@oxygen-agent/cli 1.246.0 → 1.263.0

package/dist/index.js

@@ -7,7 +7,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, Option } from "commander";
-import { formatCellForDisplay, formatPublicBudgetScopes, OXYGEN_VERSION, OxygenError, success, toFailure, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, formatCellForDisplay, formatPublicBudgetScopes, OXYGEN_VERSION, OxygenError, success, toFailure, } from "@oxygen/shared";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
@@ -308,6 +308,7 @@ function normalizeDeleteRowIds(values) {
     }
     return rowIds;
 }
+const CUSTOM_HTTP_MANIFEST_DOCS_URL = "https://oxygen-agent.com/docs/providers/custom-http";
 function readCustomIntegrationManifest(options) {
     const manifestPath = readOption(options.manifest);
     const manifestJson = readOption(options.manifestJson);
@@ -321,21 +322,38 @@ function readCustomIntegrationManifest(options) {
             exitCode: 1,
         });
     }
-    return parseJsonObject(manifestJson ?? readFileSync(resolve(manifestPath ?? ""), "utf8"));
+    if (manifestJson)
+        return parseJsonObject(manifestJson);
+    const filePath = resolve(manifestPath ?? "");
+    let content;
+    try {
+        content = readFileSync(filePath, "utf8");
+    }
+    catch (error) {
+        const notFound = error?.code === "ENOENT";
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new OxygenError("invalid_request", notFound
+            ? `Manifest file not found: ${filePath}. Pass --manifest <path.json> or --manifest-json '<json>'. See ${CUSTOM_HTTP_MANIFEST_DOCS_URL}`
+            : `Could not read manifest file ${filePath}: ${reason}. See ${CUSTOM_HTTP_MANIFEST_DOCS_URL}`, { details: { path: filePath }, exitCode: 1 });
+    }
+    try {
+        return parseJsonObject(content);
+    }
+    catch (error) {
+        if (error instanceof OxygenError) {
+            throw new OxygenError(error.code, `Manifest file ${filePath} is invalid: ${error.message} See ${CUSTOM_HTTP_MANIFEST_DOCS_URL}`, {
+                details: { path: filePath, ...(isRecord(error.details) ? error.details : {}) },
+                exitCode: error.exitCode,
+            });
+        }
+        throw error;
+    }
 }
 const CUSTOM_INTEGRATION_SECRET_KEYS = ["API_KEY", "TOKEN", "PASSWORD", "SECRET"];
 function readCustomIntegrationSecret(options) {
-    const apiKey = readOption(options.apiKey);
     const secretsFile = readOption(options.secretsFile);
-    if (apiKey && secretsFile) {
-        throw new OxygenError("invalid_request", "Pass either --api-key or --secrets-file, not both.", {
-            exitCode: 1,
-        });
-    }
-    if (apiKey)
-        return apiKey;
     if (!secretsFile) {
-        throw new OxygenError("invalid_request", "Pass --api-key or --secrets-file.", {
+        throw new OxygenError("invalid_request", "Pass --secrets-file.", {
             exitCode: 1,
         });
     }
@@ -627,6 +645,7 @@ function buildCrmRelationshipUpsertBody(object, rowId, options) {
             ...(readOption(options.targetObject) ? { object: readOption(options.targetObject) } : {}),
             row_id: options.targetRowId,
         },
+        ...(readOption(options.role) ? { role: readOption(options.role) } : {}),
         mode: resolveCrmSetupMode(options),
     };
 }
@@ -1158,11 +1177,13 @@ export function createProgram() {
         .option("--body <body>", "What you were doing, what happened, and what you tried.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
         .option("--category <category>", "Optional category label.")
+        .option("--source <source>", "Where the ticket originated. Only slack is supported today.")
         .option("--operation <operation>", "The operation/tool that failed, e.g. oxygen_columns_run.")
         .option("--error-code <code>", "The error envelope code you received.")
         .option("--run-ids <ids>", "Comma-separated run ids to attach.")
         .option("--table-ids <ids>", "Comma-separated table ids to attach.")
         .option("--deep-links <urls>", "Comma-separated https://oxygen-agent.com/... links.")
+        .option("--slack-permalink <url>", "Slack message permalink (https://*.slack.com/...) to attach as context.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("support ticket create", options, () => requestOxygen("/api/cli/support/tickets", {
@@ -1244,6 +1265,30 @@ export function createProgram() {
             method: "POST",
             body: { resolution: readOption(options.resolution) },
         }));
+    }))
+        .addCommand(new Command("workflow")
+        .description("Track verify/plan/draft triage progress on a support ticket (staff only).")
+        .argument("<ticketId>", "Ticket UUID.")
+        .option("--verify-status <status>", "Verify step: pending | in_progress | done | blocked | skipped.")
+        .option("--verify-notes <text>", "Verification notes. Pass an empty string to clear.")
+        .option("--plan-status <status>", "Plan step: pending | in_progress | done | blocked | skipped.")
+        .option("--plan <text>", "Remediation plan. Pass an empty string to clear.")
+        .option("--draft-status <status>", "Draft step: pending | in_progress | done | blocked | skipped.")
+        .option("--draft <text>", "Draft reply to the opener. Pass an empty string to clear.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminWorkflowAction(ticketId, options);
+    }))
+        .addCommand(new Command("update")
+        .description("Change a support ticket's status or assignee, with an optional staff note (staff only).")
+        .argument("<ticketId>", "Ticket UUID.")
+        .option("--status <status>", "open | triaging | waiting_on_user | closed. Use the resolve command to resolve.")
+        .option("--assign <email>", "Assign the ticket to a staff email.")
+        .option("--unassign", "Clear the ticket assignment.")
+        .option("--note <text>", "Append a staff message to the ticket thread.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (ticketId, options) => {
+        await handleSupportAdminUpdateAction(ticketId, options);
     })));
     program
         .command("feedback")
@@ -1610,6 +1655,7 @@ export function createProgram() {
         .requiredOption("--relationship <slug>", "Relationship slug from the source object, such as team or company.")
         .option("--target-object <object>", "Target CRM object slug. Optional when the relationship has one target.")
         .requiredOption("--target-row-id <row_id>", "Target CRM record row id.")
+        .option("--role <role>", "Buying-committee role for a deals.stakeholders link: champion, economic_buyer, decision_maker, influencer, or end_user.")
         .option("--dry-run", "Preview the relationship write without changing edges.")
         .option("--live", "Apply the relationship write. Default is dry-run.")
         .option("--json", "Print a JSON envelope.")
@@ -3222,9 +3268,11 @@ export function createProgram() {
         .requiredOption("--table <table>", "Table id or slug.")
         .option("--status <status>", "Filter by active, queued, running, paused, completed, completed_with_errors, failed, canceling, or canceled. Defaults to active.")
         .option("--limit <n>", "Maximum runs to return. Defaults to 20.")
+        .option("--format <format>", "Format run history as json, jsonl, csv, or table (same serializer as `tables export`). Omit to keep the default envelope output.")
+        .option("--output <path>", "Write the formatted run history to a file instead of embedding it in the response.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("table-runs list", options, () => requestOxygen(tableRunsListPath(options)));
+        await handleAsyncAction("table-runs list", options, () => listTableRuns(options));
     }))
         .addCommand(new Command("get")
         .description("Get one durable table action run.")
@@ -3835,8 +3883,8 @@ export function createProgram() {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
     }))
         .addCommand(new Command("usage")
-        .description("Show credit ledger events or automation action usage.")
-        .option("--meter <meter>", "credits or automation_actions. Defaults to credits.")
+        .description("Show credit ledger events, automation action usage, or implied LinkedIn seat COGS plus a RECOMMENDED per-account price preview (provider_seats).")
+        .option("--meter <meter>", "credits, automation_actions, or provider_seats (rolling-30d peak connected LinkedIn accounts, implied Unipile COGS, and a RECOMMENDED per-account charge preview + implied margin — preview only, not yet billed). Defaults to credits.")
         .option("--days <n>", "Lookback window in days. Defaults to 30.")
         .option("--from <iso>", "Only include ledger events at or after this ISO timestamp.")
         .option("--to <iso>", "Only include ledger events at or before this ISO timestamp.")
@@ -3983,6 +4031,116 @@ export function createProgram() {
             method: "DELETE",
         }));
     }));
+    program.addCommand(new Command("egress")
+        .description("Managed mailbox-egress IP pool: status, inventory, dedicated-IP add-on, and rotation.")
+        .addCommand(new Command("status")
+        .description("Show egress mode, this org's open mailbox->IP assignments, and IP health counts. Read-only, 0 credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress status", options, () => requestOxygen("/api/cli/egress"));
+    }))
+        .addCommand(new Command("ips")
+        .description("List the egress IPs this org may send through (shared pool for this env + any dedicated IP). Read-only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress ips", options, () => requestOxygen("/api/cli/egress?view=ips"));
+    }))
+        .addCommand(new Command("dedicated")
+        .description("Dedicated-egress-IP add-on ($400/mo): request a preview quote or check the add-on status. PREVIEW ONLY — never charges; checkout is human via Stripe.")
+        .addCommand(new Command("request")
+        .description("Preview the dedicated-egress-IP add-on ($400/mo). PREVIEW ONLY — never charges; checkout is human via Stripe.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress dedicated request", options, () => requestOxygen("/api/cli/egress/dedicated", { method: "POST", body: {} }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show this org's dedicated-egress-IP add-on state (status, quantity, activation, price). Read-only, 0 credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress dedicated status", options, () => requestOxygen("/api/cli/egress/dedicated"));
+    })))
+        .addCommand(new Command("rotate")
+        .description("Rotate a mailbox's egress IP. Approval-gated: without --approve it previews and makes no change.")
+        .requiredOption("--mailbox <id>", "Mailbox id to rotate.")
+        .option("--vendor <vendor>", "Egress vendor (pingproxies|decodo). Defaults to the current IP's vendor.")
+        .option("--approve", "Execute the rotation (paid vendor action). Omit for a no-side-effect preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress rotate", options, () => requestOxygen("/api/cli/egress/rotate", {
+            method: "POST",
+            body: {
+                mailbox_id: readOption(options.mailbox),
+                ...(readOption(options.vendor) ? { vendor: readOption(options.vendor) } : {}),
+                ...(options.approve ? { approve: true } : {}),
+            },
+        }));
+    })));
+    program
+        .command("directory")
+        .description("Manage this organization's public OXYGEN agency directory listing.")
+        .addCommand(new Command("get")
+        .description("Read the listing, its publish state, and its public/settings deep-links.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("directory get", options, () => requestOxygen("/api/cli/directory/listing"));
+    }))
+        .addCommand(new Command("update")
+        .description("Update listing profile fields. Only invited organizations can edit.")
+        .option("--name <text>", "Agency display name.")
+        .option("--slug <slug>", "Public URL slug (lowercase letters, digits, dashes).")
+        .option("--logo-url <url>", "Logo image URL.")
+        .option("--tagline <text>", "One-line pitch shown on the directory card.")
+        .option("--description <text>", "Full profile description (plain text; blank lines separate paragraphs).")
+        .option("--description-file <path>", "Path to a plain-text file with the description.")
+        .option("--website <url>", "Company website URL.")
+        .option("--company-linkedin <url>", "Company LinkedIn page URL.")
+        .option("--founders-json <json>", "JSON array of founding-team members: [{\"name\", \"title\", \"linkedin_url\"}].")
+        .option("--booking-url <url>", "Book-a-call URL (Cal.com, Calendly, ...).")
+        .option("--contact-email <email>", "Public contact email.")
+        .option("--logo-file <path>", "Upload a local png/jpeg/webp/svg logo instead of passing --logo-url.")
+        .option("--services <csv>", `Comma-separated services from the curated set: ${AGENCY_DIRECTORY_SERVICES.join(", ")}.`)
+        .option("--regions <csv>", `Comma-separated regions from the curated set: ${AGENCY_DIRECTORY_REGIONS.join(", ")}.`)
+        .option("--profile-json <json>", "JSON object with any listing fields; flags override it. Use null values to clear fields.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("directory update", options, async () => {
+            const logoPath = readOption(options.logoFile);
+            const uploaded = logoPath ? await uploadDirectoryLogo(logoPath) : null;
+            const profile = await buildDirectoryProfileBody(options);
+            if (Object.keys(profile).length === 0 && uploaded)
+                return uploaded;
+            return requestOxygen("/api/cli/directory/listing/update", {
+                method: "POST",
+                body: { profile },
+            });
+        });
+    }))
+        .addCommand(new Command("publish")
+        .description("Publish the listing to the public directory at https://oxygen-agent.com/agencies.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("directory publish", options, () => requestOxygen("/api/cli/directory/listing/publish", { method: "POST", body: {} }));
+    }))
+        .addCommand(new Command("unpublish")
+        .description("Remove the listing from the public directory (keeps the draft editable).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("directory unpublish", options, () => requestOxygen("/api/cli/directory/listing/unpublish", { method: "POST", body: {} }));
+    }))
+        .addCommand(new Command("apply")
+        .description("Apply to be listed in the public agency directory (reviewed by the OXYGEN team).")
+        .option("--message <text>", "What you do, who you serve, and how you use OXYGEN for client work.")
+        .option("--website <url>", "Your agency website URL.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("directory apply", options, () => requestOxygen("/api/cli/directory/apply", {
+            method: "POST",
+            body: {
+                ...(readOption(options.message) ? { message: readOption(options.message) } : {}),
+                ...(readOption(options.website) ? { website: readOption(options.website) } : {}),
+            },
+        }));
+    }));
     program
         .command("admin")
         .description("Staff-only commands.")
@@ -4004,7 +4162,55 @@ export function createProgram() {
             const suffix = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/admin/costs${suffix}`);
         });
-    }));
+    }))
+        .addCommand(new Command("directory")
+        .description("Curate the public agency directory (invite, prefill, delist). Staff only.")
+        .addCommand(new Command("list")
+        .description("List every agency directory listing across all organizations.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin directory list", options, () => requestOxygen("/api/cli/admin/directory"));
+    }))
+        .addCommand(new Command("enable")
+        .description("Invite an organization to the directory, optionally prefilling its profile.")
+        .argument("<organization>", "Organization id, slug, or Clerk org id.")
+        .option("--name <text>", "Agency display name (defaults to the organization name).")
+        .option("--slug <slug>", "Public URL slug (defaults to a slugified name).")
+        .option("--logo-url <url>", "Logo image URL.")
+        .option("--tagline <text>", "One-line pitch shown on the directory card.")
+        .option("--description <text>", "Full profile description (plain text; blank lines separate paragraphs).")
+        .option("--description-file <path>", "Path to a plain-text file with the description.")
+        .option("--website <url>", "Company website URL.")
+        .option("--company-linkedin <url>", "Company LinkedIn page URL.")
+        .option("--founders-json <json>", "JSON array of founding-team members: [{\"name\", \"title\", \"linkedin_url\"}].")
+        .option("--booking-url <url>", "Book-a-call URL (Cal.com, Calendly, ...).")
+        .option("--contact-email <email>", "Public contact email.")
+        .option("--services <csv>", `Comma-separated services from the curated set: ${AGENCY_DIRECTORY_SERVICES.join(", ")}.`)
+        .option("--regions <csv>", `Comma-separated regions from the curated set: ${AGENCY_DIRECTORY_REGIONS.join(", ")}.`)
+        .option("--featured", "Pin the listing to the top of the public directory.")
+        .option("--profile-json <json>", "JSON object with any listing fields; flags override it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (organization, options) => {
+        await handleAsyncAction("admin directory enable", options, async () => {
+            const profile = await buildDirectoryProfileBody(options);
+            if (options.featured)
+                profile.featured = true;
+            return requestOxygen("/api/cli/admin/directory/enable", {
+                method: "POST",
+                body: { organization, profile },
+            });
+        });
+    }))
+        .addCommand(new Command("delist")
+        .description("Remove an organization's listing from the public directory (kill switch).")
+        .argument("<organization>", "Organization id, slug, or Clerk org id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (organization, options) => {
+        await handleAsyncAction("admin directory delist", options, () => requestOxygen("/api/cli/admin/directory/delist", {
+            method: "POST",
+            body: { organization },
+        }));
+    })));
     program
         .command("signup-leads")
         .description("Signup lead delivery queue commands.")
@@ -4275,7 +4481,6 @@ export function createProgram() {
         .addCommand(new Command("connect")
         .description("Attach the credential (bearer token, API key, or basic password) for an applied custom HTTP integration.")
         .argument("<slug>", "Custom integration slug from the applied manifest.")
-        .option("--api-key <value>", "Credential value. Prefer --secrets-file to keep it out of shell history.")
         .option("--secrets-file <path>", "Path to a .env-style file holding the credential (a single entry, or one named API_KEY/TOKEN/PASSWORD/SECRET).")
         .option("--json", "Print a JSON envelope.")
         .action(async (slug, options) => {
@@ -4765,20 +4970,29 @@ export function createProgram() {
             const suffix = params.toString();
             return requestOxygen(`/api/cli/senders${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("checkpoints")
+        .description("List LinkedIn senders stuck on a security checkpoint (2FA / OTP / in-app validation), each with status, warm-up day, today's usage vs. caps, and the latest error — plus a fleet tally of every sender by status. Read-only; no provider call, no credits. Solve one with `senders checkpoint solve <id> <code>`.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("senders checkpoints", options, () => requestOxygen("/api/cli/senders/checkpoints"));
     }))
         .addCommand(new Command("connect")
-        .description("Get a Unipile hosted-auth URL to connect a new LinkedIn account (or reconnect with --reconnect). Open the URL in a browser to complete authentication.")
+        .description("Get a Unipile hosted-auth URL to connect a new LinkedIn account (or reconnect with --reconnect). Use --count to mint several links at once for bulk onboarding. Open each URL in a browser to complete authentication.")
         .option("--reconnect <connection_id>", "Reconnect an existing connection instead of creating a new one. Accepts a connection id.")
         .option("--sales-nav", "Request Classic + Sales Navigator access during Unipile hosted authentication.")
+        .option("--count <n>", "Mint N hosted-auth links in one call for bulk onboarding (1-25, default 1). Each link connects a different account. Ignored when reconnecting.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("senders connect", options, () => {
             const reconnect = readOption(options.reconnect);
+            const count = readPositiveInt(options.count);
             return requestOxygen("/api/cli/senders/connect", {
                 method: "POST",
                 body: {
                     ...(reconnect ? { reconnect_connection_id: reconnect } : {}),
                     ...(options.salesNav ? { sales_nav: true } : {}),
+                    ...(count ? { count } : {}),
                 },
             });
         });
@@ -4877,6 +5091,9 @@ export function createProgram() {
         .option("--warmup-restart", "Start (or restart) the warm-up ramp now — gradually raises this account's invite + message caps to full over ~2 weeks.")
         .option("--warmup-disable", "Turn off warm-up for this account (treat it as already warm and use its full configured caps).")
         .option("--warmup-start-date <date>", "Set the warm-up start date (ISO, e.g. 2026-01-31). A past date credits prior warming and advances the ramp.")
+        .option("--warmup-preset <preset>", "Warm-up ramp curve: conservative (~3 weeks), standard (~2 weeks, default), or fast (~1 week for an aged account).")
+        .option("--randomize-caps", "Randomise this account's daily send caps to 80-100% of configured so volume looks human day to day.")
+        .option("--no-randomize-caps", "Turn off randomised daily caps (use the exact configured caps every day).")
         .option("--json", "Print a JSON envelope.")
         .action(async (id, options) => {
         await handleAsyncAction("senders limits set", options, () => {
@@ -4995,6 +5212,77 @@ export function createProgram() {
             return requestOxygen(`/api/cli/linkedin/viewers/status${suffix ? `?${suffix}` : ""}`);
         });
     })));
+    program.addCommand(new Command("posts")
+        .description("Read and publish LinkedIn posts through a connected account. `get` returns a post and the composite social_id that `comments`/`reactions` and `oxygen engagement harvest` need; `create` publishes a real post (approval-gated). All calls are metered against the sender account's daily quota.")
+        .addCommand(new Command("get")
+        .description("Read a LinkedIn post. Returns the post and its composite social_id (reuse that social_id for `posts comments`, `posts reactions`, and `engagement harvest --source unipile` — NOT the raw activity URN). Metered as an account read.")
+        .requiredOption("--post <id>", "Numeric activity id, activity URL, or composite social_id.")
+        .option("--account <ref>", "Sender account to read through (sender id, connection id, or Unipile account id). Omit for the org default.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("posts get", options, () => {
+            const params = new URLSearchParams();
+            params.set("post", readOption(options.post) ?? "");
+            const account = readOption(options.account);
+            if (account)
+                params.set("account", account);
+            return requestOxygen(`/api/cli/linkedin/posts?${params.toString()}`);
+        });
+    }))
+        .addCommand(new Command("comments")
+        .description("List a post's comments (or the replies to a comment with --comment-id). --post MUST be the composite social_id from `posts get`, not the activity URN. Metered as an account read.")
+        .requiredOption("--post <social_id>", "Composite post social_id from `posts get`.")
+        .option("--comment-id <id>", "List replies to this comment instead of top-level comments.")
+        .option("--sort-by <sort>", "Comment sort order (provider-defined, e.g. recent|relevant).")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--limit <n>", "Max comments to return this page.")
+        .option("--account <ref>", "Sender account to read through. Omit for the org default.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("posts comments", options, () => requestOxygen(`/api/cli/linkedin/posts/comments?${buildPostEngagementQuery(options)}`));
+    }))
+        .addCommand(new Command("reactions")
+        .description("List a post's reactions (or a comment's reactions with --comment-id). --post MUST be the composite social_id from `posts get`. Metered as an account read.")
+        .requiredOption("--post <social_id>", "Composite post social_id from `posts get`.")
+        .option("--comment-id <id>", "List reactions to this comment instead of the post.")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page.")
+        .option("--limit <n>", "Max reactions to return this page.")
+        .option("--account <ref>", "Sender account to read through. Omit for the org default.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("posts reactions", options, () => requestOxygen(`/api/cli/linkedin/posts/reactions?${buildPostEngagementQuery(options)}`));
+    }))
+        .addCommand(new Command("create")
+        .description("Publish a LinkedIn post from the connected account. A REAL public write, so it prints a preview by default and only publishes with --approved. Counts against the sender account's daily action quota. (Company-page posting is not supported — Unipile exposes it only via the fragile raw route.)")
+        .option("--text <text>", "Post body text.")
+        .option("--text-file <path>", "Read the post body from a file (alternative to --text).")
+        .option("--account <ref>", "Sender account to post from. Omit for the org default.")
+        .option("--as-organization <id>", "Publish as a company page the account administers (advanced; may require raw-route support).")
+        .option("--external-link <url>", "Attach an external link to the post.")
+        .option("--approved", "Publish for real. Without this flag, prints a preview only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("posts create", options, () => {
+            const inlineText = readOption(options.text);
+            const textFile = readOption(options.textFile);
+            const text = inlineText ?? (textFile ? readFileSync(resolve(textFile), "utf8") : undefined);
+            if (!text || !text.trim())
+                throw new Error("--text or --text-file is required to publish a post.");
+            const account = readOption(options.account);
+            const asOrganization = readOption(options.asOrganization);
+            const externalLink = readOption(options.externalLink);
+            return requestOxygen("/api/cli/linkedin/posts", {
+                method: "POST",
+                body: {
+                    text,
+                    ...(account ? { account } : {}),
+                    ...(asOrganization ? { as_organization: asOrganization } : {}),
+                    ...(externalLink ? { external_link: externalLink } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                },
+            });
+        });
+    })));
     program.addCommand(new Command("engagement")
         .description("Harvest a LinkedIn post's engagers (reactors + commenters) into an enrollable CRM static list. The harvest runs as a slow, durable background drip under a dedicated conservative read budget — it never bursts and never starves the sequencer's own reads.")
         .addCommand(new Command("harvest")
@@ -5112,7 +5400,100 @@ export function createProgram() {
                 },
             });
         });
-    })));
+    }))
+        .addCommand(new Command("watch")
+        .description("Declarative engagement watches (the signals wedge): stand up a watch on a post's engagers or 'who viewed my profile' that harvests people into a table and, under a standing approval, auto-enrolls them into a sequence. The watch materializes the harvest drip and enrolls newly-harvested people each cycle — the sequence still gates its own sends.")
+        .addCommand(new Command("create")
+        .description("Arm an engagement watch. `--kind post` watches a post's reactors + commenters (needs --post social_id; a cookieless post also needs --post-url); `--kind profile_viewers` watches 'who viewed my profile' (source unipile). With --auto-enroll it enrolls harvested people into --sequence, capped by --max-enrolls-per-day. --max-credits-per-cycle is the standing per-cycle spend cap (required for --auto-enroll and cookieless). No messages are sent by the watch itself.")
+        .requiredOption("--kind <kind>", "post | profile_viewers.")
+        .requiredOption("--account <ref>", "Reading LinkedIn sender (sender id, connection id, or Unipile account id).")
+        .option("--post <social_id>", "Composite post social_id from `oxygen posts get` (required for --kind post).")
+        .option("--post-url <url>", "Public LinkedIn post URL (required for a cookieless post watch).")
+        .option("--source <source>", "cookieless | unipile. Defaults to cookieless for post, unipile for profile_viewers.")
+        .option("--table <id_or_slug>", "Existing table to land harvested people into. Omit to create one.")
+        .option("--sequence <id_or_slug>", "Sequence to auto-enroll harvested people into (required with --auto-enroll).")
+        .option("--auto-enroll", "Auto-enroll newly harvested people into --sequence under the standing approval.")
+        .option("--max-credits-per-cycle <credits>", "Standing per-cycle managed-spend cap (required for --auto-enroll and cookieless).")
+        .option("--max-enrolls-per-day <n>", "Cap auto-enrollments per day.")
+        .option("--recurrence <recurrence>", "once | every_6h | daily | weekly (default once).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("engagement watch create", options, () => {
+            const kind = readOption(options.kind);
+            const account = readOption(options.account);
+            const post = readOption(options.post);
+            const postUrl = readOption(options.postUrl);
+            const source = readOption(options.source);
+            const table = readOption(options.table);
+            const sequence = readOption(options.sequence);
+            const maxCreditsPerCycle = readPositiveNumber(options.maxCreditsPerCycle);
+            const maxEnrollsPerDay = readPositiveNumber(options.maxEnrollsPerDay);
+            const recurrence = readOption(options.recurrence);
+            return requestOxygen("/api/cli/linkedin/engagement/watches", {
+                method: "POST",
+                body: {
+                    ...(kind ? { kind } : {}),
+                    ...(account ? { account } : {}),
+                    ...(post ? { post } : {}),
+                    ...(postUrl ? { post_url: postUrl } : {}),
+                    ...(source ? { source } : {}),
+                    ...(table ? { table } : {}),
+                    ...(sequence ? { sequence } : {}),
+                    ...(options.autoEnroll ? { auto_enroll: true } : {}),
+                    ...(maxCreditsPerCycle !== undefined ? { max_credits_per_cycle: maxCreditsPerCycle } : {}),
+                    ...(maxEnrollsPerDay !== undefined ? { max_enrolls_per_day: maxEnrollsPerDay } : {}),
+                    ...(recurrence ? { recurrence } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("list")
+        .description("List the org's engagement watches (status, kind, sender, sequence, per-day enroll count) with a table deep-link.")
+        .option("--status <status>", "Filter by status: active | paused | exhausted | completed.")
+        .option("--kind <kind>", "Filter by kind.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("engagement watch list", options, () => {
+            const status = readOption(options.status);
+            const kind = readOption(options.kind);
+            const params = new URLSearchParams();
+            if (status)
+                params.set("status", status);
+            if (kind)
+                params.set("kind", kind);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/linkedin/engagement/watches${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("pause")
+        .description("Pause a watch (stop materializing its harvest + auto-enrolling).")
+        .argument("<watchId>", "Watch id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (watchId, options) => {
+        await handleAsyncAction("engagement watch pause", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
+            method: "PATCH",
+            body: { action: "pause" },
+        }));
+    }))
+        .addCommand(new Command("resume")
+        .description("Resume a paused watch.")
+        .argument("<watchId>", "Watch id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (watchId, options) => {
+        await handleAsyncAction("engagement watch resume", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
+            method: "PATCH",
+            body: { action: "resume" },
+        }));
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a watch (its harvested table + rows are kept).")
+        .argument("<watchId>", "Watch id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (watchId, options) => {
+        await handleAsyncAction("engagement watch delete", options, () => requestOxygen(`/api/cli/linkedin/engagement/watches/${encodeURIComponent(watchId)}`, {
+            method: "DELETE",
+        }));
+    }))));
     program.addCommand(new Command("linkedin")
         .description("LinkedIn read-into-workspace ingestion controls (Goal-3): the unified status of the connections / engagement / message-history drips and each account's remaining ingest read budget.")
         .addCommand(new Command("ingestion")
@@ -5406,12 +5787,14 @@ export function createProgram() {
         .requiredOption("--text <message>", "Reply text to send.")
         .option("--channel <channel>", "Inbox channel: linkedin (default), whatsapp (warm reply), or email.")
         .option("--approved", "Approve and send the message. Without this flag, returns a preview only.")
-        .option("--draft-id <id>", "Email only: when approving an AI reply-agent draft, its id (marks it sent on success).")
+        .option("--draft-id <id>", "When approving an AI reply-agent draft (email or LinkedIn), its id (marks it sent on success). Use the matching --channel.")
+        .option("--attach <url>", "LinkedIn only: attach a file by public URL (image/document). Repeatable, up to 5.", collectRepeatable, [])
         .option("--json", "Print a JSON envelope.")
         .action(async (conversation, options) => {
         await handleAsyncAction("inbox send", options, () => {
             const channel = readOption(options.channel);
             const draftId = readOption(options.draftId);
+            const attachments = (options.attach ?? []).map((url) => url.trim()).filter(Boolean).map((url) => ({ url }));
             return requestOxygen(`/api/cli/inbox/${encodeURIComponent(conversation)}/send`, {
                 method: "POST",
                 body: {
@@ -5419,6 +5802,7 @@ export function createProgram() {
                     ...(channel ? { channel } : {}),
                     ...(options.approved ? { approved: true } : {}),
                     ...(draftId ? { draft_id: draftId } : {}),
+                    ...(attachments.length > 0 ? { attachments } : {}),
                 },
             });
         });
@@ -5579,32 +5963,51 @@ export function createProgram() {
         .argument("<name>", "Display name.")
         .option("--color <hex>", "Hex color (e.g. #22c55e).")
         .option("--bucket <bucket>", "primary (default) or others.")
+        .option("--ai-settable", "Let the AI reply classifier assign this label.")
+        .option("--description <text>", "What the label means / when it applies (used by the AI classifier).")
         .option("--json", "Print a JSON envelope.")
         .action(async (name, options) => {
         await handleAsyncAction("inbox label create", options, () => {
             const color = readOption(options.color);
             const bucket = readOption(options.bucket);
+            const description = readOption(options.description);
             return requestOxygen("/api/cli/inbox/labels", {
                 method: "POST",
-                body: { name, ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+                body: {
+                    name,
+                    ...(color ? { color } : {}),
+                    ...(bucket ? { bucket } : {}),
+                    ...(options.aiSettable ? { ai_settable: true } : {}),
+                    ...(description ? { description } : {}),
+                },
             });
         });
     }))
         .addCommand(new Command("update")
-        .description("Update a status label's name, color, or bucket.")
+        .description("Update a status label's name, color, bucket, description, or (custom labels only) ai-settable flag.")
         .argument("<key>", "The label key.")
         .option("--name <name>", "New display name.")
         .option("--color <hex>", "New hex color.")
         .option("--bucket <bucket>", "New bucket (primary or others).")
+        .option("--ai-settable", "Let the AI classifier assign this label (custom labels only).")
+        .option("--no-ai-settable", "Stop the AI classifier assigning this label (custom labels only).")
+        .option("--description <text>", "What the label means / when it applies (used by the AI classifier).")
         .option("--json", "Print a JSON envelope.")
         .action(async (key, options) => {
         await handleAsyncAction("inbox label update", options, () => {
             const name = readOption(options.name);
             const color = readOption(options.color);
             const bucket = readOption(options.bucket);
+            const description = readOption(options.description);
             return requestOxygen(`/api/cli/inbox/labels/${encodeURIComponent(key)}`, {
                 method: "PATCH",
-                body: { ...(name ? { name } : {}), ...(color ? { color } : {}), ...(bucket ? { bucket } : {}) },
+                body: {
+                    ...(name ? { name } : {}),
+                    ...(color ? { color } : {}),
+                    ...(bucket ? { bucket } : {}),
+                    ...(options.aiSettable !== undefined ? { ai_settable: options.aiSettable } : {}),
+                    ...(description ? { description } : {}),
+                },
             });
         });
     }))
@@ -5618,9 +6021,10 @@ export function createProgram() {
         .addCommand(new Command("drafts")
         .description("The AI reply-agent draft queue (the approve-before-send review queue).")
         .addCommand(new Command("list")
-        .description("List drafts awaiting review (queued + edited by default).")
+        .description("List drafts awaiting review (queued + edited by default), across email + LinkedIn.")
         .option("--status <keys>", "Comma-separated draft statuses (queued,edited,sent,rejected).")
-        .option("--sequence-id <id>", "Filter to one campaign (sequence) id.")
+        .option("--channel <channel>", "Filter to one channel: email or linkedin.")
+        .option("--sequence-id <id>", "Filter to one campaign (sequence) id (email drafts only).")
         .option("--limit <n>", "Maximum drafts to return.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -5629,6 +6033,9 @@ export function createProgram() {
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const channel = readOption(options.channel);
+            if (channel)
+                params.set("channel", channel);
             const sequenceId = readOption(options.sequenceId);
             if (sequenceId)
                 params.set("sequence_id", sequenceId);
@@ -5682,6 +6089,7 @@ export function createProgram() {
         .option("--signature <text>", "Signature appended to drafts.")
         .option("--target-statuses <keys>", "Comma-separated statuses to draft for (empty = all draftable).")
         .option("--target-sequence-ids <ids>", "Comma-separated campaign ids to draft for (empty = all).")
+        .option("--channels <list>", "Comma-separated channels to draft for: a non-empty subset of email, linkedin (default email). LinkedIn drafts are short + signature-free.")
         .option("--max-drafts-per-day <n>", "Per-day draft cap.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -5709,6 +6117,9 @@ export function createProgram() {
             if (options.targetSequenceIds !== undefined) {
                 body.target_sequence_ids = options.targetSequenceIds.split(",").map((s) => s.trim()).filter(Boolean);
             }
+            if (options.channels !== undefined) {
+                body.channels = options.channels.split(",").map((c) => c.trim()).filter(Boolean);
+            }
             if (options.maxDraftsPerDay !== undefined)
                 body.max_drafts_per_day = Number(options.maxDraftsPerDay);
             return requestOxygen("/api/cli/inbox/reply-agent", { method: "POST", body });
@@ -5844,6 +6255,12 @@ export function createProgram() {
         .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
         .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
         .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
+        .option("--max-emails-per-day <n>", "Sequence-wide daily live-send fleet cap (positive integer) across every sender/mailbox.")
+        .option("--max-new-enrollments-per-day <n>", "Daily drip cap on NEW first-touch leads the planner starts (positive integer).")
+        .option("--sequence-prioritization <mode>", "Under a tight daily budget, serve 'followups' or 'new_leads' first.")
+        .option("--schedule-template <name>", "Name of a saved schedule template (oxygen schedules) backing the sending window.")
+        .option("--esp-matching <mode>", "Native-email ESP matching: 'off' (default) rotates mailboxes freely; 'prefer' biases toward a mailbox on the recipient's own provider; 'strict' requires a same-provider mailbox and defers the send when none exists.")
+        .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences create", options, () => {
@@ -5892,6 +6309,12 @@ export function createProgram() {
         .option("--max-live-sends <n>", "Send ceiling for the email track (positive integer). Required to start an email sequence live.")
         .option("--max-emails-per-mailbox-per-day <n>", "Per-mailbox daily email cap (positive integer) applied across the sending pool.")
         .option("--send-window-file <path>", "Path to a JSON file with the sequence-level email send window: { timezone, days?, start, end, timezone_mode?, recipient_timezone_column? }.")
+        .option("--max-emails-per-day <n>", "Sequence-wide daily live-send fleet cap (positive integer) across every sender/mailbox.")
+        .option("--max-new-enrollments-per-day <n>", "Daily drip cap on NEW first-touch leads the planner starts (positive integer).")
+        .option("--sequence-prioritization <mode>", "Under a tight daily budget, serve 'followups' or 'new_leads' first.")
+        .option("--schedule-template <name>", "Name of a saved schedule template (oxygen schedules) backing the sending window.")
+        .option("--esp-matching <mode>", "Native-email ESP matching: 'off' (default) rotates mailboxes freely; 'prefer' biases toward a mailbox on the recipient's own provider; 'strict' requires a same-provider mailbox and defers the send when none exists.")
+        .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences update", options, () => {
@@ -5927,7 +6350,7 @@ export function createProgram() {
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, or --send-window-file).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, or --no-stop-on-bounce).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -5943,11 +6366,12 @@ export function createProgram() {
         await handleAsyncAction("sequences get", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`));
     }))
         .addCommand(new Command("enroll")
-        .description("Enroll leads into a sequence from a JSON file of { leads: [...] }. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row. The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason).")
+        .description("Enroll leads into a sequence from a JSON file of { leads: [...] }. When the sequence is bound to a source table, a lead's table_row_id auto-snapshots that row's columns (incl. AI/tool outputs) into row_values for {{column}} copy — explicit row_values win. Idempotent per table row. The org do-not-contact list is always enforced; --exclude-contacted and --suppress-list add further opt-in skips (reported under skipped_by_reason). Leads already owned by a sender account (from an earlier real send) are routed back to that same account; a lead owned by a sender NOT on this sequence is skipped (bound_to_other_sender) unless --ignore-sender-bindings.")
         .argument("<sequence>", "Sequence id or slug.")
         .requiredOption("--leads-file <path>", "Path to a JSON file: { \"leads\": [{ lead_provider_id, lead_name, table_row_id, row_values }] }.")
         .option("--exclude-contacted", "Also skip leads any OTHER active sequence is already contacting (cross-campaign exclusion). Off by default.")
         .option("--suppress-list <ids>", "Per-call do-not-enroll lead provider ids dropped for this enroll only: a comma-separated list, or @<path> to a file of ids (comma/whitespace separated).")
+        .option("--ignore-sender-bindings", "Enroll leads even when they are already owned by a sender account outside this sequence's pool (overrides the one-person-one-sender guarantee). Off by default.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences enroll", options, () => {
@@ -5962,6 +6386,7 @@ export function createProgram() {
                     leads: parsed.leads ?? [],
                     ...(options.excludeContacted ? { exclude_contacted: true } : {}),
                     ...(suppressList.length > 0 ? { suppress_list: suppressList } : {}),
+                    ...(options.ignoreSenderBindings ? { ignore_sender_bindings: true } : {}),
                 },
             });
         });
@@ -6053,12 +6478,50 @@ export function createProgram() {
         await handleAsyncAction("sequences stats", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/stats`));
     }))
         .addCommand(new Command("variants")
-        .description("Break the sequence's email performance down by A/B variant (per step) and by sending mailbox: sent, replied, reply rate, bounced/failed, and credits used.")
+        .description("A/B scoreboard for a sequence: per-step/per-variant sent, replied, reply rate, bounced, credits, plus the reversible auto-winner state (which variants are paused + evidence). Flags run the reply-metric auto-winner or manually override/reset a variant's pause.")
         .argument("<sequence>", "Sequence id or slug.")
+        .option("--auto-optimize", "Run the reply-metric auto-winner now: pause the statistically-losing variant(s) of any step carrying an auto_optimize config, once every variant clears its thresholds. Reversible.")
+        .option("--pause <variant>", "Manually pause one variant (requires --step). Overrides the auto-winner.")
+        .option("--activate <variant>", "Manually reactivate one paused variant (requires --step).")
+        .option("--reset [variant]", "Clear an auto/manual decision: one variant (with --step), a whole step (--step only), or the entire sequence (no value). Reactivates the affected variants.")
+        .option("--step <stepId>", "Step id to scope --pause/--activate/--reset to.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleSequenceVariantsAction(sequence, options);
     })));
+    program.addCommand(new Command("schedules")
+        .description("Named, reusable sending-schedule templates (timezone + weekdays + from/to). Reference one from a sequence via --schedule-template so a single 'US business hours' window backs many sequences.")
+        .addCommand(new Command("list")
+        .description("List the org's saved schedule templates.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("schedules list", options, () => requestOxygen("/api/cli/schedules"));
+    }))
+        .addCommand(new Command("create")
+        .description("Create (or update by name) a schedule template. Partial windows get sensible defaults.")
+        .requiredOption("--name <name>", "Unique template name (e.g. 'US business hours').")
+        .requiredOption("--timezone <tz>", "IANA timezone (e.g. America/New_York).")
+        .option("--start <HH:MM>", "Inclusive daily start time.", "09:00")
+        .option("--end <HH:MM>", "Exclusive daily end time.", "17:00")
+        .option("--days <csv>", "Allowed ISO weekdays, 1=Mon..7=Sun (e.g. 1,2,3,4,5). Omit → weekdays default.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("schedules create", options, () => {
+            const days = readCsvOption(options.days).map((d) => Number(d)).filter((d) => Number.isInteger(d));
+            return requestOxygen("/api/cli/schedules", {
+                method: "POST",
+                body: {
+                    name: readOption(options.name),
+                    definition: {
+                        timezone: readOption(options.timezone),
+                        ...(readOption(options.start) ? { start: readOption(options.start) } : {}),
+                        ...(readOption(options.end) ? { end: readOption(options.end) } : {}),
+                        ...(days.length > 0 ? { days } : {}),
+                    },
+                },
+            });
+        });
+    })));
     program.addCommand(new Command("suppressions")
         .description("Org do-not-contact list (people/multichannel): lead provider ids the sequencer enroller always skips at plan time. list | add | remove. Consumes 0 credits.")
         .addCommand(new Command("list")
@@ -6132,6 +6595,11 @@ export function createProgram() {
         .requiredOption("--subject <text>", "Subject line.")
         .option("--body <text>", "Plain-text body (sent verbatim, no templating).")
         .option("--body-file <path>", "Read the body from a file instead of --body.")
+        .option("--html <html>", "Optional HTML body — sends multipart/alternative with --body as the plain-text part.")
+        .option("--html-file <path>", "Read the HTML body from a file instead of --html.")
+        .option("--display-name <name>", "From display name for this send (overrides the mailbox's stored display name).")
+        .option("--cc <list>", "Comma-separated Cc addresses.")
+        .option("--bcc <list>", "Comma-separated Bcc addresses.")
         .option("--from <mailbox>", "Sending mailbox (address or id). Defaults to the pool rotation.")
         .option("--approved", "Approve and send. Without this flag, returns a preview only.")
         .option("--json", "Print a JSON envelope.")
@@ -6141,12 +6609,19 @@ export function createProgram() {
             if (!bodyText || !bodyText.trim()) {
                 throw new Error("Provide --body or --body-file.");
             }
+            const htmlBody = readOption(options.html) ?? (options.htmlFile ? readFileSync(resolve(options.htmlFile), "utf8") : undefined);
+            const cc = readCsvOption(options.cc);
+            const bcc = readCsvOption(options.bcc);
             return requestOxygen("/api/cli/email/send", {
                 method: "POST",
                 body: {
                     to: readOption(options.to),
                     subject: readOption(options.subject),
                     body: bodyText,
+                    ...(htmlBody && htmlBody.trim() ? { html: htmlBody } : {}),
+                    ...(readOption(options.displayName) ? { display_name: readOption(options.displayName) } : {}),
+                    ...(cc.length > 0 ? { cc } : {}),
+                    ...(bcc.length > 0 ? { bcc } : {}),
                     ...(readOption(options.from) ? { from: readOption(options.from) } : {}),
                     ...(options.approved ? { approved: true } : {}),
                 },
@@ -6175,6 +6650,12 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
         await handleAsyncAction("mailboxes get", options, () => requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}`));
+    }))
+        .addCommand(new Command("health")
+        .description("Fleet email-health: the sending pool rolled up by external deliverability reputation (healthy/degraded/critical/unknown), per-mailbox scores, connected health providers, and DIRECTIONAL recommendations. Pure read — 0 credits; never pauses a mailbox.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("import")
         .description("Register (or refresh) sending mailboxes in bulk. Provide --file (a JSON file: { \"mailboxes\": [{ email_address, provider, workspace_external_id? }] }) or --from zapmail to pull the connected Zapmail workspace's mailbox list. Upsert is keyed by address, so re-importing never duplicates a mailbox.")
@@ -6244,6 +6725,67 @@ export function createProgram() {
             });
         });
     })))
+        .addCommand(new Command("ramp")
+        .description("Set or clear a single mailbox's per-mailbox warm-up ramp override (start/step/cap), replacing the default age-ramp tiers on that inbox without touching the rest of the pool.")
+        .addCommand(new Command("set")
+        .description("Set one mailbox's warm-up ramp: --start-per-day (day-0 ceiling), --increase-every-days (>=1), --step (added each period), --cap (ceiling). Pass --clear to remove the override and restore the default tiers. Consumes no Oxygen credits. <mailbox> accepts a mailbox id or email address.")
+        .argument("<mailbox>", "Mailbox id or email address.")
+        .option("--start-per-day <n>", "Day-0 send ceiling (non-negative whole number).")
+        .option("--increase-every-days <n>", "Days between each step up (whole number >= 1).")
+        .option("--step <n>", "Sends added to the ceiling each period (non-negative whole number).")
+        .option("--cap <n>", "The ramp's ceiling; once reached the ramp stops climbing (non-negative whole number).")
+        .option("--clear", "Remove the ramp override and restore the default warm-up tiers.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (mailbox, options) => {
+        await handleAsyncAction("mailboxes ramp set", options, () => {
+            if (options.clear) {
+                return requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}/ramp`, {
+                    method: "PATCH",
+                    body: { ramp_config: null },
+                });
+            }
+            const startPerDay = readPositiveInteger(options.startPerDay);
+            const increaseEveryDays = readPositiveInteger(options.increaseEveryDays);
+            const step = readPositiveInteger(options.step);
+            const cap = readPositiveInteger(options.cap);
+            if (startPerDay === undefined || increaseEveryDays === undefined || step === undefined || cap === undefined) {
+                throw new Error("Provide --start-per-day, --increase-every-days, --step, and --cap (or --clear to remove the override).");
+            }
+            return requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}/ramp`, {
+                method: "PATCH",
+                body: { ramp_config: { start_per_day: startPerDay, increase_every_days: increaseEveryDays, step, cap } },
+            });
+        });
+    })))
+        .addCommand(new Command("update")
+        .description("Update a sending mailbox's rich-content profile: the From display name and/or the HTML signature appended to its sends. Pass an empty string ('') to clear a field. Consumes no Oxygen credits. <mailbox> accepts a mailbox id or email address.")
+        .argument("<mailbox>", "Mailbox id or email address.")
+        .option("--display-name <name>", "From display name (e.g. \"Ada from Acme\"). Pass '' to clear it.")
+        .option("--signature-html <html>", "HTML signature appended to every send from this mailbox. Pass '' to clear it.")
+        .option("--signature-file <path>", "Read the HTML signature from a file instead of --signature-html.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (mailbox, options) => {
+        await handleAsyncAction("mailboxes update", options, () => {
+            // Detect PRESENCE (options.x !== undefined), not truthiness, so passing
+            // an empty string clears the field rather than being dropped.
+            const patch = {};
+            if (options.displayName !== undefined)
+                patch.display_name = options.displayName;
+            if (options.signatureHtml !== undefined) {
+                patch.signature_html = options.signatureHtml;
+            }
+            else if (options.signatureFile) {
+                patch.signature_html = readFileSync(resolve(options.signatureFile), "utf8");
+            }
+            if (Object.keys(patch).length === 0) {
+                throw new Error("Provide --display-name and/or --signature-html (or --signature-file).");
+            }
+            return requestOxygen(`/api/cli/mailboxes/${encodeURIComponent(mailbox)}`, {
+                method: "PATCH",
+                body: patch,
+            });
+        });
+    }))
         .addCommand(new Command("connect-oauth")
         .description("Provision Zapmail Custom OAuth across the mailbox pool: registers Oxygen's own OAuth app with Zapmail, which authorizes it across the Workspaces so native send needs no per-Workspace delegation. BYOK — Zapmail bills your account, 0 Oxygen credits. Pass --status <export_id> to poll a run.")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
@@ -6276,6 +6818,12 @@ export function createProgram() {
                 },
             });
         });
+    }))
+        .addCommand(new Command("oauth-health")
+        .description("Show the delegation-stuck sending mailboxes: Zapmail-linked google inboxes still on auth_mode=delegation with no OAuth grant, each with its Custom OAuth budget (attempts in the last 7 days, remaining re-export posts before Zapmail's 3-per-mailbox-per-7-day cap, last error, and next safe retry time). Read-only — 0 Oxygen credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
     }))
         .addCommand(new Command("warmup")
         .description("Mailbox warmup via Instantly (BYOK — Instantly bills your account, 0 Oxygen credits).")
@@ -6319,6 +6867,96 @@ export function createProgram() {
             const suffix = params.toString();
             return requestOxygen(`/api/cli/mailboxes/warmup/status${suffix ? `?${suffix}` : ""}`);
         });
+    })))
+        .addCommand(new Command("order")
+        .description("Order NEW sending mailboxes (domain + inboxes + warmup) on the OXYGEN-managed Zapmail wallet, billed to Oxygen credits. Without --approved returns a priced preview + quote_id. FAILS CLOSED (409) until managed ordering is enabled.")
+        .requiredOption("--provider <provider>", "Mailbox provider: google or microsoft.")
+        .requiredOption("--domains <domains>", "Comma-separated sending domains (e.g. send.acme.com,mail.acme.io).")
+        .option("--mailboxes-per-domain <n>", "Mailboxes to provision per domain (positive whole number). Defaults to 1.")
+        .option("--workspace <id>", "Optional Zapmail workspace key to provision into.")
+        .option("--approved", "Place the order (requires --quote from a fresh preview).")
+        .option("--quote <id>", "The quote_id from a fresh preview (required with --approved).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes order", options, () => {
+            const domains = readOption(options.domains)?.split(",").map((d) => d.trim()).filter(Boolean) ?? [];
+            const perDomain = readOption(options.mailboxesPerDomain);
+            const workspace = readOption(options.workspace);
+            const quote = readOption(options.quote);
+            return requestOxygen("/api/cli/mailboxes/order", {
+                method: "POST",
+                body: {
+                    provider: readOption(options.provider),
+                    domains,
+                    ...(perDomain ? { mailboxes_per_domain: Number(perDomain) } : {}),
+                    ...(workspace ? { workspace_id: workspace } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                    ...(quote ? { quote_id: quote } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("orders")
+        .description("List the org's managed mailbox provisioning orders (newest first).")
+        .option("--status <status>", "Comma-separated status filter (e.g. provisioning,warming).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("mailboxes orders", options, () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            if (status)
+                params.set("status", status);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/mailboxes/orders${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("order-status")
+        .description("Show one managed mailbox order's status (provider, domains, status, quote, held credits, Zapmail refs).")
+        .argument("<order>", "Mailbox order id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (order, options) => {
+        await handleAsyncAction("mailboxes order-status", options, () => requestOxygen(`/api/cli/mailboxes/orders/${encodeURIComponent(order)}`));
+    })));
+    program.addCommand(new Command("deliverability")
+        .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests. Placement tests are approval-gated paid runs (managed = 2 credits, BYOK = 0); fail closed with 409 when no health provider is connected.")
+        .addCommand(new Command("placement-test")
+        .description("Directional inbox-placement (spam) tests: run, list, and get. Results estimate inbox-vs-spam landing from seed inboxes.")
+        .addCommand(new Command("run")
+        .description("Start a placement test for one sending mailbox. Without --approved this returns a PREVIEW (billing mode + credits_required). Re-run with --approved and --max-credits >= credits_required to send.")
+        .argument("<mailbox>", "Sending mailbox address to test (e.g. ada@send.acme.com).")
+        .option("--subject <subject>", "Optional subject for the seed message.")
+        .option("--body <text>", "Optional plain-text body for the seed message.")
+        .option("--approved", "Actually run the test (otherwise a preview is returned).")
+        .option("--max-credits <n>", "Credit cap the caller accepts (must be >= credits_required for managed runs).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (mailbox, options) => {
+        await handleAsyncAction("deliverability placement-test run", options, () => requestOxygen("/api/cli/deliverability/placement-tests", {
+            method: "POST",
+            body: {
+                mailbox,
+                ...(readOption(options.subject) ? { subject: readOption(options.subject) } : {}),
+                ...(readOption(options.body) ? { body_text: readOption(options.body) } : {}),
+                ...(options.approved ? { approved: true } : {}),
+                ...(readOption(options.maxCredits) ? { max_credits: Number(readOption(options.maxCredits)) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("list")
+        .description("List recent directional inbox-placement tests with status, billing mode, seed set, score, and credits used.")
+        .option("--limit <n>", "Max rows (default 50, cap 200).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("deliverability placement-test list", options, () => {
+            const limit = readOption(options.limit);
+            return requestOxygen(`/api/cli/deliverability/placement-tests${limit ? `?limit=${encodeURIComponent(limit)}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Get one directional inbox-placement test by id — status, seed inboxes, per-provider results, and score.")
+        .argument("<id>", "Placement test id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("deliverability placement-test get", options, () => requestOxygen(`/api/cli/deliverability/placement-tests/${encodeURIComponent(id)}`));
     }))));
     program.addCommand(new Command("domains")
         .description("Cold-email domain management on the org's own Cloudflare account (BYOK): sync zones, inspect age/warmup/DNS health, check availability and pricing, and buy domains. Purchases bill your Cloudflare payment method, never Oxygen credits.")
@@ -6359,11 +6997,90 @@ export function createProgram() {
         await handleAsyncAction("domains get", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}`));
     }))
         .addCommand(new Command("dns")
-        .description("Run a live read-only DNS health check (SPF, DKIM, DMARC, MX) against the domain's Cloudflare zone and persist the result.")
+        .description("Run a live read-only DNS health check (SPF, DKIM, DMARC, MX) against the domain's Cloudflare zone and persist the result. Add --deep for content-level checks (SPF DNS-lookup budget, DMARC enforcement, MX provider) plus an external DNS-over-HTTPS nameserver-authority check. Use `dns plan`/`dns apply` to fix records.")
+        .argument("[domain]", "Domain name, such as acme.com.")
+        .option("--deep", "Add content-level DNS analysis (SPF lookup budget, DMARC enforcement, MX provider) and an external DoH nameserver-authority check.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        if (!domain) {
+            throw new Error("Provide a domain (oxygen domains dns <domain>) or use a subcommand: `dns plan` / `dns apply`.");
+        }
+        const suffix = options.deep ? "?deep=true" : "";
+        await handleAsyncAction("domains dns", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/dns${suffix}`));
+    })
+        .addCommand(new Command("plan")
+        .description("Preview the cold-email DNS records a domain should hold for its mailbox provider (SPF, per-provider DKIM, DMARC, MX, optional tracking) as a create/update/keep/conflict diff plus a plan_hash. FREE — nothing is written.")
+        .argument("<domain>", "Domain name, such as acme.com.")
+        .requiredOption("--provider <provider>", "Mailbox provider: google or microsoft (determines SPF/MX/DKIM).")
+        .option("--dmarc-policy <policy>", "DMARC policy: none (default), quarantine, or reject.")
+        .option("--dmarc-rua <mailbox>", "DMARC aggregate-report mailbox (rua=mailto:...).")
+        .option("--tracking-host <host>", "Open/click tracking CNAME host (only planned when tracking is configured).")
+        .option("--no-auto-dkim", "Skip auto-deriving Microsoft DKIM selector1/selector2 CNAMEs (default: auto-derive them for microsoft when no DKIM is supplied).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains dns plan", options, () => runDomainsDnsPlan(domain, options));
+    }))
+        .addCommand(new Command("apply")
+        .description("Write the planned cold-email DNS records into the domain's Cloudflare zone. Requires a fresh plan_hash from `dns plan`. No Oxygen credits (Cloudflare does not charge for DNS writes). Without --approved, re-previews the plan.")
         .argument("<domain>", "Domain name, such as acme.com.")
+        .requiredOption("--provider <provider>", "Mailbox provider: google or microsoft (must match the plan).")
+        .option("--approved", "Write the records. Without this flag, returns a plan preview only.")
+        .option("--plan <hash>", "plan_hash from a fresh `dns plan` (required with --approved).")
+        .option("--dmarc-policy <policy>", "DMARC policy: none (default), quarantine, or reject.")
+        .option("--dmarc-rua <mailbox>", "DMARC aggregate-report mailbox (rua=mailto:...).")
+        .option("--tracking-host <host>", "Open/click tracking CNAME host (only applied when tracking is configured).")
+        .option("--no-auto-dkim", "Skip auto-deriving Microsoft DKIM (must match the value used in `dns plan` so the plan_hash matches).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains dns apply", options, () => runDomainsDnsApply(domain, options));
+    })))
+        .addCommand(new Command("tracking")
+        .description("Open/click tracking domain for native cold email: provision the tracking CNAME on the domain's Cloudflare zone and check its verification status. 0 Oxygen credits.")
+        .addCommand(new Command("setup")
+        .description("Provision the open/click tracking CNAME (<track-host> CNAME <tracking target>) on the domain's Cloudflare zone. Without --approve, previews the exact record. GATE: needs EMAIL_TRACKING_CNAME_TARGET configured + the tracking hostname attached on Vercel; send-time injection stays off until EMAIL_TRACKING_SECRET is set.")
+        .argument("<domain>", "Sending domain, such as acme.com.")
+        .option("--host <host>", "Tracking subdomain (default track.<domain>); must be a subdomain of the domain.")
+        .option("--approve", "Write the CNAME. Without this flag, returns a preview only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains tracking setup", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/tracking`, {
+            method: "POST",
+            body: { ...(options.host ? { host: options.host } : {}), ...(options.approve ? { approved: true } : {}) },
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show the open/click tracking status for a domain (configured host, verification status, CNAME target, whether the tracking secret is set). Reads the cache — 0 Oxygen credits.")
+        .argument("<domain>", "Sending domain, such as acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains tracking status", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/tracking`));
+    })))
+        .addCommand(new Command("postmaster")
+        .description("Google Postmaster Tools onboarding for a sending domain: register it with Postmaster, publish the DNS verification TXT via its Cloudflare zone, and check verification status. FREE — 0 Oxygen credits.")
+        .addCommand(new Command("onboard")
+        .description("Register the domain with Google Postmaster Tools and publish the DNS verification TXT automatically via the domain's Cloudflare zone (or return the record for manual DNS); verification then completes automatically in the background. Without --approve, returns a preview. FREE — 0 Oxygen credits.")
+        .argument("<domain>", "Sending domain, such as acme.com.")
+        .option("--approve", "Perform the onboarding. Without this flag, returns a preview only.")
         .option("--json", "Print a JSON envelope.")
         .action(async (domain, options) => {
-        await handleAsyncAction("domains dns", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/dns`));
+        await handleAsyncAction("domains postmaster onboard", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/postmaster`, {
+            method: "POST",
+            body: { ...(options.approve ? { approved: true } : {}) },
+        }));
+    }))
+        .addCommand(new Command("status")
+        .description("Show the Google Postmaster Tools onboarding status for a domain: registration, DNS verification state, and whether reputation data is available. Read-only — 0 Oxygen credits.")
+        .argument("<domain>", "Sending domain, such as acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains postmaster status", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/postmaster`));
+    })))
+        .addCommand(new Command("add")
+        .description("Onboard a domain registered elsewhere by creating a Cloudflare zone for it, so its DNS can be managed here. Returns the nameservers to set at your registrar. Idempotent.")
+        .argument("<domain>", "Apex domain to add, such as acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains add", options, () => requestOxygen("/api/cli/domains/add", { method: "POST", body: { domain } }));
     }))
         .addCommand(new Command("search")
         .description("Search Cloudflare Registrar for available domains with registration/renewal pricing. Free — nothing is purchased.")
@@ -8674,6 +9391,44 @@ function domainsBuyRerunCommand(domains, quoteId, options, data) {
     ];
     return `${resolveCliBinaryName()} domains buy ${domains.join(" ")} ${flags.join(" ")}`;
 }
+function dnsPlanBody(options) {
+    const provider = readOption(options.provider);
+    if (!provider) {
+        throw new Error("--provider <google|microsoft> is required so the correct SPF/MX/DKIM records can be planned.");
+    }
+    return {
+        provider,
+        ...(readOption(options.dmarcPolicy) ? { dmarc_policy: readOption(options.dmarcPolicy) } : {}),
+        ...(readOption(options.dmarcRua) ? { dmarc_rua: readOption(options.dmarcRua) } : {}),
+        ...(readOption(options.trackingHost) ? { tracking_host: readOption(options.trackingHost) } : {}),
+        ...(options.autoDkim === false ? { auto_dkim: false } : {}),
+    };
+}
+// Preview the cold-email DNS plan for a domain (free — no writes). Appends a
+// copy-paste rerun command carrying the plan_hash, mirroring the buy quote flow.
+async function runDomainsDnsPlan(domain, options) {
+    const data = await requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/dns/plan`, { method: "POST", body: dnsPlanBody(options) });
+    const planHash = readRecordString(data, "plan_hash");
+    const provider = readOption(options.provider);
+    return planHash && provider
+        ? { ...data, rerun_command: `${resolveCliBinaryName()} domains dns apply ${domain} --provider ${provider} --approved --plan ${planHash}` }
+        : data;
+}
+// Apply an approved DNS plan (writes records). Requires --plan <hash> with
+// --approved, mirroring `domains buy --quote`.
+async function runDomainsDnsApply(domain, options) {
+    const planHash = readOption(options.plan);
+    if (options.approved && !planHash) {
+        throw new Error("--plan <hash> is required with --approved. Run `domains dns plan` first to get the plan and its hash.");
+    }
+    return requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/dns/apply`, {
+        method: "POST",
+        body: {
+            ...dnsPlanBody(options),
+            ...(options.approved ? { approved: true, plan_hash: planHash } : {}),
+        },
+    });
+}
 // Staff import of pre-existing managed-account domains. Exactly one of an explicit
 // list or --all; without --yes the server returns a preview and the CLI appends a
 // copy-paste rerun command to execute it.
@@ -8789,6 +9544,33 @@ async function exportRows(table, options) {
         ...(formatted.rescuedCount > 0 ? { rescuedNumericCells: formatted.rescuedCount } : {}),
     };
 }
+// `table-runs list --format` routes run history through the same serializer
+// `tables export` uses, so csv/jsonl/table run exports behave exactly like row
+// exports (header = union of run keys; nested objects like counts are
+// JSON-stringified by escapeCsvField). Without --format/--output the command
+// keeps its original envelope response untouched.
+async function listTableRuns(options) {
+    const rawFormat = readOption(options.format);
+    const outputPath = readOption(options.output);
+    if (!rawFormat && !outputPath)
+        return requestOxygen(tableRunsListPath(options));
+    // Validate the format before spending the API call.
+    const format = normalizeExportRowsFormat(rawFormat ?? undefined);
+    const result = await requestOxygen(tableRunsListPath(options));
+    const runs = Array.isArray(result.runs) ? result.runs.filter(isRecord) : [];
+    const formatted = formatRows(runs, format);
+    if (outputPath)
+        writeFileSync(outputPath, formatted.content);
+    return {
+        table: result.table ?? null,
+        status: result.status ?? null,
+        format,
+        runCount: runs.length,
+        output: outputPath ?? null,
+        ...(outputPath ? {} : { content: formatted.content }),
+        ...(typeof result.web_url === "string" ? { web_url: result.web_url } : {}),
+    };
+}
 const TABLE_BUNDLE_SCHEMA_VERSION = 1;
 const TABLE_BUNDLE_MAX_PAGE_SIZE = 1000;
 const TABLE_BUNDLE_DEFAULT_PAGE_SIZE = 500;
@@ -10359,11 +11141,32 @@ async function handleSequenceSignalAction(sequence, options) {
 }
 async function handleSequenceVariantsAction(sequence, options) {
     try {
-        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/variants`);
+        const path = `/api/cli/sequences/${encodeURIComponent(sequence)}/variants`;
+        let body = null;
+        if (options.autoOptimize)
+            body = { action: "auto_optimize" };
+        else if (options.pause !== undefined)
+            body = { action: "pause", step_id: options.step, variant: options.pause };
+        else if (options.activate !== undefined)
+            body = { action: "activate", step_id: options.step, variant: options.activate };
+        else if (options.reset !== undefined)
+            body = {
+                action: "reset",
+                ...(options.step ? { step_id: options.step } : {}),
+                ...(typeof options.reset === "string" ? { variant: options.reset } : {}),
+            };
+        const data = body
+            ? await requestOxygen(path, { method: "POST", body })
+            : await requestOxygen(path);
         if (options.json) {
             writeJson(success("sequences variants", data));
             return;
         }
+        if (body) {
+            const link = data.deepLink ?? data.web_url;
+            process.stdout.write(`${data.note ?? "Done."}${link ? ` ${link}` : ""}\n`);
+            return;
+        }
         process.stdout.write(formatSequenceVariants(data));
     }
     catch (error) {
@@ -10709,6 +11512,33 @@ function ansi(enabled) {
 function readOption(value) {
     return value?.trim() ? value.trim() : null;
 }
+// Commander collector for a repeatable option (e.g. --attach <url> --attach <url>):
+// accumulates each value into an array.
+function collectRepeatable(value, previous) {
+    return [...previous, value];
+}
+// Shared query string for `posts comments` / `posts reactions` (post social_id +
+// optional comment scope, pagination, sort, and account selection).
+function buildPostEngagementQuery(options) {
+    const params = new URLSearchParams();
+    params.set("post", readOption(options.post) ?? "");
+    const commentId = readOption(options.commentId);
+    if (commentId)
+        params.set("comment_id", commentId);
+    const sortBy = readOption(options.sortBy);
+    if (sortBy)
+        params.set("sort_by", sortBy);
+    const cursor = readOption(options.cursor);
+    if (cursor)
+        params.set("cursor", cursor);
+    const limit = readOption(options.limit);
+    if (limit)
+        params.set("limit", limit);
+    const account = readOption(options.account);
+    if (account)
+        params.set("account", account);
+    return params.toString();
+}
 // Assemble the POST body for `oxygen feedback`. Reads the local chat transcript
 // (unless --no-transcript) and attaches a non-sensitive environment snapshot so
 // the Oxygen team can triage. The transcript read happens here, inside the
@@ -10759,11 +11589,15 @@ function buildSupportTicketBody(options) {
         body.severity = readOption(options.severity);
     if (readOption(options.category))
         body.category = readOption(options.category);
+    if (readOption(options.source))
+        body.source = readOption(options.source);
     const context = {};
     if (readOption(options.operation))
         context.operation = readOption(options.operation);
     if (readOption(options.errorCode))
         context.error_code = readOption(options.errorCode);
+    if (readOption(options.slackPermalink))
+        context.slack_permalink = readOption(options.slackPermalink);
     const runIds = readCsvOption(options.runIds);
     const tableIds = readCsvOption(options.tableIds);
     const deepLinks = readCsvOption(options.deepLinks);
@@ -10788,6 +11622,116 @@ function withSupportListQuery(path, options) {
     const query = params.toString();
     return query ? `${path}?${query}` : path;
 }
+// Workflow text flags (--verify-notes/--plan/--draft) bypass readOption: an
+// explicitly-passed empty string clears the field server-side, while an absent
+// flag leaves it untouched, so "" must survive to the request body.
+function buildSupportAdminWorkflowBody(options) {
+    const body = {};
+    const verifyStatus = readOption(options.verifyStatus);
+    if (verifyStatus)
+        body.verify_status = verifyStatus;
+    if (options.verifyNotes !== undefined)
+        body.verify_notes = options.verifyNotes;
+    const planStatus = readOption(options.planStatus);
+    if (planStatus)
+        body.plan_status = planStatus;
+    if (options.plan !== undefined)
+        body.plan = options.plan;
+    const draftStatus = readOption(options.draftStatus);
+    if (draftStatus)
+        body.draft_status = draftStatus;
+    if (options.draft !== undefined)
+        body.draft_reply = options.draft;
+    if (!Object.keys(body).length) {
+        throw new OxygenError("invalid_request", "Pass at least one of --verify-status, --verify-notes, --plan-status, --plan, --draft-status, --draft.", { exitCode: 1 });
+    }
+    return body;
+}
+function buildSupportAdminUpdateBody(options) {
+    if (options.assign !== undefined && options.unassign) {
+        throw new OxygenError("invalid_request", "Pass either --assign <email> or --unassign, not both.", {
+            exitCode: 1,
+        });
+    }
+    const body = {};
+    const status = readOption(options.status);
+    if (status)
+        body.status = status;
+    const assign = readOption(options.assign);
+    if (assign)
+        body.assignee_email = assign;
+    if (options.unassign)
+        body.assignee_email = null;
+    const note = readOption(options.note);
+    if (note)
+        body.note = note;
+    if (!Object.keys(body).length) {
+        throw new OxygenError("invalid_request", "Pass at least one of --status, --assign, --unassign, --note.", { exitCode: 1 });
+    }
+    return body;
+}
+async function handleSupportAdminWorkflowAction(ticketId, options) {
+    try {
+        const body = buildSupportAdminWorkflowBody(options);
+        const data = await requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/workflow`, { method: "POST", body });
+        if (options.json) {
+            writeJson(success("support admin workflow", data));
+            return;
+        }
+        process.stdout.write(formatSupportAdminWorkflowTicket(data));
+    }
+    catch (error) {
+        const failure = toFailure("support admin workflow", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleSupportAdminUpdateAction(ticketId, options) {
+    try {
+        const body = buildSupportAdminUpdateBody(options);
+        const data = await requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}/update`, { method: "POST", body });
+        if (options.json) {
+            writeJson(success("support admin update", data));
+            return;
+        }
+        process.stdout.write(formatSupportAdminUpdateTicket(data));
+    }
+    catch (error) {
+        const failure = toFailure("support admin update", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function formatSupportAdminWorkflowStep(styles, label, status, artifactLabel, artifact) {
+    const artifactNote = artifact?.trim() ? `${artifactLabel} set` : `no ${artifactLabel}`;
+    return `  ${label.padEnd(6)} ${status ?? "pending"} ${styles.dim(`(${artifactNote})`)}`;
+}
+function formatSupportAdminWorkflowTicket(data) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const ticket = data.ticket ?? {};
+    const workflow = ticket.workflow ?? {};
+    const lines = [
+        `${styles.bold("Workflow updated")}${ticket.subject ? styles.dim(` — ${ticket.subject}`) : ""}`,
+        formatSupportAdminWorkflowStep(styles, "verify", workflow.verify_status, "notes", workflow.verify_notes),
+        formatSupportAdminWorkflowStep(styles, "plan", workflow.plan_status, "plan", workflow.plan),
+        formatSupportAdminWorkflowStep(styles, "draft", workflow.draft_status, "draft reply", workflow.draft_reply),
+    ];
+    if (ticket.admin_web_url)
+        lines.push(`View ticket: ${ticket.admin_web_url}`);
+    return `${lines.join("\n")}\n`;
+}
+function formatSupportAdminUpdateTicket(data) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const ticket = data.ticket ?? {};
+    const lines = [
+        `${styles.bold("Ticket updated")}${ticket.subject ? styles.dim(` — ${ticket.subject}`) : ""}`,
+        `  Status:   ${ticket.status ?? "?"}`,
+        `  Assignee: ${ticket.assignee_email ?? "(unassigned)"}`,
+    ];
+    if (ticket.admin_web_url)
+        lines.push(`View ticket: ${ticket.admin_web_url}`);
+    return `${lines.join("\n")}\n`;
+}
 function readCsvOption(value) {
     const option = readOption(value);
     if (!option)
@@ -10797,6 +11741,79 @@ function readCsvOption(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+// Assemble the directory listing profile payload shared by `directory update`
+// and `admin directory enable`. --profile-json provides the base object (and
+// the only way to null-clear fields); explicit flags override it.
+async function buildDirectoryProfileBody(options) {
+    const profile = options.profileJson
+        ? parseJsonObject(options.profileJson)
+        : {};
+    const stringFlags = [
+        [options.name, "name"],
+        [options.slug, "slug"],
+        [options.logoUrl, "logo_url"],
+        [options.tagline, "tagline"],
+        [options.description, "description"],
+        [options.website, "website_url"],
+        [options.companyLinkedin, "linkedin_company_url"],
+        [options.bookingUrl, "booking_url"],
+        [options.contactEmail, "contact_email"],
+    ];
+    for (const [value, key] of stringFlags) {
+        const normalized = readOption(value);
+        if (normalized)
+            profile[key] = normalized;
+    }
+    if (!profile.description) {
+        const path = readOption(options.descriptionFile);
+        if (path) {
+            const fs = await import("node:fs/promises");
+            profile.description = await fs.readFile(path, "utf8");
+        }
+    }
+    if (readOption(options.foundersJson)) {
+        const founders = parseJsonValue(options.foundersJson ?? "[]", "founders-json");
+        if (!Array.isArray(founders)) {
+            throw new OxygenError("invalid_request", "--founders-json must be a JSON array of {name, title, linkedin_url} objects.", { exitCode: 1 });
+        }
+        profile.founders = founders;
+    }
+    const csvFlags = [
+        [options.services, "services"],
+        [options.regions, "regions"],
+    ];
+    for (const [value, key] of csvFlags) {
+        if (readOption(value))
+            profile[key] = readCsvOption(value);
+    }
+    return profile;
+}
+function directoryLogoMimeType(extension) {
+    switch (extension.toLowerCase()) {
+        case ".png":
+            return "image/png";
+        case ".jpg":
+        case ".jpeg":
+            return "image/jpeg";
+        case ".webp":
+            return "image/webp";
+        case ".svg":
+            return "image/svg+xml";
+        default:
+            throw new OxygenError("invalid_request", "--logo-file must be a .png, .jpg, .jpeg, .webp, or .svg image.", { exitCode: 1 });
+    }
+}
+async function uploadDirectoryLogo(logoPath) {
+    const fs = await import("node:fs/promises");
+    const path = await import("node:path");
+    const buffer = await fs.readFile(logoPath);
+    const form = new FormData();
+    form.append("file", new File([buffer], path.basename(logoPath), { type: directoryLogoMimeType(path.extname(logoPath)) }));
+    return await requestOxygen("/api/cli/directory/listing/logo", {
+        method: "POST",
+        formData: form,
+    });
+}
 // Assemble the optional campaign email binding from the --email-* flags. The
 // content spec (--email-definition-file) is the author-provided email sequence
 // that the API compiles to an Instantly campaign on start; provider/connection
@@ -11050,16 +12067,22 @@ options) {
     else if (options.warmupRestart) {
         warmup = { enabled: true };
     }
+    // Opinionated-safety knobs (P3): the warm-up preset curve + randomised daily caps.
+    const warmupPreset = readOption(options.warmupPreset);
+    const hasPreset = warmupPreset !== null && warmupPreset !== undefined;
+    const hasRandomize = options.randomizeCaps !== undefined;
     const hasLimits = Object.keys(limits).length > 0;
     const hasWorkingHours = Object.keys(workingHours).length > 0;
     const hasWarmup = warmup !== undefined;
-    if (!hasLimits && !hasWorkingHours && !hasWarmup) {
-        throw new OxygenError("invalid_request", "Pass at least one limit flag (e.g. --invites-per-day), --timezone, or a warm-up flag (--warmup-restart / --warmup-disable / --warmup-start-date).", { exitCode: 1 });
+    if (!hasLimits && !hasWorkingHours && !hasWarmup && !hasPreset && !hasRandomize) {
+        throw new OxygenError("invalid_request", "Pass at least one limit flag (e.g. --invites-per-day), --timezone, a warm-up flag (--warmup-restart / --warmup-disable / --warmup-start-date), --warmup-preset, or --randomize-caps.", { exitCode: 1 });
     }
     return {
         ...(hasLimits ? { limits } : {}),
         ...(hasWorkingHours ? { working_hours: workingHours } : {}),
         ...(hasWarmup ? { warmup } : {}),
+        ...(hasPreset ? { warmup_preset: warmupPreset } : {}),
+        ...(hasRandomize ? { randomize_daily_caps: options.randomizeCaps } : {}),
     };
 }
 function readPositiveInt(value) {
@@ -11137,6 +12160,27 @@ function readSequenceSettings(options) {
     if (phoneColumnKey) {
         settings.phone_column_key = phoneColumnKey;
     }
+    // stop_on_bounce defaults ON server-side; commander's `--no-stop-on-bounce`
+    // sets this to false, so only send the key when the user explicitly opts OUT.
+    // Leaving it absent keeps the safe default and a settings PATCH clean.
+    if (options.stopOnBounce === false) {
+        settings.stop_on_bounce = false;
+    }
+    const maxEmailsPerDay = readPositiveInteger(options.maxEmailsPerDay);
+    if (maxEmailsPerDay !== undefined)
+        settings.max_emails_per_day = maxEmailsPerDay;
+    const maxNewEnrollmentsPerDay = readPositiveInteger(options.maxNewEnrollmentsPerDay);
+    if (maxNewEnrollmentsPerDay !== undefined)
+        settings.max_new_enrollments_per_day = maxNewEnrollmentsPerDay;
+    const prioritization = readOption(options.sequencePrioritization);
+    if (prioritization)
+        settings.sequence_prioritization = prioritization;
+    const scheduleTemplate = readOption(options.scheduleTemplate);
+    if (scheduleTemplate)
+        settings.schedule_template = scheduleTemplate;
+    const espMatching = readOption(options.espMatching);
+    if (espMatching)
+        settings.esp_matching = espMatching;
     return Object.keys(settings).length > 0 ? settings : undefined;
 }
 function muteTokenEcho() {