@gravity-rail/cli 0.53.0 → 0.55.0

package/dist/lib.js

@@ -33,15 +33,16 @@ import {
   startAccountPhoneVerify,
   stderr,
   unwrapItems
-} from "./chunk-FQMZ2EBF.js";
+} from "./chunk-WCMXS5CL.js";
 import {
   AGUIClient,
   formatTimestamp,
   getErrorMessage,
   getTextDelta,
+  isRecord,
   performOAuthFlow,
   selectFromList
-} from "./chunk-FSY2BM4J.js";
+} from "./chunk-BQ3WBHSA.js";
 import {
   AuthRequiredError,
   CLIError,
@@ -257,6 +258,9 @@ function commandNeedsJsonBody(cmd, parsedArgs) {
     }
     return false;
   }
+  if (cmd.acceptsJsonInput === true) {
+    return true;
+  }
   if (parsedArgs.data !== void 0 || parsedArgs.file !== void 0) {
     return true;
   }
@@ -1050,7 +1054,7 @@ var CommandRegistry = class {
       lines.push("  Requires: --allow-write");
     }
     const action = cmd.path[cmd.path.length - 1] ?? "";
-    const showsJsonHints = action === "create" || action === "update" || cmd.args?.some((a) => a.name === "data" || a.name === "file");
+    const showsJsonHints = action === "create" || action === "update" || cmd.args?.some((a) => a.name === "data");
     if (cmd.args && cmd.args.length > 0) {
       lines.push("", "Arguments:");
       for (const arg of cmd.args) {
@@ -1380,6 +1384,8 @@ Optional
   chatModelConfig (object|null)         Chat model overrides (temperature, thinking, \u2026)
   realtimeModelId (string|null)         Voice/realtime model (see \`gr ai-models realtime\`)
                                         e.g. "xai:realtime:voice-agent-2" (Grok Voice Think Fast 2)
+                                        or opt in to "xai:realtime:voice-agent-3" (Grok Voice
+                                        3.0; not yet cleared for strict-routing workflows)
                                         Native models auto-fill tts=native + default voice when
                                         realtimeModelConfig is omitted.
   realtimeModelConfig (object|null)     Realtime config. Native example:
@@ -1401,6 +1407,10 @@ One-shot workflow voice WITHOUT creating an agent (preferred for "use Grok Voice
   gr workflows update --id <wf> -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'
   gr workflows publish --workflow-id <wf>
 
+Opt a workflow into Grok Voice 3.0 (same xAI voices as 2.0; not the default):
+  gr workflows update --id <wf> -d '{"realtimeModelId":"xai:realtime:voice-agent-3"}'
+  gr workflows publish --workflow-id <wf>
+
 List models:
   gr ai-models chat | realtime | voice
 `;
@@ -1430,6 +1440,7 @@ ${AGENT_FIELD_REFERENCE}`,
       ],
       updateExamples: [
         `gr agents update --id 42 -d '{"realtimeModelId":"xai:realtime:voice-agent-2"}'`,
+        `gr agents update --id 42 -d '{"realtimeModelId":"xai:realtime:voice-agent-3"}'`,
         "gr agents update --id 42 --file agent.json"
       ]
     })
@@ -3158,6 +3169,9 @@ Assistant / models (live on the DRAFT revision \u2014 publish to go live)
                                         update: null = voice off
                                         One-shot voice example:
                                         {"realtimeModelId":"xai:realtime:voice-agent-2"}
+                                        Opt in to Grok Voice 3.0 (not the default; not yet
+                                        cleared for routingMode "strict"):
+                                        {"realtimeModelId":"xai:realtime:voice-agent-3"}
                                         A native model named WITHOUT a config gets
                                         tts=native + the provider fallback voice
                                         (xAI \u2192 xai:voice:eve, not cosmo). Explicit config:
@@ -3224,6 +3238,24 @@ var NOTE_COLUMNS = [
   },
   COL.created()
 ];
+var CONFIG_HEALTH_COLUMNS = [
+  { header: "SEVERITY", getValue: (item) => String(item.severity ?? "") },
+  { header: "CODE", getValue: (item) => String(item.code ?? "") },
+  { header: "SUBJECT", getValue: (item) => String(item.subject?.type ?? "") },
+  {
+    header: "SUBJECT-ID",
+    getValue: (item) => String(item.subject?.id ?? "")
+  },
+  {
+    header: "TASK",
+    getValue: (item) => String(item.remediation?.focus?.taskId ?? "")
+  },
+  {
+    header: "MESSAGE",
+    getValue: (item) => String(item.message ?? ""),
+    maxWidth: 80
+  }
+];
 var CONTRIBUTOR_COLUMNS = [
   COL.id(),
   {
@@ -3424,6 +3456,26 @@ var workflowsDomain = {
         outputData(result2, ctx);
       }
     },
+    // Config health (draft revision)
+    {
+      path: ["workflows", "validate-config"],
+      description: "Report the workflow's configuration health issues (draft revision) \u2014 the same findings the editor shows",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Workflow ID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.getWorkflowConfigValidation(
+          workspace,
+          requireNumber(args, "id")
+        );
+        if (ctx.outputFormat === "json" || ctx.outputFormat === "jsonl") {
+          outputData(result2, ctx);
+        } else {
+          outputData(result2.configHealthIssues ?? [], ctx, CONFIG_HEALTH_COLUMNS);
+          stderr(`issues=${(result2.configHealthIssues ?? []).length}
+`);
+        }
+      }
+    },
     // Diagram
     {
       path: ["workflows", "diagram"],
@@ -3894,6 +3946,17 @@ ${WORKFLOW_FIELD_REFERENCE}`,
 import { writeFile } from "fs/promises";
 import { extractWorkspaceExportJson } from "@gravity-rail/sdk/helpers";
 
+// src/lib/workspace-labels.ts
+function parseLabelList(value) {
+  if (value === void 0 || value === null || value === false) return [];
+  const raw = Array.isArray(value) ? value.map(String) : [String(value)];
+  const labels = raw.flatMap((entry) => entry.split(",")).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  if (labels.length === 0 && raw.some((entry) => entry.trim().length > 0)) {
+    throw new CLIError("--labels must name at least one label");
+  }
+  return labels;
+}
+
 // src/lib/workspace-timezone.ts
 function normalizeIanaTimeZone(value) {
   const trimmed = value.trim();
@@ -4698,11 +4761,16 @@ var workspacesDomain = {
         {
           name: "timezone",
           description: "IANA time zone (e.g. America/New_York). The create API does not take one, so the command waits for provisioning to finish and then sets it with a follow-up update. Without it the workspace has no timezone and Journey send windows and Routines run in UTC."
+        },
+        {
+          name: "labels",
+          description: "Comma-separated workspace labels to apply right after creation (e.g. production,sponsor-acme). Labels the organization has not used before are created. Webhook endpoints that select on these labels start covering the workspace at once."
         }
       ],
       examples: [
         'gr workspaces create --org <org-uuid> --name "Front Desk"',
-        'gr workspaces create --org <org-uuid> --name "Front Desk" --timezone America/Chicago'
+        'gr workspaces create --org <org-uuid> --name "Front Desk" --timezone America/Chicago',
+        'gr workspaces create --org <org-uuid> --name "Front Desk" --labels production,sponsor-acme'
       ],
       handler: async ({ ctx, args }) => {
         const orgUuid = args.org ?? args["org-uuid"];
@@ -4710,6 +4778,7 @@ var workspacesDomain = {
         if (!orgUuid) throw new CLIError("Missing required argument: --org <org-uuid>");
         if (!name) throw new CLIError("Missing required argument: --name");
         const timezone = typeof args.timezone === "string" ? normalizeIanaTimeZone(args.timezone) : void 0;
+        const labels = parseLabelList(args.labels);
         const payload = { name };
         if (args.slug) payload.slug = String(args.slug);
         if (args.template) payload.templateWorkspaceUuid = String(args.template);
@@ -4726,6 +4795,18 @@ var workspacesDomain = {
           }
           throw err;
         }
+        if (labels.length > 0) {
+          try {
+            await client3.setWorkspaceLabels(orgUuid, result2.uuid, { labels });
+          } catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new CLIError(
+              `Workspace ${result2.uuid} was created but its labels were not set: ${reason}
+  Apply them with:
+  gr org workspaces labels set --org ${orgUuid} --workspace-uuid ${result2.uuid} --labels ${labels.join(",")} --allow-write`
+            );
+          }
+        }
         if (timezone) {
           const wsUuid = result2.uuid;
           stderr(`Waiting for workspace ${wsUuid} to finish provisioning...`);
@@ -7242,6 +7323,73 @@ function parseIdList(value) {
     return num;
   });
 }
+function toGrantEntry(grant) {
+  return { granteeMemberId: grant.granteeMemberId, accessMode: grant.accessMode };
+}
+var SHARING_COLUMNS = [
+  { header: "ACCESS", getValue: (item) => item.access },
+  {
+    header: "SHAREABLE",
+    getValue: (item) => String(item.shareable ?? "")
+  },
+  { header: "OWNER", getValue: (item) => String(item.ownerId ?? "") },
+  { header: "GRANTS", getValue: (item) => String(item.grants.length) },
+  {
+    header: "ROLES",
+    getValue: (item) => (item.roleAssociations ?? []).map((role) => role.memberRoleName).join(", ")
+  }
+];
+function sharingCommands(spec) {
+  const { prefix, entityName, getMethod, updateMethod } = spec;
+  const idArg2 = { name: "id", description: `${entityName} ID`, required: true };
+  const cli = ["gr", ...prefix, "sharing"].join(" ");
+  return [
+    {
+      path: [...prefix, "sharing", "get"],
+      description: `Show a ${entityName}'s access level, grants and role associations`,
+      requiresWorkspace: true,
+      args: [idArg2],
+      examples: [`${cli} get -w $WID --id 12`],
+      handler: async ({ ctx, workspace, args }) => {
+        const state = await requireAuth(ctx).apiClient[getMethod](
+          workspace,
+          requireNumber(args, "id")
+        );
+        outputData(state, ctx, SHARING_COLUMNS);
+      }
+    },
+    {
+      path: [...prefix, "sharing", "set"],
+      description: `Change a ${entityName}'s sharing. The API replaces the whole sharing state, so this command reads the current state first and overrides only the keys you pass \u2014 omitting "grants" or "roleAssociations" keeps the existing ones rather than clearing them. Pass them explicitly (e.g. "grants": []) to replace.`,
+      mutates: true,
+      requiresWorkspace: true,
+      args: [idArg2],
+      examples: [
+        `${cli} set -w $WID --id 12 --allow-write -d '{"access":"workspace"}'`,
+        `${cli} set -w $WID --id 12 --allow-write -d '{"access":"private","grants":[]}'`
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        if (data === void 0 || data === null || typeof data !== "object") {
+          throw new CLIError(
+            `Provide the fields to change as JSON via --data, --file, or stdin (e.g. '{"access":"workspace"}')`
+          );
+        }
+        const patch = data;
+        const client3 = requireAuth(ctx).apiClient;
+        const id = requireNumber(args, "id");
+        const current = await client3[getMethod](workspace, id);
+        const next = {
+          access: patch.access ?? current.access,
+          shareable: patch.shareable ?? current.shareable ?? null,
+          grants: patch.grants ?? current.grants.map(toGrantEntry),
+          roleAssociations: patch.roleAssociations ?? current.roleAssociations ?? []
+        };
+        const state = await client3[updateMethod](workspace, id, next);
+        outputData(state, ctx, SHARING_COLUMNS);
+      }
+    }
+  ];
+}
 var COLUMNS10 = [
   COL.id(),
   COL.name(),
@@ -7403,6 +7551,18 @@ ${FILE_FIELD_REFERENCE}`
         outputData(results, ctx, folderSearchColumns(results));
       }
     },
+    ...sharingCommands({
+      prefix: ["files", "folders"],
+      entityName: "folder",
+      getMethod: "getFolderSharing",
+      updateMethod: "updateFolderSharing"
+    }),
+    ...sharingCommands({
+      prefix: ["files"],
+      entityName: "file",
+      getMethod: "getFileSharing",
+      updateMethod: "updateFileSharing"
+    }),
     // Labels sub-resource
     ...crudCommands({
       prefix: ["files", "labels"],
@@ -9311,7 +9471,7 @@ var OBS_COLUMNS = [
 ];
 var metricsDomain = {
   name: "metrics",
-  description: "Customer-defined outcome metrics (CEL expression or LLM rubric) with time-series readout",
+  description: "Customer-defined outcome metrics (CEL expression, LLM rubric, Member cohort count, or an aggregate over Form records) with time-series readout",
   commands: [
     ...crudCommands({
       prefix: ["metrics"],
@@ -9324,14 +9484,16 @@ var metricsDomain = {
       columns: COLUMNS11,
       paginationSupport: "full",
       createExamples: [
-        `yarn gr metrics create -w $WID --allow-write --data '{"name":"SMS Channel Rate","metricType":"expression","celExpression":"chat.channel == \\"phone-sms\\"","unit":"rate"}'`,
-        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Qualified Engagement","metricType":"rubric","evaluationPrompt":"Did the user show buying intent?","unit":"rate"}'`
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"SMS Channel Rate","metricType":"expression","celExpression":"chat.channel == \\"phone-sms\\"","unit":"rate","workflowIds":[]}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Qualified Engagement","metricType":"rubric","evaluationPrompt":"Did the user show buying intent?","unit":"rate","workflowIds":[]}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"HRV daily average","metricType":"record_aggregate","source":"data_record","sourceConfig":{"record":{"dataType":"daily_readings","aggregation":"avg","field":"record.hrv","dateField":"record.measured_on","groupBy":"record.athlete"}},"targetValue":65}'`,
+        `yarn gr metrics create -w $WID --allow-write --data '{"name":"Open lab results","metricType":"record_aggregate","source":"data_record","sourceConfig":{"record":{"dataType":"lab_results","aggregation":"count","where":{"kind":"compare","field":"record.status","op":"eq","value":"open"}}}}'`
       ],
-      createHelp: "Create a metric definition. metricType is expression (CEL) or rubric (LLM). MVP source is chat only."
+      createHelp: `Create a metric definition. metricType is expression (CEL) or rubric (LLM) for one reading per chat (pass workflowIds, [] for every workflow); filter_count for the daily size of a saved Member filter (source "member_filter", kind "gauge", sourceConfig.memberFilterId); or record_aggregate for an aggregate over a Form's records, computed from the records each time the series is read (source "data_record", sourceConfig.record). sourceConfig.record takes dataType (Form id or slug), aggregation (count | countDistinct | sum | avg | min | max), field (record.<fieldSlug>; required for all but count, a number field for sum/avg/min/max), dateField (a date or datetime field, default record.createdAt), where (Query IR predicate, see "yarn gr queries syntax") and groupBy (record.<fieldSlug>, one series per value). A record metric needs records:read to save and to read, and records:admin when it names an adminOnly field.`
     }),
     {
       path: ["metrics", "observations"],
-      description: "List raw observations for a metric in a date range (may include PHI reason)",
+      description: "List raw observations for a metric in a date range (may include PHI reason). Not available for record_aggregate metrics, which store none: read their series",
       args: [
         { name: "id", required: true, description: "Metric ID" },
         {
@@ -9369,7 +9531,7 @@ var metricsDomain = {
     },
     {
       path: ["metrics", "series"],
-      description: "Time-bucketed aggregation for a metric (numeric only)",
+      description: "Time-bucketed aggregation for a metric. A record_aggregate metric is computed from its Form records on each call and, with groupBy, also returns one series per group",
       args: [
         { name: "id", required: true, description: "Metric ID" },
         {
@@ -9385,7 +9547,7 @@ var metricsDomain = {
         { name: "bucket", description: "day | week (default day)" },
         {
           name: "aggregation",
-          description: "avg | sum | count | rate | last | passes (default varies by metric)"
+          description: "avg | sum | count | rate | last | passes (default varies by metric). Omit for a record_aggregate metric: its definition names the aggregation"
         }
       ],
       requiresWorkspace: true,
@@ -9565,8 +9727,10 @@ function buildModelEvalBatchJobs(scenarios, models, rounds, warmup, realtimeMode
 var REALTIME_AUDIO_USD_PER_MIN = {
   "xai:realtime:voice-agent": 0.05,
   // Grok Voice Think Fast 1
-  "xai:realtime:voice-agent-2": 0.08
-  // Grok Voice Think Fast 2
+  "xai:realtime:voice-agent-2": 0.08,
+  // Grok Voice Think Fast 2 (pinned grok-voice-2.0)
+  "xai:realtime:voice-agent-3": 0.08
+  // Grok Voice 3.0 — same audio rate as 2.0
 };
 var DEFAULT_REALTIME_AUDIO_USD_PER_MIN = 0.08;
 var EST_AUDIO_MIN_PER_RUN = 3;
@@ -10396,6 +10560,87 @@ var qualificationsDomain = {
   ]
 };
 
+// src/domains/data-reports.ts
+function parseRecordScope(value) {
+  if (value === void 0) return void 0;
+  if (value === "currentMember" || value === "allRecords") return value;
+  throw new CLIError("--record-scope must be currentMember or allRecords");
+}
+function parseParameters(value) {
+  if (value === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = typeof value === "string" ? JSON.parse(value) : value;
+  } catch {
+    throw new CLIError("--parameters must be a JSON object");
+  }
+  if (!isRecord(parsed)) throw new CLIError("--parameters must be a JSON object");
+  const values = {};
+  for (const [name, parameter] of Object.entries(parsed)) {
+    if (typeof parameter !== "boolean" && typeof parameter !== "number" && typeof parameter !== "string") {
+      throw new CLIError(`--parameters value for '${name}' must be a boolean, number or string`);
+    }
+    values[name] = parameter;
+  }
+  return values;
+}
+function buildPreviewRequest(data, args) {
+  if (!isRecord(data)) {
+    throw new CLIError("Report JSON required (--data, --file, or stdin)");
+  }
+  let request;
+  if ("report" in data) {
+    if (!isRecord(data.report)) {
+      throw new CLIError("The request's 'report' must be a JSON object");
+    }
+    request = { ...data };
+  } else if ("dataTypeUuid" in data && "query" in data) {
+    request = { report: data };
+  } else {
+    throw new CLIError(
+      "Body must be a request with a 'report' object, or a bare report with dataTypeUuid and query"
+    );
+  }
+  const recordScope = parseRecordScope(args["record-scope"]);
+  if (recordScope) request.recordScope = recordScope;
+  const parameters = parseParameters(args["parameters"]);
+  if (parameters) request.parameters = parameters;
+  return request;
+}
+var dataReportsDomain = {
+  name: "data-reports",
+  description: "Form Reports: preview a report as the Agent would run it",
+  commands: [
+    {
+      path: ["data-reports", "preview"],
+      description: "Run a Form Reports report, saved or not, as the signed-in Member and show the rows or groups the Agent would get. Rows return at most 50 per call and aggregates at most 200 groups. Needs the agents:write and records:read scopes.",
+      requiresWorkspace: true,
+      acceptsJsonInput: true,
+      args: [
+        {
+          name: "record-scope",
+          description: "currentMember (default) limits the report to the signed-in Member's records; allRecords covers every record that Member may read",
+          required: false
+        },
+        {
+          name: "parameters",
+          description: `Parameter values as a JSON object, e.g. '{"days":7}'. Omitted parameters use their defaults`,
+          required: false
+        }
+      ],
+      examples: [
+        `yarn gr data-reports preview -w $UUID --record-scope allRecords --parameters '{"days":7}' --file report.json`,
+        `yarn gr data-reports preview -w $UUID --data '{"report":{"name":"recent","description":"Latest rows","dataTypeUuid":"<form uuid>","query":{"sort":[{"field":"record.createdAt","dir":"desc"}],"limit":5}},"recordScope":"allRecords"}'`
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        const request = buildPreviewRequest(data, args);
+        const result2 = await requireAuth(ctx).apiClient.previewDataReport(workspace, request);
+        outputSingle(result2, ctx);
+      }
+    }
+  ]
+};
+
 // src/domains/queries.ts
 var FIELD_COLUMNS2 = [
   { header: "PATH", getValue: (f) => f.path ?? "" },
@@ -11325,6 +11570,9 @@ var abilitiesDomain = {
           description: "Allow creation before required app connections are configured"
         }
       ],
+      examples: [
+        'yarn gr abilities enable --ability-type integration:data_reports --workflow-id 12 -w $UUID --data \'{"recordScope":"currentMember","reports":[{"name":"recent_entries","description":"The latest entries for this Member","dataTypeUuid":"<form uuid>","query":{"sort":[{"field":"record.createdAt","dir":"desc"}],"limit":5}}]}\'   # Form Reports: no app editor; try a report first with `yarn gr data-reports preview`'
+      ],
       handler: async ({ ctx, workspace, args, data }) => {
         const abilityType = args["ability-type"];
         if (typeof abilityType !== "string") throw new CLIError("--ability-type is required");
@@ -11850,7 +12098,8 @@ var NO_UUID_LOOKUP = /* @__PURE__ */ new Set([
   "import",
   "invoice",
   "workspace_config",
-  "data_record"
+  "data_record",
+  "recording"
 ]);
 var HYDRATORS = {
   workspace: async ({ client: client3 }, ref) => (await client3.getWorkspace(ref.uuid)).name,
@@ -12675,7 +12924,7 @@ var aiModelsDomain = {
     },
     {
       path: ["ai-models", "realtime"],
-      description: "List realtime/voice stacks (use as realtimeModelId). e.g. xai:realtime:voice-agent-2 = Grok Voice Think Fast 2",
+      description: "List realtime/voice stacks (use as realtimeModelId). e.g. xai:realtime:voice-agent-2 = Grok Voice Think Fast 2 (default); xai:realtime:voice-agent-3 = Grok Voice 3.0 (explicit opt-in)",
       requiresWorkspace: false,
       handler: async ({ ctx }) => {
         const result2 = await requireAuth(ctx).apiClient.getRealtimeModels();
@@ -14788,6 +15037,17 @@ var ORG_WEBHOOK_COLUMNS = [
     header: "WORKSPACES",
     getValue: (item) => item.limitedToWorkspaces ? item.workspaceUuids.join(",") : "all (organization-wide)",
     maxWidth: 80
+  },
+  {
+    // A workspace is covered when it carries ALL of these labels (in
+    // addition to the explicit WORKSPACES).
+    header: "LABELS",
+    getValue: (item) => (item.labelSelector ?? []).map((label) => label.slug).join("+"),
+    maxWidth: 60
+  },
+  {
+    header: "RECENT FAILURES",
+    getValue: (item) => (item.recentFailures ?? []).map((failure) => `${failure.failureClass} (${failure.count})`).join(", ")
   }
 ];
 function requireWebhookEndpointUuid(args) {
@@ -14822,9 +15082,298 @@ function webhookStatusCommand(action) {
     }
   };
 }
+var ORG_WORKSPACE_COLUMNS = [
+  { header: "UUID", getValue: (item) => item.uuid },
+  { header: "NAME", getValue: (item) => item.name, maxWidth: 40 },
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "STATUS", getValue: (item) => String(item.status) },
+  { header: "TIMEZONE", getValue: (item) => item.timezone ?? "-" },
+  { header: "CREATED", getValue: (item) => item.createdAt }
+];
+var orgWorkspaceCommands = [
+  {
+    path: ["org", "workspaces", "list"],
+    description: "List every workspace in an organization, newest page first (read-only). Prefer this over `gr workspaces list --org` for anything fleet-wide: that command reads an unpaginated endpoint and sees only the first page of workspaces. Use --all to fetch the complete list.",
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "page", description: "Page number (default: 1)" },
+      { name: "page-size", description: "Page size" },
+      { name: "all", description: "Fetch all pages", isFlag: true },
+      { name: "search", description: "Filter by name or slug (server-side)" }
+    ],
+    examples: [
+      "yarn gr org workspaces list --org $ORG_UUID --all",
+      "yarn gr org workspaces list --org $ORG_UUID --search gastro -o json"
+    ],
+    handler: async (hctx) => {
+      const orgRef = requireOrgRef(hctx.args);
+      const pag = parsePaginationArgs(hctx.args);
+      const search = typeof hctx.args.search === "string" ? hctx.args.search : void 0;
+      const client3 = requireAuth(hctx.ctx).apiClient;
+      if (pag.all) {
+        const allItems = await fetchAllPages(
+          ({ page, pageSize }) => client3.getOrganizationWorkspaces(orgRef, {
+            page,
+            pageSize,
+            ...search ? { search } : {}
+          })
+        );
+        outputData(allItems, hctx.ctx, ORG_WORKSPACE_COLUMNS);
+        return;
+      }
+      const options = {};
+      if (pag.page) options.page = pag.page;
+      if (pag.pageSize) options.pageSize = pag.pageSize;
+      if (search) options.search = search;
+      const result2 = await client3.getOrganizationWorkspaces(orgRef, options);
+      outputData(listResult(result2, true), hctx.ctx, ORG_WORKSPACE_COLUMNS);
+    }
+  }
+];
+function requireArg2(args, name) {
+  const value = args[name];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError(`Missing required argument: --${name}`);
+  }
+  return value.trim();
+}
+function optionalArg(args, name) {
+  const value = args[name];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError(`Invalid argument: --${name}`);
+  }
+  return value.trim();
+}
+var DELIVERY_LOG_COLUMNS = [
+  { header: "EVENT", getValue: (item) => item.eventType },
+  { header: "STATUS", getValue: (item) => item.status },
+  { header: "DEDUPE KEY", getValue: (item) => item.dedupeKey, maxWidth: 48 },
+  { header: "OCCURRED", getValue: (item) => item.occurredAt },
+  { header: "ATTEMPTS", getValue: (item) => String(item.attempts) },
+  { header: "LAST FAILURE", getValue: (item) => item.lastFailureClass || "\u2014" }
+];
 var webhookCommands = [
   webhookStatusCommand("pause"),
   webhookStatusCommand("resume"),
+  {
+    path: ["org", "webhooks", "create"],
+    description: "Create an organization webhook endpoint. The signing secret is printed once in this response and is not shown again. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "name", description: "Endpoint name", required: true },
+      { name: "url", description: "HTTPS endpoint URL", required: true },
+      {
+        name: "event-type",
+        description: "Subscribed event type (repeat for more than one)",
+        required: true,
+        repeatable: true
+      },
+      {
+        name: "workspace-uuid",
+        description: "Limit coverage to this workspace (repeatable). Omit to cover every workspace in the organization.",
+        repeatable: true
+      },
+      {
+        name: "signing-secret",
+        description: "Client-supplied signing secret. Omit to have one generated."
+      }
+    ],
+    examples: [
+      'yarn gr org webhooks create --org $ORG_UUID --name "Rysun" --url https://example.com/hook --event-type data_record.created --allow-write'
+    ],
+    handler: async (hctx) => {
+      const eventTypes = repeatedValues(hctx.args, "event-type");
+      if (eventTypes.length === 0) {
+        throw new CLIError("Missing required argument: --event-type");
+      }
+      const signingSecret = optionalArg(hctx.args, "signing-secret");
+      const created = await requireAuth(hctx.ctx).apiClient.createOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        {
+          name: requireArg2(hctx.args, "name"),
+          url: requireArg2(hctx.args, "url"),
+          eventTypes,
+          workspaceUuids: repeatedValues(hctx.args, "workspace-uuid"),
+          ...signingSecret ? { signingSecret } : {}
+        }
+      );
+      hint(hctx.ctx, ["Signing secret is in this response and is not shown again."]);
+      outputSingle(created, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "webhooks", "update"],
+    description: "Update an organization webhook endpoint. A rotated signing secret is not echoed. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "name", description: "New endpoint name" },
+      { name: "url", description: "New HTTPS endpoint URL" },
+      {
+        name: "event-type",
+        description: "Replace the subscription list (repeat for more than one)",
+        repeatable: true
+      },
+      {
+        name: "workspace-uuid",
+        description: "Replace workspace coverage with this workspace (repeatable)",
+        repeatable: true
+      },
+      {
+        name: "all-workspaces",
+        description: "Cover every workspace in the organization",
+        isFlag: true
+      },
+      { name: "status", description: "active or paused" },
+      {
+        name: "signing-secret",
+        description: "Rotate the signing secret. The new value is not printed."
+      }
+    ],
+    examples: [
+      "yarn gr org webhooks update --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --status paused --allow-write"
+    ],
+    handler: async (hctx) => {
+      const workspaceUuids = repeatedValues(hctx.args, "workspace-uuid");
+      const allWorkspaces = hctx.args["all-workspaces"] === true;
+      if (allWorkspaces && workspaceUuids.length > 0) {
+        throw new CLIError("Pass either --all-workspaces or --workspace-uuid, not both");
+      }
+      const eventTypes = repeatedValues(hctx.args, "event-type");
+      const status = optionalArg(hctx.args, "status");
+      if (status !== void 0 && status !== "active" && status !== "paused") {
+        throw new CLIError("--status must be active or paused");
+      }
+      const signingSecret = optionalArg(hctx.args, "signing-secret");
+      const data = {};
+      const name = optionalArg(hctx.args, "name");
+      const url = optionalArg(hctx.args, "url");
+      if (name) data.name = name;
+      if (url) data.url = url;
+      if (eventTypes.length > 0) data.eventTypes = eventTypes;
+      if (allWorkspaces) data.workspaceUuids = [];
+      else if (workspaceUuids.length > 0) data.workspaceUuids = workspaceUuids;
+      if (status) data.status = status;
+      if (signingSecret) data.signingSecret = signingSecret;
+      if (Object.keys(data).length === 0) {
+        throw new CLIError("Nothing to update");
+      }
+      const result2 = await requireAuth(hctx.ctx).apiClient.updateOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        data
+      );
+      const { signingSecret: _rotatedSecret, ...printable } = result2;
+      outputSingle(printable, hctx.ctx, ORG_WEBHOOK_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "webhooks", "test-send"],
+    description: "Send one test payload to an endpoint. Writes no delivery row. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "event-type", description: "Event type to send", required: true },
+      {
+        name: "payload",
+        description: "JSON object to send instead of the server sample"
+      }
+    ],
+    examples: [
+      "yarn gr org webhooks test-send --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --event-type data_record.created --allow-write"
+    ],
+    handler: async (hctx) => {
+      const rawPayload = optionalArg(hctx.args, "payload");
+      let payload;
+      if (rawPayload !== void 0) {
+        let parsed;
+        try {
+          parsed = JSON.parse(rawPayload);
+        } catch {
+          throw new CLIError("--payload must be a JSON object");
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          throw new CLIError("--payload must be a JSON object");
+        }
+        payload = parsed;
+      }
+      const result2 = await requireAuth(hctx.ctx).apiClient.testOrgWebhookEndpoint(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        {
+          eventType: requireArg2(hctx.args, "event-type"),
+          ...payload ? { payload } : {}
+        }
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
+  {
+    path: ["org", "webhooks", "deliveries"],
+    description: "Delivery log for one organization webhook endpoint. Event type, status, dedupe key, occurred-at, attempt count, and last failure class. The event envelope is not printed.",
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true },
+      { name: "limit", description: "Page size (default 50)" }
+    ],
+    examples: ["yarn gr org webhooks deliveries --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID"],
+    handler: async (hctx) => {
+      const limitRaw = optionalArg(hctx.args, "limit");
+      let limit = 50;
+      if (limitRaw !== void 0) {
+        limit = Number(limitRaw);
+        if (!Number.isInteger(limit) || limit < 1) {
+          throw new CLIError("--limit must be a positive integer");
+        }
+      }
+      const page = await requireAuth(hctx.ctx).apiClient.listOrgWebhookEndpointDeliveries(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args),
+        limit
+      );
+      const rows = page.items.map((item) => {
+        const latest = item.attempts.at(-1);
+        return {
+          eventType: item.eventType,
+          status: item.status,
+          dedupeKey: item.dedupeKey,
+          occurredAt: item.occurredAt,
+          attempts: item.attempts.length,
+          lastFailureClass: latest?.failureClass ?? latest?.errorType ?? ""
+        };
+      });
+      outputData(rows, hctx.ctx, DELIVERY_LOG_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "webhooks", "discard-pending"],
+    description: "Expire a paused or disabled endpoint's pending deliveries so a resume does not re-send a backlog the receiver keeps rejecting. Dead-lettered deliveries are untouched; expired ones stay replayable. Requires organization admin access.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      { name: "endpoint-uuid", aliases: ["id"], description: "Endpoint UUID", required: true }
+    ],
+    examples: [
+      "yarn gr org webhooks discard-pending --org $ORG_UUID --endpoint-uuid $ENDPOINT_UUID --allow-write"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.discardPendingOrgWebhookDeliveries(
+        requireOrgRef(hctx.args),
+        requireWebhookEndpointUuid(hctx.args)
+      );
+      outputSingle(result2, hctx.ctx);
+    }
+  },
   {
     path: ["org", "webhooks", "list"],
     description: "List an organization's webhook endpoints (read-only). Each row carries the destination host fingerprint and a masked signing secret, never the URL or a usable secret.",
@@ -14857,9 +15406,93 @@ var webhookCommands = [
     }
   }
 ];
+var WORKSPACE_LABEL_COLUMNS = [
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "NAME", getValue: (item) => item.name },
+  { header: "WORKSPACES", getValue: (item) => String(item.workspaceCount) },
+  { header: "WEBHOOK SELECTORS", getValue: (item) => String(item.webhookSelectorCount) },
+  { header: "UUID", getValue: (item) => item.uuid }
+];
+var LABEL_SUMMARY_COLUMNS = [
+  { header: "SLUG", getValue: (item) => item.slug },
+  { header: "NAME", getValue: (item) => item.name },
+  { header: "UUID", getValue: (item) => item.uuid }
+];
+function requireWorkspaceUuidArg(args) {
+  const value = args["workspace-uuid"] ?? args.workspace;
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CLIError("Missing required argument: --workspace-uuid");
+  }
+  return value.trim();
+}
+var WORKSPACE_UUID_ARG = {
+  name: "workspace-uuid",
+  aliases: ["workspace"],
+  description: "Workspace UUID (a workspace of this organization)",
+  required: true
+};
+var workspaceLabelCommands = [
+  {
+    path: ["org", "labels", "list"],
+    description: "List the organization's workspace labels, with how many workspaces carry each and how many webhook label selectors require it",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG2],
+    examples: ["yarn gr org labels list --org $ORG_UUID -o json"],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.listWorkspaceLabels(
+        requireOrgRef(hctx.args)
+      );
+      outputData(result2, hctx.ctx, WORKSPACE_LABEL_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "workspaces", "labels", "get"],
+    description: "Show the labels one workspace of the organization carries",
+    requiresWorkspace: false,
+    args: [ORG_UUID_ARG2, WORKSPACE_UUID_ARG],
+    examples: [
+      "yarn gr org workspaces labels get --org $ORG_UUID --workspace-uuid $WORKSPACE_UUID -o json"
+    ],
+    handler: async (hctx) => {
+      const result2 = await requireAuth(hctx.ctx).apiClient.getWorkspaceLabels(
+        requireOrgRef(hctx.args),
+        requireWorkspaceUuidArg(hctx.args)
+      );
+      outputData(result2.labels, hctx.ctx, LABEL_SUMMARY_COLUMNS);
+    }
+  },
+  {
+    path: ["org", "workspaces", "labels", "set"],
+    description: "Replace a workspace's labels with exactly the given set. Requires organization admin access. Labels the organization has not used before are created. Webhook endpoints selecting on these labels start or stop covering the workspace immediately.",
+    mutates: true,
+    requiresWorkspace: false,
+    args: [
+      ORG_UUID_ARG2,
+      WORKSPACE_UUID_ARG,
+      {
+        name: "labels",
+        description: "Comma-separated label slugs; pass an empty string to remove all labels",
+        required: true
+      }
+    ],
+    examples: [
+      "yarn gr org workspaces labels set --org $ORG_UUID --workspace-uuid $WORKSPACE_UUID --labels production,sponsor-acme --allow-write"
+    ],
+    handler: async (hctx) => {
+      const raw = hctx.args.labels;
+      if (raw === void 0) throw new CLIError("Missing required argument: --labels");
+      const result2 = await requireAuth(hctx.ctx).apiClient.setWorkspaceLabels(
+        requireOrgRef(hctx.args),
+        requireWorkspaceUuidArg(hctx.args),
+        { labels: raw === "" ? [] : parseLabelList(raw) }
+      );
+      outputData(result2.labels, hctx.ctx, LABEL_SUMMARY_COLUMNS);
+    }
+  }
+];
 var orgDomain = {
   name: "org",
-  description: "Organization membership, domains, and webhook endpoints",
+  description: "Organization membership, domains, webhook endpoints, and workspace labels",
   commands: [
     {
       path: ["org", "list"],
@@ -14884,7 +15517,9 @@ var orgDomain = {
       }
     },
     ...domainCommands,
+    ...orgWorkspaceCommands,
     ...webhookCommands,
+    ...workspaceLabelCommands,
     orgMemberUpdateCommand()
   ]
 };
@@ -20528,6 +21163,71 @@ var ENCOUNTER_RUN_COLUMNS = [
     getValue: (item) => summarizeReasons(item.attribution?.collections, "errorReasonCounts")
   }
 ];
+var ONBOARDING_START_COLUMNS = [
+  { header: "MODE", getValue: (item) => item.mode ?? "" },
+  { header: "WORKFLOW ID", getValue: (item) => item.workflowId ?? "" },
+  { header: "RUN ID", getValue: (item) => item.runId ?? "" }
+];
+var ONBOARDING_PAIR_COLUMNS = [
+  { header: "DEPARTMENT", getValue: (item) => String(item.departmentId ?? "") },
+  { header: "PATIENT STATUS", getValue: (item) => item.patientStatus ?? "" },
+  { header: "STATUS", getValue: (item) => item.status ?? "" },
+  { header: "STOP REASON", getValue: (item) => item.stopReason ?? "" },
+  { header: "GEN", getValue: (item) => String(item.generation ?? "") },
+  { header: "NEXT OFFSET", getValue: (item) => String(item.nextOffset ?? "") },
+  { header: "PAGES (RUN)", getValue: (item) => String(item.pagesDone ?? 0) },
+  { header: "~FETCHED", getValue: (item) => String(item.totals?.fetched ?? 0) },
+  { header: "~APPLIED", getValue: (item) => String(item.totals?.applied ?? 0) },
+  { header: "~SKIPPED", getValue: (item) => String(item.totals?.skipped ?? 0) },
+  { header: "~FAILED", getValue: (item) => String(item.totals?.failed ?? 0) },
+  { header: "RUN ID", getValue: (item) => item.runId ?? "" }
+];
+var RESUMABLE_PAIR_STATUSES = /* @__PURE__ */ new Set([
+  "failed",
+  "aborted",
+  "truncated",
+  "pending",
+  "running",
+  "waiting"
+]);
+function onboardingStatusLines(status, connectionId) {
+  const lines = [];
+  const execution = status.execution;
+  if (execution) {
+    const failure = execution.failureCode ? ` (failure: ${execution.failureCode})` : "";
+    lines.push(
+      `Temporal execution: ${execution.workflowId} run ${execution.runId ?? "-"} \u2014 ${execution.status}${failure}`
+    );
+  } else {
+    lines.push("Temporal execution: none recorded");
+  }
+  if (status.waitingUntil) {
+    lines.push(
+      `Waiting for the operator window (21:00\u201308:00 America/New_York) until ${status.waitingUntil}`
+    );
+  }
+  if (status.preview) {
+    const previewPairs = status.preview.pairs ?? [];
+    const admitted = previewPairs.reduce((n, p) => n + (p.totals?.admitted ?? 0), 0);
+    const notAdmitted = previewPairs.reduce(
+      (n, p) => n + (p.totals?.notAdmitted ?? 0),
+      0
+    );
+    lines.push(
+      `Latest preview: ${previewPairs.length} pair(s), ~${admitted} admission-eligible (incl. already-linked), ~${notAdmitted} not admitted (read-only)`
+    );
+  }
+  lines.push("Counts are approximate.");
+  const unfinished = (status.pairs ?? []).some(
+    (p) => p.inCurrentCohort && RESUMABLE_PAIR_STATUSES.has(p.status) && p.runId
+  );
+  if (unfinished && execution?.status !== "running") {
+    lines.push(
+      `Unfinished pairs continue only on an explicit resume: gr fhir-connections onboarding-import start --id ${connectionId} --resume --allow-write`
+    );
+  }
+  return lines;
+}
 var fhirConnectionsDomain = {
   name: "fhir-connections",
   description: "Manage FHIR connections",
@@ -20573,8 +21273,8 @@ var fhirConnectionsDomain = {
       ],
       examples: [
         "fhir-connections encounter-sync runs --id 12",
-        "fhir-connections encounter-sync runs --id 12 --output json",
-        "fhir-connections encounter-sync runs --id 12 --limit 5 --output json"
+        "fhir-connections encounter-sync runs --id 12 --output-format json",
+        "fhir-connections encounter-sync runs --id 12 --limit 5 --output-format json"
       ],
       handler: async ({ ctx, workspace, args }) => {
         const limit = args["limit"] ? Number(args["limit"]) : 20;
@@ -20585,6 +21285,77 @@ var fhirConnectionsDomain = {
         );
         outputData(runs, ctx, ENCOUNTER_RUN_COLUMNS);
       }
+    },
+    {
+      // athenahealth onboarding import (PR-C): one explicit, audited
+      // operator execution per connection, at most 50 pages per pair per
+      // run. Thin over the SDK; the server decides everything.
+      path: ["fhir-connections", "onboarding-import", "start"],
+      description: "Start an athenahealth onboarding import (or --resume / --override / --dry-run preview)",
+      requiresWorkspace: true,
+      mutates: true,
+      args: [
+        { name: "id", description: "FHIR connection ID", required: true },
+        {
+          name: "dry-run",
+          description: "Preview: read and classify admission only, write no Members",
+          isFlag: true
+        },
+        {
+          name: "resume",
+          description: "Continue unfinished (failed, truncated, aborted) pairs at their stored frontier",
+          isFlag: true
+        },
+        {
+          name: "override",
+          description: "Rescan completed pairs from offset 0 under a new generation",
+          isFlag: true
+        }
+      ],
+      examples: [
+        "fhir-connections onboarding-import start --id 12 --dry-run --allow-write",
+        "fhir-connections onboarding-import start --id 12 --allow-write",
+        "fhir-connections onboarding-import start --id 12 --resume --allow-write"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const connectionId = requireNumber(args, "id");
+        const started = await requireAuth(ctx).apiClient.fhirStartOnboardingImport(
+          workspace,
+          connectionId,
+          {
+            dryRun: args["dry-run"] === true,
+            resume: args["resume"] === true,
+            override: args["override"] === true
+          }
+        );
+        outputSingle(started, ctx, ONBOARDING_START_COLUMNS);
+        hint(ctx, [
+          `Started. Follow progress with: gr fhir-connections onboarding-import status --id ${connectionId}`
+        ]);
+      }
+    },
+    {
+      path: ["fhir-connections", "onboarding-import", "status"],
+      description: "Show athenahealth onboarding-import progress and its Temporal execution (read-only)",
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "FHIR connection ID", required: true }],
+      examples: [
+        "fhir-connections onboarding-import status --id 12",
+        "fhir-connections onboarding-import status --id 12 --output-format json"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const connectionId = requireNumber(args, "id");
+        const status = await requireAuth(ctx).apiClient.fhirGetOnboardingImportStatus(
+          workspace,
+          connectionId
+        );
+        if (ctx.jq || (ctx.outputFormat ?? "table") !== "table") {
+          outputSingle(status, ctx);
+          return;
+        }
+        outputData(status.pairs, ctx, ONBOARDING_PAIR_COLUMNS);
+        hint(ctx, onboardingStatusLines(status, connectionId));
+      }
     }
   ]
 };
@@ -20920,15 +21691,18 @@ var hubspotDomain = {
       mutates: true,
       requiresWorkspace: true,
       examples: [
-        "# HubSpot setup is a 4-step flow \u2014 this command is step 1:",
+        "# When the response shows platformAppAvailable=true, the workspace connects through",
+        "# the shared Gravity Rail HubSpot app: install, then authorize. That's all.",
+        "gr hubspot install -w <ws> --allow-write",
+        "gr hubspot authorize -w <ws> --allow-write   # then open the returned authorizeUrl",
+        "",
+        "# To use your own HubSpot app instead (a Projects-platform app; HubSpot no longer",
+        "# allows new private or developer apps):",
         '#   1. install    -> creates the connection; the response includes the OAuth "callbackUrl"',
-        "#   2. in HubSpot: create a private/developer app whose Redirect URL is that callbackUrl,",
-        "#      with CRM scopes (contacts/companies/deals read+write). Copy the Client ID + Secret.",
+        "#   2. in HubSpot: give your app that callbackUrl as a Redirect URL, with CRM scopes",
+        "#      (contacts/companies/deals read+write). Copy the Client ID + Secret.",
         "#   3. configure  -> save that Client ID / Secret",
-        '#   4. authorize  -> returns an "authorizeUrl"; open it to grant access. status then',
-        "#      reports configured=true and connected=true.",
-        "",
-        "gr hubspot install -w <ws> --allow-write",
+        '#   4. authorize  -> returns an "authorizeUrl"; open it to grant access.',
         "gr hubspot status -w <ws>            # read back callbackUrl + configured/connected",
         `gr hubspot configure -w <ws> --allow-write -d '{"clientId":"...","clientSecret":"..."}'`,
         "gr hubspot authorize -w <ws> --allow-write   # then open the returned authorizeUrl"
@@ -21939,6 +22713,7 @@ function registerPublicDomains(registry) {
   registry.register(calendarsDomain);
   registry.register(qualificationsDomain);
   registry.register(queriesDomain);
+  registry.register(dataReportsDomain);
   registry.register(personasDomain);
   registry.register(metricsDomain);
   registry.register(journeysDomain);
@@ -26429,7 +27204,7 @@ var topLevelCommands = [
     mutates: true,
     args: [{ name: "phone", description: "E.164 phone number (optional; prompts if omitted)" }],
     handler: async (hctx) => {
-      const { accountVerifyPhoneCommand } = await import("./account-verify-phone-ABHHHGCC.js");
+      const { accountVerifyPhoneCommand } = await import("./account-verify-phone-4ZN7NJGW.js");
       await accountVerifyPhoneCommand(hctx);
     }
   },