@gravity-rail/cli 0.46.0 → 0.49.0

package/dist/gr.js

@@ -208,22 +208,7 @@ var init_pagination = __esm({
   }
 });
 
-// ../sdk/dist/chunk-67QXTQVL.js
-function getCookieValue(name) {
-  if (typeof document === "undefined") return void 0;
-  const cookies = document.cookie.split(";");
-  for (const cookie of cookies) {
-    const trimmedCookie = cookie.trim();
-    const eqIndex = trimmedCookie.indexOf("=");
-    if (eqIndex === -1) continue;
-    const cookieName = trimmedCookie.substring(0, eqIndex);
-    const cookieValue = trimmedCookie.substring(eqIndex + 1);
-    if (cookieName === name) {
-      return cookieValue;
-    }
-  }
-  return void 0;
-}
+// ../sdk/dist/chunk-TGL72KPS.js
 function isApiValidationError(value) {
   if (!value || typeof value !== "object") return false;
   const v = value;
@@ -240,27 +225,16 @@ function parseOrgAuthChallenge(wwwAuthenticate) {
   if (!wwwAuthenticate) return null;
   if (!wwwAuthenticate.includes('realm="org"')) return null;
   const orgUuidMatch = wwwAuthenticate.match(/org_uuid="([^"]+)"/);
-  const cookieNameMatch = wwwAuthenticate.match(/cookie_name="([^"]+)"/);
   const authUrlMatch = wwwAuthenticate.match(/auth_url="([^"]+)"/);
-  if (!orgUuidMatch?.[1] || !cookieNameMatch?.[1] || !authUrlMatch?.[1]) {
+  if (!orgUuidMatch?.[1] || !authUrlMatch?.[1]) {
     console.warn("Invalid org auth challenge header: missing required fields");
     return null;
   }
   return {
     orgUuid: orgUuidMatch[1],
-    cookieName: cookieNameMatch[1],
     authUrl: authUrlMatch[1]
   };
 }
-function getRequestOrgCookieName(cookieName) {
-  if (cookieName.startsWith("orgToken")) {
-    return cookieName.replace(/^orgToken/, "requestOrgToken");
-  }
-  if (cookieName.startsWith("orgSession")) {
-    return cookieName.replace(/^orgSession/, "requestOrgSession");
-  }
-  return null;
-}
 function orgAuthHeaderName(token) {
   return token.startsWith("gr_sess_") ? "X-Org-Session" : "X-Org-Token";
 }
@@ -269,8 +243,8 @@ function setOrgAuthHeader(headers2, token) {
   headers2.set(orgAuthHeaderName(token), token);
 }
 var ApiError, BaseApiClient;
-var init_chunk_67QXTQVL = __esm({
-  "../sdk/dist/chunk-67QXTQVL.js"() {
+var init_chunk_TGL72KPS = __esm({
+  "../sdk/dist/chunk-TGL72KPS.js"() {
     ApiError = class extends Error {
       statusCode;
       /** Legacy string-array errors — kept for non-validation callers. */
@@ -344,7 +318,7 @@ var init_chunk_67QXTQVL = __esm({
         this.apiKey = newApiKey;
       }
       /**
-       * Set the opaque org session credential for cross-domain requests.
+       * Set the opaque org session credential a bearer client sends as `X-Org-Session`.
        * Opaque gr_sess_ values use X-Org-Session. Legacy orgToken JWE values still
        * use X-Org-Token through setOrgToken() during the migration window.
        *
@@ -364,7 +338,42 @@ var init_chunk_67QXTQVL = __esm({
       setOrgToken(token, orgUuid) {
         this.setOrgSession(token, orgUuid);
       }
-      async fetch(endpoint, options) {
+      /**
+       * The `credentials` a request carries: none for a bearer client (the fetch
+       * default), the page's own-origin cookies for a same-origin session.
+       */
+      credentialsInit() {
+        return this.apiKey ? {} : { credentials: "same-origin" };
+      }
+      /**
+       * Run the org-auth handler once for concurrent challenges. A bearer client's
+       * handler sets the org session with `setOrgSession`; a same-origin session's
+       * handler leaves an httpOnly org-session cookie on the page's origin instead,
+       * which the retry presents. A bearer client whose handler issued nothing has
+       * nothing to retry with.
+       */
+      async answerOrgAuthChallenge(orgAuthInfo) {
+        const handler = this.orgAuthHandler;
+        if (!handler) return;
+        if (!this.orgAuthInProgress) {
+          this.orgAuthInProgress = (async () => {
+            try {
+              await handler(orgAuthInfo);
+            } finally {
+              this.orgAuthInProgress = null;
+            }
+          })();
+        }
+        await this.orgAuthInProgress;
+        if (this.orgSession) {
+          this.orgSessionOrgUuid = orgAuthInfo.orgUuid;
+          return;
+        }
+        if (this.apiKey) {
+          throw new ApiError("Organization authentication did not issue a session", 401);
+        }
+      }
+      async fetch(endpoint, options, orgAuthRetry = false) {
         try {
           const headers2 = new Headers({
             // Don't set Content-Type for FormData — the browser must set it
@@ -374,17 +383,12 @@ var init_chunk_67QXTQVL = __esm({
           });
           if (this.apiKey) {
             headers2.set("Authorization", `Bearer ${this.apiKey}`);
-          } else if (this.isCrossDomain) {
-            const requestToken = getCookieValue("requestToken");
-            if (requestToken) {
-              headers2.set("Authorization", `Bearer ${requestToken}`);
-            }
           }
           setOrgAuthHeader(headers2, this.orgSession);
           const fullUrl = `${this.baseUrl}/api/v2/${endpoint}`;
           const response = await this.fetchFunction(fullUrl, {
             ...options,
-            ...this.apiKey ? {} : { credentials: "include" },
+            ...this.credentialsInit(),
             ...this.isCrossDomain ? { mode: "cors" } : {},
             headers: headers2
           });
@@ -415,48 +419,14 @@ var init_chunk_67QXTQVL = __esm({
                 this.orgSession = void 0;
                 this.orgSessionOrgUuid = void 0;
               }
-              if (orgAuthInfo && !this.orgSession) {
-                const requestCookieName = getRequestOrgCookieName(orgAuthInfo.cookieName);
-                const cachedOrgSession = requestCookieName ? getCookieValue(requestCookieName) : void 0;
-                if (cachedOrgSession) {
-                  this.orgSession = cachedOrgSession;
-                  this.orgSessionOrgUuid = orgAuthInfo.orgUuid;
-                  try {
-                    return await this.fetch(endpoint, options);
-                  } catch (retryError) {
-                    this.orgSession = void 0;
-                    this.orgSessionOrgUuid = void 0;
-                    throw retryError;
-                  }
-                }
-                if (this.orgAuthHandler) {
-                  if (!this.orgAuthInProgress) {
-                    const handler = this.orgAuthHandler;
-                    this.orgAuthInProgress = (async () => {
-                      try {
-                        await handler(orgAuthInfo);
-                      } finally {
-                        this.orgAuthInProgress = null;
-                      }
-                    })();
-                  }
-                  await this.orgAuthInProgress;
-                  const postHandlerSession = (requestCookieName ? getCookieValue(requestCookieName) : void 0) ?? this.orgSession;
-                  if (!postHandlerSession) {
-                    throw new ApiError(
-                      "Organization authentication did not issue a session",
-                      401
-                    );
-                  }
-                  this.orgSession = postHandlerSession;
-                  this.orgSessionOrgUuid = orgAuthInfo.orgUuid;
-                  try {
-                    return await this.fetch(endpoint, options);
-                  } catch (retryError) {
-                    this.orgSession = void 0;
-                    this.orgSessionOrgUuid = void 0;
-                    throw retryError;
-                  }
+              if (orgAuthInfo && !this.orgSession && !orgAuthRetry && this.orgAuthHandler) {
+                await this.answerOrgAuthChallenge(orgAuthInfo);
+                try {
+                  return await this.fetch(endpoint, options, true);
+                } catch (retryError) {
+                  this.orgSession = void 0;
+                  this.orgSessionOrgUuid = void 0;
+                  throw retryError;
                 }
               }
             }
@@ -518,23 +488,18 @@ ${formattedErrors}`, response.status);
           throw error;
         }
       }
-      async fetchRaw(endpoint, options, allowedErrorStatuses = []) {
+      async fetchRaw(endpoint, options, allowedErrorStatuses = [], orgAuthRetry = false) {
         try {
           const headers2 = new Headers({
             ...options?.headers || {}
           });
           if (this.apiKey) {
             headers2.set("Authorization", `Bearer ${this.apiKey}`);
-          } else if (this.isCrossDomain) {
-            const requestToken = getCookieValue("requestToken");
-            if (requestToken) {
-              headers2.set("Authorization", `Bearer ${requestToken}`);
-            }
           }
           setOrgAuthHeader(headers2, this.orgSession);
           const response = await this.fetchFunction(`${this.baseUrl}/api/v2/${endpoint}`, {
             ...options,
-            ...this.apiKey ? {} : { credentials: "include" },
+            ...this.credentialsInit(),
             ...this.isCrossDomain ? { mode: "cors" } : {},
             headers: headers2
           });
@@ -565,48 +530,14 @@ ${formattedErrors}`, response.status);
                 this.orgSession = void 0;
                 this.orgSessionOrgUuid = void 0;
               }
-              if (orgAuthInfo && !this.orgSession) {
-                const requestCookieName = getRequestOrgCookieName(orgAuthInfo.cookieName);
-                const cachedOrgSession = requestCookieName ? getCookieValue(requestCookieName) : void 0;
-                if (cachedOrgSession) {
-                  this.orgSession = cachedOrgSession;
-                  this.orgSessionOrgUuid = orgAuthInfo.orgUuid;
-                  try {
-                    return await this.fetchRaw(endpoint, options, allowedErrorStatuses);
-                  } catch (retryError) {
-                    this.orgSession = void 0;
-                    this.orgSessionOrgUuid = void 0;
-                    throw retryError;
-                  }
-                }
-                if (this.orgAuthHandler) {
-                  if (!this.orgAuthInProgress) {
-                    const handler = this.orgAuthHandler;
-                    this.orgAuthInProgress = (async () => {
-                      try {
-                        await handler(orgAuthInfo);
-                      } finally {
-                        this.orgAuthInProgress = null;
-                      }
-                    })();
-                  }
-                  await this.orgAuthInProgress;
-                  const postHandlerSession = (requestCookieName ? getCookieValue(requestCookieName) : void 0) ?? this.orgSession;
-                  if (!postHandlerSession) {
-                    throw new ApiError(
-                      "Organization authentication did not issue a session",
-                      401
-                    );
-                  }
-                  this.orgSession = postHandlerSession;
-                  this.orgSessionOrgUuid = orgAuthInfo.orgUuid;
-                  try {
-                    return await this.fetchRaw(endpoint, options, allowedErrorStatuses);
-                  } catch (retryError) {
-                    this.orgSession = void 0;
-                    this.orgSessionOrgUuid = void 0;
-                    throw retryError;
-                  }
+              if (orgAuthInfo && !this.orgSession && !orgAuthRetry && this.orgAuthHandler) {
+                await this.answerOrgAuthChallenge(orgAuthInfo);
+                try {
+                  return await this.fetchRaw(endpoint, options, allowedErrorStatuses, true);
+                } catch (retryError) {
+                  this.orgSession = void 0;
+                  this.orgSessionOrgUuid = void 0;
+                  throw retryError;
                 }
               }
             }
@@ -634,17 +565,12 @@ ${formattedErrors}`, response.status);
           });
           if (this.apiKey) {
             headers2.set("Authorization", `Bearer ${this.apiKey}`);
-          } else if (this.isCrossDomain) {
-            const requestToken = getCookieValue("requestToken");
-            if (requestToken) {
-              headers2.set("Authorization", `Bearer ${requestToken}`);
-            }
           }
           setOrgAuthHeader(headers2, this.orgSession);
           const fullUrl = `${this.baseUrl}/${path4}`;
           const response = await this.fetchFunction(fullUrl, {
             ...options,
-            ...this.apiKey ? {} : { credentials: "include" },
+            ...this.credentialsInit(),
             ...this.isCrossDomain ? { mode: "cors" } : {},
             headers: headers2
           });
@@ -3205,7 +3131,7 @@ var init_libphonenumber_js = __esm({
   }
 });
 
-// ../sdk/dist/chunk-I7BMDNPO.js
+// ../sdk/dist/chunk-XQTPXOBU.js
 function resourceWorkflowsPath(wid, ...segments) {
   const tail = segments.map((segment) => encodeURIComponent(String(segment))).join("/");
   const base = `w/${encodeURIComponent(wid)}/resource-workflows`;
@@ -3311,18 +3237,18 @@ function businessProfilePath(orgUuid, legalEntityUuid) {
 }
 function getOAuthPath(providerSlug, action) {
   if (providerSlug === "google_calendar") {
-    return `oauth/google/calendar/${action}`;
+    return `api/v2/oauth/google/calendar/${action}`;
   }
   if (providerSlug === "gmail") {
-    return `oauth/google/gmail/${action}`;
+    return `api/v2/oauth/google/gmail/${action}`;
   }
   if (providerSlug === "gdrive") {
-    return `oauth/google/drive/${action}`;
+    return `api/v2/oauth/google/drive/${action}`;
   }
   if (providerSlug === "gsheets") {
-    return `oauth/google/sheets/${action}`;
+    return `api/v2/oauth/google/sheets/${action}`;
   }
-  return `oauth/${providerSlug}/${action}`;
+  return `api/v2/oauth/${providerSlug}/${action}`;
 }
 function buildAuthorizeQuery(options) {
   if (!options) return "";
@@ -3392,6 +3318,16 @@ function planFields(options) {
   }
   return fields;
 }
+function workspaceDirectoryParams(options = {}) {
+  const params = new URLSearchParams();
+  if (options.page !== void 0) params.set("page", String(options.page));
+  if (options.pageSize !== void 0) params.set("pageSize", String(options.pageSize));
+  if (options.search) params.set("search", options.search);
+  if (options.organizationUuid) params.set("organizationUuid", options.organizationUuid);
+  for (const uuid of options.workspaceUuids ?? []) params.append("workspaceUuids", uuid);
+  for (const id of options.workspaceIds ?? []) params.append("workspaceIds", String(id));
+  return params;
+}
 function withFilters(params, options) {
   if (options.dateFrom) params.append("dateFrom", options.dateFrom);
   if (options.dateTo) params.append("dateTo", options.dateTo);
@@ -3665,6 +3601,8 @@ function bindTrackedLinksMethods(target, trackedLinks) {
   target.clearTrackedLinkDestinations = trackedLinks.clearTrackedLinkDestinations.bind(trackedLinks);
 }
 function bindDataTypesMethods(target, dataTypes) {
+  target.getAnonymousFormSchema = dataTypes.getAnonymousFormSchema.bind(dataTypes);
+  target.submitAnonymousForm = dataTypes.submitAnonymousForm.bind(dataTypes);
   target.getDataTypeDraft = dataTypes.getDataTypeDraft.bind(dataTypes);
   target.saveDataTypeDraft = dataTypes.saveDataTypeDraft.bind(dataTypes);
   target.publishDataTypeDraft = dataTypes.publishDataTypeDraft.bind(dataTypes);
@@ -4714,9 +4652,9 @@ function getRevisionState(workflow, revision) {
   };
 }
 var AbilitiesApi, ResourceWorkflowsApi, BundlesApi, InstallationsApi, AccessGrantsApi, AgentTasksApi, AgentsApi, AIModelsApi, ApiKeysApi, AppsApi, AssignmentsApi, VoiceApi, AuthApi, BuildersApi, CalendarsApi, CallsApi, CELApi, ChatsApi, ConfluenceApi, CustomToolkitsApi, DataTypesApi, DiscordBotsApi, SlackAppsApi, EventsApi, FeaturesApi, FhirConnectionsApi, InboundFaxStatus, DocumoFaxApi, HealthieApi, FilesApi, InboxesApi, InquiriesApi, AppConnectionsApi, McpServersApi, MemberImportValidationError, MembersApi, MondayIntegrationApi, NotificationRulesApi, OperatorApi, OrgApi, OAuthConnectionsApi, OAuthApi, PhoneNumbersApi, PronunciationsApi, PromptsApi, PersonasApi, QueriesApi, QualificationsApi, ReportsApi, RoutingRulesApi, SalesforceApi, ConnectionSyncApi, HubspotApi, SitesApi, SubscriptionsApi, SupportRequestsApi, CustomersApi, ResellersApi, SupervisorsApi, TasksApi, TemplatesApi, ToolkitsApi, JourneysApi, WorkflowsApi, WorkflowNotesApi, EventRuleObjectType, EventRuleEventType, EventRuleActionType, DriverMode, MEMBER_RELATIONSHIP_KINDS, WorkspaceInvitationsApi, WorkspacesApi, DashboardsApi, DevicesApi, TeamsAppsApi, ExperimentsApi, PatientSyncConnectionsApi, ActivityApi, MotdApi, InterventionRequestsApi, MetricsApi, ProjectsApi, TrackedLinksApi, WORKSPACE_METHOD_NAMES, WORKSPACE_METHOD_NAME_SET, GravityRailClient, WIDGET_SLUGS, CHAT_TYPES, BUILTIN_ASSISTANT_CHAT_TYPES, MEMBER_AGENT_CHAT_TYPES, ActivityGrain, ActivityGroupBy, ActivityOpenItemOrder, ActivityWindowBasis;
-var init_chunk_I7BMDNPO = __esm({
-  "../sdk/dist/chunk-I7BMDNPO.js"() {
-    init_chunk_67QXTQVL();
+var init_chunk_XQTPXOBU = __esm({
+  "../sdk/dist/chunk-XQTPXOBU.js"() {
+    init_chunk_TGL72KPS();
     init_libphonenumber_js();
     AbilitiesApi = class extends BaseApiClient {
       /**
@@ -5682,18 +5620,13 @@ var init_chunk_I7BMDNPO = __esm({
         }
         return await response.json();
       }
-      /** Request a cross-domain authentication token for single sign-on across domains. */
+      /** @deprecated Browser continuity uses top-level /auth/continue navigation. */
       async requestCrossDomainToken() {
-        return this.fetch("auth/cross-domain-token", {
-          method: "POST"
-        });
+        throw new Error("Use top-level /auth/continue navigation. CLI login uses OAuth with PKCE.");
       }
-      /** Exchange a cross-domain token for an authenticated session token. */
-      async exchangeToken(token) {
-        return this.fetch("auth/exchange-token", {
-          method: "POST",
-          body: JSON.stringify({ token })
-        });
+      /** @deprecated Browser handoffs redeem only at the destination Next server. */
+      async exchangeToken(_token) {
+        throw new Error("Use top-level /auth/continue navigation. CLI login uses OAuth with PKCE.");
       }
       /** Exchange a global Account login for an opaque org-scoped session handle. */
       async exchangeSession(request) {
@@ -5874,9 +5807,17 @@ var init_chunk_I7BMDNPO = __esm({
         );
       }
       // ===== ORGANIZATION MEMBERSHIP METHODS =====
-      /** List all organizations the current account belongs to. */
-      async getMyOrganizations() {
-        return this.fetch("o/mine");
+      /** A searchable page of the current account's organizations. */
+      async getMyOrganizations(options) {
+        const params = new URLSearchParams();
+        if (options?.page) params.set("page", String(options.page));
+        if (options?.pageSize) params.set("pageSize", String(options.pageSize));
+        if (options?.canCreateWorkspace) params.set("canCreateWorkspace", "true");
+        if (options?.search) params.set("search", options.search);
+        if (options?.organizationSlug !== void 0)
+          params.set("organizationSlug", options.organizationSlug);
+        for (const uuid of options?.organizationUuids ?? []) params.append("organizationUuids", uuid);
+        return this.fetch(`o/mine?${params}`);
       }
       // ===== CREDENTIAL CHANGE METHODS =====
       /**
@@ -6978,6 +6919,45 @@ var init_chunk_I7BMDNPO = __esm({
       }
     };
     DataTypesApi = class extends BaseApiClient {
+      /** Read an anonymous Form's visitor-writable schema without a Member session. */
+      async getAnonymousFormSchema(wid, formUuid) {
+        return this.fetchPublicAnonymousForm(
+          `w/${encodeURIComponent(wid)}/anonymous-forms/${encodeURIComponent(formUuid)}`
+        );
+      }
+      /** Submit visitor-provided values. No cookie or API credential is sent. */
+      async submitAnonymousForm(wid, formUuid, input2) {
+        return this.fetchPublicAnonymousForm(
+          `w/${encodeURIComponent(wid)}/anonymous-forms/${encodeURIComponent(formUuid)}/submissions`,
+          { method: "POST", body: JSON.stringify(input2) }
+        );
+      }
+      async fetchPublicAnonymousForm(endpoint, options = {}) {
+        const headers2 = new Headers(options.headers);
+        if (options.body !== void 0) headers2.set("Content-Type", "application/json");
+        let response;
+        try {
+          response = await this.fetchFunction(`${this.baseUrl}/api/v2/${endpoint}`, {
+            ...options,
+            credentials: "omit",
+            headers: headers2
+          });
+        } catch {
+          throw new ApiError("Anonymous Form request failed", 0);
+        }
+        if (!response.ok) {
+          let message = `Request failed with status ${response.status}`;
+          try {
+            const body = await response.json();
+            if (typeof body.detail === "string" && body.detail.length > 0) {
+              message = body.detail;
+            }
+          } catch {
+          }
+          throw new ApiError(message, response.status);
+        }
+        return await response.json();
+      }
       /** Read the local Form's draft and optimistic publication counters. */
       async getDataTypeDraft(wid, id) {
         return this.fetch(`w/${wid}/data-types/${id}/schema-draft`);
@@ -8676,14 +8656,7 @@ var init_chunk_I7BMDNPO = __esm({
         }
         const queryString = params.toString();
         const url = queryString ? `inquiries/export/csv?${queryString}` : "inquiries/export/csv";
-        const response = await fetch(`${this.baseUrl}/api/v2/${url}`, {
-          method: "GET",
-          credentials: "include"
-        });
-        if (!response.ok) {
-          const error = await response.json();
-          throw new Error(error.detail || "Export failed");
-        }
+        const response = await this.fetchRaw(url, { method: "GET" });
         return response.blob();
       }
     };
@@ -9919,8 +9892,12 @@ var init_chunk_I7BMDNPO = __esm({
        * figure — the caps belong to the organization, so `cap - oneWorkspace`
        * describes nothing.
        */
-      async getOrgWorkspaceUsage(orgIdOrUuid) {
-        return this.fetch(`o/${orgIdOrUuid}/usage/workspaces`);
+      async getOrgWorkspaceUsage(orgIdOrUuid, options) {
+        const params = new URLSearchParams();
+        if (options?.page) params.set("page", String(options.page));
+        if (options?.pageSize) params.set("pageSize", String(options.pageSize));
+        if (options?.search) params.set("search", options.search);
+        return this.fetch(`o/${orgIdOrUuid}/usage/workspaces?${params}`);
       }
       /**
        * List members of an organization.
@@ -10044,8 +10021,14 @@ var init_chunk_I7BMDNPO = __esm({
        * counts. Any org member may call it — members get the workspaces they
        * belong to, org:read holders get all of them.
        */
-      async getOrganizationWorkspaceSummaries(orgIdOrUuid) {
-        return this.fetch(`o/${orgIdOrUuid}/workspaces/summary`);
+      async getOrganizationWorkspaceSummaries(orgIdOrUuid, options) {
+        const params = new URLSearchParams();
+        if (options?.page) params.set("page", String(options.page));
+        if (options?.pageSize) params.set("pageSize", String(options.pageSize));
+        if (options?.search) params.set("search", options.search);
+        return this.fetch(
+          `o/${orgIdOrUuid}/workspaces/summary?${params}`
+        );
       }
       /**
        * Workspace-schema aggregates for one card, plus the caller's own member
@@ -13264,7 +13247,8 @@ var init_chunk_I7BMDNPO = __esm({
       /**
        * Classify the prompts of a Workflow's draft revision.
        *
-       * A decision model reads each Task that has a prompt and reports which
+       * A decision model reads each live Task with Workflow or Task instructions
+       * and reports which
        * prompt classifications probably apply. Each call asks the model again.
        */
       async getWorkflowPromptClassifications(wid, workflowId) {
@@ -13901,21 +13885,21 @@ var init_chunk_I7BMDNPO = __esm({
       }
     };
     WorkspacesApi = class extends BaseApiClient {
-      /** List all workspaces accessible to the current user. */
-      async getWorkspaces() {
-        return this.fetch("w/");
+      /** A bounded page of workspaces accessible to the current account. */
+      async getWorkspaces(options) {
+        return this.fetch(`w/?${workspaceDirectoryParams(options)}`);
       }
-      /**
-       * Compact rows for the workspaces a companion device could enter — the
-       * Lantern picker. Filtered by the same admission policy a device
-       * credential is gated by, without needing the device credential.
-       */
-      async getDeviceAdmissibleWorkspaces() {
-        return this.fetch("w/?can_use_device=1");
+      /** A bounded page of companion-device candidates, with admission checked per row. */
+      async getDeviceAdmissibleWorkspaces(options) {
+        const params = workspaceDirectoryParams(options);
+        params.set("can_use_device", "1");
+        return this.fetch(`w/?${params}`);
       }
-      /** List all publicly visible workspaces. */
-      async getPublicWorkspaces() {
-        return this.fetch("w/public");
+      /** A bounded page of publicly visible workspaces. */
+      async getPublicWorkspaces(options) {
+        return this.fetch(
+          `w/public?${workspaceDirectoryParams(options)}`
+        );
       }
       /** Get a single workspace by ID. */
       async getWorkspace(wid) {
@@ -14198,13 +14182,22 @@ var init_chunk_I7BMDNPO = __esm({
        * @param scope - Export scope ("workflows" for all workflows only). Cannot be combined with workflowId.
        * @param exclude - Comma-separated entity categories to exclude (e.g. "channels")
        */
-      async exportWorkspace(wid, workflowId, scope, exclude) {
+      async exportWorkspace(wid, workflowId, scope, exclude, options) {
         const searchParams = new URLSearchParams();
         if (workflowId !== void 0) searchParams.set("workflow_id", String(workflowId));
         if (scope !== void 0) searchParams.set("scope", scope);
         if (exclude !== void 0) searchParams.set("exclude", exclude);
+        if (options?.revisionId !== void 0)
+          searchParams.set("revision_id", String(options.revisionId));
+        if (options?.revisionMode !== void 0) {
+          searchParams.set("revision_mode", options.revisionMode);
+        } else if (options?.revisionId === void 0) {
+          searchParams.set("revision_mode", "active");
+        }
         const qs = searchParams.toString();
-        return this.fetch(`w/${wid}/export${qs ? `?${qs}` : ""}`);
+        const data = await this.fetch(`w/${wid}/export${qs ? `?${qs}` : ""}`);
+        this.verifyExportSelection(data, workflowId, options);
+        return data;
       }
       /** Preview the result of importing workspace configuration without applying changes.
        *
@@ -14263,15 +14256,60 @@ var init_chunk_I7BMDNPO = __esm({
        * target workspace.
        */
       /** Download a workspace export ZIP (``export.json`` + file blobs). */
-      async exportWorkspaceZip(wid, workflowId, scope, exclude) {
+      async exportWorkspaceZip(wid, workflowId, scope, exclude, options) {
         const searchParams = new URLSearchParams();
         if (workflowId !== void 0) searchParams.set("workflow_id", String(workflowId));
         if (scope !== void 0) searchParams.set("scope", scope);
         if (exclude !== void 0) searchParams.set("exclude", exclude);
+        if (options?.revisionId !== void 0)
+          searchParams.set("revision_id", String(options.revisionId));
+        if (options?.revisionMode !== void 0) {
+          searchParams.set("revision_mode", options.revisionMode);
+        } else if (options?.revisionId === void 0) {
+          searchParams.set("revision_mode", "active");
+        }
         const qs = searchParams.toString();
         const response = await this.fetchRaw(`w/${wid}/export.zip${qs ? `?${qs}` : ""}`);
+        if (options?.revisionId !== void 0 || options?.revisionMode === "all") {
+          const version = response.headers.get("X-Gravityrail-Export-Version");
+          const selection = response.headers.get("X-Gravityrail-Export-Selection");
+          const selected = options?.revisionId !== void 0;
+          if (version !== (selected ? "1.0" : "2.0") || selection !== (selected ? "selected" : "all") || selected && (workflowId === void 0 || !response.headers.get("X-Gravityrail-Export-Revision-Uuid")?.trim() || !response.headers.get("X-Gravityrail-Export-Workflow-Uuid")?.trim())) {
+            try {
+              await response.body?.cancel();
+            } catch {
+            }
+            throw new Error(
+              "Server did not return verified Workflow revision export headers. Request an explicit active snapshot or use a server that supports export provenance."
+            );
+          }
+        }
         return response.arrayBuffer();
       }
+      // Compatibility shape check only. The backend WorkspaceExportData
+      // _validate_revision_archive owns full graph/publication invariants.
+      verifyExportSelection(data, workflowId, options) {
+        const hasUuid = (value) => typeof value === "string" && value.trim().length > 0;
+        if (options?.revisionId !== void 0) {
+          const revisions = data?.workflowRevisions;
+          if (workflowId === void 0 || data?.version !== "1.0" || data.workflowRevisionSelection !== "selected" || !Array.isArray(revisions) || revisions.length !== 1) {
+            throw new Error(
+              "Server did not return the requested Workflow revision. Use a server that supports revision selection."
+            );
+          }
+          if (!hasUuid(revisions[0]?.uuid) || !hasUuid(revisions[0]?.workflow?.uuid) || !hasUuid(data.workflows?.[0]?.uuid) || data.workflows?.length !== 1 || revisions[0]?.workflow?.uuid !== data.workflows[0]?.uuid) {
+            throw new Error("Server export does not match the requested Workflow revision.");
+          }
+        } else if (options?.revisionMode === "all" && (data?.version !== "2.0" || data.workflowRevisionSelection !== "all" || !Array.isArray(data.workflowRevisions) || !Array.isArray(data.workflows) || data.workflows.some(
+          (workflow) => !hasUuid(workflow?.uuid) || !data.workflowRevisions?.some(
+            (revision) => hasUuid(revision?.uuid) && revision?.workflow?.uuid === workflow.uuid
+          )
+        ))) {
+          throw new Error(
+            "Server did not return all Workflow revisions. Request an explicit active snapshot or use a server that supports revision archives."
+          );
+        }
+      }
       /** Import workspace configuration from exported JSON, or from a ZIP archive.
        * Pass ``archive`` (the ZIP from ``exportWorkspaceZip``) to restore file
        * contents. ``exportData`` may be omitted when the ZIP contains it.
@@ -15480,6 +15518,7 @@ var init_chunk_I7BMDNPO = __esm({
       "getAgents",
       "getAnonymousResolution",
       "getAnonymousFormSubmission",
+      "getAnonymousFormSchema",
       "getAnonymousResolutions",
       "getApiKeys",
       "getArchiveBlockers",
@@ -15865,6 +15904,7 @@ var init_chunk_I7BMDNPO = __esm({
       "linkUnlinkedSalesforceMembersByIdentity",
       "listAbilities",
       "listAnonymousFormSubmissions",
+      "submitAnonymousForm",
       "listAppConnections",
       "listAvailableAppConnections",
       "listInstallations",
@@ -16202,6 +16242,8 @@ var init_chunk_I7BMDNPO = __esm({
       getCelContext;
       validateCelExpression;
       // Data Types API
+      getAnonymousFormSchema;
+      submitAnonymousForm;
       getDataTypes;
       getDataTypeDraft;
       saveDataTypeDraft;
@@ -17492,9 +17534,9 @@ var init_chunk_I7BMDNPO = __esm({
   }
 });
 
-// ../sdk/dist/chunk-72SWNLVD.js
-var init_chunk_72SWNLVD = __esm({
-  "../sdk/dist/chunk-72SWNLVD.js"() {
+// ../sdk/dist/chunk-MMDSZ25F.js
+var init_chunk_MMDSZ25F = __esm({
+  "../sdk/dist/chunk-MMDSZ25F.js"() {
   }
 });
 
@@ -17549,10 +17591,10 @@ var init_chunk_6KPGCPGW = __esm({
 var SEARCHABLE_EVENT_RULE_SOURCE_FIELDS, ActivityEventType, EntityKind;
 var init_dist = __esm({
   "../sdk/dist/index.js"() {
-    init_chunk_I7BMDNPO();
-    init_chunk_72SWNLVD();
+    init_chunk_XQTPXOBU();
+    init_chunk_MMDSZ25F();
     init_chunk_6KPGCPGW();
-    init_chunk_67QXTQVL();
+    init_chunk_TGL72KPS();
     SEARCHABLE_EVENT_RULE_SOURCE_FIELDS = [
       "taskId",
       "dataTypeId",
@@ -21638,22 +21680,6 @@ var init_output = __esm({
     };
   }
 });
-function extractOrgSessionFromSetCookies(setCookieValues, preferredCookieName) {
-  let fallback;
-  for (const value of setCookieValues) {
-    const nameValue = value.split(";")[0]?.trim() ?? "";
-    const eqIdx = nameValue.indexOf("=");
-    if (eqIdx === -1) continue;
-    const name = nameValue.slice(0, eqIdx).trim();
-    const credentialValue = nameValue.slice(eqIdx + 1).trim() || void 0;
-    if (!credentialValue) continue;
-    if (name === preferredCookieName) return credentialValue;
-    if (!fallback && (name.startsWith("orgToken") || name.startsWith("orgSession"))) {
-      fallback = credentialValue;
-    }
-  }
-  return fallback;
-}
 async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
   const response = await fetch(`${apiUrl}/api/v2/o/${orgAuthInfo.orgUuid}/join`, {
     method: "POST",
@@ -21669,16 +21695,16 @@ async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
   if (!response.ok) {
     throw new Error(`Org join failed (HTTP ${response.status})`);
   }
-  const rawHeaders = response.headers;
-  const setCookies = rawHeaders.getSetCookie?.() ?? (rawHeaders.get("set-cookie") ? [rawHeaders.get("set-cookie")] : []);
-  if (setCookies.length === 0) {
-    throw new Error("Org join succeeded but no Set-Cookie header returned");
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error("Org join succeeded but returned an invalid response");
   }
-  const orgSession = extractOrgSessionFromSetCookies(setCookies, orgAuthInfo.cookieName);
-  if (!orgSession) {
-    throw new Error("Org join succeeded but org session cookie not found in Set-Cookie");
+  if (typeof body.orgSession !== "string" || !body.orgSession) {
+    throw new Error("Org join succeeded but returned no org session");
   }
-  return orgSession;
+  return body.orgSession;
 }
 function isAllowedAuthUrl(url, apiUrl, frontendUrl) {
   try {
@@ -21719,62 +21745,31 @@ function isHeadless() {
   }
   return false;
 }
-function startOrgSessionCapture(expectedState, expectedOrgUuid, allowedOrigin) {
+function startOrgSessionCapture(expectedState, expectedOrgUuid, _allowedOrigin) {
   let resolveSession;
   let rejectSession;
   const session = new Promise((resolve3, reject) => {
     resolveSession = resolve3;
     rejectSession = reject;
   });
-  const applyCors = (req, res) => {
-    if (req.headers.origin && req.headers.origin === allowedOrigin) {
-      res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
-      res.setHeader("Vary", "Origin");
-    }
-    res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-  };
   const server = createServer((req, res) => {
-    applyCors(req, res);
-    if (req.method === "OPTIONS") {
-      res.setHeader("Access-Control-Allow-Private-Network", "true");
-      res.writeHead(204);
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    if (req.method !== "GET") {
+      res.writeHead(405);
       res.end();
       return;
     }
-    if (req.method !== "POST") {
-      res.writeHead(405);
-      res.end();
+    const callback = new URL(req.url ?? "/", "http://127.0.0.1");
+    const code = callback.searchParams.get("code");
+    if (callback.pathname !== "/" || !code?.startsWith("gr_cli_org_") || callback.searchParams.get("state") !== expectedState || callback.searchParams.get("org_uuid") !== expectedOrgUuid) {
+      res.writeHead(400);
+      res.end("Invalid sign-in callback");
       return;
     }
-    let body = "";
-    let tooLarge = false;
-    req.on("data", (chunk) => {
-      body += chunk;
-      if (body.length > 16 * 1024) {
-        tooLarge = true;
-        req.destroy();
-      }
-    });
-    req.on("end", () => {
-      if (tooLarge) return;
-      let capturedSession;
-      try {
-        const payload = JSON.parse(body);
-        if (typeof payload.org_session === "string" && payload.org_session.length > 0 && payload.state === expectedState && payload.org_uuid === expectedOrgUuid) {
-          capturedSession = payload.org_session;
-        }
-      } catch {
-      }
-      if (capturedSession) {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end('{"ok":true}');
-        resolveSession(capturedSession);
-      } else {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"ok":false}');
-      }
-    });
+    res.writeHead(200, { "Content-Type": "text/plain" });
+    res.end("Return to the terminal to finish sign-in.");
+    resolveSession(code);
   });
   let resolveReady;
   let rejectReady;
@@ -21806,22 +21801,30 @@ function startOrgSessionCapture(expectedState, expectedOrgUuid, allowedOrigin) {
   };
   return { ready, session, close };
 }
-function buildStepUpUrl(authUrl, orgUuid, port, state) {
+function buildStepUpUrl(authUrl, orgUuid, port, state, challenge) {
   const url = new URL(authUrl);
-  const bridgeQuery = new URLSearchParams({ org: orgUuid, port: String(port), state });
+  const bridgeQuery = new URLSearchParams({ org: orgUuid, port: String(port), state, challenge });
   url.searchParams.set("return_to", `${CLI_ORG_AUTH_BRIDGE_PATH}?${bridgeQuery.toString()}`);
   return url.toString();
 }
 function newStateNonce() {
   return randomBytes(16).toString("hex");
 }
-async function stepUpViaBrowser(orgAuthInfo) {
+async function stepUpViaBrowser(orgAuthInfo, apiUrl, accessToken) {
   const state = newStateNonce();
-  const allowedOrigin = new URL(orgAuthInfo.authUrl).origin;
-  const capture = startOrgSessionCapture(state, orgAuthInfo.orgUuid, allowedOrigin);
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  new URL(orgAuthInfo.authUrl).origin;
+  const capture = startOrgSessionCapture(state, orgAuthInfo.orgUuid);
   try {
     const port = await capture.ready;
-    const stepUpUrl = buildStepUpUrl(orgAuthInfo.authUrl, orgAuthInfo.orgUuid, port, state);
+    const stepUpUrl = buildStepUpUrl(
+      orgAuthInfo.authUrl,
+      orgAuthInfo.orgUuid,
+      port,
+      state,
+      challenge
+    );
     stderr2(`
 This workspace requires organization SSO authentication.`);
     stderr2(`Opening browser to complete sign-in...`);
@@ -21829,7 +21832,19 @@ This workspace requires organization SSO authentication.`);
 `);
     stderr2(`If the browser does not open, visit the URL above manually.`);
     openBrowser2(stepUpUrl);
-    return await capture.session;
+    const code = await capture.session;
+    const response = await fetch(`${apiUrl}/api/v2/auth/cli-org-handoff/redeem`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+      body: JSON.stringify({ orgUuid: orgAuthInfo.orgUuid, code, verifier })
+    });
+    if (!response.ok)
+      throw new Error(`Could not finish organization sign-in (${response.status}).`);
+    const result2 = await response.json();
+    if (typeof result2.orgSession !== "string" || !result2.orgSession.startsWith("gr_sess_")) {
+      throw new Error("Invalid organization sign-in response.");
+    }
+    return result2.orgSession;
   } finally {
     capture.close();
   }
@@ -21875,7 +21890,7 @@ function registerOrgAuthHandler(apiClient, apiUrl, accessToken, orgAuthCtx) {
         `Refusing to open organization auth URL: host does not match the configured API/frontend host. Re-run with the expected --api-url, or contact support.`
       );
     }
-    const session = await stepUpViaBrowser(orgAuthInfo);
+    const session = await stepUpViaBrowser(orgAuthInfo, apiUrl, accessToken);
     adopt(session);
   });
 }
@@ -24040,7 +24055,7 @@ var chatsDomain = {
 
 // ../sdk/dist/helpers.js
 init_chunk_6KPGCPGW();
-init_chunk_67QXTQVL();
+init_chunk_TGL72KPS();
 new TextEncoder();
 var WORKSPACE_EXPORT_JSON_MEMBER = "export.json";
 var MAX_EXPORT_JSON_BYTES = 8 * 1024 * 1024;
@@ -26339,7 +26354,9 @@ async function exportTemplateArchive(client3, templateUuid) {
   return withTransferProgress(
     "template archive",
     templateUuid,
-    () => client3.exportWorkspaceZip(templateUuid, void 0, void 0, REAPPLY_EXPORT_EXCLUDE)
+    () => client3.exportWorkspaceZip(templateUuid, void 0, void 0, REAPPLY_EXPORT_EXCLUDE, {
+      revisionMode: "active"
+    })
   );
 }
 async function readBindingsFile(filePath, targets) {
@@ -26673,26 +26690,27 @@ var workspacesDomain = {
     }),
     {
       path: ["workspaces", "list"],
-      description: "List workspaces",
+      description: "List a searchable page of workspaces",
       requiresWorkspace: false,
       columns: COLUMNS6,
       args: [
+        { name: "page", description: "Page number" },
+        { name: "page-size", description: "Page size (at most 100)" },
+        { name: "search", description: "Search name, slug or UUID" },
         {
           name: "org",
           aliases: ["org-uuid"],
-          description: "Only workspaces in this organization (UUID). Filters the list client-side on organizationUuid."
+          description: "Only workspaces in this organization (UUID)."
         }
       ],
       examples: ["gr workspaces list --org <org-uuid> -o json"],
       handler: async ({ ctx, args }) => {
-        const result2 = await requireAuth(ctx).apiClient.getWorkspaces();
-        const org = typeof args.org === "string" ? args.org.trim().toLowerCase() : "";
-        const items = org ? unwrapItems(result2).filter(
-          (ws) => String(
-            ws.organizationUuid ?? ""
-          ).toLowerCase() === org
-        ) : result2;
-        outputData(listResult(items, false), ctx, COLUMNS6);
+        const result2 = await requireAuth(ctx).apiClient.getWorkspaces({
+          ...parsePaginationArgs(args),
+          search: typeof args.search === "string" ? args.search : void 0,
+          organizationUuid: typeof args.org === "string" ? args.org.trim() : void 0
+        });
+        outputData(listResult(result2, false), ctx, COLUMNS6);
       }
     },
     // Custom get that accepts either --id or -w as the workspace identifier
@@ -26828,6 +26846,14 @@ Provisioning started. Watch it come up with:
           name: "workflow-id",
           description: "Export a single workflow by ID"
         },
+        {
+          name: "revision-id",
+          description: "Export one revision ID. Requires --workflow-id; import updates an editable draft."
+        },
+        {
+          name: "revision-mode",
+          description: "active (default, current snapshot only) or all (history including drafts)"
+        },
         {
           name: "exclude",
           description: 'Comma-separated categories to exclude (e.g. "channels")'
@@ -26851,6 +26877,15 @@ Provisioning started. Watch it come up with:
       handler: async ({ ctx, workspace, args }) => {
         const scope = args["scope"];
         const workflowIdStr = args["workflow-id"];
+        const revisionIdStr = args["revision-id"];
+        const revisionId = revisionIdStr === void 0 ? void 0 : Number(revisionIdStr);
+        const revisionMode = args["revision-mode"] ?? (revisionId !== void 0 ? "all" : "active");
+        if (revisionId !== void 0 && (!Number.isSafeInteger(revisionId) || revisionId <= 0)) {
+          throw new CLIError("--revision-id must be a positive integer");
+        }
+        if (revisionMode !== "all" && revisionMode !== "active") {
+          throw new CLIError('--revision-mode must be "all" or "active"');
+        }
         const exclude = args["exclude"];
         const outputPath = args["output"];
         const formatArg = args["format"];
@@ -26861,6 +26896,12 @@ Provisioning started. Watch it come up with:
         if (scope && workflowId !== void 0) {
           throw new CLIError("Cannot specify both --scope and --workflow-id");
         }
+        if (revisionId !== void 0 && (workflowId === void 0 || revisionMode !== "all")) {
+          throw new CLIError(
+            "--revision-id requires --workflow-id and cannot be combined with active mode"
+          );
+        }
+        const revisionOptions = { revisionId, revisionMode };
         if (scope && scope !== "workflows") {
           throw new CLIError('--scope must be "workflows"');
         }
@@ -26877,7 +26918,8 @@ Provisioning started. Watch it come up with:
             workspace,
             workflowId,
             scope,
-            exclude
+            exclude,
+            revisionOptions
           );
           await writeFile(outputPath, Buffer.from(zip));
           process.stdout.write(`Saved ZIP export to ${outputPath}
@@ -26888,7 +26930,8 @@ Provisioning started. Watch it come up with:
           workspace,
           workflowId,
           scope,
-          exclude
+          exclude,
+          revisionOptions
         );
         if (outputPath) {
           await writeFile(outputPath, `${JSON.stringify(result2, null, 2)}
@@ -28027,11 +28070,19 @@ Each entry in "fields" (a schema field)
   required (bool)                       Whether the field must be supplied
   description (string)                  Optional help text
   options (array)                       For fieldType "enum": [{"label":"\u2026","value":"\u2026"}, \u2026]
-  referencedTypeId (number)             For reference fields: target data type id
+  referencedTypeId (number)             For reference fields: target Form integer id
+  referenceFieldId (number)             Server-issued reference identity. Preserve on update;
+                                        omit for a new reference field.
 
 Valid fieldType values
   text, longtext, email, phone, number, integer, boolean, date, datetime,
-  time_of_day, us_zip_code, enum, array, object, function
+  time_of_day, us_zip_code, enum, array, object, function, reference
+
+Record references
+  {"slug":"customer","name":"Customer","fieldType":"reference","referencedTypeId":8}
+  Record fieldValues use a positive existing integer record id, or null to clear.
+  Reference fields require authenticated reads/writes. Portable transfer and CSV
+  import/export for Forms with references are unsupported.
 
 Example
   gr data-types create -w $WID --allow-write --data '{"name":"Patient","fields":[
@@ -28340,8 +28391,15 @@ var ACTION_PARAM_HINTS = {
   },
   "assistant:message": {
     summary: "inject an assistant message into the chat",
-    shape: ['{"message":"Welcome! \u2026","suggestions":["Yes","No"],"waitForResponse":<bool>}'],
-    notes: ['message is required. The key is "message", not "messageTemplate".']
+    shape: [
+      '{"message":"Welcome! \u2026","suggestions":["Yes","No"],"waitForResponse":<bool>,"allowInterrupt":<bool>}'
+    ],
+    notes: [
+      'message is required. The key is "message", not "messageTemplate".',
+      "allowInterrupt (default true) is barge-in; waitForResponse (default true) is turn",
+      "ownership. They are independent \u2014 do not derive one from the other. allowInterrupt=false",
+      "is honoured only on a native canned-speech voice provider (xAI force_message)."
+    ]
   },
   "chat:pause": {
     summary: "pause the chat for a human response",
@@ -33871,7 +33929,7 @@ var NO_UUID_LOOKUP = /* @__PURE__ */ new Set([
 ]);
 var HYDRATORS = {
   workspace: async ({ client: client3 }, ref) => (await client3.getWorkspace(ref.uuid)).name,
-  org: async ({ orgNames }, ref) => (await orgNames()).get(ref.uuid),
+  org: async ({ orgNames }, ref) => (await orgNames(ref.uuid)).get(ref.uuid),
   workflow: async ({ client: client3 }, ref) => {
     const detail = await client3.getWorkflow(requireWorkspace(ref), ref.uuid);
     return detail.workflow?.name;
@@ -33933,7 +33991,7 @@ var ActivityRefResolver = class {
   inFlight = /* @__PURE__ */ new Map();
   fetches = 0;
   /** The org membership listing, fetched at most once per invocation. */
-  orgNamesPromise;
+  orgNamesPromises = /* @__PURE__ */ new Map();
   /** How many API calls hydration actually made. `--ids` must keep this at 0. */
   get fetchCount() {
     return this.fetches;
@@ -34115,21 +34173,24 @@ var ActivityRefResolver = class {
     return resolution.label;
   }
   /**
-   * The caller's org memberships as uuid → name, fetched once.
+   * The caller's matching organization membership, fetched once per UUID.
    *
    * The promise is cached, not its value, so N org refs resolving at once
    * share one request — the same rule the ref cache follows.
    */
-  orgNames() {
-    this.orgNamesPromise ??= this.client.getMyOrganizations().then(
+  orgNames(uuid) {
+    const cached = this.orgNamesPromises.get(uuid);
+    if (cached) return cached;
+    const pending = this.client.getMyOrganizations({ search: uuid, pageSize: 1 }).then(
       (memberships) => new Map(
-        memberships.map((membership) => [
+        memberships.items.map((membership) => [
           membership.organizationUuid,
           membership.organizationName
         ])
       )
     );
-    return this.orgNamesPromise;
+    this.orgNamesPromises.set(uuid, pending);
+    return pending;
   }
   async lookup(ref) {
     const hydrator = HYDRATORS[ref.kind];
@@ -34142,7 +34203,10 @@ var ActivityRefResolver = class {
     }
     this.fetches += 1;
     try {
-      const name = await hydrator({ client: this.client, orgNames: () => this.orgNames() }, ref);
+      const name = await hydrator(
+        { client: this.client, orgNames: (uuid) => this.orgNames(uuid) },
+        ref
+      );
       if (!name) return { label: bareLabel(ref), status: "unresolved" };
       return { label: name, status: "resolved" };
     } catch (error) {
@@ -36924,8 +36988,21 @@ var orgDomain = {
       path: ["org", "list"],
       description: "List my organizations",
       requiresWorkspace: false,
-      handler: async ({ ctx }) => {
-        const result2 = await requireAuth(ctx).apiClient.getMyOrganizations();
+      args: [
+        { name: "page", description: "Page number", default: "1" },
+        {
+          name: "page-size",
+          description: "Entries per page (maximum 100)",
+          default: "25"
+        },
+        { name: "search", description: "Search organization name or slug" }
+      ],
+      handler: async ({ ctx, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getMyOrganizations({
+          page: Number(args.page ?? 1),
+          pageSize: Number(args["page-size"] ?? 25),
+          search: args.search
+        });
         outputData(result2, ctx, ORG_COLUMNS);
       }
     },
@@ -45597,7 +45674,15 @@ init_errors();
 init_output();
 async function devImportLocalCommand(ctx, workspace) {
   stderr2(`Exporting workspace ${workspace}...`);
-  const exportData = await ctx.apiClient.exportWorkspace(workspace);
+  const exportData = await ctx.apiClient.exportWorkspace(
+    workspace,
+    void 0,
+    void 0,
+    void 0,
+    {
+      revisionMode: "active"
+    }
+  );
   stderr2("Export successful!");
   stderr2(`  Workflows: ${(exportData.workflows || []).length}`);
   stderr2(`  Tasks: ${(exportData.tasks || []).length}`);
@@ -45952,8 +46037,8 @@ var COLUMNS36 = [
   { header: "UUID", getValue: (o) => o.organizationUuid },
   { header: "ROLE", getValue: (o) => o.role || "" }
 ];
-async function organizationsListCommand(ctx) {
-  const organizations = await ctx.apiClient.getMyOrganizations();
+async function organizationsListCommand(ctx, options = {}) {
+  const organizations = await ctx.apiClient.getMyOrganizations(options);
   outputData(organizations, ctx, COLUMNS36);
 }
 
@@ -46260,16 +46345,34 @@ var topLevelCommands = [
   },
   {
     path: ["organizations", "list"],
-    description: "List organizations",
-    handler: async ({ ctx }) => {
-      await organizationsListCommand(requireAuth(ctx));
+    description: "List a searchable page of organizations",
+    args: [
+      { name: "page", description: "Page number", default: "1" },
+      { name: "page-size", description: "Entries per page (maximum 100)", default: "25" },
+      { name: "search", description: "Search organization name or slug" }
+    ],
+    handler: async ({ ctx, args }) => {
+      await organizationsListCommand(requireAuth(ctx), {
+        page: Number(args.page ?? 1),
+        pageSize: Number(args["page-size"] ?? 25),
+        search: args.search
+      });
     }
   },
   {
     path: ["orgs", "list"],
-    description: "List organizations",
-    handler: async ({ ctx }) => {
-      await organizationsListCommand(requireAuth(ctx));
+    description: "List a searchable page of organizations",
+    args: [
+      { name: "page", description: "Page number", default: "1" },
+      { name: "page-size", description: "Entries per page (maximum 100)", default: "25" },
+      { name: "search", description: "Search organization name or slug" }
+    ],
+    handler: async ({ ctx, args }) => {
+      await organizationsListCommand(requireAuth(ctx), {
+        page: Number(args.page ?? 1),
+        pageSize: Number(args["page-size"] ?? 25),
+        search: args.search
+      });
     }
   }
 ];
@@ -46279,7 +46382,7 @@ init_concierge_api();
 
 // package.json
 var package_default = {
-  version: "0.46.0"};
+  version: "0.49.0"};
 
 // src/gr.ts
 var VERSION = package_default.version;