@gravity-rail/cli 0.3.0 → 0.5.0

package/dist/lib.js

@@ -1,6 +1,8 @@
 import {
   AGUIClient,
   CredentialsManager,
+  __export,
+  __reExport,
   clearScreen,
   formatTimestamp,
   getEnvironmentConfig,
@@ -11,7 +13,7 @@ import {
   printTable,
   refreshAccessToken,
   selectFromList
-} from "./chunk-OIFV7TAT.js";
+} from "./chunk-C6D4FO6A.js";
 
 // src/lib/errors.ts
 var CLIError = class extends Error {
@@ -43,9 +45,11 @@ function handleError(err) {
       }
     }
     if ("statusCode" in err && err.statusCode === 401) {
-      process.stderr.write(`
-Hint: Run "yarn gr login" or use "--realm <name>" (dev only)
-`);
+      process.stderr.write(
+        `
+Hint: Run "gr login" to authenticate, or set GRAVITY_RAIL_API_KEY for non-interactive use.
+`
+      );
     }
     process.exit(1);
   }
@@ -264,8 +268,1583 @@ function findDef(defs, arg) {
   return void 0;
 }
 
-// src/lib/context.ts
+// ../client/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  AdminApi: () => AdminApi,
+  ApiClient: () => ApiClient,
+  bindAdminMethods: () => bindAdminMethods
+});
+__reExport(dist_exports, internal_star);
+import * as internal_star from "@gravity-rail/sdk/internal";
+import { BaseApiClient } from "@gravity-rail/sdk/internal";
 import { GravityRailClient } from "@gravity-rail/sdk";
+function supportRequestParams(params) {
+  const searchParams = new URLSearchParams();
+  if (params?.page) searchParams.append("page", params.page.toString());
+  if (params?.pageSize) searchParams.append("pageSize", params.pageSize.toString());
+  if (params?.status) searchParams.append("status", params.status);
+  if (params?.supportRequestType) {
+    searchParams.append("supportRequestType", params.supportRequestType);
+  }
+  if (params?.severity) searchParams.append("severity", params.severity);
+  if (params?.source) searchParams.append("source", params.source);
+  if (params?.organizationId !== void 0) {
+    searchParams.append("organizationId", params.organizationId.toString());
+  }
+  if (params?.workspaceId !== void 0) {
+    searchParams.append("workspaceId", params.workspaceId.toString());
+  }
+  if (params?.linearLinked !== void 0) {
+    searchParams.append("linearLinked", params.linearLinked.toString());
+  }
+  const query = searchParams.toString();
+  return query ? `?${query}` : "";
+}
+var AdminApi = class extends BaseApiClient {
+  // Support Requests API
+  async listSupportRequestsAsAdmin(params) {
+    return this.fetch(
+      `admin/support-requests${supportRequestParams(params)}`
+    );
+  }
+  async getSupportRequestAsAdmin(uuid) {
+    return this.fetch(`admin/support-requests/${uuid}`);
+  }
+  async commentOnSupportRequestAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/comments`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async noteOnSupportRequestAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/notes`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateSupportRequestStatusAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/status`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateSupportRequestAttributesAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/attributes`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async createSupportRequestLinearIssueAsAdmin(uuid) {
+    return this.fetch(`admin/support-requests/${uuid}/linear-issue`, {
+      method: "POST"
+    });
+  }
+  // Admin Accounts API
+  async getAccounts(options) {
+    const params = new URLSearchParams();
+    if (options.search) params.append("search", options.search);
+    if (options.createdAfter) params.append("created_after", options.createdAfter);
+    if (options.createdBefore) params.append("created_before", options.createdBefore);
+    if (options.sortBy) params.append("sortBy", options.sortBy);
+    if (options.sortOrder) params.append("sortOrder", options.sortOrder);
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    if (options.isActive !== void 0) params.append("isActive", options.isActive.toString());
+    if (options.organizationId !== void 0)
+      params.append("organizationId", options.organizationId.toString());
+    if (options.pendingDeletion !== void 0)
+      params.append("pendingDeletion", options.pendingDeletion.toString());
+    return this.fetch(`admin/accounts?${params.toString()}`);
+  }
+  async getAccountDetails(id) {
+    return this.fetch(`admin/accounts/${id}`);
+  }
+  async getAccountByUuid(uuid) {
+    return this.fetch(`admin/accounts/${uuid}`);
+  }
+  async getAccountMemberships(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/memberships`);
+  }
+  async getAccountOrgMemberships(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/org-memberships`);
+  }
+  async createAccountOrgMembership(accountId, organizationId, role = "member") {
+    return this.fetch(`admin/accounts/${accountId}/org-memberships`, {
+      method: "POST",
+      body: JSON.stringify({ organizationId, role })
+    });
+  }
+  async deleteAccountOrgMembership(accountId, organizationId) {
+    return this.fetch(`admin/accounts/${accountId}/org-memberships/${organizationId}`, {
+      method: "DELETE"
+    });
+  }
+  async getAccountMembership(accountId, workspaceId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/memberships/${workspaceId}`
+    );
+  }
+  async updateAccountMembership(accountId, workspaceId, updates) {
+    return this.fetch(
+      `admin/accounts/${accountId}/memberships/${workspaceId}`,
+      {
+        method: "PUT",
+        body: JSON.stringify(updates)
+      }
+    );
+  }
+  async createAccountMembership(accountId, workspaceId, data) {
+    return this.fetch(
+      `admin/accounts/${accountId}/memberships/${workspaceId}`,
+      {
+        method: "POST",
+        body: JSON.stringify(data)
+      }
+    );
+  }
+  async deleteAccountMembership(accountId, workspaceId) {
+    return this.fetch(`admin/accounts/${accountId}/memberships/${workspaceId}`, {
+      method: "DELETE"
+    });
+  }
+  async updateAccountAsAdmin(id, updates) {
+    return this.fetch(`admin/accounts/${id}`, {
+      method: "PUT",
+      body: JSON.stringify(updates)
+    });
+  }
+  async createAccountAsAdmin(data) {
+    return this.fetch("admin/accounts", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async deleteAccountAsAdmin(id) {
+    return this.fetch(`admin/accounts/${id}`, {
+      method: "DELETE"
+    });
+  }
+  // GDPR Data Subject Rights (superuser only)
+  async exportAccountData(accountId) {
+    return this.fetch(`admin/data-rights/${accountId}/export`, {
+      method: "POST"
+    });
+  }
+  async requestAccountDeletion(accountId) {
+    return this.fetch(`admin/data-rights/${accountId}/delete`, {
+      method: "POST"
+    });
+  }
+  async cancelAccountDeletion(accountId) {
+    return this.fetch(`admin/data-rights/${accountId}/cancel-delete`, {
+      method: "POST"
+    });
+  }
+  /**
+   * Look up an account by email or phone. Returns verification status.
+   * Used to check if a verified account exists before creating a new one.
+   */
+  async lookupAccount(options) {
+    const params = new URLSearchParams();
+    if (options.email) params.append("email", options.email);
+    if (options.phone) params.append("phone", options.phone);
+    return this.fetch(`admin/accounts/lookup?${params.toString()}`);
+  }
+  // Admin Organizations API
+  async getOrganizations(options) {
+    const params = new URLSearchParams();
+    if (options?.search) params.append("search", options.search);
+    if (options?.page) params.append("page", options.page.toString());
+    if (options?.pageSize) params.append("pageSize", options.pageSize.toString());
+    if (options?.noSubscription) params.append("no_subscription", "true");
+    if (options?.sortBy) params.append("sortBy", options.sortBy);
+    if (options?.sortOrder) params.append("sortOrder", options.sortOrder);
+    return this.fetch(
+      `admin/organizations?${params.toString()}`
+    );
+  }
+  /**
+   * Get organization by ID or UUID.
+   * Returns different response based on user's role:
+   * - Admins/Owners: AdminOrganization with full details
+   * - Members: MemberOrgView with basic info and workspace list
+   *
+   * Use `viewType` field to determine the response type:
+   * - 'admin': AdminOrganization
+   * - 'member': MemberOrgView
+   */
+  async getOrganization(idOrUuid) {
+    return this.fetch(`o/${idOrUuid}`);
+  }
+  /**
+   * Get organization by numeric ID or UUID via admin endpoint.
+   * Does NOT require organization membership — superuser-only.
+   */
+  async getOrganizationAsAdmin(idOrUuid) {
+    return this.fetch(`admin/organizations/${idOrUuid}`);
+  }
+  async getOrganizationMembersAsAdmin(organizationId, options) {
+    const params = new URLSearchParams();
+    if (options?.search) params.append("search", options.search);
+    if (options?.role) params.append("role", options.role);
+    if (options?.page) params.append("page", options.page.toString());
+    if (options?.pageSize) params.append("pageSize", options.pageSize.toString());
+    const qs = params.toString();
+    return this.fetch(
+      `admin/organizations/${organizationId}/members${qs ? `?${qs}` : ""}`
+    );
+  }
+  async createOrganization(data) {
+    return this.fetch("admin/organizations", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateOrganization(id, data) {
+    return this.fetch(`admin/organizations/${id}`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async deleteOrganization(id) {
+    return this.fetch(`admin/organizations/${id}`, {
+      method: "DELETE"
+    });
+  }
+  /**
+   * Join an organization with a specified role (superuser only).
+   * Creates or updates membership in the target org.
+   * @param orgUuid - Organization UUID or numeric ID as string
+   */
+  async joinOrganization(orgUuid, role = "owner") {
+    return this.fetch(`admin/organizations/${orgUuid}/join`, {
+      method: "POST",
+      body: JSON.stringify({ role })
+    });
+  }
+  /**
+   * Leave an organization (superuser only).
+   * @param orgUuid - Organization UUID or numeric ID as string
+   */
+  async leaveOrganization(orgUuid) {
+    return this.fetch(`admin/organizations/${orgUuid}/join`, {
+      method: "DELETE"
+    });
+  }
+  async generateLogoUploadUrl(organizationUuid, data) {
+    return this.fetch(`o/${organizationUuid}/logo-upload-url`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  // Organization Members API - moved to OrgApi at /api/v2/o/{org_uuid}/members
+  // See packages/client/src/api/org.ts
+  // Organization Invitations API - moved to OrgApi at /api/v2/o/{org_uuid}/invitations
+  // See packages/client/src/api/org.ts
+  // Admin Products API
+  async importProducts(workspaceId) {
+    return this.fetch("admin/import-products", {
+      method: "POST",
+      body: JSON.stringify({ workspaceId })
+    });
+  }
+  // ===== Product CRUD =====
+  async createProductAsAdmin(product) {
+    return this.fetch("admin/products", {
+      method: "POST",
+      body: JSON.stringify(product)
+    });
+  }
+  async getProductsAsAdmin(workspaceUuid, productTypes) {
+    const params = new URLSearchParams();
+    if (workspaceUuid) {
+      params.append("workspace_uuid", workspaceUuid);
+    }
+    if (productTypes && productTypes.length > 0) {
+      productTypes.forEach((type) => params.append("product_types", type));
+    }
+    const queryString = params.toString();
+    return this.fetch(`admin/products${queryString ? `?${queryString}` : ""}`);
+  }
+  async getProductAsAdmin(productId) {
+    return this.fetch(`admin/products/${productId}`);
+  }
+  async updateProductAsAdmin(product_id, product) {
+    return this.fetch(`admin/products/${product_id}`, {
+      method: "PUT",
+      body: JSON.stringify(product)
+    });
+  }
+  async deleteProductAsAdmin(productId) {
+    return this.fetch(`admin/products/${productId}`, {
+      method: "DELETE"
+    });
+  }
+  // Admin Workspace API
+  async getWorkspacesAsAdmin(options = {}) {
+    const params = new URLSearchParams();
+    if (options.page !== void 0) params.append("page", options.page.toString());
+    if (options.pageSize !== void 0) params.append("pageSize", options.pageSize.toString());
+    if (options.sortBy) params.append("sortBy", options.sortBy);
+    if (options.sortOrder) params.append("sortOrder", options.sortOrder);
+    if (options.search) params.append("search", options.search);
+    if (options.isReseller !== void 0)
+      params.append("isReseller", options.isReseller.toString());
+    if (options.organizationId !== void 0)
+      params.append("organizationId", options.organizationId.toString());
+    if (options.noActiveSubscription) params.append("noActiveSubscription", "true");
+    return this.fetch(`admin/workspaces?${params.toString()}`);
+  }
+  async getWorkspaceAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}`);
+  }
+  async getWorkspaceByNumericIdAsAdmin(workspace_id) {
+    return this.fetch(`admin/workspaces/id/${workspace_id}`);
+  }
+  async createWorkspaceAsAdmin(ws) {
+    return this.fetch("admin/workspaces", {
+      method: "POST",
+      body: JSON.stringify(ws)
+    });
+  }
+  async updateWorkspaceAsAdmin(wid, ws) {
+    return this.fetch(`admin/workspaces/${wid}`, {
+      method: "PUT",
+      body: JSON.stringify(ws)
+    });
+  }
+  async deleteWorkspaceAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}`, {
+      method: "DELETE"
+    });
+  }
+  async createSchemaAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}/provision/create`, {
+      method: "POST"
+    });
+  }
+  async migrateSchemaAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}/provision/migrate`, {
+      method: "POST"
+    });
+  }
+  async provisionWorkspaceAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}/provision`, {
+      method: "POST"
+    });
+  }
+  async refreshProvisionStatusAsAdmin(wid) {
+    return this.fetch(`admin/workspaces/${wid}/provision/refresh`, {
+      method: "POST"
+    });
+  }
+  async enableMaintenanceMode(wid) {
+    return this.fetch(`admin/workspaces/${wid}/maintenance`, {
+      method: "PUT"
+    });
+  }
+  async disableMaintenanceMode(wid) {
+    return this.fetch(`admin/workspaces/${wid}/maintenance`, {
+      method: "DELETE"
+    });
+  }
+  // ===== Workspace Health Check =====
+  async getWorkspaceHealth(workspaceUuid) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/health`);
+  }
+  async provisionPlanFeatures(workspaceUuid, request) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/provision-plan`, {
+      method: "POST",
+      body: JSON.stringify(request || {})
+    });
+  }
+  /**
+   * Switch a workspace's plan product on its active SubscriptionItem.
+   *
+   * Superuser only. Re-syncs ``workspace.features`` from the new product
+   * and emits a ``WORKSPACE_PRODUCT_CHANGED`` audit event identifying the
+   * actor, target workspace, prior and new product, and feature diff.
+   *
+   * Stripe is not touched here; price-id changes belong to the dedicated
+   * Stripe sync surface (``syncProductToStripe``).
+   */
+  async changeWorkspaceProduct(workspaceUuid, productId) {
+    const body = { productId };
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/product`,
+      {
+        method: "POST",
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  // ===== Workflow Access Validation =====
+  async validateWorkflowAccessAsAdmin(workspaceUuid) {
+    const params = new URLSearchParams();
+    if (workspaceUuid) params.append("workspace_uuid", workspaceUuid);
+    const qs = params.toString();
+    return this.fetch(
+      `admin/workspaces/validate-workflow-access${qs ? `?${qs}` : ""}`
+    );
+  }
+  async mergeMembers(wid, request) {
+    return this.fetch(`admin/workspaces/${wid}/merge-members`, {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  async getAdminWorkspaceMember(wid) {
+    return this.fetch(`admin/workspaces/${wid}/me`, {
+      method: "GET"
+    });
+  }
+  async createAdminWorkspaceMember(wid, data) {
+    return this.fetch(`admin/workspaces/${wid}/me`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateAdminWorkspaceMember(wid, data) {
+    return this.fetch(`admin/workspaces/${wid}/me`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async unarchiveAdminWorkspaceMember(wid) {
+    return this.fetch(`admin/workspaces/${wid}/me/unarchive`, {
+      method: "POST"
+    });
+  }
+  async getAdminWorkspaceMemberRoles(wid) {
+    return this.fetch(`admin/workspaces/${wid}/member-roles`);
+  }
+  async getUnmappedPhoneNumbers() {
+    return this.fetch(`admin/phone-numbers/unmapped`);
+  }
+  async getWorkspaceUnmappedPhoneNumbers(workspaceId) {
+    return this.fetch(
+      `admin/phone-numbers/workspace/${workspaceId}/unmapped`
+    );
+  }
+  async getWorkspacePhoneNumbersAsAdmin(workspaceRef) {
+    return this.fetch(`admin/workspaces/${workspaceRef}/phone-numbers`);
+  }
+  // Phone Numbers API (Provider phone numbers from Twilio, AWS, etc.)
+  async getProviderPhoneNumbers(options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    if (options.search) params.append("search", options.search);
+    if (options.isAssigned !== void 0)
+      params.append("is_assigned", String(options.isAssigned));
+    if (options.provider) params.append("provider", options.provider);
+    if (options.organizationId !== void 0)
+      params.append("organizationId", options.organizationId.toString());
+    if (options.sortBy) params.append("sortBy", options.sortBy);
+    if (options.sortOrder) params.append("sortOrder", options.sortOrder);
+    return this.fetch(
+      `admin/phone-numbers${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+  async getProviderPhoneNumber(id) {
+    return this.fetch(`admin/phone-numbers/${id}`);
+  }
+  async updateProviderPhoneNumber(id, data) {
+    return this.fetch(`admin/phone-numbers/${id}`, {
+      method: "PATCH",
+      body: JSON.stringify(data)
+    });
+  }
+  async mapMainAccountPhone(data) {
+    return this.fetch(`admin/phone-numbers/map-from-main-account`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async unmapPhoneNumber(data) {
+    return this.fetch(`admin/phone-numbers/unmap`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async searchAvailablePhoneNumbersAsAdmin(data) {
+    return this.fetch(`admin/phone-numbers/search`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async purchasePhoneNumberAsAdmin(data) {
+    return this.fetch(`admin/phone-numbers/purchase`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async getOrgA2PStatusAsAdmin(organizationId) {
+    return this.fetch(`admin/organizations/${organizationId}/a2p-status`);
+  }
+  async resetOrgA2PStatusAsAdmin(organizationId) {
+    return this.fetch(`admin/organizations/${organizationId}/a2p-status`, {
+      method: "DELETE"
+    });
+  }
+  // Site Mappings API
+  async getSiteMappings(options) {
+    const queryParams = new URLSearchParams();
+    if (options?.search) queryParams.append("search", options.search);
+    if (options?.page) queryParams.append("page", options.page.toString());
+    if (options?.pageSize) queryParams.append("pageSize", options.pageSize.toString());
+    const queryString = queryParams.toString();
+    const url = `admin/site-mappings${queryString ? `?${queryString}` : ""}`;
+    return this.fetch(url);
+  }
+  async getSiteMapping(siteId) {
+    return this.fetch(`admin/site-mappings/${siteId}`);
+  }
+  async updateSiteMapping(siteId, data) {
+    return this.fetch(`admin/site-mappings/${siteId}`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateSiteMappingWorkspace(siteId, workspaceId) {
+    return this.updateSiteMapping(siteId, {
+      workspaceId,
+      siteUuid: ""
+      // These fields are required by the type but will be ignored on the server
+    });
+  }
+  async adminDeleteSiteMapping(siteId) {
+    return this.fetch(`admin/site-mappings/${siteId}`, {
+      method: "DELETE"
+    });
+  }
+  async createSiteMapping(mapping) {
+    return this.fetch(`admin/site-mappings`, {
+      method: "POST",
+      body: JSON.stringify(mapping)
+    });
+  }
+  // Keep for backward compatibility
+  async createOrUpdateSiteMapping(wid, mapping) {
+    return this.fetch(`admin/workspaces/${wid}/site-mappings`, {
+      method: "POST",
+      body: JSON.stringify(mapping)
+    });
+  }
+  async deleteSiteMapping(wid, siteUuid) {
+    return this.fetch(`admin/workspaces/${wid}/site-mappings/${siteUuid}`, {
+      method: "DELETE"
+    });
+  }
+  async getWorkspaceInboxesAsAdmin(workspaceUuid) {
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/inboxes`
+    );
+  }
+  // Admin Inbox Mappings API
+  async getInboxMappings(options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    if (options.search) params.append("search", options.search);
+    if (options.workspaceId) params.append("workspaceId", options.workspaceId.toString());
+    return this.fetch(
+      `admin/inbox-mappings${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+  async getInboxMapping(id) {
+    return this.fetch(`admin/inbox-mappings/${id}`);
+  }
+  async updateInboxMapping(id, workspaceId) {
+    return this.fetch(`admin/inbox-mappings/${id}`, {
+      method: "PUT",
+      body: JSON.stringify({ workspaceId })
+    });
+  }
+  async deleteAdminInboxMapping(id) {
+    return this.fetch(`admin/inbox-mappings/${id}`, {
+      method: "DELETE"
+    });
+  }
+  // Evaluation API
+  async generateChatSummaries(options) {
+    return this.fetch("admin/generate-summaries", {
+      method: "POST",
+      body: JSON.stringify({
+        after_date: options.afterDate ? options.afterDate.toISOString().split("T")[0] + "T" + options.afterDate.toTimeString().split(" ")[0] : void 0,
+        only_without_summaries: options.onlyWithoutSummaries ?? true
+      })
+    });
+  }
+  async executeQuery(options) {
+    return this.fetch("admin/execute-query", {
+      method: "POST",
+      body: JSON.stringify({
+        query: options.query,
+        workspace_uuid: options.workspaceUuid
+      })
+    });
+  }
+  /**
+   * Resolve a Langfuse trace UI URL from a trace ID, chat ID, or message ID.
+   *
+   * URL-only: never fetches Langfuse payloads, Message content, or
+   * tool arguments. Exactly one of ``traceId``, ``chatId``, or
+   * ``messageId`` must be set; chat/message forms require a
+   * workspaceUuid. See
+   * docs/development/observability/llm-call-investigation.md.
+   */
+  async getTraceUrl(options) {
+    return this.fetch("admin/trace/url", {
+      method: "POST",
+      body: JSON.stringify({
+        trace_id: options.traceId,
+        chat_id: options.chatId,
+        message_id: options.messageId,
+        workspace_uuid: options.workspaceUuid
+      })
+    });
+  }
+  // Admin Themes API
+  async listAllThemes() {
+    return this.fetch("admin/themes/list");
+  }
+  // Missing Memberships API
+  async getMissingMemberships(workspaceId) {
+    return this.fetch(
+      `admin/workspaces/${workspaceId}/missing-memberships`
+    );
+  }
+  async linkMissingMembership(workspaceId, memberId, accountId) {
+    return this.fetch(
+      `admin/workspaces/${workspaceId}/link-membership?member_id=${memberId}&account_id=${accountId}`,
+      {
+        method: "POST"
+      }
+    );
+  }
+  // Bulk Phone Classification API
+  async startBulkPhoneClassification(workspaceUuid, includeUnknown = false) {
+    const params = new URLSearchParams();
+    params.append("include_unknown", includeUnknown.toString());
+    return this.fetch(`admin/workspaces/${workspaceUuid}/bulk-classify-phones?${params.toString()}`, {
+      method: "POST"
+    });
+  }
+  // Bulk TOS Acceptance API
+  async startBulkTOSAcceptance(workspaceUuid) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/bulk-accept-tos`, {
+      method: "POST"
+    });
+  }
+  // Token Usage Backfill API
+  async startTokenUsageBackfill(workspaceUuid) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/backfill-token-usage`, {
+      method: "POST"
+    });
+  }
+  // ===== Admin Chat Endpoints =====
+  async listWorkspaceChats(workspaceUuid, options) {
+    const params = new URLSearchParams();
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.pageSize) params.set("pageSize", String(options.pageSize));
+    if (options?.search) params.set("search", options.search);
+    if (options?.chatType) params.set("chatType", options.chatType);
+    if (options?.channel) params.set("channel", options.channel);
+    if (options?.archived !== void 0) params.set("archived", String(options.archived));
+    const qs = params.toString();
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/chats${qs ? `?${qs}` : ""}`
+    );
+  }
+  async getWorkspaceChat(workspaceUuid, chatId, options) {
+    const params = new URLSearchParams();
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.pageSize) params.set("pageSize", String(options.pageSize));
+    const qs = params.toString();
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/chats/${chatId}${qs ? `?${qs}` : ""}`
+    );
+  }
+  // Update chat message content
+  async updateChatMessage(workspaceUuid, chatId, messageId, content) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/chats/${chatId}/messages/${messageId}`, {
+      method: "POST",
+      body: JSON.stringify({ content })
+    });
+  }
+  async rateWorkspaceChatMessage(workspaceUuid, chatId, messageId, rating, comment) {
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/chats/${chatId}/messages/${messageId}/rate`,
+      {
+        method: "POST",
+        body: JSON.stringify({ rating, comment })
+      }
+    );
+  }
+  // ===== Stripe Customer Management =====
+  async getStripeCustomer(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/customer`);
+  }
+  async createStripeCustomer(accountId, data) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/customer`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateStripeCustomer(accountId, data) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/customer`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  // ===== Customer Management =====
+  async createCustomerFromAccount(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/customer`, {
+      method: "POST"
+    });
+  }
+  async getCustomers(options) {
+    const params = new URLSearchParams();
+    if (options?.search) params.set("search", options.search);
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.pageSize) params.set("page_size", String(options.pageSize));
+    const qs = params.toString();
+    return this.fetch(`admin/customers${qs ? `?${qs}` : ""}`);
+  }
+  async getCustomer(customerId) {
+    return this.fetch(`admin/customers/${customerId}`);
+  }
+  async createCustomer(data) {
+    return this.fetch("admin/customers", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateCustomer(customerId, data) {
+    return this.fetch(`admin/customers/${customerId}`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async syncCustomerToStripe(customerId) {
+    return this.fetch(`admin/customers/${customerId}/stripe/sync`, {
+      method: "POST"
+    });
+  }
+  async getCustomerAccounts(customerId) {
+    return this.fetch(`admin/customers/${customerId}/accounts`);
+  }
+  async linkCustomerToAccount(customerId, accountId, role) {
+    return this.fetch(`admin/customers/${customerId}/accounts`, {
+      method: "POST",
+      body: JSON.stringify({ accountId, role })
+    });
+  }
+  async unlinkCustomerFromAccount(customerId, accountId) {
+    await this.fetch(`admin/customers/${customerId}/accounts/${accountId}`, {
+      method: "DELETE"
+    });
+  }
+  // ===== Stripe Subscription Management =====
+  async getStripeSubscriptions(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/subscriptions`);
+  }
+  async createStripeSubscription(customerId, data) {
+    return this.fetch(`admin/customers/${customerId}/stripe/subscriptions`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async createDirectSubscription(customerId, data) {
+    return this.fetch(`admin/customers/${customerId}/direct/subscriptions`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateStripeSubscription(accountId, subscriptionId, data) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/subscriptions/${subscriptionId}`,
+      {
+        method: "PUT",
+        body: JSON.stringify(data)
+      }
+    );
+  }
+  async cancelStripeSubscription(accountId, subscriptionId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/subscriptions/${subscriptionId}`,
+      {
+        method: "DELETE"
+      }
+    );
+  }
+  async provisionWorkspaceForSubscription(accountId, subscriptionId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/subscriptions/${subscriptionId}/provision`,
+      {
+        method: "POST"
+      }
+    );
+  }
+  async associateWorkspaceWithSubscription(accountId, subscriptionId, workspaceId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/subscriptions/${subscriptionId}/associate?workspace_id=${workspaceId}`,
+      {
+        method: "POST"
+      }
+    );
+  }
+  async createSubscriptionPaymentLink(accountId, subscriptionId) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/subscriptions/${subscriptionId}/payment-link`, {
+      method: "POST"
+    });
+  }
+  // ===== Stripe Payment Methods Management =====
+  async createSetupIntent(accountId) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/setup-intent`, {
+      method: "POST"
+    });
+  }
+  async getStripePaymentMethods(accountId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/payment-methods`
+    );
+  }
+  async attachStripePaymentMethod(accountId, paymentMethodId, setAsDefault = false) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/payment-methods/${paymentMethodId}/attach`, {
+      method: "POST",
+      body: JSON.stringify({ setAsDefault })
+    });
+  }
+  async detachStripePaymentMethod(accountId, paymentMethodId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/payment-methods/${paymentMethodId}`,
+      {
+        method: "DELETE"
+      }
+    );
+  }
+  async setDefaultStripePaymentMethod(accountId, paymentMethodId) {
+    return this.fetch(
+      `admin/accounts/${accountId}/stripe/payment-methods/${paymentMethodId}/set-default`,
+      {
+        method: "PUT"
+      }
+    );
+  }
+  // ===== Convert Direct Subscription to Stripe =====
+  async convertSubscriptionToStripe(customerId, subscriptionId) {
+    return this.fetch(
+      `admin/customers/${customerId}/subscriptions/${subscriptionId}/convert-to-stripe`,
+      { method: "POST" }
+    );
+  }
+  // ===== Customer-Level Stripe Payment Methods =====
+  async createCustomerSetupIntent(customerId) {
+    return this.fetch(`admin/customers/${customerId}/stripe/setup-intent`, {
+      method: "POST"
+    });
+  }
+  async getCustomerPaymentMethods(customerId) {
+    return this.fetch(
+      `admin/customers/${customerId}/stripe/payment-methods`
+    );
+  }
+  async attachCustomerPaymentMethod(customerId, paymentMethodId, setAsDefault = false) {
+    return this.fetch(`admin/customers/${customerId}/stripe/payment-methods/${paymentMethodId}/attach`, {
+      method: "POST",
+      body: JSON.stringify({ setAsDefault })
+    });
+  }
+  async detachCustomerPaymentMethod(customerId, paymentMethodId) {
+    return this.fetch(
+      `admin/customers/${customerId}/stripe/payment-methods/${paymentMethodId}`,
+      {
+        method: "DELETE"
+      }
+    );
+  }
+  async setDefaultCustomerPaymentMethod(customerId, paymentMethodId) {
+    return this.fetch(
+      `admin/customers/${customerId}/stripe/payment-methods/${paymentMethodId}/set-default`,
+      {
+        method: "PUT"
+      }
+    );
+  }
+  // ===== Workspace Organization Migration =====
+  async previewWorkspaceOrganizationChange(workspaceUuid, targetOrganizationId, newCreatorId) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/change-org/preview`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        targetOrganizationId,
+        newCreatorId
+      })
+    });
+  }
+  async changeWorkspaceOrganization(workspaceUuid, targetOrganizationId, newCreatorId) {
+    return this.fetch(`admin/workspaces/${workspaceUuid}/change-org`, {
+      method: "POST",
+      body: JSON.stringify({
+        targetOrganizationId,
+        newCreatorId
+      })
+    });
+  }
+  // ===== Stripe Invoice Management =====
+  async createStripeInvoice(accountId, data) {
+    return this.fetch(`admin/accounts/${accountId}/stripe/invoices`, {
+      method: "POST",
+      body: JSON.stringify({
+        customer: data.customer,
+        description: data.description,
+        collection_method: data.collectionMethod,
+        days_until_due: data.daysUntilDue,
+        auto_advance: data.autoAdvance,
+        metadata: data.metadata
+      })
+    });
+  }
+  async getStripeInvoices(accountId, options) {
+    const params = new URLSearchParams();
+    if (options?.limit) params.append("limit", options.limit.toString());
+    if (options?.startingAfter) params.append("starting_after", options.startingAfter);
+    return this.fetch(`admin/accounts/${accountId}/stripe/invoices?${params.toString()}`);
+  }
+  async getStripeUpcomingInvoice(accountId, subscriptionId) {
+    const params = new URLSearchParams();
+    if (subscriptionId) params.append("subscription_id", subscriptionId);
+    return this.fetch(`admin/accounts/${accountId}/stripe/upcoming-invoice?${params.toString()}`);
+  }
+  // Billing Dashboard API
+  async getWorkspaceUsageDashboard(workspaceUuid) {
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/usage-dashboard`
+    );
+  }
+  // Product Stripe Sync API
+  async compareProductsWithStripe(workspaceUuid) {
+    const params = workspaceUuid ? `?workspace_uuid=${encodeURIComponent(workspaceUuid)}` : "";
+    return this.fetch(`admin/products/compare-stripe${params}`);
+  }
+  async syncProductToStripe(productId, request) {
+    return this.fetch(`admin/products/${productId}/sync-stripe`, {
+      method: "POST",
+      body: JSON.stringify({ ...request, productId })
+    });
+  }
+  // Search Stripe products
+  async searchStripeProducts(query, limit = 10) {
+    const params = new URLSearchParams({ query, limit: limit.toString() });
+    return this.fetch(`admin/products/stripe/search?${params.toString()}`);
+  }
+  // ===== Subscriptions API =====
+  async getSubscriptionsAsAdmin(options) {
+    const params = new URLSearchParams();
+    if (options?.productId) params.append("product_id", options.productId.toString());
+    if (options?.productType) params.append("product_type", options.productType);
+    if (options?.customerId) params.append("customer_id", options.customerId.toString());
+    if (options?.organizationId)
+      params.append("organization_id", options.organizationId.toString());
+    if (options?.accountId) params.append("account_id", options.accountId.toString());
+    if (options?.isDirect !== void 0) params.append("is_direct", options.isDirect.toString());
+    if (options?.status) params.append("status", options.status);
+    if (options?.page) params.append("page", options.page.toString());
+    if (options?.pageSize) params.append("page_size", options.pageSize.toString());
+    const queryString = params.toString();
+    return this.fetch(
+      `admin/subscriptions${queryString ? `?${queryString}` : ""}`
+    );
+  }
+  async getSubscriptionAsAdmin(subscriptionId) {
+    return this.fetch(`admin/subscriptions/${subscriptionId}`);
+  }
+  async updateSubscriptionStatusAsAdmin(subscriptionId, subscriptionStatus) {
+    return this.fetch(`admin/subscriptions/${subscriptionId}`, {
+      method: "PUT",
+      body: JSON.stringify({ subscription_status: subscriptionStatus })
+    });
+  }
+  async updateSubscriptionCreditSettingsAsAdmin(subscriptionId, settings) {
+    return this.fetch(`admin/subscriptions/${subscriptionId}`, {
+      method: "PUT",
+      body: JSON.stringify(settings)
+    });
+  }
+  /** Grant credits to a subscription (superuser only). */
+  async grantCreditsAsAdmin(subscriptionId, creditUnits, grantType, reason) {
+    return this.fetch(`admin/subscriptions/${subscriptionId}/grant-credits`, {
+      method: "POST",
+      body: JSON.stringify({ credit_units: creditUnits, grant_type: grantType, reason })
+    });
+  }
+  /** List credit grants for a subscription (superuser only). */
+  async listCreditGrantsAsAdmin(subscriptionId) {
+    return this.fetch(`admin/subscriptions/${subscriptionId}/credit-grants`);
+  }
+  // ===== Usage API =====
+  async getUsageReport(request) {
+    return this.fetch("admin/usage", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  // Voice Metrics API
+  async getVoiceMetrics(options) {
+    const params = new URLSearchParams();
+    if (options?.hours) params.append("hours", options.hours.toString());
+    if (options?.period) params.append("period", options.period.toString());
+    if (options?.workspace_uuid) params.append("workspace_uuid", options.workspace_uuid);
+    if (options?.organization_id != null)
+      params.append("organization_id", options.organization_id.toString());
+    if (options?.engine) params.append("engine", options.engine);
+    if (options?.channel) params.append("channel", options.channel);
+    const qs = params.toString();
+    return this.fetch(`admin/voice-metrics${qs ? `?${qs}` : ""}`);
+  }
+  // Health Dashboard API
+  async getHealthMetrics(request) {
+    return this.fetch("admin/health/metrics", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  async getHealthDetail(workspaceUuid, request) {
+    return this.fetch(`admin/health/detail/${workspaceUuid}`, {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  // ===== Reseller Management =====
+  async getResellers(options) {
+    const params = new URLSearchParams();
+    if (options?.search) params.set("search", options.search);
+    if (options?.page) params.set("page", String(options.page));
+    if (options?.pageSize) params.set("page_size", String(options.pageSize));
+    const qs = params.toString();
+    return this.fetch(`admin/resellers${qs ? `?${qs}` : ""}`);
+  }
+  async getReseller(resellerId) {
+    return this.fetch(`admin/resellers/${resellerId}`);
+  }
+  async createReseller(data) {
+    return this.fetch("admin/resellers", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateReseller(resellerId, data) {
+    return this.fetch(`admin/resellers/${resellerId}`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async getResellerAccounts(resellerId) {
+    return this.fetch(`admin/resellers/${resellerId}/accounts`);
+  }
+  async linkResellerToAccount(resellerId, data) {
+    return this.fetch(`admin/resellers/${resellerId}/accounts`, {
+      method: "POST",
+      body: JSON.stringify({ account_id: data.accountId, role: data.role })
+    });
+  }
+  async unlinkResellerFromAccount(resellerId, accountId) {
+    await this.fetch(`admin/resellers/${resellerId}/accounts/${accountId}`, {
+      method: "DELETE"
+    });
+  }
+  // ===== Invoice Management =====
+  async generateInvoice(data) {
+    return this.fetch("admin/invoices/generate", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async getInvoices(subscriptionId, pageOpts) {
+    const params = new URLSearchParams();
+    if (subscriptionId !== void 0) params.set("subscription_id", String(subscriptionId));
+    if (pageOpts?.page !== void 0) params.set("page", String(pageOpts.page));
+    if (pageOpts?.pageSize !== void 0) params.set("pageSize", String(pageOpts.pageSize));
+    const qs = params.toString();
+    return this.fetch(`admin/invoices${qs ? `?${qs}` : ""}`);
+  }
+  async getBillingPeriods(subscriptionId) {
+    return this.fetch(
+      `admin/invoices/periods?subscription_id=${subscriptionId}`
+    );
+  }
+  async getInvoiceDownloadUrl(invoiceId) {
+    return this.fetch(
+      `admin/invoices/${invoiceId}/download`
+    );
+  }
+  async getReceiptDownloadUrl(invoiceId) {
+    return this.fetch(
+      `admin/invoices/${invoiceId}/receipt`
+    );
+  }
+  async recordInvoicePayment(invoiceId, data) {
+    return this.fetch(`admin/invoices/${invoiceId}/record-payment`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  // ===== Admin Temporal Inspection (PHI-safe, read-only) =====
+  /**
+   * Server-enforced bounds for admin Temporal queries (lookback, thresholds,
+   * page sizes, history event cap). Superuser only.
+   */
+  async getTemporalAdminConfig() {
+    return this.fetch("admin/temporal/config");
+  }
+  /**
+   * List recent Temporal workflows in FAILED, TIMED_OUT, or TERMINATED
+   * status. Returns only PHI-safe operational metadata. Superuser only.
+   *
+   * Pass `options.status` to filter to a single status and enable
+   * deep pagination via `nextPageToken`. Merged mode (no status) returns
+   * the first page only and always emits `nextPageToken: null`.
+   */
+  async listFailedTemporalWorkflows(options = {}) {
+    const params = new URLSearchParams();
+    if (options.lookbackHours !== void 0)
+      params.set("lookback_hours", String(options.lookbackHours));
+    if (options.pageSize !== void 0) params.set("page_size", String(options.pageSize));
+    if (options.status) params.set("status", String(options.status));
+    if (options.nextPageToken) params.set("next_page_token", options.nextPageToken);
+    appendTemporalWorkspaceParams(params, options);
+    const qs = params.toString();
+    return this.fetch(
+      `admin/temporal/workflows/failed${qs ? `?${qs}` : ""}`
+    );
+  }
+  /**
+   * List open Temporal workflows older than the stuck threshold.
+   * Superuser only.
+   */
+  async listStuckTemporalWorkflows(options = {}) {
+    const params = new URLSearchParams();
+    if (options.thresholdMinutes !== void 0)
+      params.set("threshold_minutes", String(options.thresholdMinutes));
+    if (options.pageSize !== void 0) params.set("page_size", String(options.pageSize));
+    if (options.nextPageToken) params.set("next_page_token", options.nextPageToken);
+    appendTemporalWorkspaceParams(params, options);
+    const qs = params.toString();
+    return this.fetch(
+      `admin/temporal/workflows/stuck${qs ? `?${qs}` : ""}`
+    );
+  }
+  /**
+   * Return grouped counts for recent Temporal executions. Superuser only.
+   */
+  async getTemporalSummary(options = {}) {
+    const params = new URLSearchParams();
+    if (options.lookbackHours !== void 0)
+      params.set("lookback_hours", String(options.lookbackHours));
+    appendTemporalWorkspaceParams(params, options);
+    const qs = params.toString();
+    return this.fetch(
+      `admin/temporal/workflows/summary${qs ? `?${qs}` : ""}`
+    );
+  }
+  /**
+   * Fetch metadata + bounded sanitized history summary for one Temporal
+   * workflow. Superuser only. Does not return raw events or payloads.
+   */
+  async getTemporalWorkflowDetail(workflowId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.runId) params.set("run_id", options.runId);
+    appendTemporalWorkspaceParams(params, options);
+    const qs = params.toString();
+    const encoded = encodeURIComponent(workflowId);
+    return this.fetch(
+      `admin/temporal/workflows/${encoded}${qs ? `?${qs}` : ""}`
+    );
+  }
+};
+function appendTemporalWorkspaceParams(params, options) {
+  const seen = /* @__PURE__ */ new Set();
+  const push = (raw) => {
+    if (!raw) return;
+    const trimmed = raw.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    params.append("workspace_uuid", trimmed);
+  };
+  if (options.workspaceUuids) {
+    for (const value of options.workspaceUuids) push(value);
+  }
+  push(options.workspaceUuid);
+}
+function bindAdminMethods(target, admin) {
+  target.listSupportRequestsAsAdmin = admin.listSupportRequestsAsAdmin.bind(admin);
+  target.getSupportRequestAsAdmin = admin.getSupportRequestAsAdmin.bind(admin);
+  target.commentOnSupportRequestAsAdmin = admin.commentOnSupportRequestAsAdmin.bind(admin);
+  target.noteOnSupportRequestAsAdmin = admin.noteOnSupportRequestAsAdmin.bind(admin);
+  target.updateSupportRequestStatusAsAdmin = admin.updateSupportRequestStatusAsAdmin.bind(admin);
+  target.updateSupportRequestAttributesAsAdmin = admin.updateSupportRequestAttributesAsAdmin.bind(admin);
+  target.createSupportRequestLinearIssueAsAdmin = admin.createSupportRequestLinearIssueAsAdmin.bind(admin);
+  target.getAccounts = admin.getAccounts.bind(admin);
+  target.getAccountDetails = admin.getAccountDetails.bind(admin);
+  target.getAccountByUuid = admin.getAccountByUuid.bind(admin);
+  target.getAccountMemberships = admin.getAccountMemberships.bind(admin);
+  target.getAccountOrgMemberships = admin.getAccountOrgMemberships.bind(admin);
+  target.createAccountOrgMembership = admin.createAccountOrgMembership.bind(admin);
+  target.deleteAccountOrgMembership = admin.deleteAccountOrgMembership.bind(admin);
+  target.getAccountMembership = admin.getAccountMembership.bind(admin);
+  target.updateAccountMembership = admin.updateAccountMembership.bind(admin);
+  target.createAccountMembership = admin.createAccountMembership.bind(admin);
+  target.deleteAccountMembership = admin.deleteAccountMembership.bind(admin);
+  target.updateAccountAsAdmin = admin.updateAccountAsAdmin.bind(admin);
+  target.createAccountAsAdmin = admin.createAccountAsAdmin.bind(admin);
+  target.deleteAccountAsAdmin = admin.deleteAccountAsAdmin.bind(admin);
+  target.lookupAccount = admin.lookupAccount.bind(admin);
+  target.exportAccountData = admin.exportAccountData.bind(admin);
+  target.requestAccountDeletion = admin.requestAccountDeletion.bind(admin);
+  target.cancelAccountDeletion = admin.cancelAccountDeletion.bind(admin);
+  target.getOrganizations = admin.getOrganizations.bind(admin);
+  target.getOrganization = admin.getOrganization.bind(admin);
+  target.getOrganizationAsAdmin = admin.getOrganizationAsAdmin.bind(admin);
+  target.getOrganizationMembersAsAdmin = admin.getOrganizationMembersAsAdmin.bind(admin);
+  target.createOrganization = admin.createOrganization.bind(admin);
+  target.updateOrganization = admin.updateOrganization.bind(admin);
+  target.deleteOrganization = admin.deleteOrganization.bind(admin);
+  target.joinOrganization = admin.joinOrganization.bind(admin);
+  target.leaveOrganization = admin.leaveOrganization.bind(admin);
+  target.generateLogoUploadUrl = admin.generateLogoUploadUrl.bind(admin);
+  target.importProducts = admin.importProducts.bind(admin);
+  target.createProductAsAdmin = admin.createProductAsAdmin.bind(admin);
+  target.getProductsAsAdmin = admin.getProductsAsAdmin.bind(admin);
+  target.getProductAsAdmin = admin.getProductAsAdmin.bind(admin);
+  target.updateProductAsAdmin = admin.updateProductAsAdmin.bind(admin);
+  target.deleteProductAsAdmin = admin.deleteProductAsAdmin.bind(admin);
+  target.getWorkspacesAsAdmin = admin.getWorkspacesAsAdmin.bind(admin);
+  target.getWorkspaceAsAdmin = admin.getWorkspaceAsAdmin.bind(admin);
+  target.getWorkspaceByNumericIdAsAdmin = admin.getWorkspaceByNumericIdAsAdmin.bind(admin);
+  target.createWorkspaceAsAdmin = admin.createWorkspaceAsAdmin.bind(admin);
+  target.updateWorkspaceAsAdmin = admin.updateWorkspaceAsAdmin.bind(admin);
+  target.deleteWorkspaceAsAdmin = admin.deleteWorkspaceAsAdmin.bind(admin);
+  target.createSchemaAsAdmin = admin.createSchemaAsAdmin.bind(admin);
+  target.migrateSchemaAsAdmin = admin.migrateSchemaAsAdmin.bind(admin);
+  target.provisionWorkspaceAsAdmin = admin.provisionWorkspaceAsAdmin.bind(admin);
+  target.refreshProvisionStatusAsAdmin = admin.refreshProvisionStatusAsAdmin.bind(admin);
+  target.enableMaintenanceMode = admin.enableMaintenanceMode.bind(admin);
+  target.disableMaintenanceMode = admin.disableMaintenanceMode.bind(admin);
+  target.getWorkspaceHealth = admin.getWorkspaceHealth.bind(admin);
+  target.provisionPlanFeatures = admin.provisionPlanFeatures.bind(admin);
+  target.changeWorkspaceProduct = admin.changeWorkspaceProduct.bind(admin);
+  target.validateWorkflowAccessAsAdmin = admin.validateWorkflowAccessAsAdmin.bind(admin);
+  target.mergeMembers = admin.mergeMembers.bind(admin);
+  target.getAdminWorkspaceMember = admin.getAdminWorkspaceMember.bind(admin);
+  target.createAdminWorkspaceMember = admin.createAdminWorkspaceMember.bind(admin);
+  target.updateAdminWorkspaceMember = admin.updateAdminWorkspaceMember.bind(admin);
+  target.unarchiveAdminWorkspaceMember = admin.unarchiveAdminWorkspaceMember.bind(admin);
+  target.getAdminWorkspaceMemberRoles = admin.getAdminWorkspaceMemberRoles.bind(admin);
+  target.getMissingMemberships = admin.getMissingMemberships.bind(admin);
+  target.linkMissingMembership = admin.linkMissingMembership.bind(admin);
+  target.getUnmappedPhoneNumbers = admin.getUnmappedPhoneNumbers.bind(admin);
+  target.getWorkspaceUnmappedPhoneNumbers = admin.getWorkspaceUnmappedPhoneNumbers.bind(admin);
+  target.getWorkspacePhoneNumbersAsAdmin = admin.getWorkspacePhoneNumbersAsAdmin.bind(admin);
+  target.getProviderPhoneNumbers = admin.getProviderPhoneNumbers.bind(admin);
+  target.getProviderPhoneNumber = admin.getProviderPhoneNumber.bind(admin);
+  target.updateProviderPhoneNumber = admin.updateProviderPhoneNumber.bind(admin);
+  target.mapMainAccountPhone = admin.mapMainAccountPhone.bind(admin);
+  target.unmapPhoneNumber = admin.unmapPhoneNumber.bind(admin);
+  target.searchAvailablePhoneNumbersAsAdmin = admin.searchAvailablePhoneNumbersAsAdmin.bind(admin);
+  target.purchasePhoneNumberAsAdmin = admin.purchasePhoneNumberAsAdmin.bind(admin);
+  target.startBulkPhoneClassification = admin.startBulkPhoneClassification.bind(admin);
+  target.getOrgA2PStatusAsAdmin = admin.getOrgA2PStatusAsAdmin.bind(admin);
+  target.resetOrgA2PStatusAsAdmin = admin.resetOrgA2PStatusAsAdmin.bind(admin);
+  target.getSiteMappings = admin.getSiteMappings.bind(admin);
+  target.getSiteMapping = admin.getSiteMapping.bind(admin);
+  target.updateSiteMapping = admin.updateSiteMapping.bind(admin);
+  target.updateSiteMappingWorkspace = admin.updateSiteMappingWorkspace.bind(admin);
+  target.adminDeleteSiteMapping = admin.adminDeleteSiteMapping.bind(admin);
+  target.createSiteMapping = admin.createSiteMapping.bind(admin);
+  target.createOrUpdateSiteMapping = admin.createOrUpdateSiteMapping.bind(admin);
+  target.deleteSiteMapping = admin.deleteSiteMapping.bind(admin);
+  target.getInboxMappings = admin.getInboxMappings.bind(admin);
+  target.getInboxMapping = admin.getInboxMapping.bind(admin);
+  target.updateInboxMapping = admin.updateInboxMapping.bind(admin);
+  target.deleteAdminInboxMapping = admin.deleteAdminInboxMapping.bind(admin);
+  target.generateChatSummaries = admin.generateChatSummaries.bind(admin);
+  target.executeQuery = admin.executeQuery.bind(admin);
+  target.getTraceUrl = admin.getTraceUrl.bind(admin);
+  target.listAllThemes = admin.listAllThemes.bind(admin);
+  target.startBulkTOSAcceptance = admin.startBulkTOSAcceptance.bind(admin);
+  target.startTokenUsageBackfill = admin.startTokenUsageBackfill.bind(admin);
+  target.updateChatMessage = admin.updateChatMessage.bind(admin);
+  target.createCustomerFromAccount = admin.createCustomerFromAccount.bind(admin);
+  target.getCustomers = admin.getCustomers.bind(admin);
+  target.getCustomer = admin.getCustomer.bind(admin);
+  target.createCustomer = admin.createCustomer.bind(admin);
+  target.updateCustomer = admin.updateCustomer.bind(admin);
+  target.getCustomerAccounts = admin.getCustomerAccounts.bind(admin);
+  target.linkCustomerToAccount = admin.linkCustomerToAccount.bind(admin);
+  target.unlinkCustomerFromAccount = admin.unlinkCustomerFromAccount.bind(admin);
+  target.syncCustomerToStripe = admin.syncCustomerToStripe.bind(admin);
+  target.getStripeCustomer = admin.getStripeCustomer.bind(admin);
+  target.createStripeCustomer = admin.createStripeCustomer.bind(admin);
+  target.updateStripeCustomer = admin.updateStripeCustomer.bind(admin);
+  target.getStripeSubscriptions = admin.getStripeSubscriptions.bind(admin);
+  target.createStripeSubscription = admin.createStripeSubscription.bind(admin);
+  target.createDirectSubscription = admin.createDirectSubscription.bind(admin);
+  target.updateStripeSubscription = admin.updateStripeSubscription.bind(admin);
+  target.cancelStripeSubscription = admin.cancelStripeSubscription.bind(admin);
+  target.provisionWorkspaceForSubscription = admin.provisionWorkspaceForSubscription.bind(admin);
+  target.associateWorkspaceWithSubscription = admin.associateWorkspaceWithSubscription.bind(admin);
+  target.createSubscriptionPaymentLink = admin.createSubscriptionPaymentLink.bind(admin);
+  target.createSetupIntent = admin.createSetupIntent.bind(admin);
+  target.getStripePaymentMethods = admin.getStripePaymentMethods.bind(admin);
+  target.attachStripePaymentMethod = admin.attachStripePaymentMethod.bind(admin);
+  target.detachStripePaymentMethod = admin.detachStripePaymentMethod.bind(admin);
+  target.setDefaultStripePaymentMethod = admin.setDefaultStripePaymentMethod.bind(admin);
+  target.convertSubscriptionToStripe = admin.convertSubscriptionToStripe.bind(admin);
+  target.createCustomerSetupIntent = admin.createCustomerSetupIntent.bind(admin);
+  target.getCustomerPaymentMethods = admin.getCustomerPaymentMethods.bind(admin);
+  target.attachCustomerPaymentMethod = admin.attachCustomerPaymentMethod.bind(admin);
+  target.detachCustomerPaymentMethod = admin.detachCustomerPaymentMethod.bind(admin);
+  target.setDefaultCustomerPaymentMethod = admin.setDefaultCustomerPaymentMethod.bind(admin);
+  target.previewWorkspaceOrganizationChange = admin.previewWorkspaceOrganizationChange.bind(admin);
+  target.changeWorkspaceOrganization = admin.changeWorkspaceOrganization.bind(admin);
+  target.createStripeInvoice = admin.createStripeInvoice.bind(admin);
+  target.getStripeInvoices = admin.getStripeInvoices.bind(admin);
+  target.getStripeUpcomingInvoice = admin.getStripeUpcomingInvoice.bind(admin);
+  target.getBillingPeriods = admin.getBillingPeriods.bind(admin);
+  target.generateInvoice = admin.generateInvoice.bind(admin);
+  target.getInvoices = admin.getInvoices.bind(admin);
+  target.getInvoiceDownloadUrl = admin.getInvoiceDownloadUrl.bind(admin);
+  target.getReceiptDownloadUrl = admin.getReceiptDownloadUrl.bind(admin);
+  target.recordInvoicePayment = admin.recordInvoicePayment.bind(admin);
+  target.getWorkspaceUsageDashboard = admin.getWorkspaceUsageDashboard.bind(admin);
+  target.compareProductsWithStripe = admin.compareProductsWithStripe.bind(admin);
+  target.syncProductToStripe = admin.syncProductToStripe.bind(admin);
+  target.searchStripeProducts = admin.searchStripeProducts.bind(admin);
+  target.getUsageReport = admin.getUsageReport.bind(admin);
+  target.getSubscriptionsAsAdmin = admin.getSubscriptionsAsAdmin.bind(admin);
+  target.getSubscriptionAsAdmin = admin.getSubscriptionAsAdmin.bind(admin);
+  target.updateSubscriptionStatusAsAdmin = admin.updateSubscriptionStatusAsAdmin.bind(admin);
+  target.updateSubscriptionCreditSettingsAsAdmin = admin.updateSubscriptionCreditSettingsAsAdmin.bind(admin);
+  target.grantCreditsAsAdmin = admin.grantCreditsAsAdmin.bind(admin);
+  target.listCreditGrantsAsAdmin = admin.listCreditGrantsAsAdmin.bind(admin);
+  target.getVoiceMetrics = admin.getVoiceMetrics.bind(admin);
+  target.getHealthMetrics = admin.getHealthMetrics.bind(admin);
+  target.getHealthDetail = admin.getHealthDetail.bind(admin);
+  target.getWorkspaceInboxesAsAdmin = admin.getWorkspaceInboxesAsAdmin.bind(admin);
+  target.listWorkspaceChats = admin.listWorkspaceChats.bind(admin);
+  target.getWorkspaceChat = admin.getWorkspaceChat.bind(admin);
+  target.rateWorkspaceChatMessage = admin.rateWorkspaceChatMessage.bind(admin);
+  target.getTemporalAdminConfig = admin.getTemporalAdminConfig.bind(admin);
+  target.listFailedTemporalWorkflows = admin.listFailedTemporalWorkflows.bind(admin);
+  target.listStuckTemporalWorkflows = admin.listStuckTemporalWorkflows.bind(admin);
+  target.getTemporalSummary = admin.getTemporalSummary.bind(admin);
+  target.getTemporalWorkflowDetail = admin.getTemporalWorkflowDetail.bind(admin);
+  target.getResellers = admin.getResellers.bind(admin);
+  target.getReseller = admin.getReseller.bind(admin);
+  target.createReseller = admin.createReseller.bind(admin);
+  target.updateReseller = admin.updateReseller.bind(admin);
+  target.getResellerAccounts = admin.getResellerAccounts.bind(admin);
+  target.linkResellerToAccount = admin.linkResellerToAccount.bind(admin);
+  target.unlinkResellerFromAccount = admin.unlinkResellerFromAccount.bind(admin);
+}
+var ApiClient = class extends GravityRailClient {
+  // Admin API
+  listSupportRequestsAsAdmin;
+  getSupportRequestAsAdmin;
+  commentOnSupportRequestAsAdmin;
+  noteOnSupportRequestAsAdmin;
+  updateSupportRequestStatusAsAdmin;
+  updateSupportRequestAttributesAsAdmin;
+  createSupportRequestLinearIssueAsAdmin;
+  getAccounts;
+  getAccountDetails;
+  getAccountByUuid;
+  getAccountMemberships;
+  getAccountOrgMemberships;
+  createAccountOrgMembership;
+  deleteAccountOrgMembership;
+  getAccountMembership;
+  updateAccountMembership;
+  createAccountMembership;
+  deleteAccountMembership;
+  updateAccountAsAdmin;
+  createAccountAsAdmin;
+  deleteAccountAsAdmin;
+  lookupAccount;
+  exportAccountData;
+  requestAccountDeletion;
+  cancelAccountDeletion;
+  getOrganizations;
+  getOrganization;
+  getOrganizationAsAdmin;
+  getOrganizationMembersAsAdmin;
+  createOrganization;
+  updateOrganization;
+  deleteOrganization;
+  joinOrganization;
+  leaveOrganization;
+  generateLogoUploadUrl;
+  importProducts;
+  createProductAsAdmin;
+  getProductsAsAdmin;
+  getProductAsAdmin;
+  updateProductAsAdmin;
+  deleteProductAsAdmin;
+  getWorkspacesAsAdmin;
+  getWorkspaceAsAdmin;
+  getWorkspaceByNumericIdAsAdmin;
+  createWorkspaceAsAdmin;
+  updateWorkspaceAsAdmin;
+  deleteWorkspaceAsAdmin;
+  createSchemaAsAdmin;
+  migrateSchemaAsAdmin;
+  provisionWorkspaceAsAdmin;
+  refreshProvisionStatusAsAdmin;
+  enableMaintenanceMode;
+  disableMaintenanceMode;
+  getWorkspaceHealth;
+  provisionPlanFeatures;
+  changeWorkspaceProduct;
+  validateWorkflowAccessAsAdmin;
+  mergeMembers;
+  getAdminWorkspaceMember;
+  createAdminWorkspaceMember;
+  updateAdminWorkspaceMember;
+  unarchiveAdminWorkspaceMember;
+  getAdminWorkspaceMemberRoles;
+  getMissingMemberships;
+  linkMissingMembership;
+  getUnmappedPhoneNumbers;
+  getWorkspaceUnmappedPhoneNumbers;
+  getWorkspacePhoneNumbersAsAdmin;
+  getProviderPhoneNumbers;
+  getProviderPhoneNumber;
+  updateProviderPhoneNumber;
+  mapMainAccountPhone;
+  unmapPhoneNumber;
+  searchAvailablePhoneNumbersAsAdmin;
+  purchasePhoneNumberAsAdmin;
+  startBulkPhoneClassification;
+  getOrgA2PStatusAsAdmin;
+  resetOrgA2PStatusAsAdmin;
+  getSiteMappings;
+  getSiteMapping;
+  updateSiteMapping;
+  updateSiteMappingWorkspace;
+  adminDeleteSiteMapping;
+  createSiteMapping;
+  createOrUpdateSiteMapping;
+  deleteSiteMapping;
+  getInboxMappings;
+  getInboxMapping;
+  updateInboxMapping;
+  deleteAdminInboxMapping;
+  generateChatSummaries;
+  executeQuery;
+  getTraceUrl;
+  listAllThemes;
+  startBulkTOSAcceptance;
+  startTokenUsageBackfill;
+  updateChatMessage;
+  createCustomerFromAccount;
+  getCustomers;
+  getCustomer;
+  createCustomer;
+  updateCustomer;
+  getCustomerAccounts;
+  linkCustomerToAccount;
+  unlinkCustomerFromAccount;
+  syncCustomerToStripe;
+  getStripeCustomer;
+  createStripeCustomer;
+  updateStripeCustomer;
+  getStripeSubscriptions;
+  createStripeSubscription;
+  createDirectSubscription;
+  updateStripeSubscription;
+  cancelStripeSubscription;
+  provisionWorkspaceForSubscription;
+  associateWorkspaceWithSubscription;
+  createSubscriptionPaymentLink;
+  createSetupIntent;
+  getStripePaymentMethods;
+  attachStripePaymentMethod;
+  detachStripePaymentMethod;
+  setDefaultStripePaymentMethod;
+  createCustomerSetupIntent;
+  getCustomerPaymentMethods;
+  attachCustomerPaymentMethod;
+  detachCustomerPaymentMethod;
+  setDefaultCustomerPaymentMethod;
+  convertSubscriptionToStripe;
+  previewWorkspaceOrganizationChange;
+  changeWorkspaceOrganization;
+  createStripeInvoice;
+  getStripeInvoices;
+  getStripeUpcomingInvoice;
+  getWorkspaceUsageDashboard;
+  compareProductsWithStripe;
+  syncProductToStripe;
+  searchStripeProducts;
+  getUsageReport;
+  getSubscriptionsAsAdmin;
+  getSubscriptionAsAdmin;
+  updateSubscriptionStatusAsAdmin;
+  updateSubscriptionCreditSettingsAsAdmin;
+  grantCreditsAsAdmin;
+  listCreditGrantsAsAdmin;
+  getVoiceMetrics;
+  getHealthMetrics;
+  getHealthDetail;
+  getWorkspaceInboxesAsAdmin;
+  listWorkspaceChats;
+  getWorkspaceChat;
+  rateWorkspaceChatMessage;
+  getTemporalAdminConfig;
+  listFailedTemporalWorkflows;
+  listStuckTemporalWorkflows;
+  getTemporalSummary;
+  getTemporalWorkflowDetail;
+  getResellers;
+  getReseller;
+  createReseller;
+  updateReseller;
+  getResellerAccounts;
+  linkResellerToAccount;
+  unlinkResellerFromAccount;
+  getBillingPeriods;
+  generateInvoice;
+  getInvoices;
+  getInvoiceDownloadUrl;
+  getReceiptDownloadUrl;
+  recordInvoicePayment;
+  adminApi;
+  constructor(apiKey, baseUrl3, customFetch) {
+    super(apiKey, baseUrl3, customFetch);
+    this.adminApi = new AdminApi(apiKey, baseUrl3, customFetch);
+    bindAdminMethods(this, this.adminApi);
+  }
+  /**
+   * Propagates acting member switches to the admin API module as well.
+   */
+  setActingMember(memberUuid) {
+    super.setActingMember(memberUuid);
+    if (typeof this.adminApi.setActingMember === "function") {
+      this.adminApi.setActingMember(memberUuid);
+    }
+  }
+  // setOrgToken is intentionally NOT overridden here. Admin routes
+  // (/api/v2/admin/*) are protected by the bearer token's superuser claim and
+  // ignore X-Org-Token entirely, so propagating an org token to adminApi is
+  // dead code that would only obscure auth flow if admin route logic changes.
+};
+
+// src/lib/context.ts
 import { homedir } from "os";
 
 // src/lib/output.ts
@@ -434,11 +2013,135 @@ function loadRealmCredentials(realm, devRealmsPath) {
     if (!member?.token) {
       throw new Error(`Realm member "${memberName}" not found in workspace "${wsName}"`);
     }
-    return { token: member.token, workspaceUuid: ws.workspaceUuid };
-  }
+    return { token: member.token, workspaceUuid: ws.workspaceUuid };
+  }
+}
+
+// src/lib/org-auth.ts
+import { execFile } from "child_process";
+var ORG_AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
+function extractOrgTokenFromSetCookies(setCookieValues, preferredCookieName) {
+  let fallback;
+  for (const value of setCookieValues) {
+    const nameValue = value.split(";")[0]?.trim() ?? "";
+    const eqIdx = nameValue.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = nameValue.slice(0, eqIdx).trim();
+    const tokenValue = nameValue.slice(eqIdx + 1).trim() || void 0;
+    if (!tokenValue) continue;
+    if (name === preferredCookieName) return tokenValue;
+    if (!fallback && (name.startsWith("orgToken") || name.startsWith("orgSession"))) {
+      fallback = tokenValue;
+    }
+  }
+  return fallback;
+}
+async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
+  const response = await fetch(`${apiUrl}/api/v2/o/${orgAuthInfo.orgUuid}/join`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: "{}"
+  });
+  if (response.status === 400) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`Org join failed (HTTP ${response.status})`);
+  }
+  const rawHeaders = response.headers;
+  const setCookies = rawHeaders.getSetCookie?.() ?? (rawHeaders.get("set-cookie") ? [rawHeaders.get("set-cookie")] : []);
+  if (setCookies.length === 0) {
+    throw new Error("Org join succeeded but no Set-Cookie header returned");
+  }
+  const orgToken = extractOrgTokenFromSetCookies(setCookies, orgAuthInfo.cookieName);
+  if (!orgToken) {
+    throw new Error("Org join succeeded but org token cookie not found in Set-Cookie");
+  }
+  return orgToken;
+}
+function isAllowedAuthUrl(url, apiUrl) {
+  try {
+    const parsed = new URL(url);
+    const api = new URL(apiUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return false;
+    if (parsed.hostname === api.hostname) return true;
+    const lastTwo = (host) => {
+      const parts = host.split(".").filter(Boolean);
+      return parts.length >= 2 ? parts.slice(-2).join(".") : host;
+    };
+    const isIp = /^[0-9.]+$|^\[.*\]$/.test(parsed.hostname);
+    if (isIp) return false;
+    return lastTwo(parsed.hostname) === lastTwo(api.hostname);
+  } catch {
+    return false;
+  }
+}
+function openBrowser(url) {
+  let command;
+  let args;
+  if (process.platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    command = "cmd.exe";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  execFile(command, args, (_err) => {
+  });
+}
+function registerOrgAuthHandler(apiClient, apiUrl, accessToken) {
+  apiClient.setOrgAuthHandler(async (orgAuthInfo) => {
+    try {
+      const orgToken = await tryDirectJoin(apiUrl, accessToken, orgAuthInfo);
+      if (orgToken !== null) {
+        apiClient.setOrgToken(orgToken, orgAuthInfo.orgUuid);
+        return;
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      stderr(`Warning: org direct-join failed (${msg}); trying browser auth`);
+    }
+    if (!isAllowedAuthUrl(orgAuthInfo.authUrl, apiUrl)) {
+      throw new Error(
+        `Refusing to open organization auth URL: scheme/host does not match the configured API host. Re-run with the expected --api-url, or contact support.`
+      );
+    }
+    stderr(`
+This workspace requires organization SSO authentication.`);
+    stderr(`Opening browser to complete authentication...`);
+    stderr(`  ${orgAuthInfo.authUrl}
+`);
+    stderr(`If the browser does not open, visit the URL above manually.`);
+    stderr(
+      `After signing in, re-run the command \u2014 the CLI cannot receive the SSO token directly.`
+    );
+    openBrowser(orgAuthInfo.authUrl);
+    await new Promise((_, reject) => {
+      const t = setTimeout(
+        () => reject(
+          new Error(
+            "Organization authentication timed out.\nPlease complete authentication in the browser, then re-run the command."
+          )
+        ),
+        ORG_AUTH_TIMEOUT_MS
+      );
+      t.unref?.();
+    });
+  });
 }
 
 // src/lib/context.ts
+function makeApiClient(accessToken, apiUrl) {
+  const apiClient = new ApiClient(accessToken, apiUrl);
+  registerOrgAuthHandler(apiClient, apiUrl, accessToken);
+  return apiClient;
+}
 async function tryTokenRefresh(ctx, creds) {
   if (!creds.refreshToken) return null;
   const refreshed = await refreshAccessToken(
@@ -448,7 +2151,7 @@ async function tryTokenRefresh(ctx, creds) {
     ctx.env
   );
   if (!refreshed?.accessToken) return null;
-  const apiClient = new GravityRailClient(refreshed.accessToken, ctx.envConfig.apiUrl);
+  const apiClient = makeApiClient(refreshed.accessToken, ctx.envConfig.apiUrl);
   return { ...ctx, accessToken: refreshed.accessToken, apiClient };
 }
 function createContext(opts) {
@@ -472,12 +2175,12 @@ async function createAuthenticatedContext(opts) {
       devRealmsPath = loadDevCloudRealmFile(namespace);
     }
     const { token, workspaceUuid } = loadRealmCredentials(opts.realm, devRealmsPath);
-    const apiClient = new GravityRailClient(token, ctx.envConfig.apiUrl);
+    const apiClient = makeApiClient(token, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: token, apiClient, realmWorkspace: workspaceUuid };
   }
   const apiKey = process.env.GRAVITY_RAIL_API_KEY;
   if (apiKey) {
-    const apiClient = new GravityRailClient(apiKey, ctx.envConfig.apiUrl);
+    const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: apiKey, apiClient };
   }
   const creds = ctx.credentialsManager.load(ctx.env);
@@ -485,7 +2188,7 @@ async function createAuthenticatedContext(opts) {
     const buffer = 5 * 60 * 1e3;
     const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
     if (notExpired) {
-      const apiClient = new GravityRailClient(creds.accessToken, ctx.envConfig.apiUrl);
+      const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
       return { ...ctx, accessToken: creds.accessToken, apiClient };
     }
     const refreshed = await tryTokenRefresh(ctx, creds);
@@ -517,7 +2220,7 @@ async function createPublicAuthenticatedContext(opts) {
   const ctx = createPublicContext(opts);
   const apiKey = process.env.GRAVITY_RAIL_API_KEY;
   if (apiKey) {
-    const apiClient = new GravityRailClient(apiKey, ctx.envConfig.apiUrl);
+    const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: apiKey, apiClient };
   }
   const creds = ctx.credentialsManager.load(ctx.env);
@@ -525,7 +2228,7 @@ async function createPublicAuthenticatedContext(opts) {
     const buffer = 5 * 60 * 1e3;
     const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
     if (notExpired) {
-      const apiClient = new GravityRailClient(creds.accessToken, ctx.envConfig.apiUrl);
+      const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
       return { ...ctx, accessToken: creds.accessToken, apiClient };
     }
     const refreshed = await tryTokenRefresh(ctx, creds);
@@ -1358,6 +3061,10 @@ var MESSAGE_COLUMNS2 = [
     getValue: (item) => String(item.content ?? "").slice(0, 80),
     maxWidth: 80
   },
+  {
+    header: "TOOL_CALLS",
+    getValue: (item) => Array.isArray(item.tool_calls) && item.tool_calls.length > 0 ? item.tool_calls.map((t) => t.function?.name ?? "?").join(",") : ""
+  },
   COL.created()
 ];
 var chatsDomain = {
@@ -1391,13 +3098,35 @@ var chatsDomain = {
     // Messages
     {
       path: ["chats", "messages", "list"],
-      description: "List messages for a chat",
+      description: "List messages for a chat. Use --limit/--offset to page; the API caps a single request at 100. Tool-call shell rows that the API filter excludes (parent_message_id IS NOT NULL or parent_call_id IS NOT NULL) are still hidden \u2014 use `gr chats inspect --id <chat>` for the full debug view.",
       requiresWorkspace: true,
-      args: [{ name: "chat-id", description: "Chat ID", required: true }],
+      args: [
+        { name: "chat-id", description: "Chat ID", required: true },
+        {
+          name: "limit",
+          description: "Max messages to return (1-100, default 100)"
+        },
+        {
+          name: "offset",
+          description: "Offset for pagination (default 0)"
+        }
+      ],
       handler: async ({ ctx, workspace, args }) => {
+        const rawLimit = args.limit;
+        const rawOffset = args.offset;
+        const limit = rawLimit === void 0 || rawLimit === null || rawLimit === "" ? 100 : Number(rawLimit);
+        const offset = rawOffset === void 0 || rawOffset === null || rawOffset === "" ? 0 : Number(rawOffset);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+          throw new Error("--limit must be an integer between 1 and 100");
+        }
+        if (!Number.isInteger(offset) || offset < 0) {
+          throw new Error("--offset must be a non-negative integer");
+        }
         const result = await requireAuth(ctx).apiClient.getChatMessages(
           workspace,
-          requireNumber(args, "chat-id")
+          requireNumber(args, "chat-id"),
+          limit,
+          offset
         );
         outputData(result, ctx, MESSAGE_COLUMNS2);
       }
@@ -3495,8 +5224,8 @@ var dataTypesDomain = {
 var RULE_COLUMNS = [
   COL.id(),
   COL.name(),
-  { header: "EVENT", getValue: (item) => item.event_type ?? "" },
-  COL.enabled()
+  { header: "EVENT", getValue: (item) => item.eventType ?? "" },
+  { header: "ACTIVE", getValue: (item) => String(item.active ?? "") }
 ];
 var EVENT_COLUMNS2 = [
   COL.id(),
@@ -3504,10 +5233,9 @@ var EVENT_COLUMNS2 = [
   { header: "SLUG", getValue: (item) => item.slug ?? "" },
   COL.status()
 ];
-var eventRulesCrud = crudCommands({
+var eventRulesCrudNoList = crudCommands({
   prefix: ["events", "rules"],
   entityName: "event rule",
-  listMethod: "getEventRules",
   getMethod: "getEventRule",
   createMethod: "createEventRule",
   updateMethod: "updateEventRule",
@@ -3530,6 +5258,57 @@ var eventRulesCrud = crudCommands({
     'member:label actionParams: {"addLabelIds":["uuid"],"removeLabelIds":["uuid"]}'
   ]
 });
+var eventRulesListCmd = {
+  path: ["events", "rules", "list"],
+  description: "List event rules (use --journey-step-id or --event-type to filter)",
+  requiresWorkspace: true,
+  columns: RULE_COLUMNS,
+  args: [
+    { name: "journey-step-id", description: "Filter by journey step ID" },
+    { name: "event-type", description: "Filter by event type (e.g. journey_step:execute)" },
+    { name: "object-type", description: "Filter by object type (e.g. journey, task)" },
+    { name: "include-disabled", description: "Include inactive rules", isFlag: true },
+    { name: "page", description: "Page number (without filters)" },
+    { name: "page-size", description: "Page size (without filters)" },
+    {
+      name: "all",
+      description: "Fetch all pages (without filters)",
+      isFlag: true
+    }
+  ],
+  handler: async ({ ctx, workspace, args }) => {
+    const client = requireAuth(ctx).apiClient;
+    const journeyStepId = args["journey-step-id"] ? requireNumber(args, "journey-step-id") : void 0;
+    const eventType = args["event-type"];
+    const objectType = args["object-type"];
+    const includeDisabled = args["include-disabled"] === true;
+    if (journeyStepId !== void 0 || eventType !== void 0 || objectType !== void 0 || includeDisabled) {
+      const result2 = await client.searchEventRules(workspace, {
+        ...journeyStepId !== void 0 ? { journeyStepId } : {},
+        ...eventType ? { eventType } : {},
+        ...objectType ? { objectType } : {},
+        ...includeDisabled ? { includeDisabled: true } : {}
+      });
+      outputData(listResult(result2, false), ctx, RULE_COLUMNS);
+      return;
+    }
+    if (args["all"]) {
+      const allItems = await fetchAllPages(
+        async ({ page: page2, pageSize: pageSize2 }) => client.getEventRules(workspace, { page: page2, pageSize: pageSize2 })
+      );
+      outputData(allItems, ctx, RULE_COLUMNS);
+      return;
+    }
+    const page = args["page"] ? requireNumber(args, "page") : void 0;
+    const pageSize = args["page-size"] ? requireNumber(args, "page-size") : void 0;
+    const result = await client.getEventRules(workspace, {
+      ...page !== void 0 ? { page } : {},
+      ...pageSize !== void 0 ? { pageSize } : {}
+    });
+    outputData(listResult(result, true), ctx, RULE_COLUMNS);
+  }
+};
+var eventRulesCrud = [eventRulesListCmd, ...eventRulesCrudNoList];
 var eventRulesAliases = eventRulesCrud.filter((cmd) => {
   const verb = cmd.path[cmd.path.length - 1];
   return verb === "list" || verb === "get";
@@ -3559,6 +5338,48 @@ var eventsDomain = {
         outputData(result, ctx);
       }
     },
+    {
+      // The /event-rules/search endpoint returns an unpaginated list — the
+      // server applies the filters and returns whatever matches. No --all
+      // flag is needed; if the result becomes too large in practice,
+      // tighten the filter rather than paginate.
+      path: ["events", "rules", "search"],
+      description: "Search event rules by object/event/action type or related entity ID",
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "object-type",
+          description: "Filter by object type (task, routine, journey, workflow, calendar, ...)"
+        },
+        { name: "event-type", description: "Filter by event type" },
+        { name: "action-type", description: "Filter by action type" },
+        { name: "task-id", description: "Filter by task ID" },
+        { name: "data-type-id", description: "Filter by data type ID" },
+        { name: "routine-id", description: "Filter by routine ID" },
+        { name: "workflow-id", description: "Filter by workflow ID" },
+        { name: "journey-step-id", description: "Filter by journey step ID" },
+        {
+          name: "include-disabled",
+          description: "Include inactive rules (default: active only)"
+        }
+      ],
+      columns: RULE_COLUMNS,
+      handler: async ({ ctx, workspace, args }) => {
+        const opts = {};
+        if (args["object-type"]) opts.objectType = args["object-type"];
+        if (args["event-type"]) opts.eventType = args["event-type"];
+        if (args["action-type"]) opts.actionType = args["action-type"];
+        if (args["task-id"]) opts.taskId = requireNumber(args, "task-id");
+        if (args["data-type-id"]) opts.dataTypeId = requireNumber(args, "data-type-id");
+        if (args["routine-id"]) opts.routineId = requireNumber(args, "routine-id");
+        if (args["workflow-id"]) opts.workflowId = requireNumber(args, "workflow-id");
+        if (args["journey-step-id"])
+          opts.journeyStepId = requireNumber(args, "journey-step-id");
+        if (args["include-disabled"]) opts.includeDisabled = true;
+        const result = await requireAuth(ctx).apiClient.searchEventRules(workspace, opts);
+        outputData(result, ctx, RULE_COLUMNS);
+      }
+    },
     // Routines
     ...crudCommands({
       prefix: ["routines"],
@@ -3697,6 +5518,7 @@ var filesDomain = {
 };
 
 // src/domains/journeys.ts
+import { EventRuleEventType } from "@gravity-rail/sdk";
 var JOURNEY_COLUMNS = [
   COL.id(),
   { header: "UUID", getValue: (item) => (item.uuid ?? "").slice(0, 8) },
@@ -3760,6 +5582,15 @@ var NOTE_COLUMNS2 = [
   { header: "CONTENT", getValue: (item) => (item.contents ?? "").slice(0, 60) },
   { header: "CREATED", getValue: (item) => item.createdAt ?? "" }
 ];
+var ACTION_COLUMNS = [
+  COL.id(),
+  { header: "UUID", getValue: (item) => (item.uuid ?? "").slice(0, 8) },
+  COL.name(),
+  { header: "EVENT", getValue: (item) => item.eventType ?? "" },
+  { header: "ACTION", getValue: (item) => item.actionType ?? "" },
+  { header: "ACTIVE", getValue: (item) => String(item.active ?? "") },
+  { header: "CONDITIONS", getValue: (item) => (item.conditions ?? "").slice(0, 40) }
+];
 function baseUrl(ctx, wid) {
   return `${ctx.envConfig.apiUrl}/api/v2/w/${wid}/journeys`;
 }
@@ -4474,6 +6305,70 @@ var journeysDomain = {
         process.stdout.write(`Deleted note ${noteId}
 `);
       }
+    },
+    // ── Step execute actions (event rules scoped to a step) ────────
+    {
+      path: ["journeys", "steps", "actions", "list"],
+      description: "List event rules (actions) attached to a journey step",
+      requiresWorkspace: true,
+      args: [
+        { name: "step-id", description: "Journey step ID (numeric)", required: true },
+        {
+          name: "include-disabled",
+          description: "Include inactive/disabled rules",
+          isFlag: true
+        }
+      ],
+      examples: [
+        "gr journeys steps actions list -w $WID --step-id <step-id>",
+        "gr journeys steps actions list -w $WID --step-id <step-id> --include-disabled"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const stepId = requireNumber(args, "step-id");
+        const includeDisabled = args["include-disabled"] === true;
+        const result = await requireAuth(ctx).apiClient.searchEventRules(workspace, {
+          eventType: EventRuleEventType.JOURNEY_STEP_EXECUTE,
+          journeyStepId: stepId,
+          ...includeDisabled ? { includeDisabled: true } : {}
+        });
+        outputData(listResult(result, false), ctx, ACTION_COLUMNS);
+      }
+    },
+    {
+      path: ["journeys", "steps", "actions", "get"],
+      description: "Get a journey step action (event rule) by ID",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Event rule ID", required: true }],
+      examples: ["gr journeys steps actions get -w $WID --id <rule-id>"],
+      handler: async ({ ctx, workspace, args }) => {
+        const id = requireNumber(args, "id");
+        const result = await requireAuth(ctx).apiClient.getEventRule(workspace, id);
+        outputSingle(result, ctx, ACTION_COLUMNS);
+      }
+    },
+    {
+      path: ["journeys", "steps", "actions", "update"],
+      description: "Update a journey step action \u2014 modify template, conditions, or active state",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Event rule ID", required: true }],
+      examples: [
+        "gr journeys steps actions update -w $WID --id <rule-id> \\",
+        `  --data '{"actionParams":{"messageTemplate":"Hello {{member.name}}"}}' --allow-write`,
+        "",
+        "Updatable fields: name, conditions (CEL), actionParams, active, delay, order",
+        "Non-updatable: objectType, eventType, actionType, journeyStepId"
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const id = requireNumber(args, "id");
+        const result = await requireAuth(ctx).apiClient.updateEventRule(
+          workspace,
+          id,
+          data
+        );
+        outputSingle(result, ctx, ACTION_COLUMNS);
+      }
     }
   ]
 };
@@ -5099,6 +6994,13 @@ var COLUMNS16 = [
   { header: "PREFIX", getValue: (item) => item.prefix ?? "" },
   COL.created()
 ];
+var CREATE_COLUMNS = [
+  COL.id(),
+  COL.name(),
+  { header: "KEY", getValue: (item) => item.key ?? "" },
+  { header: "PREFIX", getValue: (item) => item.prefix ?? "" },
+  COL.created()
+];
 var apiKeysDomain = {
   name: "api-keys",
   description: "Manage API keys",
@@ -5119,7 +7021,10 @@ var apiKeysDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace, data }) => {
         const result = await requireAuth(ctx).apiClient.createApiKey(workspace, data);
-        outputSingle(result, ctx, COLUMNS16);
+        outputSingle(result, ctx, CREATE_COLUMNS);
+        if (ctx.outputFormat === "table") {
+          process.stdout.write("\n\u26A0  This key will not be shown again. Copy it now.\n");
+        }
       }
     },
     {
@@ -5151,7 +7056,10 @@ var apiKeysDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx, data }) => {
         const result = await requireAuth(ctx).apiClient.createGlobalApiKey(data);
-        outputSingle(result, ctx, COLUMNS16);
+        outputSingle(result, ctx, CREATE_COLUMNS);
+        if (ctx.outputFormat === "table") {
+          process.stdout.write("\n\u26A0  This key will not be shown again. Copy it now.\n");
+        }
       }
     },
     {
@@ -5963,8 +7871,9 @@ var mcpServersDomain = {
 // src/domains/member-memories.ts
 var COLUMNS21 = [
   { header: "KEY", getValue: (item) => item.key ?? "" },
-  { header: "STRATEGY", getValue: (item) => item.strategy ?? "" },
-  { header: "CONTENT", getValue: (item) => truncate(item.content ?? "", 80) },
+  { header: "TYPE", getValue: (item) => item.type ?? "basic" },
+  { header: "DESCRIPTION", getValue: (item) => truncate(item.description ?? "", 60) },
+  { header: "PRIORITY", getValue: (item) => item.priority ?? 0 },
   { header: "UPDATED", getValue: (item) => item.updatedAt ?? item.createdAt ?? "" }
 ];
 function truncate(s, max) {
@@ -5972,7 +7881,7 @@ function truncate(s, max) {
 }
 var memberMemoriesDomain = {
   name: "member-memories",
-  description: "Manage member long-term memories",
+  description: "Manage member persistent memories",
   commands: [
     {
       path: ["member-memories", "list"],
@@ -5981,38 +7890,18 @@ var memberMemoriesDomain = {
       args: [
         { name: "member-id", description: "Member ID", required: true },
         {
-          name: "strategy",
-          description: "Filter by strategy (preferences, semantic, summaries, episodic)"
-        }
-      ],
-      handler: async ({ ctx, workspace, args }) => {
-        const memberId = requireNumber(args, "member-id");
-        const strategy = args.strategy;
-        const result = await requireAuth(ctx).apiClient.getMemberMemories(workspace, memberId, {
-          strategy
-        });
-        outputData(listResult(result, false), ctx, COLUMNS21);
-      }
-    },
-    {
-      path: ["member-memories", "search"],
-      description: "Search memories for a member by query",
-      requiresWorkspace: true,
-      args: [
-        { name: "member-id", description: "Member ID", required: true },
-        { name: "query", description: "Search query", required: true },
-        {
-          name: "strategy",
-          description: "Filter by strategy (preferences, semantic, summaries, episodic)"
-        }
+          name: "type",
+          description: "Memory type filter (basic, preferences, semantic, summaries, episodic, all)"
+        },
+        { name: "query", description: "Semantic search query (for AgentCore memory types)" }
       ],
       handler: async ({ ctx, workspace, args }) => {
         const memberId = requireNumber(args, "member-id");
-        const query = requireString(args, "query");
-        const strategy = args.strategy;
+        const type = args.type;
+        const query = args.query;
         const result = await requireAuth(ctx).apiClient.getMemberMemories(workspace, memberId, {
-          query,
-          strategy
+          type,
+          query
         });
         outputData(listResult(result, false), ctx, COLUMNS21);
       }
@@ -6025,17 +7914,20 @@ var memberMemoriesDomain = {
       args: [
         { name: "member-id", description: "Member ID", required: true },
         { name: "key", description: "Memory key", required: true },
-        { name: "strategy", description: "Memory strategy", required: true }
+        {
+          name: "type",
+          description: "Memory type (basic, preferences, semantic, summaries, episodic)"
+        }
       ],
       handler: async ({ ctx, workspace, args }) => {
         const memberId = requireNumber(args, "member-id");
         const key = requireString(args, "key");
-        const strategy = requireString(args, "strategy");
+        const type = args.type;
         await requireAuth(ctx).apiClient.deleteMemberMemory(
           workspace,
           memberId,
           key,
-          strategy
+          type ? { type } : void 0
         );
         process.stdout.write(`Deleted memory ${key}
 `);
@@ -6073,7 +7965,7 @@ var milestonesDomain = {
 var COLUMNS23 = [
   COL.id(),
   COL.name(),
-  { header: "TYPE", getValue: (item) => item.type ?? "" },
+  { header: "TYPE", getValue: (item) => item.noticeType ?? "" },
   COL.enabled()
 ];
 var notificationRulesDomain = {
@@ -6179,55 +8071,381 @@ var operatorGroupsDomain = {
         );
         outputSingle(result, ctx);
       }
-    },
-    {
-      path: ["operator-groups", "remove-member"],
-      description: "Remove a member from an operator group",
-      mutates: true,
-      requiresWorkspace: true,
-      args: [
-        { name: "id", description: "Operator group ID", required: true },
-        { name: "member-id", description: "Member ID to remove", required: true }
-      ],
-      handler: async ({ ctx, workspace, args }) => {
-        await requireAuth(ctx).apiClient.removeGroupMember(
-          workspace,
-          requireNumber(args, "id"),
-          requireNumber(args, "member-id")
+    },
+    {
+      path: ["operator-groups", "remove-member"],
+      description: "Remove a member from an operator group",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "id", description: "Operator group ID", required: true },
+        { name: "member-id", description: "Member ID to remove", required: true }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        await requireAuth(ctx).apiClient.removeGroupMember(
+          workspace,
+          requireNumber(args, "id"),
+          requireNumber(args, "member-id")
+        );
+        process.stdout.write("Member removed from group\n");
+      }
+    },
+    {
+      path: ["operator-groups", "live"],
+      description: "List live operators",
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace }) => {
+        const result = await requireAuth(ctx).apiClient.getLiveOperators(workspace);
+        outputData(result, ctx);
+      }
+    },
+    {
+      path: ["operator-groups", "presence"],
+      description: "Get presence status",
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace }) => {
+        const result = await requireAuth(ctx).apiClient.getPresenceStatus(workspace);
+        outputSingle(result, ctx);
+      }
+    }
+  ]
+};
+
+// src/domains/org.ts
+var ORG_COLUMNS = [
+  { header: "ID", getValue: (item) => String(item.organizationId ?? "") },
+  { header: "NAME", getValue: (item) => item.organizationName || "" },
+  { header: "ROLE", getValue: (item) => item.role || "" }
+];
+var ORG_DOMAIN_COLUMNS = [
+  { header: "UUID", getValue: (item) => item.uuid ?? "" },
+  { header: "DOMAIN", getValue: (item) => item.domain ?? "" },
+  { header: "OWNERSHIP", getValue: (item) => item.ownershipStatus ?? "" },
+  { header: "EMAIL", getValue: (item) => item.emailStatus ?? "-" },
+  { header: "SITE", getValue: (item) => item.siteStatus ?? "-" },
+  { header: "TXT HOST", getValue: (item) => item.ownershipDnsRecord?.host ?? "" },
+  {
+    header: "TXT VALUE",
+    getValue: (item) => item.ownershipDnsRecord?.value ?? "",
+    maxWidth: 80
+  }
+];
+function requireOrgId(args) {
+  const val = args["org-uuid"] ?? args.org;
+  if (typeof val !== "string" || !val) {
+    throw new CLIError("Missing required argument: --org-uuid");
+  }
+  return val;
+}
+function requireDomainUuid(args) {
+  const val = args["domain-uuid"] ?? args.uuid;
+  if (typeof val !== "string" || !val) {
+    throw new CLIError("Missing required argument: --domain-uuid");
+  }
+  return val;
+}
+function requireDomain(args) {
+  const val = args.domain;
+  if (typeof val !== "string" || !val) {
+    throw new CLIError("Missing required argument: --domain");
+  }
+  return val;
+}
+var ORG_UUID_ARG = {
+  name: "org-uuid",
+  aliases: ["org"],
+  description: "Organization UUID or ID",
+  required: true
+};
+var DOMAIN_UUID_ARG = {
+  name: "domain-uuid",
+  aliases: ["domain-id"],
+  description: "OrgDomain UUID",
+  required: true
+};
+function pluralize(count, singular, plural = `${singular}s`) {
+  return count === 1 ? singular : plural;
+}
+function emailVerifyCommand(path, description) {
+  return {
+    path,
+    description,
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainEmail(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  };
+}
+function siteVerifyCommand(path, description) {
+  return {
+    path,
+    description,
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainSite(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  };
+}
+function registerDomainCommand(path) {
+  return {
+    path,
+    description: "Register an organization domain and return ownership TXT instructions",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG,
+      { name: "domain", description: "Domain to register, e.g. example.com", required: true }
+    ],
+    examples: [
+      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain example.com --allow-write`
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.registerOrgDomain(
+        requireOrgId(hctx.args),
+        requireDomain(hctx.args)
+      );
+      outputSingle(result, hctx.ctx, ORG_DOMAIN_COLUMNS);
+    }
+  };
+}
+var domainCommands = [
+  {
+    path: ["org", "domains", "list"],
+    description: "List domains registered to an organization",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG],
+    examples: ["yarn gr org domains list --org-uuid $ORG_UUID"],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.listOrgDomains(
+        requireOrgId(hctx.args)
+      );
+      outputData(result, hctx.ctx, ORG_DOMAIN_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "domains", "get"],
+    description: "Get a registered organization domain",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: ["yarn gr org domains get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.getOrgDomain(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx, ORG_DOMAIN_COLUMNS);
+    }
+  },
+  registerDomainCommand(["org", "domains", "register"]),
+  registerDomainCommand(["org", "domains", "create"]),
+  {
+    path: ["org", "domains", "verify-ownership"],
+    description: "Verify domain ownership by checking the _gravity-verify TXT record",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      "yarn gr org domains verify-ownership --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainOwnership(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "domains", "delete"],
+    description: "Delete a registered organization domain",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      "yarn gr org domains delete --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const domainUuid = requireDomainUuid(hctx.args);
+      await requireAuth(hctx.ctx).apiClient.deleteOrgDomain(requireOrgId(hctx.args), domainUuid);
+      process.stdout.write(`Deleted org domain ${domainUuid}
+`);
+    }
+  },
+  {
+    path: ["org", "domains", "email", "enable"],
+    description: "Enable email DNS records on a verified organization domain",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      "yarn gr org domains email enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.enableOrgDomainEmail(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "domains", "email", "get"],
+    description: "Get email DNS setup and status for an organization domain",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: ["yarn gr org domains email get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.getOrgDomainEmail(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  },
+  emailVerifyCommand(
+    ["org", "domains", "email", "verify"],
+    "Verify email DNS records, including MX"
+  ),
+  emailVerifyCommand(
+    ["org", "domains", "email", "verify-mx"],
+    "Verify email DNS records, including MX"
+  ),
+  {
+    path: ["org", "domains", "email", "disable"],
+    description: "Disable email on an organization domain",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG,
+      DOMAIN_UUID_ARG,
+      {
+        name: "confirm",
+        description: "Confirm removal of inbox routing that depends on this domain",
+        isFlag: true
+      }
+    ],
+    examples: [
+      "yarn gr org domains email disable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --confirm --allow-write"
+    ],
+    handler: async (hctx) => {
+      const domainUuid = requireDomainUuid(hctx.args);
+      const result = await requireAuth(hctx.ctx).apiClient.disableOrgDomainEmail(
+        requireOrgId(hctx.args),
+        domainUuid,
+        hctx.args.confirm === true
+      );
+      if (!result.ok) {
+        const { inboxCount } = result.impact;
+        throw new CLIError(
+          `Email is still used by ${inboxCount} ${pluralize(
+            inboxCount,
+            "inbox",
+            "inboxes"
+          )}. Re-run with --confirm to disable it anyway.`
         );
-        process.stdout.write("Member removed from group\n");
       }
-    },
-    {
-      path: ["operator-groups", "live"],
-      description: "List live operators",
-      requiresWorkspace: true,
-      handler: async ({ ctx, workspace }) => {
-        const result = await requireAuth(ctx).apiClient.getLiveOperators(workspace);
-        outputData(result, ctx);
+      process.stdout.write(`Disabled email for org domain ${domainUuid}
+`);
+    }
+  },
+  {
+    path: ["org", "domains", "site", "enable"],
+    description: "Enable custom site CNAME verification on a verified organization domain",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: [
+      "yarn gr org domains site enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.enableOrgDomainSite(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "domains", "site", "get"],
+    description: "Get custom site CNAME setup and status for an organization domain",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
+    examples: ["yarn gr org domains site get --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID"],
+    handler: async (hctx) => {
+      const result = await requireAuth(hctx.ctx).apiClient.getOrgDomainSite(
+        requireOrgId(hctx.args),
+        requireDomainUuid(hctx.args)
+      );
+      outputSingle(result, hctx.ctx);
+    }
+  },
+  siteVerifyCommand(
+    ["org", "domains", "site", "verify"],
+    "Verify the site CNAME points at Gravity Rail"
+  ),
+  siteVerifyCommand(
+    ["org", "domains", "site", "verify-cname"],
+    "Verify the site CNAME points at Gravity Rail"
+  ),
+  {
+    path: ["org", "domains", "site", "disable"],
+    description: "Disable custom site routing on an organization domain",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG,
+      DOMAIN_UUID_ARG,
+      {
+        name: "confirm",
+        description: "Confirm removal of site mappings that depend on this domain",
+        isFlag: true
       }
-    },
-    {
-      path: ["operator-groups", "presence"],
-      description: "Get presence status",
-      requiresWorkspace: true,
-      handler: async ({ ctx, workspace }) => {
-        const result = await requireAuth(ctx).apiClient.getPresenceStatus(workspace);
-        outputSingle(result, ctx);
+    ],
+    examples: [
+      "yarn gr org domains site disable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --confirm --allow-write"
+    ],
+    handler: async (hctx) => {
+      const domainUuid = requireDomainUuid(hctx.args);
+      const result = await requireAuth(hctx.ctx).apiClient.disableOrgDomainSite(
+        requireOrgId(hctx.args),
+        domainUuid,
+        hctx.args.confirm === true
+      );
+      if (!result.ok) {
+        const { siteCount } = result.impact;
+        throw new CLIError(
+          `Site routing is still used by ${siteCount} ${pluralize(
+            siteCount,
+            "site"
+          )}. Re-run with --confirm to disable it anyway.`
+        );
       }
+      process.stdout.write(`Disabled site routing for org domain ${domainUuid}
+`);
     }
-  ]
-};
-
-// src/domains/org.ts
-var ORG_COLUMNS = [
-  COL.id(),
-  COL.name(),
-  { header: "ROLE", getValue: (item) => item.role ?? "" }
+  }
 ];
 var orgDomain = {
   name: "org",
-  description: "Organization membership",
+  description: "Organization membership and domains",
   commands: [
     {
       path: ["org", "list"],
@@ -6237,7 +8455,8 @@ var orgDomain = {
         const result = await requireAuth(ctx).apiClient.getMyOrganizations();
         outputData(result, ctx, ORG_COLUMNS);
       }
-    }
+    },
+    ...domainCommands
   ]
 };
 
@@ -6765,20 +8984,20 @@ var promptsDomain = {
         "gr prompts inspect --chat-id 789 --turn 3"
       ],
       handler: async ({ ctx, workspace, args }) => {
-        const taskId = args["task-id"] ? requireNumber(args, "task-id") : void 0;
-        const chatId = args["chat-id"] ? requireNumber(args, "chat-id") : void 0;
-        if (!taskId && !chatId) {
+        const taskId = args["task-id"] !== void 0 ? requireNumber(args, "task-id") : void 0;
+        const chatId = args["chat-id"] !== void 0 ? requireNumber(args, "chat-id") : void 0;
+        if (taskId === void 0 && chatId === void 0) {
           throw new Error("Provide --task-id or --chat-id");
         }
-        if (taskId && chatId) {
+        if (taskId !== void 0 && chatId !== void 0) {
           throw new Error("Provide --task-id or --chat-id, not both");
         }
         const channel = args.channel || void 0;
-        const turn = args.turn ? requireNumber(args, "turn") : void 0;
-        const result = await requireAuth(ctx).apiClient.inspectPrompt(workspace, taskId ?? 0, {
-          channel,
-          ...chatId ? { chatId } : {},
-          ...turn ? { turn } : {}
+        const turn = args.turn !== void 0 ? requireNumber(args, "turn") : void 0;
+        const result = await requireAuth(ctx).apiClient.inspectPrompt(workspace, {
+          ...taskId !== void 0 ? { taskId } : { chatId },
+          ...channel ? { channel } : {},
+          ...turn !== void 0 ? { turn } : {}
         });
         outputSingle(result, ctx);
       }
@@ -6786,6 +9005,128 @@ var promptsDomain = {
   ]
 };
 
+// src/domains/support.ts
+var SUPPORT_COLUMNS = [
+  COL.uuid(),
+  { header: "STATUS", getValue: (item) => item.status ?? "" },
+  { header: "TYPE", getValue: (item) => item.supportRequestType ?? "" },
+  { header: "SEVERITY", getValue: (item) => item.severity ?? "" },
+  { header: "SOURCE", getValue: (item) => item.source ?? "" },
+  { header: "CREATED", getValue: (item) => (item.createdAt ?? "").slice(0, 19) },
+  { header: "TITLE", getValue: (item) => item.title ?? "" }
+];
+var CONTEXT_ARGS = [
+  { name: "workspace", aliases: ["w"], description: "Workspace UUID" },
+  { name: "org-uuid", description: "Organization UUID" }
+];
+function listParams(args) {
+  return {
+    page: args.page ? Number(args.page) : void 0,
+    pageSize: args["page-size"] ? Number(args["page-size"]) : void 0,
+    status: args.status,
+    supportRequestType: args.type,
+    severity: args.severity,
+    source: args.source
+  };
+}
+function requestPayload(data, args) {
+  const input = data ?? {};
+  return {
+    supportRequestType: input.supportRequestType ?? input.support_request_type ?? args.type ?? "question",
+    title: input.title ?? requireString(args, "title"),
+    description: input.description ?? requireString(args, "description"),
+    severity: input.severity ?? args.severity
+  };
+}
+function commentPayload(data, args) {
+  const input = data ?? {};
+  return {
+    body: input.body ?? requireString(args, "body")
+  };
+}
+var supportDomain = {
+  name: "support",
+  description: "Manage support requests",
+  commands: [
+    {
+      path: ["support", "list"],
+      description: "List support requests",
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "status", description: "Filter by status" },
+        { name: "type", description: "Filter by type: bug, feature_request, question" },
+        { name: "severity", description: "Filter by severity" },
+        { name: "source", description: "Filter by source" },
+        { name: "page", description: "Page number" },
+        { name: "page-size", description: "Page size" }
+      ],
+      columns: SUPPORT_COLUMNS,
+      handler: async ({ ctx, args, workspace }) => {
+        const client = requireAuth(ctx).apiClient;
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const result = wid ? await client.listWorkspaceSupportRequests(wid, listParams(args)) : orgUuid ? await client.listOrgSupportRequests(orgUuid, listParams(args)) : await client.listSupportRequests(listParams(args));
+        outputData(result, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "get"],
+      description: "Get a support request",
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "id", aliases: ["uuid"], description: "Support request UUID", required: true }
+      ],
+      handler: async ({ ctx, args, workspace }) => {
+        const client = requireAuth(ctx).apiClient;
+        const id = requireString(args, "id");
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const result = wid ? await client.getWorkspaceSupportRequest(wid, id) : orgUuid ? await client.getOrgSupportRequest(orgUuid, id) : await client.getSupportRequest(id);
+        outputSingle(result, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "create"],
+      description: "Create a support request",
+      mutates: true,
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "type", description: "Request type: bug, feature_request, question" },
+        { name: "title", description: "Support request title" },
+        { name: "description", description: "Support request description" },
+        { name: "severity", description: "Optional severity" }
+      ],
+      handler: async ({ ctx, args, workspace, data }) => {
+        const client = requireAuth(ctx).apiClient;
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const payload = requestPayload(data, args);
+        const result = wid ? await client.createWorkspaceSupportRequest(wid, payload) : orgUuid ? await client.createOrgSupportRequest(orgUuid, payload) : await client.createSupportRequest(payload);
+        outputSingle(result, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "comment"],
+      description: "Add a customer comment to a support request",
+      mutates: true,
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "id", aliases: ["uuid"], description: "Support request UUID", required: true },
+        { name: "body", description: "Comment body" }
+      ],
+      handler: async ({ ctx, args, workspace, data }) => {
+        const client = requireAuth(ctx).apiClient;
+        const id = requireString(args, "id");
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const payload = commentPayload(data, args);
+        const result = wid ? await client.commentOnWorkspaceSupportRequest(wid, id, payload) : orgUuid ? await client.commentOnOrgSupportRequest(orgUuid, id, payload) : await client.commentOnSupportRequest(id, payload);
+        outputSingle(result, ctx, SUPPORT_COLUMNS);
+      }
+    }
+  ]
+};
+
 // src/domains/supervisors.ts
 var COLUMNS28 = [
   COL.id(),
@@ -6902,6 +9243,10 @@ var syncDomain = {
         {
           name: "board-id",
           description: "Scope to a single board mapping (requires --entity-type)"
+        },
+        {
+          name: "record-limit",
+          description: "Cap the run to a preview sample (1..200). Requires --dry-run and --entity-type."
         }
       ],
       examples: [
@@ -6910,7 +9255,8 @@ var syncDomain = {
         "sync run --connection-id 6 --full-resync",
         "sync run --connection-id 6 --quiet",
         "sync run --connection-id 6 --entity-type member",
-        "sync run --connection-id 6 --entity-type member --board-id 18406694561"
+        "sync run --connection-id 6 --entity-type member --board-id 18406694561",
+        "sync run --connection-id 6 --dry-run --entity-type member --record-limit 20"
       ],
       mutates: true,
       handler: async ({ ctx, args, workspace }) => {
@@ -6930,12 +9276,39 @@ var syncDomain = {
           entityType = rawEntityType;
         }
         const boardId = args["board-id"];
+        const rawRecordLimit = args["record-limit"];
+        let recordLimit;
+        if (rawRecordLimit !== void 0 && rawRecordLimit !== "") {
+          const parsed = Number(rawRecordLimit);
+          if (!Number.isInteger(parsed) || parsed < 1 || parsed > 200) {
+            throw new CLIError(
+              `Invalid --record-limit "${rawRecordLimit}". Must be an integer between 1 and 200.`
+            );
+          }
+          if (!dryRun) {
+            throw new CLIError(
+              "--record-limit requires --dry-run: capped runs are preview-only."
+            );
+          }
+          if (entityType === void 0) {
+            throw new CLIError(
+              "--record-limit requires --entity-type: capped previews must target a single entity type."
+            );
+          }
+          recordLimit = parsed;
+        }
+        if (fullResync && (dryRun || recordLimit !== void 0)) {
+          throw new CLIError(
+            "--full-resync is incompatible with --dry-run / --record-limit: checkpoint reset must happen on a non-preview run."
+          );
+        }
         if (!quiet) {
           const flags = [
             dryRun && "(dry run)",
             fullResync && "(full re-sync)",
             entityType && `(${entityType} only)`,
-            boardId && `(board ${boardId})`
+            boardId && `(board ${boardId})`,
+            recordLimit !== void 0 && `(limit ${recordLimit})`
           ].filter(Boolean).join(" ");
           console.error(
             `Starting sync for connection ${connectionId}${flags ? ` ${flags}` : ""}...`
@@ -6948,7 +9321,8 @@ var syncDomain = {
             dryRun,
             resetCheckpoints: fullResync,
             entityType,
-            boardId
+            boardId,
+            recordLimit
           }
         );
         if (!response.ok) {
@@ -7142,6 +9516,31 @@ var appConnectionsDomain = {
         );
         outputSingle(result, ctx);
       }
+    },
+    {
+      path: ["app-connections", "relink-member"],
+      description: "Re-enable sync for a previously unlinked member by clearing the manual-unlink exclusion on this connection. Idempotent: returns cleared=false when no exclusion exists.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "id", description: "Connection ID (numeric)", required: true },
+        { name: "member-id", description: "Member ID (numeric)", required: true },
+        {
+          name: "board-id",
+          description: "Optional Monday board ID. Required for Monday connections where exclusions are board-scoped; omit for single-scope connectors."
+        }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const boardIdRaw = args["board-id"];
+        const options = boardIdRaw !== void 0 && boardIdRaw !== "" ? { boardId: String(boardIdRaw) } : void 0;
+        const result = await requireAuth(ctx).apiClient.clearConnectionMemberExclusion(
+          workspace,
+          requireNumber(args, "id"),
+          requireNumber(args, "member-id"),
+          options
+        );
+        outputSingle(result, ctx);
+      }
     }
   ]
 };
@@ -7834,49 +10233,6 @@ var mondayDomain = {
         outputData(result, ctx);
       }
     },
-    {
-      path: ["monday", "webhook-get"],
-      description: "Get a Monday.com webhook",
-      requiresWorkspace: true,
-      args: [
-        { name: "board-id", description: "Board ID", required: true },
-        { name: "id", description: "Webhook ID", required: true }
-      ],
-      handler: async ({ ctx, args, workspace }) => {
-        const result = await requireAuth(ctx).apiClient.getMondayWebhook(
-          workspace,
-          requireString(args, "board-id"),
-          requireString(args, "id")
-        );
-        outputSingle(result, ctx);
-      }
-    },
-    {
-      path: ["monday", "webhook-create"],
-      description: "Create a Monday.com webhook",
-      mutates: true,
-      requiresWorkspace: true,
-      handler: async ({ ctx, data, workspace }) => {
-        const result = await requireAuth(ctx).apiClient.createMondayWebhook(
-          workspace,
-          data
-        );
-        outputSingle(result, ctx);
-      }
-    },
-    {
-      path: ["monday", "webhook-delete"],
-      description: "Delete a Monday.com webhook",
-      mutates: true,
-      requiresWorkspace: true,
-      args: [{ name: "id", description: "Webhook ID", required: true }],
-      handler: async ({ ctx, args, workspace }) => {
-        const id = requireString(args, "id");
-        await requireAuth(ctx).apiClient.deleteMondayWebhook(workspace, id);
-        process.stdout.write(`Deleted Monday webhook ${id}
-`);
-      }
-    },
     {
       path: ["monday", "user-info"],
       description: "Get current Monday.com user info",
@@ -8216,6 +10572,113 @@ var slackAppsDomain = {
   ]
 };
 
+// src/domains/integrations/teams-apps.ts
+var COLUMNS33 = [COL.id(), COL.name(), COL.status()];
+function addTeamsUrls(data, apiUrl, workspaceUuid) {
+  const base = `${apiUrl}/api/v2/w/${workspaceUuid}/app-connections/teams`;
+  return {
+    ...data,
+    _urls: {
+      eventsEndpoint: `${base}/events`,
+      oauthUserAuthorize: `${base}/oauth/user/authorize?app_id=${data.id ?? ""}`,
+      oauthUserCallback: `${base}/oauth/user/callback`
+    }
+  };
+}
+var teamsAppsDomain = {
+  name: "teams-apps",
+  description: "Manage Microsoft Teams app integrations",
+  commands: [
+    ...crudCommands({
+      prefix: ["teams-apps"],
+      entityName: "Teams app",
+      listMethod: "getTeamsApps",
+      deleteMethod: "deleteTeamsApp",
+      columns: COLUMNS33,
+      paginationSupport: "full"
+    }),
+    {
+      path: ["teams-apps", "get"],
+      description: "Get a Teams app by ID",
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, args }) => {
+        const result = await requireAuth(ctx).apiClient.getTeamsApp(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputSingle(addTeamsUrls(result, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "create"],
+      description: "Create a Teams app",
+      mutates: true,
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const result = await requireAuth(ctx).apiClient.createTeamsApp(workspace, data);
+        outputSingle(addTeamsUrls(result, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "update"],
+      description: "Update a Teams app",
+      mutates: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const result = await requireAuth(ctx).apiClient.updateTeamsApp(
+          workspace,
+          requireNumber(args, "id"),
+          data
+        );
+        outputSingle(addTeamsUrls(result, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "conversations"],
+      description: "List Teams conversations linked to chats",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result = await requireAuth(ctx).apiClient.getTeamsConversations(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result, ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "installations"],
+      description: "List per-tenant Teams installations",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result = await requireAuth(ctx).apiClient.getTeamsInstallations(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result, ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "accounts"],
+      description: "List linked Teams (Entra) accounts for this app",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result = await requireAuth(ctx).apiClient.getTeamsAppAccounts(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result, ctx);
+      }
+    }
+  ]
+};
+
 // src/domains/index.ts
 function registerPublicDomains(registry) {
   registry.register(tasksDomain);
@@ -8247,6 +10710,7 @@ function registerPublicDomains(registry) {
   registry.register(mcpServersDomain);
   registry.register(apiKeysDomain);
   registry.register(subscriptionsDomain);
+  registry.register(supportDomain);
   registry.register(reportsDomain);
   registry.register(aiModelsDomain);
   registry.register(featuresDomain);
@@ -8262,6 +10726,7 @@ function registerPublicDomains(registry) {
   registry.register(confluenceDomain);
   registry.register(discordBotsDomain);
   registry.register(slackAppsDomain);
+  registry.register(teamsAppsDomain);
   registry.register(fhirConnectionsDomain);
   registry.register(appConnectionsDomain);
   registry.register(hubspotDomain);
@@ -8271,7 +10736,7 @@ function registerPublicDomains(registry) {
 }
 
 // src/commands/auth-browser.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 async function authBrowserCommand(ctx, args) {
   const noOpen = Boolean(args["no-open"]);
   const account = await ctx.apiClient.getUserAccount();
@@ -8307,7 +10772,7 @@ function openUrl(url) {
     command = "xdg-open";
     args = [url];
   }
-  execFile(command, args, (err) => {
+  execFile2(command, args, (err) => {
     if (err) {
       process.stderr.write("Warning: Could not open browser automatically\n");
     }
@@ -10338,7 +12803,7 @@ async function createMemberChat(apiClient, workspace, memberId) {
 }
 
 // src/commands/organizations.ts
-var COLUMNS33 = [
+var COLUMNS34 = [
   { header: "NAME", getValue: (o) => o.organizationName || "", maxWidth: 35 },
   { header: "SLUG", getValue: (o) => o.organizationSlug || "", maxWidth: 25 },
   { header: "UUID", getValue: (o) => o.organizationUuid },
@@ -10346,11 +12811,11 @@ var COLUMNS33 = [
 ];
 async function organizationsListCommand(ctx) {
   const organizations = await ctx.apiClient.getMyOrganizations();
-  outputData(organizations, ctx, COLUMNS33);
+  outputData(organizations, ctx, COLUMNS34);
 }
 
 // src/commands/whoami.ts
-var COLUMNS34 = [
+var COLUMNS35 = [
   { header: "NAME", getValue: (a) => a.name || "", maxWidth: 30 },
   { header: "EMAIL", getValue: (a) => a.email || "", maxWidth: 40 },
   { header: "UUID", getValue: (a) => a.uuid },
@@ -10358,7 +12823,7 @@ var COLUMNS34 = [
 ];
 async function whoamiCommand(ctx) {
   const account = await ctx.apiClient.getUserAccount();
-  outputSingle(account, ctx, COLUMNS34);
+  outputSingle(account, ctx, COLUMNS35);
 }
 export {
   AuthRequiredError,