@gravity-rail/cli 0.4.0 → 0.5.1

package/dist/gr.js

@@ -1,54 +1,15 @@
 #!/usr/bin/env node
+import { CLIError, handleError, AuthRequiredError } from './chunk-XRBVAFCB.js';
+import fs, { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, createWriteStream } from 'fs';
+import path3, { join, resolve, dirname } from 'path';
 import { createServer } from 'http';
 import { randomBytes, createHash } from 'crypto';
-import { readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, createWriteStream } from 'fs';
-import { join } from 'path';
 import { execSync, execFile, exec, spawn, spawnSync } from 'child_process';
 import * as readline from 'readline';
-import { homedir } from 'os';
+import readline__default from 'readline';
+import os, { homedir } from 'os';
 import { EventEmitter } from 'events';
 
-// src/lib/errors.ts
-var CLIError = class extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
-    this.exitCode = exitCode;
-    this.name = "CLIError";
-  }
-};
-var AuthRequiredError = class extends CLIError {
-  constructor(message = "Not authenticated. Run `gr login` or set GRAVITY_RAIL_API_KEY.") {
-    super(message, 2);
-    this.name = "AuthRequiredError";
-  }
-};
-function handleError(err) {
-  if (err instanceof CLIError) {
-    process.stderr.write(`Error: ${err.message}
-`);
-    process.exit(err.exitCode);
-  }
-  if (err instanceof Error) {
-    process.stderr.write(`Error: ${err.message}
-`);
-    if ("errors" in err && Array.isArray(err.errors)) {
-      for (const e of err.errors) {
-        process.stderr.write(`  - ${e}
-`);
-      }
-    }
-    if ("statusCode" in err && err.statusCode === 401) {
-      process.stderr.write(`
-Hint: Run "yarn gr login" or use "--realm <name>" (dev only)
-`);
-    }
-    process.exit(1);
-  }
-  process.stderr.write(`Error: ${String(err)}
-`);
-  process.exit(1);
-}
-
 // src/lib/pagination.ts
 function isListResult(data) {
   if (!data || typeof data !== "object" || Array.isArray(data)) return false;
@@ -172,7 +133,7 @@ var COMMON_ARGS = [
   { name: "uuid", description: "Entity UUID" }
 ];
 function parseArgs(defs, argv) {
-  const allDefs = [...COMMON_ARGS, ...defs];
+  const allDefs = [...defs, ...COMMON_ARGS];
   const result2 = {};
   for (const def of allDefs) {
     if (def.default !== void 0) {
@@ -199,8 +160,7 @@ function parseArgs(defs, argv) {
     const def = findDef(allDefs, flagPart);
     if (!def) {
       if ((flagPart.startsWith("--") || flagPart.startsWith("-")) && !KNOWN_GLOBAL_FLAGS.has(flagPart)) {
-        process.stderr.write(`Warning: unknown flag "${flagPart}" (ignored)
-`);
+        throw new CLIError(`Unknown flag "${flagPart}"`);
       }
       continue;
     }
@@ -215,9 +175,11 @@ function parseArgs(defs, argv) {
     }
   }
   for (const def of allDefs) {
-    if (def.required && result2[def.name] === void 0) {
-      throw new CLIError(`Missing required argument: --${def.name}`);
-    }
+    if (!def.required) continue;
+    if (result2[def.name] !== void 0) continue;
+    const aliasNames = [def.alias, ...def.aliases ?? []].filter(Boolean);
+    if (aliasNames.some((a) => result2[a] !== void 0)) continue;
+    throw new CLIError(`Missing required argument: --${def.name}`);
   }
   return result2;
 }
@@ -2390,7 +2352,7 @@ function parsePhoneNumber4() {
   return withMetadataArgument(parsePhoneNumber3, arguments);
 }
 
-// ../sdk/dist/chunk-3BG2GMJZ.js
+// ../sdk/dist/chunk-XRKRVY46.js
 function getCookieValue(name) {
   if (typeof document === "undefined") return void 0;
   const cookies = document.cookie.split(";");
@@ -2438,7 +2400,7 @@ function parseOrgAuthChallenge(wwwAuthenticate) {
   const cookieNameMatch = wwwAuthenticate.match(/cookie_name="([^"]+)"/);
   const authUrlMatch = wwwAuthenticate.match(/auth_url="([^"]+)"/);
   if (!orgUuidMatch?.[1] || !cookieNameMatch?.[1] || !authUrlMatch?.[1]) {
-    console.warn("Invalid org auth challenge header:", wwwAuthenticate);
+    console.warn("Invalid org auth challenge header: missing required fields");
     return null;
   }
   return {
@@ -2455,8 +2417,17 @@ var BaseApiClient = class {
   enhancedAuthHandler;
   enhancedAuthInProgress = null;
   orgAuthHandler;
+  orgAuthInProgress = null;
   actingMemberUuid;
   orgToken;
+  /**
+   * The org_uuid that issued the current orgToken. Tracked so we can detect
+   * a 401 challenge from a *different* org and re-fire the handler — the
+   * orgToken is an opaque JWE we cannot decrypt client-side, so without this
+   * the original guard `!this.orgToken` would prevent re-auth across orgs and
+   * surface as a silent 401 in multi-org CLI workflows.
+   */
+  orgTokenOrgUuid;
   constructor(apiKey, baseUrl3, customFetch) {
     this.baseUrl = baseUrl3;
     this.apiKey = apiKey;
@@ -2506,9 +2477,15 @@ var BaseApiClient = class {
    * Set the org token for cross-domain requests.
    * When set, all API requests will include the X-Org-Token header,
    * allowing org-level SSO verification without cookies.
+   *
+   * `orgUuid` is the org that issued the token; passing it lets the 401
+   * handler detect a stale token when a subsequent request targets a
+   * different org and re-fire the org-auth handler instead of silently
+   * 401-ing. Callers without that context (legacy / unknown) may omit it.
    */
-  setOrgToken(token) {
+  setOrgToken(token, orgUuid) {
     this.orgToken = token;
+    this.orgTokenOrgUuid = token ? orgUuid : void 0;
   }
   async fetch(endpoint, options) {
     try {
@@ -2556,29 +2533,61 @@ var BaseApiClient = class {
             return await this.fetch(endpoint, options);
           } catch (retryError) {
             this.orgToken = void 0;
+            this.orgTokenOrgUuid = void 0;
             throw retryError;
           }
         }
         if (response.status === 401) {
           const orgAuthInfo = parseOrgAuthChallenge(response.headers.get("WWW-Authenticate"));
+          if (orgAuthInfo && this.orgToken && this.orgTokenOrgUuid && this.orgTokenOrgUuid !== orgAuthInfo.orgUuid) {
+            this.orgToken = void 0;
+            this.orgTokenOrgUuid = void 0;
+          }
           if (orgAuthInfo && !this.orgToken) {
             const requestCookieName = orgAuthInfo.cookieName.replace(
-              "orgToken",
+              /^orgToken/,
               "requestOrgToken"
             );
             const cachedOrgToken = getCookieValue(requestCookieName);
             if (cachedOrgToken) {
               this.orgToken = cachedOrgToken;
+              this.orgTokenOrgUuid = orgAuthInfo.orgUuid;
               try {
                 return await this.fetch(endpoint, options);
               } catch (retryError) {
                 this.orgToken = void 0;
+                this.orgTokenOrgUuid = void 0;
                 throw retryError;
               }
             }
             if (this.orgAuthHandler) {
-              await this.orgAuthHandler(orgAuthInfo);
-              throw new ApiError("Organization authentication required", 401);
+              if (!this.orgAuthInProgress) {
+                const handler = this.orgAuthHandler;
+                this.orgAuthInProgress = (async () => {
+                  try {
+                    await handler(orgAuthInfo);
+                  } finally {
+                    this.orgAuthInProgress = null;
+                  }
+                })();
+              }
+              await this.orgAuthInProgress;
+              const postHandlerToken = getCookieValue(requestCookieName) ?? this.orgToken;
+              if (!postHandlerToken) {
+                throw new ApiError(
+                  "Organization authentication did not issue a token",
+                  401
+                );
+              }
+              this.orgToken = postHandlerToken;
+              this.orgTokenOrgUuid = orgAuthInfo.orgUuid;
+              try {
+                return await this.fetch(endpoint, options);
+              } catch (retryError) {
+                this.orgToken = void 0;
+                this.orgTokenOrgUuid = void 0;
+                throw retryError;
+              }
             }
           }
         }
@@ -2677,29 +2686,61 @@ ${formattedErrors}`, response.status);
             return await this.fetchRaw(endpoint, options, allowedErrorStatuses);
           } catch (retryError) {
             this.orgToken = void 0;
+            this.orgTokenOrgUuid = void 0;
             throw retryError;
           }
         }
         if (response.status === 401) {
           const orgAuthInfo = parseOrgAuthChallenge(response.headers.get("WWW-Authenticate"));
+          if (orgAuthInfo && this.orgToken && this.orgTokenOrgUuid && this.orgTokenOrgUuid !== orgAuthInfo.orgUuid) {
+            this.orgToken = void 0;
+            this.orgTokenOrgUuid = void 0;
+          }
           if (orgAuthInfo && !this.orgToken) {
             const requestCookieName = orgAuthInfo.cookieName.replace(
-              "orgToken",
+              /^orgToken/,
               "requestOrgToken"
             );
             const cachedOrgToken = getCookieValue(requestCookieName);
             if (cachedOrgToken) {
               this.orgToken = cachedOrgToken;
+              this.orgTokenOrgUuid = orgAuthInfo.orgUuid;
               try {
                 return await this.fetchRaw(endpoint, options, allowedErrorStatuses);
               } catch (retryError) {
                 this.orgToken = void 0;
+                this.orgTokenOrgUuid = void 0;
                 throw retryError;
               }
             }
             if (this.orgAuthHandler) {
-              await this.orgAuthHandler(orgAuthInfo);
-              throw new ApiError("Organization authentication required", 401);
+              if (!this.orgAuthInProgress) {
+                const handler = this.orgAuthHandler;
+                this.orgAuthInProgress = (async () => {
+                  try {
+                    await handler(orgAuthInfo);
+                  } finally {
+                    this.orgAuthInProgress = null;
+                  }
+                })();
+              }
+              await this.orgAuthInProgress;
+              const postHandlerToken = getCookieValue(requestCookieName) ?? this.orgToken;
+              if (!postHandlerToken) {
+                throw new ApiError(
+                  "Organization authentication did not issue a token",
+                  401
+                );
+              }
+              this.orgToken = postHandlerToken;
+              this.orgTokenOrgUuid = orgAuthInfo.orgUuid;
+              try {
+                return await this.fetchRaw(endpoint, options, allowedErrorStatuses);
+              } catch (retryError) {
+                this.orgToken = void 0;
+                this.orgTokenOrgUuid = void 0;
+                throw retryError;
+              }
             }
           }
         }
@@ -2719,7 +2760,7 @@ ${formattedErrors}`, response.status);
    * Fetch from root path (not prefixed with /api/v2/)
    * Used for OAuth and other non-API endpoints
    */
-  async fetchRoot(path, options) {
+  async fetchRoot(path4, options) {
     try {
       const headers2 = new Headers({
         ...options?.body instanceof FormData ? {} : { "Content-Type": "application/json" },
@@ -2739,7 +2780,7 @@ ${formattedErrors}`, response.status);
       if (this.orgToken) {
         headers2.set("X-Org-Token", this.orgToken);
       }
-      const fullUrl = `${this.baseUrl}/${path}`;
+      const fullUrl = `${this.baseUrl}/${path4}`;
       const response = await this.fetchFunction(fullUrl, {
         ...options,
         ...this.apiKey ? {} : { credentials: "include" },
@@ -3106,7 +3147,8 @@ var AssignmentsApi = class extends BaseApiClient {
     if (options.sortOrder) params.append("sortOrder", options.sortOrder);
     if (options.mine) params.append("mine", options.mine.toString());
     if (options.taskId) params.append("taskId", options.taskId.toString());
-    if (options.memberId) params.append("memberId", options.memberId.toString());
+    if (options.memberId !== void 0)
+      params.append("memberId", options.memberId.toString());
     if (options.status) params.append("status", options.status);
     return this.fetch(
       `w/${wid}/assignments${params.toString() ? `?${params.toString()}` : ""}`
@@ -3897,6 +3939,8 @@ var ChatsApi = class extends BaseApiClient {
     if (options.filters && options.filters.length > 0) {
       params.append("filters", JSON.stringify(options.filters));
     }
+    if (options.createdAfter) params.append("createdAfter", options.createdAfter);
+    if (options.createdBefore) params.append("createdBefore", options.createdBefore);
     return params;
   }
   /** List chats with optional filtering, sorting, and pagination. */
@@ -5159,6 +5203,40 @@ var HealthieApi = class extends BaseApiClient {
       method: "DELETE"
     });
   }
+  async listHealthieAppointmentTypes(wid, providerId) {
+    const query = new URLSearchParams();
+    if (providerId) query.set("provider_id", providerId);
+    const qs = query.toString() ? `?${query.toString()}` : "";
+    return this.fetch(
+      `w/${wid}/app-connections/healthie/appointment-types${qs}`
+    );
+  }
+  async listHealthiePatients(wid, keywords) {
+    const query = new URLSearchParams();
+    if (keywords?.trim()) query.set("keywords", keywords.trim());
+    const qs = query.toString() ? `?${query.toString()}` : "";
+    return this.fetch(
+      `w/${wid}/app-connections/healthie/patients${qs}`
+    );
+  }
+  async getHealthieAvailableSlots(wid, request) {
+    return this.fetch(
+      `w/${wid}/app-connections/healthie/scheduling/available-slots`,
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      }
+    );
+  }
+  async bookHealthieAppointment(wid, request) {
+    return this.fetch(
+      `w/${wid}/app-connections/healthie/scheduling/book`,
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      }
+    );
+  }
 };
 var FilesApi = class extends BaseApiClient {
   /** List files in a workspace with optional folder filtering, sorting, and search. */
@@ -5422,10 +5500,17 @@ var InboxesApi = class extends BaseApiClient {
       method: "POST"
     });
   }
+  /** Reply to an email from the inbox. */
+  async replyToEmail(wid, inboxId, emailId, content) {
+    return this.fetch(`w/${wid}/inboxes/${inboxId}/emails/${emailId}/reply`, {
+      method: "POST",
+      body: JSON.stringify({ content })
+    });
+  }
   /** Convert an email to text, markdown, or PDF format. */
-  async convertEmail(wid, emailId, format = "pdf") {
+  async convertEmail(wid, inboxId, emailId, format = "pdf") {
     return this.fetch(
-      `w/${wid}/inboxes/emails/${emailId}/convert?format=${format}`,
+      `w/${wid}/inboxes/${inboxId}/emails/${emailId}/convert?format=${format}`,
       {
         method: "POST"
       }
@@ -5596,6 +5681,19 @@ var AppConnectionsApi = class extends BaseApiClient {
       { method: "DELETE" }
     );
   }
+  /**
+   * List distinct ``MemberField.key`` values scoped to a connection
+   * (GRA-2920). Drives the Monday custom-match "Custom fields" picker.
+   *
+   * Returns only the set of keys already in use on this connection;
+   * values are intentionally never exposed. Operators can also add a
+   * new key via the UI's "Add custom field key" free-text action.
+   */
+  async listConnectionMemberFieldKeys(wid, connectionId) {
+    return this.fetch(
+      `w/${wid}/app-connections/${connectionId}/member-field-keys`
+    );
+  }
 };
 var McpServersApi = class extends BaseApiClient {
   /**
@@ -6210,33 +6308,6 @@ var MondayIntegrationApi = class extends BaseApiClient {
     );
     return { columns };
   }
-  /**
-   * Create a webhook in Monday.com
-   */
-  async createWebhook(wid, params) {
-    return this.fetch(`w/${wid}/app-connections/monday/webhooks`, {
-      method: "POST",
-      body: JSON.stringify(params)
-    });
-  }
-  /**
-   * Delete a webhook from Monday.com
-   */
-  async deleteWebhook(wid, webhookId) {
-    return this.fetch(
-      `w/${wid}/app-connections/monday/webhooks/${webhookId}`,
-      { method: "DELETE" }
-    );
-  }
-  /**
-   * Get details of a specific webhook from Monday.com
-   * Returns 404 if the webhook no longer exists
-   */
-  async getWebhook(wid, boardId, webhookId) {
-    return this.fetch(
-      `w/${wid}/app-connections/monday/boards/${boardId}/webhooks/${webhookId}`
-    );
-  }
   /**
    * Get groups for a specific Monday.com board
    */
@@ -6843,6 +6914,53 @@ var OrgApi = class extends BaseApiClient {
       body: JSON.stringify({ sampleMessages })
     });
   }
+  // ============================================================================
+  // Organization Business Profile API (Twilio Trust Hub Secondary CP)
+  // ============================================================================
+  /**
+   * Live fetch of the org's Twilio Customer Profile + related entities.
+   *
+   * Response carries both the lifecycle `status` and the compliance
+   * `evaluationStatus`. Twilio models lifecycle and evaluation as two
+   * separate enums on two separate resources, so the Submit-button gate
+   * is `evaluationStatus === 'compliant'` — never `status === 'compliant'`,
+   * which is impossible (lifecycle status is one of `draft` /
+   * `pending-review` / `in-review` / `twilio-approved` / `twilio-rejected`).
+   */
+  async getBusinessProfile(orgUuid) {
+    return this.fetch(`o/${orgUuid}/business-profile`);
+  }
+  /**
+   * Upsert the org's business profile. Idempotent via cached SIDs.
+   * Returns a fresh BusinessProfileResponse on success — including the
+   * compliance evaluation result so the frontend can immediately enable
+   * Submit without a second round-trip.
+   */
+  async updateBusinessProfile(orgUuid, data) {
+    return this.fetch(`o/${orgUuid}/business-profile`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  /**
+   * Submit the business profile to Twilio for review. Server re-evaluates
+   * compliance live and returns 412 if the profile is not currently
+   * `compliant`; returns 409 if a review is already in flight.
+   */
+  async submitBusinessProfile(orgUuid) {
+    return this.fetch(`o/${orgUuid}/business-profile/submit`, {
+      method: "POST"
+    });
+  }
+  /**
+   * Cancel an in-flight Twilio review. Resets the cached profile state
+   * to `draft` so the user can edit and resubmit.
+   */
+  async cancelBusinessProfile(orgUuid) {
+    return this.fetch(`o/${orgUuid}/business-profile/cancel`, {
+      method: "POST"
+    });
+  }
   /**
    * List available member roles for a workspace in the organization.
    */
@@ -6876,22 +6994,22 @@ var OAuthConnectionsApi = class extends BaseApiClient {
    * Get the connection status for an OAuth provider
    */
   async getConnectionStatus(providerSlug) {
-    const path = getOAuthPath(providerSlug, "status");
-    return this.fetchRoot(path);
+    const path4 = getOAuthPath(providerSlug, "status");
+    return this.fetchRoot(path4);
   }
   /**
    * Get the authorization URL to start OAuth flow
    */
   async getAuthorizationUrl(providerSlug) {
-    const path = getOAuthPath(providerSlug, "authorize");
-    return this.fetchRoot(path);
+    const path4 = getOAuthPath(providerSlug, "authorize");
+    return this.fetchRoot(path4);
   }
   /**
    * Disconnect an OAuth provider
    */
   async disconnect(providerSlug) {
-    const path = getOAuthPath(providerSlug, "disconnect");
-    return this.fetchRoot(path, { method: "DELETE" });
+    const path4 = getOAuthPath(providerSlug, "disconnect");
+    return this.fetchRoot(path4, { method: "DELETE" });
   }
 };
 var OAuthApi = class extends BaseApiClient {
@@ -7186,15 +7304,15 @@ var PronunciationsApi = class extends BaseApiClient {
 };
 var PromptsApi = class extends BaseApiClient {
   /** Inspect the full composed prompt for a task (static) or chat (live). */
-  async inspectPrompt(wid, taskId, options = {}) {
+  async inspectPrompt(wid, options) {
     const params = new URLSearchParams();
-    if (options.chatId) {
+    if (options.chatId !== void 0) {
       params.append("chat_id", options.chatId.toString());
-    } else {
-      params.append("task_id", taskId.toString());
+    } else if (options.taskId !== void 0) {
+      params.append("task_id", options.taskId.toString());
     }
     if (options.channel) params.append("channel", options.channel);
-    if (options.turn) params.append("turn", options.turn.toString());
+    if (options.turn !== void 0) params.append("turn", options.turn.toString());
     return this.fetch(`w/${wid}/prompts/inspect?${params}`);
   }
 };
@@ -7537,7 +7655,8 @@ var ConnectionSyncApi = class extends BaseApiClient {
         dryRun: options?.dryRun ?? false,
         resetCheckpoints: options?.resetCheckpoints ?? false,
         ...options?.entityType ? { entityType: options.entityType } : {},
-        ...options?.boardId ? { boardId: options.boardId } : {}
+        ...options?.boardId ? { boardId: options.boardId } : {},
+        ...typeof options?.recordLimit === "number" ? { recordLimit: options.recordLimit } : {}
       })
     });
   }
@@ -7556,6 +7675,19 @@ var ConnectionSyncApi = class extends BaseApiClient {
       `w/${wid}/app-connections/${connectionId}/sync/runs/${runId}/items?limit=${limit}`
     );
   }
+  /**
+   * Clear a manual-unlink exclusion for a member on a connection so
+   * subsequent outbound syncs stop silently skipping them. Idempotent:
+   * returns ``cleared=false`` when no matching exclusion exists.
+   * ``boardId`` is only meaningful for multi-scope connectors (Monday).
+   */
+  async clearConnectionMemberExclusion(wid, connectionId, memberId, options) {
+    const query = options?.boardId ? `?board_id=${encodeURIComponent(options.boardId)}` : "";
+    return this.fetch(
+      `w/${wid}/app-connections/${connectionId}/member-exclusions/${memberId}${query}`,
+      { method: "DELETE" }
+    );
+  }
 };
 var HubspotApi = class extends BaseApiClient {
   async configureHubspot(wid, data) {
@@ -7922,6 +8054,96 @@ var SubscriptionsApi = class extends BaseApiClient {
     });
   }
 };
+function supportRequestParams(params) {
+  const searchParams = new URLSearchParams();
+  if (params?.page) searchParams.append("page", params.page.toString());
+  if (params?.pageSize) searchParams.append("pageSize", params.pageSize.toString());
+  if (params?.status) searchParams.append("status", params.status);
+  if (params?.supportRequestType) {
+    searchParams.append("supportRequestType", params.supportRequestType);
+  }
+  if (params?.severity) searchParams.append("severity", params.severity);
+  if (params?.source) searchParams.append("source", params.source);
+  if (params?.organizationId !== void 0) {
+    searchParams.append("organizationId", params.organizationId.toString());
+  }
+  if (params?.workspaceId !== void 0) {
+    searchParams.append("workspaceId", params.workspaceId.toString());
+  }
+  if (params?.linearLinked !== void 0) {
+    searchParams.append("linearLinked", params.linearLinked.toString());
+  }
+  const query = searchParams.toString();
+  return query ? `?${query}` : "";
+}
+var SupportRequestsApi = class extends BaseApiClient {
+  async listSupportRequests(params) {
+    return this.fetch(
+      `support-requests${supportRequestParams(params)}`
+    );
+  }
+  async getSupportRequest(uuid) {
+    return this.fetch(`support-requests/${uuid}`);
+  }
+  async createSupportRequest(data) {
+    return this.fetch("support-requests", {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async commentOnSupportRequest(uuid, data) {
+    return this.fetch(`support-requests/${uuid}/comments`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async listOrgSupportRequests(orgUuid, params) {
+    return this.fetch(
+      `o/${orgUuid}/support-requests${supportRequestParams(params)}`
+    );
+  }
+  async getOrgSupportRequest(orgUuid, uuid) {
+    return this.fetch(`o/${orgUuid}/support-requests/${uuid}`);
+  }
+  async createOrgSupportRequest(orgUuid, data) {
+    return this.fetch(`o/${orgUuid}/support-requests`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async commentOnOrgSupportRequest(orgUuid, uuid, data) {
+    return this.fetch(`o/${orgUuid}/support-requests/${uuid}/comments`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async listWorkspaceSupportRequests(workspaceUuid, params) {
+    return this.fetch(
+      `w/${workspaceUuid}/support-requests${supportRequestParams(params)}`
+    );
+  }
+  async getWorkspaceSupportRequest(workspaceUuid, uuid) {
+    return this.fetch(`w/${workspaceUuid}/support-requests/${uuid}`);
+  }
+  async createWorkspaceSupportRequest(workspaceUuid, data) {
+    return this.fetch(`w/${workspaceUuid}/support-requests`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async commentOnWorkspaceSupportRequest(workspaceUuid, uuid, data) {
+    return this.fetch(`w/${workspaceUuid}/support-requests/${uuid}/comments`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async closeWorkspaceSupportRequest(workspaceUuid, uuid, data = {}) {
+    return this.fetch(`w/${workspaceUuid}/support-requests/${uuid}/close`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+};
 var CustomersApi = class extends BaseApiClient {
   async getMyCustomers() {
     return this.fetch("customers");
@@ -7935,8 +8157,8 @@ var CustomersApi = class extends BaseApiClient {
   async getMyCustomerSubscriptions(uuid, opts) {
     const params = new URLSearchParams();
     if (opts?.status) params.set("status", opts.status);
-    if (opts?.page) params.set("page", String(opts.page));
-    if (opts?.pageSize) params.set("page_size", String(opts.pageSize));
+    if (opts?.page !== void 0) params.set("page", String(opts.page));
+    if (opts?.pageSize !== void 0) params.set("page_size", String(opts.pageSize));
     const qs = params.toString();
     return this.fetch(`customers/${uuid}/subscriptions${qs ? "?" + qs : ""}`);
   }
@@ -7973,6 +8195,16 @@ var CustomersApi = class extends BaseApiClient {
       method: "PUT"
     });
   }
+  async getMyCustomerCreditGrants(uuid, opts) {
+    const params = new URLSearchParams();
+    if (opts?.subscriptionId !== void 0) {
+      params.set("subscription_id", String(opts.subscriptionId));
+    }
+    if (opts?.page !== void 0) params.set("page", String(opts.page));
+    if (opts?.pageSize !== void 0) params.set("page_size", String(opts.pageSize));
+    const qs = params.toString();
+    return this.fetch(`customers/${uuid}/credit-grants${qs ? "?" + qs : ""}`);
+  }
 };
 var ResellersApi = class extends BaseApiClient {
   async getMyResellers() {
@@ -8195,6 +8427,14 @@ var JourneysApi = class extends BaseApiClient {
       method: "DELETE"
     });
   }
+  /**
+   * Get Journey Health diagnostics — authoring issues and runtime
+   * failures for a single journey. PHI-safe: response carries IDs,
+   * counts, error_type strings, and timestamps only.
+   */
+  async getJourneyHealth(wid, journeyId) {
+    return this.fetch(`w/${wid}/journeys/${journeyId}/health`);
+  }
   /** Create a step within a journey. */
   async createStep(wid, journeyId, data) {
     return this.fetch(`w/${wid}/journeys/${journeyId}/steps`, {
@@ -8262,6 +8502,13 @@ var JourneysApi = class extends BaseApiClient {
     if (params?.page) qs.set("page", String(params.page));
     if (params?.pageSize) qs.set("pageSize", String(params.pageSize));
     if (params?.search) qs.set("search", params.search);
+    if (params?.status) qs.set("status", params.status);
+    if (params?.enrolledAfter) qs.set("enrolledAfter", params.enrolledAfter);
+    if (params?.enrolledBefore) qs.set("enrolledBefore", params.enrolledBefore);
+    if (params?.currentTaskId !== void 0)
+      qs.set("currentTaskId", String(params.currentTaskId));
+    if (params?.runtimeFailureEdgeId !== void 0)
+      qs.set("runtimeFailureEdgeId", String(params.runtimeFailureEdgeId));
     const query = qs.toString();
     return this.fetch(
       `w/${wid}/journeys/${journeyId}/members${query ? `?${query}` : ""}`
@@ -8282,10 +8529,10 @@ var JourneysApi = class extends BaseApiClient {
     });
   }
   /** Re-enroll a canceled member back to enrolled status. */
-  async reenrollMember(wid, journeyId, memberId) {
+  async reenrollMember(wid, journeyId, data) {
     return this.fetch(`w/${wid}/journeys/${journeyId}/reenroll`, {
       method: "POST",
-      body: JSON.stringify({ memberId })
+      body: JSON.stringify(data)
     });
   }
   /** Hard-delete a canceled enrollment so the member can be re-enrolled fresh. */
@@ -8298,6 +8545,18 @@ var JourneysApi = class extends BaseApiClient {
   async getMemberJourneys(wid, memberId) {
     return this.fetch(`w/${wid}/journeys/by-member/${memberId}`);
   }
+  /**
+   * Dry-run heartbeat CEL evaluation for an enrolled member.
+   *
+   * Evaluates all PENDING steps exactly as the heartbeat would, but writes no
+   * state changes. Returns step-by-step results for debugging stuck members.
+   */
+  async testRunJourney(wid, journeyId, memberId) {
+    return this.fetch(
+      `w/${wid}/journeys/${journeyId}/members/${memberId}/test-run`,
+      { method: "POST" }
+    );
+  }
   // ===== JOURNEY NOTES =====
   /** List notes for a journey. */
   async getJourneyNotes(wid, journeyId) {
@@ -8448,6 +8707,30 @@ var WorkflowsApi = class extends BaseApiClient {
       `w/${wid}/workflows/${workflowId}/validate-config`
     );
   }
+  /**
+   * Replay automatic routing for a Chat without performing the transition.
+   *
+   * Operator tool: returns a PHI-safe trace describing what the
+   * automatic-edge evaluator would do at the next turn. Never returns
+   * raw CEL, Form values, Member values, Chat content, or raw
+   * exception strings — only IDs, status labels, and the exception
+   * class name when the evaluator raises.
+   *
+   * Requires Workflow edit permission.
+   */
+  async getWorkflowRouteDryRun(wid, workflowId, args) {
+    const params = new URLSearchParams();
+    params.set("chat_id", String(args.chatId));
+    if (args.currentTaskId !== void 0) {
+      params.set("current_task_id", String(args.currentTaskId));
+    }
+    if (args.currentAssignmentTaskId !== void 0) {
+      params.set("current_assignment_task_id", String(args.currentAssignmentTaskId));
+    }
+    return this.fetch(
+      `w/${wid}/workflows/${workflowId}/route-dry-run?${params.toString()}`
+    );
+  }
   // Workflow Contributors API
   /** List all contributors for a workflow. */
   async getWorkflowContributors(wid, workflowId) {
@@ -8594,6 +8877,33 @@ var WorkflowNotesApi = class extends BaseApiClient {
     });
   }
 };
+var EventRuleEventType = /* @__PURE__ */ ((EventRuleEventType2) => {
+  EventRuleEventType2["TASK_EXECUTE"] = "task:execute";
+  EventRuleEventType2["MEMBER_JOINED"] = "workspace:member_joined";
+  EventRuleEventType2["MEMBER_LEFT"] = "workspace:member_left";
+  EventRuleEventType2["DATA_RECORD_CREATED"] = "data_record:created";
+  EventRuleEventType2["DATA_RECORD_UPDATED"] = "data_record:updated";
+  EventRuleEventType2["CHAT_CREATED"] = "chat:created";
+  EventRuleEventType2["CHAT_CALLBACK"] = "chat:callback";
+  EventRuleEventType2["MEMBER_UPDATED"] = "member:updated";
+  EventRuleEventType2["ROUTINE_TRIGGERED"] = "routine:triggered";
+  EventRuleEventType2["ASSISTANT_MESSAGE"] = "workflow:assistant_message";
+  EventRuleEventType2["USER_MESSAGE"] = "workflow:user_message";
+  EventRuleEventType2["CALENDAR_EVENT_CREATED"] = "calendar_event:created";
+  EventRuleEventType2["CALENDAR_EVENT_UPDATED"] = "calendar_event:updated";
+  EventRuleEventType2["CALENDAR_EVENT_CANCELLED"] = "calendar_event:cancelled";
+  EventRuleEventType2["CALENDAR_EVENT_STARTING"] = "calendar_event:starting";
+  EventRuleEventType2["CALENDAR_EVENT_ENDED"] = "calendar_event:ended";
+  EventRuleEventType2["CONNECTOR_EVENT"] = "connector:event";
+  EventRuleEventType2["ASSIGNMENT_CONCLUDED"] = "assignment:concluded";
+  EventRuleEventType2["JOURNEY_STEP_EXECUTE"] = "journey_step:execute";
+  EventRuleEventType2["JOURNEY_ENROLLED"] = "journey:enrolled";
+  EventRuleEventType2["JOURNEY_COMPLETED"] = "journey:completed";
+  EventRuleEventType2["CALL_STARTED"] = "call:started";
+  EventRuleEventType2["CALL_COMPLETED"] = "call:completed";
+  EventRuleEventType2["CALL_SUMMARY"] = "call:summary";
+  return EventRuleEventType2;
+})(EventRuleEventType || {});
 var WorkspaceInvitationsApi = class extends BaseApiClient {
   /**
    * List user's own invitations (both org and workspace).
@@ -9051,6 +9361,66 @@ var WorkspacesApi = class extends BaseApiClient {
     return this.fetch(`w/${wid}/usage/dashboard`);
   }
 };
+var TeamsAppsApi = class extends BaseApiClient {
+  /**
+   * List all Teams apps configured for a workspace.
+   */
+  async getTeamsApps(wid, options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    if (options.sortBy) params.append("sortBy", options.sortBy);
+    if (options.sortOrder) params.append("sortOrder", options.sortOrder);
+    if (options.search) params.append("search", options.search);
+    return this.fetch(
+      `w/${wid}/app-connections/teams/apps${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+  async getTeamsApp(wid, appId) {
+    return this.fetch(`w/${wid}/app-connections/teams/apps/${appId}`);
+  }
+  async createTeamsApp(wid, data) {
+    return this.fetch(`w/${wid}/app-connections/teams/apps`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateTeamsApp(wid, appId, data) {
+    return this.fetch(`w/${wid}/app-connections/teams/apps/${appId}`, {
+      method: "PUT",
+      body: JSON.stringify(data)
+    });
+  }
+  async deleteTeamsApp(wid, appId) {
+    return this.fetch(`w/${wid}/app-connections/teams/apps/${appId}`, {
+      method: "DELETE"
+    });
+  }
+  async getTeamsConversations(wid, appId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    return this.fetch(
+      `w/${wid}/app-connections/teams/apps/${appId}/conversations${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+  async getTeamsInstallations(wid, appId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    return this.fetch(
+      `w/${wid}/app-connections/teams/apps/${appId}/installations${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+  async getTeamsAppAccounts(wid, appId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.page) params.append("page", options.page.toString());
+    if (options.pageSize) params.append("pageSize", options.pageSize.toString());
+    return this.fetch(
+      `w/${wid}/app-connections/teams/apps/${appId}/accounts${params.toString() ? `?${params.toString()}` : ""}`
+    );
+  }
+};
 function createApiModules(apiKey, baseUrl3, customFetch) {
   return {
     abilities: new AbilitiesApi(apiKey, baseUrl3, customFetch),
@@ -9073,6 +9443,7 @@ function createApiModules(apiKey, baseUrl3, customFetch) {
     dataTypes: new DataTypesApi(apiKey, baseUrl3, customFetch),
     discordBots: new DiscordBotsApi(apiKey, baseUrl3, customFetch),
     slackApps: new SlackAppsApi(apiKey, baseUrl3, customFetch),
+    teamsApps: new TeamsAppsApi(apiKey, baseUrl3, customFetch),
     events: new EventsApi(apiKey, baseUrl3, customFetch),
     fhirConnections: new FhirConnectionsApi(apiKey, baseUrl3, customFetch),
     healthie: new HealthieApi(apiKey, baseUrl3, customFetch),
@@ -9102,6 +9473,7 @@ function createApiModules(apiKey, baseUrl3, customFetch) {
     salesforce: new SalesforceApi(apiKey, baseUrl3, customFetch),
     sites: new SitesApi(apiKey, baseUrl3, customFetch),
     subscriptions: new SubscriptionsApi(apiKey, baseUrl3, customFetch),
+    supportRequests: new SupportRequestsApi(apiKey, baseUrl3, customFetch),
     supervisors: new SupervisorsApi(apiKey, baseUrl3, customFetch),
     tasks: new TasksApi(apiKey, baseUrl3, customFetch),
     templates: new TemplatesApi(apiKey, baseUrl3, customFetch),
@@ -9598,6 +9970,7 @@ function bindCommunicationsMethods(target, phoneNumbers, inboxes, notificationRu
   target.getInboxThreads = inboxes.getInboxThreads.bind(inboxes);
   target.getThreadEmails = inboxes.getThreadEmails.bind(inboxes);
   target.getChatEmails = inboxes.getChatEmails.bind(inboxes);
+  target.replyToEmail = inboxes.replyToEmail.bind(inboxes);
   target.getNotificationRules = notificationRules.getNotificationRules.bind(notificationRules);
   target.createNotificationRule = notificationRules.createNotificationRule.bind(notificationRules);
   target.updateNotificationRule = notificationRules.updateNotificationRule.bind(notificationRules);
@@ -9689,13 +10062,10 @@ function bindAppsMethods(target, apps, builders, inquiries, oauth, oauthConnecti
   target.getOAuthAuthorizationUrl = oauthConnections.getAuthorizationUrl.bind(oauthConnections);
   target.disconnectOAuthProvider = oauthConnections.disconnect.bind(oauthConnections);
 }
-function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackApps, fhirConnections, healthie, salesforce, hubspot, appConnections, connectionSync, confluence) {
+function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackApps, teamsApps, fhirConnections, healthie, salesforce, hubspot, appConnections, connectionSync, confluence) {
   target.getMondayBoards = mondayIntegration.getBoards.bind(mondayIntegration);
   target.getMondayBoardColumns = mondayIntegration.getBoardColumns.bind(mondayIntegration);
   target.getMondayBoardGroups = mondayIntegration.getBoardGroups.bind(mondayIntegration);
-  target.createMondayWebhook = mondayIntegration.createWebhook.bind(mondayIntegration);
-  target.deleteMondayWebhook = mondayIntegration.deleteWebhook.bind(mondayIntegration);
-  target.getMondayWebhook = mondayIntegration.getWebhook.bind(mondayIntegration);
   target.getMondayCurrentUserInfo = mondayIntegration.getCurrentUserInfo.bind(mondayIntegration);
   target.configureMondayConnection = mondayIntegration.configureMondayConnection.bind(mondayIntegration);
   target.getMondayConnectionStatus = mondayIntegration.getMondayConnectionStatus.bind(mondayIntegration);
@@ -9739,6 +10109,14 @@ function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackAp
   target.getSlackThreads = slackApps.getSlackThreads.bind(slackApps);
   target.getSlackInstallations = slackApps.getSlackInstallations.bind(slackApps);
   target.getSlackAppAccounts = slackApps.getSlackAppAccounts.bind(slackApps);
+  target.getTeamsApps = teamsApps.getTeamsApps.bind(teamsApps);
+  target.getTeamsApp = teamsApps.getTeamsApp.bind(teamsApps);
+  target.createTeamsApp = teamsApps.createTeamsApp.bind(teamsApps);
+  target.updateTeamsApp = teamsApps.updateTeamsApp.bind(teamsApps);
+  target.deleteTeamsApp = teamsApps.deleteTeamsApp.bind(teamsApps);
+  target.getTeamsConversations = teamsApps.getTeamsConversations.bind(teamsApps);
+  target.getTeamsInstallations = teamsApps.getTeamsInstallations.bind(teamsApps);
+  target.getTeamsAppAccounts = teamsApps.getTeamsAppAccounts.bind(teamsApps);
   target.getFhirConnections = fhirConnections.getFhirConnections.bind(fhirConnections);
   target.getFhirConnection = fhirConnections.getFhirConnection.bind(fhirConnections);
   target.getFhirConnectionByUuid = fhirConnections.getFhirConnectionByUuid.bind(fhirConnections);
@@ -9779,6 +10157,10 @@ function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackAp
   target.getHealthieReconciliationMatches = healthie.getHealthieReconciliationMatches.bind(healthie);
   target.linkMemberToHealthie = healthie.linkMemberToHealthie.bind(healthie);
   target.unlinkMemberFromHealthie = healthie.unlinkMemberFromHealthie.bind(healthie);
+  target.listHealthieAppointmentTypes = healthie.listHealthieAppointmentTypes.bind(healthie);
+  target.listHealthiePatients = healthie.listHealthiePatients.bind(healthie);
+  target.getHealthieAvailableSlots = healthie.getHealthieAvailableSlots.bind(healthie);
+  target.bookHealthieAppointment = healthie.bookHealthieAppointment.bind(healthie);
   target.configureConfluence = confluence.configureConfluence.bind(confluence);
   target.startConfluenceOAuth = confluence.startConfluenceOAuth.bind(confluence);
   target.getConfluenceStatus = confluence.getConfluenceStatus.bind(confluence);
@@ -9831,12 +10213,14 @@ function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackAp
   target.getSyncRuns = connectionSync.getSyncRuns.bind(connectionSync);
   target.getSyncRunItems = connectionSync.getSyncRunItems.bind(connectionSync);
   target.getMemberSyncSummary = connectionSync.getMemberSyncSummary.bind(connectionSync);
+  target.clearConnectionMemberExclusion = connectionSync.clearConnectionMemberExclusion.bind(connectionSync);
   target.listAvailableAppConnections = appConnections.listAvailableAppConnections.bind(appConnections);
   target.listAppConnections = appConnections.listAppConnections.bind(appConnections);
   target.enablePlatformApp = appConnections.enablePlatformApp.bind(appConnections);
   target.getPlatformApp = appConnections.getPlatformApp.bind(appConnections);
   target.updatePlatformApp = appConnections.updatePlatformApp.bind(appConnections);
   target.deletePlatformApp = appConnections.deletePlatformApp.bind(appConnections);
+  target.listConnectionMemberFieldKeys = appConnections.listConnectionMemberFieldKeys.bind(appConnections);
 }
 function bindOperatorMethods(target, operatorGroups) {
   target.getOperatorGroups = operatorGroups.getOperatorGroups.bind(operatorGroups);
@@ -9866,6 +10250,10 @@ function bindOrgMethods(target, org) {
   target.getOrgDomainSite = org.getOrgDomainSite.bind(org);
   target.verifyOrgDomainSite = org.verifyOrgDomainSite.bind(org);
   target.disableOrgDomainSite = org.disableOrgDomainSite.bind(org);
+  target.getBusinessProfile = org.getBusinessProfile.bind(org);
+  target.updateBusinessProfile = org.updateBusinessProfile.bind(org);
+  target.submitBusinessProfile = org.submitBusinessProfile.bind(org);
+  target.cancelBusinessProfile = org.cancelBusinessProfile.bind(org);
 }
 function bindPronunciationsMethods(target, pronunciations) {
   target.getPronunciationEntries = pronunciations.getPronunciationEntries.bind(pronunciations);
@@ -9885,6 +10273,7 @@ function bindPronunciationsMethods(target, pronunciations) {
 function bindJourneysMethods(target, journeys) {
   target.getJourneys = journeys.getJourneys.bind(journeys);
   target.getJourney = journeys.getJourney.bind(journeys);
+  target.getJourneyHealth = journeys.getJourneyHealth.bind(journeys);
   target.createJourney = journeys.createJourney.bind(journeys);
   target.updateJourney = journeys.updateJourney.bind(journeys);
   target.archiveJourney = journeys.archiveJourney.bind(journeys);
@@ -9903,6 +10292,7 @@ function bindJourneysMethods(target, journeys) {
   target.reenrollMember = journeys.reenrollMember.bind(journeys);
   target.deleteEnrollment = journeys.deleteEnrollment.bind(journeys);
   target.getMemberJourneys = journeys.getMemberJourneys.bind(journeys);
+  target.testRunJourney = journeys.testRunJourney.bind(journeys);
   target.getJourneyNotes = journeys.getJourneyNotes.bind(journeys);
   target.createJourneyNote = journeys.createJourneyNote.bind(journeys);
   target.updateJourneyNote = journeys.updateJourneyNote.bind(journeys);
@@ -9942,6 +10332,7 @@ function bindCustomersMethods(target, customers) {
   target.attachMyCustomerPaymentMethod = customers.attachMyCustomerPaymentMethod.bind(customers);
   target.detachMyCustomerPaymentMethod = customers.detachMyCustomerPaymentMethod.bind(customers);
   target.setDefaultMyCustomerPaymentMethod = customers.setDefaultMyCustomerPaymentMethod.bind(customers);
+  target.getMyCustomerCreditGrants = customers.getMyCustomerCreditGrants.bind(customers);
 }
 function bindResellersMethods(target, resellers) {
   target.getMyResellers = resellers.getMyResellers.bind(resellers);
@@ -9954,6 +10345,21 @@ function bindResellersMethods(target, resellers) {
 function bindPromptsMethods(target, prompts) {
   target.inspectPrompt = prompts.inspectPrompt.bind(prompts);
 }
+function bindSupportRequestMethods(target, supportRequests) {
+  target.listSupportRequests = supportRequests.listSupportRequests.bind(supportRequests);
+  target.getSupportRequest = supportRequests.getSupportRequest.bind(supportRequests);
+  target.createSupportRequest = supportRequests.createSupportRequest.bind(supportRequests);
+  target.commentOnSupportRequest = supportRequests.commentOnSupportRequest.bind(supportRequests);
+  target.listOrgSupportRequests = supportRequests.listOrgSupportRequests.bind(supportRequests);
+  target.getOrgSupportRequest = supportRequests.getOrgSupportRequest.bind(supportRequests);
+  target.createOrgSupportRequest = supportRequests.createOrgSupportRequest.bind(supportRequests);
+  target.commentOnOrgSupportRequest = supportRequests.commentOnOrgSupportRequest.bind(supportRequests);
+  target.listWorkspaceSupportRequests = supportRequests.listWorkspaceSupportRequests.bind(supportRequests);
+  target.getWorkspaceSupportRequest = supportRequests.getWorkspaceSupportRequest.bind(supportRequests);
+  target.createWorkspaceSupportRequest = supportRequests.createWorkspaceSupportRequest.bind(supportRequests);
+  target.commentOnWorkspaceSupportRequest = supportRequests.commentOnWorkspaceSupportRequest.bind(supportRequests);
+  target.closeWorkspaceSupportRequest = supportRequests.closeWorkspaceSupportRequest.bind(supportRequests);
+}
 var GravityRailClient = class {
   // WorkspaceInvitations is exposed publicly for backward compatibility
   workspaceInvitations;
@@ -10127,6 +10533,7 @@ var GravityRailClient = class {
   // Journeys API
   getJourneys;
   getJourney;
+  getJourneyHealth;
   createJourney;
   updateJourney;
   archiveJourney;
@@ -10145,6 +10552,7 @@ var GravityRailClient = class {
   reenrollMember;
   deleteEnrollment;
   getMemberJourneys;
+  testRunJourney;
   getJourneyNotes;
   createJourneyNote;
   updateJourneyNote;
@@ -10234,6 +10642,10 @@ var GravityRailClient = class {
   getOrgDomainSite;
   verifyOrgDomainSite;
   disableOrgDomainSite;
+  getBusinessProfile;
+  updateBusinessProfile;
+  submitBusinessProfile;
+  cancelBusinessProfile;
   getVapidPublicKey;
   registerPushSubscription;
   unregisterPushSubscription;
@@ -10507,6 +10919,7 @@ var GravityRailClient = class {
   getInboxThreads;
   getThreadEmails;
   getChatEmails;
+  replyToEmail;
   getNotificationRules;
   createNotificationRule;
   updateNotificationRule;
@@ -10598,9 +11011,6 @@ var GravityRailClient = class {
   getMondayBoards;
   getMondayBoardColumns;
   getMondayBoardGroups;
-  createMondayWebhook;
-  deleteMondayWebhook;
-  getMondayWebhook;
   getMondayCurrentUserInfo;
   // Monday.com Connection API
   configureMondayConnection;
@@ -10647,6 +11057,15 @@ var GravityRailClient = class {
   getSlackThreads;
   getSlackInstallations;
   getSlackAppAccounts;
+  // Teams Apps API
+  getTeamsApps;
+  getTeamsApp;
+  createTeamsApp;
+  updateTeamsApp;
+  deleteTeamsApp;
+  getTeamsConversations;
+  getTeamsInstallations;
+  getTeamsAppAccounts;
   // FHIR Connections API
   getFhirConnections;
   getFhirConnection;
@@ -10689,6 +11108,10 @@ var GravityRailClient = class {
   getHealthieReconciliationMatches;
   linkMemberToHealthie;
   unlinkMemberFromHealthie;
+  listHealthieAppointmentTypes;
+  listHealthiePatients;
+  getHealthieAvailableSlots;
+  bookHealthieAppointment;
   // Confluence API
   configureConfluence;
   startConfluenceOAuth;
@@ -10745,6 +11168,7 @@ var GravityRailClient = class {
   getSyncRuns;
   getSyncRunItems;
   getMemberSyncSummary;
+  clearConnectionMemberExclusion;
   // App Connections API
   listAvailableAppConnections;
   listAppConnections;
@@ -10752,6 +11176,7 @@ var GravityRailClient = class {
   getPlatformApp;
   updatePlatformApp;
   deletePlatformApp;
+  listConnectionMemberFieldKeys;
   // Pronunciations API
   getPronunciationEntries;
   createPronunciationEntry;
@@ -10778,6 +11203,7 @@ var GravityRailClient = class {
   attachMyCustomerPaymentMethod;
   detachMyCustomerPaymentMethod;
   setDefaultMyCustomerPaymentMethod;
+  getMyCustomerCreditGrants;
   // Resellers API (self-service reseller portal)
   getMyResellers;
   getMyReseller;
@@ -10785,6 +11211,20 @@ var GravityRailClient = class {
   getMyResellerProducts;
   getMyResellerSubscriptions;
   updateMyReseller;
+  // Support Requests API
+  listSupportRequests;
+  getSupportRequest;
+  createSupportRequest;
+  commentOnSupportRequest;
+  listOrgSupportRequests;
+  getOrgSupportRequest;
+  createOrgSupportRequest;
+  commentOnOrgSupportRequest;
+  listWorkspaceSupportRequests;
+  getWorkspaceSupportRequest;
+  createWorkspaceSupportRequest;
+  commentOnWorkspaceSupportRequest;
+  closeWorkspaceSupportRequest;
   constructor(apiKey, baseUrl3, customFetch) {
     const apis = createApiModules(apiKey, baseUrl3, customFetch);
     this.apis = apis;
@@ -10834,6 +11274,7 @@ var GravityRailClient = class {
       apis.mondayIntegration,
       apis.discordBots,
       apis.slackApps,
+      apis.teamsApps,
       apis.fhirConnections,
       apis.healthie,
       apis.salesforce,
@@ -10845,6 +11286,7 @@ var GravityRailClient = class {
     bindPronunciationsMethods(this, apis.pronunciations);
     bindCustomersMethods(this, apis.customers);
     bindResellersMethods(this, apis.resellers);
+    bindSupportRequestMethods(this, apis.supportRequests);
   }
   /**
    * Set the handler for enhanced authentication requirements (RFC 9470 Step-Up Auth).
@@ -10872,6 +11314,24 @@ var GravityRailClient = class {
       }
     });
   }
+  /**
+   * Set the org token for cross-domain / non-browser clients (e.g. CLI).
+   * When set, all API requests include the X-Org-Token header so the backend
+   * accepts the request without requiring a browser cookie.
+   *
+   * `orgUuid` is the org that issued the token. Pass it so the SDK can
+   * detect a stale token (e.g. switching orgs mid-session) and re-fire the
+   * org-auth handler instead of silently 401-ing.
+   *
+   * Propagates to all API modules.
+   */
+  setOrgToken(token, orgUuid) {
+    Object.values(this.apis).forEach((api) => {
+      if (typeof api.setOrgToken === "function") {
+        api.setOrgToken(token, orgUuid);
+      }
+    });
+  }
   /**
    * Update the API key across all modules.
    * Used after successful re-authentication.
@@ -10926,14 +11386,74 @@ var BUILTIN_ASSISTANT_CHAT_TYPES = /* @__PURE__ */ new Set([
 ]);
 
 // ../client/dist/index.mjs
+function supportRequestParams2(params) {
+  const searchParams = new URLSearchParams();
+  if (params?.page) searchParams.append("page", params.page.toString());
+  if (params?.pageSize) searchParams.append("pageSize", params.pageSize.toString());
+  if (params?.status) searchParams.append("status", params.status);
+  if (params?.supportRequestType) {
+    searchParams.append("supportRequestType", params.supportRequestType);
+  }
+  if (params?.severity) searchParams.append("severity", params.severity);
+  if (params?.source) searchParams.append("source", params.source);
+  if (params?.organizationId !== void 0) {
+    searchParams.append("organizationId", params.organizationId.toString());
+  }
+  if (params?.workspaceId !== void 0) {
+    searchParams.append("workspaceId", params.workspaceId.toString());
+  }
+  if (params?.linearLinked !== void 0) {
+    searchParams.append("linearLinked", params.linearLinked.toString());
+  }
+  const query = searchParams.toString();
+  return query ? `?${query}` : "";
+}
 var AdminApi = class extends BaseApiClient {
-  // Admin Accounts API
-  async getAccounts(options) {
-    const params = new URLSearchParams();
-    if (options.search) params.append("search", options.search);
-    if (options.createdAfter) params.append("created_after", options.createdAfter);
-    if (options.createdBefore) params.append("created_before", options.createdBefore);
-    if (options.sortBy) params.append("sortBy", options.sortBy);
+  // Support Requests API
+  async listSupportRequestsAsAdmin(params) {
+    return this.fetch(
+      `admin/support-requests${supportRequestParams2(params)}`
+    );
+  }
+  async getSupportRequestAsAdmin(uuid) {
+    return this.fetch(`admin/support-requests/${uuid}`);
+  }
+  async commentOnSupportRequestAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/comments`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async noteOnSupportRequestAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/notes`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateSupportRequestStatusAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/status`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async updateSupportRequestAttributesAsAdmin(uuid, data) {
+    return this.fetch(`admin/support-requests/${uuid}/attributes`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async createSupportRequestLinearIssueAsAdmin(uuid) {
+    return this.fetch(`admin/support-requests/${uuid}/linear-issue`, {
+      method: "POST"
+    });
+  }
+  // Admin Accounts API
+  async getAccounts(options) {
+    const params = new URLSearchParams();
+    if (options.search) params.append("search", options.search);
+    if (options.createdAfter) params.append("created_after", options.createdAfter);
+    if (options.createdBefore) params.append("created_before", options.createdBefore);
+    if (options.sortBy) params.append("sortBy", options.sortBy);
     if (options.sortOrder) params.append("sortOrder", options.sortOrder);
     if (options.page) params.append("page", options.page.toString());
     if (options.pageSize) params.append("pageSize", options.pageSize.toString());
@@ -11065,11 +11585,11 @@ var AdminApi = class extends BaseApiClient {
     return this.fetch(`o/${idOrUuid}`);
   }
   /**
-   * Get organization by numeric ID via admin endpoint.
+   * Get organization by numeric ID or UUID via admin endpoint.
    * Does NOT require organization membership — superuser-only.
    */
-  async getOrganizationAsAdmin(id) {
-    return this.fetch(`admin/organizations/${id}`);
+  async getOrganizationAsAdmin(idOrUuid) {
+    return this.fetch(`admin/organizations/${idOrUuid}`);
   }
   async getOrganizationMembersAsAdmin(organizationId, options) {
     const params = new URLSearchParams();
@@ -11246,6 +11766,26 @@ var AdminApi = class extends BaseApiClient {
       body: JSON.stringify(request || {})
     });
   }
+  /**
+   * Switch a workspace's plan product on its active SubscriptionItem.
+   *
+   * Superuser only. Re-syncs ``workspace.features`` from the new product
+   * and emits a ``WORKSPACE_PRODUCT_CHANGED`` audit event identifying the
+   * actor, target workspace, prior and new product, and feature diff.
+   *
+   * Stripe is not touched here; price-id changes belong to the dedicated
+   * Stripe sync surface (``syncProductToStripe``).
+   */
+  async changeWorkspaceProduct(workspaceUuid, productId) {
+    const body = { productId };
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/product`,
+      {
+        method: "POST",
+        body: JSON.stringify(body)
+      }
+    );
+  }
   // ===== Workflow Access Validation =====
   async validateWorkflowAccessAsAdmin(workspaceUuid) {
     const params = new URLSearchParams();
@@ -11278,6 +11818,11 @@ var AdminApi = class extends BaseApiClient {
       body: JSON.stringify(data)
     });
   }
+  async unarchiveAdminWorkspaceMember(wid) {
+    return this.fetch(`admin/workspaces/${wid}/me/unarchive`, {
+      method: "POST"
+    });
+  }
   async getAdminWorkspaceMemberRoles(wid) {
     return this.fetch(`admin/workspaces/${wid}/member-roles`);
   }
@@ -11289,8 +11834,8 @@ var AdminApi = class extends BaseApiClient {
       `admin/phone-numbers/workspace/${workspaceId}/unmapped`
     );
   }
-  async getWorkspacePhoneNumbersAsAdmin(workspaceId) {
-    return this.fetch(`admin/workspace/${workspaceId}/phone-numbers`);
+  async getWorkspacePhoneNumbersAsAdmin(workspaceRef) {
+    return this.fetch(`admin/workspaces/${workspaceRef}/phone-numbers`);
   }
   // Phone Numbers API (Provider phone numbers from Twilio, AWS, etc.)
   async getProviderPhoneNumbers(options = {}) {
@@ -11399,6 +11944,11 @@ var AdminApi = class extends BaseApiClient {
       method: "DELETE"
     });
   }
+  async getWorkspaceInboxesAsAdmin(workspaceUuid) {
+    return this.fetch(
+      `admin/workspaces/${workspaceUuid}/inboxes`
+    );
+  }
   // Admin Inbox Mappings API
   async getInboxMappings(options = {}) {
     const params = new URLSearchParams();
@@ -11443,21 +11993,30 @@ var AdminApi = class extends BaseApiClient {
       })
     });
   }
-  // Admin Themes API
-  async listAllThemes() {
-    return this.fetch("admin/themes/list");
-  }
-  // One-off Redis cadence-key migration (periodiq_* → routine_*). See
-  // lib/routes/admin/admin_routine_cadence_api.py for context.
-  async migrateRoutineCadenceKeys(options) {
-    return this.fetch("admin/redis/routine-cadence/migrate", {
+  /**
+   * Resolve a Langfuse trace UI URL from a trace ID, chat ID, or message ID.
+   *
+   * URL-only: never fetches Langfuse payloads, Message content, or
+   * tool arguments. Exactly one of ``traceId``, ``chatId``, or
+   * ``messageId`` must be set; chat/message forms require a
+   * workspaceUuid. See
+   * docs/development/observability/llm-call-investigation.md.
+   */
+  async getTraceUrl(options) {
+    return this.fetch("admin/trace/url", {
       method: "POST",
       body: JSON.stringify({
-        dryRun: options.dryRun ?? true,
-        deleteLegacy: options.deleteLegacy ?? false
+        trace_id: options.traceId,
+        chat_id: options.chatId,
+        message_id: options.messageId,
+        workspace_uuid: options.workspaceUuid
       })
     });
   }
+  // Admin Themes API
+  async listAllThemes() {
+    return this.fetch("admin/themes/list");
+  }
   // Missing Memberships API
   async getMissingMemberships(workspaceId) {
     return this.fetch(
@@ -12030,6 +12589,13 @@ function appendTemporalWorkspaceParams(params, options) {
   push(options.workspaceUuid);
 }
 function bindAdminMethods(target, admin) {
+  target.listSupportRequestsAsAdmin = admin.listSupportRequestsAsAdmin.bind(admin);
+  target.getSupportRequestAsAdmin = admin.getSupportRequestAsAdmin.bind(admin);
+  target.commentOnSupportRequestAsAdmin = admin.commentOnSupportRequestAsAdmin.bind(admin);
+  target.noteOnSupportRequestAsAdmin = admin.noteOnSupportRequestAsAdmin.bind(admin);
+  target.updateSupportRequestStatusAsAdmin = admin.updateSupportRequestStatusAsAdmin.bind(admin);
+  target.updateSupportRequestAttributesAsAdmin = admin.updateSupportRequestAttributesAsAdmin.bind(admin);
+  target.createSupportRequestLinearIssueAsAdmin = admin.createSupportRequestLinearIssueAsAdmin.bind(admin);
   target.getAccounts = admin.getAccounts.bind(admin);
   target.getAccountDetails = admin.getAccountDetails.bind(admin);
   target.getAccountByUuid = admin.getAccountByUuid.bind(admin);
@@ -12078,11 +12644,13 @@ function bindAdminMethods(target, admin) {
   target.disableMaintenanceMode = admin.disableMaintenanceMode.bind(admin);
   target.getWorkspaceHealth = admin.getWorkspaceHealth.bind(admin);
   target.provisionPlanFeatures = admin.provisionPlanFeatures.bind(admin);
+  target.changeWorkspaceProduct = admin.changeWorkspaceProduct.bind(admin);
   target.validateWorkflowAccessAsAdmin = admin.validateWorkflowAccessAsAdmin.bind(admin);
   target.mergeMembers = admin.mergeMembers.bind(admin);
   target.getAdminWorkspaceMember = admin.getAdminWorkspaceMember.bind(admin);
   target.createAdminWorkspaceMember = admin.createAdminWorkspaceMember.bind(admin);
   target.updateAdminWorkspaceMember = admin.updateAdminWorkspaceMember.bind(admin);
+  target.unarchiveAdminWorkspaceMember = admin.unarchiveAdminWorkspaceMember.bind(admin);
   target.getAdminWorkspaceMemberRoles = admin.getAdminWorkspaceMemberRoles.bind(admin);
   target.getMissingMemberships = admin.getMissingMemberships.bind(admin);
   target.linkMissingMembership = admin.linkMissingMembership.bind(admin);
@@ -12113,8 +12681,8 @@ function bindAdminMethods(target, admin) {
   target.deleteAdminInboxMapping = admin.deleteAdminInboxMapping.bind(admin);
   target.generateChatSummaries = admin.generateChatSummaries.bind(admin);
   target.executeQuery = admin.executeQuery.bind(admin);
+  target.getTraceUrl = admin.getTraceUrl.bind(admin);
   target.listAllThemes = admin.listAllThemes.bind(admin);
-  target.migrateRoutineCadenceKeys = admin.migrateRoutineCadenceKeys.bind(admin);
   target.startBulkTOSAcceptance = admin.startBulkTOSAcceptance.bind(admin);
   target.startTokenUsageBackfill = admin.startTokenUsageBackfill.bind(admin);
   target.updateChatMessage = admin.updateChatMessage.bind(admin);
@@ -12174,6 +12742,7 @@ function bindAdminMethods(target, admin) {
   target.getVoiceMetrics = admin.getVoiceMetrics.bind(admin);
   target.getHealthMetrics = admin.getHealthMetrics.bind(admin);
   target.getHealthDetail = admin.getHealthDetail.bind(admin);
+  target.getWorkspaceInboxesAsAdmin = admin.getWorkspaceInboxesAsAdmin.bind(admin);
   target.listWorkspaceChats = admin.listWorkspaceChats.bind(admin);
   target.getWorkspaceChat = admin.getWorkspaceChat.bind(admin);
   target.rateWorkspaceChatMessage = admin.rateWorkspaceChatMessage.bind(admin);
@@ -12192,6 +12761,13 @@ function bindAdminMethods(target, admin) {
 }
 var ApiClient = class extends GravityRailClient {
   // Admin API
+  listSupportRequestsAsAdmin;
+  getSupportRequestAsAdmin;
+  commentOnSupportRequestAsAdmin;
+  noteOnSupportRequestAsAdmin;
+  updateSupportRequestStatusAsAdmin;
+  updateSupportRequestAttributesAsAdmin;
+  createSupportRequestLinearIssueAsAdmin;
   getAccounts;
   getAccountDetails;
   getAccountByUuid;
@@ -12240,11 +12816,13 @@ var ApiClient = class extends GravityRailClient {
   disableMaintenanceMode;
   getWorkspaceHealth;
   provisionPlanFeatures;
+  changeWorkspaceProduct;
   validateWorkflowAccessAsAdmin;
   mergeMembers;
   getAdminWorkspaceMember;
   createAdminWorkspaceMember;
   updateAdminWorkspaceMember;
+  unarchiveAdminWorkspaceMember;
   getAdminWorkspaceMemberRoles;
   getMissingMemberships;
   linkMissingMembership;
@@ -12275,8 +12853,8 @@ var ApiClient = class extends GravityRailClient {
   deleteAdminInboxMapping;
   generateChatSummaries;
   executeQuery;
+  getTraceUrl;
   listAllThemes;
-  migrateRoutineCadenceKeys;
   startBulkTOSAcceptance;
   startTokenUsageBackfill;
   updateChatMessage;
@@ -12330,6 +12908,7 @@ var ApiClient = class extends GravityRailClient {
   getVoiceMetrics;
   getHealthMetrics;
   getHealthDetail;
+  getWorkspaceInboxesAsAdmin;
   listWorkspaceChats;
   getWorkspaceChat;
   rateWorkspaceChatMessage;
@@ -12366,12 +12945,92 @@ var ApiClient = class extends GravityRailClient {
       this.adminApi.setActingMember(memberUuid);
     }
   }
+  // setOrgToken is intentionally NOT overridden here. Admin routes
+  // (/api/v2/admin/*) are protected by the bearer token's superuser claim and
+  // ignore X-Org-Token entirely, so propagating an org token to adminApi is
+  // dead code that would only obscure auth flow if admin route logic changes.
+};
+var ENVIRONMENTS = {
+  dev: {
+    apiUrl: "https://api.gravityrail.test:5054",
+    frontendUrl: "https://app.gravityrail.test:3000"
+  },
+  prod: {
+    apiUrl: "https://api.gravityrail.com",
+    frontendUrl: "https://app.gravityrail.com"
+  },
+  staging: {
+    apiUrl: "https://api.gr-staging.com",
+    frontendUrl: "https://app.gr-staging.com"
+  }
 };
-
-// src/cli-utils/config.ts
 var CALLBACK_PORT = 31337;
 var CALLBACK_PATH = "/oauth/callback";
 var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+function detectWorktreePorts() {
+  let dir = resolve(process.cwd());
+  let overridePath;
+  while (true) {
+    const candidate = join(dir, "docker-compose.override.yml");
+    if (existsSync(candidate)) {
+      overridePath = candidate;
+      break;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  if (!overridePath) return {};
+  let content;
+  try {
+    content = readFileSync(overridePath, "utf-8");
+  } catch {
+    return {};
+  }
+  if (!content.includes("worktree-setup.sh")) return {};
+  let apiPort;
+  let frontendPort;
+  for (const match of content.matchAll(/-\s*'(\d+):(\d+)'/g)) {
+    const host = parseInt(match[1], 10);
+    const container = parseInt(match[2], 10);
+    if (container === 5050) apiPort = host;
+    if (container === 3e3) frontendPort = host;
+  }
+  return { apiPort, frontendPort };
+}
+function getEnvironmentConfig(env) {
+  if (env.startsWith("dev-cloud:")) {
+    const namespace = env.slice("dev-cloud:".length);
+    if (!namespace) {
+      throw new Error("dev-cloud environment requires a namespace: --env dev-cloud:NAMESPACE");
+    }
+    return {
+      apiUrl: `https://${namespace}-api.gravityrail-dev.com`,
+      frontendUrl: `https://${namespace}-app.gravityrail-dev.com`
+    };
+  }
+  const config = ENVIRONMENTS[env];
+  if (!config) {
+    throw new Error(
+      `Invalid environment: ${env}. Use 'dev', 'staging', 'prod', or 'dev-cloud:NAMESPACE'.`
+    );
+  }
+  const apiUrl = process.env.GRAVITY_RAIL_API_URL || config.apiUrl;
+  const frontendUrl = process.env.GRAVITY_RAIL_FRONTEND_URL || config.frontendUrl;
+  if (apiUrl !== config.apiUrl || frontendUrl !== config.frontendUrl) {
+    return { apiUrl, frontendUrl };
+  }
+  if (env === "dev") {
+    const ports = detectWorktreePorts();
+    if (ports.apiPort || ports.frontendPort) {
+      return {
+        apiUrl: ports.apiPort ? `https://api.gravityrail.test:${ports.apiPort}` : config.apiUrl,
+        frontendUrl: ports.frontendPort ? `https://app.gravityrail.test:${ports.frontendPort}` : config.frontendUrl
+      };
+    }
+  }
+  return config;
+}
 var CredentialsManager = class {
   cacheDir;
   apiUrl;
@@ -12501,7 +13160,7 @@ function openBrowser(url) {
   });
 }
 function startCallbackServer() {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let authCode = null;
     let error = null;
     let receivedState = null;
@@ -12543,7 +13202,7 @@ function startCallbackServer() {
           </html>
         `);
         server.close();
-        resolve({ code: authCode, state: receivedState });
+        resolve2({ code: authCode, state: receivedState });
       } else {
         res.writeHead(400);
         res.end("Missing code parameter");
@@ -12735,7 +13394,7 @@ async function selectFromList(items, options = {}) {
     return { item: null, isNew: false };
   }
   const displayItems = allowNew ? [NEW_ITEM_MARKER, ...items] : items;
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let selectedIndex = allowNew ? 1 : 0;
     let filterText = "";
     const getFilteredItems = () => {
@@ -12818,16 +13477,16 @@ async function selectFromList(items, options = {}) {
         if (filtered.length > 0 && selectedIndex < filtered.length) {
           const selected = filtered[selectedIndex];
           if (selected === NEW_ITEM_MARKER) {
-            resolve({ item: null, isNew: true });
+            resolve2({ item: null, isNew: true });
           } else {
-            resolve({ item: selected, isNew: false });
+            resolve2({ item: selected, isNew: false });
           }
         } else {
-          resolve({ item: null, isNew: false });
+          resolve2({ item: null, isNew: false });
         }
       } else if (key.name === "escape" || key.ctrl && key.name === "c") {
         cleanup();
-        resolve({ item: null, isNew: false });
+        resolve2({ item: null, isNew: false });
       } else if (key.name === "backspace") {
         filterText = filterText.slice(0, -1);
         selectedIndex = allowNew ? 0 : 0;
@@ -12937,29 +13596,82 @@ function clearScreen() {
 // src/cli-utils/agui.ts
 var AGUIClient = class {
   endpointUrl;
+  baseUrl;
+  workspaceUuid;
+  chatId;
   accessToken;
   debug;
   model;
+  appContext;
   constructor(options) {
+    this.baseUrl = options.baseUrl;
+    this.workspaceUuid = options.workspaceUuid ?? "";
+    this.chatId = options.chatId ?? 0;
+    if (!options.endpointUrl && (!options.workspaceUuid || options.chatId === void 0)) {
+      throw new Error("AGUIClient requires workspaceUuid and chatId, or endpointUrl");
+    }
     this.endpointUrl = options.endpointUrl ?? `${options.baseUrl}/api/v2/w/${options.workspaceUuid}/web-chat/${options.chatId}/chat/agui`;
     this.accessToken = options.accessToken;
     this.debug = options.debug ?? false;
     this.model = "model" in options ? options.model : "manager";
+    this.appContext = options.appContext;
+  }
+  inferenceStatusUrl() {
+    if (!this.workspaceUuid || this.chatId <= 0) return null;
+    return `${this.baseUrl}/api/v2/w/${this.workspaceUuid}/chats/${this.chatId}/inference/status`;
+  }
+  async waitForInferenceInactive(maxWaitMs = 6e4) {
+    const url = this.inferenceStatusUrl();
+    if (!url) return false;
+    const deadline = Date.now() + maxWaitMs;
+    while (Date.now() < deadline) {
+      try {
+        const res = await fetch(url, {
+          headers: { Authorization: `Bearer ${this.accessToken}` }
+        });
+        if (res.ok) {
+          const body = await res.json();
+          if (!body.active) return true;
+        }
+      } catch (err) {
+        if (this.debug) {
+          console.log(
+            `[DEBUG] waitForInferenceInactive fetch failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+      await new Promise((r) => setTimeout(r, 2e3));
+    }
+    return false;
   }
   /**
    * Send messages and stream the response
    */
   async sendMessage(messages, onEvent, options) {
+    return this.streamRequest({ messages }, onEvent, options);
+  }
+  /**
+   * Stream an AG-UI request (initial messages or HITL resume).
+   */
+  async streamRequest(request, onEvent, options) {
     const body = JSON.stringify({
       ...this.model ? { model: this.model } : {},
-      messages,
+      messages: request.messages ?? [],
+      ...this.appContext ? { appContext: this.appContext } : {},
+      ...request.resumeValue !== void 0 ? { resumeValue: request.resumeValue } : {},
+      ...request.resumeInterruptId ? { resumeInterruptId: request.resumeInterruptId } : {},
       ...options?.autoApprove ? { context: { autoApprove: true } } : {}
     });
     if (this.debug) {
       console.log(`
 [DEBUG] POST ${this.endpointUrl}`);
-      console.log(`[DEBUG] Body: ${messages.length} message(s)`);
+      console.log(
+        `[DEBUG] Body: ${request.resumeValue !== void 0 ? "resume" : `${(request.messages ?? []).length} message(s)`}`
+      );
     }
+    await this.postStream(body, onEvent, options);
+  }
+  async postStream(body, onEvent, options, conflictRetries = 0) {
     const response = await fetch(this.endpointUrl, {
       method: "POST",
       headers: {
@@ -12972,12 +13684,21 @@ var AGUIClient = class {
     if (this.debug) {
       console.log(`[DEBUG] Response status: ${response.status}`);
     }
+    if (response.status === 409 && conflictRetries < 3) {
+      const ready = await this.waitForInferenceInactive();
+      if (ready) {
+        await this.postStream(body, onEvent, options, conflictRetries + 1);
+        return;
+      }
+    }
     if (!response.ok) {
       const errorText = await response.text().catch(() => "");
       if (this.debug) {
         console.log(`[DEBUG] Error response: ${errorText}`);
       }
-      throw new Error(`Chat request failed: ${response.status}`);
+      throw new Error(
+        `Chat request failed: ${response.status}${errorText ? `: ${errorText.slice(0, 200)}` : ""}`
+      );
     }
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
@@ -13108,8 +13829,129 @@ var COL = {
 function stderr2(msg) {
   process.stderr.write(msg + "\n");
 }
+var ORG_AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
+function extractOrgTokenFromSetCookies(setCookieValues, preferredCookieName) {
+  let fallback;
+  for (const value of setCookieValues) {
+    const nameValue = value.split(";")[0]?.trim() ?? "";
+    const eqIdx = nameValue.indexOf("=");
+    if (eqIdx === -1) continue;
+    const name = nameValue.slice(0, eqIdx).trim();
+    const tokenValue = nameValue.slice(eqIdx + 1).trim() || void 0;
+    if (!tokenValue) continue;
+    if (name === preferredCookieName) return tokenValue;
+    if (!fallback && (name.startsWith("orgToken") || name.startsWith("orgSession"))) {
+      fallback = tokenValue;
+    }
+  }
+  return fallback;
+}
+async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
+  const response = await fetch(`${apiUrl}/api/v2/o/${orgAuthInfo.orgUuid}/join`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: "{}"
+  });
+  if (response.status === 400) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error(`Org join failed (HTTP ${response.status})`);
+  }
+  const rawHeaders = response.headers;
+  const setCookies = rawHeaders.getSetCookie?.() ?? (rawHeaders.get("set-cookie") ? [rawHeaders.get("set-cookie")] : []);
+  if (setCookies.length === 0) {
+    throw new Error("Org join succeeded but no Set-Cookie header returned");
+  }
+  const orgToken = extractOrgTokenFromSetCookies(setCookies, orgAuthInfo.cookieName);
+  if (!orgToken) {
+    throw new Error("Org join succeeded but org token cookie not found in Set-Cookie");
+  }
+  return orgToken;
+}
+function isAllowedAuthUrl(url, apiUrl) {
+  try {
+    const parsed = new URL(url);
+    const api = new URL(apiUrl);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return false;
+    if (parsed.hostname === api.hostname) return true;
+    const lastTwo = (host) => {
+      const parts = host.split(".").filter(Boolean);
+      return parts.length >= 2 ? parts.slice(-2).join(".") : host;
+    };
+    const isIp = /^[0-9.]+$|^\[.*\]$/.test(parsed.hostname);
+    if (isIp) return false;
+    return lastTwo(parsed.hostname) === lastTwo(api.hostname);
+  } catch {
+    return false;
+  }
+}
+function openBrowser2(url) {
+  let command;
+  let args;
+  if (process.platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    command = "cmd.exe";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  execFile(command, args, (_err) => {
+  });
+}
+function registerOrgAuthHandler(apiClient, apiUrl, accessToken) {
+  apiClient.setOrgAuthHandler(async (orgAuthInfo) => {
+    try {
+      const orgToken = await tryDirectJoin(apiUrl, accessToken, orgAuthInfo);
+      if (orgToken !== null) {
+        apiClient.setOrgToken(orgToken, orgAuthInfo.orgUuid);
+        return;
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      stderr2(`Warning: org direct-join failed (${msg}); trying browser auth`);
+    }
+    if (!isAllowedAuthUrl(orgAuthInfo.authUrl, apiUrl)) {
+      throw new Error(
+        `Refusing to open organization auth URL: scheme/host does not match the configured API host. Re-run with the expected --api-url, or contact support.`
+      );
+    }
+    stderr2(`
+This workspace requires organization SSO authentication.`);
+    stderr2(`Opening browser to complete authentication...`);
+    stderr2(`  ${orgAuthInfo.authUrl}
+`);
+    stderr2(`If the browser does not open, visit the URL above manually.`);
+    stderr2(
+      `After signing in, re-run the command \u2014 the CLI cannot receive the SSO token directly.`
+    );
+    openBrowser2(orgAuthInfo.authUrl);
+    await new Promise((_, reject) => {
+      const t = setTimeout(
+        () => reject(
+          new Error(
+            "Organization authentication timed out.\nPlease complete authentication in the browser, then re-run the command."
+          )
+        ),
+        ORG_AUTH_TIMEOUT_MS
+      );
+      t.unref?.();
+    });
+  });
+}
 
 // src/lib/context.ts
+function makeApiClient(accessToken, apiUrl) {
+  const apiClient = new ApiClient(accessToken, apiUrl);
+  registerOrgAuthHandler(apiClient, apiUrl, accessToken);
+  return apiClient;
+}
 async function tryTokenRefresh(ctx, creds) {
   if (!creds.refreshToken) return null;
   const refreshed = await refreshAccessToken(
@@ -13119,7 +13961,7 @@ async function tryTokenRefresh(ctx, creds) {
     ctx.env
   );
   if (!refreshed?.accessToken) return null;
-  const apiClient = new ApiClient(refreshed.accessToken, ctx.envConfig.apiUrl);
+  const apiClient = makeApiClient(refreshed.accessToken, ctx.envConfig.apiUrl);
   return { ...ctx, accessToken: refreshed.accessToken, apiClient };
 }
 function requireAuth(ctx) {
@@ -13129,12 +13971,14 @@ function requireAuth(ctx) {
   return ctx;
 }
 function createPublicContext(opts) {
-  const apiUrl = opts.apiUrl || process.env.GRAVITY_RAIL_API_URL || "https://api.gravityrail.com";
-  const frontendUrl = opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com";
-  const envConfig = { apiUrl, frontendUrl };
-  const credentialsManager = new CredentialsManager(homedir(), apiUrl);
+  const env = opts.env ?? "prod";
+  const envConfig = opts.apiUrl ? {
+    apiUrl: opts.apiUrl,
+    frontendUrl: opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com"
+  } : getEnvironmentConfig(env);
+  const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
   return {
-    env: "prod",
+    env,
     envConfig,
     outputFormat: detectOutputFormat(opts.outputFormat),
     verbose: opts.verbose ?? false,
@@ -13146,7 +13990,7 @@ async function createPublicAuthenticatedContext(opts) {
   const ctx = createPublicContext(opts);
   const apiKey = process.env.GRAVITY_RAIL_API_KEY;
   if (apiKey) {
-    const apiClient = new ApiClient(apiKey, ctx.envConfig.apiUrl);
+    const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: apiKey, apiClient };
   }
   const creds = ctx.credentialsManager.load(ctx.env);
@@ -13154,7 +13998,7 @@ async function createPublicAuthenticatedContext(opts) {
     const buffer = 5 * 60 * 1e3;
     const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
     if (notExpired) {
-      const apiClient = new ApiClient(creds.accessToken, ctx.envConfig.apiUrl);
+      const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
       return { ...ctx, accessToken: creds.accessToken, apiClient };
     }
     const refreshed = await tryTokenRefresh(ctx, creds);
@@ -13183,32 +14027,48 @@ async function readJsonInput(args) {
       throw new CLIError(`Cannot read file: ${filePath}`);
     }
   }
-  if (!process.stdin.isTTY) {
-    return readStdin();
+  if (process.stdin.isTTY === true) {
+    return void 0;
   }
-  return void 0;
+  return readStdinIfPiped();
 }
-function readStdin() {
-  return new Promise((resolve, reject) => {
+function readStdinIfPiped() {
+  return new Promise((resolve2, reject) => {
     let data = "";
-    process.stdin.setEncoding("utf-8");
-    process.stdin.on("data", (chunk) => {
-      data += chunk;
-    });
-    process.stdin.on("end", () => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve2(value);
+    };
+    const flush = () => {
       if (!data.trim()) {
-        resolve(void 0);
+        finish(void 0);
         return;
       }
       try {
-        resolve(JSON.parse(data));
+        finish(JSON.parse(data));
       } catch {
         reject(new CLIError("Invalid JSON from stdin"));
       }
+    };
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
     });
+    process.stdin.on("end", flush);
     process.stdin.on("error", (err) => {
       reject(new CLIError(`Error reading stdin: ${err.message}`));
     });
+    process.stdin.resume();
+    setImmediate(() => {
+      if (data) return;
+      if (process.stdin.readableEnded) {
+        flush();
+        return;
+      }
+      finish(void 0);
+    });
   });
 }
 
@@ -13614,6 +14474,17 @@ function requireNumber(args, key) {
   if (isNaN(num)) throw new Error(`Argument --${key} must be a number`);
   return num;
 }
+function requireNumberFrom(args, ...keys) {
+  for (const key of keys) {
+    const val = args[key];
+    if (typeof val === "string") {
+      const num = Number(val);
+      if (!isNaN(num)) return num;
+    }
+  }
+  const hint = keys.map((k) => `--${k}`).join(" or ");
+  throw new Error(`Missing required argument: ${hint}`);
+}
 
 // src/domains/agent-tasks.ts
 var LIST_COLUMNS = [
@@ -13774,6 +14645,7 @@ var agentsDomain = {
 var COLUMNS2 = [
   COL.id(),
   COL.uuid(),
+  { header: "TYPE", getValue: (item) => item.chatType ?? item.chat_type ?? "" },
   { header: "MEMBER", getValue: (item) => item.member_name ?? String(item.member_id ?? "") },
   COL.status(),
   { header: "CHANNEL", getValue: (item) => item.channel ?? "" },
@@ -13825,7 +14697,11 @@ var chatsDomain = {
           isFlag: true
         },
         { name: "is-test", description: "Show only test chats", isFlag: true },
-        { name: "member-id", description: "Filter by member ID" }
+        { name: "member-id", description: "Filter by member ID" },
+        {
+          name: "chat-type",
+          description: "Filter by chat type (assignment, manager, developer, member, contributor). Default: assignment"
+        }
       ]
     }),
     // Messages
@@ -13834,7 +14710,7 @@ var chatsDomain = {
       description: "List messages for a chat. Use --limit/--offset to page; the API caps a single request at 100. Tool-call shell rows that the API filter excludes (parent_message_id IS NOT NULL or parent_call_id IS NOT NULL) are still hidden \u2014 use `gr chats inspect --id <chat>` for the full debug view.",
       requiresWorkspace: true,
       args: [
-        { name: "chat-id", description: "Chat ID", required: true },
+        { name: "chat-id", aliases: ["id"], description: "Chat ID", required: true },
         {
           name: "limit",
           description: "Max messages to return (1-100, default 100)"
@@ -13857,7 +14733,7 @@ var chatsDomain = {
         }
         const result2 = await requireAuth(ctx).apiClient.getChatMessages(
           workspace,
-          requireNumber(args, "chat-id"),
+          requireNumberFrom(args, "chat-id", "id"),
           limit,
           offset
         );
@@ -13870,7 +14746,7 @@ var chatsDomain = {
       mutates: true,
       requiresWorkspace: true,
       args: [
-        { name: "chat-id", description: "Chat ID", required: true },
+        { name: "chat-id", aliases: ["id"], description: "Chat ID", required: true },
         { name: "stream", description: "Stream the AI response via AG-UI", isFlag: true }
       ],
       handler: async ({ ctx, workspace, args, data }) => {
@@ -13879,7 +14755,7 @@ var chatsDomain = {
           throw new Error(
             `Message content is required (pass --data '"your message"' or --data '{"content":"your message"}')`
           );
-        const chatId = requireNumber(args, "chat-id");
+        const chatId = requireNumberFrom(args, "chat-id", "id");
         if (args.stream) {
           const aguiClient = new AGUIClient({
             baseUrl: ctx.envConfig.apiUrl,
@@ -13912,11 +14788,11 @@ var chatsDomain = {
       description: "Send an assistant message to a chat (does not trigger AI inference)",
       mutates: true,
       requiresWorkspace: true,
-      args: [{ name: "chat-id", description: "Chat ID", required: true }],
+      args: [{ name: "chat-id", aliases: ["id"], description: "Chat ID", required: true }],
       handler: async ({ ctx, workspace, args, data }) => {
         const result2 = await requireAuth(ctx).apiClient.sendAssistantMessage(
           workspace,
-          requireNumber(args, "chat-id"),
+          requireNumberFrom(args, "chat-id", "id"),
           data
         );
         outputSingle(result2, ctx, MESSAGE_COLUMNS2);
@@ -15957,8 +16833,8 @@ var dataTypesDomain = {
 var RULE_COLUMNS = [
   COL.id(),
   COL.name(),
-  { header: "EVENT", getValue: (item) => item.event_type ?? "" },
-  COL.enabled()
+  { header: "EVENT", getValue: (item) => item.eventType ?? "" },
+  { header: "ACTIVE", getValue: (item) => String(item.active ?? "") }
 ];
 var EVENT_COLUMNS2 = [
   COL.id(),
@@ -15966,29 +16842,33 @@ var EVENT_COLUMNS2 = [
   { header: "SLUG", getValue: (item) => item.slug ?? "" },
   COL.status()
 ];
-var eventRulesCrud = crudCommands({
+var eventRulesCrudNoList = crudCommands({
   prefix: ["events", "rules"],
   entityName: "event rule",
-  listMethod: "getEventRules",
   getMethod: "getEventRule",
   createMethod: "createEventRule",
   updateMethod: "updateEventRule",
   deleteMethod: "deleteEventRule",
-  // The endpoint is paginated and excludes nothing by object_type. Without
-  // 'full', the CLI silently returned only page 1 (default 25 rules), which
-  // hid routine/journey/calendar-scoped rules in workspaces with many
-  // task-scoped rules. 'full' wires up --page/--page-size and --all.
-  paginationSupport: "full",
   columns: RULE_COLUMNS,
   createExamples: [
     `gr events rules create -w $WID --data '{"name":"Label on step","objectType":"journey",`,
     '  "eventType":"journey_step:execute","actionType":"member:label",',
     `  "actionParams":{"addLabelIds":["<label-uuid>"]},"journeyStepId":<step-id>}'`,
     "",
+    "Scheduled outbound (routine \u2192 chat \u2192 voice/SMS):",
+    `gr events rules create -w $WID --allow-write --data '{"name":"AM voice check-in",`,
+    '  "objectType":"routine","eventType":"routine:triggered","actionType":"chat:create",',
+    '  "routineId":<routine-id>,',
+    '  "actionParams":{"workflowId":<workflow-id>,"channel":"phone-voice",',
+    `  "phoneNumberId":<workspace-phone-id>}}'`,
+    "",
+    '  PM SMS variant: use "channel":"phone-sms" and a second rule on the same routineId.',
+    "  Prereq: org phone assigned + gr phone-numbers link; workflow published with start task.",
+    "",
     "Required: objectType, eventType, actionType",
-    "Optional: name, actionParams, conditions (CEL), journeyStepId, delay (sec), order",
+    "Optional: name, actionParams, conditions (CEL), journeyStepId, routineId, delay (sec), order",
     "",
-    "Common eventTypes: journey_step:execute, journey:enrolled, journey:completed,",
+    "Common eventTypes: journey_step:execute, journey:enrolled, routine:triggered,",
     "  task:created, chat:created, data_record:created, member:created",
     "",
     "Common actionTypes: member:label, member:notify, webhook:send, email:send,",
@@ -15997,6 +16877,57 @@ var eventRulesCrud = crudCommands({
     'member:label actionParams: {"addLabelIds":["uuid"],"removeLabelIds":["uuid"]}'
   ]
 });
+var eventRulesListCmd = {
+  path: ["events", "rules", "list"],
+  description: "List event rules (use --journey-step-id or --event-type to filter)",
+  requiresWorkspace: true,
+  columns: RULE_COLUMNS,
+  args: [
+    { name: "journey-step-id", description: "Filter by journey step ID" },
+    { name: "event-type", description: "Filter by event type (e.g. journey_step:execute)" },
+    { name: "object-type", description: "Filter by object type (e.g. journey, task)" },
+    { name: "include-disabled", description: "Include inactive rules", isFlag: true },
+    { name: "page", description: "Page number (without filters)" },
+    { name: "page-size", description: "Page size (without filters)" },
+    {
+      name: "all",
+      description: "Fetch all pages (without filters)",
+      isFlag: true
+    }
+  ],
+  handler: async ({ ctx, workspace, args }) => {
+    const client = requireAuth(ctx).apiClient;
+    const journeyStepId = args["journey-step-id"] ? requireNumber(args, "journey-step-id") : void 0;
+    const eventType = args["event-type"];
+    const objectType = args["object-type"];
+    const includeDisabled = args["include-disabled"] === true;
+    if (journeyStepId !== void 0 || eventType !== void 0 || objectType !== void 0 || includeDisabled) {
+      const result3 = await client.searchEventRules(workspace, {
+        ...journeyStepId !== void 0 ? { journeyStepId } : {},
+        ...eventType ? { eventType } : {},
+        ...objectType ? { objectType } : {},
+        ...includeDisabled ? { includeDisabled: true } : {}
+      });
+      outputData(listResult(result3, false), ctx, RULE_COLUMNS);
+      return;
+    }
+    if (args["all"]) {
+      const allItems = await fetchAllPages(
+        async ({ page: page2, pageSize: pageSize2 }) => client.getEventRules(workspace, { page: page2, pageSize: pageSize2 })
+      );
+      outputData(allItems, ctx, RULE_COLUMNS);
+      return;
+    }
+    const page = args["page"] ? requireNumber(args, "page") : void 0;
+    const pageSize = args["page-size"] ? requireNumber(args, "page-size") : void 0;
+    const result2 = await client.getEventRules(workspace, {
+      ...page !== void 0 ? { page } : {},
+      ...pageSize !== void 0 ? { pageSize } : {}
+    });
+    outputData(listResult(result2, true), ctx, RULE_COLUMNS);
+  }
+};
+var eventRulesCrud = [eventRulesListCmd, ...eventRulesCrudNoList];
 var eventRulesAliases = eventRulesCrud.filter((cmd) => {
   const verb = cmd.path[cmd.path.length - 1];
   return verb === "list" || verb === "get";
@@ -16269,6 +17200,15 @@ var NOTE_COLUMNS2 = [
   { header: "CONTENT", getValue: (item) => (item.contents ?? "").slice(0, 60) },
   { header: "CREATED", getValue: (item) => item.createdAt ?? "" }
 ];
+var ACTION_COLUMNS = [
+  COL.id(),
+  { header: "UUID", getValue: (item) => (item.uuid ?? "").slice(0, 8) },
+  COL.name(),
+  { header: "EVENT", getValue: (item) => item.eventType ?? "" },
+  { header: "ACTION", getValue: (item) => item.actionType ?? "" },
+  { header: "ACTIVE", getValue: (item) => String(item.active ?? "") },
+  { header: "CONDITIONS", getValue: (item) => (item.conditions ?? "").slice(0, 40) }
+];
 function baseUrl(ctx, wid) {
   return `${ctx.envConfig.apiUrl}/api/v2/w/${wid}/journeys`;
 }
@@ -16983,6 +17923,70 @@ var journeysDomain = {
         process.stdout.write(`Deleted note ${noteId}
 `);
       }
+    },
+    // ── Step execute actions (event rules scoped to a step) ────────
+    {
+      path: ["journeys", "steps", "actions", "list"],
+      description: "List event rules (actions) attached to a journey step",
+      requiresWorkspace: true,
+      args: [
+        { name: "step-id", description: "Journey step ID (numeric)", required: true },
+        {
+          name: "include-disabled",
+          description: "Include inactive/disabled rules",
+          isFlag: true
+        }
+      ],
+      examples: [
+        "gr journeys steps actions list -w $WID --step-id <step-id>",
+        "gr journeys steps actions list -w $WID --step-id <step-id> --include-disabled"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const stepId = requireNumber(args, "step-id");
+        const includeDisabled = args["include-disabled"] === true;
+        const result2 = await requireAuth(ctx).apiClient.searchEventRules(workspace, {
+          eventType: EventRuleEventType.JOURNEY_STEP_EXECUTE,
+          journeyStepId: stepId,
+          ...includeDisabled ? { includeDisabled: true } : {}
+        });
+        outputData(listResult(result2, false), ctx, ACTION_COLUMNS);
+      }
+    },
+    {
+      path: ["journeys", "steps", "actions", "get"],
+      description: "Get a journey step action (event rule) by ID",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Event rule ID", required: true }],
+      examples: ["gr journeys steps actions get -w $WID --id <rule-id>"],
+      handler: async ({ ctx, workspace, args }) => {
+        const id = requireNumber(args, "id");
+        const result2 = await requireAuth(ctx).apiClient.getEventRule(workspace, id);
+        outputSingle(result2, ctx, ACTION_COLUMNS);
+      }
+    },
+    {
+      path: ["journeys", "steps", "actions", "update"],
+      description: "Update a journey step action \u2014 modify template, conditions, or active state",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Event rule ID", required: true }],
+      examples: [
+        "gr journeys steps actions update -w $WID --id <rule-id> \\",
+        `  --data '{"actionParams":{"messageTemplate":"Hello {{member.name}}"}}' --allow-write`,
+        "",
+        "Updatable fields: name, conditions (CEL), actionParams, active, delay, order",
+        "Non-updatable: objectType, eventType, actionType, journeyStepId"
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const id = requireNumber(args, "id");
+        const result2 = await requireAuth(ctx).apiClient.updateEventRule(
+          workspace,
+          id,
+          data
+        );
+        outputSingle(result2, ctx, ACTION_COLUMNS);
+      }
     }
   ]
 };
@@ -17608,6 +18612,13 @@ var COLUMNS16 = [
   { header: "PREFIX", getValue: (item) => item.prefix ?? "" },
   COL.created()
 ];
+var CREATE_COLUMNS = [
+  COL.id(),
+  COL.name(),
+  { header: "KEY", getValue: (item) => item.key ?? "" },
+  { header: "PREFIX", getValue: (item) => item.prefix ?? "" },
+  COL.created()
+];
 var apiKeysDomain = {
   name: "api-keys",
   description: "Manage API keys",
@@ -17628,7 +18639,10 @@ var apiKeysDomain = {
       requiresWorkspace: true,
       handler: async ({ ctx, workspace, data }) => {
         const result2 = await requireAuth(ctx).apiClient.createApiKey(workspace, data);
-        outputSingle(result2, ctx, COLUMNS16);
+        outputSingle(result2, ctx, CREATE_COLUMNS);
+        if (ctx.outputFormat === "table") {
+          process.stdout.write("\n\u26A0  This key will not be shown again. Copy it now.\n");
+        }
       }
     },
     {
@@ -17660,7 +18674,10 @@ var apiKeysDomain = {
       requiresWorkspace: false,
       handler: async ({ ctx, data }) => {
         const result2 = await requireAuth(ctx).apiClient.createGlobalApiKey(data);
-        outputSingle(result2, ctx, COLUMNS16);
+        outputSingle(result2, ctx, CREATE_COLUMNS);
+        if (ctx.outputFormat === "table") {
+          process.stdout.write("\n\u26A0  This key will not be shown again. Copy it now.\n");
+        }
       }
     },
     {
@@ -18134,7 +19151,7 @@ var conciergeDomain = {
       path: ["concierge", "messages"],
       description: "Show messages for a concierge chat",
       requiresWorkspace: false,
-      args: [{ name: "id", description: "Chat ID", required: true }],
+      args: [{ name: "id", aliases: ["chat-id"], description: "Chat ID", required: true }],
       handler: async ({ ctx, args }) => {
         const auth = requireAuth(ctx);
         const chatId = Number(args.id);
@@ -18566,7 +19583,7 @@ var milestonesDomain = {
 var COLUMNS23 = [
   COL.id(),
   COL.name(),
-  { header: "TYPE", getValue: (item) => item.type ?? "" },
+  { header: "TYPE", getValue: (item) => item.noticeType ?? "" },
   COL.enabled()
 ];
 var notificationRulesDomain = {
@@ -18767,15 +19784,15 @@ var DOMAIN_UUID_ARG = {
 function pluralize(count, singular, plural = `${singular}s`) {
   return count === 1 ? singular : plural;
 }
-function emailVerifyCommand(path, description) {
+function emailVerifyCommand(path4, description) {
   return {
-    path,
+    path: path4,
     description,
     mutates: true,
     requiresWorkspace: false,
     args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainEmail(
@@ -18786,15 +19803,15 @@ function emailVerifyCommand(path, description) {
     }
   };
 }
-function siteVerifyCommand(path, description) {
+function siteVerifyCommand(path4, description) {
   return {
-    path,
+    path: path4,
     description,
     mutates: true,
     requiresWorkspace: false,
     args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainSite(
@@ -18805,9 +19822,9 @@ function siteVerifyCommand(path, description) {
     }
   };
 }
-function registerDomainCommand(path) {
+function registerDomainCommand(path4) {
   return {
-    path,
+    path: path4,
     description: "Register an organization domain and return ownership TXT instructions",
     mutates: true,
     requiresWorkspace: false,
@@ -18816,7 +19833,7 @@ function registerDomainCommand(path) {
       { name: "domain", description: "Domain to register, e.g. example.com", required: true }
     ],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain example.com --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain example.com --allow-write`
     ],
     handler: async (hctx) => {
       const result2 = await requireAuth(hctx.ctx).apiClient.registerOrgDomain(
@@ -19170,6 +20187,12 @@ var commands2 = [
         workspaceUuid
       );
       outputSingle(result2, hctx.ctx, PROVIDER_PHONE_COLUMNS);
+      process.stdout.write(
+        `
+If workspace phone list is still empty, create a workspace phone record then:
+  gr phone-numbers link -w ${workspaceUuid} --id <workspace-phone-id> --provider-phone-uuid ${providerPhoneUuid} --allow-write
+`
+      );
     }
   },
   {
@@ -19273,6 +20296,31 @@ var phoneNumbersDomain = {
         outputData(result2, ctx, COLUMNS25);
       }
     },
+    {
+      path: ["phone-numbers", "link"],
+      description: "Link a workspace phone number to a provider (org) phone",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Workspace phone number ID",
+          required: true
+        },
+        { name: "provider-phone-uuid", description: "Provider phone UUID", required: true }
+      ],
+      examples: [
+        "gr phone-numbers link -w $WID --id 1 --provider-phone-uuid <uuid> --allow-write"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const auth = requireAuth(ctx);
+        const id = requireNumberFrom(args, "phone-number-id", "id");
+        const providerPhoneUuid = requireString(args, "provider-phone-uuid");
+        const result2 = await auth.apiClient.linkPhoneNumber(workspace, id, providerPhoneUuid);
+        outputData([result2], auth, COLUMNS25);
+      }
+    },
     {
       path: ["phone-numbers", "request"],
       description: "Request a phone number",
@@ -19291,7 +20339,12 @@ var phoneNumbersDomain = {
       description: "List calls for a phone number",
       requiresWorkspace: true,
       args: [
-        { name: "phone-number-id", description: "Phone number ID", required: true },
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Phone number ID",
+          required: true
+        },
         { name: "page", description: "Page number" },
         { name: "page-size", description: "Page size" },
         { name: "status", description: "Filter by status" }
@@ -19300,7 +20353,7 @@ var phoneNumbersDomain = {
         const status = args.status;
         const result2 = await requireAuth(ctx).apiClient.getPhoneNumberCalls(
           workspace,
-          requireNumber(args, "phone-number-id"),
+          requireNumberFrom(args, "phone-number-id", "id"),
           args.page ? Number(args.page) : void 0,
           args["page-size"] ? Number(args["page-size"]) : void 0,
           status ? { status } : void 0
@@ -19313,14 +20366,19 @@ var phoneNumbersDomain = {
       description: "List messages for a phone number",
       requiresWorkspace: true,
       args: [
-        { name: "phone-number-id", description: "Phone number ID", required: true },
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Phone number ID",
+          required: true
+        },
         { name: "page", description: "Page number" },
         { name: "page-size", description: "Page size" }
       ],
       handler: async ({ ctx, workspace, args }) => {
         const result2 = await requireAuth(ctx).apiClient.getPhoneNumberMessages(
           workspace,
-          requireNumber(args, "phone-number-id"),
+          requireNumberFrom(args, "phone-number-id", "id"),
           args.page ? Number(args.page) : void 0,
           args["page-size"] ? Number(args["page-size"]) : void 0
         );
@@ -19330,36 +20388,85 @@ var phoneNumbersDomain = {
   ]
 };
 
-// src/domains/pronunciations.ts
+// src/lib/resolve-org.ts
+async function resolveOrgUuidFromWorkspace(apiClient, workspaceUuid) {
+  const workspace = await apiClient.getWorkspace(workspaceUuid);
+  const orgUuid = workspace.organizationUuid;
+  if (!orgUuid) {
+    throw new CLIError(
+      "Workspace has no organization; pass --org-uuid for organization-scoped commands"
+    );
+  }
+  return orgUuid;
+}
+function normalizePronunciationCreatePayload(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CLIError("JSON body required with term and respelling (--data or --file)");
+  }
+  const raw = data;
+  const term = raw.term ?? raw.word;
+  const respelling = raw.respelling ?? raw.pronunciation;
+  if (typeof term !== "string" || !term) {
+    throw new CLIError("Payload requires term (alias: word)");
+  }
+  if (typeof respelling !== "string" || !respelling) {
+    throw new CLIError("Payload requires respelling (alias: pronunciation)");
+  }
+  const payload = { term, respelling };
+  if (raw.accountId !== void 0 && raw.accountId !== null) {
+    payload.accountId = Number(raw.accountId);
+  }
+  return payload;
+}
+function normalizePronunciationUpdatePayload(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CLIError("JSON body required (--data or --file)");
+  }
+  const raw = data;
+  const respelling = raw.respelling ?? raw.pronunciation;
+  if (typeof respelling !== "string" || !respelling) {
+    throw new CLIError("Payload requires respelling (alias: pronunciation)");
+  }
+  return { respelling };
+}
+
+// src/domains/pronunciations.ts
 var COLUMNS26 = [
   COL.id(),
-  { header: "WORD", getValue: (item) => item.word ?? "" },
-  { header: "PRONUNCIATION", getValue: (item) => item.pronunciation ?? "" },
-  { header: "TYPE", getValue: (item) => item.type ?? "" }
+  { header: "TERM", getValue: (item) => item.term ?? "" },
+  { header: "RESPELLING", getValue: (item) => item.respelling ?? "" },
+  { header: "SCOPE", getValue: (item) => item.scope ?? "" }
+];
+var CREATE_EXAMPLES = [
+  `gr pronunciations create -w $WID --data '{"term":"Jeeves","respelling":"JEEVZ"}' --allow-write`,
+  "  (aliases: word \u2192 term, pronunciation \u2192 respelling)"
 ];
 var pronunciationsDomain = {
   name: "pronunciations",
-  description: "Manage pronunciation entries",
+  description: "Manage pronunciation entries (org-scoped; -w resolves organization)",
   commands: [
     {
       path: ["pronunciations", "list"],
-      description: "List pronunciation entries",
+      description: "List pronunciation entries for the workspace organization",
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
-        const result2 = await requireAuth(ctx).apiClient.getPronunciationEntries(workspace);
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const result2 = await auth.apiClient.getPronunciationEntries(orgUuid);
         outputData(result2, ctx, COLUMNS26);
       }
     },
     {
       path: ["pronunciations", "create"],
-      description: "Create a pronunciation entry",
+      description: "Create a pronunciation entry (term + respelling)",
       mutates: true,
       requiresWorkspace: true,
+      examples: CREATE_EXAMPLES,
       handler: async ({ ctx, workspace, data }) => {
-        const result2 = await requireAuth(ctx).apiClient.createPronunciationEntry(
-          workspace,
-          data
-        );
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const payload = normalizePronunciationCreatePayload(data);
+        const result2 = await auth.apiClient.createPronunciationEntry(orgUuid, payload);
         outputSingle(result2, ctx, COLUMNS26);
       }
     },
@@ -19370,10 +20477,13 @@ var pronunciationsDomain = {
       requiresWorkspace: true,
       args: [{ name: "id", description: "Pronunciation entry ID", required: true }],
       handler: async ({ ctx, workspace, args, data }) => {
-        const result2 = await requireAuth(ctx).apiClient.updatePronunciationEntry(
-          workspace,
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const payload = normalizePronunciationUpdatePayload(data);
+        const result2 = await auth.apiClient.updatePronunciationEntry(
+          orgUuid,
           requireNumber(args, "id"),
-          data
+          payload
         );
         outputSingle(result2, ctx, COLUMNS26);
       }
@@ -19385,8 +20495,10 @@ var pronunciationsDomain = {
       requiresWorkspace: true,
       args: [{ name: "id", description: "Pronunciation entry ID", required: true }],
       handler: async ({ ctx, workspace, args }) => {
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
         const id = requireNumber(args, "id");
-        await requireAuth(ctx).apiClient.deletePronunciationEntry(workspace, id);
+        await auth.apiClient.deletePronunciationEntry(orgUuid, id);
         process.stdout.write(`Deleted pronunciation entry ${id}
 `);
       }
@@ -19406,7 +20518,8 @@ var pronunciationsDomain = {
       mutates: true,
       requiresWorkspace: true,
       handler: async ({ ctx, data }) => {
-        const result2 = await requireAuth(ctx).apiClient.createMyPronunciation(data);
+        const payload = normalizePronunciationCreatePayload(data);
+        const result2 = await requireAuth(ctx).apiClient.createMyPronunciation(payload);
         outputSingle(result2, ctx, COLUMNS26);
       }
     },
@@ -19414,11 +20527,17 @@ var pronunciationsDomain = {
       path: ["pronunciations", "suggest"],
       description: "Get pronunciation suggestions for a word",
       requiresWorkspace: true,
-      args: [{ name: "word", description: "Word to get suggestions for", required: true }],
+      args: [
+        {
+          name: "word",
+          aliases: ["term"],
+          description: "Word to get suggestions for",
+          required: true
+        }
+      ],
       handler: async ({ ctx, args }) => {
-        const result2 = await requireAuth(ctx).apiClient.suggestPronunciations(
-          requireString(args, "word")
-        );
+        const word = typeof args.word === "string" ? args.word : typeof args.term === "string" ? args.term : requireString(args, "word");
+        const result2 = await requireAuth(ctx).apiClient.suggestPronunciations(word);
         outputData(result2, ctx);
       }
     },
@@ -19584,20 +20703,20 @@ var promptsDomain = {
         "gr prompts inspect --chat-id 789 --turn 3"
       ],
       handler: async ({ ctx, workspace, args }) => {
-        const taskId = args["task-id"] ? requireNumber(args, "task-id") : void 0;
-        const chatId = args["chat-id"] ? requireNumber(args, "chat-id") : void 0;
-        if (!taskId && !chatId) {
+        const taskId = args["task-id"] !== void 0 ? requireNumber(args, "task-id") : void 0;
+        const chatId = args["chat-id"] !== void 0 ? requireNumber(args, "chat-id") : void 0;
+        if (taskId === void 0 && chatId === void 0) {
           throw new Error("Provide --task-id or --chat-id");
         }
-        if (taskId && chatId) {
+        if (taskId !== void 0 && chatId !== void 0) {
           throw new Error("Provide --task-id or --chat-id, not both");
         }
         const channel = args.channel || void 0;
-        const turn = args.turn ? requireNumber(args, "turn") : void 0;
-        const result2 = await requireAuth(ctx).apiClient.inspectPrompt(workspace, taskId ?? 0, {
-          channel,
-          ...chatId ? { chatId } : {},
-          ...turn ? { turn } : {}
+        const turn = args.turn !== void 0 ? requireNumber(args, "turn") : void 0;
+        const result2 = await requireAuth(ctx).apiClient.inspectPrompt(workspace, {
+          ...taskId !== void 0 ? { taskId } : { chatId },
+          ...channel ? { channel } : {},
+          ...turn !== void 0 ? { turn } : {}
         });
         outputSingle(result2, ctx);
       }
@@ -19605,6 +20724,128 @@ var promptsDomain = {
   ]
 };
 
+// src/domains/support.ts
+var SUPPORT_COLUMNS = [
+  COL.uuid(),
+  { header: "STATUS", getValue: (item) => item.status ?? "" },
+  { header: "TYPE", getValue: (item) => item.supportRequestType ?? "" },
+  { header: "SEVERITY", getValue: (item) => item.severity ?? "" },
+  { header: "SOURCE", getValue: (item) => item.source ?? "" },
+  { header: "CREATED", getValue: (item) => (item.createdAt ?? "").slice(0, 19) },
+  { header: "TITLE", getValue: (item) => item.title ?? "" }
+];
+var CONTEXT_ARGS = [
+  { name: "workspace", aliases: ["w"], description: "Workspace UUID" },
+  { name: "org-uuid", description: "Organization UUID" }
+];
+function listParams(args) {
+  return {
+    page: args.page ? Number(args.page) : void 0,
+    pageSize: args["page-size"] ? Number(args["page-size"]) : void 0,
+    status: args.status,
+    supportRequestType: args.type,
+    severity: args.severity,
+    source: args.source
+  };
+}
+function requestPayload(data, args) {
+  const input = data ?? {};
+  return {
+    supportRequestType: input.supportRequestType ?? input.support_request_type ?? args.type ?? "question",
+    title: input.title ?? requireString(args, "title"),
+    description: input.description ?? requireString(args, "description"),
+    severity: input.severity ?? args.severity
+  };
+}
+function commentPayload(data, args) {
+  const input = data ?? {};
+  return {
+    body: input.body ?? requireString(args, "body")
+  };
+}
+var supportDomain = {
+  name: "support",
+  description: "Manage support requests",
+  commands: [
+    {
+      path: ["support", "list"],
+      description: "List support requests",
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "status", description: "Filter by status" },
+        { name: "type", description: "Filter by type: bug, feature_request, question" },
+        { name: "severity", description: "Filter by severity" },
+        { name: "source", description: "Filter by source" },
+        { name: "page", description: "Page number" },
+        { name: "page-size", description: "Page size" }
+      ],
+      columns: SUPPORT_COLUMNS,
+      handler: async ({ ctx, args, workspace }) => {
+        const client = requireAuth(ctx).apiClient;
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const result2 = wid ? await client.listWorkspaceSupportRequests(wid, listParams(args)) : orgUuid ? await client.listOrgSupportRequests(orgUuid, listParams(args)) : await client.listSupportRequests(listParams(args));
+        outputData(result2, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "get"],
+      description: "Get a support request",
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "id", aliases: ["uuid"], description: "Support request UUID", required: true }
+      ],
+      handler: async ({ ctx, args, workspace }) => {
+        const client = requireAuth(ctx).apiClient;
+        const id = requireString(args, "id");
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const result2 = wid ? await client.getWorkspaceSupportRequest(wid, id) : orgUuid ? await client.getOrgSupportRequest(orgUuid, id) : await client.getSupportRequest(id);
+        outputSingle(result2, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "create"],
+      description: "Create a support request",
+      mutates: true,
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "type", description: "Request type: bug, feature_request, question" },
+        { name: "title", description: "Support request title" },
+        { name: "description", description: "Support request description" },
+        { name: "severity", description: "Optional severity" }
+      ],
+      handler: async ({ ctx, args, workspace, data }) => {
+        const client = requireAuth(ctx).apiClient;
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const payload = requestPayload(data, args);
+        const result2 = wid ? await client.createWorkspaceSupportRequest(wid, payload) : orgUuid ? await client.createOrgSupportRequest(orgUuid, payload) : await client.createSupportRequest(payload);
+        outputSingle(result2, ctx, SUPPORT_COLUMNS);
+      }
+    },
+    {
+      path: ["support", "comment"],
+      description: "Add a customer comment to a support request",
+      mutates: true,
+      args: [
+        ...CONTEXT_ARGS,
+        { name: "id", aliases: ["uuid"], description: "Support request UUID", required: true },
+        { name: "body", description: "Comment body" }
+      ],
+      handler: async ({ ctx, args, workspace, data }) => {
+        const client = requireAuth(ctx).apiClient;
+        const id = requireString(args, "id");
+        const wid = args.workspace ?? workspace;
+        const orgUuid = args["org-uuid"];
+        const payload = commentPayload(data, args);
+        const result2 = wid ? await client.commentOnWorkspaceSupportRequest(wid, id, payload) : orgUuid ? await client.commentOnOrgSupportRequest(orgUuid, id, payload) : await client.commentOnSupportRequest(id, payload);
+        outputSingle(result2, ctx, SUPPORT_COLUMNS);
+      }
+    }
+  ]
+};
+
 // src/domains/supervisors.ts
 var COLUMNS28 = [
   COL.id(),
@@ -19721,6 +20962,10 @@ var syncDomain = {
         {
           name: "board-id",
           description: "Scope to a single board mapping (requires --entity-type)"
+        },
+        {
+          name: "record-limit",
+          description: "Cap the run to a preview sample (1..200). Requires --dry-run and --entity-type."
         }
       ],
       examples: [
@@ -19729,7 +20974,8 @@ var syncDomain = {
         "sync run --connection-id 6 --full-resync",
         "sync run --connection-id 6 --quiet",
         "sync run --connection-id 6 --entity-type member",
-        "sync run --connection-id 6 --entity-type member --board-id 18406694561"
+        "sync run --connection-id 6 --entity-type member --board-id 18406694561",
+        "sync run --connection-id 6 --dry-run --entity-type member --record-limit 20"
       ],
       mutates: true,
       handler: async ({ ctx, args, workspace }) => {
@@ -19749,12 +20995,39 @@ var syncDomain = {
           entityType = rawEntityType;
         }
         const boardId = args["board-id"];
+        const rawRecordLimit = args["record-limit"];
+        let recordLimit;
+        if (rawRecordLimit !== void 0 && rawRecordLimit !== "") {
+          const parsed = Number(rawRecordLimit);
+          if (!Number.isInteger(parsed) || parsed < 1 || parsed > 200) {
+            throw new CLIError(
+              `Invalid --record-limit "${rawRecordLimit}". Must be an integer between 1 and 200.`
+            );
+          }
+          if (!dryRun) {
+            throw new CLIError(
+              "--record-limit requires --dry-run: capped runs are preview-only."
+            );
+          }
+          if (entityType === void 0) {
+            throw new CLIError(
+              "--record-limit requires --entity-type: capped previews must target a single entity type."
+            );
+          }
+          recordLimit = parsed;
+        }
+        if (fullResync && (dryRun || recordLimit !== void 0)) {
+          throw new CLIError(
+            "--full-resync is incompatible with --dry-run / --record-limit: checkpoint reset must happen on a non-preview run."
+          );
+        }
         if (!quiet) {
           const flags = [
             dryRun && "(dry run)",
             fullResync && "(full re-sync)",
             entityType && `(${entityType} only)`,
-            boardId && `(board ${boardId})`
+            boardId && `(board ${boardId})`,
+            recordLimit !== void 0 && `(limit ${recordLimit})`
           ].filter(Boolean).join(" ");
           console.error(
             `Starting sync for connection ${connectionId}${flags ? ` ${flags}` : ""}...`
@@ -19767,7 +21040,8 @@ var syncDomain = {
             dryRun,
             resetCheckpoints: fullResync,
             entityType,
-            boardId
+            boardId,
+            recordLimit
           }
         );
         if (!response.ok) {
@@ -19961,6 +21235,31 @@ var appConnectionsDomain = {
         );
         outputSingle(result2, ctx);
       }
+    },
+    {
+      path: ["app-connections", "relink-member"],
+      description: "Re-enable sync for a previously unlinked member by clearing the manual-unlink exclusion on this connection. Idempotent: returns cleared=false when no exclusion exists.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "id", description: "Connection ID (numeric)", required: true },
+        { name: "member-id", description: "Member ID (numeric)", required: true },
+        {
+          name: "board-id",
+          description: "Optional Monday board ID. Required for Monday connections where exclusions are board-scoped; omit for single-scope connectors."
+        }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const boardIdRaw = args["board-id"];
+        const options = boardIdRaw !== void 0 && boardIdRaw !== "" ? { boardId: String(boardIdRaw) } : void 0;
+        const result2 = await requireAuth(ctx).apiClient.clearConnectionMemberExclusion(
+          workspace,
+          requireNumber(args, "id"),
+          requireNumber(args, "member-id"),
+          options
+        );
+        outputSingle(result2, ctx);
+      }
     }
   ]
 };
@@ -20653,49 +21952,6 @@ var mondayDomain = {
         outputData(result2, ctx);
       }
     },
-    {
-      path: ["monday", "webhook-get"],
-      description: "Get a Monday.com webhook",
-      requiresWorkspace: true,
-      args: [
-        { name: "board-id", description: "Board ID", required: true },
-        { name: "id", description: "Webhook ID", required: true }
-      ],
-      handler: async ({ ctx, args, workspace }) => {
-        const result2 = await requireAuth(ctx).apiClient.getMondayWebhook(
-          workspace,
-          requireString(args, "board-id"),
-          requireString(args, "id")
-        );
-        outputSingle(result2, ctx);
-      }
-    },
-    {
-      path: ["monday", "webhook-create"],
-      description: "Create a Monday.com webhook",
-      mutates: true,
-      requiresWorkspace: true,
-      handler: async ({ ctx, data, workspace }) => {
-        const result2 = await requireAuth(ctx).apiClient.createMondayWebhook(
-          workspace,
-          data
-        );
-        outputSingle(result2, ctx);
-      }
-    },
-    {
-      path: ["monday", "webhook-delete"],
-      description: "Delete a Monday.com webhook",
-      mutates: true,
-      requiresWorkspace: true,
-      args: [{ name: "id", description: "Webhook ID", required: true }],
-      handler: async ({ ctx, args, workspace }) => {
-        const id = requireString(args, "id");
-        await requireAuth(ctx).apiClient.deleteMondayWebhook(workspace, id);
-        process.stdout.write(`Deleted Monday webhook ${id}
-`);
-      }
-    },
     {
       path: ["monday", "user-info"],
       description: "Get current Monday.com user info",
@@ -21035,6 +22291,113 @@ var slackAppsDomain = {
   ]
 };
 
+// src/domains/integrations/teams-apps.ts
+var COLUMNS33 = [COL.id(), COL.name(), COL.status()];
+function addTeamsUrls(data, apiUrl, workspaceUuid) {
+  const base = `${apiUrl}/api/v2/w/${workspaceUuid}/app-connections/teams`;
+  return {
+    ...data,
+    _urls: {
+      eventsEndpoint: `${base}/events`,
+      oauthUserAuthorize: `${base}/oauth/user/authorize?app_id=${data.id ?? ""}`,
+      oauthUserCallback: `${base}/oauth/user/callback`
+    }
+  };
+}
+var teamsAppsDomain = {
+  name: "teams-apps",
+  description: "Manage Microsoft Teams app integrations",
+  commands: [
+    ...crudCommands({
+      prefix: ["teams-apps"],
+      entityName: "Teams app",
+      listMethod: "getTeamsApps",
+      deleteMethod: "deleteTeamsApp",
+      columns: COLUMNS33,
+      paginationSupport: "full"
+    }),
+    {
+      path: ["teams-apps", "get"],
+      description: "Get a Teams app by ID",
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getTeamsApp(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputSingle(addTeamsUrls(result2, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "create"],
+      description: "Create a Teams app",
+      mutates: true,
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const result2 = await requireAuth(ctx).apiClient.createTeamsApp(workspace, data);
+        outputSingle(addTeamsUrls(result2, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "update"],
+      description: "Update a Teams app",
+      mutates: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      requiresWorkspace: true,
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
+        const result2 = await requireAuth(ctx).apiClient.updateTeamsApp(
+          workspace,
+          requireNumber(args, "id"),
+          data
+        );
+        outputSingle(addTeamsUrls(result2, ctx.envConfig.apiUrl, workspace), ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "conversations"],
+      description: "List Teams conversations linked to chats",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getTeamsConversations(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result2, ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "installations"],
+      description: "List per-tenant Teams installations",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getTeamsInstallations(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result2, ctx);
+      }
+    },
+    {
+      path: ["teams-apps", "accounts"],
+      description: "List linked Teams (Entra) accounts for this app",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Teams app ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getTeamsAppAccounts(
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(result2, ctx);
+      }
+    }
+  ]
+};
+
 // src/domains/index.ts
 function registerPublicDomains(registry) {
   registry.register(tasksDomain);
@@ -21066,6 +22429,7 @@ function registerPublicDomains(registry) {
   registry.register(mcpServersDomain);
   registry.register(apiKeysDomain);
   registry.register(subscriptionsDomain);
+  registry.register(supportDomain);
   registry.register(reportsDomain);
   registry.register(aiModelsDomain);
   registry.register(featuresDomain);
@@ -21081,6 +22445,7 @@ function registerPublicDomains(registry) {
   registry.register(confluenceDomain);
   registry.register(discordBotsDomain);
   registry.register(slackAppsDomain);
+  registry.register(teamsAppsDomain);
   registry.register(fhirConnectionsDomain);
   registry.register(appConnectionsDomain);
   registry.register(hubspotDomain);
@@ -21129,6 +22494,327 @@ function openUrl(url) {
     }
   });
 }
+function buildCliConciergeAppContext() {
+  const shell = process.env.SHELL ? path3.basename(process.env.SHELL) : void 0;
+  return {
+    clientSurface: "cli",
+    channel: "text",
+    cliContext: {
+      shell,
+      os: process.platform,
+      cwdBasename: path3.basename(process.cwd())
+    }
+  };
+}
+var DEFAULT_MAX_READ_BYTES = 5e4;
+var ABSOLUTE_MAX_READ_BYTES = 1e6;
+function resolveSafePath(root, relativePath) {
+  const rootResolved = path3.resolve(root);
+  const target = path3.resolve(rootResolved, relativePath || ".");
+  if (target !== rootResolved && !target.startsWith(rootResolved + path3.sep)) {
+    return null;
+  }
+  let cursor = rootResolved;
+  const rest = path3.relative(rootResolved, target);
+  if (rest && rest !== ".") {
+    for (const segment of rest.split(path3.sep)) {
+      cursor = path3.join(cursor, segment);
+      try {
+        const lstat = fs.lstatSync(cursor);
+        if (lstat.isSymbolicLink()) {
+          return null;
+        }
+      } catch {
+        break;
+      }
+    }
+  }
+  return target;
+}
+function executeCliLocalFileAction(root, interrupt, opts) {
+  const safe = resolveSafePath(root, interrupt.path);
+  if (!safe) {
+    return { ok: false, error: "Path escapes trusted directory" };
+  }
+  try {
+    switch (interrupt.action) {
+      case "read_file": {
+        if (!fs.existsSync(safe)) {
+          return { ok: false, error: "File not found" };
+        }
+        const stat = fs.lstatSync(safe);
+        if (stat.isSymbolicLink()) {
+          return { ok: false, error: "Path escapes trusted directory" };
+        }
+        if (!stat.isFile()) {
+          return { ok: false, error: "Not a file" };
+        }
+        const requested = Number.isFinite(interrupt.max_bytes) ? Math.max(1, Math.min(Number(interrupt.max_bytes), ABSOLUTE_MAX_READ_BYTES)) : DEFAULT_MAX_READ_BYTES;
+        if (stat.size > requested) {
+          const buf = fs.readFileSync(safe, { encoding: "utf8" });
+          return {
+            ok: true,
+            content: buf.slice(0, requested) + `
+
+[truncated at ${requested} bytes]`
+          };
+        }
+        return { ok: true, content: fs.readFileSync(safe, "utf8") };
+      }
+      case "list_dir": {
+        if (!fs.existsSync(safe)) {
+          return { ok: false, error: "Directory not found" };
+        }
+        const entries = fs.readdirSync(safe, { withFileTypes: true });
+        const lines = entries.slice(0, 200).map((e) => e.isDirectory() ? `${e.name}/` : e.name);
+        if (entries.length > 200) {
+          lines.push(`... and ${entries.length - 200} more`);
+        }
+        return { ok: true, content: lines.join("\n") };
+      }
+      case "write_file": {
+        if (!opts.allowWrite) {
+          return { ok: false, error: "Write requires --allow-write" };
+        }
+        if (interrupt.content === void 0) {
+          return { ok: false, error: "Missing content for write_file" };
+        }
+        fs.mkdirSync(path3.dirname(safe), { recursive: true });
+        fs.writeFileSync(safe, interrupt.content, "utf8");
+        return { ok: true, content: "written" };
+      }
+      default:
+        return { ok: false, error: `Unknown action: ${interrupt.action}` };
+    }
+  } catch (e) {
+    return { ok: false, error: sanitizeLocalFileError(e) };
+  }
+}
+function sanitizeLocalFileError(e) {
+  if (e && typeof e === "object" && "code" in e) {
+    const code = e.code;
+    if (code === "ENOENT") return "File or directory not found";
+    if (code === "EACCES" || code === "EPERM") return "Permission denied";
+    if (code === "EISDIR") return "Not a file";
+    if (code === "ENOTDIR") return "Not a directory";
+  }
+  return "Local file operation failed";
+}
+function isCliLocalFileInterrupt(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return v.type === "cli_local_file" && typeof v.action === "string" && typeof v.path === "string";
+}
+var STORE_VERSION = 1;
+function storePath() {
+  const base = process.env.XDG_CONFIG_HOME ?? (process.platform === "win32" ? path3.join(process.env.APPDATA ?? os.homedir(), "gravityrail") : path3.join(os.homedir(), ".config", "gravityrail"));
+  return path3.join(base, "trusted-dirs.json");
+}
+function loadTrustedDirsStore() {
+  const file = storePath();
+  try {
+    const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (raw?.version === STORE_VERSION && Array.isArray(raw.always)) {
+      return { version: STORE_VERSION, always: raw.always.map((p) => path3.resolve(p)) };
+    }
+  } catch {
+  }
+  return { version: STORE_VERSION, always: [] };
+}
+function saveTrustedDirsStore(store) {
+  const file = storePath();
+  const dir = path3.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.writeFileSync(file, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+}
+function isDirectoryTrusted(dirPath, opts) {
+  if (opts?.trustCwdFlag) return true;
+  const resolved = path3.resolve(dirPath);
+  const store = loadTrustedDirsStore();
+  return store.always.includes(resolved);
+}
+async function promptTrustInteractive(dirPath) {
+  const rl = readline__default.createInterface({ input: process.stdin, output: process.stderr });
+  const question = (q) => new Promise((resolve2) => rl.question(q, resolve2));
+  process.stderr.write(
+    `
+Gravity Rail may read files in:
+  ${dirPath}
+
+File contents can influence the assistant. Do you trust the files in this directory?
+  [1] Trust once (this session)
+  [2] Trust always (remember for this path)
+  [3] No \u2014 do not read local files
+
+Choice [1/2/3] (default 3): `
+  );
+  const answer = (await question("")).trim() || "3";
+  rl.close();
+  if (answer === "1") return "once";
+  if (answer === "2") return "always";
+  return "denied";
+}
+var sessionTrusted = /* @__PURE__ */ new Set();
+async function resolveDirectoryTrust(opts) {
+  const dir = path3.resolve(opts.trustDir ?? opts.cwd ?? process.cwd());
+  if (isDirectoryTrusted(dir, { trustCwdFlag: opts.trustCwd })) return "trusted";
+  if (sessionTrusted.has(dir)) return "trusted";
+  if (opts.trustDir && path3.resolve(opts.trustDir) === dir) {
+    sessionTrusted.add(dir);
+    return "trusted";
+  }
+  if (opts.trustCwd) {
+    sessionTrusted.add(dir);
+    return "trusted";
+  }
+  if (!process.stdin.isTTY || opts.nonInteractive) {
+    return "denied";
+  }
+  const decision = await promptTrustInteractive(dir);
+  if (decision === "denied") {
+    return "denied";
+  }
+  if (decision === "always") {
+    const store = loadTrustedDirsStore();
+    if (!store.always.includes(dir)) {
+      store.always.push(dir);
+      saveTrustedDirsStore(store);
+    }
+  }
+  sessionTrusted.add(dir);
+  return "trusted";
+}
+
+// src/lib/cli-hitl.ts
+function extractHumanInputRequest(event) {
+  const type = String(event.type ?? "").toUpperCase();
+  if (type === "CUSTOM" && event.name === "human_input_request") {
+    return event.value;
+  }
+  if (event.name === "human_input_request") {
+    return event.value;
+  }
+  return null;
+}
+async function handleCliHitlInterrupt(value, opts) {
+  if (!value || typeof value !== "object") return null;
+  const payload = value;
+  if (isCliLocalFileInterrupt(payload)) {
+    const interrupt = payload;
+    if (typeof payload.interrupt_id === "string") {
+      interrupt.interrupt_id = payload.interrupt_id;
+    }
+    return handleCliLocalFile(interrupt, opts);
+  }
+  if (payload.type === "present_choice") {
+    return handlePresentChoiceTerminal(payload);
+  }
+  return null;
+}
+async function handleCliLocalFile(interrupt, opts) {
+  const trust = await resolveDirectoryTrust({
+    cwd: process.cwd(),
+    trustCwd: opts.trustCwd,
+    trustDir: opts.trustDir,
+    // Interactive sessions: prompt on first local-file use (review feedback).
+    nonInteractive: opts.nonInteractive ?? process.stdin.isTTY !== true
+  });
+  if (trust !== "trusted") {
+    return {
+      resumeValue: JSON.stringify({
+        ok: false,
+        error: "Directory not trusted for local file access. Re-run with --trust-cwd or --trust-dir <path>, or approve trust interactively when prompted."
+      }),
+      resumeInterruptId: interrupt.interrupt_id
+    };
+  }
+  process.stderr.write(`
+[local ${interrupt.action}] ${interrupt.path}
+`);
+  const result2 = executeCliLocalFileAction(process.cwd(), interrupt, {
+    allowWrite: opts.allowWrite
+  });
+  return {
+    resumeValue: JSON.stringify(result2),
+    resumeInterruptId: interrupt.interrupt_id
+  };
+}
+async function handlePresentChoiceTerminal(payload) {
+  const prompt = typeof payload.user_prompt === "string" && payload.user_prompt || typeof payload.description === "string" && payload.description || "Choose an option";
+  const markup = typeof payload.openui_markup === "string" ? payload.openui_markup : "";
+  process.stderr.write(`
+${prompt}
+`);
+  if (markup) {
+    process.stderr.write(`${markup.slice(0, 2e3)}
+`);
+  }
+  if (!process.stdin.isTTY) {
+    return {
+      resumeValue: "",
+      resumeInterruptId: typeof payload.interrupt_id === "string" ? payload.interrupt_id : void 0
+    };
+  }
+  const rl = readline__default.createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve2) => {
+    rl.question("Your choice (value): ", resolve2);
+  });
+  rl.close();
+  return {
+    resumeValue: answer.trim(),
+    resumeInterruptId: typeof payload.interrupt_id === "string" ? payload.interrupt_id : void 0
+  };
+}
+
+// src/lib/concierge-agui-loop.ts
+var MAX_HITL_ROUNDS = 25;
+async function runConciergeAguiLoop(client, initialMessages, onEvent, opts) {
+  let streamText = "";
+  let hasToolCalls = false;
+  let resume;
+  for (let round = 0; round < MAX_HITL_ROUNDS; round++) {
+    let hitlPayload = null;
+    await client.streamRequest(
+      resume ? {
+        messages: [],
+        resumeValue: resume.resumeValue,
+        resumeInterruptId: resume.resumeInterruptId
+      } : { messages: initialMessages },
+      (event) => {
+        onEvent(event);
+        const delta = getTextDelta(event);
+        if (delta) streamText += delta;
+        const type = event.type?.toLowerCase() ?? "";
+        if (type === "tool_call_start") hasToolCalls = true;
+        const errorMsg = getErrorMessage(event);
+        if (errorMsg) process.stderr.write(`\x1B[31mError: ${errorMsg}\x1B[0m
+`);
+        const hitl = extractHumanInputRequest(event);
+        if (hitl) hitlPayload = hitl;
+      },
+      { autoApprove: opts.autoApprove }
+    );
+    if (!hitlPayload) {
+      break;
+    }
+    const next = await handleCliHitlInterrupt(hitlPayload, {
+      allowWrite: opts.allowWrite,
+      autoApprove: opts.autoApprove,
+      trustCwd: opts.trustCwd,
+      trustDir: opts.trustDir,
+      nonInteractive: opts.nonInteractive
+    });
+    if (!next) {
+      process.stderr.write(
+        "  [HITL] Unsupported interrupt in CLI \u2014 open app.gravityrail.com/setup to continue.\n"
+      );
+      break;
+    }
+    resume = next;
+    streamText = "";
+  }
+  return { streamText, hasToolCalls };
+}
 var RealtimeClient = class extends EventEmitter {
   ws = null;
   connected = false;
@@ -21148,7 +22834,7 @@ var RealtimeClient = class extends EventEmitter {
         new Error("WebSocket not available. Node.js 22+ is required for realtime mode.")
       );
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const params = new URLSearchParams();
       if (this.options.vadMode) {
         params.append("vad", this.options.vadMode);
@@ -21203,7 +22889,7 @@ var RealtimeClient = class extends EventEmitter {
       }, 1e4);
       this.once("connected", () => {
         clearTimeout(timeout);
-        resolve();
+        resolve2();
       });
       this.once("error", () => {
         clearTimeout(timeout);
@@ -22168,7 +23854,7 @@ async function listOutputDevices() {
   return listDevices("play");
 }
 function listDevices(command) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     try {
       const proc = spawnSync(command, ["--list-devices"], {
         encoding: "utf-8",
@@ -22192,9 +23878,9 @@ function listDevices(command) {
       if (devices.length === 0) {
         devices.push({ id: "default", name: "System Default", isDefault: true });
       }
-      resolve(devices);
+      resolve2(devices);
     } catch {
-      resolve([{ id: "default", name: "System Default", isDefault: true }]);
+      resolve2([{ id: "default", name: "System Default", isDefault: true }]);
     }
   });
 }
@@ -22216,14 +23902,14 @@ async function selectDevice(devices, label) {
     process.stderr.write(`    ${i + 1}. ${dev.name}${marker}
 `);
   }
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const defaultIdx = devices.findIndex((d) => d.isDefault);
     const defaultNum = defaultIdx >= 0 ? defaultIdx + 1 : 1;
     rl.question(`  Select [${defaultNum}]: `, (answer) => {
       rl.close();
       const num = answer.trim() ? parseInt(answer.trim(), 10) : defaultNum;
       const idx = Math.max(0, Math.min(devices.length - 1, num - 1));
-      resolve(devices[idx]);
+      resolve2(devices[idx]);
     });
   });
 }
@@ -22481,56 +24167,51 @@ async function runChatSession(session, args) {
       "Interactive mode requires a TTY. Use --message for non-interactive mode."
     );
   }
+  const allowWrite = !!args["allow-write"] || !!session.allowWrite;
   if (message) {
-    await singleTurnChatSession(session, message, debug, autoApprove);
+    await singleTurnChatSession(session, message, debug, autoApprove, allowWrite);
   } else if (isVoice) {
     await voiceChatSession(session, vadMode(args), args, debug);
   } else if (isRealtime) {
     await realtimeChatSession(session, vadMode(args), debug);
   } else {
-    await interactiveChatSession(session, debug);
+    await interactiveChatSession(session, debug, autoApprove, allowWrite);
   }
 }
 function vadMode(args) {
   return typeof args.vad === "string" ? args.vad : "server";
 }
-async function singleTurnChatSession(session, message, debug, autoApprove = false) {
+async function singleTurnChatSession(session, message, debug, autoApprove = false, allowWrite = false) {
   const aguiClient = new AGUIClient({
     baseUrl: session.ctx.envConfig.apiUrl,
+    workspaceUuid: session.workspaceUuid,
+    chatId: session.chatId,
     endpointUrl: session.aguiEndpointUrl,
     accessToken: session.ctx.accessToken,
     debug,
-    model: session.model
+    model: session.model,
+    appContext: session.appContext
   });
-  let streamText = "";
-  let hasToolCalls = false;
-  let eventCount = 0;
-  const logFile = process.env.GR_SSE_LOG;
-  const fs = logFile ? await import('fs') : null;
-  const logStream = logFile && fs ? fs.createWriteStream(logFile, { flags: "a" }) : null;
-  await aguiClient.sendMessage(
-    [{ role: "user", content: message }],
-    (event) => {
-      eventCount++;
-      if (logStream) logStream.write(JSON.stringify(event) + "\n");
-      const delta = getTextDelta(event);
-      if (delta) streamText += delta;
-      const type = event.type?.toLowerCase() ?? "";
-      if (type === "tool_call_start") {
-        hasToolCalls = true;
-        const name = event.name ?? "";
-        process.stderr.write(`  [${name}]
-`);
-      }
-      const errorMsg = getErrorMessage(event);
-      if (errorMsg) process.stderr.write(`\x1B[31mError: ${errorMsg}\x1B[0m
+  const onEvent = (event) => {
+    const type = event.type?.toLowerCase() ?? "";
+    if (type === "tool_call_start") {
+      const name = event.toolCallName ?? event.name ?? "";
+      process.stderr.write(`  [${name}]
 `);
-    },
-    { autoApprove }
+    }
+  };
+  const { streamText, hasToolCalls } = await runConciergeAguiLoop(
+    aguiClient,
+    [{ role: "user", content: message }],
+    onEvent,
+    {
+      autoApprove,
+      allowWrite: allowWrite || !!session.allowWrite,
+      trustCwd: session.trustCwd,
+      trustDir: session.trustDir,
+      nonInteractive: true
+    }
   );
-  if (logStream) logStream.end();
-  if (debug) process.stderr.write(`  (${eventCount} SSE events)
-`);
   if (streamText) {
     process.stdout.write(`\x1B[32mAssistant:\x1B[0m ${streamText}
 `);
@@ -22564,13 +24245,16 @@ async function singleTurnChatSession(session, message, debug, autoApprove = fals
 `);
   }
 }
-async function interactiveChatSession(session, debug) {
+async function interactiveChatSession(session, debug, autoApprove, allowWrite) {
   const aguiClient = new AGUIClient({
     baseUrl: session.ctx.envConfig.apiUrl,
+    workspaceUuid: session.workspaceUuid,
+    chatId: session.chatId,
     endpointUrl: session.aguiEndpointUrl,
     accessToken: session.ctx.accessToken,
     debug,
-    model: session.model
+    model: session.model,
+    appContext: session.appContext
   });
   clearScreen();
   console.log("=".repeat(60));
@@ -22599,7 +24283,7 @@ async function interactiveChatSession(session, debug) {
     }
   }
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const prompt = () => {
       rl.question("\x1B[34mYou:\x1B[0m ", async (input) => {
         const trimmed = input.trim();
@@ -22616,18 +24300,34 @@ async function interactiveChatSession(session, debug) {
         process.stdout.write("\n\x1B[32mAssistant:\x1B[0m ");
         let assistantContent = "";
         try {
-          await aguiClient.sendMessage(conversationMessages, (event) => {
-            const delta = getTextDelta(event);
-            if (delta) {
-              process.stdout.write(delta);
-              assistantContent += delta;
-            }
-            const errorMsg = getErrorMessage(event);
-            if (errorMsg) console.log(`
+          const { streamText } = await runConciergeAguiLoop(
+            aguiClient,
+            conversationMessages,
+            (event) => {
+              const delta = getTextDelta(event);
+              if (delta) {
+                process.stdout.write(delta);
+                assistantContent += delta;
+              }
+              const errorMsg = getErrorMessage(event);
+              if (errorMsg) console.log(`
 \x1B[31mError: ${errorMsg}\x1B[0m`);
-          });
-          if (assistantContent)
+            },
+            {
+              autoApprove,
+              allowWrite: allowWrite || !!session.allowWrite,
+              debug,
+              trustCwd: session.trustCwd,
+              trustDir: session.trustDir
+            }
+          );
+          if (streamText && !assistantContent) {
+            assistantContent = streamText;
+            process.stdout.write(streamText);
+          }
+          if (assistantContent) {
             conversationMessages.push({ role: "assistant", content: assistantContent });
+          }
           console.log("\n");
         } catch (error) {
           console.log(
@@ -22641,7 +24341,7 @@ async function interactiveChatSession(session, debug) {
     };
     rl.on("close", () => {
       console.log("\nGoodbye!");
-      resolve();
+      resolve2();
     });
     prompt();
   });
@@ -22738,8 +24438,8 @@ async function realtimeChatSession(session, vad, debug) {
   });
   tui.loadHistory(history);
   tui.start();
-  await new Promise((resolve) => {
-    client.once("closed", resolve);
+  await new Promise((resolve2) => {
+    client.once("closed", resolve2);
   });
 }
 async function voiceChatSession(session, vad, args, debug) {
@@ -22856,8 +24556,8 @@ Connecting to ${session.label.toLowerCase()}...
   tui.loadHistory(history);
   tui.start();
   mic.start(inputDeviceId);
-  await new Promise((resolve) => {
-    client.once("closed", resolve);
+  await new Promise((resolve2) => {
+    client.once("closed", resolve2);
   });
 }
 async function listAudioDevices() {
@@ -22887,13 +24587,14 @@ async function conciergeCommand(hctx) {
   const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
   const message = typeof args.message === "string" ? args.message : void 0;
   const chat = await getOrCreateConciergeChat(ctx, chatIdArg, !!message);
-  const session = buildConciergeSession(ctx, chat);
+  const session = buildConciergeSession(ctx, chat, args);
   await runChatSession(session, args);
 }
-function buildConciergeSession(ctx, chat) {
+function buildConciergeSession(ctx, chat, args) {
   const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   return {
     ctx,
+    workspaceUuid: "",
     chatId: chat.id,
     chatUuid: chat.uuid,
     chatTitle: chat.title || chat.uuid,
@@ -22901,8 +24602,12 @@ function buildConciergeSession(ctx, chat) {
     wsUrl: `${wsBase}/api/v2/concierge/voice/stream-ws`,
     loadMessages: () => getConciergeChatMessages(ctx, chat.id).catch(() => []),
     label: "Concierge",
-    model: void 0
+    model: void 0,
     // concierge doesn't send model field
+    appContext: buildCliConciergeAppContext(),
+    allowWrite: true,
+    trustCwd: !!args["trust-cwd"],
+    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
   };
 }
 async function getOrCreateConciergeChat(ctx, chatIdArg, skipSelection) {
@@ -22937,6 +24642,95 @@ async function getOrCreateConciergeChat(ctx, chatIdArg, skipSelection) {
   }
   return selectedChat;
 }
+
+// src/commands/get-started.ts
+var WEB_SETUP = "https://app.gravityrail.com/setup";
+var WEB_GET_STARTED = "https://app.gravityrail.com/get-started";
+var HUMAN_GUIDE = `Gravity Rail \u2014 getting started
+
+1. Authenticate:  gr login --env prod
+   Confirm:       gr whoami
+
+2. Recommended path \u2014 concierge (no workspace required):
+   gr concierge chat --allow-write
+   The concierge can create your org (auto-created on first login), list products,
+   start Stripe checkout, and create your first workspace.
+
+3. Verify workspaces:  gr workspaces list
+
+4. Web wizards (human-friendly):  ${WEB_SETUP}  and  ${WEB_GET_STARTED}
+
+Headless boundary: Stripe checkout needs a human in a browser \u2014 the concierge returns
+a checkout URL; an agent should hand that link to the user, not loop on payment.
+
+Agent-readable steps:  gr get-started --format llm
+`;
+var LLM_GUIDE = `# Gravity Rail CLI bootstrap (agent instructions)
+
+## Preconditions
+- Install: \`npm install -g @gravity-rail/cli\` or \`npx @gravity-rail/cli\`
+- Authenticate: \`gr login --env prod\` (interactive OAuth). Verify with \`gr whoami\`.
+- **Monorepo dev:** from gravity-team with Docker dev up, use \`yarn gr <cmd> --realm superadmin\` (reads \`dev-realms.json\`; no browser). Rebuild: \`yarn workspace @gravity-rail/gr-cli build\`.
+
+## Important facts
+- **Agents/CI:** do not leave stdin open on read-only commands; use \`GRAVITY_RAIL_API_KEY\` or redirect stdin from /dev/null. Commands only read stdin when \`--data\`/\`--file\` is passed.
+- Use \`--env dev|staging|prod\` (default prod) so credentials match the target; \`gr whoami\` shows the active env.
+- After login, an **organization is created automatically** \u2014 do not create a duplicate org unless \`gr organizations list\` is empty.
+- **Workspace is required** for workflow/agent/task commands (\`-w <workspace-uuid>\`).
+- **Concierge does not require \`-w\`** \u2014 use it for first-run setup.
+
+## Recommended path (concierge-driven)
+\`\`\`bash
+gr concierge chat --allow-write --message "Help me set up my first Gravity Rail workspace"
+\`\`\`
+Flags for unattended turns:
+- \`--message\` / \`-m\`: single-turn (non-interactive)
+- \`--auto-approve\`: skip HITL tool approval where policy allows
+- \`--allow-write\`: required for create/update tools
+
+The concierge can: list/create orgs, list org/workspace products, create Stripe checkout sessions, create workspace specs, and \`create_workspace\`.
+
+## Manual CLI path (if not using concierge)
+1. \`gr whoami\` \u2014 confirm account
+2. \`gr organizations list\` \u2014 note org slug/UUID
+3. \`gr concierge chat\` OR web: ${WEB_GET_STARTED}
+4. Product purchase: concierge returns Stripe checkout URL \u2192 **human must complete in browser**
+5. \`gr workspaces list\` \u2014 pick workspace UUID for \`-w\`
+
+## Support (account-level, no workspace)
+\`\`\`bash
+gr support create --type question --title "..." --description "..." --allow-write
+gr support list
+\`\`\`
+
+## Web fallbacks
+- Concierge / setup: ${WEB_SETUP}
+- Wizard: ${WEB_GET_STARTED}
+
+## Headless limits (do not retry forever)
+- Stripe payment / checkout: requires human browser
+- OAuth login: requires human browser
+- Directory trust for future local-file tools: use \`--trust-cwd\` only after user confirms files are safe
+
+## Local project files (CLI only)
+After directory trust + \`--allow-write\`, the concierge can use \`read_local_file\`, \`list_local_dir\`, \`write_local_file\` (client-executed via HITL).
+
+## Verify success
+\`gr workspaces list\` then \`gr workflows list -w <uuid>\` or \`gr agents list -w <uuid>\`
+`;
+async function getStartedCommand(hctx) {
+  const format = hctx.args.format ?? hctx.args.agent;
+  const isLlm = format === "llm" || format === "agent" || hctx.args["format"] === "llm" || !!hctx.args.agent;
+  if (!isLlm) {
+    try {
+      requireAuth(hctx.ctx);
+    } catch {
+    }
+    process.stdout.write(HUMAN_GUIDE);
+    return;
+  }
+  process.stdout.write(LLM_GUIDE);
+}
 async function devImportLocalCommand(ctx, workspace) {
   stderr2(`Exporting workspace ${workspace}...`);
   const exportData = await ctx.apiClient.exportWorkspace(workspace);
@@ -23015,8 +24809,17 @@ async function manageCommand(hctx) {
   const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
   const message = typeof args.message === "string" ? args.message : void 0;
   const chat = await getOrCreateChat(ctx, workspace, chatIdArg, asMember, "manager", !!message);
-  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager");
+  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager", {
+    appContext: buildCliConciergeAppContext(),
+    allowWrite: true,
+    trustCwd: !!args["trust-cwd"],
+    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
+  });
+  process.stderr.write(`Chat #${session.chatId}
+`);
   await runChatSession(session, args);
+  process.stderr.write(`Chat #${session.chatId}
+`);
 }
 async function chatCommand(hctx) {
   const ctx = requireAuth(hctx.ctx);
@@ -23041,10 +24844,11 @@ async function chatCommand(hctx) {
   const session = buildWorkspaceSession(ctx, workspace, chat, "Chat");
   await runChatSession(session, args);
 }
-function buildWorkspaceSession(ctx, workspace, chat, label) {
+function buildWorkspaceSession(ctx, workspace, chat, label, extra) {
   const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   return {
     ctx,
+    workspaceUuid: workspace,
     chatId: chat.id,
     chatUuid: chat.uuid,
     chatTitle: chat.title || chat.uuid,
@@ -23052,7 +24856,8 @@ function buildWorkspaceSession(ctx, workspace, chat, label) {
     wsUrl: `${wsBase}/api/v2/w/${workspace}/realtime/stream-ws`,
     loadMessages: () => ctx.apiClient.getChatMessages(workspace, chat.id, 50).catch(() => []),
     label,
-    model: "manager"
+    model: "manager",
+    ...extra
   };
 }
 async function getOrCreateChat(ctx, workspace, chatIdArg, asMemberId, chatType, skipSelection = false) {
@@ -23134,7 +24939,7 @@ async function createMemberChat(apiClient, workspace, memberId) {
 }
 
 // src/commands/organizations.ts
-var COLUMNS33 = [
+var COLUMNS34 = [
   { header: "NAME", getValue: (o) => o.organizationName || "", maxWidth: 35 },
   { header: "SLUG", getValue: (o) => o.organizationSlug || "", maxWidth: 25 },
   { header: "UUID", getValue: (o) => o.organizationUuid },
@@ -23142,24 +24947,28 @@ var COLUMNS33 = [
 ];
 async function organizationsListCommand(ctx) {
   const organizations = await ctx.apiClient.getMyOrganizations();
-  outputData(organizations, ctx, COLUMNS33);
+  outputData(organizations, ctx, COLUMNS34);
 }
 
 // src/commands/whoami.ts
-var COLUMNS34 = [
+var COLUMNS35 = [
   { header: "NAME", getValue: (a) => a.name || "", maxWidth: 30 },
   { header: "EMAIL", getValue: (a) => a.email || "", maxWidth: 40 },
   { header: "UUID", getValue: (a) => a.uuid },
+  { header: "ENV", getValue: () => "" },
   { header: "SUPERUSER", getValue: (a) => a.isSuperuser ? "yes" : "no" }
 ];
 async function whoamiCommand(ctx) {
   const account = await ctx.apiClient.getUserAccount();
-  outputSingle(account, ctx, COLUMNS34);
+  const columns = COLUMNS35.map(
+    (col) => col.header === "ENV" ? { ...col, getValue: () => ctx.env } : col
+  );
+  outputSingle(account, ctx, columns);
 }
 
 // package.json
 var package_default = {
-  version: "0.4.0"};
+  version: "0.5.1"};
 
 // src/gr.ts
 var VERSION = package_default.version;
@@ -23212,6 +25021,15 @@ function createRegistry() {
         name: "auto-approve",
         description: "Auto-approve all tool calls (skip HITL)",
         isFlag: true
+      },
+      {
+        name: "trust-cwd",
+        description: "Trust files in the current working directory (non-interactive)",
+        isFlag: true
+      },
+      {
+        name: "trust-dir",
+        description: "Trust files in this directory (non-interactive; absolute path)"
       }
     ],
     handler: async (hctx) => {
@@ -23245,6 +25063,37 @@ function createRegistry() {
       await chatCommand(hctx);
     }
   });
+  registry.registerCommand({
+    path: ["get-started"],
+    description: "Bootstrap instructions for new users and LLM agents",
+    requiresAuth: false,
+    args: [
+      {
+        name: "format",
+        description: "Output format: llm (agent-readable) or default (human)"
+      },
+      {
+        name: "agent",
+        description: "Alias for --format llm",
+        isFlag: true
+      }
+    ],
+    handler: async (hctx) => {
+      await getStartedCommand(hctx);
+    }
+  });
+  registry.registerCommand({
+    path: ["setup"],
+    description: "Alias for get-started \u2014 bootstrap instructions",
+    requiresAuth: false,
+    args: [
+      { name: "format", description: "Output format: llm or default" },
+      { name: "agent", description: "Alias for --format llm", isFlag: true }
+    ],
+    handler: async (hctx) => {
+      await getStartedCommand(hctx);
+    }
+  });
   registry.registerCommand({
     path: ["concierge", "chat"],
     description: "Interactive concierge chat (text, realtime, or voice)",
@@ -23264,6 +25113,15 @@ function createRegistry() {
         name: "auto-approve",
         description: "Auto-approve all tool calls (skip HITL)",
         isFlag: true
+      },
+      {
+        name: "trust-cwd",
+        description: "Trust files in the current working directory (non-interactive)",
+        isFlag: true
+      },
+      {
+        name: "trust-dir",
+        description: "Trust files in this directory (non-interactive; absolute path)"
       }
     ],
     handler: async (hctx) => {
@@ -23302,6 +25160,7 @@ function createRegistry() {
   return registry;
 }
 function parseGlobalOptions(argv) {
+  let env = "prod";
   let apiUrl;
   let outputFormat;
   let verbose = false;
@@ -23311,6 +25170,13 @@ function parseGlobalOptions(argv) {
   let collectingCommand = true;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
+    const eqIdx = arg.indexOf("=");
+    const flagPart = eqIdx !== -1 ? arg.slice(0, eqIdx) : arg;
+    const inlineValue = eqIdx !== -1 ? arg.slice(eqIdx + 1) : void 0;
+    if (flagPart === "--env" && (inlineValue ?? argv[i + 1])) {
+      env = inlineValue ?? argv[++i];
+      continue;
+    }
     if (arg === "--api-url" && argv[i + 1]) {
       apiUrl = argv[++i];
       continue;
@@ -23338,7 +25204,7 @@ function parseGlobalOptions(argv) {
     rest.unshift(commandWords.pop());
   }
   return {
-    opts: { apiUrl, outputFormat, verbose, allowWrite },
+    opts: { env, apiUrl, outputFormat, verbose, allowWrite },
     commandWords,
     rest
   };
@@ -23387,7 +25253,8 @@ async function main() {
       process.stderr.write("Error: --workspace (-w) is required\n");
       process.exit(1);
     }
-    const data = await readJsonInput(parsedArgs);
+    const acceptsJsonInput = cmd.args?.some((a) => a.name === "data" || a.name === "file");
+    const data = acceptsJsonInput ? await readJsonInput(parsedArgs) : void 0;
     hctx = { ctx, args: parsedArgs, workspace, data };
   } else {
     const baseCtx = createPublicContext(opts);
@@ -23406,7 +25273,7 @@ async function main() {
   }
   await cmd.handler(hctx);
   if (process.stdout.writableNeedDrain) {
-    await new Promise((resolve) => process.stdout.once("drain", resolve));
+    await new Promise((resolve2) => process.stdout.once("drain", resolve2));
   }
   process.exit(0);
 }