@oxygen-agent/cli 1.336.4 → 1.346.5

package/dist/index.js

@@ -264,6 +264,79 @@ function writeAutomationProjection(data) {
         process.stderr.write(`  allowance runs out ${exhaustion} at this pace — the schedule pauses until the window resets\n`);
     }
 }
+// `workflows apply` and `workflows enable` can return a non-blocking `warnings`
+// array (e.g. an aggressive cron cadence that still fits the plan's allowance).
+// Mirror each to stderr as one `warning: <message>` line — matching
+// writeAutomationProjection's stderr styling and keeping --json stdout clean.
+function writeScheduleWarnings(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const warnings = data.warnings;
+    if (!Array.isArray(warnings))
+        return;
+    for (const warning of warnings) {
+        if (typeof warning === "string" && warning.length > 0) {
+            process.stderr.write(`warning: ${warning}\n`);
+        }
+    }
+}
+// Shared human-output tail for the state-changing `workflows` commands (delete /
+// rename and the bulk enable/disable/delete summaries): print the response's
+// `next` action hints, then its deep link. Doctrine requires every state-changing
+// response to surface an oxygen-agent.com link in the terminal.
+function writeWorkflowActionTail(record) {
+    const next = Array.isArray(record.next) ? record.next : [];
+    for (const hint of next) {
+        if (typeof hint === "string" && hint.length > 0)
+            process.stdout.write(`${hint}\n`);
+    }
+    const link = typeof record.deepLink === "string"
+        ? record.deepLink
+        : typeof record.web_url === "string" ? record.web_url : null;
+    if (link)
+        process.stdout.write(`${link}\n`);
+}
+// Bulk `workflows enable | disable | delete` return a per-item results[] plus
+// summary counts. In human (non --json) output there is no JSON dump, so render
+// one readable line per item and a summary-count line to stdout. `okVerb` is the
+// past-tense success verb (enabled / disabled / archived / purged).
+function writeBulkWorkflowResults(data, okVerb) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return;
+    const record = data;
+    const results = Array.isArray(record.results) ? record.results : [];
+    for (const entry of results) {
+        if (!isRecord(entry))
+            continue;
+        const ref = typeof entry.ref === "string" ? entry.ref : "workflow";
+        const workflow = isRecord(entry.workflow) ? entry.workflow : null;
+        const slug = workflow && typeof workflow.slug === "string" ? workflow.slug : ref;
+        if (typeof entry.skipped_reason === "string") {
+            process.stdout.write(`skipped ${slug}: ${entry.skipped_reason}\n`);
+        }
+        else if (entry.ok === true) {
+            process.stdout.write(`${okVerb} ${slug}\n`);
+        }
+        else {
+            const error = isRecord(entry.error) ? entry.error : null;
+            const message = error && typeof error.message === "string"
+                ? error.message
+                : error && typeof error.code === "string"
+                    ? error.code
+                    : "failed";
+            process.stdout.write(`failed ${slug}: ${message}\n`);
+        }
+    }
+    const counts = [];
+    for (const key of ["archived", "purged", "enabled", "disabled", "skipped", "failed"]) {
+        const value = record[key];
+        if (typeof value === "number")
+            counts.push(`${value} ${key}`);
+    }
+    if (counts.length > 0)
+        process.stdout.write(`${counts.join(", ")}\n`);
+    writeWorkflowActionTail(record);
+}
 // Paid live runs are refused server-side with typed spend-gate errors
 // (max_credits_required, approval_required, spend_cap_required,
 // spend_cap_too_low). Surface each as a one-line stderr hint with the concrete
@@ -759,6 +832,30 @@ function buildPublishingPostsListPath(options) {
     const suffix = query.toString();
     return suffix ? `/api/cli/publishing/posts?${suffix}` : "/api/cli/publishing/posts";
 }
+function buildPublishingMentionsResolveBody(options) {
+    const text = readPublishingPostText(options, false);
+    const identifiers = (options.identifier ?? [])
+        .map((value) => readOption(value))
+        .filter((value) => Boolean(value));
+    const kind = readOption(options.kind);
+    if (kind && kind !== "person" && kind !== "company") {
+        throw new OxygenError("invalid_request", "--kind must be person or company.", { exitCode: 1 });
+    }
+    if (!text && identifiers.length === 0) {
+        throw new OxygenError("invalid_request", "Pass --text/--text-file or at least one --identifier.", { exitCode: 1 });
+    }
+    return {
+        account: options.account,
+        ...(text ? { text } : {}),
+        ...(identifiers.length > 0 ? {
+            identifiers: identifiers.map((value) => ({
+                value,
+                ...(kind ? { kind } : {}),
+                ...(options.asMention ? { as_mention: true } : {}),
+            })),
+        } : {}),
+    };
+}
 function buildPublishingPostCreateBody(options) {
     const status = resolvePublishingCreateStatus(options);
     const body = {
@@ -1963,11 +2060,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("support admin events", options, () => requestOxygen(withSupportEventsQuery("/api/cli/admin/support/events", options)));
     }))
         .addCommand(new Command("get")
-        .description("Show one support ticket with its message thread (staff only).")
+        .description("Show one support ticket with a consistent message-thread snapshot (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
+        .option("--if-version <version>", "Require the exact decimal version returned by support admin events; stale versions return a conflict without exposing the thread.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
-        await handleAsyncAction("support admin get", options, () => requestOxygen(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`));
+        await handleAsyncAction("support admin get", options, () => requestOxygen(withSupportAdminGetQuery(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`, options)));
     }))
         .addCommand(new Command("reply")
         .description("Add a staff message to a support ticket without resolving it.")
@@ -2245,6 +2343,23 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program
         .command("publishing")
         .description("Deterministic social post scheduling commands.")
+        .addCommand(new Command("mentions")
+        .description("Resolve LinkedIn identities for a publish-faithful post preview.")
+        .addCommand(new Command("resolve")
+        .description("Resolve @handles, LinkedIn profile/company links, provider ids, and URNs through a connected sender (notify=false).")
+        .requiredOption("--account <account>", "LinkedIn sender id, connection id, or Unipile account id.")
+        .option("--text <text>", "Post text containing @identifiers or LinkedIn URLs.")
+        .option("--text-file <path>", "Read post text from a local file.")
+        .option("--identifier <value...>", "Explicit provider id, public identifier, LinkedIn URL, or URN (repeat values after the flag).")
+        .option("--kind <kind>", "Type for explicit identifiers: person or company.")
+        .option("--as-mention", "Preview explicit identifiers as mentions instead of plain identity references.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("publishing mentions resolve", options, () => requestOxygen("/api/cli/publishing/mentions/resolve", {
+            method: "POST",
+            body: buildPublishingMentionsResolveBody(options),
+        }));
+    })))
         .addCommand(new Command("posts")
         .description("Manage scheduled Publishing posts.")
         .addCommand(new Command("list")
@@ -2267,9 +2382,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--sender <sender_account_id>", "LinkedIn sender account id. Required for LinkedIn before the worker can publish.")
         .option("--provider-connection <connection_id>", "Oxygen integration connection id for Composio-backed providers.")
         .option("--title <title>", "Internal title for the queue.")
-        .option("--text <text>", "Post text.")
+        .option("--text <text>", "Post text. For LinkedIn mentions, use @<public-identifier> directly.")
         .option("--text-file <path>", "Read post text from a local file.")
-        .option("--content-json <json>", "Optional structured provider content. For Composio providers, pass provider_arguments or composio.arguments.")
+        .option("--content-json <json>", "Structured content. Attach Oxygen media with media_asset_ids; attachments is for provider-ready objects. Composio accepts provider_arguments or composio.arguments.")
         .option("--composio-action <slug>", "Override the Composio action slug for this scheduled post.")
         .option("--timezone <tz>", "Display timezone for the scheduled date. Defaults to UTC.")
         .option("--status <status>", "draft or scheduled. Defaults to scheduled.")
@@ -2283,7 +2398,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("get")
-        .description("Get one scheduled post with attempt history.")
+        .description("Get one scheduled post with resolved media previews and attempt history.")
         .argument("<post_id>", "Scheduled post id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (postId, options) => {
@@ -2297,9 +2412,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--sender <sender_account_id>", "LinkedIn sender account id.")
         .option("--provider-connection <connection_id>", "Oxygen integration connection id for Composio-backed providers.")
         .option("--title <title>", "Internal title for the queue.")
-        .option("--text <text>", "Post text.")
+        .option("--text <text>", "Post text. For LinkedIn mentions, use @<public-identifier> directly.")
         .option("--text-file <path>", "Read post text from a local file.")
-        .option("--content-json <json>", "Optional structured provider content. For Composio providers, pass provider_arguments or composio.arguments.")
+        .option("--content-json <json>", "Structured content. Attach Oxygen media with media_asset_ids; attachments is for provider-ready objects. This replaces the existing content object.")
         .option("--composio-action <slug>", "Override the Composio action slug for this scheduled post.")
         .option("--publish-at <iso>", "ISO date-time when the post should publish.")
         .option("--timezone <tz>", "Display timezone for the scheduled date.")
@@ -2505,11 +2620,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("media")
         .description("Manage Publishing media uploads.")
         .addCommand(new Command("upload-url")
-        .description("Create a Publishing media asset and presigned object-storage upload URL.")
+        .description("Create a Publishing media asset and presigned upload URL with required upload headers.")
         .requiredOption("--file-name <name>", "Original media filename.")
-        .requiredOption("--content-type <type>", "Media MIME type, such as image/png or video/mp4.")
+        .requiredOption("--content-type <type>", "Media MIME type, such as image/png or video/mp4; use the returned upload_headers for PUT.")
         .requiredOption("--byte-length <bytes>", "Exact media byte length.")
-        .option("--scheduled-post <post_id>", "Optional scheduled post id to associate with the media.")
+        .option("--scheduled-post <post_id>", "Optional provenance association; also set the post content.media_asset_ids to attach it.")
         .option("--metadata-json <json>", "Optional metadata object to store with the media asset.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -3582,6 +3697,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             method: "POST",
             body: { table, name: options.name },
         }));
+    }))
+        .addCommand(new Command("tag")
+        .description("Replace a table's workspace tags (Tags primitive; \"\" clears). Tags link the table to sequences, wiki pages, and workflows carrying the same tag — browse with `oxygen tags get <tag>`.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--tags <csv>", "Comma-separated tags; \"\" clears them.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables tag", options, () => requestOxygen("/api/cli/tables/tags", {
+            method: "POST",
+            body: { table, tags: readCsvOption(options.tags) },
+        }));
     }))
         .addCommand(new Command("archive")
         .description("Archive a workspace table without dropping physical data.")
@@ -4526,6 +4652,22 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (options) => {
         await handleAsyncAction("knowledge purge", options, () => runKnowledgeMirrorPurge());
     }));
+    program
+        .command("tags")
+        .description("Workspace tags: one label vocabulary across knowledge pages, sequences, tables, workflows, and recipes — tag a campaign's sequence, its learnings wiki page, and its lead table alike, then browse everything that shares the label. Tags normalize to lowercase (trimmed, deduped, max 50 per item; any characters). WRITING TAGS happens on each primitive, always whole-set replace (\"\" clears): `sequences update <seq> --tags q3,launch` · `tables tag <table> --tags q3` · `workflows tag <wf> --tags q3` · `knowledge page upsert --slug <s> --tags q3 ...`. Then `tags get q3` returns everything carrying the label, deep-linked.")
+        .addCommand(new Command("list")
+        .description("List every workspace tag with per-primitive counts, most-used first.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tags list", options, () => requestOxygen("/api/cli/tags"));
+    }))
+        .addCommand(new Command("get")
+        .description("Everything carrying one tag — knowledge pages, sequences, tables, workflows, recipes — each with its deep-link.")
+        .argument("<tag>", "The tag (case-insensitive).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (tag, options) => {
+        await handleAsyncAction("tags get", options, () => requestOxygen(`/api/cli/tags/${encodeURIComponent(tag)}`));
+    }));
     program
         .command("blueprints")
         .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For guided GTM plays see `oxygen recipes`.")
@@ -6159,23 +6301,39 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("egress ips", options, () => requestOxygen("/api/cli/egress?view=ips"));
     }))
         .addCommand(new Command("dedicated")
-        .description("Dedicated-egress-IP add-on ($400/mo): request a preview quote or check the add-on status. PREVIEW ONLY — never charges; checkout is human via Stripe.")
+        .description("Dedicated sending-IP add-on (400,000 credits/mo): preview the quote, order with `request --approved`, cancel with `cancel --approve`, or check the add-on status.")
         .addCommand(new Command("request")
-        .description("Preview the dedicated-egress-IP add-on ($400/mo). PREVIEW ONLY — never charges; checkout is human via Stripe.")
+        .description("Preview the dedicated sending-IP add-on (400,000 credits/mo, $400 face value; the org's mailboxes share the one dedicated IP). With --approved, ORDER it: the IP is provisioned automatically and the first month's credits are debited immediately, then monthly. Without --approved nothing is ordered or charged. While the platform vendor account is not provisioned yet, ordering fails closed and the preview says so.")
+        // --approved (not --approve): the credit-spending approval flag,
+        // which is also what derives spends_credits in the self-index.
+        .option("--approved", "Execute the order (a real recurring credit charge). Omit for a no-side-effect preview.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("egress dedicated request", options, () => requestOxygen("/api/cli/egress/dedicated", { method: "POST", body: {} }));
+        await handleAsyncAction("egress dedicated request", options, () => requestOxygen("/api/cli/egress/dedicated", {
+            method: "POST",
+            body: { ...(options.approved ? { approve: true } : {}) },
+        }));
+    }))
+        .addCommand(new Command("cancel")
+        .description("Cancel the dedicated sending-IP add-on. Approval-gated: without --approve it previews. Canceling is immediate — the IP retires, mailboxes re-home to the shared pool, monthly credit billing stops; the current month is not refunded.")
+        .option("--approve", "Execute the cancellation. Omit for a no-side-effect preview.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("egress dedicated cancel", options, () => requestOxygen("/api/cli/egress/dedicated", {
+            method: "POST",
+            body: { cancel: true, ...(options.approve ? { approve: true } : {}) },
+        }));
     }))
         .addCommand(new Command("status")
-        .description("Show this org's dedicated-egress-IP add-on state (status, quantity, activation, price). Read-only, 0 credits.")
+        .description("Show this org's dedicated sending-IP add-on state (status, quantity, activation, price). Read-only, 0 credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("egress dedicated status", options, () => requestOxygen("/api/cli/egress/dedicated"));
     })))
         .addCommand(new Command("rotate")
-        .description("Rotate a mailbox's egress IP. Approval-gated: without --approve it previews and makes no change.")
+        .description("Rotate a mailbox's sending IP. Approval-gated: without --approve it previews and makes no change.")
         .requiredOption("--mailbox <id>", "Mailbox id to rotate.")
-        .option("--vendor <vendor>", "Egress vendor (pingproxies|decodo). Defaults to the current IP's vendor.")
+        .option("--vendor <vendor>", "Staff-only vendor override. Defaults to the current IP's vendor.")
         .option("--approve", "Execute the rotation (paid vendor action). Omit for a no-side-effect preview.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -6189,11 +6347,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("register")
-        .description("STAFF: register a manually-purchased egress IP (e.g. IPRoyal ISP-dedicated) into this environment's inventory. Secrets never pass here — --credential-ref names the Doppler family EGRESS_CRED_<REF>_USERNAME/_PASSWORD, set separately in Doppler. Register, then `egress assign`, then enable EGRESS_POOL_ENABLED (pool mode fails closed for unassigned mailboxes).")
+        .description("STAFF: register a manually-purchased sending IP into this environment's inventory. Secrets never pass here — --credential-ref names the Doppler family EGRESS_CRED_<REF>_USERNAME/_PASSWORD, set separately in Doppler. Register, then `egress assign`, then enable EGRESS_POOL_ENABLED (pool mode fails closed for unassigned mailboxes).")
         .requiredOption("--host <host>", "Proxy hostname or IP — bare, no scheme/port/credentials.")
         .requiredOption("--port <port>", "Proxy port (1-65535).")
-        .requiredOption("--credential-ref <ref>", "Doppler credential-family name (A-Z, 0-9, _), e.g. IPROYAL.")
-        .option("--vendor <vendor>", "Vendor slug for inventory provenance.", "iproyal")
+        .requiredOption("--credential-ref <ref>", "Doppler credential-family name (A-Z, 0-9, _).")
+        .requiredOption("--vendor <vendor>", "Vendor slug for inventory provenance.")
         .option("--protocol <protocol>", "Proxy protocol: http (default), https, or socks5.")
         .option("--tier <tier>", "shared (default) or dedicated (requires --dedicated-org).")
         .option("--dedicated-org <orgId>", "Organization id a dedicated-tier IP is reserved for.")
@@ -6730,7 +6888,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("custom-integrations")
         .description("Custom HTTP integration commands.")
         .addCommand(new Command("apply")
-        .description("Create or update a custom HTTP integration manifest. Attach credentials with `custom-integrations connect`.")
+        .description(`Create or update a custom HTTP integration manifest. Attach credentials with \`custom-integrations connect\`. Manifest schema + worked examples: ${CUSTOM_HTTP_MANIFEST_DOCS_URL}`)
         .option("--manifest <path>", "Path to a custom HTTP manifest JSON file.")
         .option("--manifest-json <json>", "Custom HTTP manifest as a JSON object.")
         .option("--json", "Print a JSON envelope.")
@@ -8516,8 +8674,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("sequences")
         .description("Multichannel outreach sequences: one enrollment per lead spans LinkedIn + email over a journey. LinkedIn steps dispatch natively (rate-limited, credit-capped); email steps send natively or place/move/stop the lead in a bound Instantly campaign (BYOK). Cross-channel reply-stop is intrinsic. A LinkedIn-only sequence behaves exactly like the original sequencer.")
         .addCommand(new Command("list")
-        .description("List sequences with status, channels, and credit usage.")
+        .description("List sequences with status, channels, tags, and credit usage. --stats joins each row's LIFETIME funnel (enrolled, sent, replies, reply rate, email opens/clicks, opportunities) — the same shape `sequences stats` returns for one sequence.")
         .option("--status <status>", "Filter by status: draft, active, paused, or archived.")
+        .option("--tag <tag>", "Only sequences carrying this workspace tag (see `oxygen tags list`).")
+        .option("--stats", "Attach lifetime stats per sequence (a stats pass per row — slower on large workspaces).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences list", options, () => {
@@ -8525,6 +8685,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const status = readOption(options.status);
             if (status)
                 params.set("status", status);
+            const tag = readOption(options.tag);
+            if (tag)
+                params.set("tag", tag);
+            if (options.stats)
+                params.set("include", "stats");
             const suffix = params.toString();
             return requestOxygen(`/api/cli/sequences${suffix ? `?${suffix}` : ""}`);
         });
@@ -8585,6 +8750,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--no-stop-on-bounce", "Keep a lead's enrollment running after a hard bounce (default: stop it). The bounce is still recorded as an email_bounced signal either way.")
         .option("--exclude-contacted", "Default every enroll into this sequence to cross-campaign exclusion — skip leads any OTHER active sequence is already contacting. A per-enroll `sequences enroll --exclude-contacted` / `--no-exclude-contacted` always overrides this default. Off by default.")
         .option("--no-exclude-contacted", "Turn the sequence-level exclude-contacted default back OFF (enrollments then exclude cross-campaign only when a call opts in).")
+        .option("--tags <csv>", "Comma-separated workspace tags (Tags primitive) — the labels that link this campaign to wiki pages, tables, and workflows carrying the same tag.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("sequences create", options, () => {
@@ -8594,6 +8760,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const definition = readJsonFileValue(resolve(stepsPath), "--steps-file");
             const channels = readCsvOption(options.channels);
             const senders = readCsvOption(options.senders);
+            const tags = readCsvOption(options.tags);
             const email = readCampaignEmailBinding(options);
             const maxCredits = readPositiveNumber(options.maxCredits);
             const maxLiveSends = readPositiveInt(options.maxLiveSends);
@@ -8606,6 +8773,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     definition,
                     ...(channels.length > 0 ? { channels } : {}),
                     ...(senders.length > 0 ? { senders } : {}),
+                    ...(tags.length > 0 ? { tags } : {}),
                     ...(readOption(options.table) ? { source_table_id: readOption(options.table) } : {}),
                     ...(readOption(options.urlColumn) ? { linkedin_url_column_key: readOption(options.urlColumn) } : {}),
                     ...(email ? { email } : {}),
@@ -8676,6 +8844,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--no-tracking-opens", "Turn OFF the open pixel for this sequence's native email sends (a deliverability knob — a pixel is spam-filter surface).")
         .option("--tracking-clicks", "Turn click-link tracking ON for this sequence's native email sends (the default; same verified-tracking-domain gate as opens).")
         .option("--no-tracking-clicks", "Turn OFF click-link rewriting for this sequence's native email sends (links go out untouched).")
+        .option("--tags <csv>", "Replace the sequence's workspace tags (comma-separated; \"\" clears them). The ONE field an ARCHIVED sequence still accepts — tag finished campaigns to link their learnings across the workspace.")
         .option("--json", "Print a JSON envelope.")
         .action(async (sequence, options) => {
         await handleAsyncAction("sequences update", options, () => {
@@ -8683,6 +8852,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const name = readOption(options.name);
             if (name)
                 body.name = name;
+            // Whole-set replace; `--tags ""` clears. Distinct from the
+            // omitted flag (undefined), which leaves tags untouched.
+            if (options.tags !== undefined)
+                body.tags = readCsvOption(options.tags);
             const stepsPath = readOption(options.stepsFile);
             if (stepsPath) {
                 body.definition = readJsonFileValue(resolve(stepsPath), "--steps-file");
@@ -8717,7 +8890,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     body.email = email;
             }
             if (Object.keys(body).length === 0) {
-                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
+                throw new Error("Provide at least one field to update (--name, --steps-file, --channels, --senders, --tags, --email-*, --clear-email, --max-credits, --max-live-sends, --max-emails-per-mailbox-per-day, --send-window-file, --no-stop-on-bounce, --[no-]exclude-contacted, or --[no-]tracking-opens / --[no-]tracking-clicks).");
             }
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}`, {
                 method: "PATCH",
@@ -8846,7 +9019,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("enrollments")
-        .description("List a sequence's per-lead enrollments and their state.")
+        .description("List per-lead enrollment state plus the latest action status, error, attempts, and retry time.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--status <status>", "Filter by enrollment status (active, waiting_connection, replied, completed, stopped, failed).")
         .option("--limit <n>", "Maximum enrollments to return (1-500).")
@@ -8863,6 +9036,21 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = params.toString();
             return requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/enrollments${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("reconcile")
+        .description("Safely reconcile one ambiguous LinkedIn invite/message from provider reads. Preview-only unless --approved; never resends.")
+        .argument("<sequence>", "Sequence id or slug. The sequence must be paused.")
+        .requiredOption("--action <id>", "Failed/canceled live action UUID to reconcile.")
+        .option("--approved", "Apply an exact provider match to local state. No provider write or resend occurs.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (sequence, options) => {
+        await handleAsyncAction("sequences reconcile", options, () => requestOxygen(`/api/cli/sequences/${encodeURIComponent(sequence)}/reconcile`, {
+            method: "POST",
+            body: {
+                action_id: readOption(options.action),
+                approved: options.approved === true,
+            },
+        }));
     }))
         .addCommand(new Command("stats")
         .description("Show the sequence funnel: enrolled, invites sent, connected, replied, with acceptance and reply rates.")
@@ -8929,7 +9117,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("suppressions")
-        .description("Do-not-contact + email blocklist. People/multichannel: lead provider ids the sequencer enroller skips at plan time (list | add | remove). Email blocklist (Instantly parity): bulk-import addresses + whole-domain blocks the native email dispatcher skips before sending (import | domains | remove-domain). Consumes 0 credits.")
+        .description("Do-not-contact + email blocklist. People/multichannel: lead provider ids the sequencer enroller skips at plan time (list | add | remove); list rows carry a resolved identity (name / picture / profile URL) when the workspace knows the person. Email blocklist (Instantly parity): addresses + whole-domain blocks the native email dispatcher skips before sending (addresses | domains | remove-address | remove-domain). `import` bulk-loads a mixed file: emails, bare domains, LinkedIn profile URLs, and LinkedIn member ids. Consumes 0 credits.")
         .addCommand(new Command("list")
         .description("List the org's do-not-contact suppressions, newest first. Filter by --reason or by --search (case-insensitive substring of the lead provider id).")
         .option("--reason <reason>", "Filter by reason: manual, replied, unsubscribed, bounced, do_not_contact, friends.")
@@ -8994,10 +9182,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Bulk-import an email blocklist from a file of emails and/or bare domains (newline / comma / whitespace separated, max 5000). An entry with '@' goes on the per-address list; a bare domain (e.g. acme.com) blocks the WHOLE domain. A domain block is a sharp tool, so --reason is REQUIRED when the file contains any domains; a pure-email import defaults to manual. Idempotent. Consumes 0 credits.")
-        .requiredOption("--file <path>", "Path to a file of emails and/or bare domains, separated by newlines, commas, or whitespace.")
-        .option("--reason <reason>", "Suppression reason. Emails: hard_bounce | complaint | unsubscribe | manual. Domains: manual | complaint | policy. Required when the file contains any domains.")
+        .description("Bulk-import a do-not-contact blocklist from a file (newline / comma / whitespace separated, max 5000). An entry with '@' goes on the per-address email list; a bare domain (e.g. acme.com) blocks the WHOLE domain; a LinkedIn profile URL or member id (ACo...) lands on the people do-not-contact list; any other URL is rejected. A domain block is a sharp tool, so --reason is REQUIRED when the file contains any domains; otherwise manual is the default. Idempotent. Consumes 0 credits.")
+        .requiredOption("--file <path>", "Path to a file of emails, bare domains, LinkedIn profile URLs, and/or LinkedIn member ids, separated by newlines, commas, or whitespace.")
+        .option("--reason <reason>", "Suppression reason. Emails: hard_bounce | complaint | unsubscribe | manual. Domains: manual | complaint | policy. LinkedIn contacts: manual | replied | unsubscribed | bounced | do_not_contact | friends. Required when the file contains any domains; must be valid for every entry type present (manual always is).")
         .option("--source <text>", "Optional provenance note stored on every imported row (e.g. instantly_export).")
+        .option("--detail <text>", "Optional free-text note stored on every imported row.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         try {
@@ -9012,15 +9201,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     .filter((entry) => entry.length > 0)),
             ];
             if (entries.length === 0)
-                throw new Error(`No emails or domains found in ${file}.`);
+                throw new Error(`No emails, domains, or LinkedIn ids found in ${file}.`);
             const reason = readOption(options.reason);
             const source = readOption(options.source);
+            const detail = readOption(options.detail);
             const data = await requestOxygen("/api/cli/suppressions/import", {
                 method: "POST",
                 body: {
                     entries,
                     ...(reason ? { reason } : {}),
                     ...(source ? { source } : {}),
+                    ...(detail ? { detail } : {}),
                 },
             });
             if (options.json) {
@@ -9034,6 +9225,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 writeJson({
                     imported_emails: parsed.imported_emails ?? 0,
                     imported_domains: parsed.imported_domains ?? 0,
+                    imported_contacts: parsed.imported_contacts ?? 0,
                     rejected_count: rejected.length,
                     rejected: rejected.slice(0, 10),
                     ...(rejected.length > 10
@@ -9073,6 +9265,32 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const suffix = params.toString();
             return requestOxygen(`/api/cli/suppressions/domains${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("addresses")
+        .description("List the org's blocked email ADDRESSES, newest first (bounces, unsubscribes, and `suppressions import` land here). Filter by --reason (hard_bounce | complaint | unsubscribe | manual) or --search (case-insensitive substring of the address). Rows carry a CRM person name when one matches.")
+        .option("--reason <reason>", "Filter by reason: hard_bounce, complaint, unsubscribe, manual.")
+        .option("--search <text>", "Case-insensitive substring match on the address.")
+        .option("--limit <n>", "Maximum addresses to return (1-500; default 100).")
+        .option("--offset <n>", "Pagination offset (0-based).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions addresses", options, () => {
+            const params = new URLSearchParams();
+            const reason = readOption(options.reason);
+            if (reason)
+                params.set("reason", reason);
+            const search = readOption(options.search);
+            if (search)
+                params.set("search", search);
+            const limit = readOption(options.limit);
+            if (limit)
+                params.set("limit", limit);
+            const offset = readOption(options.offset);
+            if (offset)
+                params.set("offset", offset);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/suppressions/addresses${suffix ? `?${suffix}` : ""}`);
+        });
     }))
         .addCommand(new Command("remove-domain")
         .description("Remove a whole-domain email block (re-enable sending to the domain).")
@@ -9616,10 +9834,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     program.addCommand(new Command("domains")
         .description("Cold-email domain management on the org's own Cloudflare account (BYOK): sync zones, inspect age/warmup/DNS health, check availability and pricing, and buy domains. Purchases bill your Cloudflare payment method, never Oxygen credits.")
         .addCommand(new Command("list")
-        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Reads the cache only — run `domains sync` to refresh.")
+        .description("List the org's cached Cloudflare domains with cold-email metadata (age, mailboxes, warmup, sending volume, DNS health). Each row's `dns` object explains the status (ok, issues, not checked, check failed, partial check, no zone) with a reason and fix path; `managed_domains` lists InboxKit-managed bundle domains (vendor-registered + vendor-DNS'd — manage via `managed-inboxes`). Reads the cache only — run `domains sync` to refresh.")
         .option("--status <status>", "Filter by zone status: unknown, initializing, pending, active, moved, or deleted.")
         .option("--registrar <registrar>", "Filter by registrar name.")
         .option("--q <text>", "Filter by domain substring.")
+        .option("--dns <state>", "Filter by the derived DNS state: ok, issues, not_checked, check_failed, check_incomplete, or no_zone.")
+        .option("--expiring", "Only non-deleted domains expiring within 60 days.")
+        .option("--has-mailboxes <bool>", "true → only domains with sending mailboxes; false → only domains without.")
+        .option("--include-archived", "Include archived domains (hidden by default).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("domains list", options, () => {
@@ -9633,9 +9855,39 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const queryText = readOption(options.q);
             if (queryText)
                 params.set("q", queryText);
+            const dns = readOption(options.dns);
+            if (dns)
+                params.set("dns", dns);
+            if (options.expiring)
+                params.set("expiring", "true");
+            const hasMailboxes = readOption(options.hasMailboxes);
+            if (hasMailboxes)
+                params.set("has_mailboxes", hasMailboxes);
+            if (options.includeArchived)
+                params.set("include_archived", "true");
             const suffix = params.toString();
             return requestOxygen(`/api/cli/domains${suffix ? `?${suffix}` : ""}`);
         });
+    }))
+        .addCommand(new Command("archive")
+        .description("Hide a domain from the default list — an Oxygen-side declutter flag only. Nothing changes at Cloudflare, DNS and mailbox governance are untouched, syncs never resurrect it, and `domains unarchive` fully reverses it.")
+        .argument("<domain>", "Domain name, such as acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains archive", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/archive`, {
+            method: "POST",
+            body: { archived: true },
+        }));
+    }))
+        .addCommand(new Command("unarchive")
+        .description("Restore an archived domain to the default list.")
+        .argument("<domain>", "Domain name, such as acme.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (domain, options) => {
+        await handleAsyncAction("domains unarchive", options, () => requestOxygen(`/api/cli/domains/${encodeURIComponent(domain)}/archive`, {
+            method: "POST",
+            body: { archived: false },
+        }));
     }))
         .addCommand(new Command("sync")
         .description("Refresh the domain cache from Cloudflare: zone pages, registrar metadata, RDAP age backfill, and DNS health. Partial (paginated) syncs auto-continue until complete.")
@@ -9924,18 +10176,21 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .action(async (options) => {
         await handleAsyncAction("workflows apply", options, async () => {
             const manifest = await compileWorkflowFile(options.file);
-            return prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/apply", {
+            const data = prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/apply", {
                 method: "POST",
                 body: { manifest },
             }), options);
+            writeScheduleWarnings(data);
+            return data;
         });
     }))
         .addCommand(new Command("list")
-        .description("List workflow automations.")
+        .description("List workflow automations. Archived workflows are hidden unless you pass --include-archived.")
+        .option("--include-archived", "Also list archived workflows, which are hidden by default.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows list", options, async () => {
-            const data = await requestOxygen("/api/cli/workflows");
+            const data = await requestOxygen(`/api/cli/workflows${options.includeArchived ? "?include_archived=true" : ""}`);
             writeDisabledWorkflowNotices(data);
             return data;
         });
@@ -9954,6 +10209,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             writeDisabledWorkflowNotices(data);
             return prepareWorkflowCliOutput(data, options);
         });
+    }))
+        .addCommand(new Command("tag")
+        .description("Replace a workflow's workspace tags (Tags primitive; \"\" clears). Tags link the workflow to sequences, tables, and wiki pages carrying the same tag — browse with `oxygen tags get <tag>`. Org metadata only: no new revision is cut.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .requiredOption("--tags <csv>", "Comma-separated tags; \"\" clears them.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows tag", options, () => requestOxygen("/api/cli/workflows/tags", {
+            method: "POST",
+            body: { workflow, tags: readCsvOption(options.tags) },
+        }));
     }))
         .addCommand(new Command("duplicate")
         .description("Duplicate a workflow automation as a disabled copy by default.")
@@ -10148,36 +10414,140 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("enable")
-        .description("Enable a workflow automation and its current trigger. Prints the schedule's projected automation-action burn; refuses a cron cadence the plan's monthly allowance cannot sustain.")
-        .argument("<workflow>", "Workflow id, slug, or name.")
+        .description("Enable one or more workflow automations and their current triggers. Prints the schedule's projected automation-action burn; refuses a cron cadence the plan's monthly allowance cannot sustain. Pass several workflows to enable them in one bulk call.")
+        .argument("<workflows...>", "One or more workflow ids, slugs, or names.")
         .option("--reason <text>", "Why you are enabling it. Recorded on the workflow and shown to the workspace.")
         .option("--json", "Print a JSON envelope.")
-        .action(async (workflow, options) => {
-        await handleAsyncAction("workflows enable", options, async () => {
+        .action(async (workflows, options) => {
+        if (workflows.length === 1) {
+            await handleAsyncAction("workflows enable", options, async () => {
+                const data = await requestOxygen("/api/cli/workflows/enable", {
+                    method: "POST",
+                    body: {
+                        workflow: workflows[0],
+                        ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+                    },
+                });
+                writeAutomationProjection(data);
+                writeScheduleWarnings(data);
+                return data;
+            });
+            return;
+        }
+        try {
             const data = await requestOxygen("/api/cli/workflows/enable", {
                 method: "POST",
                 body: {
-                    workflow,
+                    workflows,
                     ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
                 },
             });
-            writeAutomationProjection(data);
-            return data;
-        });
+            if (options.json) {
+                writeJson(success("workflows enable", data));
+            }
+            else {
+                writeBulkWorkflowResults(data, "enabled");
+            }
+            writeScheduleWarnings(data);
+        }
+        catch (error) {
+            emitCliFailure("workflows enable", error);
+        }
     }))
         .addCommand(new Command("disable")
-        .description("Disable a workflow automation and its current trigger. Records who disabled it, from where, and why — the workspace sees it on the workflow.")
-        .argument("<workflow>", "Workflow id, slug, or name.")
+        .description("Disable one or more workflow automations and their current triggers. Records who disabled it, from where, and why — the workspace sees it on the workflow. Pass several workflows to disable them in one bulk call.")
+        .argument("<workflows...>", "One or more workflow ids, slugs, or names.")
         .option("--reason <text>", "Why you are disabling it. Recorded on the workflow and shown to the workspace.")
         .option("--json", "Print a JSON envelope.")
-        .action(async (workflow, options) => {
-        await handleAsyncAction("workflows disable", options, () => requestOxygen("/api/cli/workflows/disable", {
-            method: "POST",
-            body: {
-                workflow,
-                ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
-            },
-        }));
+        .action(async (workflows, options) => {
+        if (workflows.length === 1) {
+            await handleAsyncAction("workflows disable", options, () => requestOxygen("/api/cli/workflows/disable", {
+                method: "POST",
+                body: {
+                    workflow: workflows[0],
+                    ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+                },
+            }));
+            return;
+        }
+        try {
+            const data = await requestOxygen("/api/cli/workflows/disable", {
+                method: "POST",
+                body: {
+                    workflows,
+                    ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+                },
+            });
+            if (options.json) {
+                writeJson(success("workflows disable", data));
+            }
+            else {
+                writeBulkWorkflowResults(data, "disabled");
+            }
+        }
+        catch (error) {
+            emitCliFailure("workflows disable", error);
+        }
+    }))
+        .addCommand(new Command("delete")
+        .description("Archive (or, with --purge, permanently delete) one or more workflow automations. Archiving hides the workflow from `workflows list`, disarms its trigger, and is reversible with `workflows enable`/`disable` — see archived workflows again with `workflows list --include-archived`. --purge cannot be undone.")
+        .argument("<workflows...>", "One or more workflow ids, slugs, or names.")
+        .option("--purge", "Permanently remove the workflow instead of archiving it. Run history pages for this workflow become unreachable; this cannot be undone.")
+        .option("--reason <text>", "Why you are deleting it. Recorded on the workflow and shown to the workspace.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflows, options) => {
+        try {
+            const single = workflows.length === 1;
+            const data = await requestOxygen("/api/cli/workflows/delete", {
+                method: "POST",
+                body: {
+                    ...(single ? { workflow: workflows[0] } : { workflows }),
+                    ...(options.purge ? { purge: true } : {}),
+                    ...(readOption(options.reason) ? { reason: readOption(options.reason) } : {}),
+                },
+            });
+            if (options.json) {
+                writeJson(success("workflows delete", data));
+                return;
+            }
+            if (single) {
+                const workflow = isRecord(data.workflow) ? data.workflow : null;
+                const slug = workflow && typeof workflow.slug === "string" ? workflow.slug : workflows[0];
+                process.stdout.write(`${data.purged === true ? "purged" : "archived"} ${slug}\n`);
+                writeWorkflowActionTail(data);
+            }
+            else {
+                writeBulkWorkflowResults(data, options.purge ? "purged" : "archived");
+            }
+        }
+        catch (error) {
+            emitCliFailure("workflows delete", error);
+        }
+    }))
+        .addCommand(new Command("rename")
+        .description("Rename a workflow automation's display name only — its id and slug are unchanged, and the next `workflows apply` from source overwrites the name.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .argument("<name>", "New display name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, name, options) => {
+        try {
+            const data = await requestOxygen("/api/cli/workflows/rename", {
+                method: "POST",
+                body: { workflow, name },
+            });
+            if (options.json) {
+                writeJson(success("workflows rename", data));
+                return;
+            }
+            const renamed = isRecord(data.workflow) ? data.workflow : null;
+            const slug = renamed && typeof renamed.slug === "string" ? renamed.slug : workflow;
+            const displayName = renamed && typeof renamed.name === "string" ? renamed.name : name;
+            process.stdout.write(`renamed ${slug} to "${displayName}"\n`);
+            writeWorkflowActionTail(data);
+        }
+        catch (error) {
+            emitCliFailure("workflows rename", error);
+        }
     }))
         .addCommand(new Command("mcp")
         .description("Publish workflows as dynamic MCP tools (oxygen_workflow_<slug>) — the 'Clay Functions' pattern.")
@@ -14327,18 +14697,22 @@ async function handleSequenceDuplicateAction(sequence, options) {
         const copySenders = options.senders !== false;
         const created = await requestOxygen("/api/cli/sequences", {
             method: "POST",
+            // The create route reads snake_case keys (source_table_id, max_credits,
+            // senders, …). This handler used to POST camelCase, so the copy silently
+            // dropped the sender pool, table binding, URL column, and caps.
             body: {
                 slug,
                 name,
                 definition: src.definition,
                 ...(src.channels ? { channels: src.channels } : {}),
-                ...(src.sourceTableId ? { sourceTableId: src.sourceTableId } : {}),
-                ...(src.linkedinUrlColumnKey ? { linkedinUrlColumnKey: src.linkedinUrlColumnKey } : {}),
+                ...(src.sourceTableId ? { source_table_id: src.sourceTableId } : {}),
+                ...(src.linkedinUrlColumnKey ? { linkedin_url_column_key: src.linkedinUrlColumnKey } : {}),
                 ...(src.settings ? { settings: src.settings } : {}),
-                ...(src.maxCredits != null ? { maxCredits: src.maxCredits } : {}),
-                ...(src.maxLiveSends != null ? { maxLiveSends: src.maxLiveSends } : {}),
+                ...(src.maxCredits != null ? { max_credits: src.maxCredits } : {}),
+                ...(src.maxLiveSends != null ? { max_live_sends: src.maxLiveSends } : {}),
+                ...(Array.isArray(src.tags) && src.tags.length > 0 ? { tags: src.tags } : {}),
                 ...(copySenders && src.senderAccountIds && src.senderAccountIds.length > 0
-                    ? { senderRefs: src.senderAccountIds }
+                    ? { senders: src.senderAccountIds }
                     : {}),
             },
         });
@@ -14944,6 +15318,13 @@ function withSupportEventsQuery(path, options) {
     const query = params.toString();
     return query ? `${path}?${query}` : path;
 }
+function withSupportAdminGetQuery(path, options) {
+    const ifVersion = readOption(options.ifVersion);
+    if (!ifVersion)
+        return path;
+    const params = new URLSearchParams({ if_version: ifVersion });
+    return `${path}?${params.toString()}`;
+}
 // Workflow text flags (--verify-notes/--plan/--draft) bypass readOption: an
 // explicitly-passed empty string clears the field server-side, while an absent
 // flag leaves it untouched, so "" must survive to the request body.