@oxygen-agent/cli 1.177.1 → 1.209.6

package/dist/index.js

@@ -1,5 +1,3 @@
-#!/usr/bin/env node
-// skipcq: JS-0271 — bin entry source; build chmod+x on dist/index.js
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -9,7 +7,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, Option } from "commander";
-import { formatCellForDisplay, OXYGEN_VERSION, OxygenError, success, toFailure } from "@oxygen/shared";
+import { formatCellForDisplay, formatPublicBudgetScopes, OXYGEN_VERSION, OxygenError, success, toFailure, } from "@oxygen/shared";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
@@ -374,6 +372,43 @@ function resolveCrmSetupMode(options) {
     }
     return options.live === true ? "live" : "dry_run";
 }
+function buildCrmObjectCreateBody(options) {
+    const slug = readOption(options.slug);
+    if (!slug) {
+        throw new OxygenError("missing_slug", "--slug is required.", { exitCode: 1 });
+    }
+    const displayName = readOption(options.displayName);
+    if (!displayName) {
+        throw new OxygenError("missing_display_name", "--display-name is required.", { exitCode: 1 });
+    }
+    const columns = options.columnsJson ? parseJsonArray(options.columnsJson) : [];
+    const identities = options.identitiesJson ? parseJsonArray(options.identitiesJson) : [];
+    return {
+        slug,
+        display_name: displayName,
+        columns,
+        identities,
+        mode: resolveCrmSetupMode(options),
+        ...(readOption(options.singularName) ? { singular_name: readOption(options.singularName) } : {}),
+        ...(readOption(options.pluralName) ? { plural_name: readOption(options.pluralName) } : {}),
+        ...(readOption(options.labelColumn) ? { label_column: readOption(options.labelColumn) } : {}),
+        ...(options.relationshipsJson ? { relationships: parseJsonArray(options.relationshipsJson) } : {}),
+        ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+    };
+}
+function buildCrmObjectAddAttrBody(options) {
+    const column = readOption(options.columnJson)
+        ? parseJsonObject(options.columnJson)
+        : null;
+    if (!column) {
+        throw new OxygenError("missing_column", "--column-json is required.", { exitCode: 1 });
+    }
+    return {
+        column,
+        mode: resolveCrmSetupMode(options),
+        ...(options.asIdentityJson ? { identity: parseJsonObject(options.asIdentityJson) } : {}),
+    };
+}
 function buildCrmAssertBody(object, options) {
     return {
         object,
@@ -382,6 +417,81 @@ function buildCrmAssertBody(object, options) {
         mode: resolveCrmSetupMode(options),
     };
 }
+function buildCrmSyncImportBody(provider, options) {
+    return {
+        provider,
+        object: options.object,
+        mode: resolveCrmSetupMode(options),
+        ...(options.into ? { into: options.into } : {}),
+        ...(readPositiveInt(options.limit) !== undefined ? { limit: readPositiveInt(options.limit) } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
+function buildCrmSyncStatusPath(runId) {
+    const params = new URLSearchParams();
+    params.set("run_id", runId);
+    return `/api/cli/crm/sync/status?${params.toString()}`;
+}
+function buildCrmSyncLinksPath(object, rowId) {
+    const params = new URLSearchParams();
+    params.set("object", object);
+    params.set("row_id", rowId);
+    return `/api/cli/crm/sync/links?${params.toString()}`;
+}
+function buildCrmSearchBody(query, options) {
+    const objects = readCsvOption(options.objects);
+    const limit = readPositiveInt(options.limit);
+    return {
+        query,
+        ...(objects.length > 0 ? { objects } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+    };
+}
+function buildCrmMergeBody(object, survivorRowId, loserRowId, options) {
+    const mode = resolveCrmSetupMode(options);
+    if (mode === "live" && options.confirm !== true) {
+        throw new OxygenError("confirm_required", "crm merge --live requires --confirm after inspecting the dry-run field diff.", { exitCode: 1 });
+    }
+    return {
+        object,
+        survivor_row_id: survivorRowId,
+        loser_row_id: loserRowId,
+        mode,
+        ...(options.confirm === true ? { confirm: true } : {}),
+        ...(options.fieldOverridesJson ? { field_overrides: parseJsonObject(options.fieldOverridesJson) } : {}),
+    };
+}
+function buildNotetakerSetupBody(options) {
+    return {
+        mode: resolveNotetakerMode(options),
+        enabled: options.disabled === true ? false : true,
+        capture_mode: "invited_bot",
+        auto_record_scope: "manual",
+        ...(readOption(options.botName) ? { bot_name: readOption(options.botName) } : {}),
+        ...(readPositiveInt(options.defaultMaxMinutes) ? { default_max_minutes: readPositiveInt(options.defaultMaxMinutes) } : {}),
+        ...(readPositiveNumber(options.defaultMaxCredits) ? { default_max_credits: readPositiveNumber(options.defaultMaxCredits) } : {}),
+        ...(readPositiveInt(options.retentionDays) ? { retention_days: readPositiveInt(options.retentionDays) } : {}),
+    };
+}
+function buildNotetakerScheduleBody(meetingUrl, options) {
+    return {
+        mode: resolveNotetakerMode(options),
+        meeting_url: meetingUrl,
+        approved: options.approved === true,
+        ...(readOption(options.title) ? { title: readOption(options.title) } : {}),
+        ...(readOption(options.joinAt) ? { join_at: readOption(options.joinAt) } : {}),
+        ...(readPositiveInt(options.maxMinutes) ? { max_minutes: readPositiveInt(options.maxMinutes) } : {}),
+        ...(readPositiveNumber(options.maxCredits) ? { max_credits: readPositiveNumber(options.maxCredits) } : {}),
+        ...(readOption(options.crmLinksJson) ? { crm_links: parseJsonArray(readOption(options.crmLinksJson) ?? "") } : {}),
+    };
+}
+function resolveNotetakerMode(options) {
+    if (options.live === true && options.dryRun === true) {
+        throw new OxygenError("conflicting_flags", "Pass either --live or --dry-run, not both.", { exitCode: 1 });
+    }
+    return options.live === true ? "live" : "dry_run";
+}
 function buildCrmRelationshipUpsertBody(object, rowId, options) {
     return {
         object,
@@ -394,6 +504,122 @@ function buildCrmRelationshipUpsertBody(object, rowId, options) {
         mode: resolveCrmSetupMode(options),
     };
 }
+function buildCrmActivityBody(object, rowId, options) {
+    const body = {
+        mode: resolveCrmSetupMode(options),
+        activity_type: options.type,
+        links: [{ object, row_id: rowId, role: options.role ?? "actor" }],
+    };
+    if (options.summary)
+        body.summary = options.summary;
+    if (options.body)
+        body.body = options.body;
+    if (options.channel)
+        body.channel = options.channel;
+    if (options.direction)
+        body.direction = options.direction;
+    if (options.occurredAt)
+        body.occurred_at = options.occurredAt;
+    if (options.sourceProvider)
+        body.source_provider = options.sourceProvider;
+    if (options.providerEventId)
+        body.provider_event_id = options.providerEventId;
+    if (options.metadataJson)
+        body.metadata = parseJsonObject(options.metadataJson);
+    return body;
+}
+function buildCrmActivityNoteBody(object, rowId, text, options) {
+    return {
+        mode: resolveCrmSetupMode(options),
+        activity_type: "note",
+        summary: text,
+        links: [{ object, row_id: rowId, role: "actor" }],
+    };
+}
+function buildCrmTimelinePath(object, rowId, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    if (options.cursor)
+        params.set("cursor", options.cursor);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}/timeline`;
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmPipelinePath(options) {
+    const params = new URLSearchParams();
+    if (readOption(options.pipeline))
+        params.set("pipeline", readOption(options.pipeline));
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    return query ? `/api/cli/crm/pipeline?${query}` : "/api/cli/crm/pipeline";
+}
+function buildCrmDuplicatesPath(object, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    const base = `/api/cli/crm/objects/${encodeURIComponent(object)}/duplicates`;
+    return query ? `${base}?${query}` : base;
+}
+function buildCrmAutomationSetBody(templateId, options) {
+    if (options.armed === true && options.disarmed === true) {
+        throw new OxygenError("conflicting_flags", "Pass either --armed or --disarmed, not both.", { exitCode: 1 });
+    }
+    if (options.armed !== true && options.disarmed !== true) {
+        throw new OxygenError("missing_flag", "Pass --armed or --disarmed.", { exitCode: 1 });
+    }
+    const body = {
+        template_id: templateId,
+        armed: options.armed === true,
+        mode: resolveCrmSetupMode(options),
+    };
+    if (options.configJson)
+        body.config = parseJsonObject(options.configJson);
+    return body;
+}
+function buildCrmAutomationAuditPath(options) {
+    const params = new URLSearchParams();
+    if (readOption(options.templateId))
+        params.set("template_id", readOption(options.templateId));
+    if (options.limit)
+        params.set("limit", options.limit);
+    const query = params.toString();
+    return query ? `/api/cli/crm/automation/audit?${query}` : "/api/cli/crm/automation/audit";
+}
+function buildCrmListCreateBody(slug, options) {
+    const body = {
+        slug,
+        base_object: options.base,
+        kind: options.kind,
+        mode: resolveCrmSetupMode(options),
+    };
+    if (options.displayName)
+        body.display_name = options.displayName;
+    if (options.project)
+        body.project = options.project;
+    if (options.filterJson)
+        body.filter = parseJsonObject(options.filterJson);
+    return body;
+}
+function buildCrmListEntryBody(object, rowId, options) {
+    return {
+        object,
+        row_id: rowId,
+        mode: resolveCrmSetupMode(options),
+    };
+}
+function buildCrmListMembersPath(list, options) {
+    const params = new URLSearchParams();
+    if (options.limit)
+        params.set("limit", options.limit);
+    if (options.cursor)
+        params.set("cursor", options.cursor);
+    const query = params.toString();
+    const base = `/api/cli/crm/lists/${encodeURIComponent(list)}/members`;
+    return query ? `${base}?${query}` : base;
+}
 function parseCrmIdentityOption(value) {
     const separator = value.indexOf("=");
     if (separator <= 0 || separator === value.length - 1) {
@@ -416,6 +642,10 @@ function readSpecFileBody(path) {
         throw error;
     }
 }
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+    return UUID_PATTERN.test(value);
+}
 // Builds the `prompts` command tree (list/get/upsert/archive). The
 // deprecated `templates` alias is the identical tree — same subcommands,
 // options, request bodies, and routes — differing only in the parent command
@@ -450,7 +680,7 @@ function buildPromptTemplatesCommand(surface, description) {
         .action(async (idOrSlug, options) => {
         await handleAsyncAction(`${surface} get`, options, () => requestOxygen("/api/cli/templates/get", {
             method: "POST",
-            body: idOrSlug.includes("-") && idOrSlug.length >= 32
+            body: isUuid(idOrSlug)
                 ? { id: idOrSlug }
                 : { slug: idOrSlug },
         }));
@@ -809,6 +1039,24 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
+    }))
+        .addCommand(new Command("get")
+        .description("Show one support ticket with its message thread (staff only).")
+        .argument("<ticketId>", "Ticket UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin get", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`));
+    }))
+        .addCommand(new Command("reply")
+        .description("Add a staff message to a support ticket without resolving it.")
+        .argument("<ticketId>", "Ticket UUID.")
+        .requiredOption("--body <body>", "Reply body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleAsyncAction("support admin reply", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/messages`, {
+            method: "POST",
+            body: { body: readOption(options.body) },
+        }));
     }))
         .addCommand(new Command("resolve")
         .description("Resolve a support ticket and notify the opener (staff only).")
@@ -1004,6 +1252,50 @@ export function createProgram() {
             body: { name },
         }));
     }));
+    program
+        .command("notetaker")
+        .description("AI meeting notetaker setup, scheduling, and session inspection.")
+        .addCommand(new Command("setup")
+        .description("Configure the Recall-backed Oxygen Notetaker. Defaults to dry-run.")
+        .option("--bot-name <name>", "Meeting bot display name. Defaults to Oxygen Notetaker.")
+        .option("--disabled", "Save the notetaker as disabled when used with --live.")
+        .option("--default-max-minutes <n>", "Default maximum meeting minutes to reserve. Defaults to 60.")
+        .option("--default-max-credits <n>", "Default spend cap for live schedules.")
+        .option("--retention-days <n>", "Transcript/artifact retention window. Defaults to 30.")
+        .option("--dry-run", "Preview setup without writing settings.")
+        .option("--live", "Apply notetaker settings.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("notetaker setup", options, () => requestOxygen("/api/cli/notetaker/setup", {
+            method: "POST",
+            body: buildNotetakerSetupBody(options),
+        }));
+    }))
+        .addCommand(new Command("schedule")
+        .description("Schedule an invited meeting bot. Defaults to dry-run.")
+        .argument("<meeting_url>", "Zoom, Google Meet, or Teams meeting URL.")
+        .option("--title <title>", "Meeting title for the CRM timeline.")
+        .option("--join-at <iso>", "ISO date-time for scheduled bot join.")
+        .option("--max-minutes <n>", "Maximum meeting minutes to reserve.")
+        .option("--max-credits <n>", "Required spend cap for live schedules.")
+        .option("--crm-links-json <json>", "JSON array of CRM links: [{\"object\":\"companies\",\"row_id\":\"...\",\"role\":\"account\"}].")
+        .option("--approved", "Approve the live paid Recall bot schedule.")
+        .option("--dry-run", "Preview schedule and credit estimate without creating a bot.")
+        .option("--live", "Create the Recall bot after approval and credit reservation.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (meetingUrl, options) => {
+        await handleAsyncAction("notetaker schedule", options, () => requestOxygen("/api/cli/notetaker/schedule", {
+            method: "POST",
+            body: buildNotetakerScheduleBody(meetingUrl, options),
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Get one notetaker session with artifacts and credit state.")
+        .argument("<session_id>", "Notetaker session id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sessionId, options) => {
+        await handleAsyncAction("notetaker status", options, () => requestOxygen(`/api/cli/notetaker/sessions/${encodeURIComponent(sessionId)}`));
+    }));
     program
         .command("crm")
         .description("Agent-native CRM object setup and metadata commands.")
@@ -1020,11 +1312,67 @@ export function createProgram() {
             body: buildCrmSetupBody(options),
         }));
     }))
-        .addCommand(new Command("objects")
-        .description("List configured CRM objects in the current tenant database.")
+        .addCommand(
+    // `crm objects` lists (parent action runs when no subcommand matches);
+    // `crm objects create` / `crm objects add-attr` create custom objects.
+    new Command("objects")
+        .description("List configured CRM objects, or create/extend custom objects.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("crm objects", options, () => requestOxygen("/api/cli/crm/objects"));
+    })
+        .addCommand(new Command("create")
+        .description("Create or repair a custom CRM object. Defaults to dry-run.")
+        .requiredOption("--slug <slug>", "Object slug (snake_case), such as projects or tasks.")
+        .requiredOption("--display-name <name>", "Human-readable object name, such as Projects.")
+        .requiredOption("--columns-json <json>", "JSON array of column definitions {key,label,dataType,semanticType,...}.")
+        .option("--identities-json <json>", "JSON array of identity definitions {columnKey,normalization,isPrimary?}.")
+        .option("--relationships-json <json>", "JSON array of relationship definitions (not yet supported).")
+        .option("--label-column <key>", "Column key to use as the record label. Defaults to the isRecordLabel column or the first column.")
+        .option("--singular-name <name>", "Singular display name, such as Project.")
+        .option("--plural-name <name>", "Plural display name, such as Projects.")
+        .option("--project <project>", "Project id or slug for the created CRM table.")
+        .option("--dry-run", "Preview the object plan without creating tables.")
+        .option("--live", "Apply the object creation. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options, command) => {
+        // The `crm objects` parent declares its own --json + a default
+        // action, so commander binds `objects create --json` to the parent
+        // and options.json is undefined here. optsWithGlobals() reads --json
+        // wherever it landed, so the envelope is emitted like every other
+        // crm_* command instead of printing the bare result.
+        await handleAsyncAction("crm object create", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen("/api/cli/crm/objects", {
+            method: "POST",
+            body: buildCrmObjectCreateBody(options),
+        }));
+    }))
+        .addCommand(new Command("add-attr")
+        .description("Add one attribute to an existing custom CRM object, optionally as an identity. Defaults to dry-run.")
+        .argument("<object>", "Custom CRM object slug, such as projects or tasks. Standard objects are managed by `crm setup`.")
+        .requiredOption("--column-json <json>", "JSON column definition {key,label,dataType,semanticType,...}.")
+        .option("--as-identity-json <json>", "JSON identity definition {columnKey,normalization,isPrimary?} promoting the new column.")
+        .option("--dry-run", "Preview the attribute plan without altering the table.")
+        .option("--live", "Apply the attribute. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options, command) => {
+        // See `objects create` above: optsWithGlobals() recovers --json,
+        // which the parent command otherwise swallows.
+        await handleAsyncAction("crm object add-attr", { json: Boolean(command.optsWithGlobals().json) }, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/attributes`, {
+            method: "POST",
+            body: buildCrmObjectAddAttrBody(options),
+        }));
+    })))
+        .addCommand(new Command("search")
+        .description("Search CRM records by identity or record label.")
+        .argument("<query>", "Domain, email, LinkedIn URL, or record name to search for.")
+        .option("--objects <objects>", "Comma-separated CRM object slugs to search. Defaults to all configured objects.")
+        .option("--limit <limit>", "Maximum records to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("crm search", options, () => requestOxygen("/api/cli/crm/records/search", {
+            method: "POST",
+            body: buildCrmSearchBody(query, options),
+        }));
     }))
         .addCommand(new Command("assert")
         .description("Create or update one CRM record by object identity. Defaults to dry-run.")
@@ -1065,6 +1413,55 @@ export function createProgram() {
             method: "POST",
             body: buildCrmRelationshipUpsertBody(object, rowId, options),
         }));
+    })))
+        .addCommand(new Command("activity")
+        .description("Log and read CRM record timeline activities.")
+        .addCommand(new Command("log")
+        .description("Log a timeline activity on a CRM record. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .requiredOption("--type <type>", "Activity type, such as note, call, meeting_booked, stage_changed.")
+        .option("--summary <summary>", "Short one-line summary of the activity.")
+        .option("--body <body>", "Longer activity body or details.")
+        .option("--channel <channel>", "Channel, such as email, linkedin, or phone.")
+        .option("--direction <direction>", "inbound, outbound, internal, or system.")
+        .option("--occurred-at <iso>", "ISO-8601 timestamp the activity occurred. Defaults to now.")
+        .option("--role <role>", "Link role for the record. Defaults to actor.")
+        .option("--source-provider <provider>", "Provider that produced the activity (for idempotency).")
+        .option("--provider-event-id <id>", "Provider event id (dedupes redelivered events).")
+        .option("--metadata-json <json>", "JSON object of extra activity metadata.")
+        .option("--dry-run", "Preview the activity without writing it.")
+        .option("--live", "Write the activity. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm activity log", options, () => requestOxygen("/api/cli/crm/activities", {
+            method: "POST",
+            body: buildCrmActivityBody(object, rowId, options),
+        }));
+    }))
+        .addCommand(new Command("note")
+        .description("Log a free-text note on a CRM record. Defaults to dry-run.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .argument("<text>", "Note text.")
+        .option("--dry-run", "Preview the note without writing it.")
+        .option("--live", "Write the note. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, text, options) => {
+        await handleAsyncAction("crm activity note", options, () => requestOxygen("/api/cli/crm/activities", {
+            method: "POST",
+            body: buildCrmActivityNoteBody(object, rowId, text, options),
+        }));
+    }))
+        .addCommand(new Command("timeline")
+        .description("Show a CRM record's activity timeline, newest first.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<row_id>", "CRM record row id.")
+        .option("--limit <limit>", "Maximum activities to return.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm activity timeline", options, () => requestOxygen(buildCrmTimelinePath(object, rowId, options)));
     })))
         .addCommand(new Command("describe")
         .description("Describe one configured CRM object.")
@@ -1072,7 +1469,166 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (object, options) => {
         await handleAsyncAction("crm describe", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}`));
-    }));
+    }))
+        .addCommand(new Command("duplicates")
+        .description("List ranked duplicate-candidate record pairs for one CRM object (identity-overlap + fuzzy-label). Read-only.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .option("--limit <limit>", "Maximum candidate pairs to return. Defaults to 25, max 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, options) => {
+        await handleAsyncAction("crm duplicates", options, () => requestOxygen(buildCrmDuplicatesPath(object, options)));
+    }))
+        .addCommand(new Command("merge")
+        .description("Merge two CRM records: survivor-wins-with-loser-fill field write + relink/tombstone. Defaults to dry-run; --live requires --confirm.")
+        .argument("<object>", "CRM object slug, such as companies or people.")
+        .argument("<survivor_row_id>", "Row id of the record to KEEP (older record by default).")
+        .argument("<loser_row_id>", "Row id of the record to MERGE AWAY and tombstone.")
+        .option("--field-overrides-json <json>", "JSON object of resolved field values keyed by column key, overriding survivor-wins-with-loser-fill.")
+        .option("--dry-run", "Preview the field-level diff and relink plan without writing. Default.")
+        .option("--live", "Apply the merge. Requires --confirm.")
+        .option("--confirm", "Confirm the live merge after inspecting the dry-run diff.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, survivorRowId, loserRowId, options) => {
+        await handleAsyncAction("crm merge", options, () => requestOxygen("/api/cli/crm/merge", {
+            method: "POST",
+            body: buildCrmMergeBody(object, survivorRowId, loserRowId, options),
+        }));
+    }))
+        .addCommand(new Command("pipeline")
+        .description("Show the deals pipeline grouped by stage, with per-stage counts and amount totals.")
+        .option("--pipeline <name>", "Filter to one pipeline, such as sales, expansion, or renewal.")
+        .option("--limit <limit>", "Maximum deals to return per stage.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm pipeline", options, () => requestOxygen(buildCrmPipelinePath(options)));
+    }))
+        .addCommand(new Command("lists")
+        .description("Static and dynamic CRM lists over companies, people, deals, and custom objects.")
+        .addCommand(new Command("create")
+        .description("Create a static or dynamic CRM list. Defaults to dry-run.")
+        .argument("<slug>", "List slug, such as vip_accounts.")
+        .requiredOption("--base <object>", "Base CRM object slug the list draws from, such as people.")
+        .requiredOption("--kind <kind>", "List kind: static (materialized) or dynamic (filter-computed).")
+        .option("--filter-json <json>", "Dynamic-list filter as a JSON FilterTree object.")
+        .option("--display-name <name>", "Human-friendly list name.")
+        .option("--project <project>", "Project id or slug for the backing list table.")
+        .option("--dry-run", "Preview the list without creating it.")
+        .option("--live", "Create the list. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("crm lists create", options, () => requestOxygen("/api/cli/crm/lists", {
+            method: "POST",
+            body: buildCrmListCreateBody(slug, options),
+        }));
+    }))
+        .addCommand(new Command("add")
+        .description("Add a record to a static CRM list. Defaults to dry-run.")
+        .argument("<list>", "List slug.")
+        .argument("<object>", "Base CRM object slug, such as people.")
+        .argument("<row_id>", "Base record row id.")
+        .option("--dry-run", "Preview the add without writing it.")
+        .option("--live", "Write the membership. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (list, object, rowId, options) => {
+        await handleAsyncAction("crm lists add", options, () => requestOxygen(`/api/cli/crm/lists/${encodeURIComponent(list)}/entries`, {
+            method: "POST",
+            body: buildCrmListEntryBody(object, rowId, options),
+        }));
+    }))
+        .addCommand(new Command("remove")
+        .description("Remove a record from a static CRM list. Defaults to dry-run.")
+        .argument("<list>", "List slug.")
+        .argument("<object>", "Base CRM object slug, such as people.")
+        .argument("<row_id>", "Base record row id.")
+        .option("--dry-run", "Preview the removal without writing it.")
+        .option("--live", "Tombstone the membership. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (list, object, rowId, options) => {
+        await handleAsyncAction("crm lists remove", options, () => requestOxygen(`/api/cli/crm/lists/${encodeURIComponent(list)}/entries`, {
+            method: "DELETE",
+            body: buildCrmListEntryBody(object, rowId, options),
+        }));
+    }))
+        .addCommand(new Command("members")
+        .description("List a CRM list's members (the audience for sequence enrollment).")
+        .argument("<list>", "List slug.")
+        .option("--limit <limit>", "Maximum members to return.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (list, options) => {
+        await handleAsyncAction("crm lists members", options, () => requestOxygen(buildCrmListMembersPath(list, options)));
+    }))
+        .addCommand(new Command("ls")
+        .description("List every configured CRM list.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm lists ls", options, () => requestOxygen("/api/cli/crm/lists"));
+    })))
+        .addCommand(new Command("automation")
+        .description("Arm / disarm standing CRM automation templates and read the audit trail.")
+        .addCommand(new Command("rules")
+        .description("List the standing CRM automation templates and their armed state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm automation rules", options, () => requestOxygen("/api/cli/crm/automation"));
+    }))
+        .addCommand(new Command("set")
+        .description("Arm or disarm a standing CRM automation template. Defaults to dry-run.")
+        .argument("<template-id>", "Template id, such as crm-lead-stage-router.")
+        .option("--armed", "Arm the template (let bridged signals advance stages).")
+        .option("--disarmed", "Disarm the template.")
+        .option("--config-json <json>", "JSON object of per-template config.")
+        .option("--dry-run", "Preview the change without writing it.")
+        .option("--live", "Write the change. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("crm automation set", options, () => requestOxygen("/api/cli/crm/automation", {
+            method: "POST",
+            body: buildCrmAutomationSetBody(templateId, options),
+        }));
+    }))
+        .addCommand(new Command("audit")
+        .description("Show recent CRM automation rule changes, newest first.")
+        .option("--template-id <id>", "Filter to one template id.")
+        .option("--limit <limit>", "Maximum audit entries to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("crm automation audit", options, () => requestOxygen(buildCrmAutomationAuditPath(options)));
+    })))
+        .addCommand(new Command("sync")
+        .description("Import records from a connected CRM (HubSpot/Attio) into Oxygen CRM objects, and inspect import runs and provider links.")
+        .addCommand(new Command("import")
+        .description("Import provider records into an Oxygen CRM object as a durable workflow run. Defaults to dry-run.")
+        .argument("<provider>", "Connected CRM to import from: hubspot or attio.")
+        .requiredOption("--object <object>", "Provider object: hubspot contacts|companies, or attio people|companies.")
+        .option("--into <object>", "Oxygen CRM object slug to import into. Defaults to the natural mapping.")
+        .option("--limit <n>", "Max records to pull this run.")
+        .option("--max-credits <n>", "Volume + external-quota cap (BYOK reads cost 0 Oxygen credits but use your CRM API quota).")
+        .option("--approved", "Confirm a live import after inspecting a dry run.")
+        .option("--dry-run", "Preview the import without pulling. Default.")
+        .option("--live", "Run the live import. Requires --approved and --max-credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (provider, options) => {
+        await handleAsyncAction("crm sync import", options, () => requestOxygen("/api/cli/crm/sync/import", {
+            method: "POST",
+            body: buildCrmSyncImportBody(provider, options),
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show the status of a CRM import workflow run.")
+        .argument("<run_id>", "Import workflow run id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("crm sync status", options, () => requestOxygen(buildCrmSyncStatusPath(runId)));
+    }))
+        .addCommand(new Command("links")
+        .description("Show provider record links (HubSpot/Attio ids) mapped to one Oxygen CRM record.")
+        .argument("<object>", "Oxygen CRM object slug, such as companies or people.")
+        .argument("<row_id>", "Oxygen CRM record row id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, rowId, options) => {
+        await handleAsyncAction("crm sync links", options, () => requestOxygen(buildCrmSyncLinksPath(object, rowId)));
+    })));
     const tablesCommand = program
         .command("tables")
         .description("Tenant workspace table commands.")
@@ -1600,7 +2156,7 @@ export function createProgram() {
         .description("Playbooks, strategies, campaigns, personas, and research notes.")
         .addCommand(new Command("list")
         .description("List workspace context assets.")
-        .option("--type <type>", "Filter by playbook, strategy, campaign, positioning, persona, competitor, research_note, or other.")
+        .option("--type <type>", "Filter by playbook, strategy, campaign, positioning, brand, voice, persona, competitor, research_note, message_playbook, or other.")
         .option("--status <status>", "Filter by draft, active, or archived.")
         .option("--tags <csv>", "Comma-separated tags that must be present.")
         .option("--include-archived", "Include archived assets when no status filter is set.")
@@ -1621,7 +2177,7 @@ export function createProgram() {
         .addCommand(new Command("upsert")
         .description("Create or update a context asset.")
         .option("--id <asset_id>", "Existing asset UUID to update. Omit to create.")
-        .option("--type <type>", "Asset type. Defaults to other on create.")
+        .option("--type <type>", "Asset type (positioning, brand, voice, persona, competitor, message_playbook, playbook, strategy, campaign, research_note, other). Defaults to other on create.")
         .option("--title <title>", "Asset title. Required on create.")
         .option("--status <status>", "draft, active, or archived.")
         .option("--tags <csv>", "Comma-separated asset tags.")
@@ -1629,12 +2185,24 @@ export function createProgram() {
         .option("--body <text>", "Asset body text.")
         .option("--data-json <json>", "Flexible JSON object for structured asset data.")
         .option("--asset-json <json>", "Full asset JSON object. CLI flags override matching fields.")
+        .option("--default", "Pin as the canonical default for its type (auto-applied to copy generation). brand/voice/positioning defaults are injected into AI message columns.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("context asset upsert", options, () => requestOxygen("/api/cli/context/assets/upsert", {
             method: "POST",
             body: buildContextAssetUpsertBody(options),
         }));
+    }))
+        .addCommand(new Command("set-default")
+        .description("Pin a context asset as the canonical default for its type. The canonical brand/voice/positioning docs are auto-applied to AI copy generation.")
+        .argument("<asset_id>", "Context asset UUID.")
+        .option("--off", "Unpin instead of pin (clears the canonical default for this type).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (assetId, options) => {
+        await handleAsyncAction("context asset set-default", options, () => requestOxygen("/api/cli/context/assets/set-default", {
+            method: "POST",
+            body: { id: assetId, is_default: options.off ? false : true },
+        }));
     }))
         .addCommand(new Command("archive")
         .description("Archive a context asset.")
@@ -1790,10 +2358,15 @@ export function createProgram() {
     }))
         .addCommand(new Command("archive")
         .description("Archive a saved blueprint (seed blueprints cannot be archived).")
-        .argument("<slug>", "Blueprint slug or id.")
+        .argument("<id_or_slug>", "Blueprint UUID or slug.")
         .option("--json", "Print a JSON envelope.")
-        .action(async (slug, options) => {
-        await handleAsyncAction("blueprints archive", options, () => requestOxygen("/api/cli/blueprints/archive", { method: "POST", body: { slug } }));
+        .action(async (idOrSlug, options) => {
+        await handleAsyncAction("blueprints archive", options, () => requestOxygen("/api/cli/blueprints/archive", {
+            method: "POST",
+            body: isUuid(idOrSlug)
+                ? { id: idOrSlug }
+                : { slug: idOrSlug },
+        }));
     }))
         .addCommand(new Command("share")
         .description("Create a public share URL for a saved blueprint (oxygen-agent.com/b/<code>).")
@@ -2017,6 +2590,7 @@ export function createProgram() {
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--background", "Create a durable background table action run instead of executing synchronously.")
+        .option("--approved", "Confirm the paid background run after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for a background run.")
         .option("--max-concurrency <n>", "Maximum concurrent row items for a background run. Defaults to 250 for AI columns and 50 otherwise.")
         .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
@@ -2075,6 +2649,7 @@ export function createProgram() {
                 ...(options.force ? { force: true } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
                 ...(options.background ? { background: true } : {}),
+                ...(options.approved ? { approved: true } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.dryRun ? { dry_run: true } : {}),
@@ -2262,6 +2837,7 @@ export function createProgram() {
         .option("--filter-json <json>", "Filter object or array for server-side row selection.")
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
+        .option("--approved", "Confirm the paid table action run after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for this run.")
         .option("--max-concurrency <n>", "Maximum concurrent row items for this run.")
         .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
@@ -2279,6 +2855,7 @@ export function createProgram() {
                 selection: readTableRunSelection(options),
                 ...(options.force ? { force: true } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(options.approved ? { approved: true } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.metadataJson ? { metadata: parseJsonObject(options.metadataJson) } : {}),
@@ -2904,7 +3481,8 @@ export function createProgram() {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
     }))
         .addCommand(new Command("usage")
-        .description("Show credit ledger events.")
+        .description("Show credit ledger events or automation action usage.")
+        .option("--meter <meter>", "credits or automation_actions. Defaults to credits.")
         .option("--days <n>", "Lookback window in days. Defaults to 30.")
         .option("--from <iso>", "Only include ledger events at or after this ISO timestamp.")
         .option("--to <iso>", "Only include ledger events at or before this ISO timestamp.")
@@ -2969,13 +3547,46 @@ export function createProgram() {
                 ...(readOption(options.description) ? { description: readOption(options.description) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("set-plan")
+        .description("Create or update an off-Stripe custom plan for an organization (staff only).")
+        .requiredOption("--organization-id <id>", "Organization id to put on the custom plan.")
+        .requiredOption("--credits <n>", "Monthly managed credits included in the plan.")
+        .option("--org-id <id>", "Alias for --organization-id.")
+        .option("--name <text>", "Display name for the plan, e.g. \"Custom Contract - $250/mo\".")
+        .option("--price <usd>", "Monthly contract price in USD (recorded for display; not charged off-Stripe).")
+        .option("--weekly-credits <n>", "Weekly spend throttle. Defaults to the monthly credits (no throttle).")
+        .option("--rollover <n>", "Max balance credits roll over to. Defaults to the monthly credits.")
+        .option("--base-tier <tier>", "Base pricing tier to inherit feature flags from. Defaults to growth_250.")
+        .option("--byok", "Enable bring-your-own-key integrations for the plan.")
+        .option("--note <text>", "Internal note stored on the contract.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("billing set-plan", options, () => requestOxygen("/api/cli/billing/set-plan", {
+            method: "POST",
+            body: {
+                organization_id: readOption(options.organizationId) ?? readOption(options.orgId),
+                monthly_credits: readPositiveNumber(options.credits),
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.price) ? { price: readPositiveNumber(options.price) } : {}),
+                ...(readOption(options.weeklyCredits)
+                    ? { weekly_credits_limit: readPositiveNumber(options.weeklyCredits) }
+                    : {}),
+                ...(readOption(options.rollover)
+                    ? { rollover_cap: readPositiveNumber(options.rollover) }
+                    : {}),
+                ...(readOption(options.baseTier) ? { base_tier: readOption(options.baseTier) } : {}),
+                ...(options.byok ? { byok: true } : {}),
+                ...(readOption(options.note) ? { note: readOption(options.note) } : {}),
+            },
+        }));
     }));
     program
         .command("budget")
         .description("Standing credit caps (org/table daily/monthly hard-blocks) beyond per-run max_credits.")
         .addCommand(new Command("list")
         .description("List the organization's standing budget policies.")
-        .option("--scope <scope>", "Filter by scope: org, table, api_key, workflow_trigger, monitor.")
+        .option("--scope <scope>", `Filter by scope: ${formatPublicBudgetScopes()}.`)
         .option("--status <status>", "Filter by status. Defaults to all.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -2991,7 +3602,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("set")
         .description("Set, raise, or lower a standing credit cap (idempotent per scope+window).")
-        .requiredOption("--scope <scope>", "org, table, api_key, workflow_trigger, or monitor.")
+        .requiredOption("--scope <scope>", formatPublicBudgetScopes())
         .requiredOption("--window <window>", "per_run, daily, or monthly.")
         .requiredOption("--max-credits <credits>", "Cap in Oxygen credits.")
         .option("--scope-id <id>", "Table id/slug for --scope table (or other scope id). Omit for a scope-wide cap.")
@@ -3732,6 +4343,8 @@ export function createProgram() {
         .option("--live", "Execute the action live. Default is dry-run.")
         .option("--dry-run", "Force dry-run (no provider call).")
         .option("--mode <mode>", "'live' or 'dry_run'. Overridden by --live/--dry-run if provided.")
+        .option("--approved", "Required for live actions after inspecting dry-run output.")
+        .option("--max-credits <n>", "Required positive credit cap for live actions.")
         .option("--json", "Print a JSON envelope.")
         .action(async (integrationId, actionSlug, options) => {
         await handleAsyncAction("integrations run", options, () => {
@@ -3739,6 +4352,7 @@ export function createProgram() {
                 ? parseJsonObject(readOption(options.input))
                 : {};
             const mode = resolveComposioRunMode(options);
+            const maxCredits = readPositiveNumber(options.maxCredits);
             return requestOxygen("/api/cli/integrations/composio/run", {
                 method: "POST",
                 body: {
@@ -3746,6 +4360,8 @@ export function createProgram() {
                     action_slug: actionSlug,
                     arguments: args,
                     mode,
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
                 },
             });
         });
@@ -3857,10 +4473,19 @@ export function createProgram() {
     program.addCommand(new Command("inbox")
         .description("Unified inbox (unibox): LinkedIn conversations and (--channel email) the fleet's email conversations synced from Zapmail Zapbox. Scan, read threads, and reply.")
         .addCommand(new Command("list")
-        .description("List conversations across all connected accounts, newest first. --channel email lists the Zapbox-synced email inbox.")
+        .description("List conversations across all connected accounts, newest first. --channel email lists the Zapbox-synced email inbox; filter it by status, campaign, mailbox provider/domain, and Primary/Others bucket.")
         .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--account <id>", "LinkedIn only: filter to one sender account (sender id, connection id, or Unipile account id).")
         .option("--unread", "Only show conversations with unread messages.")
+        .option("--responses-only", "Email only: only conversations with an inbound reply (never sent-only threads).")
+        .option("--bucket <bucket>", "Email only: primary or others (superseded by --segment).")
+        .option("--segment <segment>", "Email only: top-tab folder — primary, others, sent, warmup, or dmarc.")
+        .option("--status <keys>", "Email only: comma-separated status keys (e.g. interested,meeting_booked).")
+        .option("--sequence-id <ids>", "Email only: comma-separated campaign (sequence) ids.")
+        .option("--provider <providers>", "Email only: comma-separated providers (google,microsoft).")
+        .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
+        .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
+        .option("--mailbox-id <ids>", "Email only: comma-separated mailbox ids.")
         .option("--search <text>", "Filter by attendee name or last-message text.")
         .option("--include-archived", "Include archived conversations.")
         .option("--limit <n>", "Maximum conversations to return (1-200). Defaults to 50.")
@@ -3876,6 +4501,22 @@ export function createProgram() {
                 params.set("account", account);
             if (options.unread)
                 params.set("unread", "true");
+            if (options.responsesOnly)
+                params.set("responses_only", "true");
+            for (const [flag, key] of [
+                ["bucket", "bucket"],
+                ["segment", "segment"],
+                ["status", "status"],
+                ["sequenceId", "sequence_id"],
+                ["provider", "provider"],
+                ["domain", "domain"],
+                ["excludeDomain", "exclude_domain"],
+                ["mailboxId", "mailbox_id"],
+            ]) {
+                const value = readOption(options[flag]);
+                if (value)
+                    params.set(key, value);
+            }
             const search = readOption(options.search);
             if (search)
                 params.set("search", search);
@@ -3913,28 +4554,36 @@ export function createProgram() {
         .requiredOption("--text <message>", "Reply text to send.")
         .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--approved", "Approve and send the message. Without this flag, returns a preview only.")
+        .option("--draft-id <id>", "Email only: when approving an AI reply-agent draft, its id (marks it sent on success).")
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
         await handleAsyncAction("inbox send", options, () => {
             const channel = readOption(options.channel);
+            const draftId = readOption(options.draftId);
             return requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/send`, {
                 method: "POST",
                 body: {
                     text: readOption(options.text),
                     ...(channel ? { channel } : {}),
                     ...(options.approved ? { approved: true } : {}),
+                    ...(draftId ? { draft_id: draftId } : {}),
                 },
             });
         });
     }))
         .addCommand(new Command("mark-read")
         .description("Mark a conversation and all its messages as read.")
-        .argument("<conversation>", "Conversation id or Unipile chat id.")
+        .argument("<conversation>", "Conversation id, Unipile chat id, or (email) Zapbox thread id.")
+        .option("--channel <channel>", "Inbox channel: linkedin (default) or email.")
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
-        await handleAsyncAction("inbox mark-read", options, () => requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/read`, {
-            method: "POST",
-        }));
+        await handleAsyncAction("inbox mark-read", options, () => {
+            const channel = readOption(options.channel);
+            return requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/read`, {
+                method: "POST",
+                body: channel ? { channel } : {},
+            });
+        });
     }))
         .addCommand(new Command("analyze")
         .description("Run the default analysis on an email conversation now: sentiment + interest category + a drafted reply (Oxygen's default model). The worker also does this automatically on inbound mail.")
@@ -3977,7 +4626,167 @@ export function createProgram() {
                 body.message_limit = Number(messageLimit);
             return requestOxygen("/api/cli/inbox/sync", { method: "POST", body });
         });
-    })));
+    }))
+        .addCommand(new Command("status")
+        .description("Set an email conversation's status (the Instantly-style tier). A manual override that locks out AI re-classification.")
+        .argument("<conversation>", "Conversation id or Zapbox thread id.")
+        .argument("<status>", "A status label key (e.g. interested, meeting_booked, won, not_interested).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (conversation, status, options) => {
+        await handleAsyncAction("inbox status", options, () => requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/status`, {
+            method: "POST",
+            body: { status },
+        }));
+    }))
+        .addCommand(new Command("labels")
+        .description("Manage inbox status labels (the Instantly-style system set + custom labels).")
+        .addCommand(new Command("list")
+        .description("List status labels.")
+        .option("--include-archived", "Include archived custom labels.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox labels list", options, () => requestOxygen(`/api/cli/inbox/labels${options.includeArchived ? "?include_archived=true" : ""}`));
+    }))
+        .addCommand(new Command("create")
+        .description("Create a custom status label.")
+        .argument("<name>", "Display name.")
+        .option("--color <hex>", "Hex color (e.g. #22c55e).")
+        .option("--bucket <bucket>", "primary (default) or others.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (name, options) => {
+        await handleAsyncAction("inbox label create", options, () => {
+            const color = readOption(options.color);
+            const bucket = readOption(options.bucket);
+            return requestOxygen("/api/cli/inbox/labels", {
+                method: "POST",
+                body: { name, ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+            });
+        });
+    }))
+        .addCommand(new Command("update")
+        .description("Update a status label's name, color, or bucket.")
+        .argument("<key>", "The label key.")
+        .option("--name <name>", "New display name.")
+        .option("--color <hex>", "New hex color.")
+        .option("--bucket <bucket>", "New bucket (primary or others).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label update", options, () => {
+            const name = readOption(options.name);
+            const color = readOption(options.color);
+            const bucket = readOption(options.bucket);
+            return requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, {
+                method: "PATCH",
+                body: { ...(name ? { name } : {}), ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+            });
+        });
+    }))
+        .addCommand(new Command("delete")
+        .description("Archive a custom status label (system labels and in-use labels are rejected).")
+        .argument("<key>", "The custom label key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (key, options) => {
+        await handleAsyncAction("inbox label archive", options, () => requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, { method: "DELETE" }));
+    })))
+        .addCommand(new Command("drafts")
+        .description("The AI reply-agent draft queue (the approve-before-send review queue).")
+        .addCommand(new Command("list")
+        .description("List drafts awaiting review (queued + edited by default).")
+        .option("--status <keys>", "Comma-separated draft statuses (queued,edited,sent,rejected).")
+        .option("--sequence-id <id>", "Filter to one campaign (sequence) id.")
+        .option("--limit <n>", "Maximum drafts to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox drafts list", options, () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            const sequenceId = readOption(options.sequenceId);
+            if (sequenceId)
+                params.set("sequence_id", sequenceId);
+            const limit = readOption(options.limit);
+            if (limit)
+                params.set("limit", limit);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/inbox/drafts${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("edit")
+        .description("Edit an open draft's body before approval. Does not send.")
+        .argument("<draft>", "The draft id.")
+        .requiredOption("--text <message>", "The new draft body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (draft, options) => {
+        await handleAsyncAction("inbox draft update", options, () => requestOxygen(`/api/cli/inbox/drafts/${encodeURIComponent(draft)}`, {
+            method: "PATCH",
+            body: { text: readOption(options.text) },
+        }));
+    }))
+        .addCommand(new Command("reject")
+        .description("Reject an open draft so it leaves the queue. Does not send.")
+        .argument("<draft>", "The draft id.")
+        .option("--reason <text>", "Optional reason.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (draft, options) => {
+        await handleAsyncAction("inbox draft reject", options, () => {
+            const reason = readOption(options.reason);
+            return requestOxygen(`/api/cli/inbox/drafts/${encodeURIComponent(draft)}/reject`, {
+                method: "POST",
+                body: reason ? { reason } : {},
+            });
+        });
+    })))
+        .addCommand(new Command("reply-agent")
+        .description("The draft-only AI reply agent (the 'AI Sales Agent'): auto-classifies + auto-drafts replies into the review queue. It NEVER auto-sends.")
+        .addCommand(new Command("get")
+        .description("Show the reply-agent config.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox reply-agent get", options, () => requestOxygen("/api/cli/inbox/reply-agent"));
+    }))
+        .addCommand(new Command("set")
+        .description("Configure the reply agent (enable, persona/tone, targets). It drafts into the queue; a human approves+sends.")
+        .option("--enabled", "Enable the agent.")
+        .option("--disabled", "Disable the agent.")
+        .option("--persona <text>", "Who the agent is.")
+        .option("--tone <text>", "Reply tone.")
+        .option("--instructions <text>", "Extra drafting instructions.")
+        .option("--signature <text>", "Signature appended to drafts.")
+        .option("--target-statuses <keys>", "Comma-separated statuses to draft for (empty = all draftable).")
+        .option("--target-sequence-ids <ids>", "Comma-separated campaign ids to draft for (empty = all).")
+        .option("--max-drafts-per-day <n>", "Per-day draft cap.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("inbox reply-agent set", options, () => {
+            const body = {};
+            if (options.enabled)
+                body.enabled = true;
+            if (options.disabled)
+                body.enabled = false;
+            // Presence (flag passed) — not readOption — decides inclusion, so an
+            // absent flag leaves the field untouched rather than clearing it.
+            const opts = options;
+            for (const [flag, key] of [
+                ["persona", "persona"],
+                ["tone", "tone"],
+                ["instructions", "instructions"],
+                ["signature", "signature"],
+            ]) {
+                if (opts[flag] !== undefined)
+                    body[key] = opts[flag];
+            }
+            if (options.targetStatuses !== undefined) {
+                body.target_statuses = options.targetStatuses.split(",").map((s) => s.trim()).filter(Boolean);
+            }
+            if (options.targetSequenceIds !== undefined) {
+                body.target_sequence_ids = options.targetSequenceIds.split(",").map((s) => s.trim()).filter(Boolean);
+            }
+            if (options.maxDraftsPerDay !== undefined)
+                body.max_drafts_per_day = Number(options.maxDraftsPerDay);
+            return requestOxygen("/api/cli/inbox/reply-agent", { method: "POST", body });
+        });
+    }))));
     program.addCommand(new Command("sequences")
         .description("Multichannel outreach sequences: one enrollment per lead spans LinkedIn + email over a journey. LinkedIn steps dispatch natively (rate-limited, credit-capped); email steps send natively or place/move/stop the lead in a bound Instantly campaign (BYOK). Cross-channel reply-stop is intrinsic. A LinkedIn-only sequence behaves exactly like the original sequencer.")
         .addCommand(new Command("list")
@@ -4033,6 +4842,9 @@ export function createProgram() {
         .option("--email-connection <id>", "Instantly connection id for the email track. Defaults to the org's active Instantly connection.")
         .option("--email-definition-file <path>", "Path to a JSON file with the email content spec (subjects/bodies/delays/subsequences) compiled to an Instantly campaign on start.")
         .option("--max-credits <n>", "Credit cap for the LinkedIn track (also set when starting).")
+        .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
+        .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
+        .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences create", options, () => {
@@ -4044,6 +4856,8 @@ export function createProgram() {
             const senders = readCsvOption(options.senders);
             const email = readCampaignEmailBinding(options);
             const maxCredits = readPositiveNumber(options.maxCredits);
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
+            const settings = readSequenceSettings(options);
             return requestOxygen("/api/cli/sequences", {
                 method: "POST",
                 body: {
@@ -4056,6 +4870,8 @@ export function createProgram() {
                     ...(readOption(options.urlColumn) ? { linkedin_url_column_key: readOption(options.urlColumn) } : {}),
                     ...(email ? { email } : {}),
                     ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                    ...(maxLiveSends !== undefined ? { max_live_sends: maxLiveSends } : {}),
+                    ...(settings ? { settings } : {}),
                 },
             });
         });
@@ -4072,6 +4888,9 @@ export function createProgram() {
         .option("--email-definition-file <path>", "Path to a JSON file with the email content spec (subjects/bodies/delays/subsequences).")
         .option("--clear-email", "Remove the email binding from the sequence (draft only).")
         .option("--max-credits <n>", "Credit cap for the LinkedIn track (draft only).")
+        .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
+        .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
+        .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences update", options, () => {
@@ -4092,6 +4911,12 @@ export function createProgram() {
             const maxCredits = readPositiveNumber(options.maxCredits);
             if (maxCredits !== undefined)
                 body.max_credits = maxCredits;
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
+            if (maxLiveSends !== undefined)
+                body.max_live_sends = maxLiveSends;
+            const settings = readSequenceSettings(options);
+            if (settings)
+                body.settings = settings;
             if (options.clearEmail) {
                 body.email = null;
             }
@@ -4101,7 +4926,7 @@ export function createProgram() {
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, or --max-credits).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, or --send-window-file).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -4138,20 +4963,33 @@ export function createProgram() {
         .argument("<sequence>", "Sequence id or slug.")
         .option("--approved", "Approve and activate live. Without this flag, returns a preview only.")
         .option("--max-credits <n>", "Credit cap (required with --approved).")
+        .option("--max-live-sends <n>", "Email send ceiling (positive integer). Required to start a sequence with email steps live.")
         .option("--dry-run", "Activate in dry-run mode: advance every step with simulated sends, no LinkedIn actions, no credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences start", options, () => {
             const maxCredits = readPositiveNumber(options.maxCredits);
+            const maxLiveSends = readPositiveInteger(options.maxLiveSends);
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/start`, {
                 method: "POST",
                 body: {
                     ...(options.dryRun ? { dry_run: true } : {}),
                     ...(options.approved ? { approved: true } : {}),
                     ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                    ...(maxLiveSends !== undefined ? { max_live_sends: maxLiveSends } : {}),
                 },
             });
         });
+    }))
+        .addCommand(new Command("signal")
+        .description("Record an external GTM signal (e.g. linkedin_connected, email_replied, company_raised_funds, job_change, web_visit, intent) onto a running sequence's enrollment(s) to drive signal-triggered branch/wait control. Target an enrollment by --enrollment or --lead (at least one is required); the server validates the signal name.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .requiredOption("--signal <name>", "Signal to record: linkedin_connected, linkedin_replied, email_sent, email_opened, email_clicked, email_replied, email_bounced, company_hiring, company_raised_funds, job_change, new_hire, web_visit, intent.")
+        .option("--enrollment <id>", "Target enrollment id.")
+        .option("--lead <provider_id>", "Target enrollment by its lead provider id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceSignalAction(sequence, options);
     }))
         .addCommand(new Command("pause")
         .description("Pause an active sequence (stops new dispatches; enrollments resume on un-pause).")
@@ -4205,6 +5043,13 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences stats", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/stats`));
+    }))
+        .addCommand(new Command("variants")
+        .description("Break the sequence's email performance down by A/B variant (per step) and by sending mailbox: sent, replied, reply rate, bounced/failed, and credits used.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceVariantsAction(sequence, options);
     })));
     program.addCommand(new Command("email")
         .description("Ad-hoc email from the org's sending fleet: one-off sends with no sequence, enrollment, or contact sync. Zapbox-connected mailboxes send through Zapmail's API (no Google/Microsoft consent); BYOK — 0 Oxygen credits.")
@@ -4459,6 +5304,16 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (domains, options) => {
         await handleAsyncAction("domains buy", options, () => runDomainsBuy(domains, options));
+    }))
+        .addCommand(new Command("adopt")
+        .description("STAFF: Import domains that already exist in the shared Oxygen-managed Cloudflare account into a workspace, then mirror them into the domain cache. FREE — no Oxygen credits and no Cloudflare purchase (the domains are already registered); this differs from `domains buy`. Idempotent. Without --yes, prints a preview of what would be adopted/skipped.")
+        .argument("[domains...]", "Specific domains to adopt. Omit and pass --all to adopt every zone in the managed account.")
+        .option("--all", "Adopt every zone discovered in the managed Cloudflare account.")
+        .option("--organization-id <id>", "STAFF override: adopt into this workspace instead of the calling org.")
+        .option("--yes", "Execute the adoption. Without this flag, prints a preview only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domains, options) => {
+        await handleAsyncAction("domains adopt", options, () => runDomainsAdopt(domains, options));
     }))
         .addCommand(new Command("registrations")
         .description("List the org's domain purchase ledger: every registration attempt with status and price snapshot.")
@@ -4666,7 +5521,7 @@ export function createProgram() {
         .description("Workflow event trigger utilities.")
         .addCommand(new Command("emit")
         .description("Emit a normalized workflow event and enqueue matching event-triggered workflows.")
-        .requiredOption("--source <source>", "Event source, such as instantly, calendar, or hubspot.")
+        .requiredOption("--source <source>", "Event source, such as instantly, calendar, hubspot, or oxygen.notetaker.")
         .requiredOption("--event <event>", "Event type, such as email.reply_received.")
         .requiredOption("--payload-json <json>", "Normalized event payload object.")
         .option("--raw-payload-json <json>", "Optional raw provider payload object.")
@@ -4765,6 +5620,44 @@ export function createProgram() {
             method: "POST",
             body: { run_id: runId },
         }));
+    }))
+        .addCommand(new Command("approvals")
+        .description("List workflow runs awaiting a human approval decision (the mid-run approval inbox).")
+        .option("--status <status>", "Filter: pending (default), approved, rejected, expired, or all.")
+        .option("--run-id <run_id>", "Only approvals for this workflow run.")
+        .option("--limit <n>", "Maximum approvals to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows approvals", options, () => {
+            const query = new URLSearchParams();
+            if (readOption(options.status))
+                query.set("status", readOption(options.status) ?? "");
+            if (readOption(options.runId))
+                query.set("run_id", readOption(options.runId) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/workflows/approvals${suffix}`);
+        });
+    }))
+        .addCommand(new Command("resume")
+        .description("Approve or reject a paused mid-run workflow approval, resuming the run.")
+        .argument("<run_id>", "Workflow run UUID.")
+        .requiredOption("--decision <decision>", "approve or reject.")
+        .option("--step-id <step_id>", "Approval step id, when a run has more than one pending gate.")
+        .option("--plan-hash <plan_hash>", "Reviewed plan hash; the decision is refused if the plan changed since review.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("workflows resume", options, () => requestOxygen("/api/cli/workflows/resume", {
+            method: "POST",
+            body: {
+                run_id: runId,
+                decision: readOption(options.decision),
+                ...(readOption(options.stepId) ? { step_id: readOption(options.stepId) } : {}),
+                ...(readOption(options.planHash) ? { plan_hash: readOption(options.planHash) } : {}),
+            },
+        }));
     }))
         .addCommand(new Command("enable")
         .description("Enable a workflow automation and its current trigger.")
@@ -4817,7 +5710,46 @@ export function createProgram() {
     }));
     return program;
 }
+/**
+ * Map a workflow compile/validation throw to a typed `OxygenError`. The
+ * compiler and linter (`compileWorkflowDefinition`, `assertWorkflowManifest`,
+ * `serializeWorkflowFunction`, cron parsing) throw ordinary `Error`s shaped
+ * `"<code>: <message>"`, which `@oxygen/shared`'s `toFailure` would otherwise
+ * flatten to a machine-hostile `unexpected_error` — making `workflows lint`
+ * (whose whole job is to report authoring mistakes) read like an internal
+ * crash. Preserve the embedded lint code so the failure mirrors what a manifest
+ * lint would return (`duplicate_step_id`, `invalid_cron`, `invalid_max_credits`,
+ * …). Same precedent as `parseJsonValue`.
+ */
+function asWorkflowCompileError(error, filePath) {
+    if (error instanceof OxygenError)
+        return error;
+    const fsCode = error?.code;
+    if (typeof fsCode === "string" && /^E[A-Z]+$/.test(fsCode)) {
+        return new OxygenError("workflow_file_unreadable", `Could not read workflow file: ${error instanceof Error ? error.message : fsCode}`, { details: { file: filePath }, exitCode: 1 });
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const match = /^([a-z][a-z0-9_]*): ([\s\S]+)$/.exec(message);
+    if (match?.[1] && match[2]) {
+        return new OxygenError(match[1], match[2], {
+            details: { file: filePath, phase: "compile" },
+            exitCode: 1,
+        });
+    }
+    return new OxygenError("invalid_workflow", message, {
+        details: { file: filePath, phase: "compile" },
+        exitCode: 1,
+    });
+}
 async function compileWorkflowFile(filePath) {
+    try {
+        return await loadWorkflowManifestFromFile(filePath);
+    }
+    catch (error) {
+        throw asWorkflowCompileError(error, filePath);
+    }
+}
+async function loadWorkflowManifestFromFile(filePath) {
     const absolutePath = resolve(filePath);
     const source = readFileSync(absolutePath, "utf8");
     const extension = extname(absolutePath).toLowerCase();
@@ -5214,7 +6146,10 @@ function normalizeWorkflowRunErrors(value) {
     return output;
 }
 function isTerminalWorkflowRunStatus(status) {
-    return status === "completed" || status === "failed" || status === "canceled";
+    // 'awaiting_approval' pauses the run indefinitely for a human decision (lease
+    // cleared, excluded from claim + lease sweep), so it must stop the tail and
+    // surface the approval rather than poll forever.
+    return status === "completed" || status === "failed" || status === "canceled" || status === "awaiting_approval";
 }
 function tableWebhookListPath(options) {
     const params = new URLSearchParams();
@@ -6496,6 +7431,38 @@ function domainsBuyRerunCommand(domains, quoteId, options, data) {
     ];
     return `${resolveCliBinaryName()} domains buy ${domains.join(" ")} ${flags.join(" ")}`;
 }
+// Staff import of pre-existing managed-account domains. Exactly one of an explicit
+// list or --all; without --yes the server returns a preview and the CLI appends a
+// copy-paste rerun command to execute it.
+async function runDomainsAdopt(domains, options) {
+    const hasExplicit = domains.length > 0;
+    if (hasExplicit === Boolean(options.all)) {
+        throw new Error("Pass exactly one of <domains...> or --all. Use --all to adopt every domain in the managed account, or list specific domains.");
+    }
+    const organizationId = readOption(options.organizationId);
+    const data = await requestOxygen("/api/cli/domains/adopt", {
+        method: "POST",
+        body: {
+            ...(options.all ? { all: true } : {}),
+            ...(hasExplicit ? { domains } : {}),
+            ...(organizationId ? { organization_id: organizationId } : {}),
+            ...(options.yes ? { approved: true } : {}),
+        },
+    });
+    if (options.yes)
+        return data;
+    return { ...data, rerun_command: domainsAdoptRerunCommand(domains, options) };
+}
+function domainsAdoptRerunCommand(domains, options) {
+    const organizationId = readOption(options.organizationId);
+    const flags = [
+        ...(options.all ? ["--all"] : []),
+        ...(organizationId ? [`--organization-id ${organizationId}`] : []),
+        "--yes",
+    ];
+    const args = domains.length > 0 ? ` ${domains.join(" ")}` : "";
+    return `${resolveCliBinaryName()} domains adopt${args} ${flags.join(" ")}`;
+}
 // succeeded/failed are terminal; action_required stops the wait too because
 // only the user (in the Cloudflare dashboard) can move it forward.
 function isSettledDomainRegistrationStatus(status) {
@@ -8108,6 +9075,125 @@ function formatProfileUseSuccess(profile, options) {
     }
     return lines.join("\n");
 }
+// `sequences signal` records an external GTM signal onto a running sequence's
+// enrollment(s). The signal *name* is validated server-side against the typed
+// enum; the CLI only enforces that a signal was supplied and that at least one
+// enrollment target (--enrollment / --lead) is present, so an unscoped call
+// fails before spending a request.
+async function handleSequenceSignalAction(sequence, options) {
+    try {
+        const signal = readOption(options.signal);
+        if (!signal)
+            throw new Error("--signal is required.");
+        const enrollmentId = readOption(options.enrollment);
+        const leadProviderId = readOption(options.lead);
+        if (!enrollmentId && !leadProviderId) {
+            throw new Error("Provide a target enrollment with --enrollment <id> and/or --lead <provider_id>.");
+        }
+        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/signal`, {
+            method: "POST",
+            body: {
+                signal,
+                ...(enrollmentId ? { enrollment_id: enrollmentId } : {}),
+                ...(leadProviderId ? { lead_provider_id: leadProviderId } : {}),
+            },
+        });
+        if (options.json) {
+            writeJson(success("sequences signal", data));
+            return;
+        }
+        const updated = typeof data.enrollments_updated === "number" ? data.enrollments_updated : 0;
+        const recordedSignal = data.signal ?? signal;
+        const link = data.deepLink ?? data.web_url;
+        process.stdout.write(`Recorded ${recordedSignal} on ${updated} enrollment(s).${link ? ` ${link}` : ""}\n`);
+    }
+    catch (error) {
+        const failure = toFailure("sequences signal", error);
+        writeJson(failure);
+        writeMaxCreditsHint(error);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleSequenceVariantsAction(sequence, options) {
+    try {
+        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/variants`);
+        if (options.json) {
+            writeJson(success("sequences variants", data));
+            return;
+        }
+        process.stdout.write(formatSequenceVariants(data));
+    }
+    catch (error) {
+        const failure = toFailure("sequences variants", error);
+        writeJson(failure);
+        writeMaxCreditsHint(error);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function formatVariantCell(value) {
+    if (value === null || value === undefined)
+        return "—";
+    return String(value);
+}
+function formatRatePercent(value) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return "—";
+    // Rates arrive as a 0–1 fraction; render as a one-decimal percentage.
+    return `${(value * 100).toFixed(1)}%`;
+}
+function renderVariantTable(headers, rows) {
+    const widths = headers.map((header, columnIndex) => {
+        let max = header.length;
+        for (const row of rows) {
+            const cell = row[columnIndex] ?? "";
+            if (cell.length > max)
+                max = cell.length;
+        }
+        return max;
+    });
+    const renderRow = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ")}`.replace(/\s+$/, "");
+    const separator = `  ${widths.map((width) => "-".repeat(width)).join("  ")}`;
+    return [renderRow(headers), separator, ...rows.map(renderRow)];
+}
+function formatSequenceVariants(data) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const byVariant = Array.isArray(data.by_variant) ? data.by_variant : [];
+    const byMailbox = Array.isArray(data.by_mailbox) ? data.by_mailbox : [];
+    const lines = ["", styles.bold("By variant")];
+    if (byVariant.length === 0) {
+        lines.push(`  ${styles.dim("No variant analytics yet.")}`);
+    }
+    else {
+        const headers = ["STEP", "VARIANT", "SENT", "REPLIED", "REPLY RATE", "BOUNCED", "CREDITS"];
+        const rows = byVariant.map((row) => [
+            formatVariantCell(row.step_index),
+            formatVariantCell(row.variant_id),
+            formatVariantCell(row.sent),
+            formatVariantCell(row.replied),
+            formatRatePercent(row.reply_rate),
+            formatVariantCell(row.bounced),
+            formatVariantCell(row.credits_used),
+        ]);
+        lines.push(...renderVariantTable(headers, rows));
+    }
+    lines.push("", styles.bold("By mailbox"));
+    if (byMailbox.length === 0) {
+        lines.push(`  ${styles.dim("No mailbox analytics yet.")}`);
+    }
+    else {
+        const headers = ["MAILBOX", "SENT", "REPLIED", "REPLY RATE", "FAILED"];
+        const rows = byMailbox.map((row) => [
+            formatVariantCell(row.email_address),
+            formatVariantCell(row.sent),
+            formatVariantCell(row.replied),
+            formatRatePercent(row.reply_rate),
+            formatVariantCell(row.failed),
+        ]);
+        lines.push(...renderVariantTable(headers, rows));
+    }
+    lines.push("");
+    return lines.join("\n");
+}
 function formatWhoami(identity, context) {
     const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const email = identity.user.email ?? identity.user.id;
@@ -8431,6 +9517,8 @@ function buildBillingLedgerParams(options) {
         params.set("days", String(days));
     if (limit)
         params.set("limit", String(limit));
+    if (readOption(options.meter))
+        params.set("meter", readOption(options.meter));
     if (readOption(options.from))
         params.set("from", readOption(options.from));
     if (readOption(options.to))
@@ -8479,6 +9567,7 @@ function buildContextAssetUpsertBody(options) {
         ...(readOption(options.summary) ? { summary: readOption(options.summary) } : {}),
         ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
         ...(options.dataJson ? { data: parseJsonObject(options.dataJson) } : {}),
+        ...(options.default ? { is_default: true } : {}),
     };
 }
 function buildEnrichColumnBody(// skipcq: JS-R1005 -- CLI body builder maps enrichment aliases, selection, provider order, and safety caps.
@@ -8615,6 +9704,37 @@ function readNonNegativeInt(value) {
     }
     return parsed;
 }
+function readPositiveInteger(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new OxygenError("invalid_number", "Expected a positive integer.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+// Folds the sequence-level email send controls (--max-emails-per-mailbox-per-day,
+// --send-window-file) into a partial `settings` object. Returns undefined when
+// neither flag is set so the field is omitted from the request body entirely.
+// The server shallow-merges this fragment over the sequence's current settings
+// (apps/web .../sequences/[sequenceId]/route.ts), so a throttle-only PATCH
+// preserves other settings the server already holds, e.g. dispatch_mode/schedule.
+function readSequenceSettings(options) {
+    const settings = {};
+    const maxPerMailbox = readPositiveInteger(options.maxEmailsPerMailboxPerDay);
+    if (maxPerMailbox !== undefined) {
+        settings.max_emails_per_mailbox_per_day = maxPerMailbox;
+    }
+    const windowPath = readOption(options.sendWindowFile);
+    if (windowPath) {
+        settings.email_send_window = readJsonFileValue(resolve(windowPath), "--send-window-file");
+    }
+    return Object.keys(settings).length > 0 ? settings : undefined;
+}
 function muteTokenEcho() {
     if (!input.isTTY || process.platform === "win32")
         return () => undefined;