@gravity-rail/cli 0.53.0 → 0.55.0

package/dist/gr.js

@@ -15,12 +15,22 @@ import { stdout, stdin } from 'process';
 import { writeFile, readFile } from 'fs/promises';
 import { EventEmitter } from 'events';
 
-createRequire(import.meta.url);
+const require$1 = createRequire(import.meta.url);
 const __filename$1 = fileURLToPath(import.meta.url);
 dirname(__filename$1);
 
+var __create = Object.create;
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
+}) : x)(function(x) {
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res, err) => function __init() {
   if (err) throw err[0];
   try {
@@ -29,10 +39,33 @@ var __esm = (fn, res, err) => function __init() {
     throw err = [e], e;
   }
 };
+var __commonJS = (cb, mod) => function __require2() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  __defProp(target, "default", { value: mod, enumerable: true }) ,
+  mod
+));
 
 // src/lib/errors.ts
 function handleError(err) {
@@ -3131,7 +3164,7 @@ var init_libphonenumber_js = __esm({
   }
 });
 
-// ../sdk/dist/chunk-6F4YJJKQ.js
+// ../sdk/dist/chunk-BF4MOZZO.js
 function resourceWorkflowsPath(wid, ...segments) {
   const tail = segments.map((segment) => encodeURIComponent(String(segment))).join("/");
   const base = `w/${encodeURIComponent(wid)}/resource-workflows`;
@@ -3398,6 +3431,7 @@ function createApiModules(apiKey, baseUrl3, customFetch) {
     qualifications: new QualificationsApi(apiKey, baseUrl3, customFetch),
     personas: new PersonasApi(apiKey, baseUrl3, customFetch),
     metrics: new MetricsApi(apiKey, baseUrl3, customFetch),
+    dataReports: new DataReportsApi(apiKey, baseUrl3, customFetch),
     queries: new QueriesApi(apiKey, baseUrl3, customFetch),
     reports: new ReportsApi(apiKey, baseUrl3, customFetch),
     resourceWorkflows: new ResourceWorkflowsApi(apiKey, baseUrl3, customFetch),
@@ -3720,6 +3754,7 @@ function bindMembersMethods(target, members) {
 }
 function bindWorkspacesMethods(target, workspaces, signupRequests) {
   target.getWorkspaces = workspaces.getWorkspaces.bind(workspaces);
+  target.getOrganizationWorkspacePages = workspaces.getOrganizationWorkspacePages.bind(workspaces);
   target.getDeviceAdmissibleWorkspaces = workspaces.getDeviceAdmissibleWorkspaces.bind(workspaces);
   target.getPublicWorkspaces = workspaces.getPublicWorkspaces.bind(workspaces);
   target.getWorkspace = workspaces.getWorkspace.bind(workspaces);
@@ -3915,6 +3950,7 @@ function bindFilesMethods(target, files) {
   target.convertFile = files.convertFile.bind(files);
   target.generateFileUploadUrl = files.generateFileUploadUrl.bind(files);
   target.getFolders = files.getFolders.bind(files);
+  target.getFolderChildren = files.getFolderChildren.bind(files);
   target.getFolder = files.getFolder.bind(files);
   target.createFolder = files.createFolder.bind(files);
   target.updateFolder = files.updateFolder.bind(files);
@@ -3995,6 +4031,7 @@ function bindWorkflowsMethods(target, workflows, workflowNotes, voice, superviso
   target.getWorkflowsActivityBatch = workflows.getWorkflowsActivityBatch.bind(workflows);
   target.getWorkflowDiagram = workflows.getWorkflowDiagram.bind(workflows);
   target.getWorkflowOutline = workflows.getWorkflowOutline.bind(workflows);
+  target.getWorkflowsOutlineBatch = workflows.getWorkflowsOutlineBatch.bind(workflows);
   target.createWorkflow = workflows.createWorkflow.bind(workflows);
   target.updateWorkflow = workflows.updateWorkflow.bind(workflows);
   target.getWorkflowDeletionPreview = workflows.getWorkflowDeletionPreview.bind(workflows);
@@ -4008,6 +4045,7 @@ function bindWorkflowsMethods(target, workflows, workflowNotes, voice, superviso
   target.getTaskChats = workflows.getTaskChats.bind(workflows);
   target.getWorkflowConfigValidation = workflows.getWorkflowConfigValidation.bind(workflows);
   target.getWorkflowPromptClassifications = workflows.getWorkflowPromptClassifications.bind(workflows);
+  target.reviewWorkflowPromptClassifications = workflows.reviewWorkflowPromptClassifications.bind(workflows);
   target.getWorkflowNotes = workflowNotes.getWorkflowNotes.bind(workflowNotes);
   target.createWorkflowNote = workflowNotes.createWorkflowNote.bind(workflowNotes);
   target.updateWorkflowNote = workflowNotes.updateWorkflowNote.bind(workflowNotes);
@@ -4204,6 +4242,12 @@ function bindAppsMethods(target, apps, builders, inquiries, oauth, oauthConnecti
   target.deleteInquiry = inquiries.deleteInquiry.bind(inquiries);
   target.exportInquiriesCsv = inquiries.exportInquiriesCsv.bind(inquiries);
   target.authorize = oauth.authorize.bind(oauth);
+  target.denyAuthorization = oauth.denyAuthorization.bind(oauth);
+  target.getOAuthConsentClient = oauth.getOAuthConsentClient.bind(oauth);
+  target.getMcpConsentTargets = oauth.getMcpConsentTargets.bind(oauth);
+  target.listMcpGrants = oauth.listMcpGrants.bind(oauth);
+  target.narrowMcpGrant = oauth.narrowMcpGrant.bind(oauth);
+  target.revokeMcpGrant = oauth.revokeMcpGrant.bind(oauth);
   target.exchangeOAuthToken = oauth.exchangeOAuthToken.bind(oauth);
   target.getAvailableScopes = oauth.getAvailableScopes.bind(oauth);
   target.getOAuthConnectionStatus = oauthConnections.getConnectionStatus.bind(oauthConnections);
@@ -4301,6 +4345,8 @@ function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackAp
   target.fhirGetEncounterSyncRuns = fhirConnections.fhirGetEncounterSyncRuns.bind(fhirConnections);
   target.fhirRefreshEncounterPatient = fhirConnections.fhirRefreshEncounterPatient.bind(fhirConnections);
   target.fhirBackfillEncounterSync = fhirConnections.fhirBackfillEncounterSync.bind(fhirConnections);
+  target.fhirStartOnboardingImport = fhirConnections.fhirStartOnboardingImport.bind(fhirConnections);
+  target.fhirGetOnboardingImportStatus = fhirConnections.fhirGetOnboardingImportStatus.bind(fhirConnections);
   target.configurePatientSync = patientSyncConnections.configurePatientSync.bind(patientSyncConnections);
   target.getPatientSyncStatus = patientSyncConnections.getPatientSyncStatus.bind(patientSyncConnections);
   target.deletePatientSyncConnection = patientSyncConnections.deletePatientSyncConnection.bind(patientSyncConnections);
@@ -4387,6 +4433,7 @@ function bindIntegrationsMethods(target, mondayIntegration, discordBots, slackAp
   target.listAvailableAppConnections = appConnections.listAvailableAppConnections.bind(appConnections);
   target.listAppConnections = appConnections.listAppConnections.bind(appConnections);
   target.enablePlatformApp = appConnections.enablePlatformApp.bind(appConnections);
+  target.configureZendeskConnection = appConnections.configureZendeskConnection.bind(appConnections);
   target.getPlatformApp = appConnections.getPlatformApp.bind(appConnections);
   target.updatePlatformApp = appConnections.updatePlatformApp.bind(appConnections);
   target.deletePlatformApp = appConnections.deletePlatformApp.bind(appConnections);
@@ -4435,6 +4482,7 @@ function bindOrgMethods(target, org) {
   target.getVoiceTrustProducts = org.getVoiceTrustProducts.bind(org);
   target.syncVoiceTrustProducts = org.syncVoiceTrustProducts.bind(org);
   target.createOrganizationWorkspace = org.createOrganizationWorkspace.bind(org);
+  target.getOrganizationWorkspaces = org.getOrganizationWorkspaces.bind(org);
   target.getOrganizationWorkspace = org.getOrganizationWorkspace.bind(org);
   target.updateOrganizationWorkspace = org.updateOrganizationWorkspace.bind(org);
   target.getOrgBillingCustomer = org.getOrgBillingCustomer.bind(org);
@@ -4444,7 +4492,20 @@ function bindOrgMethods(target, org) {
   target.updateOrganizationMember = org.updateOrganizationMember.bind(org);
   target.listOrgWebhookEndpoints = org.listOrgWebhookEndpoints.bind(org);
   target.getOrgWebhookEndpoint = org.getOrgWebhookEndpoint.bind(org);
+  target.createOrgWebhookEndpoint = org.createOrgWebhookEndpoint.bind(org);
   target.updateOrgWebhookEndpoint = org.updateOrgWebhookEndpoint.bind(org);
+  target.listOrgWebhookEndpointDeliveries = org.listOrgWebhookEndpointDeliveries.bind(org);
+  target.replayOrgWebhookDelivery = org.replayOrgWebhookDelivery.bind(org);
+  target.discardPendingOrgWebhookDeliveries = org.discardPendingOrgWebhookDeliveries.bind(org);
+  target.getOrgWebhookEndpointCoverage = org.getOrgWebhookEndpointCoverage.bind(org);
+  target.testOrgWebhookEndpoint = org.testOrgWebhookEndpoint.bind(org);
+  target.listWorkspaceLabels = org.listWorkspaceLabels.bind(org);
+  target.createWorkspaceLabel = org.createWorkspaceLabel.bind(org);
+  target.updateWorkspaceLabel = org.updateWorkspaceLabel.bind(org);
+  target.deleteWorkspaceLabel = org.deleteWorkspaceLabel.bind(org);
+  target.getWorkspaceLabels = org.getWorkspaceLabels.bind(org);
+  target.setWorkspaceLabels = org.setWorkspaceLabels.bind(org);
+  target.previewWorkspaceScope = org.previewWorkspaceScope.bind(org);
 }
 function bindPronunciationsMethods(target, pronunciations) {
   target.getPronunciationEntries = pronunciations.getPronunciationEntries.bind(pronunciations);
@@ -4583,6 +4644,9 @@ function bindMetricsMethods(target, metrics) {
   target.getMetricSeries = metrics.getMetricSeries.bind(metrics);
   target.computeChatMetrics = metrics.computeChatMetrics.bind(metrics);
 }
+function bindDataReportsMethods(target, dataReports) {
+  target.previewDataReport = dataReports.previewDataReport.bind(dataReports);
+}
 function bindQueriesMethods(target, queries) {
   target.getQueryFields = queries.getQueryFields.bind(queries);
   target.validateQuery = queries.validateQuery.bind(queries);
@@ -4652,9 +4716,9 @@ function getRevisionState(workflow, revision) {
     state: revision?.publishedAt != null ? "published" : "draft"
   };
 }
-var AbilitiesApi, ResourceWorkflowsApi, BundlesApi, InstallationsApi, AccessGrantsApi, AgentTasksApi, AgentsApi, AIModelsApi, ApiKeysApi, AppsApi, AssignmentsApi, VoiceApi, AuthApi, BuildersApi, CalendarsApi, CallsApi, CELApi, ChatsApi, ConfluenceApi, CustomToolkitsApi, DataTypesApi, DiscordBotsApi, SlackAppsApi, EventsApi, FeaturesApi, FhirConnectionsApi, InboundFaxStatus, DocumoFaxApi, HealthieApi, FilesApi, InboxesApi, InquiriesApi, AppConnectionsApi, McpServersApi, MemberImportValidationError, MembersApi, MondayIntegrationApi, NotificationRulesApi, OperatorApi, OrgApi, OAuthConnectionsApi, OAuthApi, PhoneNumbersApi, PronunciationsApi, PromptsApi, PersonasApi, QueriesApi, QualificationsApi, ReportsApi, RoutingRulesApi, SalesforceApi, ConnectionSyncApi, HubspotApi, SitesApi, SubscriptionsApi, SupportRequestsApi, CustomersApi, ResellersApi, SupervisorsApi, TasksApi, TemplatesApi, ToolkitsApi, JourneysApi, WorkflowsApi, WorkflowNotesApi, EventRuleObjectType, EventRuleEventType, EventRuleActionType, DriverMode, MEMBER_RELATIONSHIP_KINDS, WorkspaceInvitationsApi, WorkspacesApi, DashboardsApi, DevicesApi, TeamsAppsApi, ExperimentsApi, PatientSyncConnectionsApi, ActivityApi, MotdApi, InterventionRequestsApi, MetricsApi, ProjectsApi, TrackedLinksApi, WORKSPACE_METHOD_NAMES, WORKSPACE_METHOD_NAME_SET, GravityRailClient, WIDGET_SLUGS, CHAT_TYPES, BUILTIN_ASSISTANT_CHAT_TYPES, MEMBER_AGENT_CHAT_TYPES, ActivityGrain, ActivityGroupBy, ActivityOpenItemOrder, ActivityWindowBasis;
-var init_chunk_6F4YJJKQ = __esm({
-  "../sdk/dist/chunk-6F4YJJKQ.js"() {
+var AbilitiesApi, ResourceWorkflowsApi, BundlesApi, InstallationsApi, AccessGrantsApi, AgentTasksApi, AgentsApi, AIModelsApi, ApiKeysApi, AppsApi, AssignmentsApi, VoiceApi, AuthApi, BuildersApi, CalendarsApi, CallsApi, CELApi, ChatsApi, ConfluenceApi, CustomToolkitsApi, DataTypesApi, DiscordBotsApi, SlackAppsApi, EventsApi, FeaturesApi, FhirConnectionsApi, InboundFaxStatus, DocumoFaxApi, HealthieApi, FilesApi, InboxesApi, InquiriesApi, AppConnectionsApi, McpServersApi, MemberImportValidationError, MembersApi, MondayIntegrationApi, NotificationRulesApi, OperatorApi, OrgApi, OAuthConnectionsApi, OAuthApi, PhoneNumbersApi, PronunciationsApi, PromptsApi, PersonasApi, QueriesApi, QualificationsApi, ReportsApi, RoutingRulesApi, SalesforceApi, ConnectionSyncApi, HubspotApi, SitesApi, SubscriptionsApi, SupportRequestsApi, CustomersApi, ResellersApi, SupervisorsApi, TasksApi, TemplatesApi, ToolkitsApi, JourneysApi, WorkflowsApi, WorkflowNotesApi, EventRuleObjectType, EventRuleEventType, EventRuleActionType, DriverMode, MEMBER_RELATIONSHIP_KINDS, WorkspaceInvitationsApi, WorkspacesApi, DashboardsApi, DevicesApi, TeamsAppsApi, ExperimentsApi, PatientSyncConnectionsApi, ActivityApi, MotdApi, InterventionRequestsApi, MetricsApi, DataReportsApi, ProjectsApi, TrackedLinksApi, WORKSPACE_METHOD_NAMES, WORKSPACE_METHOD_NAME_SET, GravityRailClient, WIDGET_SLUGS, CHAT_TYPES, BUILTIN_ASSISTANT_CHAT_TYPES, MEMBER_AGENT_CHAT_TYPES, ActivityGrain, ActivityGroupBy, ActivityOpenItemOrder, ActivityWindowBasis;
+var init_chunk_BF4MOZZO = __esm({
+  "../sdk/dist/chunk-BF4MOZZO.js"() {
     init_chunk_GCN4OMYU();
     init_libphonenumber_js();
     AbilitiesApi = class extends BaseApiClient {
@@ -7970,6 +8034,36 @@ var init_chunk_6F4YJJKQ = __esm({
           { method: "POST", body: JSON.stringify(data) }
         );
       }
+      /**
+       * Start, resume, override or preview (dry run) an athenahealth connection's
+       * onboarding import. The body is exactly the three mode flags; the server
+       * traverses the connection's configured department/status pairs. Returns
+       * 202 with the Temporal workflow and run ids. Requires `workspace:admin`.
+       */
+      async fhirStartOnboardingImport(wid, connectionId, data = {}) {
+        const body = {
+          dryRun: data.dryRun ?? false,
+          resume: data.resume ?? false,
+          override: data.override ?? false
+        };
+        return this.fetch(
+          `w/${wid}/app-connections/fhir/connections/${connectionId}/onboarding-import`,
+          {
+            method: "POST",
+            body: JSON.stringify(body)
+          }
+        );
+      }
+      /**
+       * Read an athenahealth connection's onboarding-import progress (durable,
+       * approximate totals) and its known Temporal execution. GET-only: never
+       * starts or resumes work. Requires `workspace:admin`.
+       */
+      async fhirGetOnboardingImportStatus(wid, connectionId) {
+        return this.fetch(
+          `w/${wid}/app-connections/fhir/connections/${connectionId}/onboarding-import`
+        );
+      }
     };
     InboundFaxStatus = {
       pending: "pending",
@@ -8172,8 +8266,8 @@ var init_chunk_6F4YJJKQ = __esm({
        * Download one file's bytes via GET ``.../files/{id}/contents/{filename}``.
        *
        * Uses this client's base URL (FastAPI on the app, same-origin ``/api/v2``
-       * on scoped site sessions) so the payload does not transit the Next.js
-       * ``/api/w/.../files/...`` Lambda proxy, which 500s above the 6MB sync cap.
+       * on scoped site sessions). The Next.js ``/api/w/.../files/...`` route
+       * redirects to this same contents path; calling it directly skips the hop.
        */
       async downloadFileContents(wid, id, filename) {
         const response = await this.fetchRaw(
@@ -8257,9 +8351,9 @@ var init_chunk_6F4YJJKQ = __esm({
         );
       }
       /**
-       * Same-origin proxy URL for a version's raw contents. Mirrors the shape of
-       * `FileResponse.cdnUrl`: an app-relative Next.js route that authenticates
-       * via session cookies and forwards to the versioned contents endpoint.
+       * Same-origin URL for a version's raw contents. The Next.js route
+       * requires a session and redirects to the versioned FastAPI contents
+       * endpoint. Mirrors the shape of `FileResponse.cdnUrl`.
        */
       getFileVersionContentsUrl(wid, fileId, versionNumber) {
         return `/api/w/${wid}/files/${fileId}/versions/${versionNumber}/contents`;
@@ -8291,6 +8385,19 @@ var init_chunk_6F4YJJKQ = __esm({
         const parentId = typeof parentIdOrOpts === "number" ? parentIdOrOpts : parentIdOrOpts.parentId;
         return this.fetch(`w/${wid}/folders?parent_id=${parentId}`);
       }
+      /**
+       * Readable children of many parents in one request.
+       *
+       * Every id comes back as a key. A parent with no readable children maps to
+       * an empty list. The server accepts at most 100 ids per call.
+       */
+      async getFolderChildren(wid, parentIds) {
+        const params = new URLSearchParams();
+        for (const parentId of parentIds) {
+          params.append("parent_ids", String(parentId));
+        }
+        return this.fetch(`w/${wid}/folders/children?${params}`);
+      }
       /** Get a single folder by ID. */
       async getFolder(wid, id) {
         return this.fetch(`w/${wid}/folders/${id}`);
@@ -8698,6 +8805,19 @@ var init_chunk_6F4YJJKQ = __esm({
           body: JSON.stringify(data)
         });
       }
+      /**
+       * Create a public Zendesk Help Center connection with its sync paused.
+       *
+       * The acting Member becomes the sync owner. Later settings edits,
+       * pause/resume, Sync now and run history use the generic connection-sync
+       * methods (`updateConnectionSyncConfig`, `startSyncRun`, `getSyncRuns`).
+       */
+      async configureZendeskConnection(wid, data) {
+        return this.fetch(`w/${wid}/app-connections/zendesk/configure`, {
+          method: "POST",
+          body: JSON.stringify(data)
+        });
+      }
       /**
        * Get platform app connection details by UUID.
        */
@@ -10709,6 +10829,45 @@ var init_chunk_6F4YJJKQ = __esm({
           `o/${orgIdOrUuid}/webhooks/${endpointUuid}/deliveries?limit=${limit}`
         );
       }
+      /**
+       * Requeue one dead-lettered or expired delivery on its existing row.
+       *
+       * The response is identifiers only. The drain signs a fresh timestamp
+       * when it sends; this call does not POST to the receiver.
+       */
+      async replayOrgWebhookDelivery(orgIdOrUuid, endpointUuid, deliveryId) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/webhooks/${endpointUuid}/deliveries/${deliveryId}/replay`,
+          {
+            method: "POST",
+            body: JSON.stringify({})
+          }
+        );
+      }
+      /**
+       * Expire every pending delivery of a paused or disabled endpoint, so a
+       * resume does not re-send a held backlog the receiver keeps rejecting.
+       * Refused with 409 while the endpoint is active. Dead-lettered rows
+       * are untouched; expired rows stay replayable one at a time.
+       */
+      async discardPendingOrgWebhookDeliveries(orgIdOrUuid, endpointUuid) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/webhooks/${endpointUuid}/deliveries/discard-pending`,
+          {
+            method: "POST",
+            body: JSON.stringify({})
+          }
+        );
+      }
+      /**
+       * Which covered workspaces have the subscribed Forms opted in
+       * (`webhookEventsEnabled`). Record events only.
+       */
+      async getOrgWebhookEndpointCoverage(orgIdOrUuid, endpointUuid) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/webhooks/${endpointUuid}/coverage`
+        );
+      }
       /**
        * A representative delivery body for one event type — what the test-send
        * editor is prefilled with, and the same builder the public event catalog
@@ -10770,6 +10929,57 @@ var init_chunk_6F4YJJKQ = __esm({
           method: "DELETE"
         });
       }
+      // =========================================================================
+      // Workspace labels — the organization's own taxonomy of its workspaces
+      // =========================================================================
+      /** Every label of the organization, with workspace and webhook-selector counts. */
+      async listWorkspaceLabels(orgIdOrUuid) {
+        return this.fetch(`o/${orgIdOrUuid}/workspace-labels`);
+      }
+      async createWorkspaceLabel(orgIdOrUuid, data) {
+        return this.fetch(`o/${orgIdOrUuid}/workspace-labels`, {
+          method: "POST",
+          body: JSON.stringify(data)
+        });
+      }
+      /** Rename or recolor a label. The slug never changes. */
+      async updateWorkspaceLabel(orgIdOrUuid, labelUuid, data) {
+        return this.fetch(`o/${orgIdOrUuid}/workspace-labels/${labelUuid}`, {
+          method: "PATCH",
+          body: JSON.stringify(data)
+        });
+      }
+      /** Delete a label. Refused (409) while a webhook label selector requires it. */
+      async deleteWorkspaceLabel(orgIdOrUuid, labelUuid) {
+        return this.fetch(`o/${orgIdOrUuid}/workspace-labels/${labelUuid}`, {
+          method: "DELETE"
+        });
+      }
+      /**
+       * Which workspaces a webhook scope (explicit workspaces plus a label
+       * selector) would cover right now. Both empty means the whole organization.
+       */
+      async previewWorkspaceScope(orgIdOrUuid, data) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/workspace-labels/preview-scope`,
+          { method: "POST", body: JSON.stringify(data) }
+        );
+      }
+      async getWorkspaceLabels(orgIdOrUuid, workspaceUuid) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/workspaces/${workspaceUuid}/labels`
+        );
+      }
+      /**
+       * Replace a workspace's labels with exactly `data.labels` (slugs). A slug the
+       * organization has not used before creates that label.
+       */
+      async setWorkspaceLabels(orgIdOrUuid, workspaceUuid, data) {
+        return this.fetch(
+          `o/${orgIdOrUuid}/workspaces/${workspaceUuid}/labels`,
+          { method: "PUT", body: JSON.stringify(data) }
+        );
+      }
     };
     OAuthConnectionsApi = class extends BaseApiClient {
       async getConnectionStatus(providerSlug) {
@@ -10800,6 +11010,39 @@ var init_chunk_6F4YJJKQ = __esm({
           body: JSON.stringify(request)
         });
       }
+      async denyAuthorization(request) {
+        return this.fetch("oauth/authorize/deny", {
+          method: "POST",
+          body: JSON.stringify(request)
+        });
+      }
+      async getOAuthConsentClient(clientId, redirectUri, resource) {
+        const params = new URLSearchParams({ client_id: clientId, redirect_uri: redirectUri });
+        if (resource) params.set("resource", resource);
+        return this.fetch(`oauth/authorize/client?${params.toString()}`);
+      }
+      /** The organizations and workspaces the MCP consent screen may offer. */
+      async getMcpConsentTargets(clientId) {
+        const params = new URLSearchParams({ client_id: clientId });
+        return this.fetch(`oauth/authorize/mcp-targets?${params.toString()}`);
+      }
+      /** The signed-in account's MCP grants. */
+      async listMcpGrants() {
+        return this.fetch("oauth/mcp-grants");
+      }
+      /** Remove organizations or workspaces from one MCP grant. */
+      async narrowMcpGrant(grantId, removeTargetIds) {
+        return this.fetch(`oauth/mcp-grants/${encodeURIComponent(grantId)}`, {
+          method: "PATCH",
+          body: JSON.stringify({ removeTargetIds })
+        });
+      }
+      /** Revoke one MCP grant. */
+      async revokeMcpGrant(grantId) {
+        return this.fetch(`oauth/mcp-grants/${encodeURIComponent(grantId)}`, {
+          method: "DELETE"
+        });
+      }
       async exchangeOAuthToken(request) {
         const formData = new URLSearchParams();
         formData.append("grant_type", request.grant_type);
@@ -13171,6 +13414,20 @@ var init_chunk_6F4YJJKQ = __esm({
       async getWorkflowOutline(wid, id) {
         return this.fetch(`w/${wid}/workflows/${id}/outline`);
       }
+      /**
+       * Outlines for many Workflows in one request. The same shape as
+       * {@link getWorkflowOutline}, keyed by workflow id. Ids the caller cannot
+       * use, and outlines that cannot be read, are absent.
+       *
+       * The route accepts at most 100 ids. Callers with a longer list chunk.
+       */
+      async getWorkflowsOutlineBatch(wid, workflowIds) {
+        const params = new URLSearchParams();
+        params.set("workflowIds", workflowIds.join(","));
+        return this.fetch(
+          `w/${wid}/workflows/outline/batch?${params.toString()}`
+        );
+      }
       /** Create a new workflow in a workspace. */
       async createWorkflow(wid, workflow) {
         return this.fetch(`w/${wid}/workflows`, {
@@ -13269,6 +13526,13 @@ var init_chunk_6F4YJJKQ = __esm({
           `w/${wid}/workflows/${workflowId}/prompt-classifications`
         );
       }
+      /** Review prompt diagnoses and report rebutted findings to Customer Success. */
+      async reviewWorkflowPromptClassifications(wid, workflowId) {
+        return this.fetch(
+          `w/${wid}/workflows/${workflowId}/prompt-classifications`,
+          { method: "POST" }
+        );
+      }
       /**
        * Replay automatic routing for a Chat without performing the transition.
        *
@@ -13902,6 +14166,17 @@ var init_chunk_6F4YJJKQ = __esm({
       async getWorkspaces(options) {
         return this.fetch(`w/?${workspaceDirectoryParams(options)}`);
       }
+      /**
+       * Page 1 of each organization's workspace directory, in one request.
+       * Later pages stay on ``getWorkspaces({ organizationUuid, page })``.
+       */
+      async getOrganizationWorkspacePages(options) {
+        const params = new URLSearchParams();
+        if (options.pageSize !== void 0) params.set("pageSize", String(options.pageSize));
+        if (options.search) params.set("search", options.search);
+        for (const uuid of options.organizationUuids) params.append("organizationUuids", uuid);
+        return this.fetch(`w/organization-pages?${params}`);
+      }
       /** A bounded page of companion-device candidates, with admission checked per row. */
       async getDeviceAdmissibleWorkspaces(options) {
         const params = workspaceDirectoryParams(options);
@@ -15119,6 +15394,19 @@ var init_chunk_6F4YJJKQ = __esm({
         });
       }
     };
+    DataReportsApi = class extends BaseApiClient {
+      /**
+       * Run a Form Reports report, saved or not, with the given parameter values.
+       * The result is what the Agent would get: record rows or aggregate groups
+       * within the tool's row and group caps, plus the text sent to the Agent.
+       */
+      async previewDataReport(wid, request) {
+        return this.fetch(`w/${wid}/data-reports/preview`, {
+          method: "POST",
+          body: JSON.stringify(request)
+        });
+      }
+    };
     ProjectsApi = class extends BaseApiClient {
       /** List projects (README frontmatter summaries). */
       async getProjects(wid, options = {}) {
@@ -15307,6 +15595,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "configureHubspot",
       "configureMondayConnection",
       "configureSalesforce",
+      "configureZendeskConnection",
       "convertEmail",
       "convertFile",
       "createAbility",
@@ -15503,6 +15792,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "fhirGetCsvImportSettings",
       "fhirGetEncounterSyncRuns",
       "fhirGetEncounterSyncStatus",
+      "fhirGetOnboardingImportStatus",
       "fhirImportPatient",
       "fhirLinkMember",
       "fhirListLinkedMembers",
@@ -15511,6 +15801,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "fhirSearchLocations",
       "fhirSearchPatients",
       "fhirSearchPractitioners",
+      "fhirStartOnboardingImport",
       "fhirSyncMember",
       "fhirUnlinkMember",
       "fhirUpdateCsvImportSettings",
@@ -15667,6 +15958,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "importSiteSourceZip",
       "installDocumoFax",
       "listChatRecordings",
+      "previewDataReport",
       "previewQuery",
       "publishSiteSource",
       "publishDataTypeDraft",
@@ -15690,6 +15982,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "getFiles",
       "getFirstRunState",
       "getFolder",
+      "getFolderChildren",
       "getFolderMemberAccess",
       "getFolderSharing",
       "getFolders",
@@ -15864,6 +16157,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "getWorkflowConfigValidation",
       "getWorkflowFeedback",
       "getWorkflowPromptClassifications",
+      "reviewWorkflowPromptClassifications",
       "getWorkflowContributors",
       "getWorkflowDeletionPreview",
       "getWorkflowDiagram",
@@ -15875,6 +16169,7 @@ var init_chunk_6F4YJJKQ = __esm({
       "getWorkflowTemplates",
       "getWorkflows",
       "getWorkflowsActivityBatch",
+      "getWorkflowsOutlineBatch",
       "getWorkspace",
       "getWorkspaceActivityCounts",
       "getWorkspaceBuilder",
@@ -16409,6 +16704,8 @@ var init_chunk_6F4YJJKQ = __esm({
       validateQuery;
       previewQuery;
       runQuery;
+      // Form Reports
+      previewDataReport;
       listPersonas;
       getPersona;
       createPersona;
@@ -16593,6 +16890,7 @@ var init_chunk_6F4YJJKQ = __esm({
       inspectPrompt;
       // Workspaces API
       getWorkspaces;
+      getOrganizationWorkspacePages;
       getDeviceAdmissibleWorkspaces;
       getPublicWorkspaces;
       getWorkspace;
@@ -16679,6 +16977,7 @@ var init_chunk_6F4YJJKQ = __esm({
       getVoiceTrustProducts;
       syncVoiceTrustProducts;
       createOrganizationWorkspace;
+      getOrganizationWorkspaces;
       getOrganizationWorkspace;
       updateOrganizationWorkspace;
       getOrgBillingCustomer;
@@ -16688,7 +16987,20 @@ var init_chunk_6F4YJJKQ = __esm({
       updateOrganizationMember;
       listOrgWebhookEndpoints;
       getOrgWebhookEndpoint;
+      createOrgWebhookEndpoint;
       updateOrgWebhookEndpoint;
+      listOrgWebhookEndpointDeliveries;
+      replayOrgWebhookDelivery;
+      discardPendingOrgWebhookDeliveries;
+      getOrgWebhookEndpointCoverage;
+      testOrgWebhookEndpoint;
+      listWorkspaceLabels;
+      createWorkspaceLabel;
+      updateWorkspaceLabel;
+      deleteWorkspaceLabel;
+      getWorkspaceLabels;
+      setWorkspaceLabels;
+      previewWorkspaceScope;
       getVapidPublicKey;
       registerPushSubscription;
       unregisterPushSubscription;
@@ -16829,6 +17141,7 @@ var init_chunk_6F4YJJKQ = __esm({
       convertFile;
       generateFileUploadUrl;
       getFolders;
+      getFolderChildren;
       getFolder;
       createFolder;
       updateFolder;
@@ -16886,6 +17199,7 @@ var init_chunk_6F4YJJKQ = __esm({
       getWorkflowsActivityBatch;
       getWorkflowDiagram;
       getWorkflowOutline;
+      getWorkflowsOutlineBatch;
       createWorkflow;
       updateWorkflow;
       getWorkflowDeletionPreview;
@@ -16899,6 +17213,7 @@ var init_chunk_6F4YJJKQ = __esm({
       getTaskChats;
       getWorkflowConfigValidation;
       getWorkflowPromptClassifications;
+      reviewWorkflowPromptClassifications;
       getWorkflowNotes;
       createWorkflowNote;
       updateWorkflowNote;
@@ -17097,6 +17412,12 @@ var init_chunk_6F4YJJKQ = __esm({
       deleteInquiry;
       exportInquiriesCsv;
       authorize;
+      denyAuthorization;
+      getOAuthConsentClient;
+      getMcpConsentTargets;
+      listMcpGrants;
+      narrowMcpGrant;
+      revokeMcpGrant;
       exchangeOAuthToken;
       getAvailableScopes;
       getOAuthConnectionStatus;
@@ -17198,6 +17519,8 @@ var init_chunk_6F4YJJKQ = __esm({
       fhirGetEncounterSyncRuns;
       fhirRefreshEncounterPatient;
       fhirBackfillEncounterSync;
+      fhirStartOnboardingImport;
+      fhirGetOnboardingImportStatus;
       // Healthie API
       getDocumoFaxStatus;
       getDocumoFaxSetup;
@@ -17290,6 +17613,7 @@ var init_chunk_6F4YJJKQ = __esm({
       listAvailableAppConnections;
       listAppConnections;
       enablePlatformApp;
+      configureZendeskConnection;
       getPlatformApp;
       updatePlatformApp;
       deletePlatformApp;
@@ -17370,6 +17694,7 @@ var init_chunk_6F4YJJKQ = __esm({
         bindPersonasMethods(this, apis.personas);
         bindMetricsMethods(this, apis.metrics);
         bindQueriesMethods(this, apis.queries);
+        bindDataReportsMethods(this, apis.dataReports);
         bindDashboardsMethods(this, apis.dashboards);
         bindActivityMethods(this, apis.activity);
         bindMotdMethods(this, apis.motd);
@@ -17549,9 +17874,9 @@ var init_chunk_6F4YJJKQ = __esm({
   }
 });
 
-// ../sdk/dist/chunk-MMDSZ25F.js
-var init_chunk_MMDSZ25F = __esm({
-  "../sdk/dist/chunk-MMDSZ25F.js"() {
+// ../sdk/dist/chunk-HXVJF54M.js
+var init_chunk_HXVJF54M = __esm({
+  "../sdk/dist/chunk-HXVJF54M.js"() {
   }
 });
 
@@ -17606,8 +17931,8 @@ var init_chunk_6KPGCPGW = __esm({
 var SEARCHABLE_EVENT_RULE_SOURCE_FIELDS, ActivityEventType, EntityKind;
 var init_dist = __esm({
   "../sdk/dist/index.js"() {
-    init_chunk_6F4YJJKQ();
-    init_chunk_MMDSZ25F();
+    init_chunk_BF4MOZZO();
+    init_chunk_HXVJF54M();
     init_chunk_6KPGCPGW();
     init_chunk_GCN4OMYU();
     SEARCHABLE_EVENT_RULE_SOURCE_FIELDS = [
@@ -17693,6 +18018,7 @@ var init_dist = __esm({
       escalation: "escalation",
       inbox: "inbox",
       phone_number: "phone_number",
+      recording: "recording",
       voicemail: "voicemail",
       domain: "domain",
       import: "import",
@@ -18894,7 +19220,7 @@ function readBlockScalar(state, parentIndent, props) {
         state.position = linePosition + column;
         throwError(state, "tab characters must not be used in indentation");
       }
-      if (column < maxLeadingIndent) {
+      if (column >= parentIndent && column < maxLeadingIndent) {
         state.position = linePosition + column;
         throwError(state, "bad indentation of a mapping entry");
       }
@@ -19104,13 +19430,16 @@ function readBlockMapping(state, nodeIndent, flowIndent, props) {
           ch = state.input.charCodeAt(++state.position);
           if (!isWsOrEolOrEnd(ch)) throwError(state, "a whitespace character is expected after the key-value separator within a block mapping");
           if (!mappingOpened) {
-            restoreState(state, beforeKey);
-            addMappingEvent(state, beforeKey.position, props.anchorStart, props.anchorEnd, props.tagStart, props.tagEnd, COLLECTION_STYLE.BLOCK);
+            state.events.splice(beforeKey.eventsLength, 0, {
+              type: EVENT_ID.MAPPING,
+              start: beforeKey.position,
+              anchorStart: props.anchorStart,
+              anchorEnd: props.anchorEnd,
+              tagStart: props.tagStart,
+              tagEnd: props.tagEnd,
+              style: COLLECTION_STYLE.BLOCK
+            });
             mappingOpened = true;
-            parseNode(state, flowIndent, CONTEXT_FLOW_OUT, false, true);
-            ch = state.input.charCodeAt(state.position);
-            while (isWhiteSpace(ch)) ch = state.input.charCodeAt(++state.position);
-            state.position++;
           }
           detected = true;
           atExplicitKey = false;
@@ -20369,6 +20698,1650 @@ var init_config = __esm({
     };
   }
 });
+
+// ../../node_modules/graceful-fs/polyfills.js
+var require_polyfills = __commonJS({
+  "../../node_modules/graceful-fs/polyfills.js"(exports$1, module) {
+    var constants = __require("constants");
+    var origCwd = process.cwd;
+    var cwd = null;
+    var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+    process.cwd = function() {
+      if (!cwd)
+        cwd = origCwd.call(process);
+      return cwd;
+    };
+    try {
+      process.cwd();
+    } catch (er) {
+    }
+    if (typeof process.chdir === "function") {
+      chdir = process.chdir;
+      process.chdir = function(d) {
+        cwd = null;
+        chdir.call(process, d);
+      };
+      if (Object.setPrototypeOf) Object.setPrototypeOf(process.chdir, chdir);
+    }
+    var chdir;
+    module.exports = patch;
+    function patch(fs3) {
+      if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
+        patchLchmod(fs3);
+      }
+      if (!fs3.lutimes) {
+        patchLutimes(fs3);
+      }
+      fs3.chown = chownFix(fs3.chown);
+      fs3.fchown = chownFix(fs3.fchown);
+      fs3.lchown = chownFix(fs3.lchown);
+      fs3.chmod = chmodFix(fs3.chmod);
+      fs3.fchmod = chmodFix(fs3.fchmod);
+      fs3.lchmod = chmodFix(fs3.lchmod);
+      fs3.chownSync = chownFixSync(fs3.chownSync);
+      fs3.fchownSync = chownFixSync(fs3.fchownSync);
+      fs3.lchownSync = chownFixSync(fs3.lchownSync);
+      fs3.chmodSync = chmodFixSync(fs3.chmodSync);
+      fs3.fchmodSync = chmodFixSync(fs3.fchmodSync);
+      fs3.lchmodSync = chmodFixSync(fs3.lchmodSync);
+      fs3.stat = statFix(fs3.stat);
+      fs3.fstat = statFix(fs3.fstat);
+      fs3.lstat = statFix(fs3.lstat);
+      fs3.statSync = statFixSync(fs3.statSync);
+      fs3.fstatSync = statFixSync(fs3.fstatSync);
+      fs3.lstatSync = statFixSync(fs3.lstatSync);
+      if (fs3.chmod && !fs3.lchmod) {
+        fs3.lchmod = function(path4, mode, cb) {
+          if (cb) process.nextTick(cb);
+        };
+        fs3.lchmodSync = function() {
+        };
+      }
+      if (fs3.chown && !fs3.lchown) {
+        fs3.lchown = function(path4, uid, gid, cb) {
+          if (cb) process.nextTick(cb);
+        };
+        fs3.lchownSync = function() {
+        };
+      }
+      if (platform === "win32") {
+        fs3.rename = typeof fs3.rename !== "function" ? fs3.rename : (function(fs$rename) {
+          function rename(from, to, cb) {
+            var start = Date.now();
+            var backoff = 0;
+            fs$rename(from, to, function CB(er) {
+              if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
+                setTimeout(function() {
+                  fs3.stat(to, function(stater, st) {
+                    if (stater && stater.code === "ENOENT")
+                      fs$rename(from, to, CB);
+                    else
+                      cb(er);
+                  });
+                }, backoff);
+                if (backoff < 100)
+                  backoff += 10;
+                return;
+              }
+              if (cb) cb(er);
+            });
+          }
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
+          return rename;
+        })(fs3.rename);
+      }
+      fs3.read = typeof fs3.read !== "function" ? fs3.read : (function(fs$read) {
+        function read(fd, buffer, offset, length, position, callback_) {
+          var callback;
+          if (callback_ && typeof callback_ === "function") {
+            var eagCounter = 0;
+            callback = function(er, _, __) {
+              if (er && er.code === "EAGAIN" && eagCounter < 10) {
+                eagCounter++;
+                return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
+              }
+              callback_.apply(this, arguments);
+            };
+          }
+          return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
+        }
+        if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
+        return read;
+      })(fs3.read);
+      fs3.readSync = typeof fs3.readSync !== "function" ? fs3.readSync : /* @__PURE__ */ (function(fs$readSync) {
+        return function(fd, buffer, offset, length, position) {
+          var eagCounter = 0;
+          while (true) {
+            try {
+              return fs$readSync.call(fs3, fd, buffer, offset, length, position);
+            } catch (er) {
+              if (er.code === "EAGAIN" && eagCounter < 10) {
+                eagCounter++;
+                continue;
+              }
+              throw er;
+            }
+          }
+        };
+      })(fs3.readSync);
+      function patchLchmod(fs4) {
+        fs4.lchmod = function(path4, mode, callback) {
+          fs4.open(
+            path4,
+            constants.O_WRONLY | constants.O_SYMLINK,
+            mode,
+            function(err, fd) {
+              if (err) {
+                if (callback) callback(err);
+                return;
+              }
+              fs4.fchmod(fd, mode, function(err2) {
+                fs4.close(fd, function(err22) {
+                  if (callback) callback(err2 || err22);
+                });
+              });
+            }
+          );
+        };
+        fs4.lchmodSync = function(path4, mode) {
+          var fd = fs4.openSync(path4, constants.O_WRONLY | constants.O_SYMLINK, mode);
+          var threw = true;
+          var ret;
+          try {
+            ret = fs4.fchmodSync(fd, mode);
+            threw = false;
+          } finally {
+            if (threw) {
+              try {
+                fs4.closeSync(fd);
+              } catch (er) {
+              }
+            } else {
+              fs4.closeSync(fd);
+            }
+          }
+          return ret;
+        };
+      }
+      function patchLutimes(fs4) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs4.futimes) {
+          fs4.lutimes = function(path4, at, mt, cb) {
+            fs4.open(path4, constants.O_SYMLINK, function(er, fd) {
+              if (er) {
+                if (cb) cb(er);
+                return;
+              }
+              fs4.futimes(fd, at, mt, function(er2) {
+                fs4.close(fd, function(er22) {
+                  if (cb) cb(er2 || er22);
+                });
+              });
+            });
+          };
+          fs4.lutimesSync = function(path4, at, mt) {
+            var fd = fs4.openSync(path4, constants.O_SYMLINK);
+            var ret;
+            var threw = true;
+            try {
+              ret = fs4.futimesSync(fd, at, mt);
+              threw = false;
+            } finally {
+              if (threw) {
+                try {
+                  fs4.closeSync(fd);
+                } catch (er) {
+                }
+              } else {
+                fs4.closeSync(fd);
+              }
+            }
+            return ret;
+          };
+        } else if (fs4.futimes) {
+          fs4.lutimes = function(_a, _b, _c, cb) {
+            if (cb) process.nextTick(cb);
+          };
+          fs4.lutimesSync = function() {
+          };
+        }
+      }
+      function chmodFix(orig) {
+        if (!orig) return orig;
+        return function(target, mode, cb) {
+          return orig.call(fs3, target, mode, function(er) {
+            if (chownErOk(er)) er = null;
+            if (cb) cb.apply(this, arguments);
+          });
+        };
+      }
+      function chmodFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, mode) {
+          try {
+            return orig.call(fs3, target, mode);
+          } catch (er) {
+            if (!chownErOk(er)) throw er;
+          }
+        };
+      }
+      function chownFix(orig) {
+        if (!orig) return orig;
+        return function(target, uid, gid, cb) {
+          return orig.call(fs3, target, uid, gid, function(er) {
+            if (chownErOk(er)) er = null;
+            if (cb) cb.apply(this, arguments);
+          });
+        };
+      }
+      function chownFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, uid, gid) {
+          try {
+            return orig.call(fs3, target, uid, gid);
+          } catch (er) {
+            if (!chownErOk(er)) throw er;
+          }
+        };
+      }
+      function statFix(orig) {
+        if (!orig) return orig;
+        return function(target, options, cb) {
+          if (typeof options === "function") {
+            cb = options;
+            options = null;
+          }
+          function callback(er, stats) {
+            if (stats) {
+              if (stats.uid < 0) stats.uid += 4294967296;
+              if (stats.gid < 0) stats.gid += 4294967296;
+            }
+            if (cb) cb.apply(this, arguments);
+          }
+          return options ? orig.call(fs3, target, options, callback) : orig.call(fs3, target, callback);
+        };
+      }
+      function statFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, options) {
+          var stats = options ? orig.call(fs3, target, options) : orig.call(fs3, target);
+          if (stats) {
+            if (stats.uid < 0) stats.uid += 4294967296;
+            if (stats.gid < 0) stats.gid += 4294967296;
+          }
+          return stats;
+        };
+      }
+      function chownErOk(er) {
+        if (!er)
+          return true;
+        if (er.code === "ENOSYS")
+          return true;
+        var nonroot = !process.getuid || process.getuid() !== 0;
+        if (nonroot) {
+          if (er.code === "EINVAL" || er.code === "EPERM")
+            return true;
+        }
+        return false;
+      }
+    }
+  }
+});
+
+// ../../node_modules/graceful-fs/legacy-streams.js
+var require_legacy_streams = __commonJS({
+  "../../node_modules/graceful-fs/legacy-streams.js"(exports$1, module) {
+    var Stream = __require("stream").Stream;
+    module.exports = legacy;
+    function legacy(fs3) {
+      return {
+        ReadStream,
+        WriteStream
+      };
+      function ReadStream(path4, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path4, options);
+        Stream.call(this);
+        var self = this;
+        this.path = path4;
+        this.fd = null;
+        this.readable = true;
+        this.paused = false;
+        this.flags = "r";
+        this.mode = 438;
+        this.bufferSize = 64 * 1024;
+        options = options || {};
+        var keys = Object.keys(options);
+        for (var index = 0, length = keys.length; index < length; index++) {
+          var key = keys[index];
+          this[key] = options[key];
+        }
+        if (this.encoding) this.setEncoding(this.encoding);
+        if (this.start !== void 0) {
+          if ("number" !== typeof this.start) {
+            throw TypeError("start must be a Number");
+          }
+          if (this.end === void 0) {
+            this.end = Infinity;
+          } else if ("number" !== typeof this.end) {
+            throw TypeError("end must be a Number");
+          }
+          if (this.start > this.end) {
+            throw new Error("start must be <= end");
+          }
+          this.pos = this.start;
+        }
+        if (this.fd !== null) {
+          process.nextTick(function() {
+            self._read();
+          });
+          return;
+        }
+        fs3.open(this.path, this.flags, this.mode, function(err, fd) {
+          if (err) {
+            self.emit("error", err);
+            self.readable = false;
+            return;
+          }
+          self.fd = fd;
+          self.emit("open", fd);
+          self._read();
+        });
+      }
+      function WriteStream(path4, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path4, options);
+        Stream.call(this);
+        this.path = path4;
+        this.fd = null;
+        this.writable = true;
+        this.flags = "w";
+        this.encoding = "binary";
+        this.mode = 438;
+        this.bytesWritten = 0;
+        options = options || {};
+        var keys = Object.keys(options);
+        for (var index = 0, length = keys.length; index < length; index++) {
+          var key = keys[index];
+          this[key] = options[key];
+        }
+        if (this.start !== void 0) {
+          if ("number" !== typeof this.start) {
+            throw TypeError("start must be a Number");
+          }
+          if (this.start < 0) {
+            throw new Error("start must be >= zero");
+          }
+          this.pos = this.start;
+        }
+        this.busy = false;
+        this._queue = [];
+        if (this.fd === null) {
+          this._open = fs3.open;
+          this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
+          this.flush();
+        }
+      }
+    }
+  }
+});
+
+// ../../node_modules/graceful-fs/clone.js
+var require_clone = __commonJS({
+  "../../node_modules/graceful-fs/clone.js"(exports$1, module) {
+    module.exports = clone;
+    var getPrototypeOf = Object.getPrototypeOf || function(obj) {
+      return obj.__proto__;
+    };
+    function clone(obj) {
+      if (obj === null || typeof obj !== "object")
+        return obj;
+      if (obj instanceof Object)
+        var copy = { __proto__: getPrototypeOf(obj) };
+      else
+        var copy = /* @__PURE__ */ Object.create(null);
+      Object.getOwnPropertyNames(obj).forEach(function(key) {
+        Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key));
+      });
+      return copy;
+    }
+  }
+});
+
+// ../../node_modules/graceful-fs/graceful-fs.js
+var require_graceful_fs = __commonJS({
+  "../../node_modules/graceful-fs/graceful-fs.js"(exports$1, module) {
+    var fs3 = __require("fs");
+    var polyfills = require_polyfills();
+    var legacy = require_legacy_streams();
+    var clone = require_clone();
+    var util = __require("util");
+    var gracefulQueue;
+    var previousSymbol;
+    if (typeof Symbol === "function" && typeof Symbol.for === "function") {
+      gracefulQueue = /* @__PURE__ */ Symbol.for("graceful-fs.queue");
+      previousSymbol = /* @__PURE__ */ Symbol.for("graceful-fs.previous");
+    } else {
+      gracefulQueue = "___graceful-fs.queue";
+      previousSymbol = "___graceful-fs.previous";
+    }
+    function noop() {
+    }
+    function publishQueue(context, queue2) {
+      Object.defineProperty(context, gracefulQueue, {
+        get: function() {
+          return queue2;
+        }
+      });
+    }
+    var debug = noop;
+    if (util.debuglog)
+      debug = util.debuglog("gfs4");
+    else if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || ""))
+      debug = function() {
+        var m = util.format.apply(util, arguments);
+        m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
+        console.error(m);
+      };
+    if (!fs3[gracefulQueue]) {
+      queue = global[gracefulQueue] || [];
+      publishQueue(fs3, queue);
+      fs3.close = (function(fs$close) {
+        function close(fd, cb) {
+          return fs$close.call(fs3, fd, function(err) {
+            if (!err) {
+              resetQueue();
+            }
+            if (typeof cb === "function")
+              cb.apply(this, arguments);
+          });
+        }
+        Object.defineProperty(close, previousSymbol, {
+          value: fs$close
+        });
+        return close;
+      })(fs3.close);
+      fs3.closeSync = (function(fs$closeSync) {
+        function closeSync(fd) {
+          fs$closeSync.apply(fs3, arguments);
+          resetQueue();
+        }
+        Object.defineProperty(closeSync, previousSymbol, {
+          value: fs$closeSync
+        });
+        return closeSync;
+      })(fs3.closeSync);
+      if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
+        process.on("exit", function() {
+          debug(fs3[gracefulQueue]);
+          __require("assert").equal(fs3[gracefulQueue].length, 0);
+        });
+      }
+    }
+    var queue;
+    if (!global[gracefulQueue]) {
+      publishQueue(global, fs3[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs3));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs3.__patched) {
+      module.exports = patch(fs3);
+      fs3.__patched = true;
+    }
+    function patch(fs4) {
+      polyfills(fs4);
+      fs4.gracefulify = patch;
+      fs4.createReadStream = createReadStream;
+      fs4.createWriteStream = createWriteStream2;
+      var fs$readFile = fs4.readFile;
+      fs4.readFile = readFile3;
+      function readFile3(path4, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$readFile(path4, options, cb);
+        function go$readFile(path5, options2, cb2, startTime) {
+          return fs$readFile(path5, options2, function(err) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([go$readFile, [path5, options2, cb2], err, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$writeFile = fs4.writeFile;
+      fs4.writeFile = writeFile2;
+      function writeFile2(path4, data, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$writeFile(path4, data, options, cb);
+        function go$writeFile(path5, data2, options2, cb2, startTime) {
+          return fs$writeFile(path5, data2, options2, function(err) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([go$writeFile, [path5, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$appendFile = fs4.appendFile;
+      if (fs$appendFile)
+        fs4.appendFile = appendFile;
+      function appendFile(path4, data, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$appendFile(path4, data, options, cb);
+        function go$appendFile(path5, data2, options2, cb2, startTime) {
+          return fs$appendFile(path5, data2, options2, function(err) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([go$appendFile, [path5, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$copyFile = fs4.copyFile;
+      if (fs$copyFile)
+        fs4.copyFile = copyFile;
+      function copyFile(src, dest, flags, cb) {
+        if (typeof flags === "function") {
+          cb = flags;
+          flags = 0;
+        }
+        return go$copyFile(src, dest, flags, cb);
+        function go$copyFile(src2, dest2, flags2, cb2, startTime) {
+          return fs$copyFile(src2, dest2, flags2, function(err) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([go$copyFile, [src2, dest2, flags2, cb2], err, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$readdir = fs4.readdir;
+      fs4.readdir = readdir;
+      var noReaddirOptionVersions = /^v[0-5]\./;
+      function readdir(path4, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path5, options2, cb2, startTime) {
+          return fs$readdir(path5, fs$readdirCallback(
+            path5,
+            options2,
+            cb2,
+            startTime
+          ));
+        } : function go$readdir2(path5, options2, cb2, startTime) {
+          return fs$readdir(path5, options2, fs$readdirCallback(
+            path5,
+            options2,
+            cb2,
+            startTime
+          ));
+        };
+        return go$readdir(path4, options, cb);
+        function fs$readdirCallback(path5, options2, cb2, startTime) {
+          return function(err, files) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([
+                go$readdir,
+                [path5, options2, cb2],
+                err,
+                startTime || Date.now(),
+                Date.now()
+              ]);
+            else {
+              if (files && files.sort)
+                files.sort();
+              if (typeof cb2 === "function")
+                cb2.call(this, err, files);
+            }
+          };
+        }
+      }
+      if (process.version.substr(0, 4) === "v0.8") {
+        var legStreams = legacy(fs4);
+        ReadStream = legStreams.ReadStream;
+        WriteStream = legStreams.WriteStream;
+      }
+      var fs$ReadStream = fs4.ReadStream;
+      if (fs$ReadStream) {
+        ReadStream.prototype = Object.create(fs$ReadStream.prototype);
+        ReadStream.prototype.open = ReadStream$open;
+      }
+      var fs$WriteStream = fs4.WriteStream;
+      if (fs$WriteStream) {
+        WriteStream.prototype = Object.create(fs$WriteStream.prototype);
+        WriteStream.prototype.open = WriteStream$open;
+      }
+      Object.defineProperty(fs4, "ReadStream", {
+        get: function() {
+          return ReadStream;
+        },
+        set: function(val) {
+          ReadStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      Object.defineProperty(fs4, "WriteStream", {
+        get: function() {
+          return WriteStream;
+        },
+        set: function(val) {
+          WriteStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      var FileReadStream = ReadStream;
+      Object.defineProperty(fs4, "FileReadStream", {
+        get: function() {
+          return FileReadStream;
+        },
+        set: function(val) {
+          FileReadStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      var FileWriteStream = WriteStream;
+      Object.defineProperty(fs4, "FileWriteStream", {
+        get: function() {
+          return FileWriteStream;
+        },
+        set: function(val) {
+          FileWriteStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      function ReadStream(path4, options) {
+        if (this instanceof ReadStream)
+          return fs$ReadStream.apply(this, arguments), this;
+        else
+          return ReadStream.apply(Object.create(ReadStream.prototype), arguments);
+      }
+      function ReadStream$open() {
+        var that = this;
+        open(that.path, that.flags, that.mode, function(err, fd) {
+          if (err) {
+            if (that.autoClose)
+              that.destroy();
+            that.emit("error", err);
+          } else {
+            that.fd = fd;
+            that.emit("open", fd);
+            that.read();
+          }
+        });
+      }
+      function WriteStream(path4, options) {
+        if (this instanceof WriteStream)
+          return fs$WriteStream.apply(this, arguments), this;
+        else
+          return WriteStream.apply(Object.create(WriteStream.prototype), arguments);
+      }
+      function WriteStream$open() {
+        var that = this;
+        open(that.path, that.flags, that.mode, function(err, fd) {
+          if (err) {
+            that.destroy();
+            that.emit("error", err);
+          } else {
+            that.fd = fd;
+            that.emit("open", fd);
+          }
+        });
+      }
+      function createReadStream(path4, options) {
+        return new fs4.ReadStream(path4, options);
+      }
+      function createWriteStream2(path4, options) {
+        return new fs4.WriteStream(path4, options);
+      }
+      var fs$open = fs4.open;
+      fs4.open = open;
+      function open(path4, flags, mode, cb) {
+        if (typeof mode === "function")
+          cb = mode, mode = null;
+        return go$open(path4, flags, mode, cb);
+        function go$open(path5, flags2, mode2, cb2, startTime) {
+          return fs$open(path5, flags2, mode2, function(err, fd) {
+            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+              enqueue([go$open, [path5, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      return fs4;
+    }
+    function enqueue(elem) {
+      debug("ENQUEUE", elem[0].name, elem[1]);
+      fs3[gracefulQueue].push(elem);
+      retry();
+    }
+    var retryTimer;
+    function resetQueue() {
+      var now = Date.now();
+      for (var i = 0; i < fs3[gracefulQueue].length; ++i) {
+        if (fs3[gracefulQueue][i].length > 2) {
+          fs3[gracefulQueue][i][3] = now;
+          fs3[gracefulQueue][i][4] = now;
+        }
+      }
+      retry();
+    }
+    function retry() {
+      clearTimeout(retryTimer);
+      retryTimer = void 0;
+      if (fs3[gracefulQueue].length === 0)
+        return;
+      var elem = fs3[gracefulQueue].shift();
+      var fn = elem[0];
+      var args = elem[1];
+      var err = elem[2];
+      var startTime = elem[3];
+      var lastTime = elem[4];
+      if (startTime === void 0) {
+        debug("RETRY", fn.name, args);
+        fn.apply(null, args);
+      } else if (Date.now() - startTime >= 6e4) {
+        debug("TIMEOUT", fn.name, args);
+        var cb = args.pop();
+        if (typeof cb === "function")
+          cb.call(null, err);
+      } else {
+        var sinceAttempt = Date.now() - lastTime;
+        var sinceStart = Math.max(lastTime - startTime, 1);
+        var desiredDelay = Math.min(sinceStart * 1.2, 100);
+        if (sinceAttempt >= desiredDelay) {
+          debug("RETRY", fn.name, args);
+          fn.apply(null, args.concat([startTime]));
+        } else {
+          fs3[gracefulQueue].push(elem);
+        }
+      }
+      if (retryTimer === void 0) {
+        retryTimer = setTimeout(retry, 0);
+      }
+    }
+  }
+});
+
+// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js
+var require_retry_operation = __commonJS({
+  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js"(exports$1, module) {
+    function RetryOperation(timeouts, options) {
+      if (typeof options === "boolean") {
+        options = { forever: options };
+      }
+      this._originalTimeouts = JSON.parse(JSON.stringify(timeouts));
+      this._timeouts = timeouts;
+      this._options = options || {};
+      this._maxRetryTime = options && options.maxRetryTime || Infinity;
+      this._fn = null;
+      this._errors = [];
+      this._attempts = 1;
+      this._operationTimeout = null;
+      this._operationTimeoutCb = null;
+      this._timeout = null;
+      this._operationStart = null;
+      if (this._options.forever) {
+        this._cachedTimeouts = this._timeouts.slice(0);
+      }
+    }
+    module.exports = RetryOperation;
+    RetryOperation.prototype.reset = function() {
+      this._attempts = 1;
+      this._timeouts = this._originalTimeouts;
+    };
+    RetryOperation.prototype.stop = function() {
+      if (this._timeout) {
+        clearTimeout(this._timeout);
+      }
+      this._timeouts = [];
+      this._cachedTimeouts = null;
+    };
+    RetryOperation.prototype.retry = function(err) {
+      if (this._timeout) {
+        clearTimeout(this._timeout);
+      }
+      if (!err) {
+        return false;
+      }
+      var currentTime = (/* @__PURE__ */ new Date()).getTime();
+      if (err && currentTime - this._operationStart >= this._maxRetryTime) {
+        this._errors.unshift(new Error("RetryOperation timeout occurred"));
+        return false;
+      }
+      this._errors.push(err);
+      var timeout = this._timeouts.shift();
+      if (timeout === void 0) {
+        if (this._cachedTimeouts) {
+          this._errors.splice(this._errors.length - 1, this._errors.length);
+          this._timeouts = this._cachedTimeouts.slice(0);
+          timeout = this._timeouts.shift();
+        } else {
+          return false;
+        }
+      }
+      var self = this;
+      var timer = setTimeout(function() {
+        self._attempts++;
+        if (self._operationTimeoutCb) {
+          self._timeout = setTimeout(function() {
+            self._operationTimeoutCb(self._attempts);
+          }, self._operationTimeout);
+          if (self._options.unref) {
+            self._timeout.unref();
+          }
+        }
+        self._fn(self._attempts);
+      }, timeout);
+      if (this._options.unref) {
+        timer.unref();
+      }
+      return true;
+    };
+    RetryOperation.prototype.attempt = function(fn, timeoutOps) {
+      this._fn = fn;
+      if (timeoutOps) {
+        if (timeoutOps.timeout) {
+          this._operationTimeout = timeoutOps.timeout;
+        }
+        if (timeoutOps.cb) {
+          this._operationTimeoutCb = timeoutOps.cb;
+        }
+      }
+      var self = this;
+      if (this._operationTimeoutCb) {
+        this._timeout = setTimeout(function() {
+          self._operationTimeoutCb();
+        }, self._operationTimeout);
+      }
+      this._operationStart = (/* @__PURE__ */ new Date()).getTime();
+      this._fn(this._attempts);
+    };
+    RetryOperation.prototype.try = function(fn) {
+      console.log("Using RetryOperation.try() is deprecated");
+      this.attempt(fn);
+    };
+    RetryOperation.prototype.start = function(fn) {
+      console.log("Using RetryOperation.start() is deprecated");
+      this.attempt(fn);
+    };
+    RetryOperation.prototype.start = RetryOperation.prototype.try;
+    RetryOperation.prototype.errors = function() {
+      return this._errors;
+    };
+    RetryOperation.prototype.attempts = function() {
+      return this._attempts;
+    };
+    RetryOperation.prototype.mainError = function() {
+      if (this._errors.length === 0) {
+        return null;
+      }
+      var counts = {};
+      var mainError = null;
+      var mainErrorCount = 0;
+      for (var i = 0; i < this._errors.length; i++) {
+        var error = this._errors[i];
+        var message = error.message;
+        var count = (counts[message] || 0) + 1;
+        counts[message] = count;
+        if (count >= mainErrorCount) {
+          mainError = error;
+          mainErrorCount = count;
+        }
+      }
+      return mainError;
+    };
+  }
+});
+
+// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js
+var require_retry = __commonJS({
+  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js"(exports$1) {
+    var RetryOperation = require_retry_operation();
+    exports$1.operation = function(options) {
+      var timeouts = exports$1.timeouts(options);
+      return new RetryOperation(timeouts, {
+        forever: options && options.forever,
+        unref: options && options.unref,
+        maxRetryTime: options && options.maxRetryTime
+      });
+    };
+    exports$1.timeouts = function(options) {
+      if (options instanceof Array) {
+        return [].concat(options);
+      }
+      var opts = {
+        retries: 10,
+        factor: 2,
+        minTimeout: 1 * 1e3,
+        maxTimeout: Infinity,
+        randomize: false
+      };
+      for (var key in options) {
+        opts[key] = options[key];
+      }
+      if (opts.minTimeout > opts.maxTimeout) {
+        throw new Error("minTimeout is greater than maxTimeout");
+      }
+      var timeouts = [];
+      for (var i = 0; i < opts.retries; i++) {
+        timeouts.push(this.createTimeout(i, opts));
+      }
+      if (options && options.forever && !timeouts.length) {
+        timeouts.push(this.createTimeout(i, opts));
+      }
+      timeouts.sort(function(a, b) {
+        return a - b;
+      });
+      return timeouts;
+    };
+    exports$1.createTimeout = function(attempt, opts) {
+      var random = opts.randomize ? Math.random() + 1 : 1;
+      var timeout = Math.round(random * opts.minTimeout * Math.pow(opts.factor, attempt));
+      timeout = Math.min(timeout, opts.maxTimeout);
+      return timeout;
+    };
+    exports$1.wrap = function(obj, options, methods) {
+      if (options instanceof Array) {
+        methods = options;
+        options = null;
+      }
+      if (!methods) {
+        methods = [];
+        for (var key in obj) {
+          if (typeof obj[key] === "function") {
+            methods.push(key);
+          }
+        }
+      }
+      for (var i = 0; i < methods.length; i++) {
+        var method = methods[i];
+        var original = obj[method];
+        obj[method] = function retryWrapper(original2) {
+          var op = exports$1.operation(options);
+          var args = Array.prototype.slice.call(arguments, 1);
+          var callback = args.pop();
+          args.push(function(err) {
+            if (op.retry(err)) {
+              return;
+            }
+            if (err) {
+              arguments[0] = op.mainError();
+            }
+            callback.apply(this, arguments);
+          });
+          op.attempt(function() {
+            original2.apply(obj, args);
+          });
+        }.bind(obj, original);
+        obj[method].options = options;
+      }
+    };
+  }
+});
+
+// ../../node_modules/proper-lockfile/node_modules/retry/index.js
+var require_retry2 = __commonJS({
+  "../../node_modules/proper-lockfile/node_modules/retry/index.js"(exports$1, module) {
+    module.exports = require_retry();
+  }
+});
+
+// ../../node_modules/signal-exit/signals.js
+var require_signals = __commonJS({
+  "../../node_modules/signal-exit/signals.js"(exports$1, module) {
+    module.exports = [
+      "SIGABRT",
+      "SIGALRM",
+      "SIGHUP",
+      "SIGINT",
+      "SIGTERM"
+    ];
+    if (process.platform !== "win32") {
+      module.exports.push(
+        "SIGVTALRM",
+        "SIGXCPU",
+        "SIGXFSZ",
+        "SIGUSR2",
+        "SIGTRAP",
+        "SIGSYS",
+        "SIGQUIT",
+        "SIGIOT"
+        // should detect profiler and enable/disable accordingly.
+        // see #21
+        // 'SIGPROF'
+      );
+    }
+    if (process.platform === "linux") {
+      module.exports.push(
+        "SIGIO",
+        "SIGPOLL",
+        "SIGPWR",
+        "SIGSTKFLT",
+        "SIGUNUSED"
+      );
+    }
+  }
+});
+
+// ../../node_modules/signal-exit/index.js
+var require_signal_exit = __commonJS({
+  "../../node_modules/signal-exit/index.js"(exports$1, module) {
+    var process2 = global.process;
+    var processOk = function(process3) {
+      return process3 && typeof process3 === "object" && typeof process3.removeListener === "function" && typeof process3.emit === "function" && typeof process3.reallyExit === "function" && typeof process3.listeners === "function" && typeof process3.kill === "function" && typeof process3.pid === "number" && typeof process3.on === "function";
+    };
+    if (!processOk(process2)) {
+      module.exports = function() {
+        return function() {
+        };
+      };
+    } else {
+      assert = __require("assert");
+      signals = require_signals();
+      isWin = /^win/i.test(process2.platform);
+      EE = __require("events");
+      if (typeof EE !== "function") {
+        EE = EE.EventEmitter;
+      }
+      if (process2.__signal_exit_emitter__) {
+        emitter = process2.__signal_exit_emitter__;
+      } else {
+        emitter = process2.__signal_exit_emitter__ = new EE();
+        emitter.count = 0;
+        emitter.emitted = {};
+      }
+      if (!emitter.infinite) {
+        emitter.setMaxListeners(Infinity);
+        emitter.infinite = true;
+      }
+      module.exports = function(cb, opts) {
+        if (!processOk(global.process)) {
+          return function() {
+          };
+        }
+        assert.equal(typeof cb, "function", "a callback must be provided for exit handler");
+        if (loaded === false) {
+          load2();
+        }
+        var ev = "exit";
+        if (opts && opts.alwaysLast) {
+          ev = "afterexit";
+        }
+        var remove = function() {
+          emitter.removeListener(ev, cb);
+          if (emitter.listeners("exit").length === 0 && emitter.listeners("afterexit").length === 0) {
+            unload();
+          }
+        };
+        emitter.on(ev, cb);
+        return remove;
+      };
+      unload = function unload2() {
+        if (!loaded || !processOk(global.process)) {
+          return;
+        }
+        loaded = false;
+        signals.forEach(function(sig) {
+          try {
+            process2.removeListener(sig, sigListeners[sig]);
+          } catch (er) {
+          }
+        });
+        process2.emit = originalProcessEmit;
+        process2.reallyExit = originalProcessReallyExit;
+        emitter.count -= 1;
+      };
+      module.exports.unload = unload;
+      emit = function emit2(event, code, signal) {
+        if (emitter.emitted[event]) {
+          return;
+        }
+        emitter.emitted[event] = true;
+        emitter.emit(event, code, signal);
+      };
+      sigListeners = {};
+      signals.forEach(function(sig) {
+        sigListeners[sig] = function listener() {
+          if (!processOk(global.process)) {
+            return;
+          }
+          var listeners = process2.listeners(sig);
+          if (listeners.length === emitter.count) {
+            unload();
+            emit("exit", null, sig);
+            emit("afterexit", null, sig);
+            if (isWin && sig === "SIGHUP") {
+              sig = "SIGINT";
+            }
+            process2.kill(process2.pid, sig);
+          }
+        };
+      });
+      module.exports.signals = function() {
+        return signals;
+      };
+      loaded = false;
+      load2 = function load3() {
+        if (loaded || !processOk(global.process)) {
+          return;
+        }
+        loaded = true;
+        emitter.count += 1;
+        signals = signals.filter(function(sig) {
+          try {
+            process2.on(sig, sigListeners[sig]);
+            return true;
+          } catch (er) {
+            return false;
+          }
+        });
+        process2.emit = processEmit;
+        process2.reallyExit = processReallyExit;
+      };
+      module.exports.load = load2;
+      originalProcessReallyExit = process2.reallyExit;
+      processReallyExit = function processReallyExit2(code) {
+        if (!processOk(global.process)) {
+          return;
+        }
+        process2.exitCode = code || /* istanbul ignore next */
+        0;
+        emit("exit", process2.exitCode, null);
+        emit("afterexit", process2.exitCode, null);
+        originalProcessReallyExit.call(process2, process2.exitCode);
+      };
+      originalProcessEmit = process2.emit;
+      processEmit = function processEmit2(ev, arg) {
+        if (ev === "exit" && processOk(global.process)) {
+          if (arg !== void 0) {
+            process2.exitCode = arg;
+          }
+          var ret = originalProcessEmit.apply(this, arguments);
+          emit("exit", process2.exitCode, null);
+          emit("afterexit", process2.exitCode, null);
+          return ret;
+        } else {
+          return originalProcessEmit.apply(this, arguments);
+        }
+      };
+    }
+    var assert;
+    var signals;
+    var isWin;
+    var EE;
+    var emitter;
+    var unload;
+    var emit;
+    var sigListeners;
+    var loaded;
+    var load2;
+    var originalProcessReallyExit;
+    var processReallyExit;
+    var originalProcessEmit;
+    var processEmit;
+  }
+});
+
+// ../../node_modules/proper-lockfile/lib/mtime-precision.js
+var require_mtime_precision = __commonJS({
+  "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports$1, module) {
+    var cacheSymbol = /* @__PURE__ */ Symbol();
+    function probe(file, fs3, callback) {
+      const cachedPrecision = fs3[cacheSymbol];
+      if (cachedPrecision) {
+        return fs3.stat(file, (err, stat) => {
+          if (err) {
+            return callback(err);
+          }
+          callback(null, stat.mtime, cachedPrecision);
+        });
+      }
+      const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
+      fs3.utimes(file, mtime, mtime, (err) => {
+        if (err) {
+          return callback(err);
+        }
+        fs3.stat(file, (err2, stat) => {
+          if (err2) {
+            return callback(err2);
+          }
+          const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          Object.defineProperty(fs3, cacheSymbol, { value: precision });
+          callback(null, stat.mtime, precision);
+        });
+      });
+    }
+    function getMtime(precision) {
+      let now = Date.now();
+      if (precision === "s") {
+        now = Math.ceil(now / 1e3) * 1e3;
+      }
+      return new Date(now);
+    }
+    module.exports.probe = probe;
+    module.exports.getMtime = getMtime;
+  }
+});
+
+// ../../node_modules/proper-lockfile/lib/lockfile.js
+var require_lockfile = __commonJS({
+  "../../node_modules/proper-lockfile/lib/lockfile.js"(exports$1, module) {
+    var path4 = __require("path");
+    var fs3 = require_graceful_fs();
+    var retry = require_retry2();
+    var onExit = require_signal_exit();
+    var mtimePrecision = require_mtime_precision();
+    var locks = {};
+    function getLockFile(file, options) {
+      return options.lockfilePath || `${file}.lock`;
+    }
+    function resolveCanonicalPath(file, options, callback) {
+      if (!options.realpath) {
+        return callback(null, path4.resolve(file));
+      }
+      options.fs.realpath(file, callback);
+    }
+    function acquireLock(file, options, callback) {
+      const lockfilePath = getLockFile(file, options);
+      options.fs.mkdir(lockfilePath, (err) => {
+        if (!err) {
+          return mtimePrecision.probe(lockfilePath, options.fs, (err2, mtime, mtimePrecision2) => {
+            if (err2) {
+              options.fs.rmdir(lockfilePath, () => {
+              });
+              return callback(err2);
+            }
+            callback(null, mtime, mtimePrecision2);
+          });
+        }
+        if (err.code !== "EEXIST") {
+          return callback(err);
+        }
+        if (options.stale <= 0) {
+          return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+        }
+        options.fs.stat(lockfilePath, (err2, stat) => {
+          if (err2) {
+            if (err2.code === "ENOENT") {
+              return acquireLock(file, { ...options, stale: 0 }, callback);
+            }
+            return callback(err2);
+          }
+          if (!isLockStale(stat, options)) {
+            return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+          }
+          removeLock(file, options, (err3) => {
+            if (err3) {
+              return callback(err3);
+            }
+            acquireLock(file, { ...options, stale: 0 }, callback);
+          });
+        });
+      });
+    }
+    function isLockStale(stat, options) {
+      return stat.mtime.getTime() < Date.now() - options.stale;
+    }
+    function removeLock(file, options, callback) {
+      options.fs.rmdir(getLockFile(file, options), (err) => {
+        if (err && err.code !== "ENOENT") {
+          return callback(err);
+        }
+        callback();
+      });
+    }
+    function updateLock(file, options) {
+      const lock2 = locks[file];
+      if (lock2.updateTimeout) {
+        return;
+      }
+      lock2.updateDelay = lock2.updateDelay || options.update;
+      lock2.updateTimeout = setTimeout(() => {
+        lock2.updateTimeout = null;
+        options.fs.stat(lock2.lockfilePath, (err, stat) => {
+          const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
+          if (err) {
+            if (err.code === "ENOENT" || isOverThreshold) {
+              return setLockAsCompromised(file, lock2, Object.assign(err, { code: "ECOMPROMISED" }));
+            }
+            lock2.updateDelay = 1e3;
+            return updateLock(file, options);
+          }
+          const isMtimeOurs = lock2.mtime.getTime() === stat.mtime.getTime();
+          if (!isMtimeOurs) {
+            return setLockAsCompromised(
+              file,
+              lock2,
+              Object.assign(
+                new Error("Unable to update lock within the stale threshold"),
+                { code: "ECOMPROMISED" }
+              )
+            );
+          }
+          const mtime = mtimePrecision.getMtime(lock2.mtimePrecision);
+          options.fs.utimes(lock2.lockfilePath, mtime, mtime, (err2) => {
+            const isOverThreshold2 = lock2.lastUpdate + options.stale < Date.now();
+            if (lock2.released) {
+              return;
+            }
+            if (err2) {
+              if (err2.code === "ENOENT" || isOverThreshold2) {
+                return setLockAsCompromised(file, lock2, Object.assign(err2, { code: "ECOMPROMISED" }));
+              }
+              lock2.updateDelay = 1e3;
+              return updateLock(file, options);
+            }
+            lock2.mtime = mtime;
+            lock2.lastUpdate = Date.now();
+            lock2.updateDelay = null;
+            updateLock(file, options);
+          });
+        });
+      }, lock2.updateDelay);
+      if (lock2.updateTimeout.unref) {
+        lock2.updateTimeout.unref();
+      }
+    }
+    function setLockAsCompromised(file, lock2, err) {
+      lock2.released = true;
+      if (lock2.updateTimeout) {
+        clearTimeout(lock2.updateTimeout);
+      }
+      if (locks[file] === lock2) {
+        delete locks[file];
+      }
+      lock2.options.onCompromised(err);
+    }
+    function lock(file, options, callback) {
+      options = {
+        stale: 1e4,
+        update: null,
+        realpath: true,
+        retries: 0,
+        fs: fs3,
+        onCompromised: (err) => {
+          throw err;
+        },
+        ...options
+      };
+      options.retries = options.retries || 0;
+      options.retries = typeof options.retries === "number" ? { retries: options.retries } : options.retries;
+      options.stale = Math.max(options.stale || 0, 2e3);
+      options.update = options.update == null ? options.stale / 2 : options.update || 0;
+      options.update = Math.max(Math.min(options.update, options.stale / 2), 1e3);
+      resolveCanonicalPath(file, options, (err, file2) => {
+        if (err) {
+          return callback(err);
+        }
+        const operation = retry.operation(options.retries);
+        operation.attempt(() => {
+          acquireLock(file2, options, (err2, mtime, mtimePrecision2) => {
+            if (operation.retry(err2)) {
+              return;
+            }
+            if (err2) {
+              return callback(operation.mainError());
+            }
+            const lock2 = locks[file2] = {
+              lockfilePath: getLockFile(file2, options),
+              mtime,
+              mtimePrecision: mtimePrecision2,
+              options,
+              lastUpdate: Date.now()
+            };
+            updateLock(file2, options);
+            callback(null, (releasedCallback) => {
+              if (lock2.released) {
+                return releasedCallback && releasedCallback(Object.assign(new Error("Lock is already released"), { code: "ERELEASED" }));
+              }
+              unlock(file2, { ...options, realpath: false }, releasedCallback);
+            });
+          });
+        });
+      });
+    }
+    function unlock(file, options, callback) {
+      options = {
+        fs: fs3,
+        realpath: true,
+        ...options
+      };
+      resolveCanonicalPath(file, options, (err, file2) => {
+        if (err) {
+          return callback(err);
+        }
+        const lock2 = locks[file2];
+        if (!lock2) {
+          return callback(Object.assign(new Error("Lock is not acquired/owned by you"), { code: "ENOTACQUIRED" }));
+        }
+        lock2.updateTimeout && clearTimeout(lock2.updateTimeout);
+        lock2.released = true;
+        delete locks[file2];
+        removeLock(file2, options, callback);
+      });
+    }
+    function check(file, options, callback) {
+      options = {
+        stale: 1e4,
+        realpath: true,
+        fs: fs3,
+        ...options
+      };
+      options.stale = Math.max(options.stale || 0, 2e3);
+      resolveCanonicalPath(file, options, (err, file2) => {
+        if (err) {
+          return callback(err);
+        }
+        options.fs.stat(getLockFile(file2, options), (err2, stat) => {
+          if (err2) {
+            return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
+          }
+          return callback(null, !isLockStale(stat, options));
+        });
+      });
+    }
+    function getLocks() {
+      return locks;
+    }
+    onExit(() => {
+      for (const file in locks) {
+        const options = locks[file].options;
+        try {
+          options.fs.rmdirSync(getLockFile(file, options));
+        } catch (e) {
+        }
+      }
+    });
+    module.exports.lock = lock;
+    module.exports.unlock = unlock;
+    module.exports.check = check;
+    module.exports.getLocks = getLocks;
+  }
+});
+
+// ../../node_modules/proper-lockfile/lib/adapter.js
+var require_adapter = __commonJS({
+  "../../node_modules/proper-lockfile/lib/adapter.js"(exports$1, module) {
+    var fs3 = require_graceful_fs();
+    function createSyncFs(fs4) {
+      const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
+      const newFs = { ...fs4 };
+      methods.forEach((method) => {
+        newFs[method] = (...args) => {
+          const callback = args.pop();
+          let ret;
+          try {
+            ret = fs4[`${method}Sync`](...args);
+          } catch (err) {
+            return callback(err);
+          }
+          callback(null, ret);
+        };
+      });
+      return newFs;
+    }
+    function toPromise(method) {
+      return (...args) => new Promise((resolve3, reject) => {
+        args.push((err, result2) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve3(result2);
+          }
+        });
+        method(...args);
+      });
+    }
+    function toSync(method) {
+      return (...args) => {
+        let err;
+        let result2;
+        args.push((_err, _result) => {
+          err = _err;
+          result2 = _result;
+        });
+        method(...args);
+        if (err) {
+          throw err;
+        }
+        return result2;
+      };
+    }
+    function toSyncOptions(options) {
+      options = { ...options };
+      options.fs = createSyncFs(options.fs || fs3);
+      if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
+        throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
+      }
+      return options;
+    }
+    module.exports = {
+      toPromise,
+      toSync,
+      toSyncOptions
+    };
+  }
+});
+
+// ../../node_modules/proper-lockfile/index.js
+var require_proper_lockfile = __commonJS({
+  "../../node_modules/proper-lockfile/index.js"(exports$1, module) {
+    var lockfile2 = require_lockfile();
+    var { toPromise, toSync, toSyncOptions } = require_adapter();
+    async function lock(file, options) {
+      const release = await toPromise(lockfile2.lock)(file, options);
+      return toPromise(release);
+    }
+    function lockSync(file, options) {
+      const release = toSync(lockfile2.lock)(file, toSyncOptions(options));
+      return toSync(release);
+    }
+    function unlock(file, options) {
+      return toPromise(lockfile2.unlock)(file, options);
+    }
+    function unlockSync(file, options) {
+      return toSync(lockfile2.unlock)(file, toSyncOptions(options));
+    }
+    function check(file, options) {
+      return toPromise(lockfile2.check)(file, options);
+    }
+    function checkSync(file, options) {
+      return toSync(lockfile2.check)(file, toSyncOptions(options));
+    }
+    module.exports = lock;
+    module.exports.lock = lock;
+    module.exports.unlock = unlock;
+    module.exports.lockSync = lockSync;
+    module.exports.unlockSync = unlockSync;
+    module.exports.check = check;
+    module.exports.checkSync = checkSync;
+  }
+});
+
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@gravity-rail/cli",
+      version: "0.55.0",
+      description: "Gravity Rail CLI \u2014 manage workspaces from the command line",
+      type: "module",
+      bin: {
+        gr: "./dist/gr.js"
+      },
+      exports: {
+        ".": {
+          types: "./dist/lib.d.ts",
+          import: "./dist/lib.js"
+        },
+        "./lib": {
+          types: "./dist/lib.d.ts",
+          import: "./dist/lib.js"
+        },
+        "./cli-utils": {
+          types: "./dist/cli-utils.d.ts",
+          import: "./dist/cli-utils.js"
+        }
+      },
+      files: [
+        "dist"
+      ],
+      license: "MIT",
+      repository: {
+        type: "git",
+        url: "https://developer.gravityrail.com"
+      },
+      homepage: "https://developer.gravityrail.com",
+      keywords: [
+        "gravity-rail",
+        "cli",
+        "healthcare",
+        "workspace"
+      ],
+      engines: {
+        node: ">=18"
+      },
+      scripts: {
+        build: "tsup",
+        "generate:skill-docs": "tsx scripts/generate-skill-docs.ts",
+        clean: "rm -rf dist",
+        typecheck: "tsc --noEmit",
+        test: "jest --forceExit",
+        "test:ci": "jest --forceExit --passWithNoTests --coverage --coverageReporters=json-summary --coverageReporters=text-summary"
+      },
+      dependencies: {
+        "@gravity-rail/sdk": "workspace:^",
+        "js-yaml": "^5.4.3",
+        "proper-lockfile": "^4.1.2"
+      },
+      devDependencies: {
+        "@gravity-rail/sandbox": "workspace:*",
+        "@types/jest": "^30.0.0",
+        "@types/node": "^26.6.4",
+        "@types/proper-lockfile": "^4.1.4",
+        jest: "^30.5.2",
+        "ts-jest": "29.4.9",
+        tsup: "^8.5.1",
+        typescript: "^6.0.3",
+        undici: "6.28.1"
+      }
+    };
+  }
+});
 var DEFAULT_PROFILE, CredentialsManager;
 var init_credentials_manager = __esm({
   "src/cli-utils/credentials-manager.ts"() {
@@ -20733,7 +22706,7 @@ function validateTokenResponse(tokenData) {
   if (tokenData.expires_in != null) {
     const raw = Number(tokenData.expires_in);
     if (!Number.isFinite(raw) || raw < 60 || raw > 31536e3) {
-      stderr(`  Warning: unusual expires_in value (${tokenData.expires_in}), using default`);
+      stderr("  Warning: unusual expires_in value in the token response, using default");
     } else {
       expiresIn = raw;
     }
@@ -20953,7 +22926,8 @@ async function performOAuthFlow(options) {
       method: "POST",
       headers: {
         ...auth.headers,
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": TOKEN_REQUEST_USER_AGENT
       },
       body: new URLSearchParams({
         grant_type: "authorization_code",
@@ -20990,53 +22964,150 @@ async function performOAuthFlow(options) {
     return { accessToken, credentials: creds };
   }
 }
-async function refreshAccessToken(envConfig, creds, credentialsManager, env, profile) {
-  if (!creds.refreshToken || !creds.clientId) {
+function parseOAuthErrorCode(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object") {
+      const code = parsed.error;
+      if (typeof code === "string") return code;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isFreshEnough(creds) {
+  return !creds.expiresAt || new Date(creds.expiresAt).getTime() > Date.now() + ACCESS_TOKEN_EXPIRY_BUFFER_MS;
+}
+async function acquireRefreshLock(credentialsPath) {
+  try {
+    const cacheDir = dirname$1(credentialsPath);
+    if (!existsSync(cacheDir)) {
+      mkdirSync(cacheDir, { recursive: true, mode: 448 });
+    }
+    return await import_proper_lockfile.default.lock(credentialsPath, {
+      realpath: false,
+      retries: REFRESH_LOCK_RETRIES,
+      // The library default throws from a timer, which would crash the
+      // command. Losing the lock mid-refresh is worth a warning, not that.
+      // The library has already dropped its in-process record of the lock
+      // by the time this runs, so the `release()` in `refreshAccessToken`'s
+      // `finally` is refused (ENOTACQUIRED) and can never remove a lock
+      // another process has since taken.
+      onCompromised: () => {
+        stderr(
+          "  Warning: lost the credential refresh lock; another gr process may refresh at the same time"
+        );
+      }
+    });
+  } catch {
+    throw new Error(REFRESH_LOCK_FAILED);
+  }
+}
+async function refreshAccessToken(envConfig, _creds, credentialsManager, env, profile) {
+  const profileName = credentialsManager.resolveProfileName(profile, env);
+  const release = await acquireRefreshLock(credentialsManager.getCredentialsFilePath(env));
+  try {
+    return await refreshUnderLock(envConfig, credentialsManager, env, profileName);
+  } finally {
+    await release().catch(() => void 0);
+  }
+}
+async function refreshUnderLock(envConfig, credentialsManager, env, profileName) {
+  const stored = credentialsManager.load(env, profileName);
+  if (stored?.accessToken && isFreshEnough(stored)) {
+    return stored;
+  }
+  if (!stored?.refreshToken || !stored.clientId) {
     stderr("  Cannot refresh: missing credentials (re-login required)");
     return null;
   }
-  const profileName = credentialsManager.resolveProfileName(profile, env);
-  const tokenUrl = `${envConfig.apiUrl}/api/v2/oauth/token`;
-  const auth = tokenRequestAuth(creds.clientId, creds.clientSecret);
+  const presentedRefreshToken = stored.refreshToken;
+  const auth = tokenRequestAuth(stored.clientId, stored.clientSecret);
+  let response;
   try {
-    const response = await fetch(tokenUrl, {
+    response = await fetch(`${envConfig.apiUrl}/api/v2/oauth/token`, {
       method: "POST",
       headers: {
         ...auth.headers,
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": TOKEN_REQUEST_USER_AGENT
       },
       body: new URLSearchParams({
         grant_type: "refresh_token",
-        refresh_token: creds.refreshToken,
+        refresh_token: presentedRefreshToken,
         ...auth.params
-      })
+      }),
+      // Bounds the request and the body reads below. Never retried: a
+      // second POST of the same token is itself a reuse.
+      //
+      // Known residual: an abort only stops *this* side. If the server
+      // commits the rotation after the deadline, the response carrying the
+      // successor is lost and the stored token is spent; the next refresh
+      // of it is a genuine invalid_grant and clears the profile. The client
+      // cannot recover an unseen successor; the deadline is long enough
+      // that this needs a token endpoint stalled for 15 s, not a slow one.
+      signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS)
     });
-    if (!response.ok) {
-      const body = await response.text();
-      const isExpiredRefresh = isOAuthError(body, "invalid_grant");
-      if (isExpiredRefresh) {
-        stderr("  Refresh token expired, re-login required");
-      } else {
-        stderr(`  Token refresh failed (${response.status}), clearing credentials`);
+  } catch {
+    throw new Error(REFRESH_REQUEST_FAILED);
+  }
+  if (!response.ok) {
+    let body;
+    try {
+      body = await response.text();
+    } catch {
+      throw new Error(REFRESH_REQUEST_FAILED);
+    }
+    if (response.status === 400 && parseOAuthErrorCode(body) === "invalid_grant") {
+      const current = credentialsManager.load(env, profileName);
+      if (!current) {
+        stderr("  The server rejected the stored refresh token; re-login required");
+        return null;
+      }
+      if (current.refreshToken === presentedRefreshToken) {
+        credentialsManager.clear(env, profileName);
+        stderr("  The server rejected the stored refresh token; re-login required");
+        return null;
       }
-      credentialsManager.clear(env, profileName);
+      throw new Error(REFRESH_SUPERSEDED);
+    }
+    if (parseOAuthErrorCode(body) === "invalid_client") {
+      stderr("  The server no longer recognises this profile's OAuth client; re-login required");
       return null;
     }
-    const tokenData = await response.json();
-    const { accessToken, refreshToken, expiresIn } = validateTokenResponse(tokenData);
-    const updated = {
-      ...creds,
-      accessToken,
-      refreshToken: refreshToken ?? creds.refreshToken,
-      expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-    };
-    credentialsManager.save(env, updated, profileName);
-    return updated;
-  } catch (err) {
-    stderr(`  Token refresh error: ${err instanceof Error ? err.message : "unknown"}`);
-    credentialsManager.clear(env, profileName);
+    throw new Error(REFRESH_FAILED);
+  }
+  let tokens;
+  try {
+    tokens = validateTokenResponse(await response.json());
+  } catch {
+    throw new Error(REFRESH_BAD_RESPONSE);
+  }
+  const latest = credentialsManager.load(env, profileName);
+  if (!latest) {
+    stderr("  Cannot refresh: missing credentials (re-login required)");
     return null;
   }
+  if (latest.clientId !== stored.clientId || latest.refreshToken !== presentedRefreshToken) {
+    if (latest.accessToken && isFreshEnough(latest)) {
+      return latest;
+    }
+    throw new Error(REFRESH_SUPERSEDED);
+  }
+  const updated = {
+    ...latest,
+    accessToken: tokens.accessToken,
+    // A server may omit `refresh_token` when it does not rotate; the
+    // presented token then stays valid.
+    refreshToken: tokens.refreshToken ?? presentedRefreshToken,
+    expiresAt: new Date(Date.now() + tokens.expiresIn * 1e3).toISOString()
+  };
+  try {
+    credentialsManager.save(env, updated, profileName);
+  } catch {
+    throw new Error(REFRESH_SAVE_FAILED);
+  }
+  return updated;
 }
 async function resolveNonInteractiveAuth(options) {
   const { env, envConfig, credentialsManager, profile } = options;
@@ -21061,12 +23132,23 @@ async function resolveNonInteractiveAuth(options) {
   if (!refreshed?.accessToken) return null;
   return { accessToken: refreshed.accessToken, credentials: refreshed };
 }
-var ACCESS_TOKEN_EXPIRY_BUFFER_MS, FIRST_PARTY_CLIENT_METADATA_FIELD;
+var import_proper_lockfile, ACCESS_TOKEN_EXPIRY_BUFFER_MS, TOKEN_REQUEST_USER_AGENT, REFRESH_REQUEST_TIMEOUT_MS, REFRESH_LOCK_RETRIES, REFRESH_LOCK_FAILED, REFRESH_REQUEST_FAILED, REFRESH_FAILED, REFRESH_SUPERSEDED, REFRESH_BAD_RESPONSE, REFRESH_SAVE_FAILED, FIRST_PARTY_CLIENT_METADATA_FIELD;
 var init_auth = __esm({
   "src/cli-utils/auth.ts"() {
+    import_proper_lockfile = __toESM(require_proper_lockfile());
+    init_package();
     init_config();
     init_credentials_manager();
     ACCESS_TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+    TOKEN_REQUEST_USER_AGENT = `gravityrail-cli/${package_default.version}`;
+    REFRESH_REQUEST_TIMEOUT_MS = 15e3;
+    REFRESH_LOCK_RETRIES = { retries: 23, factor: 2, minTimeout: 100, maxTimeout: 1e3 };
+    REFRESH_LOCK_FAILED = "Could not lock the credential store to refresh the access token (another gr process may still be refreshing). Stored credentials were kept; retry the command.";
+    REFRESH_REQUEST_FAILED = "Token refresh did not complete (network error or timeout). Stored credentials were kept; retry the command.";
+    REFRESH_FAILED = "Token refresh failed. Stored credentials were kept; retry the command, and log in again if it keeps failing.";
+    REFRESH_SUPERSEDED = "Token refresh was rejected, but the stored credentials changed meanwhile and were kept. Retry the command.";
+    REFRESH_BAD_RESPONSE = "Token refresh returned an unusable response. Stored credentials were kept; retry the command.";
+    REFRESH_SAVE_FAILED = "Token refresh succeeded, but the new credentials could not be saved. Retry the command, and log in again if it keeps failing.";
     FIRST_PARTY_CLIENT_METADATA_FIELD = "gravityrail_first_party_cli_client_id";
   }
 });
@@ -22428,6 +24510,9 @@ function commandNeedsJsonBody(cmd, parsedArgs) {
     }
     return false;
   }
+  if (cmd.acceptsJsonInput === true) {
+    return true;
+  }
   if (parsedArgs.data !== void 0 || parsedArgs.file !== void 0) {
     return true;
   }
@@ -22949,7 +25034,7 @@ var CommandRegistry = class {
       lines.push("  Requires: --allow-write");
     }
     const action = cmd.path[cmd.path.length - 1] ?? "";
-    const showsJsonHints = action === "create" || action === "update" || cmd.args?.some((a) => a.name === "data" || a.name === "file");
+    const showsJsonHints = action === "create" || action === "update" || cmd.args?.some((a) => a.name === "data");
     if (cmd.args && cmd.args.length > 0) {
       lines.push("", "Arguments:");
       for (const arg of cmd.args) {
@@ -23282,6 +25367,8 @@ Optional
   chatModelConfig (object|null)         Chat model overrides (temperature, thinking, \u2026)
   realtimeModelId (string|null)         Voice/realtime model (see \`gr ai-models realtime\`)
                                         e.g. "xai:realtime:voice-agent-2" (Grok Voice Think Fast 2)
+                                        or opt in to "xai:realtime:voice-agent-3" (Grok Voice
+                                        3.0; not yet cleared for strict-routing workflows)
                                         Native models auto-fill tts=native + default voice when
                                         realtimeModelConfig is omitted.
   realtimeModelConfig (object|null)     Realtime config. Native example:
@@ -23303,6 +25390,10 @@ One-shot workflow voice WITHOUT creating an agent (preferred for "use Grok Voice
   gr workflows update --id <wf> -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'
   gr workflows publish --workflow-id <wf>
 
+Opt a workflow into Grok Voice 3.0 (same xAI voices as 2.0; not the default):
+  gr workflows update --id <wf> -d '{"realtimeModelId":"xai:realtime:voice-agent-3"}'
+  gr workflows publish --workflow-id <wf>
+
 List models:
   gr ai-models chat | realtime | voice
 `;
@@ -23332,6 +25423,7 @@ ${AGENT_FIELD_REFERENCE}`,
       ],
       updateExamples: [
         `gr agents update --id 42 -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'`,
+        `gr agents update --id 42 -d '{"realtimeModelId":"xai:realtime:voice-agent-3"}'`,
         "gr agents update --id 42 --file agent.json"
       ]
     })
@@ -25214,6 +27306,9 @@ Assistant / models (live on the DRAFT revision \u2014 publish to go live)
                                         update: null = voice off
                                         One-shot voice example:
                                         {"realtimeModelId":"xai:realtime:voice-agent-2"}
+                                        Opt in to Grok Voice 3.0 (not the default; not yet
+                                        cleared for routingMode "strict"):
+                                        {"realtimeModelId":"xai:realtime:voice-agent-3"}
                                         A native model named WITHOUT a config gets
                                         tts=native + the provider fallback voice
                                         (xAI \u2192 xai:voice:eve, not cosmo). Explicit config:
@@ -25280,6 +27375,24 @@ var NOTE_COLUMNS = [
   },
   COL.created()
 ];
+var CONFIG_HEALTH_COLUMNS = [
+  { header: "SEVERITY", getValue: (item) => String(item.severity ?? "") },
+  { header: "CODE", getValue: (item) => String(item.code ?? "") },
+  { header: "SUBJECT", getValue: (item) => String(item.subject?.type ?? "") },
+  {
+    header: "SUBJECT-ID",
+    getValue: (item) => String(item.subject?.id ?? "")
+  },
+  {
+    header: "TASK",
+    getValue: (item) => String(item.remediation?.focus?.taskId ?? "")
+  },
+  {
+    header: "MESSAGE",
+    getValue: (item) => String(item.message ?? ""),
+    maxWidth: 80
+  }
+];
 var CONTRIBUTOR_COLUMNS = [
   COL.id(),
   {
@@ -25480,6 +27593,26 @@ var workflowsDomain = {
         outputData(result2, ctx);
       }
     },
+    // Config health (draft revision)
+    {
+      path: ["workflows", "validate-config"],
+      description: "Report the workflow's configuration health issues (draft revision) \u2014 the same findings the editor shows",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Workflow ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getWorkflowConfigValidation(
+          workspace,
+          requireNumber(args, "id")
+        );
+        if (ctx.outputFormat === "json" || ctx.outputFormat === "jsonl") {
+          outputData(result2, ctx);
+        } else {
+          outputData(result2.configHealthIssues ?? [], ctx, CONFIG_HEALTH_COLUMNS);
+          stderr2(`issues=${(result2.configHealthIssues ?? []).length}
+`);
+        }
+      }
+    },
     // Diagram
     {
       path: ["workflows", "diagram"],
@@ -25946,6 +28079,20 @@ ${WORKFLOW_FIELD_REFERENCE}`,
   ]
 };
 init_errors();
+
+// src/lib/workspace-labels.ts
+init_errors();
+function parseLabelList(value) {
+  if (value === void 0 || value === null || value === false) return [];
+  const raw = Array.isArray(value) ? value.map(String) : [String(value)];
+  const labels = raw.flatMap((entry) => entry.split(",")).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  if (labels.length === 0 && raw.some((entry) => entry.trim().length > 0)) {
+    throw new CLIError("--labels must name at least one label");
+  }
+  return labels;
+}
+
+// src/domains/workspaces.ts
 init_output();
 init_pagination();
 init_context();
@@ -26760,11 +28907,16 @@ var workspacesDomain = {
         {
           name: "timezone",
           description: "IANA time zone (e.g. America/New_York). The create API does not take one, so the command waits for provisioning to finish and then sets it with a follow-up update. Without it the workspace has no timezone and Journey send windows and Routines run in UTC."
+        },
+        {
+          name: "labels",
+          description: "Comma-separated workspace labels to apply right after creation (e.g. production,sponsor-acme). Labels the organization has not used before are created. Webhook endpoints that select on these labels start covering the workspace at once."
         }
       ],
       examples: [
         'gr workspaces create --org <org-uuid> --name "Front Desk"',
-        'gr workspaces create --org <org-uuid> --name "Front Desk" --timezone America/Chicago'
+        'gr workspaces create --org <org-uuid> --name "Front Desk" --timezone America/Chicago',
+        'gr workspaces create --org <org-uuid> --name "Front Desk" --labels production,sponsor-acme'
       ],
       handler: async ({ ctx, args }) => {
         const orgUuid = args.org ?? args["org-uuid"];
@@ -26772,6 +28924,7 @@ var workspacesDomain = {
         if (!orgUuid) throw new CLIError("Missing required argument: --org <org-uuid>");
         if (!name) throw new CLIError("Missing required argument: --name");
         const timezone = typeof args.timezone === "string" ? normalizeIanaTimeZone(args.timezone) : void 0;
+        const labels = parseLabelList(args.labels);
         const payload = { name };
         if (args.slug) payload.slug = String(args.slug);
         if (args.template) payload.templateWorkspaceUuid = String(args.template);
@@ -26788,6 +28941,18 @@ var workspacesDomain = {
           }
           throw err;
         }
+        if (labels.length > 0) {
+          try {
+            await client3.setWorkspaceLabels(orgUuid, result2.uuid, { labels });
+          } catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new CLIError(
+              `Workspace ${result2.uuid} was created but its labels were not set: ${reason}
+  Apply them with:
+  gr org workspaces labels set --org ${orgUuid} --workspace-uuid ${result2.uuid} --labels ${labels.join(",")} --allow-write`
+            );
+          }
+        }
         if (timezone) {
           const wsUuid = result2.uuid;
           stderr2(`Waiting for workspace ${wsUuid} to finish provisioning...`);
@@ -29322,6 +31487,73 @@ function parseIdList(value) {
     return num;
   });
 }
+function toGrantEntry(grant) {
+  return { granteeMemberId: grant.granteeMemberId, accessMode: grant.accessMode };
+}
+var SHARING_COLUMNS = [
+  { header: "ACCESS", getValue: (item) => item.access },
+  {
+    header: "SHAREABLE",
+    getValue: (item) => String(item.shareable ?? "")
+  },
+  { header: "OWNER", getValue: (item) => String(item.ownerId ?? "") },
+  { header: "GRANTS", getValue: (item) => String(item.grants.length) },
+  {
+    header: "ROLES",
+    getValue: (item) => (item.roleAssociations ?? []).map((role) => role.memberRoleName).join(", ")
+  }
+];
+function sharingCommands(spec) {
+  const { prefix, entityName, getMethod, updateMethod } = spec;
+  const idArg2 = { name: "id", description: `${entityName} ID`, required: true };
+  const cli = ["gr", ...prefix, "sharing"].join(" ");
+  return [
+    {
+      path: [...prefix, "sharing", "get"],
+      description: `Show a ${entityName}'s access level, grants and role associations`,
+      requiresWorkspace: true,
+      args: [idArg2],
+      examples: [`${cli} get -w $WID --id 12`],
+      handler: async ({ ctx, workspace, args }) => {
+        const state = await requireAuth(ctx).apiClient[getMethod](
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(state, ctx, SHARING_COLUMNS);
+      }
+    },
+    {
+      path: [...prefix, "sharing", "set"],
+      description: `Change a ${entityName}'s sharing. The API replaces the whole sharing state, so this command reads the current state first and overrides only the keys you pass \u2014 omitting "grants" or "roleAssociations" keeps the existing ones rather than clearing them. Pass them explicitly (e.g. "grants": []) to replace.`,
+      mutates: true,
+      requiresWorkspace: true,
+      args: [idArg2],
+      examples: [
+        `${cli} set -w $WID --id 12 --allow-write -d '{"access":"workspace"}'`,
+        `${cli} set -w $WID --id 12 --allow-write -d '{"access":"private","grants":[]}'`
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (data === void 0 || data === null || typeof data !== "object") {
+          throw new CLIError(
+            `Provide the fields to change as JSON via --data, --file, or stdin (e.g. '{"access":"workspace"}')`
+          );
+        }
+        const patch = data;
+        const client3 = requireAuth(ctx).apiClient;
+        const id = requireNumber(args, "id");
+        const current = await client3[getMethod](workspace, id);
+        const next = {
+          access: patch.access ?? current.access,
+          shareable: patch.shareable ?? current.shareable ?? null,
+          grants: patch.grants ?? current.grants.map(toGrantEntry),
+          roleAssociations: patch.roleAssociations ?? current.roleAssociations ?? []
+        };
+        const state = await client3[updateMethod](workspace, id, next);
+        outputData(state, ctx, SHARING_COLUMNS);
+      }
+    }
+  ];
+}
 var COLUMNS10 = [
   COL.id(),
   COL.name(),
@@ -29483,6 +31715,18 @@ ${FILE_FIELD_REFERENCE}`
         outputData(results, ctx, folderSearchColumns(results));
       }
     },
+    ...sharingCommands({
+      prefix: ["files", "folders"],
+      entityName: "folder",
+      getMethod: "getFolderSharing",
+      updateMethod: "updateFolderSharing"
+    }),
+    ...sharingCommands({
+      prefix: ["files"],
+      entityName: "file",
+      getMethod: "getFileSharing",
+      updateMethod: "updateFileSharing"
+    }),
     // Labels sub-resource
     ...crudCommands({
       prefix: ["files", "labels"],
@@ -31404,7 +33648,7 @@ var OBS_COLUMNS = [
 ];
 var metricsDomain = {
   name: "metrics",
-  description: "Customer-defined outcome metrics (CEL expression or LLM rubric) with time-series readout",
+  description: "Customer-defined outcome metrics (CEL expression, LLM rubric, Member cohort count, or an aggregate over Form records) with time-series readout",
   commands: [
     ...crudCommands({
       prefix: ["metrics"],
@@ -31417,14 +33661,16 @@ var metricsDomain = {
       columns: COLUMNS11,
       paginationSupport: "full",
       createExamples: [
-        `yarn gr metrics create -w $WID --allow-write --data '{"name":"SMS Channel Rate","metricType":"expression","celExpression":"chat.channel == \\"phone-sms\\"","unit":"rate"}'`,
-        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Qualified Engagement","metricType":"rubric","evaluationPrompt":"Did the user show buying intent?","unit":"rate"}'`
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"SMS Channel Rate","metricType":"expression","celExpression":"chat.channel == \\"phone-sms\\"","unit":"rate","workflowIds":[]}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Qualified Engagement","metricType":"rubric","evaluationPrompt":"Did the user show buying intent?","unit":"rate","workflowIds":[]}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"HRV daily average","metricType":"record_aggregate","source":"data_record","sourceConfig":{"record":{"dataType":"daily_readings","aggregation":"avg","field":"record.hrv","dateField":"record.measured_on","groupBy":"record.athlete"}},"targetValue":65}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Open lab results","metricType":"record_aggregate","source":"data_record","sourceConfig":{"record":{"dataType":"lab_results","aggregation":"count","where":{"kind":"compare","field":"record.status","op":"eq","value":"open"}}}}'`
       ],
-      createHelp: "Create a metric definition. metricType is expression (CEL) or rubric (LLM). MVP source is chat only."
+      createHelp: `Create a metric definition. metricType is expression (CEL) or rubric (LLM) for one reading per chat (pass workflowIds, [] for every workflow); filter_count for the daily size of a saved Member filter (source "member_filter", kind "gauge", sourceConfig.memberFilterId); or record_aggregate for an aggregate over a Form's records, computed from the records each time the series is read (source "data_record", sourceConfig.record). sourceConfig.record takes dataType (Form id or slug), aggregation (count | countDistinct | sum | avg | min | max), field (record.<fieldSlug>; required for all but count, a number field for sum/avg/min/max), dateField (a date or datetime field, default record.createdAt), where (Query IR predicate, see "yarn gr queries syntax") and groupBy (record.<fieldSlug>, one series per value). A record metric needs records:read to save and to read, and records:admin when it names an adminOnly field.`
     }),
     {
       path: ["metrics", "observations"],
-      description: "List raw observations for a metric in a date range (may include PHI reason)",
+      description: "List raw observations for a metric in a date range (may include PHI reason). Not available for record_aggregate metrics, which store none: read their series",
       args: [
         { name: "id", required: true, description: "Metric ID" },
         {
@@ -31462,7 +33708,7 @@ var metricsDomain = {
     },
     {
       path: ["metrics", "series"],
-      description: "Time-bucketed aggregation for a metric (numeric only)",
+      description: "Time-bucketed aggregation for a metric. A record_aggregate metric is computed from its Form records on each call and, with groupBy, also returns one series per group",
       args: [
         { name: "id", required: true, description: "Metric ID" },
         {
@@ -31478,7 +33724,7 @@ var metricsDomain = {
         { name: "bucket", description: "day | week (default day)" },
         {
           name: "aggregation",
-          description: "avg | sum | count | rate | last | passes (default varies by metric)"
+          description: "avg | sum | count | rate | last | passes (default varies by metric). Omit for a record_aggregate metric: its definition names the aggregation"
         }
       ],
       requiresWorkspace: true,
@@ -31658,8 +33904,10 @@ function buildModelEvalBatchJobs(scenarios, models, rounds, warmup, realtimeMode
 var REALTIME_AUDIO_USD_PER_MIN = {
   "xai:realtime:voice-agent": 0.05,
   // Grok Voice Think Fast 1
-  "xai:realtime:voice-agent-2": 0.08
-  // Grok Voice Think Fast 2
+  "xai:realtime:voice-agent-2": 0.08,
+  // Grok Voice Think Fast 2 (pinned grok-voice-2.0)
+  "xai:realtime:voice-agent-3": 0.08
+  // Grok Voice 3.0 — same audio rate as 2.0
 };
 var DEFAULT_REALTIME_AUDIO_USD_PER_MIN = 0.08;
 var EST_AUDIO_MIN_PER_RUN = 3;
@@ -32489,6 +34737,91 @@ var qualificationsDomain = {
   ]
 };
 
+// src/domains/data-reports.ts
+init_output();
+init_context();
+init_errors();
+init_config();
+function parseRecordScope(value) {
+  if (value === void 0) return void 0;
+  if (value === "currentMember" || value === "allRecords") return value;
+  throw new CLIError("--record-scope must be currentMember or allRecords");
+}
+function parseParameters(value) {
+  if (value === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = typeof value === "string" ? JSON.parse(value) : value;
+  } catch {
+    throw new CLIError("--parameters must be a JSON object");
+  }
+  if (!isRecord(parsed)) throw new CLIError("--parameters must be a JSON object");
+  const values = {};
+  for (const [name, parameter] of Object.entries(parsed)) {
+    if (typeof parameter !== "boolean" && typeof parameter !== "number" && typeof parameter !== "string") {
+      throw new CLIError(`--parameters value for '${name}' must be a boolean, number or string`);
+    }
+    values[name] = parameter;
+  }
+  return values;
+}
+function buildPreviewRequest(data, args) {
+  if (!isRecord(data)) {
+    throw new CLIError("Report JSON required (--data, --file, or stdin)");
+  }
+  let request;
+  if ("report" in data) {
+    if (!isRecord(data.report)) {
+      throw new CLIError("The request's 'report' must be a JSON object");
+    }
+    request = { ...data };
+  } else if ("dataTypeUuid" in data && "query" in data) {
+    request = { report: data };
+  } else {
+    throw new CLIError(
+      "Body must be a request with a 'report' object, or a bare report with dataTypeUuid and query"
+    );
+  }
+  const recordScope = parseRecordScope(args["record-scope"]);
+  if (recordScope) request.recordScope = recordScope;
+  const parameters = parseParameters(args["parameters"]);
+  if (parameters) request.parameters = parameters;
+  return request;
+}
+var dataReportsDomain = {
+  name: "data-reports",
+  description: "Form Reports: preview a report as the Agent would run it",
+  commands: [
+    {
+      path: ["data-reports", "preview"],
+      description: "Run a Form Reports report, saved or not, as the signed-in Member and show the rows or groups the Agent would get. Rows return at most 50 per call and aggregates at most 200 groups. Needs the agents:write and records:read scopes.",
+      requiresWorkspace: true,
+      acceptsJsonInput: true,
+      args: [
+        {
+          name: "record-scope",
+          description: "currentMember (default) limits the report to the signed-in Member's records; allRecords covers every record that Member may read",
+          required: false
+        },
+        {
+          name: "parameters",
+          description: `Parameter values as a JSON object, e.g. '{"days":7}'. Omitted parameters use their defaults`,
+          required: false
+        }
+      ],
+      examples: [
+        `yarn gr data-reports preview -w $UUID --record-scope allRecords --parameters '{"days":7}' --file report.json`,
+        `yarn gr data-reports preview -w $UUID --data '{"report":{"name":"recent","description":"Latest rows","dataTypeUuid":"<form uuid>","query":{"sort":[{"field":"record.createdAt","dir":"desc"}],"limit":5}},"recordScope":"allRecords"}'`
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        const request = buildPreviewRequest(data, args);
+        const result2 = await requireAuth(ctx).apiClient.previewDataReport(workspace, request);
+        outputSingle(result2, ctx);
+      }
+    }
+  ]
+};
+
 // src/domains/queries.ts
 init_output();
 init_context();
@@ -33421,6 +35754,9 @@ var abilitiesDomain = {
           description: "Allow creation before required app connections are configured"
         }
       ],
+      examples: [
+        'yarn gr abilities enable --ability-type integration:data_reports --workflow-id 12 -w $UUID --data \'{"recordScope":"currentMember","reports":[{"name":"recent_entries","description":"The latest entries for this Member","dataTypeUuid":"<form uuid>","query":{"sort":[{"field":"record.createdAt","dir":"desc"}],"limit":5}}]}\'   # Form Reports: no app editor; try a report first with `yarn gr data-reports preview`'
+      ],
       handler: async ({ ctx, workspace, args, data }) => {
         const abilityType = args["ability-type"];
         if (typeof abilityType !== "string") throw new CLIError("--ability-type is required");
@@ -33940,7 +36276,8 @@ var NO_UUID_LOOKUP = /* @__PURE__ */ new Set([
   "import",
   "invoice",
   "workspace_config",
-  "data_record"
+  "data_record",
+  "recording"
 ]);
 var HYDRATORS = {
   workspace: async ({ client: client3 }, ref) => (await client3.getWorkspace(ref.uuid)).name,
@@ -34773,7 +37110,7 @@ var aiModelsDomain = {
     },
     {
       path: ["ai-models", "realtime"],
-      description: "List realtime/voice stacks (use as realtimeModelId). e.g. xai:realtime:voice-agent-2 = Grok Voice Think Fast 2",
+      description: "List realtime/voice stacks (use as realtimeModelId). e.g. xai:realtime:voice-agent-2 = Grok Voice Think Fast 2 (default); xai:realtime:voice-agent-3 = Grok Voice 3.0 (explicit opt-in)",
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getRealtimeModels();
@@ -36321,6 +38658,7 @@ init_dist();
 init_context();
 init_errors();
 init_output();
+init_pagination();
 var ORG_COLUMNS = [
   { header: "ID", getValue: (item) => String(item.organizationId ?? "") },
   { header: "NAME", getValue: (item) => item.organizationName || "" },
@@ -36926,6 +39264,17 @@ var ORG_WEBHOOK_COLUMNS = [
     header: "WORKSPACES",
     getValue: (item) => item.limitedToWorkspaces ? item.workspaceUuids.join(",") : "all (organization-wide)",
     maxWidth: 80
+  },
+  {
+    // A workspace is covered when it carries ALL of these labels (in
+    // addition to the explicit WORKSPACES).
+    header: "LABELS",
+    getValue: (item) => (item.labelSelector ?? []).map((label) => label.slug).join("+"),
+    maxWidth: 60
+  },
+  {
+    header: "RECENT FAILURES",
+    getValue: (item) => (item.recentFailures ?? []).map((failure) => `${failure.failureClass} (${failure.count})`).join(", ")
   }
 ];
 function requireWebhookEndpointUuid(args) {
@@ -36960,9 +39309,298 @@ function webhookStatusCommand(action) {
     }
   };
 }
+var ORG_WORKSPACE_COLUMNS = [
+  { header: "UUID", getValue: (item) => item.uuid },
+  { header: "NAME", getValue: (item) => item.name, maxWidth: 40 },
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "STATUS", getValue: (item) => String(item.status) },
+  { header: "TIMEZONE", getValue: (item) => item.timezone ?? "-" },
+  { header: "CREATED", getValue: (item) => item.createdAt }
+];
+var orgWorkspaceCommands = [
+  {
+    path: ["org", "workspaces", "list"],
+    description: "List every workspace in an organization, newest page first (read-only). Prefer this over `gr workspaces list --org` for anything fleet-wide: that command reads an unpaginated endpoint and sees only the first page of workspaces. Use --all to fetch the complete list.",
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "page", description: "Page number (default: 1)" },
+      { name: "page-size", description: "Page size" },
+      { name: "all", description: "Fetch all pages", isFlag: true },
+      { name: "search", description: "Filter by name or slug (server-side)" }
+    ],
+    examples: [
+      "yarn gr org workspaces list --org $ORG_UUID --all",
+      "yarn gr org workspaces list --org $ORG_UUID --search gastro -o json"
+    ],
+    handler: async (hctx) => {
+      const orgRef = requireOrgRef(hctx.args);
+      const pag = parsePaginationArgs(hctx.args);
+      const search = typeof hctx.args.search === "string" ? hctx.args.search : void 0;
+      const client3 = requireAuth(hctx.ctx).apiClient;
+      if (pag.all) {
+        const allItems = await fetchAllPages(
+          ({ page, pageSize }) => client3.getOrganizationWorkspaces(orgRef, {
+            page,
+            pageSize,
+            ...search ? { search } : {}
+          })
+        );
+        outputData(allItems, hctx.ctx, ORG_WORKSPACE_COLUMNS);
+        return;
+      }
+      const options = {};
+      if (pag.page) options.page = pag.page;
+      if (pag.pageSize) options.pageSize = pag.pageSize;
+      if (search) options.search = search;
+      const result2 = await client3.getOrganizationWorkspaces(orgRef, options);
+      outputData(listResult(result2, true), hctx.ctx, ORG_WORKSPACE_COLUMNS);
+    }
+  }
+];
+function requireArg2(args, name) {
+  const value = args[name];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError(`Missing required argument: --${name}`);
+  }
+  return value.trim();
+}
+function optionalArg(args, name) {
+  const value = args[name];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError(`Invalid argument: --${name}`);
+  }
+  return value.trim();
+}
+var DELIVERY_LOG_COLUMNS = [
+  { header: "EVENT", getValue: (item) => item.eventType },
+  { header: "STATUS", getValue: (item) => item.status },
+  { header: "DEDUPE KEY", getValue: (item) => item.dedupeKey, maxWidth: 48 },
+  { header: "OCCURRED", getValue: (item) => item.occurredAt },
+  { header: "ATTEMPTS", getValue: (item) => String(item.attempts) },
+  { header: "LAST FAILURE", getValue: (item) => item.lastFailureClass || "\u2014" }
+];
 var webhookCommands = [
   webhookStatusCommand("pause"),
   webhookStatusCommand("resume"),
+  {
+    path: ["org", "webhooks", "create"],
+    description: "Create an organization webhook endpoint. The signing secret is printed once in this response and is not shown again. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "name", description: "Endpoint name", required: true },
+      { name: "url", description: "HTTPS endpoint URL", required: true },
+      {
+        name: "event-type",
+        description: "Subscribed event type (repeat for more than one)",
+        required: true,
+        repeatable: true
+      },
+      {
+        name: "workspace-uuid",
+        description: "Limit coverage to this workspace (repeatable). Omit to cover every workspace in the organization.",
+        repeatable: true
+      },
+      {
+        name: "signing-secret",
+        description: "Client-supplied signing secret. Omit to have one generated."
+      }
+    ],
+    examples: [
+      'yarn gr org webhooks create --org $ORG_UUID --name "Rysun" --url https://example.com/hook --event-type data_record.created --allow-write'
+    ],
+    handler: async (hctx) => {
+      const eventTypes = repeatedValues(hctx.args, "event-type");
+      if (eventTypes.length === 0) {
+        throw new CLIError("Missing required argument: --event-type");
+      }
+      const signingSecret = optionalArg(hctx.args, "signing-secret");
+      const created = await requireAuth(hctx.ctx).apiClient.createOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        {
+          name: requireArg2(hctx.args, "name"),
+          url: requireArg2(hctx.args, "url"),
+          eventTypes,
+          workspaceUuids: repeatedValues(hctx.args, "workspace-uuid"),
+          ...signingSecret ? { signingSecret } : {}
+        }
+      );
+      hint(hctx.ctx, ["Signing secret is in this response and is not shown again."]);
+      outputSingle(created, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "webhooks", "update"],
+    description: "Update an organization webhook endpoint. A rotated signing secret is not echoed. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "name", description: "New endpoint name" },
+      { name: "url", description: "New HTTPS endpoint URL" },
+      {
+        name: "event-type",
+        description: "Replace the subscription list (repeat for more than one)",
+        repeatable: true
+      },
+      {
+        name: "workspace-uuid",
+        description: "Replace workspace coverage with this workspace (repeatable)",
+        repeatable: true
+      },
+      {
+        name: "all-workspaces",
+        description: "Cover every workspace in the organization",
+        isFlag: true
+      },
+      { name: "status", description: "active or paused" },
+      {
+        name: "signing-secret",
+        description: "Rotate the signing secret. The new value is not printed."
+      }
+    ],
+    examples: [
+      "yarn gr org webhooks update --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --status paused --allow-write"
+    ],
+    handler: async (hctx) => {
+      const workspaceUuids = repeatedValues(hctx.args, "workspace-uuid");
+      const allWorkspaces = hctx.args["all-workspaces"] === true;
+      if (allWorkspaces && workspaceUuids.length > 0) {
+        throw new CLIError("Pass either --all-workspaces or --workspace-uuid, not both");
+      }
+      const eventTypes = repeatedValues(hctx.args, "event-type");
+      const status = optionalArg(hctx.args, "status");
+      if (status !== void 0 && status !== "active" && status !== "paused") {
+        throw new CLIError("--status must be active or paused");
+      }
+      const signingSecret = optionalArg(hctx.args, "signing-secret");
+      const data = {};
+      const name = optionalArg(hctx.args, "name");
+      const url = optionalArg(hctx.args, "url");
+      if (name) data.name = name;
+      if (url) data.url = url;
+      if (eventTypes.length > 0) data.eventTypes = eventTypes;
+      if (allWorkspaces) data.workspaceUuids = [];
+      else if (workspaceUuids.length > 0) data.workspaceUuids = workspaceUuids;
+      if (status) data.status = status;
+      if (signingSecret) data.signingSecret = signingSecret;
+      if (Object.keys(data).length === 0) {
+        throw new CLIError("Nothing to update");
+      }
+      const result2 = await requireAuth(hctx.ctx).apiClient.updateOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        data
+      );
+      const { signingSecret: _rotatedSecret, ...printable } = result2;
+      outputSingle(printable, hctx.ctx, ORG_WEBHOOK_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "webhooks", "test-send"],
+    description: "Send one test payload to an endpoint. Writes no delivery row. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "event-type", description: "Event type to send", required: true },
+      {
+        name: "payload",
+        description: "JSON object to send instead of the server sample"
+      }
+    ],
+    examples: [
+      "yarn gr org webhooks test-send --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --event-type data_record.created --allow-write"
+    ],
+    handler: async (hctx) => {
+      const rawPayload = optionalArg(hctx.args, "payload");
+      let payload;
+      if (rawPayload !== void 0) {
+        let parsed;
+        try {
+          parsed = JSON.parse(rawPayload);
+        } catch {
+          throw new CLIError("--payload must be a JSON object");
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          throw new CLIError("--payload must be a JSON object");
+        }
+        payload = parsed;
+      }
+      const result2 = await requireAuth(hctx.ctx).apiClient.testOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        {
+          eventType: requireArg2(hctx.args, "event-type"),
+          ...payload ? { payload } : {}
+        }
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "webhooks", "deliveries"],
+    description: "Delivery log for one organization webhook endpoint. Event type, status, dedupe key, occurred-at, attempt count, and last failure class. The event envelope is not printed.",
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "limit", description: "Page size (default 50)" }
+    ],
+    examples: ["yarn gr org webhooks deliveries --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID"],
+    handler: async (hctx) => {
+      const limitRaw = optionalArg(hctx.args, "limit");
+      let limit = 50;
+      if (limitRaw !== void 0) {
+        limit = Number(limitRaw);
+        if (!Number.isInteger(limit) || limit < 1) {
+          throw new CLIError("--limit must be a positive integer");
+        }
+      }
+      const page = await requireAuth(hctx.ctx).apiClient.listOrgWebhookEndpointDeliveries(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        limit
+      );
+      const rows = page.items.map((item) => {
+        const latest = item.attempts.at(-1);
+        return {
+          eventType: item.eventType,
+          status: item.status,
+          dedupeKey: item.dedupeKey,
+          occurredAt: item.occurredAt,
+          attempts: item.attempts.length,
+          lastFailureClass: latest?.failureClass ?? latest?.errorType ?? ""
+        };
+      });
+      outputData(rows, hctx.ctx, DELIVERY_LOG_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "webhooks", "discard-pending"],
+    description: "Expire a paused or disabled endpoint's pending deliveries so a resume does not re-send a backlog the receiver keeps rejecting. Dead-lettered deliveries are untouched; expired ones stay replayable. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true }
+    ],
+    examples: [
+      "yarn gr org webhooks discard-pending --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.discardPendingOrgWebhookDeliveries(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
   {
     path: ["org", "webhooks", "list"],
     description: "List an organization's webhook endpoints (read-only). Each row carries the destination host fingerprint and a masked signing secret, never the URL or a usable secret.",
@@ -36995,9 +39633,93 @@ var webhookCommands = [
     }
   }
 ];
+var WORKSPACE_LABEL_COLUMNS = [
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "NAME", getValue: (item) => item.name },
+  { header: "WORKSPACES", getValue: (item) => String(item.workspaceCount) },
+  { header: "WEBHOOK SELECTORS", getValue: (item) => String(item.webhookSelectorCount) },
+  { header: "UUID", getValue: (item) => item.uuid }
+];
+var LABEL_SUMMARY_COLUMNS = [
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "NAME", getValue: (item) => item.name },
+  { header: "UUID", getValue: (item) => item.uuid }
+];
+function requireWorkspaceUuidArg(args) {
+  const value = args["workspace-uuid"] ?? args.workspace;
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError("Missing required argument: --workspace-uuid");
+  }
+  return value.trim();
+}
+var WORKSPACE_UUID_ARG = {
+  name: "workspace-uuid",
+  aliases: ["workspace"],
+  description: "Workspace UUID (a workspace of this organization)",
+  required: true
+};
+var workspaceLabelCommands = [
+  {
+    path: ["org", "labels", "list"],
+    description: "List the organization's workspace labels, with how many workspaces carry each and how many webhook label selectors require it",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG2],
+    examples: ["yarn gr org labels list --org $ORG_UUID -o json"],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.listWorkspaceLabels(
+        requireOrgRef(hctx.args)
+      );
+      outputData(result2, hctx.ctx, WORKSPACE_LABEL_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "workspaces", "labels", "get"],
+    description: "Show the labels one workspace of the organization carries",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG2, WORKSPACE_UUID_ARG],
+    examples: [
+      "yarn gr org workspaces labels get --org $ORG_UUID --workspace-uuid $WORKSPACE_UUID -o json"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.getWorkspaceLabels(
+        requireOrgRef(hctx.args),
+        requireWorkspaceUuidArg(hctx.args)
+      );
+      outputData(result2.labels, hctx.ctx, LABEL_SUMMARY_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "workspaces", "labels", "set"],
+    description: "Replace a workspace's labels with exactly the given set. Requires organization admin access. Labels the organization has not used before are created. Webhook endpoints selecting on these labels start or stop covering the workspace immediately.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      WORKSPACE_UUID_ARG,
+      {
+        name: "labels",
+        description: "Comma-separated label slugs; pass an empty string to remove all labels",
+        required: true
+      }
+    ],
+    examples: [
+      "yarn gr org workspaces labels set --org $ORG_UUID --workspace-uuid $WORKSPACE_UUID --labels production,sponsor-acme --allow-write"
+    ],
+    handler: async (hctx) => {
+      const raw = hctx.args.labels;
+      if (raw === void 0) throw new CLIError("Missing required argument: --labels");
+      const result2 = await requireAuth(hctx.ctx).apiClient.setWorkspaceLabels(
+        requireOrgRef(hctx.args),
+        requireWorkspaceUuidArg(hctx.args),
+        { labels: raw === "" ? [] : parseLabelList(raw) }
+      );
+      outputData(result2.labels, hctx.ctx, LABEL_SUMMARY_COLUMNS);
+    }
+  }
+];
 var orgDomain = {
   name: "org",
-  description: "Organization membership, domains, and webhook endpoints",
+  description: "Organization membership, domains, webhook endpoints, and workspace labels",
   commands: [
     {
       path: ["org", "list"],
@@ -37022,7 +39744,9 @@ var orgDomain = {
       }
     },
     ...domainCommands,
+    ...orgWorkspaceCommands,
     ...webhookCommands,
+    ...workspaceLabelCommands,
     orgMemberUpdateCommand()
   ]
 };
@@ -40392,6 +43116,71 @@ var ENCOUNTER_RUN_COLUMNS = [
     getValue: (item) => summarizeReasons(item.attribution?.collections, "errorReasonCounts")
   }
 ];
+var ONBOARDING_START_COLUMNS = [
+  { header: "MODE", getValue: (item) => item.mode ?? "" },
+  { header: "WORKFLOW ID", getValue: (item) => item.workflowId ?? "" },
+  { header: "RUN ID", getValue: (item) => item.runId ?? "" }
+];
+var ONBOARDING_PAIR_COLUMNS = [
+  { header: "DEPARTMENT", getValue: (item) => String(item.departmentId ?? "") },
+  { header: "PATIENT STATUS", getValue: (item) => item.patientStatus ?? "" },
+  { header: "STATUS", getValue: (item) => item.status ?? "" },
+  { header: "STOP REASON", getValue: (item) => item.stopReason ?? "" },
+  { header: "GEN", getValue: (item) => String(item.generation ?? "") },
+  { header: "NEXT OFFSET", getValue: (item) => String(item.nextOffset ?? "") },
+  { header: "PAGES (RUN)", getValue: (item) => String(item.pagesDone ?? 0) },
+  { header: "~FETCHED", getValue: (item) => String(item.totals?.fetched ?? 0) },
+  { header: "~APPLIED", getValue: (item) => String(item.totals?.applied ?? 0) },
+  { header: "~SKIPPED", getValue: (item) => String(item.totals?.skipped ?? 0) },
+  { header: "~FAILED", getValue: (item) => String(item.totals?.failed ?? 0) },
+  { header: "RUN ID", getValue: (item) => item.runId ?? "" }
+];
+var RESUMABLE_PAIR_STATUSES = /* @__PURE__ */ new Set([
+  "failed",
+  "aborted",
+  "truncated",
+  "pending",
+  "running",
+  "waiting"
+]);
+function onboardingStatusLines(status, connectionId) {
+  const lines = [];
+  const execution = status.execution;
+  if (execution) {
+    const failure = execution.failureCode ? ` (failure: ${execution.failureCode})` : "";
+    lines.push(
+      `Temporal execution: ${execution.workflowId} run ${execution.runId ?? "-"} \u2014 ${execution.status}${failure}`
+    );
+  } else {
+    lines.push("Temporal execution: none recorded");
+  }
+  if (status.waitingUntil) {
+    lines.push(
+      `Waiting for the operator window (21:00\u201308:00 America/New_York) until ${status.waitingUntil}`
+    );
+  }
+  if (status.preview) {
+    const previewPairs = status.preview.pairs ?? [];
+    const admitted = previewPairs.reduce((n, p) => n + (p.totals?.admitted ?? 0), 0);
+    const notAdmitted = previewPairs.reduce(
+      (n, p) => n + (p.totals?.notAdmitted ?? 0),
+      0
+    );
+    lines.push(
+      `Latest preview: ${previewPairs.length} pair(s), ~${admitted} admission-eligible (incl. already-linked), ~${notAdmitted} not admitted (read-only)`
+    );
+  }
+  lines.push("Counts are approximate.");
+  const unfinished = (status.pairs ?? []).some(
+    (p) => p.inCurrentCohort && RESUMABLE_PAIR_STATUSES.has(p.status) && p.runId
+  );
+  if (unfinished && execution?.status !== "running") {
+    lines.push(
+      `Unfinished pairs continue only on an explicit resume: gr fhir-connections onboarding-import start --id ${connectionId} --resume --allow-write`
+    );
+  }
+  return lines;
+}
 var fhirConnectionsDomain = {
   name: "fhir-connections",
   description: "Manage FHIR connections",
@@ -40437,8 +43226,8 @@ var fhirConnectionsDomain = {
       ],
       examples: [
         "fhir-connections encounter-sync runs --id 12",
-        "fhir-connections encounter-sync runs --id 12 --output json",
-        "fhir-connections encounter-sync runs --id 12 --limit 5 --output json"
+        "fhir-connections encounter-sync runs --id 12 --output-format json",
+        "fhir-connections encounter-sync runs --id 12 --limit 5 --output-format json"
       ],
       handler: async ({ ctx, workspace, args }) => {
         const limit = args["limit"] ? Number(args["limit"]) : 20;
@@ -40449,6 +43238,77 @@ var fhirConnectionsDomain = {
         );
         outputData(runs, ctx, ENCOUNTER_RUN_COLUMNS);
       }
+    },
+    {
+      // athenahealth onboarding import (PR-C): one explicit, audited
+      // operator execution per connection, at most 50 pages per pair per
+      // run. Thin over the SDK; the server decides everything.
+      path: ["fhir-connections", "onboarding-import", "start"],
+      description: "Start an athenahealth onboarding import (or --resume / --override / --dry-run preview)",
+      requiresWorkspace: true,
+      mutates: true,
+      args: [
+        { name: "id", description: "FHIR connection ID", required: true },
+        {
+          name: "dry-run",
+          description: "Preview: read and classify admission only, write no Members",
+          isFlag: true
+        },
+        {
+          name: "resume",
+          description: "Continue unfinished (failed, truncated, aborted) pairs at their stored frontier",
+          isFlag: true
+        },
+        {
+          name: "override",
+          description: "Rescan completed pairs from offset 0 under a new generation",
+          isFlag: true
+        }
+      ],
+      examples: [
+        "fhir-connections onboarding-import start --id 12 --dry-run --allow-write",
+        "fhir-connections onboarding-import start --id 12 --allow-write",
+        "fhir-connections onboarding-import start --id 12 --resume --allow-write"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const connectionId = requireNumber(args, "id");
+        const started = await requireAuth(ctx).apiClient.fhirStartOnboardingImport(
+          workspace,
+          connectionId,
+          {
+            dryRun: args["dry-run"] === true,
+            resume: args["resume"] === true,
+            override: args["override"] === true
+          }
+        );
+        outputSingle(started, ctx, ONBOARDING_START_COLUMNS);
+        hint(ctx, [
+          `Started. Follow progress with: gr fhir-connections onboarding-import status --id ${connectionId}`
+        ]);
+      }
+    },
+    {
+      path: ["fhir-connections", "onboarding-import", "status"],
+      description: "Show athenahealth onboarding-import progress and its Temporal execution (read-only)",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "FHIR connection ID", required: true }],
+      examples: [
+        "fhir-connections onboarding-import status --id 12",
+        "fhir-connections onboarding-import status --id 12 --output-format json"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const connectionId = requireNumber(args, "id");
+        const status = await requireAuth(ctx).apiClient.fhirGetOnboardingImportStatus(
+          workspace,
+          connectionId
+        );
+        if (ctx.jq || (ctx.outputFormat ?? "table") !== "table") {
+          outputSingle(status, ctx);
+          return;
+        }
+        outputData(status.pairs, ctx, ONBOARDING_PAIR_COLUMNS);
+        hint(ctx, onboardingStatusLines(status, connectionId));
+      }
     }
   ]
 };
@@ -40795,15 +43655,18 @@ var hubspotDomain = {
       mutates: true,
       requiresWorkspace: true,
       examples: [
-        "# HubSpot setup is a 4-step flow \u2014 this command is step 1:",
+        "# When the response shows platformAppAvailable=true, the workspace connects through",
+        "# the shared Gravity Rail HubSpot app: install, then authorize. That's all.",
+        "gr hubspot install -w <ws> --allow-write",
+        "gr hubspot authorize -w <ws> --allow-write   # then open the returned authorizeUrl",
+        "",
+        "# To use your own HubSpot app instead (a Projects-platform app; HubSpot no longer",
+        "# allows new private or developer apps):",
         '#   1. install    -> creates the connection; the response includes the OAuth "callbackUrl"',
-        "#   2. in HubSpot: create a private/developer app whose Redirect URL is that callbackUrl,",
-        "#      with CRM scopes (contacts/companies/deals read+write). Copy the Client ID + Secret.",
+        "#   2. in HubSpot: give your app that callbackUrl as a Redirect URL, with CRM scopes",
+        "#      (contacts/companies/deals read+write). Copy the Client ID + Secret.",
         "#   3. configure  -> save that Client ID / Secret",
-        '#   4. authorize  -> returns an "authorizeUrl"; open it to grant access. status then',
-        "#      reports configured=true and connected=true.",
-        "",
-        "gr hubspot install -w <ws> --allow-write",
+        '#   4. authorize  -> returns an "authorizeUrl"; open it to grant access.',
         "gr hubspot status -w <ws>            # read back callbackUrl + configured/connected",
         `gr hubspot configure -w <ws> --allow-write -d '{"clientId":"...","clientSecret":"..."}'`,
         "gr hubspot authorize -w <ws> --allow-write   # then open the returned authorizeUrl"
@@ -41828,6 +44691,7 @@ function registerPublicDomains(registry) {
   registry.register(calendarsDomain);
   registry.register(qualificationsDomain);
   registry.register(queriesDomain);
+  registry.register(dataReportsDomain);
   registry.register(personasDomain);
   registry.register(metricsDomain);
   registry.register(journeysDomain);
@@ -46395,11 +49259,8 @@ var topLevelCommands = [
 // src/lib.ts
 init_concierge_api();
 
-// package.json
-var package_default = {
-  version: "0.53.0"};
-
 // src/gr.ts
+init_package();
 var VERSION = package_default.version;
 function createRegistry() {
   const registry = new CommandRegistry();
@@ -46481,7 +49342,7 @@ main().catch(handleError);
 /*! Bundled license information:
 
 js-yaml/dist/js-yaml.mjs:
-  (*! js-yaml 5.4.2 https://github.com/nodeca/js-yaml @license MIT *)
+  (*! js-yaml 5.4.3 https://github.com/nodeca/js-yaml @license MIT *)
 */
 //# sourceMappingURL=gr.js.map
 //# sourceMappingURL=gr.js.map