@gravity-rail/cli 0.8.0 → 0.11.0

package/README.md

@@ -26,7 +26,58 @@ gr whoami                   # verify your identity
 gr logout                   # clear cached credentials
 ```
 
-Credentials are cached locally per environment.
+### Multi-account profiles
+
+Like `aws --profile` / `gh auth switch`, the public CLI supports multiple named accounts:
+
+```sh
+gr auth login --name work       # OAuth into a named profile (also sets it current)
+gr auth login --name personal
+gr auth list                    # list profiles for the current --env
+gr auth switch --name personal  # change the default profile
+gr auth logout --name work      # clear one profile
+
+# Per-invocation selection (does not change the stored default)
+gr whoami --profile work
+gr tasks list -w $WORKSPACE --profile personal
+export GRAVITY_RAIL_PROFILE=work
+```
+
+`gr login` / `gr logout` remain as shortcuts for the active profile (or `--name`).
+
+**Local monorepo / QA (Gravity Rail developers):** after provisioning, import
+dev tokens into the same profile store (this replaces the old `--realm` flag):
+
+```sh
+yarn gr auth import-dev                 # or: python scripts/sync_gr_cli_profiles.py
+yarn gr whoami --profile superadmin
+yarn gr tasks list --profile acme-demo/acme-admin   # auto-sets -w
+```
+
+Workspace/member names use one slash (`workspace/member`). Provisioning auto-syncs
+profiles; re-run import after re-seed. Worktree API ports get isolated credential files.
+
+### Credential store (security)
+
+| Item            | Detail                                                                       |
+| --------------- | ---------------------------------------------------------------------------- |
+| Location        | `~/.gr-cli/credentials-<env>.json` (e.g. `credentials-prod.json`)            |
+| Directory mode  | `0700` on `~/.gr-cli`                                                        |
+| File mode       | `0600` on credential files                                                   |
+| Contents        | OAuth client id/secret + tokens, and/or token-only dev profiles (+ optional workspace UUID) |
+| Not stored      | `GRAVITY_RAIL_API_KEY` (process environment only; always overrides profiles) |
+| Name validation | Profiles allow `name` or `workspace/member`; env names are allowlisted       |
+| Logging         | CLI code never writes token or secret values to stdout/stderr                |
+
+**Security review notes:** tokens never leave the local filesystem except on HTTPS calls to the Gravity Rail API. There is no cloud sync of CLI credentials. Rotate by `gr auth logout --name <profile>` (or deleting the store file) and logging in again. Multi-user machines should rely on OS home-directory isolation plus the `0600`/`0700` modes. Do not commit `~/.gr-cli` into repositories or bake it into container images.
+
+Profile resolution order for a command:
+
+1. `GRAVITY_RAIL_API_KEY` (if set — skips the store entirely)
+2. `--profile <name>` (or `--account`)
+3. `GRAVITY_RAIL_PROFILE`
+4. `currentProfile` in the credential store (from `gr auth switch` / last login)
+5. Profile name `default`
 
 ### API Key (non-interactive)
 
@@ -35,7 +86,7 @@ export GRAVITY_RAIL_API_KEY=your-api-key
 gr tasks list -w $WORKSPACE
 ```
 
-Useful for scripts, CI/CD, and automation. Create scoped keys from workspace settings or via [`@gravity-rail/sdk`](https://www.npmjs.com/package/@gravity-rail/sdk).
+Useful for scripts, CI/CD, and automation. Create scoped keys from workspace settings or via [`@gravity-rail/sdk`](https://www.npmjs.com/package/@gravity-rail/sdk). API keys are **not** written into the profile store.
 
 ## Command Pattern
 
@@ -114,35 +165,37 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 
 ## Global Options
 
-| Flag | Description |
-|---|---|
-| `--api-url <url>` | Override API base URL |
-| `-w, --workspace <uuid>` | Workspace UUID (required for most commands) |
-| `-o, --output-format <fmt>` | Output format: `json`, `jsonl`, `table` |
-| `-v, --verbose` | Verbose output to stderr |
-| `--allow-write` | Required for create/update/delete operations |
-| `--id <id>` | Entity ID (for get/update/delete) |
-| `-d, --data <json>` | Inline JSON payload |
-| `-f, --file <path>` | Read JSON payload from file |
-| `--help` | Show help |
-| `--version` | Show version |
+| Flag                        | Description                                  |
+| --------------------------- | -------------------------------------------- |
+| `--api-url <url>`           | Override API base URL                        |
+| `--profile <name>`          | Named account profile (alias: `--account`)   |
+| `-w, --workspace <uuid>`    | Workspace UUID (required for most commands)  |
+| `-o, --output-format <fmt>` | Output format: `json`, `jsonl`, `table`      |
+| `-v, --verbose`             | Verbose output to stderr                     |
+| `--allow-write`             | Required for create/update/delete operations |
+| `--id <id>`                 | Entity ID (for get/update/delete)            |
+| `-d, --data <json>`         | Inline JSON payload                          |
+| `-f, --file <path>`         | Read JSON payload from file                  |
+| `--help`                    | Show help                                    |
+| `--version`                 | Show version                                 |
 
 ## Environment Variables
 
-| Variable | Description |
-|---|---|
-| `GRAVITY_RAIL_API_KEY` | API key for non-interactive authentication |
-| `GRAVITY_RAIL_API_URL` | Override API base URL (default: `https://api.gravityrail.com`) |
+| Variable                    | Description                                                    |
+| --------------------------- | -------------------------------------------------------------- |
+| `GRAVITY_RAIL_API_KEY`      | API key for non-interactive authentication                     |
+| `GRAVITY_RAIL_PROFILE`      | Default named credential profile                               |
+| `GRAVITY_RAIL_API_URL`      | Override API base URL (default: `https://api.gravityrail.com`) |
 | `GRAVITY_RAIL_FRONTEND_URL` | Override frontend URL (default: `https://app.gravityrail.com`) |
 
 ## Exit Codes
 
-| Code | Meaning |
-|---|---|
-| `0` | Success |
-| `1` | General error |
-| `2` | Authentication required (run `gr login` or set `GRAVITY_RAIL_API_KEY`) |
-| `3` | A human-in-the-loop (HITL) interrupt requires out-of-band action before the operation can continue |
+| Code | Meaning                                                                                            |
+| ---- | -------------------------------------------------------------------------------------------------- |
+| `0`  | Success                                                                                            |
+| `1`  | General error                                                                                      |
+| `2`  | Authentication required (run `gr login` or set `GRAVITY_RAIL_API_KEY`)                             |
+| `3`  | A human-in-the-loop (HITL) interrupt requires out-of-band action before the operation can continue |
 
 When a concierge command run with `--message` (non-interactive mode) hits a HITL
 interrupt the CLI cannot resolve on its own, it exits `3` and writes a single
@@ -150,10 +203,10 @@ machine-readable JSON object to **stdout**:
 
 ```json
 {
-  "error": "hitl_interrupt",
-  "message": "A human-in-the-loop interrupt requires out-of-band action before the operation can continue.",
-  "resume": { "chatId": 42, "chatUuid": "…", "interruptId": "int-abc" },
-  "interrupt": { "type": "stripe_checkout", "interrupt_id": "int-abc", "url": "…" }
+   "error": "hitl_interrupt",
+   "message": "A human-in-the-loop interrupt requires out-of-band action before the operation can continue.",
+   "resume": { "chatId": 42, "chatUuid": "…", "interruptId": "int-abc" },
+   "interrupt": { "type": "stripe_checkout", "interrupt_id": "int-abc", "url": "…" }
 }
 ```
 
@@ -166,73 +219,76 @@ not forwarded, as it may contain sensitive data. Use `resume.chatUuid` /
 
 ### Core
 
-| Domain | Description |
-|---|---|
-| `tasks` | Workflow tasks — CRUD, archive, clone |
-| `chats` | Conversations — CRUD, labels, filters, messages, export, summaries |
-| `members` | Contacts and team — CRUD, labels, filters, roles, fields, import/export |
-| `workspaces` | Workspace management — CRUD, features, themes, invitations, export/import |
-| `workflows` | Conversational workflows — CRUD, notes, contributors, templates, analytics |
-| `agents` | Autonomous AI members — CRUD, archive |
-| `assistants` | AI personas — CRUD with model and voice configuration |
-| `assignments` | Task-based conversations — CRUD, messages, tools |
+| Domain        | Description                                                                |
+| ------------- | -------------------------------------------------------------------------- |
+| `tasks`       | Workflow tasks — CRUD, archive, clone                                      |
+| `chats`       | Conversations — CRUD, labels, filters, messages, export, summaries         |
+| `members`     | Contacts and team — CRUD, labels, filters, roles, fields, import/export    |
+| `workspaces`  | Workspace management — CRUD, features, themes, invitations, export/import  |
+| `workflows`   | Conversational workflows — CRUD, notes, contributors, templates, analytics |
+| `agents`      | Autonomous AI members — CRUD, archive                                      |
+| `assistants`  | AI personas — CRUD with model and voice configuration                      |
+| `assignments` | Task-based conversations — CRUD, messages, tools                           |
 
 ### Data & Content
 
-| Domain | Description |
-|---|---|
-| `data-types` | Schema-driven forms and records — CRUD, field indexing, computed fields |
-| `files` | Documents and folders — CRUD, sharing, semantic search, labels |
-| `sites` | Customer portals — CRUD, pages, menus, web crawling |
-| `events` | Automation rules — triggers, CEL conditions, delayed actions, webhooks |
-| `calendars` | Scheduling — calendars, events, event types, availability, Google sync |
-| `qualifications` | Skills evaluation — requirements, submissions, scoring |
+| Domain           | Description                                                             |
+| ---------------- | ----------------------------------------------------------------------- |
+| `data-types`     | Schema-driven forms and records — CRUD, field indexing, computed fields |
+| `files`          | Documents and folders — CRUD, sharing, semantic search, labels          |
+| `sites`          | Customer portals — CRUD, pages, menus, web crawling                     |
+| `events`         | Automation rules — triggers, CEL conditions, delayed actions, webhooks  |
+| `calendars`      | Scheduling — calendars, events, event types, availability, Google sync  |
+| `qualifications` | Skills evaluation — requirements, submissions, scoring                  |
+| `queries`        | Unified Query Engine — fields, validate, preview, run, syntax reference |
 
 ### Global (no workspace)
 
-| Domain | Description |
-|---|---|
-| `concierge` | Global Concierge — interactive chat, PSTN `--call`, SMS `--sms` |
-| `account verify-phone` | Verify your account phone (required before concierge outbound) |
+| Domain                 | Description                                                     |
+| ---------------------- | --------------------------------------------------------------- |
+| `concierge`            | Global Concierge — interactive chat, PSTN `--call`, SMS `--sms` |
+| `account verify-phone` | Verify your account phone (required before concierge outbound)  |
 
 ### Communication
 
-| Domain | Description |
-|---|---|
-| `phone-numbers` | Voice and SMS phone numbers — provisioning, calls, messages |
-| `inboxes` | Email inboxes — threads, attachments, routing |
-| `operator-groups` | Live operator routing — groups, presence, strategies |
-| `notification-rules` | Alert configuration — event-based notifications |
+| Domain               | Description                                                               |
+| -------------------- | ------------------------------------------------------------------------- |
+| `phone-numbers`      | Voice and SMS phone numbers — provisioning, calls, messages               |
+| `recordings`         | Call recordings — list chunks, get a presigned download URL, save the WAV |
+| `inboxes`            | Email inboxes — threads, attachments, routing                             |
+| `operator-groups`    | Live operator routing — groups, presence, strategies                      |
+| `notification-rules` | Alert configuration — event-based notifications                           |
 
 ### Integrations
 
-| Domain | Description |
-|---|---|
-| `discord-bots` | Discord bot management — slash commands, threads, account linking |
-| `slack-apps` | Slack app management — installations, threads, accounts |
-| `fhir-connections` | FHIR healthcare connections — patients, practitioners, encounters |
-| `app-connections` | Platform app integrations |
-| `monday` | Monday.com — boards, columns, webhooks |
+| Domain             | Description                                                                                        |
+| ------------------ | -------------------------------------------------------------------------------------------------- |
+| `discord-bots`     | Discord bot management — slash commands, threads, account linking                                  |
+| `slack-apps`       | Slack app management — installations, threads, accounts                                            |
+| `fhir-connections` | FHIR healthcare connections — patients, practitioners, encounters                                  |
+| `patientsync`      | PatientSync PSTN-transfer connection — `configure` / `status` / `delete` (singleton per workspace) |
+| `app-connections`  | Platform app integrations                                                                          |
+| `monday`           | Monday.com — boards, columns, webhooks                                                             |
 
 ### Platform
 
-| Domain | Description |
-|---|---|
-| `api-keys` | API key management — workspace and global scopes |
-| `subscriptions` | Subscription management |
-| `reports` | Usage reports — AI tokens, voice minutes, SMS, storage |
-| `ai-models` | Available AI models (no workspace required) |
-| `features` | Feature registry (no workspace required) |
-| `custom-toolkits` | Custom tool definitions |
-| `mcp-servers` | MCP server connections |
-| `milestones` | Goal tracking |
-| `supervisors` | AI supervisor management |
-| `access-grants` | Temporary access delegation |
-| `pronunciations` | Voice pronunciation overrides |
-| `apps` | OAuth app management |
-| `oauth` | OAuth provider connections |
-| `auth` | Two-factor authentication, credentials, and password management |
-| `org` | Organization membership, invitations, and org domains |
+| Domain            | Description                                                     |
+| ----------------- | --------------------------------------------------------------- |
+| `api-keys`        | API key management — workspace and global scopes                |
+| `subscriptions`   | Subscription management                                         |
+| `reports`         | Usage reports — AI tokens, voice minutes, SMS, storage          |
+| `ai-models`       | Available AI models (no workspace required)                     |
+| `features`        | Feature registry (no workspace required)                        |
+| `custom-toolkits` | Custom tool definitions                                         |
+| `mcp-servers`     | MCP server connections                                          |
+| `milestones`      | Goal tracking                                                   |
+| `supervisors`     | AI supervisor management                                        |
+| `access-grants`   | Temporary access delegation                                     |
+| `pronunciations`  | Voice pronunciation overrides                                   |
+| `apps`            | OAuth app management                                            |
+| `oauth`           | OAuth provider connections                                      |
+| `auth`            | Two-factor authentication, credentials, and password management |
+| `org`             | Organization membership, invitations, and org domains           |
 
 ## Recipes
 
@@ -277,6 +333,16 @@ gr pronunciations list -w $WORKSPACE
 gr pronunciations create -w $WORKSPACE --term "GravityRail" --respelling "GRA-vit-ee rail" --allow-write
 ```
 
+### Download a call recording
+
+```sh
+# Get a single short-lived presigned URL for the whole call (assembled once, cached).
+gr recordings download-url -w $WORKSPACE --chat-id 42
+
+# Or download the assembled WAV straight to a file.
+gr recordings download -w $WORKSPACE --chat-id 42 -o call.wav
+```
+
 ### Register and verify an org domain
 
 ```sh

package/dist/{account-verify-phone-TC73QIIE.js → account-verify-phone-7YQXKU3X.js}

@@ -2,9 +2,9 @@ import {
   confirmAccountPhoneVerify,
   requireAuth,
   startAccountPhoneVerify
-} from "./chunk-L5YCPUAM.js";
-import "./chunk-H62EC2CF.js";
-import "./chunk-7VZ4JLAJ.js";
+} from "./chunk-GRLUFHMI.js";
+import "./chunk-SIV2WU2I.js";
+import "./chunk-WZVMWN3S.js";
 
 // src/commands/account-verify-phone.ts
 import * as readline from "readline/promises";
@@ -38,4 +38,4 @@ async function promptLine(question) {
 export {
   accountVerifyPhoneCommand
 };
-//# sourceMappingURL=account-verify-phone-TC73QIIE.js.map
+//# sourceMappingURL=account-verify-phone-7YQXKU3X.js.map

package/dist/{chunk-L5YCPUAM.js → chunk-GRLUFHMI.js}

@@ -3,11 +3,11 @@ import {
   getEnvironmentConfig,
   printTable,
   refreshAccessToken
-} from "./chunk-H62EC2CF.js";
+} from "./chunk-SIV2WU2I.js";
 import {
   AuthRequiredError,
   CLIError
-} from "./chunk-7VZ4JLAJ.js";
+} from "./chunk-WZVMWN3S.js";
 
 // src/lib/pagination.ts
 function isListResult(data) {
@@ -208,11 +208,11 @@ var COL = {
   status: () => ({ header: "STATUS", getValue: (item) => item.status ?? "" }),
   created: () => ({
     header: "CREATED",
-    getValue: (item) => item.created_at ?? ""
+    getValue: (item) => item.createdAt ?? ""
   }),
   updated: () => ({
     header: "UPDATED",
-    getValue: (item) => item.updated_at ?? ""
+    getValue: (item) => item.updatedAt ?? ""
   }),
   description: () => ({
     header: "DESCRIPTION",
@@ -231,108 +231,21 @@ function stderr(msg) {
 import { GravityRailClient } from "@gravity-rail/sdk";
 import { homedir } from "os";
 
-// src/lib/realm.ts
-import { execSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-function findDevRealmsFile() {
-  let dir = process.cwd();
-  while (dir !== dirname(dir)) {
-    const candidate = join(dir, "dev-realms.json");
-    if (existsSync(candidate)) return candidate;
-    dir = dirname(dir);
-  }
-  throw new Error("Cannot find dev-realms.json in any parent directory");
-}
-var DEV_CLOUD_CACHE_DIR = ".dev-cloud";
-var CACHE_MAX_AGE_MS = 60 * 60 * 1e3;
-function findRepoRoot() {
-  let dir = process.cwd();
-  while (dir !== dirname(dir)) {
-    if (existsSync(join(dir, ".git"))) {
-      return dir;
-    }
-    dir = dirname(dir);
-  }
-  return void 0;
-}
-function getDevCloudCacheDir(namespace) {
-  const repoRoot = findRepoRoot();
-  const base = repoRoot ?? process.cwd();
-  return join(base, DEV_CLOUD_CACHE_DIR, namespace);
-}
-function fetchDevCloudRealms(namespace) {
-  const k8sNamespace = `dev-cloud-${namespace}`;
-  const cmd = `kubectl exec -n ${k8sNamespace} deploy/env -c devbox -- cat /workspace/dev-realms.json`;
-  try {
-    return execSync(cmd, { encoding: "utf-8", timeout: 3e4 });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Failed to fetch dev-realms.json from dev-cloud pod "${namespace}": ${message}`
-    );
-  }
-}
-function loadDevCloudRealmFile(namespace) {
-  const cacheDir = getDevCloudCacheDir(namespace);
-  const cachePath = join(cacheDir, "dev-realms.json");
-  if (existsSync(cachePath)) {
-    const stat = statSync(cachePath);
-    const age = Date.now() - stat.mtimeMs;
-    if (age < CACHE_MAX_AGE_MS) {
-      return cachePath;
-    }
-  }
-  const content = fetchDevCloudRealms(namespace);
-  mkdirSync(cacheDir, { recursive: true });
-  writeFileSync(cachePath, content, "utf-8");
-  return cachePath;
-}
-function loadRealmCredentials(realm, devRealmsPath) {
-  const filePath = devRealmsPath ?? findDevRealmsFile();
-  let data;
-  try {
-    data = JSON.parse(readFileSync(filePath, "utf-8"));
-  } catch {
-    throw new Error(`Cannot read dev-realms.json at ${filePath}`);
-  }
-  const parts = realm.split("/");
-  if (parts.length === 1) {
-    const accounts = data._accounts;
-    const account = accounts?.[parts[0]];
-    if (!account?.token) {
-      throw new Error(`Realm account "${parts[0]}" not found in dev-realms.json`);
-    }
-    return { token: account.token };
-  } else {
-    const [wsName, memberName] = parts;
-    const ws = data[wsName];
-    if (!ws) {
-      throw new Error(`Realm workspace "${wsName}" not found in dev-realms.json`);
-    }
-    const member = ws.members?.[memberName];
-    if (!member?.token) {
-      throw new Error(`Realm member "${memberName}" not found in workspace "${wsName}"`);
-    }
-    return { token: member.token, workspaceUuid: ws.workspaceUuid };
-  }
-}
-
 // src/lib/org-auth.ts
 import { execFile } from "child_process";
 var ORG_AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
-function extractOrgTokenFromSetCookies(setCookieValues, preferredCookieName) {
+function extractOrgSessionFromSetCookies(setCookieValues, preferredCookieName) {
   let fallback;
   for (const value of setCookieValues) {
     const nameValue = value.split(";")[0]?.trim() ?? "";
     const eqIdx = nameValue.indexOf("=");
     if (eqIdx === -1) continue;
     const name = nameValue.slice(0, eqIdx).trim();
-    const tokenValue = nameValue.slice(eqIdx + 1).trim() || void 0;
-    if (!tokenValue) continue;
-    if (name === preferredCookieName) return tokenValue;
+    const credentialValue = nameValue.slice(eqIdx + 1).trim() || void 0;
+    if (!credentialValue) continue;
+    if (name === preferredCookieName) return credentialValue;
     if (!fallback && (name.startsWith("orgToken") || name.startsWith("orgSession"))) {
-      fallback = tokenValue;
+      fallback = credentialValue;
     }
   }
   return fallback;
@@ -357,11 +270,11 @@ async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
   if (setCookies.length === 0) {
     throw new Error("Org join succeeded but no Set-Cookie header returned");
   }
-  const orgToken = extractOrgTokenFromSetCookies(setCookies, orgAuthInfo.cookieName);
-  if (!orgToken) {
-    throw new Error("Org join succeeded but org token cookie not found in Set-Cookie");
+  const orgSession = extractOrgSessionFromSetCookies(setCookies, orgAuthInfo.cookieName);
+  if (!orgSession) {
+    throw new Error("Org join succeeded but org session cookie not found in Set-Cookie");
   }
-  return orgToken;
+  return orgSession;
 }
 function isAllowedAuthUrl(url, apiUrl) {
   try {
@@ -399,9 +312,9 @@ function openBrowser(url) {
 function registerOrgAuthHandler(apiClient, apiUrl, accessToken) {
   apiClient.setOrgAuthHandler(async (orgAuthInfo) => {
     try {
-      const orgToken = await tryDirectJoin(apiUrl, accessToken, orgAuthInfo);
-      if (orgToken !== null) {
-        apiClient.setOrgToken(orgToken, orgAuthInfo.orgUuid);
+      const orgSession = await tryDirectJoin(apiUrl, accessToken, orgAuthInfo);
+      if (orgSession !== null) {
+        apiClient.setOrgSession(orgSession, orgAuthInfo.orgUuid);
         return;
       }
     } catch (err) {
@@ -420,7 +333,7 @@ This workspace requires organization SSO authentication.`);
 `);
     stderr(`If the browser does not open, visit the URL above manually.`);
     stderr(
-      `After signing in, re-run the command \u2014 the CLI cannot receive the SSO token directly.`
+      `After signing in, re-run the command \u2014 the CLI cannot receive the SSO session directly.`
     );
     openBrowser(orgAuthInfo.authUrl);
     await new Promise((_, reject) => {
@@ -517,55 +430,65 @@ async function tryTokenRefresh(ctx, creds) {
     ctx.envConfig,
     creds,
     ctx.credentialsManager,
-    ctx.env
+    ctx.env,
+    ctx.profile
   );
   if (!refreshed?.accessToken) return null;
   const apiClient = makeApiClient(refreshed.accessToken, ctx.envConfig.apiUrl);
-  return { ...ctx, accessToken: refreshed.accessToken, apiClient };
+  return {
+    ...ctx,
+    accessToken: refreshed.accessToken,
+    apiClient,
+    profileWorkspace: refreshed.workspaceUuid ?? creds.workspaceUuid
+  };
 }
 function createContext(opts) {
   const baseConfig = getEnvironmentConfig(opts.env);
   const apiUrl = opts.apiUrl || process.env.GRAVITY_RAIL_API_URL || baseConfig.apiUrl;
   const envConfig = apiUrl === baseConfig.apiUrl ? baseConfig : { ...baseConfig, apiUrl };
   const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
+  const profile = credentialsManager.resolveProfileName(opts.profile, opts.env);
   return {
     env: opts.env,
     envConfig,
     outputFormat: detectOutputFormat(opts.outputFormat),
     verbose: opts.verbose ?? false,
     allowWrite: opts.allowWrite ?? false,
-    credentialsManager
+    credentialsManager,
+    profile
   };
 }
 async function createAuthenticatedContext(opts) {
   const ctx = createContext(opts);
-  if (opts.realm) {
-    let devRealmsPath;
-    if (opts.env.startsWith("dev-cloud:")) {
-      const namespace = opts.env.slice("dev-cloud:".length);
-      devRealmsPath = loadDevCloudRealmFile(namespace);
-    }
-    const { token, workspaceUuid } = loadRealmCredentials(opts.realm, devRealmsPath);
-    const apiClient = makeApiClient(token, ctx.envConfig.apiUrl);
-    return { ...ctx, accessToken: token, apiClient, realmWorkspace: workspaceUuid };
-  }
   const apiKey = process.env.GRAVITY_RAIL_API_KEY;
   if (apiKey) {
     const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: apiKey, apiClient };
   }
-  const creds = ctx.credentialsManager.load(ctx.env);
+  const creds = ctx.credentialsManager.load(ctx.env, ctx.profile);
   if (creds?.accessToken) {
     const buffer = 5 * 60 * 1e3;
     const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
     if (notExpired) {
       const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
-      return { ...ctx, accessToken: creds.accessToken, apiClient };
+      return {
+        ...ctx,
+        accessToken: creds.accessToken,
+        apiClient,
+        profileWorkspace: creds.workspaceUuid
+      };
     }
     const refreshed = await tryTokenRefresh(ctx, creds);
     if (refreshed) return refreshed;
   }
-  throw new AuthRequiredError();
+  if (ctx.profile !== "default") {
+    throw new AuthRequiredError(
+      `No credentials for profile "${ctx.profile}" (${ctx.env}). Run: gr auth login --name ${ctx.profile}  or  gr auth import-dev`
+    );
+  }
+  throw new AuthRequiredError(
+    "Not authenticated. Run `gr login`, `gr auth import-dev` (local dev), or set GRAVITY_RAIL_API_KEY."
+  );
 }
 function requireAuth(ctx) {
   if (!("apiClient" in ctx)) {
@@ -580,13 +503,15 @@ function createPublicContext(opts) {
     frontendUrl: opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com"
   } : getEnvironmentConfig(env);
   const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
+  const profile = credentialsManager.resolveProfileName(opts.profile, env);
   return {
     env,
     envConfig,
     outputFormat: detectOutputFormat(opts.outputFormat),
     verbose: opts.verbose ?? false,
     allowWrite: opts.allowWrite ?? false,
-    credentialsManager
+    credentialsManager,
+    profile
   };
 }
 async function createPublicAuthenticatedContext(opts) {
@@ -596,13 +521,18 @@ async function createPublicAuthenticatedContext(opts) {
     const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
     return { ...ctx, accessToken: apiKey, apiClient };
   }
-  const creds = ctx.credentialsManager.load(ctx.env);
+  const creds = ctx.credentialsManager.load(ctx.env, ctx.profile);
   if (creds?.accessToken) {
     const buffer = 5 * 60 * 1e3;
     const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
     if (notExpired) {
       const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
-      return { ...ctx, accessToken: creds.accessToken, apiClient };
+      return {
+        ...ctx,
+        accessToken: creds.accessToken,
+        apiClient,
+        profileWorkspace: creds.workspaceUuid
+      };
     }
     const refreshed = await tryTokenRefresh(ctx, creds);
     if (refreshed) return refreshed;
@@ -624,11 +554,11 @@ function toCamelChat(raw) {
   return {
     id: raw.id,
     uuid: raw.uuid,
-    chatType: raw.chat_type,
+    chatType: raw.chatType,
     title: raw.title,
-    threadId: raw.thread_id,
-    createdAt: raw.created_at,
-    updatedAt: raw.updated_at
+    threadId: raw.threadId,
+    createdAt: raw.createdAt,
+    updatedAt: raw.updatedAt
   };
 }
 function toCamelMessage(raw) {
@@ -636,9 +566,10 @@ function toCamelMessage(raw) {
     id: raw.id,
     role: raw.role,
     content: raw.content ?? "",
-    createdAt: raw.createdAt ?? raw.created_at ?? null,
-    toolCalls: raw.toolCalls ?? raw.tool_calls ?? null,
-    toolCallId: raw.toolCallId ?? raw.tool_call_id ?? null
+    createdAt: raw.createdAt ?? null,
+    // Protocol-exempt snake_case on wire (see ConciergeMessageResponse)
+    toolCalls: raw.tool_calls ?? null,
+    toolCallId: raw.tool_call_id ?? null
   };
 }
 async function listConciergeChats(ctx) {
@@ -744,6 +675,7 @@ export {
   outputSingle,
   COL,
   stderr,
+  createSandboxFetchFromEnv,
   createContext,
   createAuthenticatedContext,
   requireAuth,
@@ -758,4 +690,4 @@ export {
   confirmAccountPhoneVerify,
   getConciergeChatMessages
 };
-//# sourceMappingURL=chunk-L5YCPUAM.js.map
+//# sourceMappingURL=chunk-GRLUFHMI.js.map