hctx.args.country ?? "US",
         numberType: hctx.args["number-type"] ?? "local",
@@ -9370,7 +10070,7 @@ var commands2 = [
     requiresWorkspace: false,
     columns: PROVIDER_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const phoneNumber = hctx.args["phone-number"];
       if (!phoneNumber) throw new CLIError("Missing required argument: --phone-number");
       const numberType = hctx.args["number-type"] ?? "local";
@@ -9399,7 +10099,7 @@ var commands2 = [
     requiresWorkspace: false,
     columns: PROVIDER_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const providerPhoneUuid = hctx.args["provider-phone-uuid"];
       const workspaceUuid = hctx.args["workspace-uuid"];
       if (!providerPhoneUuid)
@@ -9431,7 +10131,7 @@ Create a workspace phone linked to this provider number (sets Twilio webhooks):
     requiresWorkspace: false,
     columns: PROVIDER_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const providerPhoneUuid = hctx.args["provider-phone-uuid"];
       const newWorkspaceUuid = hctx.args["new-workspace-uuid"];
       if (!providerPhoneUuid)
@@ -9457,7 +10157,7 @@ Create a workspace phone linked to this provider number (sets Twilio webhooks):
     requiresWorkspace: false,
     columns: PROVIDER_PHONE_COLUMNS,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const providerPhoneUuid = hctx.args["provider-phone-uuid"];
       if (!providerPhoneUuid)
         throw new CLIError("Missing required argument: --provider-phone-uuid");
@@ -9475,7 +10175,7 @@ Create a workspace phone linked to this provider number (sets Twilio webhooks):
     ],
     requiresWorkspace: false,
     handler: async (hctx) => {
-      const orgUuid = requireOrgUuid(hctx.args);
+      const orgUuid = requireOrgRef(hctx.args);
       const providerPhoneUuid = hctx.args["provider-phone-uuid"];
       if (!providerPhoneUuid)
         throw new CLIError("Missing required argument: --provider-phone-uuid");
@@ -9487,7 +10187,7 @@ Create a workspace phone linked to this provider number (sets Twilio webhooks):
 var orgPhoneNumbersDomain = {
   name: "org",
   description: "Organization management",
-  commands: commands2
+  commands: commands3
 };
 
 // src/lib/phone-numbers/defaults.ts
@@ -12498,7 +13198,7 @@ function requireCallerRole(args, flag) {
   }
   return role;
 }
-var COLUMNS24 = [
+var COLUMNS25 = [
   COL.id(),
   { header: "NUMBER", getValue: (item) => item.phoneNumber ?? item.number ?? "" },
   { header: "LABEL", getValue: (item) => item.label ?? item.name ?? "" },
@@ -12525,7 +13225,7 @@ var phoneNumbersDomain = {
       entityName: "phone number",
       listMethod: "getPhoneNumbers",
       archiveMethod: "archivePhoneNumber",
-      columns: COLUMNS24
+      columns: COLUMNS25
     }),
     {
       path: ["phone-numbers", "get"],
@@ -12575,7 +13275,7 @@ ${PHONE_NUMBER_FIELD_REFERENCE}`,
           );
           const record = asPhoneRecord(result2);
           const warnings = collectPhoneNumberWarnings(record);
-          outputData([record], ctx, COLUMNS24);
+          outputData([record], ctx, COLUMNS25);
           if (warnings.length > 0) {
             process.stderr.write("\nWarnings after create:\n");
             for (const w of warnings) {
@@ -12607,7 +13307,7 @@ ${PHONE_NUMBER_FIELD_REFERENCE}`,
             id,
             data
           );
-          outputData([result2], ctx, COLUMNS24);
+          outputData([result2], ctx, COLUMNS25);
         } catch (err) {
           return enrichPhoneNumberApiError(err);
         }
@@ -12895,7 +13595,7 @@ ${formatRoutingSimulation(sim, phone)}
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.getAvailablePhoneNumbers(workspace);
-        outputData(result2, ctx, COLUMNS24);
+        outputData(result2, ctx, COLUMNS25);
       }
     },
     {
@@ -12920,7 +13620,7 @@ ${formatRoutingSimulation(sim, phone)}
         const id = requireNumberFrom(args, "phone-number-id", "id");
         const providerPhoneUuid = requireString(args, "provider-phone-uuid");
         const result2 = await auth.apiClient.linkPhoneNumber(workspace, id, providerPhoneUuid);
-        outputData([result2], auth, COLUMNS24);
+        outputData([result2], auth, COLUMNS25);
       }
     },
     {
@@ -12933,7 +13633,7 @@ ${formatRoutingSimulation(sim, phone)}
           workspace,
           data
         );
-        outputData([result2], ctx, COLUMNS24);
+        outputData([result2], ctx, COLUMNS25);
       }
     },
     {
@@ -13080,7 +13780,7 @@ function normalizePronunciationUpdatePayload(data) {
 }
 
 // src/domains/pronunciations.ts
-var COLUMNS25 = [
+var COLUMNS26 = [
   COL.id(),
   { header: "TERM", getValue: (item) => item.term ?? "" },
   { header: "RESPELLING", getValue: (item) => item.respelling ?? "" },
@@ -13102,7 +13802,7 @@ var pronunciationsDomain = {
         const auth = requireAuth(ctx);
         const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
         const result2 = await auth.apiClient.getPronunciationEntries(orgUuid);
-        outputData(result2, ctx, COLUMNS25);
+        outputData(result2, ctx, COLUMNS26);
       }
     },
     {
@@ -13116,7 +13816,7 @@ var pronunciationsDomain = {
         const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
         const payload = normalizePronunciationCreatePayload(data);
         const result2 = await auth.apiClient.createPronunciationEntry(orgUuid, payload);
-        outputSingle(result2, ctx, COLUMNS25);
+        outputSingle(result2, ctx, COLUMNS26);
       }
     },
     {
@@ -13134,7 +13834,7 @@ var pronunciationsDomain = {
           requireNumber(args, "id"),
           payload
         );
-        outputSingle(result2, ctx, COLUMNS25);
+        outputSingle(result2, ctx, COLUMNS26);
       }
     },
     {
@@ -13158,7 +13858,7 @@ var pronunciationsDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getMyPronunciations();
-        outputData(result2, ctx, COLUMNS25);
+        outputData(result2, ctx, COLUMNS26);
       }
     },
     {
@@ -13169,7 +13869,7 @@ var pronunciationsDomain = {
       handler: async ({ ctx, data }) => {
         const payload = normalizePronunciationCreatePayload(data);
         const result2 = await requireAuth(ctx).apiClient.createMyPronunciation(payload);
-        outputSingle(result2, ctx, COLUMNS25);
+        outputSingle(result2, ctx, COLUMNS26);
       }
     },
     {
@@ -13467,7 +14167,7 @@ ${ROUTINE_FIELD_REFERENCE}`,
 };
 
 // src/domains/subscriptions.ts
-var COLUMNS26 = [
+var COLUMNS27 = [
   COL.id(),
   COL.status(),
   { header: "PLAN", getValue: (item) => item.planName ?? item.plan ?? "" },
@@ -13483,7 +14183,7 @@ var subscriptionsDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getSubscriptions();
-        outputData(result2, ctx, COLUMNS26);
+        outputData(result2, ctx, COLUMNS27);
       }
     },
     {
@@ -13492,7 +14192,7 @@ var subscriptionsDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.getWorkspaceSubscriptions(workspace);
-        outputData(result2, ctx, COLUMNS26);
+        outputData(result2, ctx, COLUMNS27);
       }
     },
     {
@@ -13505,7 +14205,7 @@ var subscriptionsDomain = {
         const result2 = await requireAuth(ctx).apiClient.cancelSubscription(
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS26);
+        outputSingle(result2, ctx, COLUMNS27);
       }
     },
     {
@@ -13517,7 +14217,7 @@ var subscriptionsDomain = {
         const result2 = await requireAuth(ctx).apiClient.reactivateSubscription(
           requireNumber(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS26);
+        outputSingle(result2, ctx, COLUMNS27);
       }
     },
     {
@@ -13531,7 +14231,7 @@ var subscriptionsDomain = {
           requireNumber(args, "id"),
           data
         );
-        outputSingle(result2, ctx, COLUMNS26);
+        outputSingle(result2, ctx, COLUMNS27);
       }
     }
   ]
@@ -13785,7 +14485,7 @@ var supportDomain = {
 };
 
 // src/domains/supervisors.ts
-var COLUMNS27 = [
+var COLUMNS28 = [
   COL.id(),
   COL.name(),
   { header: "TYPE", getValue: (item) => item.type ?? "" },
@@ -13803,7 +14503,7 @@ var supervisorsDomain = {
       createMethod: "createSupervisor",
       updateMethod: "updateSupervisor",
       deleteMethod: "deleteSupervisor",
-      columns: COLUMNS27
+      columns: COLUMNS28
     })
   ]
 };
@@ -14147,7 +14847,7 @@ var widgetDomainsDomain = {
         }
       ],
       examples: [
-        "gr widget-domains enable -w $WID --domain <uuid> --widgets chat,operator --allow-write",
+        "gr widget-domains enable -w $WID --domain <uuid> --widgets chat,operator-tools --allow-write",
         "gr widget-domains enable -w $WID --domain <uuid> --widgets chat --allow-subdomains --port 4444 --allow-write"
       ],
       handler: async ({ ctx, workspace, args }) => {
@@ -14191,7 +14891,7 @@ var widgetDomainsDomain = {
 };
 
 // src/domains/integrations/app-connections.ts
-var COLUMNS28 = [
+var COLUMNS29 = [
   COL.id(),
   COL.name(),
   { header: "TYPE", getValue: (item) => item.type ?? "" },
@@ -14232,7 +14932,7 @@ var appConnectionsDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.listAvailableAppConnections(workspace);
-        outputData(result2, ctx, COLUMNS28);
+        outputData(result2, ctx, COLUMNS29);
       }
     },
     {
@@ -14241,7 +14941,7 @@ var appConnectionsDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.listAppConnections(workspace);
-        outputData(result2, ctx, COLUMNS28);
+        outputData(result2, ctx, COLUMNS29);
       }
     },
     {
@@ -14265,7 +14965,7 @@ var appConnectionsDomain = {
         const result2 = await requireAuth(ctx).apiClient.enablePlatformApp(workspace, {
           slug: requireString(args, "slug")
         });
-        outputSingle(result2, ctx, COLUMNS28);
+        outputSingle(result2, ctx, COLUMNS29);
       }
     },
     {
@@ -14278,7 +14978,7 @@ var appConnectionsDomain = {
           workspace,
           requireString(args, "id")
         );
-        outputSingle(result2, ctx, COLUMNS28);
+        outputSingle(result2, ctx, COLUMNS29);
       }
     },
     {
@@ -14293,7 +14993,7 @@ var appConnectionsDomain = {
           requireString(args, "id"),
           data
         );
-        outputSingle(result2, ctx, COLUMNS28);
+        outputSingle(result2, ctx, COLUMNS29);
       }
     },
     {
@@ -14635,7 +15335,7 @@ var confluenceDomain = {
 };
 
 // src/domains/integrations/discord-bots.ts
-var COLUMNS29 = [COL.id(), COL.name(), COL.status()];
+var COLUMNS30 = [COL.id(), COL.name(), COL.status()];
 var discordBotsDomain = {
   name: "discord-bots",
   description: "Manage Discord bot integrations",
@@ -14648,7 +15348,7 @@ var discordBotsDomain = {
       createMethod: "createDiscordBot",
       updateMethod: "updateDiscordBot",
       deleteMethod: "deleteDiscordBot",
-      columns: COLUMNS29,
+      columns: COLUMNS30,
       paginationSupport: "full"
     }),
     {
@@ -14708,7 +15408,7 @@ var discordBotsDomain = {
 };
 
 // src/domains/integrations/fhir-connections.ts
-var COLUMNS30 = [
+var COLUMNS31 = [
   COL.id(),
   COL.name(),
   { header: "URL", getValue: (item) => item.baseUrl ?? "" },
@@ -14726,7 +15426,7 @@ var fhirConnectionsDomain = {
       createMethod: "createFhirConnection",
       updateMethod: "updateFhirConnection",
       deleteMethod: "deleteFhirConnection",
-      columns: COLUMNS30,
+      columns: COLUMNS31,
       paginationSupport: "full"
     }),
     {
@@ -14746,7 +15446,7 @@ var fhirConnectionsDomain = {
 };
 
 // src/domains/integrations/patientsync.ts
-var COLUMNS31 = [
+var COLUMNS32 = [
   { header: "CONFIGURED", getValue: (i) => String(i.configured ?? false) },
   { header: "ENABLED", getValue: (i) => String(i.enabled ?? false) },
   { header: "HAS_KEY", getValue: (i) => String(i.hasApiKey ?? false) },
@@ -14775,7 +15475,7 @@ var patientSyncDomain = {
           workspace,
           data
         );
-        outputSingle(result2, ctx, COLUMNS31);
+        outputSingle(result2, ctx, COLUMNS32);
       }
     },
     {
@@ -14784,7 +15484,7 @@ var patientSyncDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
         const result2 = await requireAuth(ctx).apiClient.getPatientSyncStatus(workspace);
-        outputSingle(result2, ctx, COLUMNS31);
+        outputSingle(result2, ctx, COLUMNS32);
       }
     },
     {
@@ -15833,7 +16533,7 @@ var salesforceDomain = {
 };
 
 // src/domains/integrations/slack-apps.ts
-var COLUMNS32 = [COL.id(), COL.name(), COL.status()];
+var COLUMNS33 = [COL.id(), COL.name(), COL.status()];
 function addSlackUrls(data, apiUrl, workspaceUuid) {
   const base = `${apiUrl}/api/v2/w/${workspaceUuid}/app-connections/slack`;
   return {
@@ -15856,7 +16556,7 @@ var slackAppsDomain = {
       entityName: "Slack app",
       listMethod: "getSlackApps",
       deleteMethod: "deleteSlackApp",
-      columns: COLUMNS32,
+      columns: COLUMNS33,
       paginationSupport: "full"
     }),
     {
@@ -15942,7 +16642,7 @@ var slackAppsDomain = {
 };
 
 // src/domains/integrations/teams-apps.ts
-var COLUMNS33 = [COL.id(), COL.name(), COL.status()];
+var COLUMNS34 = [COL.id(), COL.name(), COL.status()];
 function addTeamsUrls(data, apiUrl, workspaceUuid) {
   const base = `${apiUrl}/api/v2/w/${workspaceUuid}/app-connections/teams`;
   return {
@@ -15963,7 +16663,7 @@ var teamsAppsDomain = {
       entityName: "Teams app",
       listMethod: "getTeamsApps",
       deleteMethod: "deleteTeamsApp",
-      columns: COLUMNS33,
+      columns: COLUMNS34,
       paginationSupport: "full"
     }),
     {
@@ -16069,6 +16769,7 @@ function registerPublicDomains(registry) {
   registry.register(qualificationsDomain);
   registry.register(queriesDomain);
   registry.register(personasDomain);
+  registry.register(metricsDomain);
   registry.register(journeysDomain);
   registry.register(abilitiesDomain);
   registry.register(phoneNumbersDomain);
@@ -16076,10 +16777,10 @@ function registerPublicDomains(registry) {
   registry.register(inboxesDomain);
   registry.register(operatorGroupsDomain);
   registry.register(accessGrantsDomain);
+  registry.register(interventionRequestsDomain);
   registry.register(notificationRulesDomain);
   registry.register(supervisorsDomain);
   registry.register(promptsDomain);
-  registry.register(milestonesDomain);
   registry.register(customToolkitsDomain);
   registry.register(mcpServersDomain);
   registry.register(apiKeysDomain);
@@ -16091,6 +16792,7 @@ function registerPublicDomains(registry) {
   registry.register(featuresDomain);
   registry.register(pronunciationsDomain);
   registry.register(orgDomain);
+  registry.register(orgLegalEntitiesDomain);
   registry.register(orgPhoneNumbersDomain);
   registry.register(authManageDomain);
   registry.register(appsDomain);
@@ -19228,7 +19930,7 @@ async function authImportDevCommand(ctx, args) {
 }
 
 // src/commands/organizations.ts
-var COLUMNS34 = [
+var COLUMNS35 = [
   { header: "NAME", getValue: (o) => o.organizationName || "", maxWidth: 35 },
   { header: "SLUG", getValue: (o) => o.organizationSlug || "", maxWidth: 25 },
   { header: "UUID", getValue: (o) => o.organizationUuid },
@@ -19236,7 +19938,7 @@ var COLUMNS34 = [
 ];
 async function organizationsListCommand(ctx) {
   const organizations = await ctx.apiClient.getMyOrganizations();
-  outputData(organizations, ctx, COLUMNS34);
+  outputData(organizations, ctx, COLUMNS35);
 }
 
 // src/commands/whoami.ts