@oxygen-agent/cli 1.1014.136 → 1.1014.618

package/dist/commands/crm.js

@@ -0,0 +1,1669 @@
+import { emitCliFailure, writeJson } from "../cli-output.js";
+import { parseJsonObject, readPositiveInt, readRecordString, resolveLiveDryRunMode } from "../cli-values.js";
+import { ansi, buildCrmLeadsTodayPath, buildCrmSignalRecordBody, clipCell, handleReadActionWithLens, parseJsonArray, parseJsonValue, readCsvOption, readPositiveNumber, renderTextTable, splitCommaList } from "../command-support.js";
+import { addContractFlags, readContractFlags } from "../contract-flags.js";
+import { readCrmNoteEditFields, readCrmPhotoFields, readCrmFileLabel, buildCrmObjectsPath, buildCrmConnectionsPath, buildCrmRecordPath } from "../crm-support-flags.js";
+import { requestOxygen } from "../http-client.js";
+import { isRecord, readClearableOption, readOption } from "../util.js";
+import { OxygenError, success } from "@oxygen/shared/cli-result";
+import { CRM_ENRICHMENT_READ_CONTRACT } from "@oxygen/shared/contracts/crm-enrichment-read";
+import { Command } from "commander";
+import { stdout as output } from "node:process";
+const DEFAULT_CRM_SETUP_OBJECTS = ["companies", "people", "deals"];
+function buildCrmSetupBody(options) {
+    return {
+        objects: readCrmSetupObjects(options.objects),
+        mode: resolveLiveDryRunMode(options),
+        ...(options.withEnrichment === true ? { with_enrichment: true } : {}),
+        ...(options.withoutEnrichment === true ? { without_enrichment: true } : {}),
+        ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+    };
+}
+function buildCrmFieldsBody(options) {
+    const object = readOption(options.object);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { objects: object } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+    };
+}
+function buildCrmRollupBody(options) {
+    const object = readOption(options.object);
+    const row = readOption(options.row);
+    const limit = readOption(options.limit);
+    return {
+        mode: resolveLiveDryRunMode(options),
+        ...(object ? { object } : {}),
+        ...(row ? { row } : {}),
+        ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+        ...(options.includeLifecycle ? { include_lifecycle: true } : {}),
+    };
+}
+function readCrmSetupObjects(value) {
+    const objects = readCsvOption(value);
+    return objects.length > 0 ? [...new Set(objects)] : DEFAULT_CRM_SETUP_OBJECTS;
+}
+function buildCrmObjectCreateBody(options) {
+    const slug = readOption(options.slug);
+    if (!slug) {
+        throw new OxygenError("missing_slug", "--slug is required.", { exitCode: 1 });
+    }
+    const displayName = readOption(options.displayName);
+    if (!displayName) {
+        throw new OxygenError("missing_display_name", "--display-name is required.", { exitCode: 1 });
+    }
+    const columns = options.columnsJson ? parseJsonArray(options.columnsJson) : [];
+    const identities = options.identitiesJson ? parseJsonArray(options.identitiesJson) : [];
+    return {
+        slug,
+        display_name: displayName,
+        columns,
+        identities,
+        mode: resolveLiveDryRunMode(options),
+        ...(readOption(options.singularName) ? { singular_name: readOption(options.singularName) } : {}),
+        ...(readOption(options.pluralName) ? { plural_name: readOption(options.pluralName) } : {}),
+        ...(readOption(options.labelColumn) ? { label_column: readOption(options.labelColumn) } : {}),
+        ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+    };
+}
+function buildCrmObjectDeleteBody(options) {
+    const mode = resolveLiveDryRunMode(options);
+    if (mode === "live" && options.confirm !== true) {
+        throw new OxygenError("confirm_required", "crm objects delete --live requires --confirm after inspecting the dry-run impact.", { exitCode: 1 });
+    }
+    return {
+        mode,
+        ...(options.confirm === true ? { confirm: true } : {}),
+        ...(options.keepTable === true ? { keep_table: true } : {}),
+        ...(readOption(options.purgeAfter) ? { purge_after_days: options.purgeAfter } : {}),
+    };
+}
+function buildCrmObjectAddAttrBody(options) {
+    const column = readOption(options.columnJson)
+        ? parseJsonObject(options.columnJson)
+        : null;
+    if (!column) {
+        throw new OxygenError("missing_column", "--column-json is required.", { exitCode: 1 });
+    }
+    return {
+        column,
+        mode: resolveLiveDryRunMode(options),
+        ...(options.asIdentityJson ? { identity: parseJsonObject(options.asIdentityJson) } : {}),
+    };
+}
+function buildCrmObjectUpdateAttrBody(options) {
+    const name = readOption(options.name);
+    const optionsJson = readOption(options.optionsJson);
+    if (!name && options.required === undefined && !optionsJson) {
+        throw new OxygenError("missing_attribute_change", "Nothing to change. Pass --name <label>, --required / --no-required, and/or --options-json <json>.", { exitCode: 1 });
+    }
+    let choices;
+    if (optionsJson) {
+        const parsed = parseJsonValue(optionsJson, "--options-json");
+        if (!Array.isArray(parsed)) {
+            throw new OxygenError("invalid_options_json", "--options-json must be a JSON array of {value,label,color?}.", { exitCode: 1 });
+        }
+        choices = parsed;
+    }
+    return {
+        ...(name ? { display_name: name } : {}),
+        ...(options.required !== undefined ? { is_required: options.required } : {}),
+        ...(choices !== undefined ? { options: choices } : {}),
+        mode: resolveLiveDryRunMode(options),
+    };
+}
+function buildCrmAssertBody(object, options) {
+    return {
+        object,
+        identity: parseCrmIdentityOption(options.identity),
+        values: options.valuesJson ? parseJsonObject(options.valuesJson) : {},
+        mode: resolveLiveDryRunMode(options),
+    };
+}
+function buildCrmSyncImportBody(provider, options) {
+    return {
+        provider,
+        object: options.object,
+        mode: resolveLiveDryRunMode(options),
+        ...(options.into ? { into: options.into } : {}),
+        ...(readPositiveInt(options.limit) !== undefined ? { limit: readPositiveInt(options.limit) } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
+function buildCrmSyncConfigureBody(options) {
+    return {
+        provider: options.provider,
+        object: options.object,
+        mode: resolveLiveDryRunMode(options),
+        ...(readOption(options.direction) ? { direction: readOption(options.direction) } : {}),
+        ...(readOption(options.cron) ? { cron: readOption(options.cron) } : {}),
+        ...(readOption(options.timezone) ? { timezone: readOption(options.timezone) } : {}),
+        ...(readPositiveInt(options.maxRows) !== undefined ? { max_rows_per_cycle: readPositiveInt(options.maxRows) } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(options.fieldMappingsJson
+            ? { field_mappings: parseJsonArray(options.fieldMappingsJson) }
+            : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
+function buildCrmSyncRunBody(options) {
+    return {
+        provider: options.provider,
+        object: options.object,
+        mode: resolveLiveDryRunMode(options),
+        ...(readOption(options.direction) ? { direction: readOption(options.direction) } : {}),
+        ...(readOption(options.since) ? { since: readOption(options.since) } : {}),
+        ...(readOption(options.configId) ? { config_id: readOption(options.configId) } : {}),
+        ...(readPositiveInt(options.maxRows) !== undefined ? { max_rows_per_cycle: readPositiveInt(options.maxRows) } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
+function buildCrmSyncEnableBody(options) {
+    return {
+        provider: options.provider,
+        object: options.object,
+        ...(readOption(options.direction) ? { direction: readOption(options.direction) } : {}),
+        ...(readOption(options.cron) ? { cron: readOption(options.cron) } : {}),
+        ...(readOption(options.timezone) ? { timezone: readOption(options.timezone) } : {}),
+        ...(readPositiveInt(options.maxRows) !== undefined ? { max_rows_per_cycle: readPositiveInt(options.maxRows) } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(options.fieldMappingsJson
+            ? { field_mappings: parseJsonArray(options.fieldMappingsJson) }
+            : {}),
+        ...(options.approved ? { approved: true } : {}),
+        // Commander maps --no-run-now to runNow:false (default true); only send the
+        // opt-out so the route's default (run an immediate first cycle) holds.
+        ...(options.runNow === false ? { run_now: false } : {}),
+    };
+}
+function buildCrmSyncDisableBody(options) {
+    return { provider: options.provider, object: options.object };
+}
+function buildCrmSyncConfigStatusPath(options) {
+    const runId = readOption(options.runId);
+    const provider = readOption(options.provider);
+    const object = readOption(options.object);
+    const hasPair = provider !== null && object !== null;
+    if (runId !== null && (provider !== null || object !== null)) {
+        throw new OxygenError("conflicting_flags", "Pass either --run-id or --provider/--object, not both.", { exitCode: 1 });
+    }
+    if (runId === null && !hasPair) {
+        throw new OxygenError("missing_target", "Pass --run-id for a single run, or --provider and --object for a standing sync config.", { exitCode: 1 });
+    }
+    const params = new URLSearchParams();
+    if (runId !== null) {
+        params.set("run_id", runId);
+    }
+    else {
+        params.set("provider", provider);
+        params.set("object", object);
+    }
+    return `/api/cli/crm/sync/status?${params.toString()}`;
+}
+function buildCrmSyncLinksPath(object, rowId) {
+    const params = new URLSearchParams();
+    params.set("object", object);
+    params.set("row_id", rowId);
+    return `/api/cli/crm/sync/links?${params.toString()}`;
+}
+const CRM_ENRICHMENT_READ_FLAGS = {
+    object: { valueName: "<object>", help: "CRM object slug: companies or people. Omit for every object this workspace has.", parse: readOption },
+};
+function buildCrmEnrichmentListPath(options) {
+    const fields = readContractFlags(options, CRM_ENRICHMENT_READ_CONTRACT, CRM_ENRICHMENT_READ_FLAGS);
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(fields))
+        if (value !== undefined && value !== null)
+            params.set(key, String(value));
+    return params.size ? `/api/cli/crm/enrichment?${params.toString()}` : "/api/cli/crm/enrichment";
+}
+// The delta form: flip one named enrichment and leave every other decision
+// (the rest of the presets, the ceiling, force, the trigger set) exactly as it
+// was. Mutually exclusive with the whole-set form the API rejects mixing.
+function buildCrmEnrichmentDeltaBody(preset, options, key) {
+    return { object: readOption(options.object) ?? "", [key]: [preset] };
+}
+function buildCrmEnrichmentSetBody(options) {
+    return {
+        object: readOption(options.object) ?? "",
+        presets: readCsvOption(options.presets),
+        ...readCrmEnrichmentMaxCredits(options.maxCredits),
+        ...(options.force === true ? { force: true } : {}),
+    };
+}
+// `--max-credits auto` is the explicit "hand the ceiling back to the plan
+// default" write, which the API only performs for a literal null. An ABSENT
+// flag preserves whatever is armed, so the two must not collapse into the same
+// request body.
+function readCrmEnrichmentMaxCredits(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return {};
+    if (raw.toLowerCase() === "auto")
+        return { max_credits: null };
+    const credits = readPositiveNumber(raw);
+    return credits === undefined ? {} : { max_credits: credits };
+}
+function buildCrmSearchBody(query, options) {
+    // `crm search` is the only command in the family that took the plural, which
+    // cost a failed invocation every time an agent reached for the sibling
+    // spelling. Both are accepted; the plural still wins if somebody passes both.
+    const objects = readCsvOption(options.objects ?? options.object);
+    const limit = readPositiveInt(options.limit);
+    return {
+        query,
+        ...(objects.length > 0 ? { objects } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+        ...(options.suggest === true ? { mode: "suggest" } : {}),
+    };
+}
+function buildCrmMergeBody(object, survivorRowId, loserRowId, options) {
+    const mode = resolveLiveDryRunMode(options);
+    if (mode === "live" && options.confirm !== true) {
+        throw new OxygenError("confirm_required", "crm merge --live requires --confirm after inspecting the dry-run field diff.", { exitCode: 1 });
+    }
+    return {
+        object,
+        survivor_row_id: survivorRowId,
+        loser_row_id: loserRowId,
+        mode,
+        ...(options.confirm === true ? { confirm: true } : {}),
+        ...(options.fieldOverridesJson ? { field_overrides: parseJsonObject(options.fieldOverridesJson) } : {}),
+    };
+}
+function buildCrmRelationshipUpsertBody(object, rowId, options) {
+    return {
+        object,
+        row_id: rowId,
+        relationship: options.relationship,
+        target: {
+            ...(readOption(options.targetObject) ? { object: readOption(options.targetObject) } : {}),
+            row_id: options.targetRowId,
+        },
+        ...(readOption(options.role) ? { role: readOption(options.role) } : {}),
+        mode: resolveLiveDryRunMode(options),
+    };
+}
+function buildCrmActivityBody(object, rowId, options) {
+    const body = {
+        mode: resolveLiveDryRunMode(options),
+        activity_type: options.type,
+        links: [{ object, row_id: rowId, role: options.role ?? "actor" }],
+    };
+    if (options.summary)
+        body.summary = options.summary;
+    if (options.body)
+        body.body = options.body;
+    if (options.channel)
+        body.channel = options.channel;
+    if (options.direction)
+        body.direction = options.direction;
+    if (options.occurredAt)
+        body.occurred_at = options.occurredAt;
+    if (options.sourceProvider)
+        body.source_provider = options.sourceProvider;
+    if (options.providerEventId)
+        body.provider_event_id = options.providerEventId;
+    if (options.metadataJson)
+        body.metadata = parseJsonObject(options.metadataJson);
+    return body;
+}
+function buildCrmActivityNoteBody(object, rowId, text, options) {
+    return {
+        mode: resolveLiveDryRunMode(options),
+        activity_type: "note",
+        summary: text,
+        links: [{ object, row_id: rowId, role: "actor" }],
+    };
+}
+function buildCrmTimelinePath(object, rowId, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    if (options.cursor)
+        params.set("cursor", options.cursor);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/timeline`;
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmRelatedPath(object, rowId, options) {
+    const params = new URLSearchParams();
+    if (options.previewLimit)
+        params.set("preview_limit", options.previewLimit);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/related`;
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmNotesPath(object, rowId, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    if (options.cursor)
+        params.set("cursor", options.cursor);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/notes`;
+    return query ? `${base}?${query}` : base;
+}
+/**
+ * One record's tasks, or — with neither argument — every task in the workspace
+ * (Philipp, 2026-09-22). The record scope is BOTH arguments or neither: one
+ * alone is an unfinished command, and guessing the other half would silently
+ * read a different set than the operator asked for.
+ */
+function buildCrmTasksPath(object, rowId, options) {
+    if (Boolean(object) !== Boolean(rowId)) {
+        throw new OxygenError("invalid_request", "Name both the object and the record, or neither: `oxygen crm tasks list companies acme.com` reads one record, `oxygen crm tasks list` reads the whole workspace.", { exitCode: 1 });
+    }
+    const params = new URLSearchParams();
+    // The workspace read is "what do I owe anyone": without --status it lists
+    // OPEN work, as its description promises — the blind acceptance run got
+    // cancelled rows back and had to confirm with a second call. A record's own
+    // list keeps every status, the way its tab shows Done and Cancelled groups.
+    // `--status all` asks the workspace read for everything.
+    const status = options.status ?? (object && rowId ? undefined : "open");
+    if (status && status !== "all")
+        params.set("status", status);
+    if (options.assignee)
+        params.set("assignee", options.assignee);
+    if (options.limit)
+        params.set("limit", options.limit);
+    if (options.cursor)
+        params.set("cursor", options.cursor);
+    const query = params.toString();
+    const base = object && rowId
+        ? `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/tasks`
+        : "/api/cli/crm/tasks";
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmPipelinePath(options) {
+    const params = new URLSearchParams();
+    if (readOption(options.pipeline))
+        params.set("pipeline", readOption(options.pipeline));
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    return query ? `/api/cli/crm/pipeline?${query}` : "/api/cli/crm/pipeline";
+}
+function buildCrmDuplicatesPath(object, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/duplicates`;
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmAutomationSetBody(templateId, options) {
+    if (options.armed === true && options.disarmed === true) {
+        throw new OxygenError("conflicting_flags", "Pass either --armed or --disarmed, not both.", { exitCode: 1 });
+    }
+    if (options.armed !== true && options.disarmed !== true) {
+        throw new OxygenError("missing_flag", "Pass --armed or --disarmed.", { exitCode: 1 });
+    }
+    const body = {
+        template_id: templateId,
+        armed: options.armed === true,
+        mode: resolveLiveDryRunMode(options),
+    };
+    if (options.configJson)
+        body.config = parseJsonObject(options.configJson);
+    if (options.approved === true)
+        body.approved = true;
+    const maxCredits = readPositiveNumber(options.maxCredits);
+    if (maxCredits !== undefined)
+        body.max_credits = maxCredits;
+    return body;
+}
+function buildCrmAutomationAuditPath(options) {
+    const params = new URLSearchParams();
+    if (readOption(options.templateId))
+        params.set("template_id", readOption(options.templateId));
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    return query ? `/api/cli/crm/automation/audit?${query}` : "/api/cli/crm/automation/audit";
+}
+function parseCrmIdentityOption(value) {
+    const separator = value.indexOf("=");
+    if (separator <= 0 || separator === value.length - 1) {
+        throw new OxygenError("invalid_identity", "--identity must be formatted as key=value, for example domain=acme.com or email=ceo@acme.com.", { exitCode: 1 });
+    }
+    return {
+        key: value.slice(0, separator).trim(),
+        value: value.slice(separator + 1).trim(),
+    };
+}
+/**
+ * `crm objects`, as an operator reads it.
+ *
+ * Every crm command printed raw JSON whether or not you asked for it, so the
+ * 2026-09-20 blind eval's agent piped this exact command through `python3 -c`
+ * just to see which objects existed. A list of four objects should not need a
+ * program to read. `--json` is untouched and remains the contract.
+ */
+const CRM_NORMALIZATION_WORDS = {
+    email_v1: "email address",
+    domain_v1: "website domain",
+    linkedin_url_v1: "LinkedIn URL",
+    exact_text_v1: "exact text",
+    uuid_v1: "ID",
+};
+function formatCrmObjects(data) {
+    const objects = Array.isArray(data.objects) ? data.objects.filter(isRecord) : [];
+    if (objects.length === 0) {
+        return "No CRM objects yet. Create the standard set with: oxygen crm setup --live\n";
+    }
+    const rows = objects.map((object) => {
+        const attributes = Array.isArray(object.attributes) ? object.attributes.filter(isRecord) : [];
+        const identities = Array.isArray(object.identities) ? object.identities.filter(isRecord) : [];
+        // System attributes are bookkeeping, not fields anyone chose.
+        const fieldCount = attributes.filter((attribute) => attribute.attributeKind !== "system").length;
+        const primary = identities.find((identity) => identity.isPrimary === true) ?? identities[0];
+        // A compact projection carries no attributes or identities (and an older
+        // server no standardKey): print what it does carry, never "custom, 0
+        // fields, can duplicate" for companies/people/deals.
+        const compact = !Array.isArray(object.attributes);
+        const kind = object.standardKey ? "standard" : object.standardKey === null || !compact ? "custom" : "—";
+        let identity = describeCrmIdentity(primary, attributes);
+        if (!Array.isArray(object.identities) && Object.hasOwn(object, "primaryIdentitySlug")) {
+            identity = typeof object.primaryIdentitySlug === "string" ? object.primaryIdentitySlug : "nothing — can duplicate";
+        }
+        else if (compact && !Array.isArray(object.identities)) {
+            identity = "—";
+        }
+        return [
+            String(object.pluralName || object.displayName || object.slug || "—"),
+            kind,
+            compact ? "—" : String(fieldCount),
+            identity,
+            String(object.slug ?? "—"),
+        ];
+    });
+    return [
+        `${objects.length} object${objects.length === 1 ? "" : "s"}`,
+        "",
+        ...renderTextTable(["OBJECT", "KIND", "FIELDS", "SAME RECORD WHEN", "SLUG"], rows),
+        "",
+        "  One object's fields and links:  oxygen crm describe <slug>",
+        "  In the app:                     /settings/data-model",
+        "",
+    ].join("\n");
+}
+/**
+ * A to-do list an operator can read without a JSON parser.
+ *
+ * The record column is the point of the workspace read — a task title alone
+ * ("Send the deck") says nothing about who it is for — so it comes first, from
+ * the same primary link the web row shows. A record-scoped read prints the
+ * same table; the column is simply the record you asked about.
+ */
+function formatCrmTasks(data) {
+    const tasks = Array.isArray(data.tasks) ? data.tasks.filter(isRecord) : [];
+    // The workspace read names its scope as `object: null`; the record-scoped
+    // envelope carries no `object` key at all.
+    const scoped = !Object.hasOwn(data, "object");
+    if (tasks.length === 0) {
+        return scoped
+            ? "No tasks on this record. Add one with: oxygen crm tasks add <object> <record> \"<title>\"\n"
+            : "No tasks in this workspace. A task is filed on a record: oxygen crm tasks add companies acme.com \"Send the deck\"\n";
+    }
+    const rows = tasks.map((task) => {
+        const links = Array.isArray(task.links) ? task.links.filter(isRecord) : [];
+        const primary = links[0];
+        const assignee = isRecord(task.assignee) ? task.assignee : null;
+        return [
+            // Clipped, so one essay-length title cannot push every other column off
+            // the terminal. `--json` still carries the whole thing.
+            clipCell(String(primary?.label ?? primary?.objectSlug ?? "—"), 28),
+            clipCell(String(task.title ?? "—"), 48),
+            String(task.status ?? "—"),
+            String(task.priority ?? "—"),
+            formatCrmTaskDue(task.dueAt),
+            String(assignee?.name ?? assignee?.email ?? "unassigned"),
+            String(task.id ?? "—"),
+        ];
+    });
+    const link = typeof data.web_url === "string" ? data.web_url : null;
+    return [
+        `${tasks.length} task${tasks.length === 1 ? "" : "s"}${data.hasMore === true ? " (more available — pass --cursor)" : ""}`,
+        "",
+        ...renderTextTable(["RECORD", "TASK", "STATUS", "PRIORITY", "DUE", "ASSIGNEE", "ID"], rows),
+        "",
+        "  Finish one:  oxygen crm tasks complete <id>",
+        ...(link ? [`  In the app:  ${link}`] : []),
+        "",
+    ].join("\n");
+}
+/** A deadline is a day to whoever reads the list; the time of day is noise. */
+function formatCrmTaskDue(value) {
+    if (typeof value !== "string" || !value)
+        return "—";
+    return value.slice(0, 10);
+}
+/** "Website domain (website domain)" is noise, so the comparison is named only
+ *  when it says something the field name does not. An object with no identity
+ *  is called out rather than left blank: it duplicates on every re-import. */
+function describeCrmIdentity(identity, attributes) {
+    if (!identity)
+        return "nothing — can duplicate";
+    const attributeSlug = typeof identity.attributeSlug === "string" ? identity.attributeSlug : null;
+    const attribute = attributeSlug
+        ? attributes.find((candidate) => candidate.slug === attributeSlug)
+        : undefined;
+    const fieldName = String(attribute?.displayName ?? identity.displayName ?? attributeSlug ?? "—");
+    const normalization = typeof identity.normalization === "string" ? identity.normalization : "";
+    const words = CRM_NORMALIZATION_WORDS[normalization];
+    return words && words !== fieldName.toLowerCase() ? `${fieldName} (${words})` : fieldName;
+}
+// The stored trigger names are internal (`rows_insert`); the words the rest of
+// the CLI uses for the same writes are `insert` / `upsert` / `send`.
+// Width of the widest on/off marker (`[off]`), so every preset row's label
+// starts in the same column.
+const CRM_ENRICHMENT_MARKER_WIDTH = 5;
+const CRM_ENRICHMENT_SOURCE_LABELS = {
+    import: "import",
+    rows_insert: "insert",
+    rows_upsert: "upsert",
+    table_send: "send",
+};
+// `crm enrichment` reads and writes ONE thing: the standing auto-run on a CRM
+// object's table. --json returns the raw envelope; the default rendering exists
+// because this is where a founder decides what to spend on, and a JSON dump
+// buries the free-vs-paid split, the per-batch ceiling, and the fact that the
+// saved set is a standing permission.
+async function handleCrmEnrichmentAction(command, options, request) {
+    try {
+        const data = await request();
+        if (options.json) {
+            writeJson(success(command, data));
+            return;
+        }
+        process.stdout.write(formatCrmEnrichment(data));
+    }
+    catch (error) {
+        emitCliFailure(command, error);
+    }
+}
+function formatCrmEnrichment(data) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const lines = [];
+    if (!("objects" in data)) {
+        pushCrmEnrichmentObject(lines, styles, data);
+        lines.push("");
+        return lines.join("\n");
+    }
+    if (data.objects.length === 0) {
+        lines.push("", `  ${styles.dim("No CRM objects to enrich yet — run `oxygen crm setup` first.")}`, "", styles.dim(`View CRM: ${data.deepLink}`), "");
+        return lines.join("\n");
+    }
+    for (const view of data.objects) {
+        pushCrmEnrichmentObject(lines, styles, view);
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+function pushCrmEnrichmentObject(lines, styles, view) {
+    lines.push("", `${styles.bold(`Automatic enrichment — ${view.object}`)}  ${formatCrmEnrichmentState(view, styles)}`, `  ${styles.dim("Standing permission: records written to this object enrich automatically, with no per-record approval, bounded by the per-batch ceiling below.")}`, "");
+    const labelWidth = Math.max(...view.presets.map((preset) => preset.label.length), 0);
+    const armed = new Set(view.presets.filter((preset) => preset.enabled).map((preset) => preset.id));
+    for (const preset of view.presets) {
+        pushCrmEnrichmentPreset(lines, styles, preset, labelWidth, armed);
+    }
+    const summary = [
+        ["Per record", formatCrmEnrichmentCredits(view.credits_per_record, styles, "credits")],
+        ["Per batch", formatCrmEnrichmentCeiling(view, styles)],
+        ["Columns", `${view.column_budget.used} of ${view.column_budget.max} allowed`],
+        ["Fires on", formatCrmEnrichmentSources(view.sources)],
+        // Only worth a line when it is on: force is what turns a re-import into a
+        // second bill for records that already carry the values.
+        ...(view.force
+            ? [["Force", "on — re-runs columns that already have a value"]]
+            : []),
+    ];
+    const summaryWidth = Math.max(...summary.map(([label]) => label.length));
+    lines.push("", ...summary.map(([label, value]) => `  ${styles.dim(label.padEnd(summaryWidth))}   ${value}`));
+    if (view.custom_columns.length > 0) {
+        // A hand-tuned config carries columns no preset owns, so the per-record
+        // figure above can be a floor rather than the bill.
+        // Uncosted only when one of them may bill; a formula needs no run and is free.
+        const note = view.custom_columns_uncosted
+            ? ` ${styles.yellow("(cost not included above)")}`
+            : ` ${styles.dim("(free: no run needed)")}`;
+        lines.push(`  ${styles.dim("Extra".padEnd(summaryWidth))}   ${view.custom_columns.join(", ")}${note}`);
+    }
+    // The half the config alone cannot show: an armed set says nothing about the
+    // records that were already there when it was armed. Without this line a
+    // workspace reads a correct configuration and never learns that 303 of its
+    // 317 companies are still blank.
+    const backfillLine = formatCrmEnrichmentBacklog(view, styles);
+    if (backfillLine) {
+        lines.push(`  ${styles.dim("Not enriched".padEnd(summaryWidth))}   ${backfillLine}`);
+    }
+    if (view.changed) {
+        lines.push("", ...formatCrmEnrichmentChange(view.changed, styles));
+    }
+    lines.push("", styles.dim(`View: ${view.deepLink}`), styles.dim(`Runs: ${view.runs_web_url}`));
+}
+function formatCrmEnrichmentBacklog(view, styles) {
+    const backfill = view.backfill;
+    if (!backfill)
+        return null;
+    if (backfill.remaining_rows === 0) {
+        return styles.green(`none — all ${backfill.total_rows.toLocaleString("en-US")} records carry these enrichments`);
+    }
+    return `${styles.yellow(`${backfill.remaining_rows.toLocaleString("en-US")} of ${backfill.total_rows.toLocaleString("en-US")} records`)}`
+        + ` ${styles.dim(`— fill them with \`oxygen crm enrichment backfill --object ${view.object}\``)}`;
+}
+function pushCrmEnrichmentPreset(lines, styles, preset, labelWidth, armed) {
+    // Pad the raw marker before colouring it: `[off]` is one character wider than
+    // `[on]`, and an ANSI-wrapped padEnd would count the escape codes.
+    const state = !preset.available ? "[--]" : preset.enabled ? "[on]" : "[off]";
+    const marker = (!preset.available || !preset.enabled ? styles.dim : styles.green)(state)
+        + " ".repeat(CRM_ENRICHMENT_MARKER_WIDTH - state.length);
+    lines.push(`  ${marker} ${preset.label.padEnd(labelWidth)}   ${formatCrmEnrichmentCredits(preset.credits_per_record, styles, "credits/record")}   ${styles.dim(preset.id)}`, `       ${styles.dim(preset.description)}`);
+    if (preset.credit_note)
+        lines.push(`       ${styles.dim(`Cost note: ${preset.credit_note}`)}`);
+    if (preset.caveat)
+        lines.push(`       ${styles.yellow(`Caveat: ${preset.caveat}`)}`);
+    if (!preset.available) {
+        lines.push(`       ${styles.dim("This table has none of its columns yet — re-run `oxygen crm setup`.")}`);
+        return;
+    }
+    if (!preset.enabled)
+        return;
+    // An enabled preset missing some of its own columns is a hand-tuned config:
+    // say which columns are not armed rather than implying the whole preset runs.
+    if (preset.missing_columns.length > 0) {
+        lines.push(`       ${styles.yellow(`Partly armed — not running: ${preset.missing_columns.join(", ")}`)}`);
+    }
+    // A preset that reads another preset's output writes nothing while that one is
+    // off — the quietest way an armed set under-delivers.
+    const unmet = (preset.depends_on ?? []).filter((id) => !armed.has(id));
+    if (unmet.length > 0) {
+        lines.push(`       ${styles.yellow(`Reads ${unmet.join(", ")} — turn that on or this stays empty.`)}`);
+    }
+}
+function formatCrmEnrichmentCredits(credits, styles, unit) {
+    if (credits === 0)
+        return styles.green("free");
+    // "1 credits/record" read wrong in a blind pass (2026-10-04); the unit is
+    // "credits" or "credits/record", so singularize its leading word.
+    const label = credits === 1 ? unit.replace(/^credits\b/, "credit") : unit;
+    return styles.yellow(`${credits.toLocaleString("en-US")} ${label}`);
+}
+// "on" alone reads as "the enrichments listed below are on" even when every one
+// of them is off and only a hand-added column is armed.
+function formatCrmEnrichmentState(view, styles) {
+    if (!view.enabled)
+        return styles.dim("off");
+    const anyPreset = view.presets.some((preset) => preset.enabled);
+    if (!anyPreset && view.custom_columns.length > 0) {
+        return `${styles.green("on")} ${styles.dim("— your own columns only")}`;
+    }
+    return styles.green("on");
+}
+function formatCrmEnrichmentCeiling(view, styles) {
+    if (view.max_credits === null)
+        return styles.dim("—");
+    const source = view.max_credits_source === "explicit"
+        ? "you set this"
+        : "your plan's per-delivery default";
+    const unit = view.max_credits === 1 ? "credit" : "credits";
+    return `${view.max_credits.toLocaleString("en-US")} ${unit} ${styles.dim(`(${source})`)}`;
+}
+function formatCrmEnrichmentSources(sources) {
+    if (sources.length === 0)
+        return "—";
+    const labels = sources.map((source) => CRM_ENRICHMENT_SOURCE_LABELS[source] ?? source);
+    // `crm assert` writes land on the insert/upsert triggers, so an armed object
+    // enriches CRM-asserted records too — the one place that is not obvious from
+    // the trigger names alone.
+    const assertCovered = sources.includes("rows_insert") || sources.includes("rows_upsert");
+    return `${labels.join(", ")}${assertCovered ? " (includes `crm assert` writes)" : ""}`;
+}
+function buildCrmEnrichmentBackfillBody(options) {
+    const presets = readCsvOption(options.presets);
+    const limit = readPositiveInt(options.limit);
+    return {
+        object: readOption(options.object) ?? "",
+        // An ABSENT --presets means "whatever is armed"; an explicitly empty one is
+        // still a caller-supplied set, so the two must not collapse.
+        ...(options.presets !== undefined ? { presets } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+        ...(options.all === true ? { all: true } : {}),
+        ...(options.live === true ? { live: true } : {}),
+        ...(options.approved === true ? { approved: true } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined
+            ? { max_credits: readPositiveNumber(options.maxCredits) }
+            : {}),
+    };
+}
+// Backfill prints its own rendering rather than reusing the preset editor's:
+// this command's whole job is to say what is missing and what filling it costs,
+// and a JSON dump buries the one number that decides whether to run it.
+async function handleCrmEnrichmentBackfill(options) {
+    const command = "crm enrichment backfill";
+    try {
+        const data = await requestOxygen("/api/cli/crm/enrichment/backfill", { method: "POST", body: buildCrmEnrichmentBackfillBody(options) });
+        if (options.json) {
+            writeJson(success(command, data));
+            return;
+        }
+        process.stdout.write(formatCrmEnrichmentBackfill(data));
+    }
+    catch (error) {
+        emitCliFailure(command, error);
+    }
+}
+function formatCrmEnrichmentBackfill(view) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const lines = [
+        "",
+        `${styles.bold(`Backfill — ${view.object}`)}  ${view.live ? styles.green("queued") : styles.dim("preview")}`,
+        `  ${styles.dim("Arming an enrichment only covers records written from then on. This fills the ones already here.")}`,
+        "",
+        `  ${formatBackfillHeadline(view, styles)}`,
+        "",
+    ];
+    const labelWidth = Math.max(...view.columns.map((column) => column.label.length), 0);
+    for (const column of view.columns) {
+        const rate = column.credits_per_row === null
+            ? styles.yellow("cost unknown")
+            : formatCrmEnrichmentCredits(column.credits_per_row, styles, "credits/record");
+        const pending = column.billable
+            ? `${column.pending_rows.toLocaleString("en-US")} missing`
+            : styles.dim("derived — fills itself, free");
+        lines.push(`  ${column.label.padEnd(labelWidth)}   ${pending.padEnd(18)}   ${rate}`);
+    }
+    const summary = [
+        ["This batch", `${view.batch.rows.toLocaleString("en-US")} records · ${formatBackfillCredits(view.batch.estimated_credits, styles)}`],
+        ["To finish", `${view.to_finish.rows.toLocaleString("en-US")} records · ${formatBackfillCredits(view.to_finish.estimated_credits, styles)} · ${view.to_finish.batches_at_this_size} batch${view.to_finish.batches_at_this_size === 1 ? "" : "es"} this size`],
+        ["Spendable", view.spendable_credits === null
+                ? styles.dim("unknown")
+                : `${view.spendable_credits.toLocaleString("en-US")} credits ${styles.dim("(balance minus fixed monthly commitments)")}`],
+    ];
+    if (view.batch.recommended_max_credits !== null) {
+        summary.push(["Suggested cap", `${view.batch.recommended_max_credits.toLocaleString("en-US")} credits for this batch`]);
+    }
+    if (view.run) {
+        summary.push(["Run", `${view.run.status} · ${view.run.item_count.toLocaleString("en-US")} items · ${view.run.action_run_id}`]);
+    }
+    if (view.remaining_after_batch !== undefined) {
+        summary.push(["Left after this", `${view.remaining_after_batch.toLocaleString("en-US")} records`]);
+    }
+    const summaryWidth = Math.max(...summary.map(([label]) => label.length));
+    lines.push("", ...summary.map(([label, value]) => `  ${styles.dim(label.padEnd(summaryWidth))}   ${value}`));
+    if (view.to_finish.uncosted_columns.length > 0) {
+        lines.push(`  ${styles.yellow(`Cost unknown for: ${view.to_finish.uncosted_columns.join(", ")} — the figures above are a floor.`)}`);
+    }
+    // The silent failure this command exists to make loud: a ceiling that
+    // truncates the run leaves the rest terminally skipped while the run still
+    // reports completed.
+    if (view.skipped_credit_limit.rows > 0) {
+        lines.push("", `  ${styles.yellow(view.skipped_credit_limit.message)}`);
+    }
+    if (view.credit_guidance && view.credit_posture !== "sufficient") {
+        lines.push("", `  ${styles.yellow(view.credit_guidance)}`);
+    }
+    lines.push("", `  ${styles.dim("Next")}   ${view.next_step}`, ...(view.run_all_step === view.next_step ? [] : [`  ${styles.dim("All ")}   ${view.run_all_step}`]), "", styles.dim(`View: ${view.deepLink}`), styles.dim(`Runs: ${view.run?.web_url ?? view.runs_web_url}`), "");
+    return lines.join("\n");
+}
+function formatBackfillHeadline(view, styles) {
+    if (view.remaining_rows === 0) {
+        return styles.green(`All ${view.total_rows.toLocaleString("en-US")} records already carry these enrichments.`);
+    }
+    return `${styles.bold(view.remaining_rows.toLocaleString("en-US"))} of ${view.total_rows.toLocaleString("en-US")} records are still missing at least one of these enrichments.`;
+}
+function formatBackfillCredits(credits, styles) {
+    if (credits === null)
+        return styles.yellow("cost unknown");
+    return credits === 0 ? styles.green("free") : `${credits.toLocaleString("en-US")} credits`;
+}
+function formatCrmEnrichmentChange(changed, styles) {
+    if (changed.enabled_added.length === 0 && changed.enabled_removed.length === 0) {
+        return [`  ${styles.dim("No change — that set was already armed.")}`];
+    }
+    const lines = [];
+    if (changed.enabled_added.length > 0) {
+        lines.push(`  ${styles.green("+")} armed: ${changed.enabled_added.join(", ")}`);
+    }
+    if (changed.enabled_removed.length > 0) {
+        lines.push(`  ${styles.dim("-")} disarmed: ${changed.enabled_removed.join(", ")}`);
+    }
+    return lines;
+}
+export function registerCrmFamily(program, handleAsyncAction) {
+    program
+        .command("crm")
+        .description("Agent-native CRM object setup, records, automatic enrichment, and metadata commands. Who to contact first today: crm signals leads-today lists people ranked by their strongest intent signal in the last 7 days (website visit > profile view > post reaction > new follower), most recent first within a type.")
+        .addCommand(new Command("setup")
+        .description("Create or repair standard CRM object-backed tables; defaults to dry-run. A live run that creates the companies or people list also switches on automatic paid enrichment for every record added later: the dry run says what it costs, and --without-enrichment skips it.")
+        .option("--objects <objects>", "Comma-separated standard CRM objects to set up. Defaults to companies,people,deals.")
+        .option("--project <project>", "Project id or slug for created CRM tables.")
+        .option("--without-enrichment", "Set up the lists without switching on automatic enrichment, not even on a freshly created table. Wins over --with-enrichment. Switch an enrichment on later with `oxygen crm enrichment enable`.")
+        .option("--with-enrichment", "Also arm the standing cheap-enrichment auto-run on objects that already existed (fresh-created tables arm it by default). New records then auto-enrich within the per-batch credit cap, whether they arrive by import, insert, upsert, or `crm assert`. If your plan runs fewer columns per record than the defaults, the columns left out are listed under autoRunColumnsOverLimit. Pick which enrichments run with `oxygen crm enrichment`.")
+        .option("--dry-run", "Preview CRM setup without creating or repairing tables.")
+        .option("--live", "Apply CRM setup changes. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm setup", options, () => requestOxygen("/api/cli/crm/setup", {
+            method: "POST",
+            body: buildCrmSetupBody(options),
+        }));
+    }))
+        .addCommand(new Command("photos")
+        .description("Fill CRM people photos from LinkedIn data this workspace already holds \u2014 inbox conversations, connections, followers, and post engagers. Free: no provider calls, no credits. LinkedIn photo URLs expire after about two weeks, so re-run to refresh (an expired photo falls back to initials, never a broken image). Defaults to dry-run.")
+        .option("--limit <n>", "Maximum people rows to scan. Defaults to 2000.")
+        .option("--dry-run", "Preview how many photos would be filled, without writing.")
+        .option("--live", "Write the resolved photos onto the people records.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm photos", options, () => requestOxygen("/api/cli/crm/photos", {
+            method: "POST",
+            body: readCrmPhotoFields(options),
+        }));
+    }))
+        .addCommand(new Command("fields")
+        .description("Fill the stored CRM fields (Industry, Employees, HQ, and their siblings) from enrichment data this workspace already holds. These are ordinary text/number fields you can edit \u2014 the fill only ever writes an EMPTY cell, so a value you typed is never overwritten. Free: no provider calls, no credits. Run this once on a workspace whose records were enriched before those fields became editable. Defaults to dry-run.")
+        .option("--object <object>", "Limit the fill to one CRM object (companies, people, deals). Defaults to all.")
+        .option("--limit <n>", "Maximum rows to scan per object. Defaults to 2000.")
+        .option("--dry-run", "Preview how many cells would be filled, without writing.")
+        .option("--live", "Write the extracted values onto the records.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm fields", options, () => requestOxygen("/api/cli/crm/fields", {
+            method: "POST",
+            body: buildCrmFieldsBody(options),
+        }));
+    }))
+        .addCommand(new Command("rollup")
+        .description("Recompute the Open Deal column on companies (and the copy stamped on their people) from this workspace's deals. It normally converges on every deal write; run this to repair after a bulk import, or on a workspace whose deals predate the column. Free: no provider calls, no credits. Defaults to dry-run.")
+        .option("--object <object>", "CRM object to recompute. Only companies today. Defaults to companies.")
+        .option("--row <id>", "Recompute one company record by row id instead of sweeping the object.")
+        .option("--limit <n>", "Maximum company rows to scan in one sweep. Defaults to 2000.")
+        .option("--dry-run", "Report how many companies disagree with their deals, without writing. A deal with no stage set is not an open deal and is excluded from the comparison, so a blank-stage deal is never reported as drift.")
+        .option("--live", "Write the recomputed Open Deal cells. Default is dry-run.")
+        .option("--include-lifecycle", "Also recompute Account Stage from each company's people and deals. Account Stage only moves when a person or deal changes, so a workspace whose records were imported before that projection existed reads Prospect for everything. Free, and dry-run previews it like the rest.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm rollup", options, () => requestOxygen("/api/cli/crm/rollup", {
+            method: "POST",
+            body: buildCrmRollupBody(options),
+        }));
+    }))
+        .addCommand(
+    // `crm objects` lists (parent action runs when no subcommand matches);
+    // `crm objects create` / `crm objects add-attr` create custom objects.
+    new Command("objects")
+        .description("List configured CRM objects, or create/extend custom objects.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleReadActionWithLens("crm objects", options, () => requestOxygen(buildCrmObjectsPath(options)), formatCrmObjects);
+    })
+        .addCommand(new Command("create")
+        .description("Create or repair a custom CRM object. Defaults to dry-run.")
+        .requiredOption("--slug <slug>", "Object slug (snake_case), such as projects or tasks.")
+        .requiredOption("--display-name <name>", "Human-readable object name, such as Projects.")
+        .requiredOption("--columns-json <json>", 'JSON array. Every column requires key,label,data_type,semantic_type; camelCase aliases are accepted. Example: [{"key":"name","label":"Name","data_type":"text","semantic_type":"text","is_record_label":true}].')
+        .option("--identities-json <json>", "JSON array. Every identity requires column_key and normalization; camelCase columnKey is accepted. normalization is one of email_v1, domain_v1, linkedin_url_v1, exact_text_v1, uuid_v1 — the versioned CRM names, NOT the short exact/email/domain spellings --lookup-normalize takes. At most one identity may set is_primary.")
+        .option("--label-column <key>", "Column key to use as the record label. Defaults to the isRecordLabel column or the first column.")
+        .option("--singular-name <name>", "Singular display name, such as Project.")
+        .option("--plural-name <name>", "Plural display name, such as Projects.")
+        .option("--project <project>", "Project id or slug for the created CRM table.")
+        .option("--dry-run", "Preview the object plan without creating tables.")
+        .option("--live", "Apply the object creation. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options, command) => {
+        // The `crm objects` parent declares its own --json + a default
+        // action, so commander binds `objects create --json` to the parent
+        // and options.json is undefined here. optsWithGlobals() reads --json
+        // wherever it landed, so the envelope is emitted like every other
+        // crm_* command instead of printing the bare result.
+        await handleAsyncAction("crm objects create", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen("/api/cli/crm/objects", {
+            method: "POST",
+            body: buildCrmObjectCreateBody(options),
+        }));
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a CUSTOM CRM object: removes the object and schedules its backing table for deletion (restorable for 14 days). Standard objects (companies, people, deals) are permanent and refused. Defaults to dry-run; --live requires --confirm. Re-run on an object a teammate already deleted, it reports alreadyArchived with the table's deletion state and purge date. Restoring that table returns its rows as an ordinary table; the object stays deleted. Purging it also removes the object's archived definition.")
+        .argument("<object>", "Custom CRM object slug, such as projects or tasks.")
+        .option("--keep-table", "Deregister the object but keep its table as an ordinary workspace table (no delete timer). Ignored once the table is already scheduled.")
+        .option("--purge-after <days>", "Days until the backing table's physical purge. Defaults to 14; restorable via `tables restore` until then. Ignored once the table is already scheduled.")
+        .option("--dry-run", "Preview the object, rows, relationships, and edges the delete would take. Default.")
+        .option("--live", "Apply the delete. Requires --confirm.")
+        .option("--confirm", "Confirm the live delete after inspecting the dry-run impact.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options, command) => {
+        // See `objects create` above: optsWithGlobals() recovers --json,
+        // which the parent command otherwise swallows.
+        await handleAsyncAction("crm objects delete", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}`, {
+            method: "DELETE",
+            body: buildCrmObjectDeleteBody(options),
+        }));
+    }))
+        .addCommand(new Command("add-attr")
+        .description("Add one field to an existing CRM object, optionally as an identity. Works on custom objects and on companies/people/deals — a field you add is yours and survives `crm setup`. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies, people, deals, or a custom object like projects.")
+        .requiredOption("--column-json <json>", "JSON column. Required: key,label,data_type,semantic_type; camelCase aliases are accepted.")
+        .option("--as-identity-json <json>", "JSON identity definition {columnKey,normalization,isPrimary?} promoting the new column. normalization is one of email_v1, domain_v1, linkedin_url_v1, exact_text_v1, uuid_v1.")
+        .option("--dry-run", "Preview the attribute plan without altering the table.")
+        .option("--live", "Apply the attribute. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options, command) => {
+        // See `objects create` above: optsWithGlobals() recovers --json,
+        // which the parent command otherwise swallows.
+        await handleAsyncAction("crm objects add-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes`, {
+            method: "POST",
+            body: buildCrmObjectAddAttrBody(options),
+        }));
+    }))
+        .addCommand(new Command("update-attr")
+        .description("Change one field on a CRM object: rename it, make it required or optional, or replace the choices of a select/status field. The field's key never changes, so prompts and formulas that read it keep working. An Oxygen-shipped field on companies/people/deals can be renamed and its choices changed (its key, type and required flag stay); a field you added is fully yours. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies, people, deals, or a custom object like projects.")
+        .argument("<attribute>", "The field's key as `crm describe` lists it, e.g. renewal_date or pipeline_stage.")
+        .option("--name <label>", "New display name for the field.")
+        .option("--required", "Make the field required.")
+        .option("--no-required", "Make the field optional.")
+        .option("--options-json <json>", "Replacement choice list for a select/status field: a JSON array of {value,label,color?}. Keep an existing value to keep the records that hold it.")
+        .option("--dry-run", "Validate the change without applying it.")
+        .option("--live", "Apply the change. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, attribute, options, command) => {
+        await handleAsyncAction("crm objects update-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "PATCH", body: buildCrmObjectUpdateAttrBody(options) }));
+    }))
+        .addCommand(new Command("remove-attr")
+        .description("Remove a field you added to a CRM object. The column is archived (restorable with `columns restore <table> <key>`, which brings the field back; no cell destroyed), the object stops listing it, and the key is free for a new field at once. Oxygen-shipped fields, the title field, identity fields and relations cannot be removed. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies, people, deals, or a custom object like projects.")
+        .argument("<attribute>", "The field's key as `crm describe` lists it.")
+        .option("--dry-run", "Show what would be removed without applying it.")
+        .option("--live", "Remove the field. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, attribute, options, command) => {
+        await handleAsyncAction("crm objects remove-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes/${encodeURIComponent(attribute)}`, { method: "DELETE", body: { mode: resolveLiveDryRunMode(options) } }));
+    })))
+        .addCommand(new Command("search")
+        .description("Search CRM records by identity or record label. Takes ONE query; narrow the objects with --object, not a second argument.")
+        .argument("<query>", "Domain, email, LinkedIn URL, or record name to search for. Quote it if it contains spaces; to restrict to one object use --object companies.")
+        .option("--objects <objects>", "Comma-separated CRM object slugs to search. Defaults to all configured objects.")
+        .option("--object <object>", "Alias for --objects; every sibling crm command spells it singular.")
+        .option("--limit <limit>", "Maximum records to return.")
+        .option("--suggest", "Typeahead mode: ranked name/email/domain matches on a partial string, returning a compact suggestion per record instead of the full row. This is what the app's CRM search bar calls; use it when you have a fragment, and the default when you have an exact identity.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("crm search", options, () => requestOxygen("/api/cli/crm/records/search", {
+            method: "POST",
+            body: buildCrmSearchBody(query, options),
+        }));
+    }))
+        .addCommand(new Command("assert")
+        .description("Create or update one CRM record by object identity. Defaults to dry-run. A live assert fires the object's standing auto-run (automatic enrichment) for the written record, exactly like `tables insert|upsert|import` — so new records enrich hands-free within the per-batch credit cap. Inspect or change what runs with `oxygen crm enrichment list`.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .requiredOption("--identity <key=value>", "Identity key/value, for example domain=acme.com or email=ceo@acme.com.")
+        .option("--values-json <json>", "JSON object of CRM attribute values keyed by column key. RELATIONSHIP columns (a deal's Associated Company and Associated People, a person's Company) are not set here; a value for one is left out and reported in `warnings`. Link by the target's identity with `company_domain` (people and deals) or `primary_contact_email` (deals), or attach an existing record with `oxygen crm relationships upsert`.")
+        .option("--dry-run", "Preview the assert without writing a row.")
+        .option("--live", "Apply the assert. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options) => {
+        await handleAsyncAction("crm assert", options, () => requestOxygen("/api/cli/crm/assert", {
+            method: "POST",
+            body: buildCrmAssertBody(object, options),
+        }));
+    }))
+        .addCommand(new Command("get")
+        .description("Get one CRM record aggregate with row values, identities, and relationships.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm get", options, () => requestOxygen(buildCrmRecordPath(object, rowId, options)));
+    }))
+        .addCommand(new Command("connections")
+        .description("Show the conversations and sequence enrollments connected to one CRM record, resolved through its people and identities \u2014 never by fuzzy name or domain.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--conversation-limit <n>", "Maximum conversations to return.")
+        .option("--sequence-limit <n>", "Maximum sequence enrollments to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm connections", options, () => {
+            return requestOxygen(buildCrmConnectionsPath(object, rowId, options));
+        });
+    }))
+        .addCommand(new Command("files")
+        .description("Attach, list, download and remove files on a CRM record. The bytes live in the workspace file store, which owns dedupe, the per-file ceiling and the retained-bytes quota.")
+        .addCommand(new Command("list")
+        .description("List one record's attachments, newest first.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm files list", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/files`));
+    }))
+        .addCommand(new Command("attach")
+        .description("Upload a local file and attach it to a CRM record. Each call creates a new file and attachment, including identical retries. If a response is lost, inspect the record's files before retrying. No credits.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .argument("<path>", "Local file path.")
+        .option("--label <label>", "What to call it on this record. The stored file keeps its own filename.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, filePath, options) => {
+        await handleAsyncAction("crm files attach", options, async () => {
+            const { readFile } = await import("node:fs/promises");
+            const { basename } = await import("node:path");
+            const { createHash } = await import("node:crypto");
+            const bytes = await readFile(filePath);
+            // Presign, PUT straight to object storage, then have the server
+            // verify and attach — the same three hops the web drop zone and
+            // `copilot attach` make. Bytes never ride in the JSON body, whose
+            // 2,000,000-byte ceiling held attachments to ~1.5 MB against a
+            // store that allows 100 MiB.
+            const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/files`;
+            const ticket = await requestOxygen(`${base}/upload-url`, {
+                method: "POST",
+                body: {
+                    name: basename(filePath),
+                    byte_length: bytes.byteLength,
+                    sha256: createHash("sha256").update(bytes).digest("hex"),
+                },
+            });
+            const uploadUrl = readRecordString(ticket, "upload_url");
+            const fileId = isRecord(ticket.file) ? readRecordString(ticket.file, "id") : null;
+            const reservedRowId = isRecord(ticket.record) ? readRecordString(ticket.record, "row_id") : null;
+            if (!uploadUrl || !fileId || !reservedRowId) {
+                throw new OxygenError("attachment_upload_failed", "The server did not return an upload URL, file ID and resolved record ID for that file.", { exitCode: 1 });
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 300_000);
+            let put;
+            try {
+                put = await fetch(uploadUrl, {
+                    method: "PUT",
+                    headers: { "content-type": readRecordString(ticket, "upload_content_type") ?? "application/octet-stream" },
+                    body: new Uint8Array(bytes),
+                    signal: controller.signal,
+                });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            if (!put.ok) {
+                throw new OxygenError("attachment_upload_failed", `Object storage rejected the upload (${put.status}).`, { exitCode: 1 });
+            }
+            return requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(reservedRowId)}/files/${encodeURIComponent(fileId)}/uploaded`, {
+                method: "POST",
+                body: readCrmFileLabel(options),
+            });
+        });
+    }))
+        .addCommand(new Command("detach")
+        .description("Remove a file from a record. Removes the LINK only \u2014 the stored file is kept, so anywhere else it is attached still has it.")
+        .argument("<attachment_id>", "Attachment id from `crm files list`. Not the stored file id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (attachmentId, options) => {
+        await handleAsyncAction("crm files detach", options, () => requestOxygen(`/api/cli/crm/files/${encodeURIComponent(attachmentId)}`, {
+            method: "DELETE",
+        }));
+    })))
+        .addCommand(new Command("tasks")
+        .description("Reminders and to-dos on CRM records: file a task on a record, list the open work across the whole workspace or one record's, complete it. Distinct from `oxygen voice tasks`, which is the phone queue a rep dials from.")
+        .addCommand(new Command("list")
+        .description("List open reminders across the whole workspace, or one record's with <object> <record>. Open work first, then by deadline; --assignee me for yours, --status completed for the done ones. An undated task sorts last inside its group rather than first.")
+        .argument("[object]", "CRM object slug, such as companies or people. Leave both arguments off to read every record's tasks.")
+        .argument("[record]", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--status <status>", "open, completed, cancelled or all. The workspace read defaults to open; a record's own list shows every status.")
+        .option("--assignee <email|me>", "Only this member's tasks. `me` is whoever this key authenticates as.")
+        .option("--limit <n>", "Maximum tasks to return. Defaults to 50.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleReadActionWithLens("crm tasks list", options, () => requestOxygen(buildCrmTasksPath(object, rowId, options)), formatCrmTasks);
+    }))
+        .addCommand(new Command("add")
+        .description("Create a task on a CRM record. Free and internal, so it writes immediately rather than previewing first. The returned web_url opens THIS task on the record (?tab=tasks&task=<id>) — hand that one to the user, not the bare record link.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .argument("<title>", "What needs doing.")
+        .option("--body <body>", "Longer description.")
+        .option("--priority <priority>", "urgent, high, medium or low.")
+        .option("--due <iso>", "ISO-8601 due timestamp. An unparseable value is rejected, never silently dropped.")
+        .option("--assignee <email>", "Workspace member to assign it to, by email (a user id also works). Unassigned means the team, not nobody.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, title, options) => {
+        await handleAsyncAction("crm tasks add", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/tasks`, {
+            method: "POST",
+            body: {
+                title,
+                ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
+                ...(readOption(options.priority) ? { priority: readOption(options.priority) } : {}),
+                ...(readOption(options.due) ? { due_at: readOption(options.due) } : {}),
+                ...(readOption(options.assignee) ? { assignee_actor_id: readOption(options.assignee) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("update")
+        .description("Change a task's title, body, status, priority, deadline or assignee. Addressed by task id because one task can be filed on several records.")
+        .argument("<task_id>", "Task id.")
+        .option("--title <title>", "Replacement title.")
+        .option("--body <body>", "Replacement description. Pass an empty string to clear it.")
+        .option("--status <status>", "open, completed or cancelled.")
+        .option("--priority <priority>", "urgent, high, medium, low, or an empty string to clear it.")
+        .option("--due <iso>", "ISO-8601 due timestamp, or an empty string to clear the deadline.")
+        .option("--assignee <email>", "Workspace member by email (a user id also works), or an empty string to unassign.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (taskId, options) => {
+        await handleAsyncAction("crm tasks update", options, () => {
+            // Absent flag: leave the field alone. Empty string: clear it.
+            // The two must stay distinguishable all the way to the route.
+            const body = readClearableOption(options.body);
+            const priority = readClearableOption(options.priority);
+            const due = readClearableOption(options.due);
+            const assignee = readClearableOption(options.assignee);
+            return requestOxygen(`/api/cli/crm/tasks/${encodeURIComponent(taskId)}`, {
+                method: "PATCH",
+                body: {
+                    ...(readOption(options.title) ? { title: readOption(options.title) } : {}),
+                    ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
+                    ...(body !== undefined ? { body } : {}),
+                    ...(priority !== undefined ? { priority } : {}),
+                    ...(due !== undefined ? { due_at: due } : {}),
+                    ...(assignee !== undefined ? { assignee_actor_id: assignee } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("complete")
+        .description("Mark a task done. Completing an already-completed task keeps the original completion time and adds no second timeline entry.")
+        .argument("<task_id>", "Task id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (taskId, options) => {
+        await handleAsyncAction("crm tasks complete", options, () => requestOxygen(`/api/cli/crm/tasks/${encodeURIComponent(taskId)}`, {
+            method: "PATCH",
+            body: { status: "completed" },
+        }));
+    }))
+        .addCommand(new Command("reopen")
+        .description("Reopen a completed task, clearing its completion stamp.")
+        .argument("<task_id>", "Task id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (taskId, options) => {
+        await handleAsyncAction("crm tasks reopen", options, () => requestOxygen(`/api/cli/crm/tasks/${encodeURIComponent(taskId)}`, {
+            method: "PATCH",
+            body: { status: "open" },
+        }));
+    })))
+        .addCommand(new Command("notes")
+        .description("Read and write a CRM record's notes. A note is editable, pinnable and authored \u2014 and still lands on the record's timeline.")
+        .addCommand(new Command("list")
+        .description("List one record's notes, pinned first then newest. Address the record by row id OR by any of the object's identities.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--limit <n>", "Maximum notes to return. Defaults to 25.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm notes list", options, () => requestOxygen(buildCrmNotesPath(object, rowId, options)));
+    }))
+        .addCommand(new Command("add")
+        .description("Write a note on a CRM record. Free, internal, and editable afterwards, so it writes immediately rather than previewing first. The returned web_url opens THIS note on the record (?tab=notes&note=<id>) — hand that one to the user, not the bare record link.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .argument("<body>", "Note text. Markdown.")
+        .option("--title <title>", "Optional note title.")
+        .option("--pin", "Pin the note to the top of the record's notes.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, body, options) => {
+        await handleAsyncAction("crm notes add", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/notes`, {
+            method: "POST",
+            body: {
+                body,
+                ...(readOption(options.title) ? { title: readOption(options.title) } : {}),
+                ...(options.pin ? { pinned: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("update")
+        .description("Edit a note's body, title or pin. Addressed by note id because one note can be filed on several records.")
+        .argument("<note_id>", "Note id.")
+        .option("--body <body>", "Replacement note text.")
+        .option("--title <title>", "Replacement title. Pass an empty string to clear it.")
+        .option("--pin", "Pin the note.")
+        .option("--unpin", "Unpin the note.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (noteId, options) => {
+        await handleAsyncAction("crm notes update", options, () => {
+            return requestOxygen(`/api/cli/crm/notes/${encodeURIComponent(noteId)}`, {
+                method: "PATCH",
+                body: readCrmNoteEditFields(options),
+            });
+        });
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a note. Soft: the note stops showing its text while its place in the timeline stays, so the record still shows that a note was written and removed.")
+        .argument("<note_id>", "Note id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (noteId, options) => {
+        await handleAsyncAction("crm notes delete", options, () => requestOxygen(`/api/cli/crm/notes/${encodeURIComponent(noteId)}`, { method: "DELETE" }));
+    })))
+        .addCommand(new Command("related")
+        .description("Show the records linked to one CRM record, grouped by relationship with a true count per group. Address the record by row id OR by any of the object's identities \u2014 a company domain, a person's email or LinkedIn URL.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--preview-limit <n>", "Linked records to preview per group. Defaults to 6, max 50. The count is always the real total.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm related", options, () => requestOxygen(buildCrmRelatedPath(object, rowId, options)));
+    }))
+        .addCommand(new Command("tag")
+        .description("Add/remove workspace tags on one CRM record (Tags primitive — the same vocabulary as sequences, tables, conversations; see `oxygen tags list`). Delta semantics: --add unions, --remove subtracts, remove wins. Standard objects carry the tags attribute after `oxygen crm setup`.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .option("--add <tags>", "Comma-separated tags to add.")
+        .option("--remove <tags>", "Comma-separated tags to remove.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm tag", options, () => {
+            const add = splitCommaList(options.add);
+            const remove = splitCommaList(options.remove);
+            if (add.length === 0 && remove.length === 0) {
+                throw new OxygenError("invalid_request", "Pass --add and/or --remove.", { exitCode: 1 });
+            }
+            return requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/tags`, {
+                method: "POST",
+                body: {
+                    ...(add.length > 0 ? { add } : {}),
+                    ...(remove.length > 0 ? { remove } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("keep")
+        .description("Keep one sample record as real. A new workspace starts with sample companies, CEOs and deals: their reads carry `_sample: true` (`sample: true` on `crm pipeline` deals) and pipeline totals leave them out. Keep one only when it is real; it then counts like any record. Linked records stay as they are: a kept sample deal's company and contact stay samples until each is kept. Free and idempotent, no undo.")
+        .argument("<object>", "CRM object slug: companies, people or deals.")
+        .argument("<record>", "Row id (`crm pipeline` lists each deal's), or an identity value such as stripe.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, record, options) => {
+        await handleAsyncAction("crm keep", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(record)}/keep`, { method: "POST" }));
+    }))
+        .addCommand(new Command("relationships")
+        .description("Define CRM relationships and manage record relationship edges.")
+        .addCommand(new Command("define")
+        .description("Define a relationship (and its relation column) from a custom object to any object. Defaults to dry-run.")
+        .argument("<object>", "Source CRM object slug. Must be a custom object, such as projects.")
+        .argument("<slug>", "Relationship slug — also the relation column key on the source, such as client.")
+        .requiredOption("--target-object <object>", "Target CRM object slug, custom or standard (companies, people, deals, ...).")
+        .option("--display-name <name>", "Display name for the relation column. Defaults to the slug in Title Case.")
+        .option("--cardinality <cardinality>", "one_to_one, one_to_many, many_to_one, or many_to_many (source:target). Default many_to_many. one_to_many means each source record links many targets and each target links back to one source.")
+        .option("--inverse-slug <slug>", "Inverse relationship slug on the target. On a custom target this also creates the inverse relation column.")
+        .option("--inverse-display-name <name>", "Display name for the inverse side.")
+        .option("--dry-run", "Preview the relationship definition without writing.")
+        .option("--live", "Apply the definition. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, slug, options) => {
+        await handleAsyncAction("crm relationships define", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/relationships`, {
+            method: "POST",
+            body: {
+                relationship: {
+                    slug,
+                    target_object: options.targetObject,
+                    ...(options.displayName ? { display_name: options.displayName } : {}),
+                    ...(options.cardinality ? { cardinality: options.cardinality } : {}),
+                    ...(options.inverseSlug ? { inverse_slug: options.inverseSlug } : {}),
+                    ...(options.inverseDisplayName ? { inverse_display_name: options.inverseDisplayName } : {}),
+                },
+                mode: options.live ? "live" : "dry_run",
+            },
+        }));
+    }))
+        .addCommand(new Command("upsert")
+        .description("Create or replace a CRM relationship edge. Defaults to dry-run.")
+        .argument("<object>", "Source CRM object slug, such as companies or people.")
+        .argument("<row_id>", "Source CRM record row id.")
+        .requiredOption("--relationship <slug>", "Relationship slug from the source object, such as team or company.")
+        .option("--target-object <object>", "Target CRM object slug. Optional when the relationship has one target.")
+        .requiredOption("--target-row-id <row_id>", "Target CRM record row id.")
+        .option("--role <role>", "Buying-committee role for a deals.stakeholders link: champion, economic_buyer, decision_maker, influencer, or end_user.")
+        .option("--dry-run", "Preview the relationship write without changing edges.")
+        .option("--live", "Apply the relationship write. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm relationships upsert", options, () => requestOxygen("/api/cli/crm/relationships/upsert", {
+            method: "POST",
+            body: buildCrmRelationshipUpsertBody(object, rowId, options),
+        }));
+    })))
+        .addCommand(new Command("activity")
+        .description("Log and read CRM record timeline activities.")
+        .addCommand(new Command("log")
+        .description("Log a timeline activity on a CRM record. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .requiredOption("--type <type>", "Activity type, such as note, call, meeting_booked, stage_changed.")
+        .option("--summary <summary>", "Short one-line summary of the activity.")
+        .option("--body <body>", "Longer activity body or details.")
+        .option("--channel <channel>", "Channel, such as email, linkedin, or phone.")
+        .option("--direction <direction>", "inbound, outbound, internal, or system.")
+        .option("--occurred-at <iso>", "ISO-8601 timestamp the activity occurred. Defaults to now.")
+        .option("--role <role>", "Link role for the record. Defaults to actor.")
+        .option("--source-provider <provider>", "Provider that produced the activity (for idempotency).")
+        .option("--provider-event-id <id>", "Provider event id (dedupes redelivered events).")
+        .option("--metadata-json <json>", "JSON object of extra activity metadata.")
+        .option("--dry-run", "Preview the activity without writing it.")
+        .option("--live", "Write the activity. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm activity log", options, () => requestOxygen("/api/cli/crm/activities", {
+            method: "POST",
+            body: buildCrmActivityBody(object, rowId, options),
+        }));
+    }))
+        .addCommand(new Command("note")
+        .description("Log a free-text note on a CRM record. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .argument("<text>", "Note text.")
+        .option("--dry-run", "Preview the note without writing it.")
+        .option("--live", "Write the note. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, text, options) => {
+        await handleAsyncAction("crm activity note", options, () => requestOxygen("/api/cli/crm/activities", {
+            method: "POST",
+            body: buildCrmActivityNoteBody(object, rowId, text, options),
+        }));
+    }))
+        .addCommand(new Command("timeline")
+        .description("Show a CRM record's activity timeline, newest first. Address the record by row id OR by any of the object's identities \u2014 a company domain, a person's email or LinkedIn URL.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<record>", "CRM record row id, or an identity value such as acme.com or sarah@acme.com.")
+        .option("--limit <limit>", "Maximum activities to return.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm activity timeline", options, () => requestOxygen(buildCrmTimelinePath(object, rowId, options)));
+    })))
+        .addCommand(new Command("describe")
+        .description("Describe one configured CRM object: its fields, identities and relationships. Pass --field <key> to read just one field (its name, type, choices, flags) instead of the whole object. Custom slugs accept hyphens. A deleted custom object answers crm_object_not_found with state archived; its next step, `crm objects delete <slug> --dry-run`, shows the purge time.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .option("--field <key>", "Narrow the answer to one field by its key, e.g. --field pipeline_stage. Also accepted as --attribute.")
+        .option("--attribute <key>", "Alias for --field.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options) => {
+        const field = readOption(options.field) ?? readOption(options.attribute);
+        await handleAsyncAction("crm describe", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}${field ? `?attribute=${encodeURIComponent(field)}` : ""}`));
+    }))
+        .addCommand(new Command("duplicates")
+        .description("List ranked duplicate-candidate record pairs for one CRM object (identity-overlap + fuzzy-label). Read-only.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .option("--limit <limit>", "Maximum candidate pairs to return. Defaults to 25, max 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options) => {
+        await handleAsyncAction("crm duplicates", options, () => requestOxygen(buildCrmDuplicatesPath(object, options)));
+    }))
+        .addCommand(new Command("merge")
+        .description("Merge two CRM records: survivor-wins-with-loser-fill field write + relink/tombstone. Defaults to dry-run; --live requires --confirm.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<survivor_row_id>", "Row id of the record to KEEP (older record by default).")
+        .argument("<loser_row_id>", "Row id of the record to MERGE AWAY and tombstone.")
+        .option("--field-overrides-json <json>", "JSON object of resolved field values keyed by column key, overriding survivor-wins-with-loser-fill.")
+        .option("--dry-run", "Preview the field-level diff and relink plan without writing. Default.")
+        .option("--live", "Apply the merge. Requires --confirm.")
+        .option("--confirm", "Confirm the live merge after inspecting the dry-run diff.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, survivorRowId, loserRowId, options) => {
+        await handleAsyncAction("crm merge", options, () => requestOxygen("/api/cli/crm/merge", {
+            method: "POST",
+            body: buildCrmMergeBody(object, survivorRowId, loserRowId, options),
+        }));
+    }))
+        .addCommand(new Command("pipeline")
+        .description("Show the deals pipeline grouped by stage, with per-stage counts and amount totals. Seeded sample deals are listed with `sample: true` but never counted; `samples` reports them.")
+        .option("--pipeline <name>", "Filter to one pipeline, such as sales, expansion, or renewal.")
+        .option("--limit <limit>", "Maximum deals to return per stage.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm pipeline", options, () => requestOxygen(buildCrmPipelinePath(options)));
+    }))
+        .addCommand(new Command("signals")
+        .description("Record inbound GTM intent signals and read the ranked leads-to-contact-today list.")
+        .addCommand(new Command("record")
+        .description("Record one inbound GTM signal (website_visit, profile_view, post_engager, new_follower) into the CRM. Internal write — free, no approval. Idempotent on --external-event-id.")
+        .requiredOption("--event <event>", "Signal event: website_visit | profile_view | post_engager | new_follower.")
+        .option("--external-event-id <id>", "Stable provider event id (redelivery/idempotency guard). Derived from --session-id when omitted.")
+        .option("--email <email>", "Person email (identity).")
+        .option("--linkedin-url <url>", "Person LinkedIn URL (identity when no email).")
+        .option("--company-domain <domain>", "Company domain for the company assert.")
+        .option("--company-name <name>", "Company name.")
+        .option("--first-name <name>", "Person first name.")
+        .option("--last-name <name>", "Person last name.")
+        .option("--page-url <url>", "Page the signal fired on (website visit).")
+        .option("--session-id <id>", "Provider session id (provenance + idempotency).")
+        .option("--payload-json <json>", "JSON object merged into the signal payload (wins over the flags above).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm signals record", options, () => requestOxygen("/api/cli/crm/signals", {
+            method: "POST",
+            body: buildCrmSignalRecordBody(options),
+        }));
+    }))
+        .addCommand(new Command("leads-today")
+        .description("List people to contact today, ranked by their most recent GTM intent signal. When the output has rankedBy, equal signals are ordered by the company's ICP fit (see each lead's fit). Do-not-contact filtering is best-effort (email-only leads surface unchecked).")
+        .option("--limit <limit>", "Maximum leads to return. Defaults to 25, max 100.")
+        .option("--within-days <days>", "Signal look-back window in days. Defaults to 7, max 30.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm signals leads-today", options, () => requestOxygen(buildCrmLeadsTodayPath(options)));
+    })))
+        .addCommand(new Command("automation")
+        .description("Arm / disarm standing CRM automation templates and read the audit trail.")
+        .addCommand(new Command("rules")
+        .description("List the standing CRM automation templates and their armed state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm automation rules", options, () => requestOxygen("/api/cli/crm/automation"));
+    }))
+        .addCommand(new Command("set")
+        .description("Arm or disarm a standing CRM automation template. Defaults to dry-run. crm-lead-stage-router (replies → CRM person + lead stage) is armed automatically the first time a sequence goes live; --disarmed is the explicit off switch, and a disarmed template is never re-armed automatically.")
+        .argument("<template-id>", "Template id, such as crm-lead-stage-router.")
+        .option("--armed", "Arm the template (let bridged signals advance stages).")
+        .option("--disarmed", "Disarm the template.")
+        .option("--config-json <json>", "JSON object of per-template config.")
+        .option("--dry-run", "Preview the change without writing it.")
+        .option("--live", "Write the change. Default is dry-run.")
+        .option("--approved", "Approve standing tool authority when arming live after inspecting the dry-run preview.")
+        .option("--max-credits <n>", "Positive credit ceiling for each event delivery when arming live.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("crm automation set", options, () => requestOxygen("/api/cli/crm/automation", {
+            method: "POST",
+            body: buildCrmAutomationSetBody(templateId, options),
+        }));
+    }))
+        .addCommand(new Command("audit")
+        .description("Show recent CRM automation rule changes, newest first.")
+        .option("--template-id <id>", "Filter to one template id.")
+        .option("--limit <limit>", "Maximum audit entries to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm automation audit", options, () => requestOxygen(buildCrmAutomationAuditPath(options)));
+    })))
+        .addCommand(new Command("sync")
+        .description("Sync or import a connected CRM with Oxygen CRM objects: import records (HubSpot/Attio/Pipedrive), configure a standing two-way sync (HubSpot/Attio), run a reconciliation cycle, and inspect runs and provider links.")
+        .addCommand(new Command("import")
+        .description("Import provider records into an Oxygen CRM object (canonical CRM truth) as a durable workflow run. Defaults to dry-run. This pulls the WHOLE object and has no list/segment filter; to import one HubSpot saved list or one Pipedrive saved filter into a new table you can filter and enrich, use `oxygen tables hubspot import` or `oxygen tables pipedrive import` instead.")
+        .argument("<provider>", "Connected CRM to import from: hubspot, attio, or pipedrive.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, attio people|companies, or pipedrive persons|organizations|deals. Import Pipedrive persons and organizations before deals so each deal links to them.")
+        .option("--into <object>", "Oxygen CRM object slug to import into. Defaults to the natural mapping.")
+        .option("--limit <n>", "Max records to pull this run.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling for the run. Review the current quote: own-API-key calls cost 0.05 credits each after repricing takes effect; OAuth follows its tool quote. Workflow steps count toward the ceiling after repricing takes effect. Use --limit for rows; provider billing and API quota are separate.")
+        .option("--approved", "Confirm a live import after inspecting a dry run.")
+        .option("--dry-run", "Preview the import without pulling. Default.")
+        .option("--live", "Run the live import. Requires --approved and --max-credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (provider, options) => {
+        await handleAsyncAction("crm sync import", options, () => requestOxygen("/api/cli/crm/sync/import", {
+            method: "POST",
+            body: buildCrmSyncImportBody(provider, options),
+        }));
+    }))
+        .addCommand(new Command("configure")
+        .description("Configure a standing bidirectional sync for one CRM object pair. Defaults to dry-run, which returns a real preview of the next cycle; inbound and bidirectional previews perform bounded CRM provider reads and may use external API quota.")
+        .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
+        .option("--direction <direction>", "Sync direction: inbound, outbound, or bidirectional. Defaults to bidirectional.")
+        .option("--cron <cron>", "Cron expression for the scheduled reconciliation cadence, e.g. '*/15 * * * *'.")
+        .option("--timezone <tz>", "IANA timezone the cron schedule runs in, e.g. America/New_York. Defaults to UTC.")
+        .option("--max-rows <n>", "Per-cycle row cap, separate from the --max-credits OXYGEN spend ceiling. OAuth provider calls follow their tool quote; own-API-key calls and live Workflow steps have separate charges.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
+        .option("--field-mappings-json <json>", "HubSpot custom-property mappings as a JSON array of {oxygen_field, provider_field, direction}. Pass [] to clear; canonical identity/name mappings stay fixed.")
+        .option("--approved", "Confirm a live configuration after inspecting a dry run.")
+        .option("--dry-run", "Preview the configuration and next cycle without writing. Inbound/bidirectional previews perform bounded CRM reads and may use external API quota. Default.")
+        .option("--live", "Write the configuration. Requires --approved and --max-credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm sync configure", options, () => requestOxygen("/api/cli/crm/sync/configure", {
+            method: "POST",
+            body: buildCrmSyncConfigureBody(options),
+        }));
+    }))
+        .addCommand(new Command("run")
+        .description("Run one bidirectional reconciliation cycle for a configured CRM object pair as a durable workflow run. Defaults to dry-run.")
+        .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
+        .option("--direction <direction>", "Override this cycle's direction: inbound, outbound, or bidirectional.")
+        .option("--since <iso>", "Read provider changes since this watermark.")
+        .option("--config-id <id>", "Use this standing CRM sync configuration for the cycle.")
+        .option("--max-rows <n>", "Per-cycle row cap, separate from the --max-credits OXYGEN spend ceiling. OAuth provider calls follow their tool quote; own-API-key calls and live Workflow steps have separate charges.")
+        .option("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
+        .option("--approved", "Confirm a live cycle after inspecting a dry run.")
+        .option("--dry-run", "Preview the cycle without pulling or pushing. Default.")
+        .option("--live", "Run the live reconciliation cycle. Requires --approved and --max-credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm sync run", options, () => requestOxygen("/api/cli/crm/sync/run", {
+            method: "POST",
+            body: buildCrmSyncRunBody(options),
+        }));
+    }))
+        .addCommand(new Command("enable")
+        .description("Enable continuous (scheduled) bidirectional sync for one CRM object pair: arms the cron trigger + the standing write permission, and runs an immediate first cycle. Always live — requires --approved, --max-credits, and --max-rows.")
+        .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
+        .option("--direction <direction>", "Sync direction: inbound, outbound, or bidirectional. Defaults to bidirectional.")
+        .option("--cron <cron>", "Cron expression for the cadence, e.g. '*/15 * * * *'. Defaults to every 15 minutes.")
+        .option("--timezone <tz>", "IANA timezone the cron runs in. Defaults to UTC.")
+        .requiredOption("--max-rows <n>", "Per-cycle row cap — the volume brake on provider writes (required).")
+        .requiredOption("--max-credits <n>", "OXYGEN credit ceiling per cycle. Provider/data-read fees count toward it; Workflow steps count after repricing takes effect. Provider billing and API quota are separate.")
+        .option("--field-mappings-json <json>", "HubSpot custom-property mappings as a JSON array of {oxygen_field, provider_field, direction}. Omit to preserve the configured mappings.")
+        .option("--approved", "Confirm enabling scheduled provider writes after inspecting a dry run.")
+        .option("--no-run-now", "Do not run an immediate first cycle after enabling.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm sync enable", options, () => requestOxygen("/api/cli/crm/sync/enable", {
+            method: "POST",
+            body: buildCrmSyncEnableBody(options),
+        }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disable the scheduled sync for one CRM object pair: stops the cron trigger and revokes the standing write permission. The standing config (direction, cadence, mappings, watermarks) is preserved for re-enable.")
+        .requiredOption("--provider <provider>", "Connected CRM: hubspot or attio.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm sync disable", options, () => requestOxygen("/api/cli/crm/sync/disable", {
+            method: "POST",
+            body: buildCrmSyncDisableBody(options),
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show a CRM sync status: pass --run-id for one workflow run, or --provider/--object for the standing sync config (cadence, watermarks, last-cycle counts).")
+        .argument("[run_id]", "Workflow run id. Equivalent to --run-id.")
+        .option("--run-id <id>", "Workflow run id to read a single run.")
+        .option("--provider <provider>", "Connected CRM (hubspot|attio) for a standing-config read. Use with --object.")
+        .option("--object <object>", "Provider object for a standing-config read. Use with --provider.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        const resolved = {
+            ...options,
+            ...(runId !== undefined && readOption(options.runId) === null ? { runId } : {}),
+        };
+        await handleAsyncAction("crm sync status", resolved, () => requestOxygen(buildCrmSyncConfigStatusPath(resolved)));
+    }))
+        .addCommand(new Command("links")
+        .description("Show provider record links (HubSpot/Attio/Pipedrive ids) mapped to one Oxygen CRM record.")
+        .argument("<object>", "Oxygen CRM object slug, such as companies or people.")
+        .argument("<row_id>", "Oxygen CRM record row id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm sync links", options, () => requestOxygen(buildCrmSyncLinksPath(object, rowId)));
+    })))
+        .addCommand(new Command("enrichment")
+        .description("Choose which named enrichments run automatically on new CRM records. The saved set is a STANDING PERMISSION: every record written to the object (imports, inserts, upserts, and `crm assert`) enriches without per-record approval, bounded by the per-batch credit ceiling. Same storage as `oxygen tables auto-run`, in founder words.")
+        .addCommand(addContractFlags(new Command("list")
+        .description("Show the enrichments available per CRM object: which are armed, what each costs per record, the per-record total, the per-batch credit ceiling, how much of the column allowance is spent, and how many records already in the object have never been enriched. Read-only, free.")
+        .option("--json", "Print a JSON envelope."), CRM_ENRICHMENT_READ_CONTRACT, CRM_ENRICHMENT_READ_FLAGS)
+        .action(async (options) => {
+        if (options.projection === "summary" || options.projection === "value")
+            await handleAsyncAction("crm enrichment list", options, () => requestOxygen(buildCrmEnrichmentListPath(options)));
+        else
+            await handleCrmEnrichmentAction("crm enrichment list", options, () => requestOxygen(buildCrmEnrichmentListPath(options)));
+    }))
+        .addCommand(new Command("backfill")
+        .description("Enrich the records you ALREADY have. Arming an enrichment only covers records written from that moment on, so the companies and people already in your CRM stay blank until you run this. Previews for free by default: what is still missing, what one batch costs, and what finishing costs. Add --live --approved --max-credits to actually run a batch; repeat it and the next batch picks up where the last one stopped.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .option("--presets <csv>", "Comma-separated enrichment ids to backfill. Defaults to whatever is armed on the object.")
+        .option("--limit <n>", "How many records this batch enriches. Defaults to 50, max 5000.")
+        .option("--all", "Enrich every record still missing these enrichments, up to 5000 in one batch. Costs the whole `to finish` figure the preview quotes.")
+        .option("--live", "Actually run the batch. Without it this is a free preview that spends nothing.")
+        .option("--approved", "Approve THIS batch after reading the preview. A live paid batch fails with approval_required (exit 7) without it.")
+        .option("--max-credits <n>", "Credit ceiling for this batch. Records beyond it are skipped with credit_limit_reached — the preview says how many that would be. Required for a live paid batch; unused credits are not spent.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCrmEnrichmentBackfill(options);
+    }))
+        .addCommand(new Command("enable")
+        .description("Arm one enrichment on a CRM object and leave every other choice untouched. Takes effect immediately as a standing permission: new records enrich without per-record approval, capped per batch by the object's credit ceiling.")
+        .argument("<preset>", "Enrichment id from `oxygen crm enrichment list`, such as company_linkedin_profile.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (preset, options) => {
+        await handleCrmEnrichmentAction("crm enrichment enable", options, () => requestOxygen("/api/cli/crm/enrichment", {
+            method: "POST",
+            body: buildCrmEnrichmentDeltaBody(preset, options, "enable"),
+        }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disarm one enrichment on a CRM object and leave every other choice untouched. New records stop running its columns; already-written values stay.")
+        .argument("<preset>", "Enrichment id from `oxygen crm enrichment list`.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (preset, options) => {
+        await handleCrmEnrichmentAction("crm enrichment disable", options, () => requestOxygen("/api/cli/crm/enrichment", {
+            method: "POST",
+            body: buildCrmEnrichmentDeltaBody(preset, options, "disable"),
+        }));
+    }))
+        .addCommand(new Command("set")
+        .description("Replace the armed enrichment set for a CRM object outright — any preset not listed is disarmed, while columns you added to the config yourself are kept. The saved set is a standing permission: new records enrich without per-record approval, and --max-credits is the ceiling each write batch may spend. An empty --presets list is the full disarm that `off` spells.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .requiredOption("--presets <csv>", "Comma-separated enrichment ids to arm. Pass an empty value to disarm everything (same as `crm enrichment off`).")
+        .option("--max-credits <n|auto>", "Credit ceiling PER enqueued batch; records beyond it are skipped with credit_limit_reached. Pass auto to fall back to your plan's per-delivery default. Omit to keep the current ceiling.")
+        .option("--force", "Re-run the enrichment columns even when the target cell already has a value.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCrmEnrichmentAction("crm enrichment set", options, () => requestOxygen("/api/cli/crm/enrichment", {
+            method: "POST",
+            body: buildCrmEnrichmentSetBody(options),
+        }));
+    }))
+        .addCommand(new Command("off")
+        .description("Turn automatic enrichment off for a CRM object: revokes the standing permission and clears the WHOLE configuration — every named preset plus any columns you added to it yourself, so nothing keeps spending after you turn it off. New records are written without enrichment; existing values stay. To drop one preset and keep the rest, use `disable` instead.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCrmEnrichmentAction("crm enrichment off", options, () => requestOxygen("/api/cli/crm/enrichment", {
+            method: "POST",
+            body: { object: readOption(options.object) ?? "", presets: [] },
+        }));
+    })));
+}