@oxygen-agent/cli 1.310.3 → 1.336.1

package/dist/index.js

@@ -9,11 +9,11 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command, Option } from "commander";
 import { applyOxygenHelp } from "./help.js";
 import { buildCommandManifest } from "./command-manifest.js";
-import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, isVersionGreater, isVersionLess, OXYGEN_VERSION, OxygenError, parseKnowledgePageMarkdown, sleep, success, toFailure, } from "@oxygen/shared";
+import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, describeWorkflowStatusChange, formatCellForDisplay, formatPublicBudgetScopes, exitCodeForOxygenError, parseWorkflowStatusChange, isVersionGreater, isVersionLess, MAX_MCP_TOOL_NAME_LENGTH, OXYGEN_VERSION, OxygenError, parseKnowledgePageMarkdown, sleep, success, toFailure, workflowMcpToolName, } from "@oxygen/shared";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
-import { createBrowserLoginSession, openBrowser } from "./browser-login.js";
+import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "./browser-login.js";
 import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { ensureFreshCliForApiUrl, requestOxygen } from "./http-client.js";
 import { acquireMirrorLock, clearConflictFiles, deletePageFile, emptyMirrorState, findMirrorSlugByPageId, isFileDirty, listConflictFiles, listLocalMirrors, localPageSha256, markMirrorStale, mirrorExists, pageFilePath, planMirrorPush, purgeMirror, resetMirrorForFullResync, quarantineDirtyFile, readMirrorState, releaseMirrorLock, resolveDefaultConfigDir, resolveMirrorDir, writeGeneratedIndexFile, writeGeneratedLogFile, writeMirrorState, writePageFile, } from "./knowledge-mirror.js";
@@ -63,6 +63,7 @@ function buildFindBody(capability, options) {
     return body;
 }
 const BROWSER_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const BROWSER_LOGIN_FALLBACK_HINT_MS = 15 * 1000;
 const OXYGEN_SPINNER_INTERVAL_MS = 90;
 const INITIAL_OXYGEN_PROFILE_ENV = process.env.OXYGEN_PROFILE?.trim() || null;
 let globalProfileFlag = null;
@@ -160,6 +161,62 @@ function writeCreditsReceipt(data) {
         process.stderr.write(`estimated ${block.estimated_credits.toLocaleString("en-US")} credits for a live run${remaining !== null ? `, ${remaining} available` : ""}\n`);
     }
 }
+// A disabled workflow is a customer's automation at zero, and `status:
+// "disabled"` alone never said who did that or why (OXY-4124). Mirror the
+// recorded transition as one stderr line per disabled workflow, so `workflows
+// list` / `workflows get` answer "who turned this off?" in the terminal without
+// polluting the machine-read stdout envelope (which carries `statusChange` in
+// full). Sourced from the same shared sentence the web banner renders.
+export function formatDisabledWorkflowNotices(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return [];
+    const block = data;
+    const candidates = Array.isArray(block.workflows)
+        ? block.workflows
+        : [block.workflow];
+    const notices = [];
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+            continue;
+        const workflow = candidate;
+        if (workflow.status !== "disabled")
+            continue;
+        const slug = typeof workflow.slug === "string" ? workflow.slug : "workflow";
+        const change = parseWorkflowStatusChange(workflow.statusChange);
+        // A workflow disabled before the record shipped has no actor to name. Say
+        // that plainly rather than inventing one.
+        notices.push(change
+            ? `${slug}: ${describeWorkflowStatusChange(change)}`
+            : `${slug}: disabled — no actor was recorded (disabled before Oxygen tracked this).`);
+    }
+    return notices;
+}
+function writeDisabledWorkflowNotices(data) {
+    for (const notice of formatDisabledWorkflowNotices(data)) {
+        process.stderr.write(`${notice}\n`);
+    }
+}
+// The observability console caps each source at --limit (default 25, max 100) and
+// reports which hit the cap in sources[].capped. The human (non --json) output is
+// a JSON dump that buries that boolean, so surface it as a one-line stderr notice:
+// the counts shown are only the returned page, and more may sit behind a capped
+// source. Not pagination — raising --limit or filtering --source is the fix.
+function writeObservabilityCapsNotice(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    const sources = Array.isArray(record.sources) ? record.sources : [];
+    const cappedSources = sources
+        .filter((source) => Boolean(source) && typeof source === "object" && !Array.isArray(source)
+        && source.capped === true)
+        .map((source) => String(source.source));
+    if (cappedSources.length === 0)
+        return;
+    const returned = typeof record.returned === "number"
+        ? record.returned
+        : Array.isArray(record.items) ? record.items.length : 0;
+    process.stderr.write(`note: showing ${returned} item(s); some sources hit the per-source cap (${cappedSources.join(", ")}) — raise --limit (max 100) or filter --source to see more.\n`);
+}
 // Arming a cron commits recurring spend, so `workflows enable` mirrors its
 // `automation` block as stderr lines: what the schedule burns per day, what
 // share of the monthly allowance that is, and when it runs out. Observed burn
@@ -534,7 +591,6 @@ function buildCrmObjectCreateBody(options) {
         ...(readOption(options.singularName) ? { singular_name: readOption(options.singularName) } : {}),
         ...(readOption(options.pluralName) ? { plural_name: readOption(options.pluralName) } : {}),
         ...(readOption(options.labelColumn) ? { label_column: readOption(options.labelColumn) } : {}),
-        ...(options.relationshipsJson ? { relationships: parseJsonArray(options.relationshipsJson) } : {}),
         ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
     };
 }
@@ -687,12 +743,19 @@ function buildNotetakerScheduleBody(meetingUrl, options) {
 }
 function buildPublishingPostsListPath(options) {
     const query = new URLSearchParams();
-    const status = readOption(options.status);
-    const limit = readOption(options.limit);
-    if (status)
-        query.set("status", status);
-    if (limit)
-        query.set("limit", limit);
+    const filters = {
+        status: options.status,
+        approval_status: options.approvalStatus,
+        label: options.label,
+        campaign_id: options.campaign,
+        provider: options.provider,
+        limit: options.limit,
+    };
+    for (const [key, value] of Object.entries(filters)) {
+        const read = readOption(value);
+        if (read)
+            query.set(key, read);
+    }
     const suffix = query.toString();
     return suffix ? `/api/cli/publishing/posts?${suffix}` : "/api/cli/publishing/posts";
 }
@@ -878,6 +941,88 @@ function buildPublishingPostsDraftBody(options) {
         body.source_url = sourceUrl;
     return body;
 }
+function buildSequenceDraftBody(options) {
+    const goal = readOption(options.goal);
+    if (!goal)
+        throw new Error("--goal is required.");
+    const name = readOption(options.name);
+    const slug = readOption(options.slug);
+    if (options.create && (!name || !slug)) {
+        throw new Error("--create requires --name and --slug.");
+    }
+    const audience = readOption(options.audience);
+    const table = readOption(options.table);
+    const steps = readPositiveInt(options.steps);
+    const variants = readPositiveInt(options.variants);
+    return {
+        goal,
+        max_credits: readPositiveNumber(options.maxCredits),
+        ...(audience ? { audience } : {}),
+        ...(table ? { source_table: table } : {}),
+        ...(steps !== undefined ? { steps } : {}),
+        ...(variants !== undefined ? { variants } : {}),
+        ...(options.create ? { create: true } : {}),
+        ...(name ? { name } : {}),
+        ...(slug ? { slug } : {}),
+    };
+}
+// Human-legible preview for `sequences draft` (stdout stays the machine JSON, like
+// every other command): the drafted emails with their subjects + wait gaps, the
+// Knowledge Graph pages that grounded the copy, and the next step. Written to
+// stderr (the same lane as the credits receipt) so scripts still parse stdout.
+function writeSequenceDraftPreview(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    const definition = record.definition;
+    const steps = Array.isArray(record.steps)
+        ? record.steps
+        : Array.isArray(definition?.steps)
+            ? definition.steps
+            : [];
+    const sequence = record.sequence;
+    const lines = [];
+    if (record.created && sequence) {
+        lines.push(`Saved draft sequence "${String(sequence.name ?? "")}" (${String(sequence.slug ?? "")}).`);
+    }
+    else {
+        lines.push("Drafted email sequence (preview — not saved):");
+    }
+    let emailNumber = 0;
+    for (const step of steps) {
+        if (!step || typeof step !== "object" || Array.isArray(step))
+            continue;
+        const entry = step;
+        if (entry.kind === "email_send") {
+            emailNumber += 1;
+            const subject = typeof entry.subject_template === "string" && entry.subject_template.trim()
+                ? entry.subject_template.trim()
+                : "(no subject)";
+            const variantCount = Array.isArray(entry.variants) ? entry.variants.length : 0;
+            lines.push(`  Email ${emailNumber}: ${subject}${variantCount > 0 ? ` (+${variantCount} A/B variant${variantCount === 1 ? "" : "s"})` : ""}`);
+        }
+        else if (entry.kind === "wait") {
+            const days = typeof entry.days === "number" ? entry.days : 0;
+            lines.push(`  wait ${days} day${days === 1 ? "" : "s"}`);
+        }
+    }
+    const provenance = record.provenance;
+    const pages = Array.isArray(provenance?.pages) ? provenance.pages : [];
+    if (pages.length > 0) {
+        const names = pages
+            .map((page) => (typeof page.title === "string" && page.title.trim() ? page.title.trim() : typeof page.slug === "string" ? page.slug : ""))
+            .filter((name) => name.length > 0)
+            .slice(0, 5);
+        lines.push(`  Grounded on ${pages.length} Knowledge Graph page${pages.length === 1 ? "" : "s"}${names.length > 0 ? `: ${names.join(", ")}` : ""}.`);
+    }
+    else {
+        lines.push("  Grounded on the workspace voice (no Knowledge Graph pages retrieved).");
+    }
+    if (!record.created) {
+        lines.push("  Re-run with --create --name <name> --slug <slug> to save it as a draft sequence.");
+    }
+    process.stderr.write(`${lines.join("\n")}\n`);
+}
 function buildPublishingDraftsListPath(options) {
     const query = new URLSearchParams();
     const kind = readOption(options.kind);
@@ -913,6 +1058,211 @@ function buildPublishingDraftsAcceptBody(options) {
         body.timezone = timezone;
     return body;
 }
+function buildPublishingCampaignBody(options, requireName) {
+    const name = readOption(options.name);
+    if (requireName && !name) {
+        throw new OxygenError("invalid_request", "Pass --name.", { exitCode: 1 });
+    }
+    const goal = readOption(options.goal);
+    const startsAt = readOption(options.startsAt);
+    const endsAt = readOption(options.endsAt);
+    return {
+        ...(name ? { name } : {}),
+        ...(goal ? { goal } : {}),
+        ...(startsAt ? { starts_at: startsAt } : {}),
+        ...(endsAt ? { ends_at: endsAt } : {}),
+    };
+}
+function buildPublishingLabelsBody(options) {
+    const add = splitCommaList(options.add);
+    const remove = splitCommaList(options.remove);
+    if (add.length === 0 && remove.length === 0) {
+        throw new OxygenError("invalid_request", "Pass --add and/or --remove.", { exitCode: 1 });
+    }
+    return {
+        ...(add.length > 0 ? { add } : {}),
+        ...(remove.length > 0 ? { remove } : {}),
+    };
+}
+function splitCommaList(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return [];
+    return raw.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function buildPublishingAnalyticsPath(base, params) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value)
+            query.set(key, value);
+    }
+    const suffix = query.toString();
+    return suffix ? `${base}?${suffix}` : base;
+}
+// `--file` is the whole import: a .csv is posted verbatim as `csv` (the API owns
+// the parse, so the CLI and the web importer can never disagree about a quoted
+// comma); a .json is posted as `rows`. Dry-run is the DEFAULT — a bare
+// `publishing import --file posts.csv` lints and reports, and only --approved
+// flips dry_run off, so a bulk write into the queue is never one typo away.
+function buildPublishingImportBody(options) {
+    const file = readOption(options.file);
+    if (!file)
+        throw new OxygenError("invalid_request", "Pass --file <path.csv|.json>.", { exitCode: 1 });
+    if (options.dryRun === true && options.approved === true) {
+        throw new OxygenError("conflicting_flags", "Pass either --dry-run or --approved, not both.", { exitCode: 1 });
+    }
+    const contents = readPublishingTextFile(file, "--file");
+    const campaign = readOption(options.campaign);
+    const labels = splitCommaList(options.label);
+    const isJson = file.trim().toLowerCase().endsWith(".json");
+    return {
+        ...(isJson ? { rows: readPublishingImportRows(contents) } : { csv: contents }),
+        dry_run: options.approved !== true,
+        ...(campaign ? { campaign_id: campaign } : {}),
+        ...(labels.length > 0 ? { labels } : {}),
+    };
+}
+function readPublishingImportRows(contents) {
+    let parsed;
+    try {
+        parsed = JSON.parse(contents);
+    }
+    catch {
+        throw new OxygenError("invalid_json", "--file is not valid JSON.", { exitCode: 1 });
+    }
+    if (Array.isArray(parsed))
+        return parsed;
+    const rows = parsed?.rows;
+    if (Array.isArray(rows))
+        return rows;
+    throw new OxygenError("invalid_request", "Expected a JSON array of rows, or an object with a `rows` array.", { exitCode: 1 });
+}
+// Amplification create and post boost both arm REAL public writes from other
+// people's connected accounts and both spend credits, so the CLI refuses (exit 7)
+// before the request rather than relying on the API to bounce it. Same gate the
+// LinkedIn `posts delete` path uses: an irreversible public action never happens
+// because a flag was forgotten.
+function requirePublishingApprovalAndCap(approved, maxCredits, action, details) {
+    if (approved !== true) {
+        throw new OxygenError("approval_required", `${action} makes real public engagement from the participants' connected accounts and spends credits. Re-run with --approved --max-credits <n>.`, { details, exitCode: 7 });
+    }
+    const cap = readPositiveNumber(maxCredits);
+    if (cap === undefined) {
+        throw new OxygenError("max_credits_required", `${action} spends credits, so it needs an explicit ceiling. Re-run with --max-credits <n>.`, { details, exitCode: 7 });
+    }
+    return cap;
+}
+function buildPublishingAmplificationCreateBody(options) {
+    const maxCredits = requirePublishingApprovalAndCap(options.approved, options.maxCredits, "Creating an amplification policy", { name: options.name, scope: options.scope });
+    const senders = splitCommaList(options.senders);
+    const actions = splitCommaList(options.actions);
+    if (senders.length === 0)
+        throw new OxygenError("invalid_request", "Pass --senders.", { exitCode: 1 });
+    if (actions.length === 0)
+        throw new OxygenError("invalid_request", "Pass --actions.", { exitCode: 1 });
+    return {
+        name: options.name,
+        scope_kind: options.scope,
+        participant_sender_ids: senders,
+        actions,
+        max_credits_per_cycle: maxCredits,
+        approved: true,
+        ...publishingAmplificationScope(options),
+        ...publishingAmplificationTunables(options),
+    };
+}
+function publishingAmplificationScope(options) {
+    const campaign = readOption(options.campaign);
+    const label = readOption(options.label);
+    const post = readOption(options.post);
+    return {
+        ...(campaign ? { scope_campaign_id: campaign } : {}),
+        ...(label ? { scope_label: label } : {}),
+        ...(post ? { scope_post_id: post } : {}),
+    };
+}
+function publishingAmplificationTunables(options) {
+    const maxActions = readPositiveInt(options.maxActionsPerPost);
+    const commentPool = readPublishingCommentPool(options);
+    const reactionMin = readNonNegativeInt(options.reactionDelayMin);
+    const reactionMax = readNonNegativeInt(options.reactionDelayMax);
+    const commentMin = readNonNegativeInt(options.commentDelayMin);
+    const commentMax = readNonNegativeInt(options.commentDelayMax);
+    return {
+        ...(maxActions !== undefined ? { max_actions_per_post: maxActions } : {}),
+        ...(commentPool ? { comment_source: "pool", comment_pool: commentPool } : {}),
+        ...(reactionMin !== undefined ? { reaction_delay_min_seconds: reactionMin } : {}),
+        ...(reactionMax !== undefined ? { reaction_delay_max_seconds: reactionMax } : {}),
+        ...(commentMin !== undefined ? { comment_delay_min_seconds: commentMin } : {}),
+        ...(commentMax !== undefined ? { comment_delay_max_seconds: commentMax } : {}),
+    };
+}
+// Comments are prose: a comma-separated flag would split them mid-sentence. The
+// pool is a repeatable --comment-pool flag, or a file of one comment per line.
+function readPublishingCommentPool(options) {
+    const file = readOption(options.commentPoolFile);
+    const inline = Array.isArray(options.commentPool)
+        ? options.commentPool.map((entry) => entry.trim()).filter(Boolean)
+        : [];
+    if (file && inline.length > 0) {
+        throw new OxygenError("conflicting_flags", "Pass either --comment-pool or --comment-pool-file, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (file) {
+        const lines = readPublishingTextFile(file, "--comment-pool-file")
+            .split("\n")
+            .map((line) => line.trim())
+            .filter(Boolean);
+        if (lines.length === 0) {
+            throw new OxygenError("invalid_request", "--comment-pool-file has no comments.", { exitCode: 1 });
+        }
+        return lines;
+    }
+    return inline.length > 0 ? inline : null;
+}
+function buildPublishingAmplificationUpdateBody(options) {
+    const name = readOption(options.name);
+    const senders = splitCommaList(options.senders);
+    const actions = splitCommaList(options.actions);
+    const maxCredits = readPositiveNumber(options.maxCredits);
+    return {
+        ...(name ? { name } : {}),
+        ...(senders.length > 0 ? { participant_sender_ids: senders } : {}),
+        ...(actions.length > 0 ? { actions } : {}),
+        ...(maxCredits !== undefined ? { max_credits_per_cycle: maxCredits } : {}),
+        ...publishingAmplificationTunables(options),
+    };
+}
+function buildPublishingBoostBody(postId, options) {
+    const maxCredits = requirePublishingApprovalAndCap(options.approved, options.maxCredits, "Boosting a post", { post_id: postId });
+    const senders = splitCommaList(options.senders);
+    const actions = splitCommaList(options.actions);
+    if (senders.length === 0)
+        throw new OxygenError("invalid_request", "Pass --senders.", { exitCode: 1 });
+    if (actions.length === 0)
+        throw new OxygenError("invalid_request", "Pass --actions.", { exitCode: 1 });
+    const maxActions = readPositiveInt(options.maxActionsPerPost);
+    const commentPool = readPublishingCommentPool(options);
+    return {
+        senders,
+        actions,
+        max_credits: maxCredits,
+        approved: true,
+        ...(maxActions !== undefined ? { max_actions_per_post: maxActions } : {}),
+        ...(commentPool ? { comment_pool: commentPool } : {}),
+    };
+}
+function buildPublishingIdeaBody(options) {
+    const topic = readOption(options.topic);
+    const channels = splitCommaList(options.channels);
+    return {
+        kind: "idea",
+        text: readPublishingPostText(options, true),
+        ...(topic ? { topic } : {}),
+        ...(channels.length > 0 ? { channels } : {}),
+    };
+}
 function buildCrmRelationshipUpsertBody(object, rowId, options) {
     return {
         object,
@@ -1136,6 +1486,20 @@ function isUuid(value) {
 // surfaces are generated here to stop them drifting (the alias previously
 // duplicated every subcommand). All subcommands hit the shared
 // /api/cli/templates/* routes.
+/**
+ * Accept the domain as EITHER a positional argument or --domain.
+ *
+ * `subscribe` required --domain while get/warmup/cancel took a positional, so the same value had
+ * two spellings depending on the verb, and `get --domain acme.com` failed outright with "unknown
+ * option". Both spellings now work on every verb; nothing that used to work stops working.
+ */
+function requireDomainArg(positional, option) {
+    const domain = readOption(positional) ?? readOption(option);
+    if (!domain) {
+        throw new Error("A domain is required \u2014 pass it as an argument or with --domain.");
+    }
+    return domain;
+}
 function buildPromptTemplatesCommand(surface, description) {
     return new Command(surface)
         .description(description)
@@ -1232,7 +1596,7 @@ export function createProgram() {
     });
     program
         .command("login")
-        .description("Connect this terminal to Oxygen.")
+        .description("Connect this terminal to Oxygen. Opens the browser to approve this terminal (matching confirmation code shown in both); paste a token with --token instead if you prefer.")
         .option("--token <token>", "CLI API token created in the Oxygen dashboard.")
         .option("--api-url <url>", "Oxygen API URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
         .option("--profile <name>", "Store credentials under a named CLI profile and make it active.")
@@ -1244,7 +1608,7 @@ export function createProgram() {
     });
     program
         .command("auth")
-        .description("Authentication helpers.")
+        .description("Authentication helpers for scripts and agents (non-interactive token use). Day to day, `oxygen login` and `oxygen whoami` are all you need.")
         .addCommand(new Command("use-token")
         .description("Store a CLI API token non-interactively.")
         .requiredOption("--token <token>", "CLI API token.")
@@ -1263,7 +1627,7 @@ export function createProgram() {
     }));
     program
         .command("profiles")
-        .description("Manage stored CLI credential profiles.")
+        .description("Manage stored CLI credential profiles (switch between workspaces and hosts). `oxygen login` creates or updates the active profile.")
         .addCommand(new Command("list")
         .description("List stored CLI credential profiles.")
         .option("--json", "Print a JSON envelope.")
@@ -1480,7 +1844,7 @@ export function createProgram() {
     }));
     program
         .command("support")
-        .description("File and track Oxygen support tickets.")
+        .description("File and track Oxygen support tickets. Staff event automation: this CLI's `support admin events` command.")
         .addCommand(new Command("file")
         .description("File a support ticket. Use when you're stuck on an Oxygen operation.")
         .requiredOption("--subject <subject>", "One-line summary of the problem.")
@@ -1574,6 +1938,29 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
+    }))
+        .addCommand(new Command("events")
+        .description("Read-only, zero-credit poll of body-free support event envelopes (staff only). Watermark polls replay 24h; dedupe by (ticket_ref, version).")
+        .option("--after <cursor>", "If has_more=true, pass next_cursor to continue that scan. If false, persist the non-null watermark_cursor for later polls. A watermark poll intentionally replays the settled 24h window, not only unseen events; dedupe every page by (ticket_ref, version).")
+        .option("--limit <n>", "Events to return (1-100, defaults to 50).")
+        .option("--json", "Print a JSON envelope.")
+        .addHelpText("after", `
+Event schema (each data.events item has exactly these fields):
+  event_kind: ticket_snapshot
+  ticket_ref: UUID; version: decimal string; event_time: UTC timestamp
+  status: open | triaging | waiting_on_user | resolved | closed | null
+  severity: low | normal | high | null
+  category: account | auth | billing | bug | data | deliverability |
+            feature_request | feedback | integration | other | performance |
+            provider | security | sequencer | tables | workflow | null
+  source: slack | null; route: slack | cli | mcp | web | null
+
+The cursor is opaque. has_more discriminates its phase: next_cursor continues a
+fixed scan; watermark_cursor starts a later bounded replay. Consumers must retain
+(ticket_ref, version) as the idempotency key across every poll.
+`)
+        .action(async (options) => {
+        await handleAsyncAction("support admin events", options, () => requestOxygen(withSupportEventsQuery("/api/cli/admin/support/events", options)));
     }))
         .addCommand(new Command("get")
         .description("Show one support ticket with its message thread (staff only).")
@@ -1863,6 +2250,10 @@ export function createProgram() {
         .addCommand(new Command("list")
         .description("List scheduled posts.")
         .option("--status <status>", "Filter by draft, scheduled, queued, publishing, published, failed, or canceled.")
+        .option("--approval-status <status>", "Filter by draft, needs_approval, approved, or rejected.")
+        .option("--label <label>", "Only posts carrying this label.")
+        .option("--campaign <campaign_id>", "Only posts in this campaign.")
+        .option("--provider <provider>", "Filter by provider: linkedin, x, instagram, tiktok, facebook, or youtube.")
         .option("--limit <n>", "Maximum posts to return.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -1984,6 +2375,78 @@ export function createProgram() {
             method: "POST",
             body: { max_credits: readPositiveNumber(options.maxCredits) },
         }));
+    }))
+        .addCommand(new Command("boost")
+        .description("Boost ONE post: your teammates' connected accounts react to and comment on it, once. These are REAL public LinkedIn writes from their accounts and they SPEND CREDITS — refused (exit 7) without --approved and --max-credits. Creates a post-scoped policy that is already enabled and plans its actions immediately. For a standing rule across many posts, use `publishing amplification create`.")
+        .argument("<post_id>", "Scheduled post id.")
+        .requiredOption("--senders <ids>", "Comma-separated connected sender account ids that will engage.")
+        .requiredOption("--actions <list>", "Comma-separated actions: reaction, comment.")
+        .option("--max-actions-per-post <n>", "Hard cap on how many actions are planned.")
+        .option("--max-credits <n>", "Credit ceiling for the boost (required — this is a paid action).")
+        .option("--comment-pool <text>", "A comment to draw from. Repeatable. Required when --actions includes comment.", collectRepeatable, [])
+        .option("--comment-pool-file <path>", "Read the comment pool from a file, one comment per line.")
+        .option("--approved", "Confirm the real public engagement. Without it the command refuses and nothing is planned.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts boost", options, () => requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/boost`, {
+            method: "POST",
+            body: buildPublishingBoostBody(postId, options),
+        }));
+    }))
+        .addCommand(new Command("revisions")
+        .description("List a post's content history: every revision with its number, title, text, author, and time.")
+        .argument("<post_id>", "Scheduled post id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts revisions", options, () => requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/revisions`));
+    }))
+        .addCommand(new Command("restore")
+        .description("Roll a post back to an earlier revision (see `publishing posts revisions`). The current text is snapshotted as a new revision first, so a restore is itself undoable. Refused once the post is publishing, published, or canceled.")
+        .argument("<post_id>", "Scheduled post id.")
+        .requiredOption("--revision <n>", "Revision number to restore.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts restore", options, () => {
+            const revision = readPositiveInt(options.revision);
+            if (revision === undefined) {
+                throw new OxygenError("invalid_request", "Pass --revision <n>.", { exitCode: 1 });
+            }
+            return requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/revisions/${revision}/restore`, { method: "POST" });
+        });
+    }))
+        .addCommand(new Command("notes")
+        .description("List the internal review notes on a post. Notes are workspace-only — they are never published.")
+        .argument("<post_id>", "Scheduled post id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts notes", options, () => requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/comments`));
+    }))
+        .addCommand(new Command("note")
+        .description("Leave an internal review note on a post, or reply to one with --parent. Never published.")
+        .argument("<post_id>", "Scheduled post id.")
+        .option("--text <text>", "The note.")
+        .option("--text-file <path>", "Read the note from a local file.")
+        .option("--parent <comment_id>", "Reply to this note.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts note", options, () => {
+            const parent = readOption(options.parent);
+            return requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/comments`, {
+                method: "POST",
+                body: {
+                    body: readPublishingPostText(options, true),
+                    ...(parent ? { parent_comment_id: parent } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("resolve-note")
+        .description("Mark a review note handled.")
+        .argument("<post_id>", "Scheduled post id.")
+        .requiredOption("--comment <comment_id>", "Note id from `publishing posts notes`.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing posts resolve-note", options, () => requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/comments/${encodeURIComponent(options.comment)}/resolve`, { method: "POST" }));
     })))
         .addCommand(new Command("drafts")
         .description("Review the AI post-draft queue before anything reaches the publish queue.")
@@ -2065,6 +2528,238 @@ export function createProgram() {
             method: "POST",
             body: buildPublishingMediaUploadedBody(options),
         }));
+    })))
+        .addCommand(new Command("campaigns")
+        .description("Group scheduled posts under a launch or theme, then filter the queue (`publishing posts list --campaign`) or scope an amplification policy to it.")
+        .addCommand(new Command("list")
+        .description("List campaigns with their post counts.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing campaigns list", options, () => requestOxygen("/api/cli/publishing/campaigns"));
+    }))
+        .addCommand(new Command("create")
+        .description("Create a campaign.")
+        .requiredOption("--name <name>", "Campaign name.")
+        .option("--goal <goal>", "What this campaign is for.")
+        .option("--starts-at <iso>", "ISO date-time the campaign starts.")
+        .option("--ends-at <iso>", "ISO date-time the campaign ends.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing campaigns create", options, () => requestOxygen("/api/cli/publishing/campaigns", {
+            method: "POST",
+            body: buildPublishingCampaignBody(options, true),
+        }));
+    }))
+        .addCommand(new Command("get")
+        .description("Get one campaign with its posts.")
+        .argument("<campaign_id>", "Campaign id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (campaignId, options) => {
+        await handleAsyncAction("publishing campaigns get", options, () => requestOxygen(`/api/cli/publishing/campaigns/${encodeURIComponent(campaignId)}`));
+    }))
+        .addCommand(new Command("update")
+        .description("Update a campaign's name, goal, or window.")
+        .argument("<campaign_id>", "Campaign id.")
+        .option("--name <name>", "Campaign name.")
+        .option("--goal <goal>", "What this campaign is for.")
+        .option("--starts-at <iso>", "ISO date-time the campaign starts.")
+        .option("--ends-at <iso>", "ISO date-time the campaign ends.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (campaignId, options) => {
+        await handleAsyncAction("publishing campaigns update", options, () => requestOxygen(`/api/cli/publishing/campaigns/${encodeURIComponent(campaignId)}`, {
+            method: "PATCH",
+            body: buildPublishingCampaignBody(options, false),
+        }));
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a campaign. Its posts survive — they are just unlinked from it.")
+        .argument("<campaign_id>", "Campaign id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (campaignId, options) => {
+        await handleAsyncAction("publishing campaigns delete", options, () => requestOxygen(`/api/cli/publishing/campaigns/${encodeURIComponent(campaignId)}`, {
+            method: "DELETE",
+        }));
+    })))
+        .addCommand(new Command("labels")
+        .description("Tag scheduled posts. Labels drive queue filters and label-scoped amplification; they are never published.")
+        .addCommand(new Command("set")
+        .description("Add and/or remove labels on one post.")
+        .argument("<post_id>", "Scheduled post id.")
+        .option("--add <labels>", "Comma-separated labels to add.")
+        .option("--remove <labels>", "Comma-separated labels to remove.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing labels set", options, () => requestOxygen(`/api/cli/publishing/posts/${encodeURIComponent(postId)}/labels`, {
+            method: "POST",
+            body: buildPublishingLabelsBody(options),
+        }));
+    })))
+        .addCommand(new Command("analytics")
+        .description("Engagement metrics the worker syncs back from the provider. Free reads. LinkedIn exposes reactions, comments, and reshares only — impressions, saves, and sends come back null, never zero.")
+        .addCommand(new Command("post")
+        .description("One post's daily metric series, totals, and earned-media value. EMV is impressions-derived, so on LinkedIn it returns null with an unavailable_reason instead of a made-up number.")
+        .argument("<post_id>", "Scheduled post id.")
+        .option("--since <date>", "ISO date to start the series from.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (postId, options) => {
+        await handleAsyncAction("publishing analytics post", options, () => requestOxygen(buildPublishingAnalyticsPath(`/api/cli/publishing/analytics/posts/${encodeURIComponent(postId)}`, { since: readOption(options.since) })));
+    }))
+        .addCommand(new Command("account")
+        .description("Per-account metric series for the connected publishing accounts.")
+        .option("--provider <provider>", "Provider to read. Defaults to linkedin.")
+        .option("--since <date>", "ISO date to start the series from.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing analytics account", options, () => requestOxygen(buildPublishingAnalyticsPath("/api/cli/publishing/analytics/account", {
+            provider: readOption(options.provider),
+            since: readOption(options.since),
+        })));
+    }))
+        .addCommand(new Command("emv")
+        .description("Set the workspace CPM used for earned-media value, per channel. EMV stays null on any channel whose provider does not expose impressions.")
+        .requiredOption("--cpm-json <json>", "Per-channel CPM object, e.g. '{\"linkedin\":30,\"x\":12}'.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing analytics emv", options, () => requestOxygen("/api/cli/publishing/analytics/emv", {
+            method: "POST",
+            body: { cpm: parseJsonObject(options.cpmJson ?? "") },
+        }));
+    })))
+        .addCommand(new Command("import")
+        .description("Bulk-load scheduled posts from a .csv or .json file. Dry-run by DEFAULT: it parses, lints, and reports invalid rows while writing nothing. Pass --approved to actually write. Imported posts land as drafts that still need approval — import never approves and never publishes. A row whose idempotency_key was already used is skipped, so re-importing the same file cannot duplicate the queue.")
+        .requiredOption("--file <path>", "Path to a .csv (header row) or .json file ([rows] or { rows: [...] }).")
+        .option("--dry-run", "Parse, lint, and report without writing. Default.")
+        .option("--approved", "Write the parsed rows into the queue as needs-approval drafts.")
+        .option("--campaign <campaign_id>", "Campaign for every imported post.")
+        .option("--label <labels>", "Comma-separated labels for every imported post.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing import", options, () => requestOxygen("/api/cli/publishing/import", {
+            method: "POST",
+            body: buildPublishingImportBody(options),
+        }));
+    }))
+        .addCommand(new Command("amplification")
+        .description("Standing auto-engagement policies: the sender accounts you name react to and comment on every post in scope, paced and capped. Default OFF — a new policy is created disabled, and arming it is a separate, deliberate call.")
+        .addCommand(new Command("list")
+        .description("List amplification policies with their scope, caps, and enabled state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing amplification list", options, () => requestOxygen("/api/cli/publishing/amplification"));
+    }))
+        .addCommand(new Command("create")
+        .description("Create an amplification policy. It arms REAL public engagement from other people's connected accounts and SPENDS CREDITS, so it is refused (exit 7) without --approved and --max-credits — that pair is the standing grant, recorded with who/when/what scope. The policy is created DISABLED: run `amplification enable` when you actually want it to run.")
+        .requiredOption("--name <name>", "Policy name.")
+        .requiredOption("--scope <kind>", "What it amplifies: all, campaign, label, or post.")
+        .option("--campaign <campaign_id>", "Campaign to scope to (with --scope campaign).")
+        .option("--label <label>", "Label to scope to (with --scope label).")
+        .option("--post <post_id>", "Post to scope to (with --scope post).")
+        .requiredOption("--senders <ids>", "Comma-separated connected sender account ids that will engage.")
+        .requiredOption("--actions <list>", "Comma-separated actions: reaction, comment.")
+        .option("--max-actions-per-post <n>", "Hard cap on actions per post.")
+        .option("--max-credits <n>", "Hard credit cap per cycle (required — this policy spends credits).")
+        .option("--comment-pool <text>", "A comment to draw from. Repeatable. Required when --actions includes comment.", collectRepeatable, [])
+        .option("--comment-pool-file <path>", "Read the comment pool from a file, one comment per line.")
+        .option("--reaction-delay-min <seconds>", "Lower bound of the randomized reaction delay.")
+        .option("--reaction-delay-max <seconds>", "Upper bound of the randomized reaction delay.")
+        .option("--comment-delay-min <seconds>", "Lower bound of the randomized comment delay.")
+        .option("--comment-delay-max <seconds>", "Upper bound of the randomized comment delay.")
+        .option("--approved", "Grant the standing permission. Without it the command refuses and creates nothing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing amplification create", options, () => requestOxygen("/api/cli/publishing/amplification", {
+            method: "POST",
+            body: buildPublishingAmplificationCreateBody(options),
+        }));
+    }))
+        .addCommand(new Command("get")
+        .description("Get one policy: scope, participants, caps, pacing, enabled state, and standing approval.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification get", options, () => requestOxygen(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}`));
+    }))
+        .addCommand(new Command("update")
+        .description("Update a policy's participants, actions, caps, or pacing. Tightening a cap takes effect on the next cycle.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--name <name>", "Policy name.")
+        .option("--senders <ids>", "Comma-separated connected sender account ids.")
+        .option("--actions <list>", "Comma-separated actions: reaction, comment.")
+        .option("--max-actions-per-post <n>", "Hard cap on actions per post.")
+        .option("--max-credits <n>", "Hard credit cap per cycle.")
+        .option("--comment-pool <text>", "A comment to draw from. Repeatable.", collectRepeatable, [])
+        .option("--comment-pool-file <path>", "Read the comment pool from a file, one comment per line.")
+        .option("--reaction-delay-min <seconds>", "Lower bound of the randomized reaction delay.")
+        .option("--reaction-delay-max <seconds>", "Upper bound of the randomized reaction delay.")
+        .option("--comment-delay-min <seconds>", "Lower bound of the randomized comment delay.")
+        .option("--comment-delay-max <seconds>", "Upper bound of the randomized comment delay.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification update", options, () => requestOxygen(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}`, {
+            method: "PATCH",
+            body: buildPublishingAmplificationUpdateBody(options),
+        }));
+    }))
+        .addCommand(new Command("enable")
+        .description("Arm a policy. From here the worker engages on every post in scope from the participants' real accounts, within the caps — so this refuses (exit 7) without --approved. Nothing else in the policy changes.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--approved", "Confirm arming the standing public engagement. Without it nothing is armed.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification enable", options, () => {
+            if (options.approved !== true) {
+                throw new OxygenError("approval_required", "Enabling a policy starts real public engagement from the participants' connected accounts. Re-run with --approved.", { details: { policy_id: policyId }, exitCode: 7 });
+            }
+            return requestOxygen(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}/enable`, { method: "POST" });
+        });
+    }))
+        .addCommand(new Command("disable")
+        .description("Disarm a policy and skip every action it had already planned. Always allowed — the off switch is never gated.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification disable", options, () => requestOxygen(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}/disable`, {
+            method: "POST",
+        }));
+    }))
+        .addCommand(new Command("delete")
+        .description("Delete a policy.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification delete", options, () => requestOxygen(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}`, {
+            method: "DELETE",
+        }));
+    }))
+        .addCommand(new Command("actions")
+        .description("The policy's action ledger: what each participant account did (or is about to do) on which post, with status and cost.")
+        .argument("<policy_id>", "Amplification policy id.")
+        .option("--status <status>", "Filter by planned, dispatched, failed, or skipped.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (policyId, options) => {
+        await handleAsyncAction("publishing amplification actions", options, () => requestOxygen(buildPublishingAnalyticsPath(`/api/cli/publishing/amplification/${encodeURIComponent(policyId)}/actions`, { status: readOption(options.status) })));
+    })))
+        .addCommand(new Command("ideas")
+        .description("The content backlog: ideas parked for later, with no publish time and no AI spend.")
+        .addCommand(new Command("add")
+        .description("File an idea into the backlog. Free — no AI call, nothing scheduled. Turn one into a post later with `publishing drafts accept --publish-at`.")
+        .option("--text <text>", "The idea.")
+        .option("--text-file <path>", "Read the idea from a local file.")
+        .option("--topic <topic>", "Optional topic tag.")
+        .option("--channels <list>", "Comma-separated channels this idea is meant for.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing ideas add", options, () => requestOxygen("/api/cli/publishing/drafts", {
+            method: "POST",
+            body: buildPublishingIdeaBody(options),
+        }));
+    }))
+        .addCommand(new Command("list")
+        .description("List the idea backlog.")
+        .option("--limit <n>", "Maximum ideas to return.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing ideas list", options, () => requestOxygen(buildPublishingDraftsListPath({ ...options, kind: "idea" })));
     })));
     program
         .command("dashboards")
@@ -2126,7 +2821,6 @@ export function createProgram() {
         .requiredOption("--display-name <name>", "Human-readable object name, such as Projects.")
         .requiredOption("--columns-json <json>", "JSON array of column definitions {key,label,dataType,semanticType,...}.")
         .option("--identities-json <json>", "JSON array of identity definitions {columnKey,normalization,isPrimary?}.")
-        .option("--relationships-json <json>", "JSON array of relationship definitions (not yet supported).")
         .option("--label-column <key>", "Column key to use as the record label. Defaults to the isRecordLabel column or the first column.")
         .option("--singular-name <name>", "Singular display name, such as Project.")
         .option("--plural-name <name>", "Plural display name, such as Projects.")
@@ -2196,7 +2890,35 @@ export function createProgram() {
         await handleAsyncAction("crm get", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/records/${encodeURIComponent(rowId)}`));
     }))
         .addCommand(new Command("relationships")
-        .description("Manage CRM record relationships.")
+        .description("Define CRM relationships and manage record relationship edges.")
+        .addCommand(new Command("define")
+        .description("Define a relationship (and its relation column) from a custom object to any object. Defaults to dry-run.")
+        .argument("<object>", "Source CRM object slug. Must be a custom object, such as projects.")
+        .argument("<slug>", "Relationship slug — also the relation column key on the source, such as client.")
+        .requiredOption("--target-object <object>", "Target CRM object slug, custom or standard (companies, people, deals, ...).")
+        .option("--display-name <name>", "Display name for the relation column. Defaults to the slug in Title Case.")
+        .option("--cardinality <cardinality>", "one_to_one, one_to_many, many_to_one, or many_to_many (source:target). Default many_to_many. one_to_many means each source record links many targets and each target links back to one source.")
+        .option("--inverse-slug <slug>", "Inverse relationship slug on the target. On a custom target this also creates the inverse relation column.")
+        .option("--inverse-display-name <name>", "Display name for the inverse side.")
+        .option("--dry-run", "Preview the relationship definition without writing.")
+        .option("--live", "Apply the definition. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (object, slug, options) => {
+        await handleAsyncAction("crm relationships define", options, () => requestOxygen(`/api/cli/crm/objects/${encodeURIComponent(object)}/relationships`, {
+            method: "POST",
+            body: {
+                relationship: {
+                    slug,
+                    target_object: options.targetObject,
+                    ...(options.displayName ? { display_name: options.displayName } : {}),
+                    ...(options.cardinality ? { cardinality: options.cardinality } : {}),
+                    ...(options.inverseSlug ? { inverse_slug: options.inverseSlug } : {}),
+                    ...(options.inverseDisplayName ? { inverse_display_name: options.inverseDisplayName } : {}),
+                },
+                mode: options.live ? "live" : "dry_run",
+            },
+        }));
+    }))
         .addCommand(new Command("upsert")
         .description("Create or replace a CRM relationship edge. Defaults to dry-run.")
         .argument("<object>", "Source CRM object slug, such as companies or people.")
@@ -2899,6 +3621,133 @@ export function createProgram() {
             });
         });
     }));
+    tablesCommand.addCommand(new Command("relate")
+        .description("Relate two tables: define a relation column on the source that links rows to the target table. Works on ANY table — plain tables are registered under the hood automatically. Defaults to dry-run.")
+        .argument("<table>", "Source table id or slug.")
+        .argument("<slug>", "Relation slug — also the relation column key on the source, such as client.")
+        .requiredOption("--target-table <table>", "Target table id or slug. May also be a CRM object table (companies, people, deals).")
+        .option("--display-name <name>", "Display name for the relation column. Defaults to the slug in Title Case.")
+        .option("--cardinality <cardinality>", "one_to_one, one_to_many, many_to_one, or many_to_many (source:target). Default many_to_many. one_to_many means each source row links many target rows and each target row links back to one source.")
+        .option("--inverse-slug <slug>", "Inverse relation slug on the target; also creates the inverse relation column there.")
+        .option("--inverse-display-name <name>", "Display name for the inverse side.")
+        .option("--dry-run", "Preview the relation plan without writing.")
+        .option("--live", "Apply the relation. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, slug, options) => {
+        await handleAsyncAction("tables relate", options, () => requestOxygen("/api/cli/tables/relations", {
+            method: "POST",
+            body: {
+                table,
+                relationship: {
+                    slug,
+                    target_table: options.targetTable,
+                    ...(options.displayName ? { display_name: options.displayName } : {}),
+                    ...(options.cardinality ? { cardinality: options.cardinality } : {}),
+                    ...(options.inverseSlug ? { inverse_slug: options.inverseSlug } : {}),
+                    ...(options.inverseDisplayName ? { inverse_display_name: options.inverseDisplayName } : {}),
+                },
+                mode: options.live ? "live" : "dry_run",
+            },
+        }));
+    }))
+        .addCommand(new Command("link")
+        .description("Link one row to a row in the related table through a relation defined with `tables relate`. Defaults to dry-run.")
+        .argument("<table>", "Source table id or slug.")
+        .argument("<row_id>", "Source row id.")
+        .requiredOption("--relation <slug>", "Relation slug defined on the source table, such as client.")
+        .requiredOption("--target-row-id <row_id>", "Target row id in the related table.")
+        .option("--dry-run", "Preview the link (and any cardinality replacements) without writing.")
+        .option("--live", "Apply the link. Default is dry-run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, options) => {
+        await handleAsyncAction("tables link", options, () => requestOxygen("/api/cli/tables/relations/link", {
+            method: "POST",
+            body: {
+                table,
+                row_id: rowId,
+                relation: options.relation,
+                target_row_id: options.targetRowId,
+                mode: options.live ? "live" : "dry_run",
+            },
+        }));
+    }))
+        .addCommand(new Command("promote")
+        .description("Write bound rows' columns onto their matched CRM records (Records<->Tables). Free, but a truth write: previews by default, then re-run with --approved to write. Approved runs queue as a background run — watch with `oxygen table-runs wait <run_id>`.")
+        .argument("<table>", "Table id or slug whose bound rows to promote.")
+        .option("--object <slug>", "CRM object to promote onto (companies, people, deals, ...). Inferred when the table has exactly one bind column.")
+        .requiredOption("--map <pairs>", "Column-to-attribute mapping as column=attribute pairs (e.g. job_title=job_title,seniority=seniority) or a JSON array/object.")
+        .option("--policy <policy>", "Conflict policy: fill-empty-only (default), overwrite, or skip-conflicts.", "fill-empty-only")
+        .option("--row-id <id...>", "Promote only these row ids. Defaults to every bound row.")
+        .option("--dry-run", "Preview per-field would_fill/would_overwrite/conflicts without writing (the default when --approved is absent).")
+        .option("--approved", "Confirm the truth write onto CRM records after inspecting the preview.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for the run. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        if (options.dryRun && options.approved) {
+            throw new OxygenError("invalid_promote", "Pass either --dry-run or --approved, not both.", { exitCode: 1 });
+        }
+        const mappings = parsePromoteMapOption(options.map);
+        const policy = normalizePromotePolicy(options.policy);
+        const maxConcurrency = readPositiveInt(options.maxConcurrency);
+        await handleAsyncAction("tables promote", options, () => requestOxygen("/api/cli/tables/promote", {
+            method: "POST",
+            body: {
+                table,
+                ...(readOption(options.object) ? { object: readOption(options.object) } : {}),
+                mappings,
+                policy,
+                ...(options.rowId && options.rowId.length > 0 ? { row_ids: options.rowId } : {}),
+                // Preview by default; --approved is the only path that writes.
+                ...(options.approved ? { approved: true } : { dry_run: true }),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+            },
+        }));
+    }));
+    tablesCommand.addCommand(new Command("dedupe")
+        .description("Collapse duplicate rows by normalized (email/domain/linkedin) or fuzzy-label keys, or cross-check a column against another table. Previews by default; --apply --approved deletes losers (kept in row history).")
+        .argument("<table>", "Table id or slug to dedupe.")
+        .requiredOption("--on <cols>", "Key column(s): one column, or two comma-separated for a composite key (e.g. email or first_name,company).")
+        .option("--normalize <mode>", "Match mode: exact (default), email, domain, linkedin, or fuzzy-label. Fuzzy allowed only as a single key.", "exact")
+        .option("--keep <policy>", "Survivor per duplicate group: oldest (default), newest, or most-complete.", "oldest")
+        .option("--merge-values <mode>", "With --apply, fill the survivor's blank cells from the losers first: fill-empty.")
+        .option("--scan-limit <n>", "Max rows to scan. Defaults to 50000, capped at 200000.")
+        .option("--apply", "Delete the duplicate rows (losers). Without this flag the command only previews.")
+        .option("--approved", "Confirm the deletion (required with --apply); without it the API returns the preview to inspect first.")
+        .option("--against <table>", "Cross-table check: report rows whose --on value already exists in this other table (read-only).")
+        .option("--against-column <col>", "Column in the --against table to match against. Required with --against.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables dedupe", options, () => {
+            const request = buildDedupeRequest(table, options);
+            return requestOxygen(request.endpoint, { method: "POST", body: request.body });
+        });
+    }));
+    tablesCommand.addCommand(new Command("send")
+        .description("Copy rows from one table into another as a durable background run (free, resumable). Map columns with --map (or --automap), optionally flatten an array column into one row per element, and insert or upsert. --dry-run previews the resolved mapping, row estimate, and sample rows without writing.")
+        .argument("<source>", "Source table id or slug.")
+        .argument("<target>", "Target table id or slug (must be a different table).")
+        .option("--map <pairs>", "target=source column pairs, comma-separated and/or repeated (e.g. --map company=company_name,website=domain).", collectRepeatable, [])
+        .option("--mapping <json>", 'Full mapping JSON array for literals and dot-paths, e.g. [{"target":"email","source":{"type":"column","key":"$element"},"path":"email"}]. Escape hatch when --map is not enough.')
+        .option("--automap", "Match columns automatically (exact key, then case-insensitive label). The resolved mapping is echoed back.")
+        .option("--flatten <column>", 'Source column whose array value emits one target row per element (the element is mapping source key "$element"); non-array values pass through as one row.')
+        .option("--flatten-path <path>", "Dot-path to the array inside the --flatten column's value.")
+        .option("--filter <json>", 'Source-row filters JSON, e.g. [{"column":"domain","op":"is_not_null"}]. Ops: eq, neq, is_null, is_not_null, in, not_in.')
+        .option("--mode <mode>", "insert (append, default) or upsert (requires --upsert-key).", "insert")
+        .option("--upsert-key <key>", "Mapped target column that identifies existing rows for upsert.")
+        .option("--page-size <n>", "Rows copied per durable page. Defaults to 500, max 2000.")
+        .option("--dry-run", "Validate and preview only; nothing is written.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (source, target, options) => {
+        try {
+            const body = buildTablesSendRequest(source, target, options);
+            const data = await requestOxygen("/api/cli/tables/send", { method: "POST", body });
+            emitSuccess("tables send", data, options);
+            writeTablesSendHint(data);
+        }
+        catch (error) {
+            emitCliFailure("tables send", error);
+        }
+    }));
     tablesCommand.addCommand(new Command("webhook")
         .description("Create and manage direct table webhooks.")
         .addCommand(new Command("list")
@@ -2932,7 +3781,7 @@ export function createProgram() {
         .option("--event-type-path <path>", "Dot path to the event type. Defaults to type or event.")
         .option("--occurred-at-path <path>", "Dot path to the event timestamp.")
         .option("--auto-run-columns <csv>", "Comma-separated enrichment, tool, AI, or formula columns to queue for webhook-written rows.")
-        .addOption(new Option("--auto-run-max-credits <n>", "Deprecated optional safety ceiling for webhook-triggered auto-runs.").hideHelp())
+        .option("--auto-run-max-credits <n>", "Credit ceiling per webhook-triggered auto-run batch; items beyond it are skipped with credit_limit_reached.")
         .option("--auto-run-max-concurrency <n>", "Maximum concurrent row items for webhook-triggered auto-runs.")
         .option("--auto-run-force", "Run auto-run columns even when the target cell already has a value.")
         .option("--auto-run-connection-id <connection_id>", "Optional provider integration connection id for auto-runs.")
@@ -2963,7 +3812,7 @@ export function createProgram() {
         .option("--status <status>", "active or disabled.")
         .option("--auth-mode <mode>", "none or secret. Setting secret rotates and returns a new webhook secret.")
         .option("--auto-run-columns <csv>", "Comma-separated enrichment, tool, AI, or formula columns to queue for webhook-written rows.")
-        .addOption(new Option("--auto-run-max-credits <n>", "Deprecated optional safety ceiling for webhook-triggered auto-runs.").hideHelp())
+        .option("--auto-run-max-credits <n>", "Credit ceiling per webhook-triggered auto-run batch; items beyond it are skipped with credit_limit_reached.")
         .option("--auto-run-max-concurrency <n>", "Maximum concurrent row items for webhook-triggered auto-runs.")
         .option("--auto-run-force", "Run auto-run columns even when the target cell already has a value.")
         .option("--auto-run-connection-id <connection_id>", "Optional provider integration connection id for auto-runs.")
@@ -3067,6 +3916,125 @@ export function createProgram() {
         .argument("<view>", "View id.")
         .option("--json", "Print a JSON envelope.")
         .action((table, view, options) => handleAsyncAction("tables views delete", options, () => requestOxygen(`/api/cli/tables/views?table=${encodeURIComponent(table)}&view=${encodeURIComponent(view)}`, { method: "DELETE" })))));
+    tablesCommand.addCommand(new Command("auto-run")
+        .description("Inspect and manage a table's standing auto-run configuration (columns queued automatically when new rows are written).")
+        .addCommand(new Command("get")
+        .description("Show a table's standing auto-run configuration (columns queued automatically when new rows are written).")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables auto-run get", options, () => {
+        const params = new URLSearchParams({ table });
+        return requestOxygen(`/api/cli/tables/auto-run?${params.toString()}`);
+    })))
+        .addCommand(new Command("set")
+        .description("Enable a standing auto-run: automatically queue the given columns for rows written to this table (imports, inserts, upserts). Default off.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--columns <csv>", "Comma-separated column keys to auto-run on newly written rows (tool, AI, formula, enrichment, bind, or lookup columns).")
+        .option("--sources <csv>", "Which write sources trigger the auto-run: any of import, insert, upsert, send. Defaults to all when omitted.")
+        .option("--force", "Re-run the columns even for rows that already have values.")
+        .option("--max-credits <n>", "Credit ceiling PER enqueued auto-run batch; rows beyond it are skipped with credit_limit_reached.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items per auto-run batch.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => {
+        const columns = readCsvOption(options.columns);
+        const sources = readCsvOption(options.sources);
+        const maxCredits = readPositiveNumber(options.maxCredits);
+        const maxConcurrency = readPositiveInt(options.maxConcurrency);
+        const force = Boolean(options.force);
+        return handleAsyncAction("tables auto-run set", options, () => requestOxygen("/api/cli/tables/auto-run", {
+            method: "POST",
+            body: {
+                table,
+                columns,
+                ...(sources.length ? { sources } : {}),
+                ...(force ? { force: true } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disable (clear) a table's standing auto-run configuration.")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables auto-run disable", options, () => requestOxygen("/api/cli/tables/auto-run", {
+        method: "DELETE",
+        body: { table },
+    })))));
+    tablesCommand.addCommand(new Command("auto-dedupe")
+        .description("Inspect and manage a table's standing auto-dedupe configuration (duplicate rows collapsed automatically after every write; deleted rows are kept in row history).")
+        .addCommand(new Command("get")
+        .description("Show a table's standing auto-dedupe configuration.")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables auto-dedupe get", options, () => {
+        const params = new URLSearchParams({ table });
+        return requestOxygen(`/api/cli/tables/auto-dedupe?${params.toString()}`);
+    })))
+        .addCommand(new Command("set")
+        .description("Enable a standing auto-dedupe: after every write (insert, upsert, import, send, webhook), duplicate groups containing a just-written row are collapsed by the keep policy — losers are DELETED automatically without per-write approval (kept in row history), and any standing auto-run only enriches the survivors. Runs BEFORE auto-run so credits are never spent on rows about to be deleted. Fuzzy-label matching is on-demand only: use `oxygen tables dedupe --normalize fuzzy-label` instead.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--on <cols>", "Key column(s): one column, or two comma-separated for a composite key (e.g. email or first_name,company).")
+        .option("--normalize <modes>", "Match mode per --on column, comma-separated positionally: exact (default), email, domain, or linkedin. Unpaired columns default to exact; fuzzy-label is rejected (on-demand only).")
+        .option("--keep <policy>", "Survivor per duplicate group (existing rows included): oldest (default), newest, or most-complete.", "oldest")
+        .option("--merge-values <mode>", "Fill the survivor's blank cells from the losers before deleting them: fill-empty.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables auto-dedupe set", options, () => requestOxygen("/api/cli/tables/auto-dedupe", {
+        method: "POST",
+        body: buildTablesAutoDedupeSetBody(table, options),
+    }))))
+        .addCommand(new Command("disable")
+        .description("Disable (clear) a table's standing auto-dedupe configuration.")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables auto-dedupe disable", options, () => requestOxygen("/api/cli/tables/auto-dedupe", {
+        method: "DELETE",
+        body: { table },
+    })))));
+    tablesCommand.addCommand(new Command("schedule")
+        .description("Scheduled column refresh: a cron workflow re-runs one column on a schedule (only empty/failed cells unless --force). One schedule per column.")
+        .addCommand(new Command("set")
+        .description("Create or replace a column's scheduled refresh (a cron-triggered hosted workflow; visible via `oxygen workflows list`). Paid columns (tool, AI, enrichment) require --max-credits AND --approved; formula columns are free.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column key or id (tool, AI, formula, or enrichment kind).")
+        .option("--cron <expr>", 'Cron expression in UTC, e.g. "0 9 * * *".')
+        .option("--every <sugar>", "Shorthand schedule: hourly, daily@<hour>, or weekly@<day><hour> (e.g. weekly@mon9). Hours 0-23 UTC.")
+        .option("--max-credits <n>", "Credit ceiling PER scheduled refresh; required with --approved for paid columns.")
+        .option("--approved", "Approve the recurring paid runs; required with --max-credits for paid columns.")
+        .option("--force", "Re-run cells that already have values on every tick (full refresh instead of fill-missing).")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, column, options) => {
+        const maxCredits = readPositiveNumber(options.maxCredits);
+        return handleAsyncAction("tables schedule set", options, () => requestOxygen("/api/cli/tables/schedule", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                ...(readOption(options.cron) ? { cron: readOption(options.cron) } : {}),
+                ...(readOption(options.every) ? { every: readOption(options.every) } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(options.approved ? { approved: true } : {}),
+                ...(options.force ? { force: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("list")
+        .description("List a table's scheduled column refreshes.")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, options) => handleAsyncAction("tables schedule list", options, () => {
+        const params = new URLSearchParams({ table });
+        return requestOxygen(`/api/cli/tables/schedule?${params.toString()}`);
+    })))
+        .addCommand(new Command("remove")
+        .description("Remove a column's scheduled refresh (deletes the backing cron workflow; future scheduled runs stop).")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column key or id.")
+        .option("--json", "Print a JSON envelope.")
+        .action((table, column, options) => handleAsyncAction("tables schedule remove", options, () => requestOxygen("/api/cli/tables/schedule", {
+        method: "DELETE",
+        body: { table, column },
+    })))));
     program
         .command("context")
         .description("Workspace-level GTM context commands.")
@@ -3505,7 +4473,7 @@ export function createProgram() {
         .option("--enabled", "Enable unattended synthesis.")
         .option("--disabled", "Disable unattended synthesis.")
         .option("--cadence-hours <n>", "Hours between synthesis cycles (1-168, default 24).")
-        .option("--max-credits-per-day <n>", "Managed-credit cap per UTC day (0-500, default 5).")
+        .option("--max-credits-per-day <n>", "Managed-credit cap per UTC day (0-10,000, default 100).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("knowledge agent set", options, () => {
@@ -3560,7 +4528,7 @@ export function createProgram() {
     }));
     program
         .command("blueprints")
-        .description("Portable Oxygen blueprints: bundle a workflow + tables + columns + prompts as shareable JSON.")
+        .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For guided GTM plays see `oxygen recipes`.")
         .addCommand(new Command("list")
         .description("List Oxygen blueprints visible in this workspace (seeds + saved).")
         .argument("[query]", "Search text.")
@@ -3794,6 +4762,64 @@ export function createProgram() {
             return requestOxygen(`/api/blueprints/marketplace${qs}`, { requireAuth: false });
         });
     }));
+    program
+        .command("recipes")
+        .description("Business-case GTM playbooks: proven plays with prerequisites, credit posture, and approval gates spelled out.")
+        .addCommand(new Command("list")
+        .description("List recipes, optionally filtered by text, business-case category, journey stage, or audience.")
+        .argument("[query]", "Search text (matches slug/title/business case/tags).")
+        .option("--category <category>", "Business-case category (e.g. start-here, pipeline-from-zero).")
+        .option("--stage <stage>", "Journey stage: day-1, day-7, day-30, or ongoing.")
+        .option("--audience <audience>", "founder, gtm-operator, or agency-operator.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("recipes list", options, () => {
+            const params = new URLSearchParams();
+            if (query)
+                params.set("query", query);
+            const category = readOption(options.category);
+            if (category)
+                params.set("category", category);
+            const stage = readOption(options.stage);
+            if (stage)
+                params.set("stage", stage);
+            const audience = readOption(options.audience);
+            if (audience)
+                params.set("audience", audience);
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/recipes${qs}`);
+        });
+    }))
+        .addCommand(new Command("show")
+        .description("Show one recipe: the full playbook body plus prerequisites, credits, and approval gates.")
+        .argument("<slug>", "Recipe slug, e.g. outbound-pilot-50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("recipes show", options, () => requestOxygen("/api/cli/recipes/get", {
+            method: "POST",
+            body: { slug },
+        }));
+    }))
+        .addCommand(new Command("install")
+        .description("Install a recipe into the workspace wiki as a playbook page (revisioned, retrieval-grounded, with per-version provenance).")
+        .argument("<slug>", "Recipe slug, e.g. outbound-pilot-50.")
+        .option("--slug <wiki_slug>", "Override the target wiki slug (default playbook-<recipe-slug>).")
+        .option("--draft", "Install as a draft page (drafts never ground AI actions until activated).")
+        .option("--force", "Overwrite a customized installed copy (edits survive as a page revision).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("recipes install", options, () => {
+            const body = { slug };
+            const wikiSlug = readOption(options.slug);
+            if (wikiSlug)
+                body.wiki_slug = wikiSlug;
+            if (options.draft)
+                body.draft = true;
+            if (options.force)
+                body.force = true;
+            return requestOxygen("/api/cli/recipes/install", { method: "POST", body });
+        });
+    }));
     program.addCommand(buildPromptTemplatesCommand("prompts", "Reusable prompt templates layered into AI columns at run time."));
     // The deprecated `templates` alias tree was removed at its registry sunset
     // (v1.290.0) — `oxygen prompts` has been canonical since v1.80.0.
@@ -3873,7 +4899,7 @@ export function createProgram() {
         .option("--label <label>", "Display label for the new column. Required unless --prompt-key supplies a default title.")
         .option("--key <key>", "Optional stable column key. Defaults to a normalized label.")
         .option("--data-type <type>", "Column data type: text, numeric, boolean, jsonb, or timestamptz.")
-        .option("--kind <kind>", "Column kind. Defaults to manual.")
+        .option("--kind <kind>", "Column kind: manual, ai, formula, enrichment, tool, bind, or lookup. Defaults to manual.")
         .option("--semantic-type <type>", "Optional semantic type such as company_domain.")
         .option("--definition-json <json>", "Optional JSON object with column definition metadata.")
         .option("--prompt-key <key>", "OXYGEN prompt-library key (e.g. email_draft_v1). Materializes prompt + output_schema and forces kind=ai.")
@@ -3884,6 +4910,16 @@ export function createProgram() {
         .option("--run-condition-columns <csv>", "Comma-separated column keys referenced by --run-condition.")
         .option("--output-schema-json <json>", "AI column output JSON schema as inline JSON.")
         .option("--output-schema-file <path>", "AI column output JSON schema read from a file path.")
+        .option("--bind-object <slug>", "Bind column CRM object slug (companies, people, deals, ...). Sets kind=bind and resolves rows to CRM records by identity.")
+        .option("--bind-map <pairs>", "Bind identity mapping as identity=column pairs, e.g. domain=website,linkedin_url=li.")
+        .option("--bind-create", "Bind columns: assert a new CRM record for unmatched rows (onNoMatch=create; a truth write, needs --approved on run).")
+        .option("--lookup-table <table>", "Lookup column: source table id or slug to read from (same workspace). Sets kind=lookup. Free + point-in-time (re-run to refresh).")
+        .option("--lookup-match <pair>", "Lookup join as localColumn=sourceColumn, e.g. company_domain=domain.")
+        .option("--lookup-normalize <mode>", "Lookup key normalization: exact, lower-trim (default), email, domain, or linkedin.")
+        .option("--lookup-mode <mode>", "Lookup mode: first-match (default), count, exists, or aggregate.")
+        .option("--lookup-return <csv>", "Lookup first-match: source column keys to pull (single -> scalar cell, multiple -> object).")
+        .option("--lookup-order <column:dir>", "Lookup first-match tie-break when a key matches many source rows, e.g. created_at:desc.")
+        .option("--lookup-aggregate <fn:column>", "Lookup aggregate reducer as fn:column, e.g. sum:amount (fn: sum, avg, min, or max).")
         .option("--json", "Print a JSON envelope.")
         // skipcq: JS-R1005 — intentional per-option branching to assemble the columns-add request body
         .action(async (table, options) => {
@@ -3914,6 +4950,39 @@ export function createProgram() {
             const definition = isRecord(column.definition) ? column.definition : {};
             column.definition = applyAiColumnConfig(definition, options);
         }
+        if (readOption(options.bindObject) || readOption(options.bindMap) || options.bindCreate) {
+            const definition = isRecord(column.definition) ? column.definition : {};
+            column.kind = "bind";
+            // Bind columns write a jsonb status cell; the server rejects any other
+            // data type (invalid_column_definition). Default it so callers don't have
+            // to pass --data-type jsonb by hand alongside --bind-object.
+            if (!options.dataType)
+                column.data_type = "jsonb";
+            column.definition = applyBindColumnConfig(definition, options);
+        }
+        if (readOption(options.lookupTable)
+            || readOption(options.lookupMatch)
+            || readOption(options.lookupMode)
+            || readOption(options.lookupReturn)
+            || readOption(options.lookupOrder)
+            || readOption(options.lookupAggregate)
+            || readOption(options.lookupNormalize)) {
+            const definition = isRecord(column.definition) ? column.definition : {};
+            column.kind = "lookup";
+            const lookupDefinition = applyLookupColumnConfig(definition, options);
+            column.definition = lookupDefinition;
+            // Derive the output data type from the mode so callers don't have to know
+            // it (the bind lesson): count/aggregate -> numeric, exists -> boolean,
+            // first_match -> jsonb (holds a scalar OR the multi-return object).
+            if (!options.dataType) {
+                const mode = typeof lookupDefinition.mode === "string" ? lookupDefinition.mode : "first_match";
+                column.data_type = mode === "count" || mode === "aggregate"
+                    ? "numeric"
+                    : mode === "exists"
+                        ? "boolean"
+                        : "jsonb";
+            }
+        }
         const body = { table, column };
         if (options.promptKey)
             body.prompt_key = options.promptKey;
@@ -3925,7 +4994,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("run")
-        .description("Run an executable AI, tool, formula, or local custom HTTP column for one row or a bounded batch.")
+        .description("Run an executable AI, tool, formula, enrichment, bind, lookup, or local custom HTTP column for one row or a bounded batch. Bind create-mode (onNoMatch=create) needs --approved.")
         .argument("<table>", "Table id or slug.")
         .argument("<column>", "Column id or key.")
         .option("--row-id <row_id>", "Workspace row id to run.")
@@ -3935,7 +5004,7 @@ export function createProgram() {
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--background", "Create a durable background table action run instead of executing synchronously.")
-        .option("--approved", "Confirm the paid background run after inspecting a dry run or preview.")
+        .option("--approved", "Confirm a paid background run, or a bind create-mode run (onNoMatch=create), after inspecting a dry run or preview.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for a background run.")
         .option("--max-concurrency <n>", "Maximum concurrent row items for a background run. Defaults to 250 for AI columns and 50 otherwise.")
         .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
@@ -4891,7 +5960,7 @@ export function createProgram() {
         .command("billing")
         .description("Plan and managed credit commands.")
         .addCommand(new Command("balance")
-        .description("Show the current plan and managed credit balance.")
+        .description("Show the current plan and managed credit balance. Credits are Oxygen's native unit; the plan's price and $-per-credit are at https://oxygen-agent.com/billing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("billing balance", options, () => requestOxygen("/api/cli/billing/balance"));
@@ -5014,6 +6083,18 @@ export function createProgram() {
             method: "POST",
             body: { action: "resume" },
         }));
+    }))
+        .addCommand(new Command("topup")
+        .description("Buy on-demand credits at $1.25 per 1,000 (subscription credits are 20% cheaper). Run without a pack to list packs; with a pack it returns a Stripe checkout link — credits post as soon as the payment confirms and never expire.")
+        .argument("[pack]", "Pack size in USD: 10, 25, 100, or 250.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (pack, options) => {
+        await handleAsyncAction("billing topup", options, () => pack
+            ? requestOxygen("/api/cli/billing/topup", {
+                method: "POST",
+                body: { pack },
+            })
+            : requestOxygen("/api/cli/billing/topup"));
     }));
     program
         .command("budget")
@@ -5331,9 +6412,9 @@ export function createProgram() {
     })));
     program
         .command("observability")
-        .description("Redacted operation event commands for the current organization.")
+        .description("Workspace observability: redacted operation events, plus the cross-primitive runs lens and approvals inbox (list-only — decisions route to the owning primitive).")
         .addCommand(new Command("events")
-        .description("List recent redacted operation events and failures.")
+        .description("List recent redacted operation events and failures. For staff ticket-change envelopes, use this CLI's `support admin events` command.")
         // Keep in sync with OBSERVABILITY_STATUS_FILTERS in
         // apps/web/src/lib/observability.ts and the MCP tool enum in
         // packages/mcp-server/src/tools/observability.ts. The API rejects any
@@ -5373,6 +6454,112 @@ export function createProgram() {
             const suffix = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/observability/events${suffix}`);
         });
+    }))
+        .addCommand(new Command("runs")
+        .description("List active and failed runs across workflows and table action/ingestion runs — the cross-primitive runs lens. Read-only; each failed item carries the command that resolves it.")
+        // Keep --status / --source values in sync with OBSERVABILITY_CONSOLE_STATES
+        // and OBSERVABILITY_RUN_SOURCES in apps/web/src/lib/observability-console.ts
+        // and the MCP tool enums. The API rejects any other value with
+        // invalid_request so a typo fails loudly.
+        .option("--status <statuses>", "Comma-separated normalized states: running, queued, waiting_approval, failed, completed, canceled. Defaults to active + failed.")
+        .option("--source <sources>", "Comma-separated sources: workflow, table_run.")
+        .option("--limit <n>", "Maximum items per source (default 25, max 100). Counts reflect the returned page only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("observability runs", options, async () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            const source = readOption(options.source);
+            const limit = readPositiveInt(options.limit);
+            if (status)
+                params.set("status", status);
+            if (source)
+                params.set("source", source);
+            if (limit)
+                params.set("limit", String(limit));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/observability/runs${suffix}`);
+            if (!options.json)
+                writeObservabilityCapsNotice(data);
+            return data;
+        });
+    }))
+        .addCommand(new Command("approvals")
+        .description("List everything waiting for a human decision across workflows, publishing, message reviews, and inbox reply drafts — the cross-primitive approvals inbox. Read-only: each item includes the exact command to resolve it and a web link to decide.")
+        // Keep --source values in sync with OBSERVABILITY_APPROVAL_SOURCES in
+        // apps/web/src/lib/observability-console.ts and the MCP tool enum. The API
+        // rejects any other value with invalid_request so a typo fails loudly.
+        .option("--source <sources>", "Comma-separated sources: workflow, publishing, message_review, inbox_draft.")
+        .option("--limit <n>", "Maximum items per source (default 25, max 100). Counts reflect the returned page only.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("observability approvals", options, async () => {
+            const params = new URLSearchParams();
+            const source = readOption(options.source);
+            const limit = readPositiveInt(options.limit);
+            if (source)
+                params.set("source", source);
+            if (limit)
+                params.set("limit", String(limit));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            const data = await requestOxygen(`/api/cli/observability/approvals${suffix}`);
+            if (!options.json)
+                writeObservabilityCapsNotice(data);
+            return data;
+        });
+    }));
+    // Singular `agent`, deliberately: this is ONE governed roster surface — a lens
+    // over the built-in specialist agents that already run inside the workspace as
+    // approval-gated, workflow-owned behavior — not a 14th primitive and not a
+    // build-your-own-agent runtime. (Distinct from `oxygen knowledge agent`, which
+    // configures the knowledge-synthesis specialist itself.)
+    program
+        .command("agent")
+        .description("Workspace Agent roster: your built-in specialist agents (inbox reply drafts, meeting notetaker, knowledge synthesis) that run inside your workspace as approval-gated runs. List them, inspect run history, and enable or disable each one.")
+        .addCommand(new Command("list")
+        .description("List the built-in specialist agents with their enabled state and recent run history.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("agent list", options, () => requestOxygen("/api/cli/agent"));
+    }))
+        .addCommand(new Command("get")
+        .description("Show one specialist agent: its state, approval boundary, config command, and recent runs.")
+        .argument("<slug>", "Specialist slug: inbox-reply-drafts, meeting-notetaker, or knowledge-synthesis.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("agent get", options, () => requestOxygen(`/api/cli/agent/${encodeURIComponent(slug)}`));
+    }))
+        .addCommand(new Command("enable")
+        .description("Enable a specialist agent so it resumes its approval-gated drafts/runs.")
+        .argument("<slug>", "Specialist slug: inbox-reply-drafts, meeting-notetaker, or knowledge-synthesis.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("agent enable", options, () => requestOxygen(`/api/cli/agent/${encodeURIComponent(slug)}/enable`, { method: "POST" }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disable a specialist agent so it stops its drafts/runs on the next worker tick.")
+        .argument("<slug>", "Specialist slug: inbox-reply-drafts, meeting-notetaker, or knowledge-synthesis.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("agent disable", options, () => requestOxygen(`/api/cli/agent/${encodeURIComponent(slug)}/disable`, { method: "POST" }));
+    }))
+        .addCommand(new Command("runs")
+        .description("List recent runs across the specialist agents (or one via <slug>), newest first.")
+        .argument("[slug]", "Optional specialist slug to filter to one agent.")
+        .option("--limit <n>", "Maximum runs to return (1-100). Defaults to 25.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("agent runs", options, () => {
+            const params = new URLSearchParams();
+            const target = readOption(slug);
+            const limit = readPositiveInt(options.limit);
+            if (target)
+                params.set("slug", target);
+            if (limit)
+                params.set("limit", String(limit));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/agent/runs${suffix}`);
+        });
     }));
     program
         .command("runs")
@@ -6311,10 +7498,10 @@ export function createProgram() {
         });
     })));
     program.addCommand(new Command("posts")
-        .description("Read and publish LinkedIn posts through a connected account. `get` returns a post and the composite social_id that `comments`/`reactions` and `oxygen engagement harvest` need; `create` publishes a real post (approval-gated). All calls are metered against the sender account's daily quota.")
+        .description("Read and publish LinkedIn posts through a connected account. `get` returns a post and the composite social_id that `comments`/`reactions` and `oxygen engagement harvest` need; `create` publishes a real post (approval-gated). Every command here addresses ONE post you already have an id for — Oxygen cannot enumerate an account's own LinkedIn history, so analytics only cover posts Oxygen itself published (`oxygen publishing ...`). All calls are metered against the sender account's daily quota.")
         .addCommand(new Command("get")
         .description("Read a LinkedIn post. Returns the post and its composite social_id (reuse that social_id for `posts comments`, `posts reactions`, and `engagement harvest --source unipile` — NOT the raw activity URN). Metered as an account read.")
-        .requiredOption("--post <id>", "Numeric activity id, activity URL, or composite social_id.")
+        .requiredOption("--post <id>", "Numeric activity id, activity URL, or composite social_id. There is no way to LIST your own posts: take the id from the post's LinkedIn URL, or from a post you scheduled (`oxygen publishing posts get <post_id>` → provider_post_id).")
         .option("--account <ref>", "Sender account to read through (sender id, connection id, or Unipile account id). Omit for the org default.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -6530,14 +7717,14 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("watch")
-        .description("Declarative engagement watches (the signals wedge): stand up a watch on a post's engagers or 'who viewed my profile' that harvests people into a table and, under a standing approval, auto-enrolls them into a sequence. The watch materializes the harvest drip and enrolls newly-harvested people each cycle — the sequence still gates its own sends.")
+        .description("Declarative engagement watches (the signals wedge): stand up a watch on a post's engagers, 'who viewed my profile', or the sender's inbound network (new followers / new connections) that harvests people into a table and, under a standing approval, auto-enrolls them into a sequence. The watch materializes the harvest drip and enrolls newly-harvested people each cycle — the sequence still gates its own sends.")
         .addCommand(new Command("create")
-        .description("Arm an engagement watch. `--kind post` watches a post's reactors + commenters (needs --post social_id; a cookieless post also needs --post-url); `--kind profile_viewers` watches 'who viewed my profile' (source unipile). With --auto-enroll it enrolls harvested people into --sequence, capped by --max-enrolls-per-day. --max-credits-per-cycle is the standing per-cycle spend cap (required for --auto-enroll and cookieless). No messages are sent by the watch itself.")
-        .requiredOption("--kind <kind>", "post | profile_viewers.")
+        .description("Arm an engagement watch. `--kind post` watches a post's reactors + commenters (needs --post social_id; a cookieless post also needs --post-url); `--kind profile_viewers` watches 'who viewed my profile' (source unipile); `--kind followers` / `--kind connections` watch the sender's inbound network — people NEW to the org's orbit stream into the watch table as they follow/connect (source unipile, no credits, reads metered against the account's daily ingest budget). With --auto-enroll it enrolls harvested people into --sequence, capped by --max-enrolls-per-day — the inbound-led-outbound loop. --max-credits-per-cycle is the standing per-cycle spend cap (required for --auto-enroll and cookieless). No messages are sent by the watch itself.")
+        .requiredOption("--kind <kind>", "post | profile_viewers | followers | connections.")
         .requiredOption("--account <ref>", "Reading LinkedIn sender (sender id, connection id, or Unipile account id).")
         .option("--post <social_id>", "Composite post social_id from `oxygen posts get` (required for --kind post).")
         .option("--post-url <url>", "Public LinkedIn post URL (required for a cookieless post watch).")
-        .option("--source <source>", "cookieless | unipile. Defaults to cookieless for post, unipile for profile_viewers.")
+        .option("--source <source>", "cookieless | unipile. Defaults to cookieless for post; profile_viewers/followers/connections are always unipile.")
         .option("--table <id_or_slug>", "Existing table to land harvested people into. Omit to create one.")
         .option("--sequence <id_or_slug>", "Sequence to auto-enroll harvested people into (required with --auto-enroll).")
         .option("--auto-enroll", "Auto-enroll newly harvested people into --sequence under the standing approval.")
@@ -6839,7 +8026,7 @@ export function createProgram() {
         .option("--status <keys>", "Comma-separated status keys (e.g. interested,meeting_booked). Cross-channel — filters email + LinkedIn + WhatsApp by the shared taxonomy.")
         .option("--since <iso>", "Only conversations whose last message is on/after this ISO date/timestamp. Cross-channel.")
         .option("--until <iso>", "Only conversations whose last message is on/before this ISO date/timestamp. Cross-channel.")
-        .option("--sequence-id <ids>", "Email only: comma-separated campaign (sequence) ids.")
+        .option("--sequence-id <ids>", "Email only: comma-separated campaign (sequence) UUIDs (not slugs — get the id from `sequences get <slug>`).")
         .option("--provider <providers>", "Email only: comma-separated providers (google,microsoft).")
         .option("--domain <domains>", "Email only: comma-separated counterpart domains to include.")
         .option("--exclude-domain <domains>", "Email only: comma-separated counterpart domains to exclude.")
@@ -7300,11 +8487,12 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("stats")
-        .description("Cross-channel campaign analytics: outbound/inbound totals, heuristic reply rate by channel + campaign, status/sentiment breakdowns, response-time percentiles, top counterpart domains, and winning openers. Scope with --sequence-id, --channel, and a date range.")
+        .description("Cross-channel campaign analytics: outbound/inbound totals, heuristic reply rate by channel + campaign, status/sentiment breakdowns, response-time percentiles, top counterpart domains, and winning openers. Scope with --sequence-id, --channel, and a date range. Defaults to the last 30 days; pass --all-time for full history.")
         .option("--sequence-id <ids>", "Comma-separated campaign (sequence) ids to scope to.")
         .option("--channel <channel>", "Channel: all (default), email, linkedin, or whatsapp.")
-        .option("--since <iso>", "Only messages sent at or after this ISO timestamp.")
+        .option("--since <iso>", "Only messages sent at or after this ISO timestamp. Defaults to 30 days ago.")
         .option("--until <iso>", "Only messages sent before this ISO timestamp.")
+        .option("--all-time", "Scan full message history instead of the default trailing 30 days. Ignored if --since or --until is also set.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("messages stats", options, () => {
@@ -7319,6 +8507,8 @@ export function createProgram() {
                 if (value)
                     params.set(key, value);
             }
+            if (options.allTime)
+                params.set("all_time", "true");
             const suffix = params.toString();
             return requestOxygen(`/api/cli/messages/stats${suffix ? `?${suffix}` : ""}`);
         });
@@ -7369,7 +8559,7 @@ export function createProgram() {
         .description("Create a draft multichannel sequence from a steps JSON file. Assign LinkedIn senders with --senders (required when the journey has LinkedIn steps); bind an Instantly email track with --email-*.")
         .requiredOption("--name <name>", "Human-readable sequence name.")
         .requiredOption("--slug <slug>", "Unique slug for the sequence.")
-        .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (invite | message | wait_for_connection | inmail), email steps (email_send | email_reply | email_enroll | email_move | email_stop), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected sugar (then_id/else_id).")
+        .requiredOption("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] }. LinkedIn steps (visit_profile | invite | wait_for_connection | message | inmail | follow | like_post | comment_post | withdraw_invite), email steps (email_send | email_reply | email_enroll | email_move | email_stop), and control steps (wait | wait_for_signal | branch | stop), each with an `id`. Copy templates support {{column}} interpolation from the lead's row. Native email sends (email_send/email_reply) also expose three reserved sender variables from the sending mailbox: {{sender_name}} (mailbox display name), {{sender_first_name}} (its first word), and {{sender_email}} (the from address); a row column of the same name WINS on collision, and a missing display name renders empty. comment_post takes text_template and/or ai_prompt — a KG-grounded comment generated at send time (a paid AI call) that falls back to text_template if generation fails. A `branch` routes on signals (then/else) or the legacy connection_accepted/already_connected sugar (then_id/else_id). A signal condition can also branch on the LEAD'S DATA: a data leaf { has_column: \"email\" } is true when that row_values column has a non-empty value (add present:false for \"missing\") — e.g. route leads that have an email down an email arm and the rest down a LinkedIn arm.MINIMAL EMAIL STEP SHAPE: { \"id\": \"s1\", \"channel\": \"email\", \"kind\": \"email_send\", \"subject_template\": \"...\", \"body_template\": \"...\" } — subject_template + body_template are REQUIRED on email_send; A/B tests use an explicit `variants` array of copy partials on the step (up to 25 alternates, a–z; spintax varies wording INSIDE one variant and is not A/B-tracked).")
         .option("--channels <list>", "Comma-separated channels: linkedin,email,whatsapp. Defaults to the channels the journey touches.")
         .option("--whatsapp-cold-initiate", "WhatsApp: allow cold-initiating new chats (no prior conversation). Required to start a WhatsApp sequence live — WhatsApp via Unipile is unofficial WhatsApp Web, so cold-initiating is an explicit ban-risk opt-in.")
         .option("--phone-column-key <key>", "WhatsApp: row_values key holding each lead's phone number (else falls back to phone/phone_number/mobile).")
@@ -7390,7 +8580,11 @@ export function createProgram() {
         .option("--esp-matching <mode>", "Native-email ESP matching: 'off' (default) rotates mailboxes freely; 'prefer' biases toward a mailbox on the recipient's own provider; 'strict' requires a same-provider mailbox and defers the send when none exists.")
         .option("--sender-failover <mode>", "What happens when an enrollment's LinkedIn/WhatsApp sender goes unavailable: 'wait' (default) resumes when the sender recovers; 'rebind' moves UNTOUCHED enrollments (no thread, no pending invite, no lead binding) to the least-loaded healthy sender in the pool after ~5h of confirmed outage.")
         .option("--email-min-gap-minutes <n>", "Minimum minutes between two live emails from the SAME mailbox for this sequence (Instantly's 'time gap between emails'; integer 0-720, 0 = none). A humanization gap that only WIDENS the derived per-mailbox spacing — it never bypasses the daily caps or the send window.")
+        .option("--opportunity-value <usd>", "Estimated USD value of one positive-reply opportunity (>= 0). Analytics-only: sequence stats multiply it by the positive-reply count to report pipeline $ (stats.opportunities). Never gates a send or spends a credit.")
+        .option("--mailboxes <ids>", "Per-sequence sending-account allowlist for native email (Instantly's 'Accounts to use'): comma-separated mailbox ids. Native email sends rotate ONLY over these mailboxes instead of the whole pool (max 50). Omit for the whole pool. Note: a narrow allowlist plus --esp-matching strict can starve sends when no allowed same-provider mailbox exists (surfaced as blocked defer reasons in stats).")
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
+        .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
+        .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences create", options, () => {
@@ -7421,12 +8615,39 @@ export function createProgram() {
                 },
             });
         });
+    }))
+        .addCommand(new Command("draft")
+        .description("Draft an email outreach sequence with AI, grounded in the workspace Knowledge Graph (voice, positioning, campaign learnings) — Instantly's AI sequence generator, with provenance. PAID (one AI call, typically ~15 credits [low tier]; an under-cap call errors BEFORE spending and prints the live estimate) — requires --max-credits. Prints the drafted steps + the KG pages that grounded them; nothing is saved until you re-run with --create (which needs --name and --slug). Even created, it lands as a DRAFT — enrolling leads and starting it stay approval-gated.")
+        .requiredOption("--goal <goal>", "Plain-language goal for the sequence (e.g. \"book demos with RevOps leaders at Series A SaaS\"). The trusted brief the copy is written to.")
+        .option("--audience <audience>", "Who the sequence targets (e.g. \"RevOps leaders at 20-100 person B2B SaaS\"). Sharpens the Knowledge Graph retrieval.")
+        .option("--table <id>", "Source table id whose column keys become the {{column|fallback}} personalization tokens the copy may use.")
+        .option("--steps <n>", "How many emails in the journey (1-7). Defaults to 4.")
+        .option("--variants <n>", "Copy variants per email for A/B testing (1-3). Defaults to 1.")
+        .requiredOption("--max-credits <n>", "Credit cap for the AI call (required — this is a paid action).")
+        .option("--create", "Save the draft as a DRAFT sequence (requires --name and --slug). Without this, the draft is only previewed.")
+        .option("--name <name>", "Human-readable sequence name (required with --create).")
+        .option("--slug <slug>", "Unique slug for the sequence (required with --create).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        try {
+            const data = await requestOxygen("/api/cli/sequences/draft", {
+                method: "POST",
+                body: buildSequenceDraftBody(options),
+            });
+            emitSuccess("sequences draft", data, options);
+            if (!options.json)
+                writeSequenceDraftPreview(data);
+            writeCreditsReceipt(data);
+        }
+        catch (error) {
+            emitCliFailure("sequences draft", error);
+        }
     }))
         .addCommand(new Command("update")
         .description("Update a DRAFT sequence's name, journey, channels, senders, email binding, or LinkedIn credit cap, plus the always-editable open/click tracking toggles (--[no-]tracking-opens / --[no-]tracking-clicks, default on). The journey is re-validated; the email binding stays editable only while the sequence is a draft. --max-credits is locked once the sequence has been started (re-run `sequences start`). Pass only the fields you want to change.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--name <name>", "New human-readable sequence name.")
-        .option("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] } replacing the journey.")
+        .option("--steps-file <path>", "Path to a JSON file: { \"steps\": [...] } replacing the journey. Copy supports {{column}} interpolation; native email steps also expose {{sender_name}} / {{sender_first_name}} / {{sender_email}} from the sending mailbox (a same-named row column wins). A `branch` can also route on the lead's data with a data leaf { has_column: \"email\" } (true when that row_values column is non-empty; present:false for \"missing\").")
         .option("--channels <list>", "Comma-separated channels: linkedin,email,whatsapp.")
         .option("--whatsapp-cold-initiate", "WhatsApp: allow cold-initiating new chats (no prior conversation). Required to start a WhatsApp sequence live (draft-editable).")
         .option("--phone-column-key <key>", "WhatsApp: row_values key holding each lead's phone number (else falls back to phone/phone_number/mobile).")
@@ -7446,7 +8667,11 @@ export function createProgram() {
         .option("--esp-matching <mode>", "Native-email ESP matching: 'off' (default) rotates mailboxes freely; 'prefer' biases toward a mailbox on the recipient's own provider; 'strict' requires a same-provider mailbox and defers the send when none exists.")
         .option("--sender-failover <mode>", "What happens when an enrollment's LinkedIn/WhatsApp sender goes unavailable: 'wait' (default) resumes when the sender recovers; 'rebind' moves UNTOUCHED enrollments (no thread, no pending invite, no lead binding) to the least-loaded healthy sender in the pool after ~5h of confirmed outage.")
         .option("--email-min-gap-minutes <n>", "Minimum minutes between two live emails from the SAME mailbox for this sequence (Instantly's 'time gap between emails'; integer 0-720, 0 = none). A humanization gap that only WIDENS the derived per-mailbox spacing — it never bypasses the daily caps or the send window.")
+        .option("--opportunity-value <usd>", "Estimated USD value of one positive-reply opportunity (>= 0). Analytics-only: sequence stats multiply it by the positive-reply count to report pipeline $ (stats.opportunities). Never gates a send or spends a credit.")
+        .option("--mailboxes <ids>", "Per-sequence sending-account allowlist for native email (Instantly's 'Accounts to use'): comma-separated mailbox ids. Native email sends rotate ONLY over these mailboxes instead of the whole pool (max 50). Note: a narrow allowlist plus --esp-matching strict can starve sends when no allowed same-provider mailbox exists (surfaced as blocked defer reasons in stats).")
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
+        .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
+        .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
         .option("--tracking-opens", "Turn open-pixel tracking ON for this sequence's native email sends (the default; injection still needs a verified tracking domain — see `oxygen domains tracking`).")
         .option("--no-tracking-opens", "Turn OFF the open pixel for this sequence's native email sends (a deliverability knob — a pixel is spam-filter surface).")
         .option("--tracking-clicks", "Turn click-link tracking ON for this sequence's native email sends (the default; same verified-tracking-domain gate as opens).")
@@ -7492,7 +8717,7 @@ export function createProgram() {
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --no-stop-on-bounce, or --[no-]tracking-opens / --[no-]tracking-clicks).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -7512,7 +8737,8 @@ export function createProgram() {
         .argument("<sequence>", "Sequence id or slug.")
         .option("--leads-file <path>", "Path to a JSON file: { \"leads\": [{ row_values: { email }, lead_name }] } for cold email, or { lead_provider_id, lead_name, table_row_id, row_values } for LinkedIn / existing rows. Exactly one of --leads-file or --from-table.")
         .option("--from-table", "Enroll every not-yet-enrolled row of the sequence's bound source table (up to 500 per run; re-run to continue). Exactly one of --leads-file or --from-table.")
-        .option("--exclude-contacted", "Also skip leads any OTHER active sequence is already contacting (cross-campaign exclusion). Off by default.")
+        .option("--exclude-contacted", "Also skip leads any OTHER active sequence is already contacting (cross-campaign exclusion), for THIS enroll. Off by default; forces exclusion on even if the sequence's exclude_contacted default is off.")
+        .option("--no-exclude-contacted", "Force-INCLUDE cross-campaign leads for this enroll even when the sequence's exclude_contacted default is on (per-call override).")
         .option("--suppress-list <ids>", "Per-call do-not-enroll lead provider ids dropped for this enroll only: a comma-separated list, or @<path> to a file of ids (comma/whitespace separated).")
         .option("--ignore-sender-bindings", "Enroll leads even when they are already owned by a sender account outside this sequence's pool (overrides the one-person-one-sender guarantee). Off by default.")
         .option("--json", "Print a JSON envelope.")
@@ -7527,7 +8753,9 @@ export function createProgram() {
             }
             const suppressList = parseSuppressListOption(options.suppressList);
             const sharedFlags = {
-                ...(options.excludeContacted ? { exclude_contacted: true } : {}),
+                // Tri-state: --exclude-contacted (true) / --no-exclude-contacted (false)
+                // / absent (undefined → the route falls back to the sequence's default).
+                ...(options.excludeContacted === undefined ? {} : { exclude_contacted: options.excludeContacted }),
                 ...(suppressList.length > 0 ? { suppress_list: suppressList } : {}),
                 ...(options.ignoreSenderBindings ? { ignore_sender_bindings: true } : {}),
             };
@@ -7579,6 +8807,16 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleSequenceSignalAction(sequence, options);
+    }))
+        .addCommand(new Command("duplicate")
+        .description("Duplicate a sequence as a new DRAFT: copies the step definition, settings, channels, source table, and sender pool. Never copies enrollments, stats, or an Instantly email binding (re-bind with `sequences update` if the source used one; native email steps need no binding). Client-side composition of get + create — the copy starts fully inert until you `sequences start` it.")
+        .argument("<sequence>", "Source sequence id or slug.")
+        .requiredOption("--name <name>", "Name for the copy.")
+        .option("--slug <slug>", "Slug for the copy. Defaults to the source slug + '-copy'.")
+        .option("--no-senders", "Do not copy the source's sender pool onto the copy.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceDuplicateAction(sequence, options);
     }))
         .addCommand(new Command("pause")
         .description("Pause an active sequence (stops new dispatches; enrollments resume on un-pause).")
@@ -7632,11 +8870,23 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences stats", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/stats`));
+    }))
+        .addCommand(new Command("events")
+        .description("Chronological activity feed for a sequence (like Instantly's Sending Activities): sends, failures, deferrals, opens, clicks, replies, bounces, unsubscribes, and positive reply-status transitions, newest first. Keyset-paginated via --before.")
+        .argument("<sequence>", "Sequence id or slug.")
+        .option("--enrollment <id>", "Scope the feed to one enrollment id.")
+        .option("--kind <list>", "Comma-separated event kinds to include (sent,failed,skipped,open,click,replied,bounced,unsubscribed,positive).")
+        .option("--include-bots", "Include bot-attributed opens/clicks (excluded by default).")
+        .option("--limit <n>", "Maximum events to return (1-200, default 50).")
+        .option("--before <iso>", "Keyset cursor: only events strictly before this ISO timestamp (pass the previous page's next_before).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleSequenceEventsAction(sequence, options);
     }))
         .addCommand(new Command("variants")
-        .description("A/B scoreboard for a sequence: per-step/per-variant sent, replied, reply rate, bounced, credits, plus the reversible auto-winner state (which variants are paused + evidence). Flags run the reply-metric auto-winner or manually override/reset a variant's pause.")
+        .description("A/B scoreboard for a sequence: per-step/per-variant sent, replied, reply rate, bounced, credits, plus the reversible auto-winner state (which variants are paused + evidence). Flags run the auto-winner or manually override/reset a variant's pause.")
         .argument("<sequence>", "Sequence id or slug.")
-        .option("--auto-optimize", "Run the reply-metric auto-winner now: pause the statistically-losing variant(s) of any step carrying an auto_optimize config, once every variant clears its thresholds. Reversible.")
+        .option("--auto-optimize", "Run the auto-winner now: pause the statistically-losing variant(s) of any step carrying an auto_optimize config, once every variant clears its thresholds, on that step's configured metric — reply (the recommended default), click, or open (click/open need native open/click tracking; opens are soft signals under Apple Mail Privacy Protection). Reversible.")
         .option("--pause <variant>", "Manually pause one variant (requires --step). Overrides the auto-winner.")
         .option("--activate <variant>", "Manually reactivate one paused variant (requires --step).")
         .option("--reset [variant]", "Clear an auto/manual decision: one variant (with --step), a whole step (--step only), or the entire sequence (no value). Reactivates the affected variants.")
@@ -7679,7 +8929,7 @@ export function createProgram() {
         });
     })));
     program.addCommand(new Command("suppressions")
-        .description("Org do-not-contact list (people/multichannel): lead provider ids the sequencer enroller always skips at plan time. list | add | remove. Consumes 0 credits.")
+        .description("Do-not-contact + email blocklist. People/multichannel: lead provider ids the sequencer enroller skips at plan time (list | add | remove). Email blocklist (Instantly parity): bulk-import addresses + whole-domain blocks the native email dispatcher skips before sending (import | domains | remove-domain). Consumes 0 credits.")
         .addCommand(new Command("list")
         .description("List the org's do-not-contact suppressions, newest first. Filter by --reason or by --search (case-insensitive substring of the lead provider id).")
         .option("--reason <reason>", "Filter by reason: manual, replied, unsubscribed, bounced, do_not_contact, friends.")
@@ -7729,19 +8979,132 @@ export function createProgram() {
             });
         });
     }))
-        .addCommand(new Command("remove")
-        .description("Remove a lead provider id from the org do-not-contact list (re-enable contact).")
-        .requiredOption("--lead <provider_id>", "The lead provider id to un-suppress.")
+        .addCommand(new Command("remove")
+        .description("Remove a lead provider id from the org do-not-contact list (re-enable contact).")
+        .requiredOption("--lead <provider_id>", "The lead provider id to un-suppress.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions remove", options, () => {
+            const lead = readOption(options.lead);
+            if (!lead)
+                throw new Error("--lead is required.");
+            return requestOxygen(`/api/cli/suppressions?lead_provider_id=${encodeURIComponent(lead)}`, {
+                method: "DELETE",
+            });
+        });
+    }))
+        .addCommand(new Command("import")
+        .description("Bulk-import an email blocklist from a file of emails and/or bare domains (newline / comma / whitespace separated, max 5000). An entry with '@' goes on the per-address list; a bare domain (e.g. acme.com) blocks the WHOLE domain. A domain block is a sharp tool, so --reason is REQUIRED when the file contains any domains; a pure-email import defaults to manual. Idempotent. Consumes 0 credits.")
+        .requiredOption("--file <path>", "Path to a file of emails and/or bare domains, separated by newlines, commas, or whitespace.")
+        .option("--reason <reason>", "Suppression reason. Emails: hard_bounce | complaint | unsubscribe | manual. Domains: manual | complaint | policy. Required when the file contains any domains.")
+        .option("--source <text>", "Optional provenance note stored on every imported row (e.g. instantly_export).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        try {
+            const file = readOption(options.file);
+            if (!file)
+                throw new Error("--file is required.");
+            const text = readFileSync(resolve(file), "utf8");
+            const entries = [
+                ...new Set(text
+                    .split(/[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0)),
+            ];
+            if (entries.length === 0)
+                throw new Error(`No emails or domains found in ${file}.`);
+            const reason = readOption(options.reason);
+            const source = readOption(options.source);
+            const data = await requestOxygen("/api/cli/suppressions/import", {
+                method: "POST",
+                body: {
+                    entries,
+                    ...(reason ? { reason } : {}),
+                    ...(source ? { source } : {}),
+                },
+            });
+            if (options.json) {
+                writeJson(success("suppressions import", data));
+            }
+            else {
+                // Compact human view: the counts plus up to 10 rejected entries (the
+                // full list is always in the --json envelope).
+                const parsed = (data ?? {});
+                const rejected = Array.isArray(parsed.rejected) ? parsed.rejected : [];
+                writeJson({
+                    imported_emails: parsed.imported_emails ?? 0,
+                    imported_domains: parsed.imported_domains ?? 0,
+                    rejected_count: rejected.length,
+                    rejected: rejected.slice(0, 10),
+                    ...(rejected.length > 10
+                        ? { rejected_note: `+${rejected.length - 10} more (use --json for the full list)` }
+                        : {}),
+                    deep_link: parsed.deep_link,
+                });
+            }
+            writeCreditsReceipt(data);
+        }
+        catch (error) {
+            emitCliFailure("suppressions import", error);
+        }
+    }))
+        .addCommand(new Command("domains")
+        .description("List the org's whole-domain email blocks, newest first. Filter by --reason (manual | complaint | policy) or --search (case-insensitive substring of the domain).")
+        .option("--reason <reason>", "Filter by reason: manual, complaint, policy.")
+        .option("--search <text>", "Case-insensitive substring match on the domain.")
+        .option("--limit <n>", "Maximum domain blocks to return (1-500; default 100).")
+        .option("--offset <n>", "Pagination offset (0-based).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions domains", options, () => {
+            const params = new URLSearchParams();
+            const reason = readOption(options.reason);
+            if (reason)
+                params.set("reason", reason);
+            const search = readOption(options.search);
+            if (search)
+                params.set("search", search);
+            const limit = readOption(options.limit);
+            if (limit)
+                params.set("limit", limit);
+            const offset = readOption(options.offset);
+            if (offset)
+                params.set("offset", offset);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/suppressions/domains${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("remove-domain")
+        .description("Remove a whole-domain email block (re-enable sending to the domain).")
+        .argument("<domain>", "The bare domain to un-block (e.g. acme.com).")
         .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("suppressions remove", options, () => {
-            const lead = readOption(options.lead);
-            if (!lead)
-                throw new Error("--lead is required.");
-            return requestOxygen(`/api/cli/suppressions?lead_provider_id=${encodeURIComponent(lead)}`, {
+        .action(async (domain, options) => {
+        await handleAsyncAction("suppressions remove-domain", options, () => {
+            const value = domain?.trim();
+            if (!value)
+                throw new Error("A domain is required.");
+            return requestOxygen(`/api/cli/suppressions/domains?domain=${encodeURIComponent(value)}`, {
                 method: "DELETE",
             });
         });
+    }))
+        .addCommand(new Command("remove-address")
+        .description("Remove one blocked email ADDRESS from the do-not-contact ledger (re-enables sending to it). Addresses land here via bounces, unsubscribes, and `suppressions import`; whole-domain blocks have their own `remove-domain`.")
+        .argument("<email>", "The blocked address, e.g. ada@acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        try {
+            const data = await requestOxygen(`/api/cli/suppressions/addresses?email=${encodeURIComponent(email)}`, { method: "DELETE" });
+            if (options.json) {
+                writeJson(success("suppressions remove-address", data));
+                return;
+            }
+            const link = data.deepLink ?? data.web_url;
+            process.stdout.write(`${data.removed ? "Removed" : "Not found:"} ${data.email ?? email}.${link ? ` ${link}` : ""}\n`);
+        }
+        catch (error) {
+            emitCliFailure("suppressions remove-address", error);
+        }
     })));
     program.addCommand(new Command("email")
         .description("Ad-hoc email from the org's sending fleet: one-off sends with no sequence, enrollment, or contact sync. Zapbox-connected mailboxes send through Zapmail's API (no Google/Microsoft consent); BYOK — 0 Oxygen credits.")
@@ -7785,10 +9148,17 @@ export function createProgram() {
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Whitelabel sending inboxes bought through OXYGEN: subscribe a domain + N mailboxes (google/microsoft/azure) as a recurring MONTHLY subscription billed in USD to your Oxygen Email Infrastructure subscription, list/get your subscriptions, and cancel. Subscribe/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
+        .description("Whitelabel sending inboxes bought through OXYGEN: subscribe a domain + N mailboxes (google/microsoft/azure) as a recurring MONTHLY subscription billed in USD to your Oxygen Email Infrastructure subscription, list/get your subscriptions, verify that Oxygen/Stripe/the vendor agree, and cancel. Subscribe/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
+        .addCommand(new Command("verify")
+        .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("managed-inboxes verify", options, () => requestOxygen("/api/cli/managed-inboxes/verify"));
+    }))
         .addCommand(new Command("subscribe")
         .description("Subscribe a domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. Fails closed until the vendor key + founder-signed per-platform pricing are configured.")
-        .requiredOption("--domain <domain>", "Sending domain to register + host the mailboxes (e.g. send.acme.com).")
+        .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com). May also be passed as --domain.")
+        .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
         .option("--vendor <vendor>", "Pin the vendor: inboxkit or cmr. Omit to let OXYGEN choose. A named vendor with no credential FAILS rather than falling back to another.")
         .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\"}].")
@@ -7801,9 +9171,12 @@ export function createProgram() {
         .option("--approved", "Place the order (requires --quote). Without it, a priced preview is returned.")
         .option("--quote <id>", "The quote_id from a fresh preview. Required with --approved.")
         .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
+        .action(async (domainArg, options) => {
         await handleAsyncAction("managed-inboxes subscribe", options, () => {
-            const domain = readOption(options.domain);
+            // The domain may arrive either way. `subscribe` took --domain while get/warmup/
+            // cancel took a positional, so the same value had two spellings depending on the
+            // verb — `get --domain x` simply failed. Both work everywhere now.
+            const domain = readOption(domainArg) ?? readOption(options.domain);
             const provider = readOption(options.provider);
             if (!domain)
                 throw new Error("--domain is required.");
@@ -7862,20 +9235,26 @@ export function createProgram() {
     }))
         .addCommand(new Command("get")
         .description("Get one managed inbox subscription by domain (vendor, platform, mailbox count, monthly USD price, vendor order id, lifecycle status, auto-renew, period end, internal billing status). Read-only, 0 Oxygen credits.")
-        .argument("<domain>", "The managed inbox domain (e.g. send.acme.com).")
+        .argument("[domain]", "The managed inbox domain (e.g. send.acme.com). May also be passed as --domain.")
+        .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--json", "Print a JSON envelope.")
-        .action(async (domain, options) => {
-        await handleAsyncAction("managed-inboxes get", options, () => requestOxygen(`/api/cli/managed-inboxes/${encodeURIComponent(domain)}`));
+        .action(async (domainArg, options) => {
+        await handleAsyncAction("managed-inboxes get", options, () => {
+            const domain = requireDomainArg(domainArg, options.domain);
+            return requestOxygen(`/api/cli/managed-inboxes/${encodeURIComponent(domain)}`);
+        });
     }))
         .addCommand(new Command("warmup")
         .description("Turn the warmup pool on or off for a managed domain's inboxes, after purchase. Warmup runs on the vendor's pool against mailboxes it provisioned, so it is only available on inboxes BOUGHT through Oxygen — an imported inbox you already owned must arrive already warmed. WITHOUT --approved this prints a priced preview; re-run with --approved to apply.")
-        .argument("<domain>", "The managed inbox domain (e.g. send.acme.com).")
+        .argument("[domain]", "The managed inbox domain (e.g. send.acme.com). May also be passed as --domain.")
+        .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--enable", "Turn warmup on (a recurring monthly per-mailbox add-on).")
         .option("--disable", "Turn warmup off and stop billing for it.")
         .option("--approved", "Apply the change (otherwise a priced preview is returned).")
         .option("--json", "Print a JSON envelope.")
-        .action(async (domain, options) => {
+        .action(async (domainArg, options) => {
         await handleAsyncAction("managed-inboxes warmup", options, () => {
+            const domain = requireDomainArg(domainArg, options.domain);
             if (options.enable === options.disable) {
                 throw new Error("Pass exactly one of --enable or --disable.");
             }
@@ -7891,17 +9270,21 @@ export function createProgram() {
     }))
         .addCommand(new Command("cancel")
         .description("Cancel a managed inbox subscription by domain (stops the recurring monthly charge and frees the domain at period end). WITHOUT --approved prints a preview; re-run with --approved to cancel. Cancelling is free.")
-        .argument("<domain>", "The managed inbox domain to cancel.")
+        .argument("[domain]", "The managed inbox domain to cancel. May also be passed as --domain.")
+        .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--approved", "Actually cancel (otherwise a preview is returned).")
         .option("--json", "Print a JSON envelope.")
-        .action(async (domain, options) => {
-        await handleAsyncAction("managed-inboxes cancel", options, () => requestOxygen("/api/cli/managed-inboxes/cancel", {
-            method: "POST",
-            body: {
-                domain,
-                ...(options.approved ? { approved: true } : {}),
-            },
-        }));
+        .action(async (domainArg, options) => {
+        await handleAsyncAction("managed-inboxes cancel", options, () => {
+            const domain = requireDomainArg(domainArg, options.domain);
+            return requestOxygen("/api/cli/managed-inboxes/cancel", {
+                method: "POST",
+                body: {
+                    domain,
+                    ...(options.approved ? { approved: true } : {}),
+                },
+            });
+        });
     })));
     program.addCommand(new Command("mailboxes")
         .description("Native email sending pool: register/refresh Google/Microsoft mailboxes a campaign rotates over, pause/disable inboxes, and delegate warmup to Instantly (BYOK — Instantly bills your account, 0 Oxygen credits).")
@@ -8186,27 +9569,6 @@ export function createProgram() {
                 deep_link: "https://oxygen-agent.com/billing",
             },
         }));
-    }))
-        .addCommand(new Command("orders")
-        .description("List the org's managed mailbox provisioning orders (newest first).")
-        .option("--status <status>", "Comma-separated status filter (e.g. provisioning,warming).")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (options) => {
-        await handleAsyncAction("mailboxes orders", options, () => {
-            const params = new URLSearchParams();
-            const status = readOption(options.status);
-            if (status)
-                params.set("status", status);
-            const suffix = params.toString();
-            return requestOxygen(`/api/cli/mailboxes/orders${suffix ? `?${suffix}` : ""}`);
-        });
-    }))
-        .addCommand(new Command("order-status")
-        .description("Show one managed mailbox order's status (provider, domains, status, quote, held credits, Zapmail refs).")
-        .argument("<order>", "Mailbox order id.")
-        .option("--json", "Print a JSON envelope.")
-        .action(async (order, options) => {
-        await handleAsyncAction("mailboxes order-status", options, () => requestOxygen(`/api/cli/mailboxes/orders/${encodeURIComponent(order)}`));
     })));
     program.addCommand(new Command("deliverability")
         .description("External email deliverability: fleet reputation health and DIRECTIONAL inbox-placement (spam) tests via EmailGuard or Zapmail. Placement tests are approval-gated paid runs (managed bills Oxygen credits; BYOK = 0 Oxygen credits — Zapmail BYOK bills your Zapmail wallet ~$2/test); fail closed with 409 when no health provider is connected.")
@@ -8572,7 +9934,11 @@ export function createProgram() {
         .description("List workflow automations.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("workflows list", options, () => requestOxygen("/api/cli/workflows"));
+        await handleAsyncAction("workflows list", options, async () => {
+            const data = await requestOxygen("/api/cli/workflows");
+            writeDisabledWorkflowNotices(data);
+            return data;
+        });
     }))
         .addCommand(new Command("get")
         .description("Get one workflow automation.")
@@ -8580,10 +9946,14 @@ export function createProgram() {
         .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (workflow, options) => {
-        await handleAsyncAction("workflows get", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/get", {
-            method: "POST",
-            body: { workflow },
-        }), options));
+        await handleAsyncAction("workflows get", options, async () => {
+            const data = await requestOxygen("/api/cli/workflows/get", {
+                method: "POST",
+                body: { workflow },
+            });
+            writeDisabledWorkflowNotices(data);
+            return prepareWorkflowCliOutput(data, options);
+        });
     }))
         .addCommand(new Command("duplicate")
         .description("Duplicate a workflow automation as a disabled copy by default.")
@@ -8780,31 +10150,39 @@ export function createProgram() {
         .addCommand(new Command("enable")
         .description("Enable a workflow automation and its current trigger. Prints the schedule's projected automation-action burn; refuses a cron cadence the plan's monthly allowance cannot sustain.")
         .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--reason <text>", "Why you are enabling it. Recorded on the workflow and shown to the workspace.")
         .option("--json", "Print a JSON envelope.")
         .action(async (workflow, options) => {
         await handleAsyncAction("workflows enable", options, async () => {
             const data = await requestOxygen("/api/cli/workflows/enable", {
                 method: "POST",
-                body: { workflow },
+                body: {
+                    workflow,
+                    ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+                },
             });
             writeAutomationProjection(data);
             return data;
         });
     }))
         .addCommand(new Command("disable")
-        .description("Disable a workflow automation and its current trigger.")
+        .description("Disable a workflow automation and its current trigger. Records who disabled it, from where, and why — the workspace sees it on the workflow.")
         .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--reason <text>", "Why you are disabling it. Recorded on the workflow and shown to the workspace.")
         .option("--json", "Print a JSON envelope.")
         .action(async (workflow, options) => {
         await handleAsyncAction("workflows disable", options, () => requestOxygen("/api/cli/workflows/disable", {
             method: "POST",
-            body: { workflow },
+            body: {
+                workflow,
+                ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+            },
         }));
     }))
         .addCommand(new Command("mcp")
         .description("Publish workflows as dynamic MCP tools (oxygen_workflow_<slug>) — the 'Clay Functions' pattern.")
         .addCommand(new Command("enable")
-        .description("Publish an active workflow as a callable MCP tool so any MCP client can run it.")
+        .description("Publish an active workflow as a callable MCP tool so any MCP client can run it. The published tool appears to MCP clients as oxygen_workflow_<slug>.")
         .argument("<workflow>", "Workflow id, slug, or name.")
         .option("--display-name <name>", "Display name for the published MCP tool.")
         .option("--description <text>", "Description for the published MCP tool.")
@@ -8820,15 +10198,22 @@ export function createProgram() {
                     ...(readOption(options.description) ? { description: readOption(options.description) } : {}),
                 },
             });
-            // MCP tool names are capped at 64 chars. Warn (non-fatal) when the
-            // resolved slug pushes oxygen_workflow_<slug> over the limit: the
-            // flag is set but the tool is skipped in tools/list until the slug
-            // is shortened. Uses the server-resolved slug, not the raw ref.
+            // Surface the resolved MCP tool name. Prefer the server's, fall
+            // back to the canonical builder on the server-resolved slug.
             const slug = data?.workflow?.slug;
-            if (typeof slug === "string") {
-                const toolName = `oxygen_workflow_${slug}`;
-                if (toolName.length > 64) {
-                    process.stderr.write(`warning: "${toolName}" is ${toolName.length} chars (limit 64) — the workflow is enabled for MCP but will not appear in tools/list until its slug is shortened.\n`);
+            const toolName = data?.tool_name
+                ?? (typeof slug === "string" ? workflowMcpToolName(slug) : null);
+            if (toolName) {
+                // MCP tool names are capped at MAX_MCP_TOOL_NAME_LENGTH. Over the
+                // limit the flag is set but the tool is SKIPPED in tools/list until
+                // the slug is shortened — always warn (stderr, JSON stays clean).
+                // Under it, confirm the callable name in human output only (the
+                // JSON envelope already carries tool_name for --json callers).
+                if (toolName.length > MAX_MCP_TOOL_NAME_LENGTH) {
+                    process.stderr.write(`warning: "${toolName}" is ${toolName.length} chars (limit ${MAX_MCP_TOOL_NAME_LENGTH}) — the workflow is enabled for MCP but will not appear in tools/list until its slug is shortened.\n`);
+                }
+                else if (!options.json) {
+                    process.stderr.write(`Published as MCP tool ${toolName} — call it from any MCP client.\n`);
                 }
             }
             return data;
@@ -9337,11 +10722,25 @@ function waitForWorkflowRun(runId, options) {
             const runUrl = readRecordString(latestEnvelope, "runUrl");
             const webUrl = readRecordString(latestEnvelope, "web_url");
             const deepLink = readRecordString(latestEnvelope, "deepLink");
+            // `waiting` stops the poll but the run is NOT over — it resumes on its own
+            // at ready_at. Say so, and say when, or the caller reads `terminal: true`
+            // and concludes the run died.
+            const parked = status === "waiting";
+            const resumeAt = parked ? readRecordString(run, "readyAt") ?? readRecordString(run, "ready_at") : null;
             return {
                 run,
                 workflowRunId: readRecordString(run, "id") ?? runId,
                 status,
-                terminal: true,
+                terminal: !parked,
+                ...(parked
+                    ? {
+                        parked: true,
+                        ...(resumeAt ? { resumes_at: resumeAt } : {}),
+                        message: resumeAt
+                            ? `Run is parked until ${resumeAt} (a provider quota or a retry backoff). It resumes automatically — no action needed.`
+                            : "Run is parked and resumes automatically — no action needed.",
+                    }
+                    : {}),
                 polls,
                 elapsedMs,
                 ...(workflowUrl ? { workflowUrl } : {}),
@@ -9442,10 +10841,18 @@ function normalizeWorkflowRunErrors(value) {
     return output;
 }
 function isTerminalWorkflowRunStatus(status) {
+    // Terminal here means "stop polling", not "the run is over".
+    //
     // 'awaiting_approval' pauses the run indefinitely for a human decision (lease
     // cleared, excluded from claim + lease sweep), so it must stop the tail and
     // surface the approval rather than poll forever.
-    return status === "completed" || status === "failed" || status === "canceled" || status === "awaiting_approval";
+    //
+    // 'waiting' is the same shape with a clock instead of a human: the run is
+    // parked until `ready_at` — typically a provider's own quota reset, which can
+    // be ~20 hours out. Polling that is pointless; the tail stops and reports the
+    // resume time (see readWorkflowRunPauseReason).
+    return status === "completed" || status === "failed" || status === "canceled"
+        || status === "awaiting_approval" || status === "waiting";
 }
 function tableWebhookListPath(options) {
     const params = new URLSearchParams();
@@ -9590,6 +10997,447 @@ function applyAiColumnConfig(definition, options) {
     }
     return definition;
 }
+// Parse a `--bind-map identity=column,identity2=column2` value into an
+// inputMapping of column refs. Server-side normalizeBindColumnDefinition also
+// accepts a bare column-key string, but we emit the explicit ref shape so the
+// wire payload is self-describing. Full JSON control stays available via
+// --definition-json.
+function parseBindMapOption(value) {
+    const mapping = {};
+    for (const entry of readCsvOption(value)) {
+        const separator = entry.indexOf("=");
+        if (separator <= 0 || separator === entry.length - 1) {
+            throw new OxygenError("invalid_bind_map", "--bind-map entries must be identity=column pairs, e.g. domain=website,linkedin_url=li.", { details: { entry }, exitCode: 1 });
+        }
+        const identity = entry.slice(0, separator).trim();
+        const columnKey = entry.slice(separator + 1).trim();
+        mapping[identity] = { type: "column", columnKey };
+    }
+    return mapping;
+}
+// `columns add` bind sugar: assemble the { version, object, inputMapping,
+// onNoMatch } definition from --bind-object / --bind-map / --bind-create. The API
+// column normalizer does all validation (identity slugs, ref shapes); the CLI only
+// marshals. --definition-json remains the escape hatch for createValues /
+// minConfidence / runCondition.
+function applyBindColumnConfig(definition, options) {
+    definition.version = 1;
+    const object = readOption(options.bindObject);
+    if (object)
+        definition.object = object;
+    const mapping = parseBindMapOption(options.bindMap);
+    if (Object.keys(mapping).length > 0) {
+        const existing = isRecord(definition.inputMapping) ? definition.inputMapping : {};
+        definition.inputMapping = { ...existing, ...mapping };
+    }
+    if (options.bindCreate)
+        definition.onNoMatch = "create";
+    return definition;
+}
+const LOOKUP_NORMALIZE_ALIASES = {
+    exact: "exact",
+    "lower-trim": "lower_trim",
+    lower_trim: "lower_trim",
+    email: "email_v1",
+    domain: "domain_v1",
+    linkedin: "linkedin_url_v1",
+};
+const LOOKUP_MODE_ALIASES = {
+    "first-match": "first_match",
+    first_match: "first_match",
+    count: "count",
+    exists: "exists",
+    aggregate: "aggregate",
+};
+// Parse `--lookup-match localColumn=sourceColumn` into its two halves (LHS is the
+// working-row column, RHS the source table's join column).
+function parseLookupMatchOption(value) {
+    const trimmed = readOption(value);
+    if (!trimmed)
+        return null;
+    const separator = trimmed.indexOf("=");
+    if (separator <= 0 || separator === trimmed.length - 1) {
+        throw new OxygenError("invalid_lookup_match", "--lookup-match must be localColumn=sourceColumn, e.g. company_domain=domain.", { details: { value: trimmed }, exitCode: 1 });
+    }
+    return { localColumn: trimmed.slice(0, separator).trim(), sourceColumn: trimmed.slice(separator + 1).trim() };
+}
+function parseLookupNormalizeOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    const mapped = LOOKUP_NORMALIZE_ALIASES[raw.trim().toLowerCase()];
+    if (!mapped) {
+        throw new OxygenError("invalid_lookup_normalize", "--lookup-normalize must be exact, lower-trim, email, domain, or linkedin.", { details: { value: raw }, exitCode: 1 });
+    }
+    return mapped;
+}
+function parseLookupModeOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    const mapped = LOOKUP_MODE_ALIASES[raw.trim().toLowerCase()];
+    if (!mapped) {
+        throw new OxygenError("invalid_lookup_mode", "--lookup-mode must be first-match, count, exists, or aggregate.", { details: { value: raw }, exitCode: 1 });
+    }
+    return mapped;
+}
+function parseLookupOrderOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    const separator = raw.indexOf(":");
+    const column = (separator === -1 ? raw : raw.slice(0, separator)).trim();
+    const directionRaw = (separator === -1 ? "asc" : raw.slice(separator + 1)).trim().toLowerCase();
+    if (!column || (directionRaw !== "asc" && directionRaw !== "desc")) {
+        throw new OxygenError("invalid_lookup_order", "--lookup-order must be column or column:asc|desc, e.g. created_at:desc.", { details: { value: raw }, exitCode: 1 });
+    }
+    return { column, direction: directionRaw };
+}
+function parseLookupAggregateOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    const separator = raw.indexOf(":");
+    if (separator <= 0 || separator === raw.length - 1) {
+        throw new OxygenError("invalid_lookup_aggregate", "--lookup-aggregate must be fn:column, e.g. sum:amount.", { details: { value: raw }, exitCode: 1 });
+    }
+    const fn = raw.slice(0, separator).trim().toLowerCase();
+    const column = raw.slice(separator + 1).trim();
+    if (fn !== "sum" && fn !== "avg" && fn !== "min" && fn !== "max") {
+        throw new OxygenError("invalid_lookup_aggregate", "--lookup-aggregate fn must be sum, avg, min, or max.", { details: { value: raw }, exitCode: 1 });
+    }
+    return { fn, column };
+}
+// `columns add` lookup sugar: assemble the { version, sourceTable, match,
+// inputMapping, mode, returnColumns, orderBy, aggregate } definition from the
+// --lookup-* flags. The API column normalizer does all validation (mode-specific
+// requirements, self-lookup, ref shapes); the CLI only marshals. --definition-json
+// remains the escape hatch for runCondition and literal match_value refs.
+function applyLookupColumnConfig(definition, options) {
+    definition.version = 1;
+    const sourceTable = readOption(options.lookupTable);
+    if (sourceTable)
+        definition.sourceTable = sourceTable;
+    const match = parseLookupMatchOption(options.lookupMatch);
+    const normalization = parseLookupNormalizeOption(options.lookupNormalize);
+    if (match || normalization) {
+        const existingMatch = isRecord(definition.match) ? definition.match : {};
+        definition.match = {
+            ...existingMatch,
+            ...(match ? { sourceColumn: match.sourceColumn } : {}),
+            ...(normalization ? { normalization } : {}),
+        };
+    }
+    if (match) {
+        definition.inputMapping = { match_value: { type: "column", columnKey: match.localColumn } };
+    }
+    const mode = parseLookupModeOption(options.lookupMode);
+    if (mode)
+        definition.mode = mode;
+    const returnColumns = readCsvOption(options.lookupReturn);
+    if (returnColumns.length > 0)
+        definition.returnColumns = returnColumns;
+    const orderBy = parseLookupOrderOption(options.lookupOrder);
+    if (orderBy)
+        definition.orderBy = orderBy;
+    const aggregate = parseLookupAggregateOption(options.lookupAggregate);
+    if (aggregate)
+        definition.aggregate = aggregate;
+    return definition;
+}
+// Parse a `tables promote --map` value into the wire mappings [{column, attribute}].
+// Accepts the CSV pair form `column=attribute,column2=attribute2` (LHS is the working
+// column, RHS the CRM attribute — the reverse of --bind-map's identity=column), a
+// JSON array of {column, attribute}, or a JSON object { column: attribute }.
+function parsePromoteMapOption(value) {
+    const trimmed = readOption(value);
+    if (!trimmed) {
+        throw new OxygenError("invalid_promote_map", "--map is required: column=attribute pairs or a JSON array/object.", { exitCode: 1 });
+    }
+    if (trimmed.startsWith("[") || trimmed.startsWith("{")) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            throw new OxygenError("invalid_promote_map", "--map JSON is not valid JSON.", { details: { value: trimmed }, exitCode: 1 });
+        }
+        const entries = Array.isArray(parsed)
+            ? parsed.map((entry) => {
+                const record = isRecord(entry) ? entry : {};
+                return {
+                    column: typeof record.column === "string" ? record.column.trim() : "",
+                    attribute: typeof record.attribute === "string" ? record.attribute.trim() : "",
+                };
+            })
+            : isRecord(parsed)
+                ? Object.entries(parsed).map(([column, attribute]) => ({ column: column.trim(), attribute: String(attribute).trim() }))
+                : [];
+        const mappings = entries.filter((mapping) => mapping.column && mapping.attribute);
+        if (mappings.length === 0) {
+            throw new OxygenError("invalid_promote_map", "--map must contain at least one column-to-attribute mapping.", { exitCode: 1 });
+        }
+        return mappings;
+    }
+    const mappings = [];
+    for (const entry of readCsvOption(value)) {
+        const separator = entry.indexOf("=");
+        if (separator <= 0 || separator === entry.length - 1) {
+            throw new OxygenError("invalid_promote_map", "--map entries must be column=attribute pairs, e.g. job_title=job_title,seniority=seniority.", { details: { entry }, exitCode: 1 });
+        }
+        mappings.push({ column: entry.slice(0, separator).trim(), attribute: entry.slice(separator + 1).trim() });
+    }
+    if (mappings.length === 0) {
+        throw new OxygenError("invalid_promote_map", "--map must contain at least one column-to-attribute mapping.", { exitCode: 1 });
+    }
+    return mappings;
+}
+// Map the hyphenated CLI policy flag to the wire enum.
+function normalizePromotePolicy(value) {
+    const normalized = (readOption(value) ?? "fill-empty-only").replace(/-/g, "_");
+    if (normalized === "fill_empty_only" || normalized === "overwrite" || normalized === "skip_conflicts") {
+        return normalized;
+    }
+    throw new OxygenError("invalid_promote_policy", "--policy must be fill-empty-only, overwrite, or skip-conflicts.", {
+        details: { policy: value },
+        exitCode: 1,
+    });
+}
+// Assemble the `tables send` request: --map pairs (headline sugar) become
+// column-copy mapping entries; --mapping JSON is the literal/path escape hatch;
+// --automap asks the server to resolve the mapping (echoed back). Exactly one
+// mapping source must be chosen, locally, so the error names CLI flags instead
+// of API fields.
+function buildTablesSendRequest(source, target, options) {
+    const mapping = parseTablesSendMapping(options);
+    if (mapping && options.automap) {
+        throw new OxygenError("invalid_send", "Pass either a mapping (--map/--mapping) or --automap, not both.", { exitCode: 1 });
+    }
+    if (!mapping && !options.automap) {
+        throw new OxygenError("invalid_send", "Pass --map target=source pairs, --mapping <json>, or --automap.", { exitCode: 1 });
+    }
+    const mode = normalizeTablesSendMode(options.mode);
+    const upsertKey = readOption(options.upsertKey);
+    if (mode === "upsert" && !upsertKey) {
+        throw new OxygenError("invalid_send", "--mode upsert requires --upsert-key <target column>.", { exitCode: 1 });
+    }
+    if (mode === "insert" && upsertKey) {
+        throw new OxygenError("invalid_send", "--upsert-key is only valid with --mode upsert.", { exitCode: 1 });
+    }
+    const flattenColumn = readOption(options.flatten);
+    const flattenPath = readOption(options.flattenPath);
+    if (flattenPath && !flattenColumn) {
+        throw new OxygenError("invalid_send", "--flatten-path requires --flatten <column>.", { exitCode: 1 });
+    }
+    const filters = parseTablesSendFilters(options.filter);
+    const pageSize = readPositiveInt(options.pageSize);
+    return {
+        source,
+        target,
+        ...(mapping ? { mapping } : {}),
+        ...(options.automap ? { automap: true } : {}),
+        ...(flattenColumn ? { flatten: { column: flattenColumn, ...(flattenPath ? { path: flattenPath } : {}) } } : {}),
+        ...(filters ? { filters } : {}),
+        mode,
+        ...(upsertKey ? { upsert_key: upsertKey } : {}),
+        ...(pageSize ? { page_size: pageSize } : {}),
+        ...(options.dryRun ? { dry_run: true } : {}),
+    };
+}
+function parseTablesSendMapping(options) {
+    const pairs = (options.map ?? []).flatMap((entry) => readCsvOption(entry));
+    const mappingJson = readOption(options.mapping);
+    if (pairs.length > 0 && mappingJson) {
+        throw new OxygenError("invalid_send", "Pass either --map pairs or --mapping <json>, not both.", { exitCode: 1 });
+    }
+    if (mappingJson) {
+        let parsed;
+        try {
+            parsed = JSON.parse(mappingJson);
+        }
+        catch {
+            throw new OxygenError("invalid_send", "--mapping is not valid JSON.", { details: { mapping: mappingJson }, exitCode: 1 });
+        }
+        if (!Array.isArray(parsed) || parsed.length === 0 || !parsed.every(isRecord)) {
+            throw new OxygenError("invalid_send", "--mapping must be a non-empty JSON array of { target, source, path? } entries.", { exitCode: 1 });
+        }
+        return parsed;
+    }
+    if (pairs.length === 0)
+        return null;
+    return pairs.map((entry) => {
+        const separator = entry.indexOf("=");
+        if (separator <= 0 || separator === entry.length - 1) {
+            throw new OxygenError("invalid_send", "--map entries must be target=source column pairs, e.g. company=company_name,website=domain.", { details: { entry }, exitCode: 1 });
+        }
+        return {
+            target: entry.slice(0, separator).trim(),
+            source: { type: "column", key: entry.slice(separator + 1).trim() },
+        };
+    });
+}
+function parseTablesSendFilters(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new OxygenError("invalid_send", "--filter is not valid JSON.", { details: { filter: raw }, exitCode: 1 });
+    }
+    const entries = Array.isArray(parsed) ? parsed : [parsed];
+    if (entries.length === 0 || !entries.every(isRecord)) {
+        throw new OxygenError("invalid_send", "--filter must be a JSON array of { column, op, value? } objects.", { exitCode: 1 });
+    }
+    return entries;
+}
+function normalizeTablesSendMode(value) {
+    const normalized = (readOption(value) ?? "insert").toLowerCase();
+    if (normalized === "insert" || normalized === "upsert")
+        return normalized;
+    throw new OxygenError("invalid_send", "--mode must be insert or upsert.", {
+        details: { mode: value },
+        exitCode: 1,
+    });
+}
+// After a live send starts, point the terminal at the durable run's inspection
+// surfaces (stderr, so the machine-read stdout envelope stays clean).
+function writeTablesSendHint(data) {
+    if (!isRecord(data) || typeof data.ingestion_run_id !== "string")
+        return;
+    const runUrl = typeof data.run_web_url === "string" ? ` (or open ${data.run_web_url})` : "";
+    process.stderr.write(`hint: watch the copy with oxygen table-ingestions wait ${data.ingestion_run_id}${runUrl}\n`);
+}
+// Route `tables dedupe` to the preview / apply / cross-check API by flag: --against
+// switches to the read-only cross-table check (rejecting --apply); --apply targets
+// the destructive delete (approved only when --approved is set); otherwise preview.
+function buildDedupeRequest(table, options) {
+    const onColumns = readCsvOption(options.on);
+    if (onColumns.length === 0) {
+        throw new OxygenError("invalid_dedupe", "--on requires at least one column.", { exitCode: 1 });
+    }
+    const normalizer = normalizeDedupeNormalizer(options.normalize);
+    const scanLimit = readPositiveInt(options.scanLimit);
+    const against = readOption(options.against);
+    if (against) {
+        if (options.apply) {
+            throw new OxygenError("invalid_dedupe", "--apply cannot be combined with --against; the cross-table check is read-only.", { exitCode: 1 });
+        }
+        const againstColumn = readOption(options.againstColumn);
+        if (!againstColumn) {
+            throw new OxygenError("invalid_dedupe", "--against-column is required with --against.", { exitCode: 1 });
+        }
+        if (onColumns.length > 1) {
+            throw new OxygenError("invalid_dedupe", "The cross-table check matches on a single --on column.", { exitCode: 1 });
+        }
+        return {
+            endpoint: "/api/cli/tables/dedupe/cross-check",
+            body: {
+                table,
+                column: onColumns[0],
+                against_table: against,
+                against_column: againstColumn,
+                normalizer,
+                ...(scanLimit ? { scan_limit: scanLimit } : {}),
+            },
+        };
+    }
+    const keys = onColumns.map((column) => ({ column, normalizer }));
+    const keep = normalizeDedupeKeep(options.keep);
+    if (options.apply) {
+        const mergeValues = normalizeDedupeMergeValues(options.mergeValues);
+        return {
+            endpoint: "/api/cli/tables/dedupe/apply",
+            body: {
+                table,
+                keys,
+                keep,
+                ...(mergeValues ? { merge_values: mergeValues } : {}),
+                ...(scanLimit ? { scan_limit: scanLimit } : {}),
+                // --approved is the only path that deletes; without it the API 409s with the preview.
+                ...(options.approved ? { approved: true } : {}),
+            },
+        };
+    }
+    return {
+        endpoint: "/api/cli/tables/dedupe/preview",
+        body: { table, keys, keep, ...(scanLimit ? { scan_limit: scanLimit } : {}) },
+    };
+}
+// Build the standing auto-dedupe `set` body: --on columns paired positionally
+// with --normalize modes (unpaired columns default to exact). fuzzy-label maps
+// through so the API rejects it with the on-demand pointer — one source of
+// truth for the hot-path restriction.
+function buildTablesAutoDedupeSetBody(table, options) {
+    const onColumns = readCsvOption(options.on);
+    if (onColumns.length === 0) {
+        throw new OxygenError("invalid_auto_dedupe", "--on requires at least one column.", { exitCode: 1 });
+    }
+    const normalizers = readCsvOption(options.normalize);
+    const keys = onColumns.map((column, index) => ({
+        column,
+        normalizer: normalizeDedupeNormalizer(normalizers[index]),
+    }));
+    const keep = normalizeDedupeKeep(options.keep);
+    const mergeValues = normalizeDedupeMergeValues(options.mergeValues);
+    return {
+        table,
+        keys,
+        keep,
+        ...(mergeValues ? { merge_values: mergeValues } : {}),
+    };
+}
+// Map the CLI --normalize flag to the wire normalizer vocabulary.
+function normalizeDedupeNormalizer(value) {
+    const normalized = (readOption(value) ?? "exact").toLowerCase();
+    switch (normalized) {
+        case "exact":
+            return "exact";
+        case "email":
+            return "email";
+        case "domain":
+            return "domain";
+        case "linkedin":
+        case "linkedin-url":
+        case "linkedin_url":
+            return "linkedin_url";
+        case "fuzzy":
+        case "fuzzy-label":
+        case "fuzzy_label":
+            return "fuzzy_label";
+        default:
+            throw new OxygenError("invalid_dedupe_normalize", "--normalize must be exact, email, domain, linkedin, or fuzzy-label.", {
+                details: { normalize: value },
+                exitCode: 1,
+            });
+    }
+}
+function normalizeDedupeKeep(value) {
+    const normalized = (readOption(value) ?? "oldest").replace(/-/g, "_");
+    if (normalized === "oldest" || normalized === "newest" || normalized === "most_complete") {
+        return normalized;
+    }
+    throw new OxygenError("invalid_dedupe_keep", "--keep must be oldest, newest, or most-complete.", {
+        details: { keep: value },
+        exitCode: 1,
+    });
+}
+function normalizeDedupeMergeValues(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return null;
+    const normalized = raw.replace(/-/g, "_");
+    if (normalized === "fill_empty")
+        return "fill_empty";
+    if (normalized === "none")
+        return null;
+    throw new OxygenError("invalid_dedupe_merge", "--merge-values must be fill-empty.", {
+        details: { merge_values: value },
+        exitCode: 1,
+    });
+}
 function tableRunsListPath(options) {
     const table = readOption(options.table);
     if (!table) {
@@ -12077,24 +13925,20 @@ async function buildPostLoginHint(activeProfile) {
 }
 async function promptForToken(options) {
     const fallbackLoginUrl = createCliLoginUrl(options.apiUrl);
+    const settingsUrl = cliSettingsUrl(options.apiUrl);
     if (options.json) {
-        throw new OxygenError("missing_token", "Pass a CLI API token with --token when using --json.", {
+        throw new OxygenError("missing_token", `Pass a CLI API token with --token when using --json. Create one at ${settingsUrl}.`, {
             details: { login_url: fallbackLoginUrl },
             exitCode: 1,
         });
     }
     if (!process.stdin.isTTY) {
-        throw new OxygenError("missing_token", "Pass a CLI API token with --token, or run `oxygen login` in an interactive terminal.", {
+        throw new OxygenError("missing_token", `Pass a CLI API token with --token, or run \`oxygen login\` in an interactive terminal. Create a token at ${settingsUrl}.`, {
             details: { login_url: fallbackLoginUrl },
             exitCode: 1,
         });
     }
-    const browserSession = options.browser
-        ? await createBrowserLoginSession(options.apiUrl).catch((error) => {
-            output.write(`Browser login unavailable: ${readErrorMessage(error)}\n`);
-            return null;
-        })
-        : null;
+    const browserSession = options.browser ? await createLoginSession(options.apiUrl) : null;
     if (browserSession) {
         const opened = openBrowser(browserSession.verificationUrl);
         if (opened) {
@@ -12104,7 +13948,19 @@ async function promptForToken(options) {
             output.write("Open this URL in your browser:\n");
             output.write(`${browserSession.verificationUrl}\n`);
         }
-        const spinner = startOxygenSpinner("Waiting for browser authorization");
+        if ("confirmationCode" in browserSession) {
+            output.write(`Confirmation code: ${browserSession.confirmationCode}\n`);
+            output.write("Approve the login in your browser — it must show this exact code.\n");
+        }
+        let spinner = startOxygenSpinner("Waiting for browser authorization");
+        // One-shot fallback hint: after 15s of silence, tell the user how to finish
+        // manually (blocked browsers and remote terminals used to look like a hang).
+        const hintTimer = setTimeout(() => {
+            spinner.stop();
+            output.write(`Still waiting? To finish manually: open ${settingsUrl}, create a session, and paste the \`oxygen login --token <token>\` command it shows.\n`);
+            spinner = startOxygenSpinner("Waiting for browser authorization");
+        }, BROWSER_LOGIN_FALLBACK_HINT_MS);
+        hintTimer.unref?.();
         try {
             const token = (await waitForBrowserToken(browserSession)).trim();
             if (token) {
@@ -12114,15 +13970,38 @@ async function promptForToken(options) {
         }
         catch (error) {
             spinner.fail(`Browser login unavailable: ${readErrorMessage(error)}`);
-            output.write("Paste a CLI API token instead.\n");
+            output.write(`Paste a CLI API token instead (create one at ${settingsUrl}).\n`);
         }
         finally {
+            clearTimeout(hintTimer);
             spinner.stop();
             await browserSession.close();
         }
     }
     return promptForManualToken();
 }
+/**
+ * Relay login first (server-side approve + claim — works in every browser and
+ * for remote/SSH terminals); legacy loopback only when the relay request cannot
+ * even be created (older server without the endpoint, network policy). Any
+ * create failure falls back — an old server answers with an HTML 404 that
+ * surfaces as invalid_response, not not_found.
+ */
+async function createLoginSession(apiUrl) {
+    try {
+        return await createRelayLoginSession(apiUrl);
+    }
+    catch {
+        // Fall through to the legacy loopback handoff.
+    }
+    try {
+        return await createBrowserLoginSession(apiUrl);
+    }
+    catch (error) {
+        output.write(`Browser login unavailable: ${readErrorMessage(error)}\n`);
+        return null;
+    }
+}
 async function promptForManualToken() {
     const restoreEcho = muteTokenEcho();
     const rl = createInterface({ input, output });
@@ -12164,6 +14043,9 @@ function createCliLoginUrl(apiUrl) {
     url.searchParams.set("source", "oxygen_cli");
     return url.toString();
 }
+function cliSettingsUrl(apiUrl) {
+    return new URL("/settings/cli", apiUrl).toString();
+}
 function startOxygenSpinner(message) {
     if (!output.isTTY) {
         output.write(`${message}...\n`);
@@ -12424,11 +14306,56 @@ function formatProfileUseSuccess(profile, options) {
     }
     return lines.join("\n");
 }
-// `sequences signal` records an external GTM signal onto a running sequence's
-// enrollment(s). The signal *name* is validated server-side against the typed
-// enum; the CLI only enforces that a signal was supplied and that at least one
-// enrollment target (--enrollment / --lead) is present, so an unscoped call
-// fails before spending a request.
+// `sequences duplicate` is deliberately CLIENT-SIDE composition (get + create):
+// it adds a real workflow convenience (Instantly/Lemlist/HeyReach all have
+// campaign duplication) without growing the API/MCP surface — an MCP agent
+// composes the same two calls, and the tools/list payload is at its size
+// budget. The Instantly email BINDING is never copied: two campaigns must not
+// share one provider campaign id; the create-side validation tells the user
+// exactly that if the copied steps require a binding.
+async function handleSequenceDuplicateAction(sequence, options) {
+    try {
+        const name = readOption(options.name);
+        if (!name)
+            throw new Error("--name is required.");
+        const source = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, { method: "GET" });
+        const src = source.sequence;
+        if (!src || src.definition === undefined) {
+            throw new Error(`Sequence '${sequence}' was found but returned no definition to copy.`);
+        }
+        const slug = readOption(options.slug) ?? `${src.slug ?? sequence}-copy`;
+        const copySenders = options.senders !== false;
+        const created = await requestOxygen("/api/cli/sequences", {
+            method: "POST",
+            body: {
+                slug,
+                name,
+                definition: src.definition,
+                ...(src.channels ? { channels: src.channels } : {}),
+                ...(src.sourceTableId ? { sourceTableId: src.sourceTableId } : {}),
+                ...(src.linkedinUrlColumnKey ? { linkedinUrlColumnKey: src.linkedinUrlColumnKey } : {}),
+                ...(src.settings ? { settings: src.settings } : {}),
+                ...(src.maxCredits != null ? { maxCredits: src.maxCredits } : {}),
+                ...(src.maxLiveSends != null ? { maxLiveSends: src.maxLiveSends } : {}),
+                ...(copySenders && src.senderAccountIds && src.senderAccountIds.length > 0
+                    ? { senderRefs: src.senderAccountIds }
+                    : {}),
+            },
+        });
+        if (options.json) {
+            writeJson(success("sequences duplicate", created));
+            return;
+        }
+        const link = created.deepLink ?? created.web_url;
+        const note = src.emailProvider
+            ? " Note: the source's email binding was NOT copied — re-bind with `sequences update` if needed."
+            : "";
+        process.stdout.write(`Duplicated '${sequence}' as draft '${created.sequence?.slug ?? slug}'.${note}${link ? ` ${link}` : ""}\n`);
+    }
+    catch (error) {
+        emitCliFailure("sequences duplicate", error);
+    }
+}
 async function handleSequenceSignalAction(sequence, options) {
     try {
         const signal = readOption(options.signal);
@@ -12460,6 +14387,74 @@ async function handleSequenceSignalAction(sequence, options) {
         emitCliFailure("sequences signal", error);
     }
 }
+// `sequences events` reads the per-sequence activity feed (Instantly "Sending
+// Activities" parity). Read-only: it forwards the filters as query params and
+// renders one line per event, with a keyset `next:` hint when a further page
+// exists.
+async function handleSequenceEventsAction(sequence, options) {
+    try {
+        const params = new URLSearchParams();
+        const enrollment = readOption(options.enrollment);
+        if (enrollment)
+            params.set("enrollment", enrollment);
+        const kinds = readCsvOption(options.kind);
+        if (kinds.length > 0)
+            params.set("kinds", kinds.join(","));
+        if (options.includeBots)
+            params.set("include_bots", "true");
+        const limit = readOption(options.limit);
+        if (limit)
+            params.set("limit", limit);
+        const before = readOption(options.before);
+        if (before)
+            params.set("before", before);
+        const suffix = params.toString();
+        const data = await requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/events${suffix ? `?${suffix}` : ""}`);
+        if (options.json) {
+            writeJson(success("sequences events", data));
+            return;
+        }
+        process.stdout.write(formatSequenceEvents(data));
+    }
+    catch (error) {
+        emitCliFailure("sequences events", error);
+    }
+}
+const SEQUENCE_EVENT_KIND_WIDTH = 12;
+// Render occurred_at as a compact minute-precision UTC stamp for the terminal
+// (the full-precision ISO stays in the JSON envelope and the --before cursor).
+function formatEventTime(iso) {
+    if (!iso)
+        return "—";
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime()))
+        return iso;
+    return `${date.toISOString().slice(0, 16)}Z`;
+}
+function formatSequenceEvents(data) {
+    const events = Array.isArray(data.events) ? data.events : [];
+    if (events.length === 0)
+        return "No events yet.\n";
+    const lines = events.map((event) => {
+        const time = formatEventTime(event.occurredAt);
+        const kind = (event.kind ?? "—").padEnd(SEQUENCE_EVENT_KIND_WIDTH);
+        const segments = [];
+        if (event.stepIndex != null) {
+            segments.push(`step ${event.stepIndex}${event.variantId ? ` (${event.variantId})` : ""}`);
+        }
+        if (event.actionKind)
+            segments.push(event.actionKind);
+        if (event.url)
+            segments.push(event.url);
+        if (event.detail)
+            segments.push(`— ${event.detail}`);
+        const tail = segments.join("  ");
+        return [time, kind, tail].filter((part) => part.trim().length > 0).join("  ").replace(/\s+$/, "");
+    });
+    if (data.next_before)
+        lines.push(`next: --before ${data.next_before}`);
+    return `${lines.join("\n")}\n`;
+}
 async function handleSequenceVariantsAction(sequence, options) {
     try {
         const path = `/api/cli/sequences/${encodeURIComponent(sequence)}/variants`;
@@ -12938,6 +14933,17 @@ function withSupportListQuery(path, options) {
     const query = params.toString();
     return query ? `${path}?${query}` : path;
 }
+function withSupportEventsQuery(path, options) {
+    const params = new URLSearchParams();
+    const after = readOption(options.after);
+    const limit = readOption(options.limit);
+    if (after)
+        params.set("after", after);
+    if (limit)
+        params.set("limit", limit);
+    const query = params.toString();
+    return query ? `${path}?${query}` : path;
+}
 // Workflow text flags (--verify-notes/--plan/--draft) bypass readOption: an
 // explicitly-passed empty string clears the field server-side, while an absent
 // flag leaves it untouched, so "" must survive to the request body.
@@ -14045,6 +16051,12 @@ function readSequenceSettings(options) {
     if (options.stopOnBounce === false) {
         settings.stop_on_bounce = false;
     }
+    // exclude_contacted: sequence-level cross-campaign exclusion default. Tri-state
+    // (--exclude-contacted / --no-exclude-contacted); undefined leaves it unset so a
+    // settings PATCH stays clean and enroll keeps today's per-call-only behavior.
+    if (options.excludeContacted !== undefined) {
+        settings.exclude_contacted = options.excludeContacted;
+    }
     const maxEmailsPerDay = readPositiveInt(options.maxEmailsPerDay);
     if (maxEmailsPerDay !== undefined)
         settings.max_emails_per_day = maxEmailsPerDay;
@@ -14073,6 +16085,22 @@ function readSequenceSettings(options) {
         if (emailMinGap !== undefined)
             settings.email_min_gap_minutes = emailMinGap;
     }
+    // opportunity_value is a non-negative dollar amount (may be fractional and may be
+    // 0), so it is parsed as a plain finite number rather than a positive integer;
+    // the server enforces the >= 0 rule (validateSequenceSettings) and reports a clear
+    // error for a negative value, so send any finite number through.
+    const opportunityValueRaw = readOption(options.opportunityValue);
+    if (opportunityValueRaw !== null) {
+        const opportunityValue = Number(opportunityValueRaw);
+        if (Number.isFinite(opportunityValue))
+            settings.opportunity_value = opportunityValue;
+    }
+    // Per-sequence sending-account allowlist (--mailboxes id1,id2). Split + trim +
+    // drop empties client-side (light); the server validates each is a UUID and caps
+    // the count. An all-empty list omits the key so a stray "--mailboxes ," is a no-op.
+    const mailboxIds = readCsvOption(options.mailboxes);
+    if (mailboxIds.length > 0)
+        settings.mailbox_ids = mailboxIds;
     return Object.keys(settings).length > 0 ? settings : undefined;
 }
 function muteTokenEcho() {