@oxygen-agent/cli 1.45.4

package/dist/index.js

@@ -0,0 +1,3523 @@
+#!/usr/bin/env node
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, extname, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { Command } from "commander";
+import { OXYGEN_VERSION, OxygenError, success, toFailure } from "@oxygen/shared";
+import { inferRowsFileFormat, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, } from "@oxygen/shared/file-import";
+import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
+import { isRecipeDefinition } from "@oxygen/recipe-sdk";
+import { createBrowserLoginSession, openBrowser } from "./browser-login.js";
+import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, saveCredentials, switchCredentialProfile, } from "./credentials.js";
+import { requestOxygen } from "./http-client.js";
+import { runLocalCustomHttpColumn } from "./local-custom-http-column.js";
+import { addSessionOutput, addSessionStatus, getSessionUsage, startSession, updateSessionStep, } from "./session.js";
+const BROWSER_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const OXYGEN_SPINNER_INTERVAL_MS = 90;
+const OXYGEN_SPINNER_FRAMES = [
+    "[Oxygen  ]",
+    "[ Oxygen ]",
+    "[  Oxygen]",
+    "[ nOxyge ]",
+    "[ enOxyg ]",
+    "[ genOxy ]",
+    "[ ygenOx ]",
+    "[ xygenO ]",
+];
+const OXYGEN_WORDMARK = [
+    "   ___  __  __ __   __  ___  _____ _   _",
+    "  / _ \\ \\ \\/ / \\ \\ / / / __|| ____| \\ | |",
+    " | | | | \\  /   \\ V / | |  _|  _| |  \\| |",
+    " | |_| | /  \\    | |  | |_| | |___| |\\  |",
+    "  \\___/ /_/\\_\\   |_|   \\____|_____|_| \\_|",
+].join("\n");
+const LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD = 500;
+const TABLE_ACTION_RUN_WAIT_DEFAULT_TIMEOUT_SECONDS = 600;
+const TABLE_ACTION_RUN_WAIT_DEFAULT_INTERVAL_SECONDS = 5;
+const TABLE_INGESTION_WAIT_DEFAULT_TIMEOUT_SECONDS = 600;
+const TABLE_INGESTION_WAIT_DEFAULT_INTERVAL_SECONDS = 5;
+const WORKFLOW_TAIL_DEFAULT_TIMEOUT_SECONDS = 600;
+const WORKFLOW_TAIL_DEFAULT_INTERVAL_SECONDS = 2;
+const DEFAULT_CLI_PACKAGE_SPEC = "@oxygen-agent/cli@latest";
+const CLI_MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+const RECIPE_ESBUILD_NODE_PATHS = [
+    resolve("node_modules"),
+    resolve("../../node_modules"),
+    resolve(CLI_MODULE_DIR, "../node_modules"),
+    resolve(CLI_MODULE_DIR, "../../../node_modules"),
+];
+function writeJson(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+function emitSuccess(command, data, options) {
+    if (options.json) {
+        writeJson(success(command, data));
+        return;
+    }
+    writeJson(data);
+}
+async function handleAsyncAction(command, options, action) {
+    try {
+        const data = await action();
+        emitSuccess(command, data, options);
+    }
+    catch (error) {
+        const failure = toFailure(command, error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function parseJsonObject(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        throw new OxygenError("invalid_json", "Input must be valid JSON.", {
+            details: { reason: error instanceof Error ? error.message : "unknown" },
+            exitCode: 1,
+        });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new OxygenError("invalid_json", "Input JSON must be an object.", {
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function parseJsonArray(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        throw new OxygenError("invalid_json", "Input must be valid JSON.", {
+            details: { reason: error instanceof Error ? error.message : "unknown" },
+            exitCode: 1,
+        });
+    }
+    if (!Array.isArray(parsed)) {
+        throw new OxygenError("invalid_json", "Input JSON must be an array.", {
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function readFileIfPresent(value) {
+    const candidate = resolve(value);
+    try {
+        return readFileSync(candidate, "utf8");
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : "";
+        if (code === "ENOENT" || code === "ENAMETOOLONG" || code === "ENOTDIR")
+            return value;
+        throw error;
+    }
+}
+function resolveComposioRunMode(options) {
+    if (options.live === true && options.dryRun === true) {
+        throw new OxygenError("conflicting_flags", "Pass either --live or --dry-run, not both.", { exitCode: 1 });
+    }
+    if (options.live === true)
+        return "live";
+    if (options.dryRun === true)
+        return "dry_run";
+    const raw = readOption(options.mode);
+    if (raw) {
+        const normalized = raw.trim().toLowerCase().replace("-", "_");
+        if (normalized === "live" || normalized === "dry_run")
+            return normalized;
+        throw new OxygenError("invalid_mode", "--mode must be 'live' or 'dry_run'.", { details: { mode: raw }, exitCode: 1 });
+    }
+    return "dry_run";
+}
+function readSpecFileBody(path) {
+    const text = readFileSync(resolve(path), "utf8");
+    try {
+        return { spec: parseJsonObject(text) };
+    }
+    catch (error) {
+        if (error instanceof OxygenError && error.code === "invalid_json") {
+            return { spec_prompt: text };
+        }
+        throw error;
+    }
+}
+export function createProgram() {
+    const program = new Command();
+    program
+        .name("oxygen")
+        .description("CLI/API-first GTM platform for GTM tool and workflow primitives.")
+        .version(OXYGEN_VERSION)
+        .option("--profile <name>", "Use a stored CLI profile for this command.");
+    program.hook("preAction", () => {
+        const options = program.opts();
+        if (options.profile)
+            process.env.OXYGEN_PROFILE = options.profile;
+    });
+    program
+        .command("login")
+        .description("Connect this terminal to Oxygen.")
+        .option("--token <token>", "CLI API token created in the Oxygen dashboard.")
+        .option("--api-url <url>", "Oxygen API URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--profile <name>", "Store credentials under a named CLI profile and make it active.")
+        .option("--no-browser", "Skip the browser handoff and paste the token manually.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleLoginAction(options);
+    });
+    program
+        .command("auth")
+        .description("Authentication helpers.")
+        .addCommand(new Command("use-token")
+        .description("Store a CLI API token non-interactively.")
+        .requiredOption("--token <token>", "CLI API token.")
+        .option("--api-url <url>", "Oxygen API URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--profile <name>", "Store credentials under a named CLI profile and make it active.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAuthUseTokenAction(options);
+    }));
+    program
+        .command("profiles")
+        .description("Manage stored CLI credential profiles.")
+        .addCommand(new Command("list")
+        .description("List stored CLI credential profiles.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleProfilesListAction(options);
+    }))
+        .addCommand(new Command("use")
+        .description("Switch the active CLI credential profile.")
+        .argument("<profile>", "Stored profile name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (profile, options) => {
+        await handleProfilesUseAction(profile, options);
+    }))
+        .addCommand(new Command("remove")
+        .description("Remove one stored CLI credential profile.")
+        .argument("<profile>", "Stored profile name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (profile, options) => {
+        await handleLogoutAction({ ...options, profile });
+    }));
+    program
+        .command("logout")
+        .description("Remove the active stored CLI API token.")
+        .option("--profile <name>", "Remove a named CLI profile instead of the active profile.")
+        .option("--all", "Remove all stored CLI profiles.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleLogoutAction(options);
+    });
+    program
+        .command("update")
+        .description("Update the Oxygen CLI from npm.")
+        .option("--package <npm_spec>", "Override the npm package spec.")
+        .option("--dry-run", "Print the update command without running it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleUpdateAction(options);
+    });
+    program
+        .command("whoami")
+        .description("Show the current Oxygen CLI identity.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("whoami", options, async () => requestOxygen("/api/cli/whoami"));
+    });
+    program
+        .command("status")
+        .description("Compare the local Oxygen CLI version against what's deployed in prod.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("status", options, async () => {
+            const server = await requestOxygen("/api/health", { requireAuth: false });
+            return {
+                client_version: OXYGEN_VERSION,
+                server_version: server.server_version,
+                sha: server.sha,
+                region: server.region,
+                in_sync: server.server_version === OXYGEN_VERSION,
+            };
+        });
+    });
+    program
+        .command("orgs")
+        .description("Organization selection commands.")
+        .addCommand(new Command("list")
+        .description("List organizations available to the current CLI identity.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("orgs list", options, async () => requestOxygen("/api/cli/orgs"));
+    }))
+        .addCommand(new Command("select")
+        .description("Select the active organization for an OAuth-backed CLI session.")
+        .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (organization, options) => {
+        await handleAsyncAction("orgs select", options, async () => requestOxygen("/api/cli/orgs/select", {
+            method: "POST",
+            body: { organization },
+        }));
+    }));
+    program
+        .command("db")
+        .description("Tenant database commands.")
+        .addCommand(new Command("status")
+        .description("Show the current organization's tenant database status.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db status", options, async () => requestOxygen("/api/cli/db/status"));
+    }))
+        .addCommand(new Command("provision")
+        .description("Provision a managed Neon tenant database for the current organization.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db provision", options, async () => requestOxygen("/api/cli/db/provision", { method: "POST", body: {} }));
+    }))
+        .addCommand(new Command("migrate")
+        .description("Apply pending tenant database migrations for the current organization.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db migrate", options, async () => requestOxygen("/api/cli/db/migrate", { method: "POST", body: {} }));
+    }))
+        .addCommand(new Command("migrate-all")
+        .description("Apply pending tenant database migrations across all ready tenants (staff only).")
+        .option("--limit <n>", "Maximum tenants to migrate in this batch. Defaults to 50; hard cap is 500.")
+        .option("--dry-run", "List pending tenants without applying migrations.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db migrate-all", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen("/api/cli/db/migrate-all", {
+                method: "POST",
+                body: {
+                    ...(limit !== undefined ? { limit } : {}),
+                    ...(options.dryRun ? { dry_run: true } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("cost-policy")
+        .description("Show tenant database cost controls and reconciliation status.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db cost-policy", options, async () => requestOxygen("/api/cli/db/cost-policy"));
+    }))
+        .addCommand(new Command("reconcile-cost-policy")
+        .description("Apply tenant database cost controls to the managed Neon endpoint.")
+        .option("--suspend-idle", "Request immediate Neon compute suspension when the tenant is idle.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db reconcile-cost-policy", options, async () => requestOxygen("/api/cli/db/reconcile-cost-policy", {
+            method: "POST",
+            body: {
+                ...(options.suspendIdle ? { suspend_idle: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("attach")
+        .description("Attach an existing Postgres database as the current organization's tenant database.")
+        .requiredOption("--database-url <url>", "Owner connection string for the tenant Postgres database.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db attach", options, async () => requestOxygen("/api/cli/db/attach", {
+            method: "POST",
+            body: { database_url: options.databaseUrl },
+        }));
+    }))
+        .addCommand(new Command("query")
+        .description("Run one read-only SQL statement against the current tenant database.")
+        .requiredOption("--sql <sql>", "Single SELECT, WITH, or EXPLAIN statement.")
+        .option("--max-rows <n>", "Maximum rows to return. Defaults to 100; hard cap is 1000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("db query", options, async () => {
+            const maxRows = readPositiveInt(options.maxRows);
+            return requestOxygen("/api/cli/db/query", {
+                method: "POST",
+                body: {
+                    sql: options.sql,
+                    ...(maxRows ? { max_rows: maxRows } : {}),
+                },
+            });
+        });
+    }));
+    program
+        .command("projects")
+        .description("Tenant project commands.")
+        .addCommand(new Command("list")
+        .description("List table projects in the current tenant database.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("projects list", options, async () => requestOxygen("/api/cli/projects"));
+    }))
+        .addCommand(new Command("create")
+        .description("Create a schema-backed table project.")
+        .argument("<name>", "Display name for the project.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (name, options) => {
+        await handleAsyncAction("projects create", options, async () => requestOxygen("/api/cli/projects", {
+            method: "POST",
+            body: { name },
+        }));
+    }));
+    const tablesCommand = program
+        .command("tables")
+        .description("Tenant workspace table commands.")
+        .addCommand(new Command("create")
+        .description("Create a real Postgres-backed workspace table.")
+        .argument("<name>", "Display name for the table.")
+        .requiredOption("--columns-json <json>", "JSON array of column definitions.")
+        .option("--project <project>", "Project id or slug. Defaults to General.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (name, options) => {
+        await handleAsyncAction("tables create", options, async () => requestOxygen("/api/cli/tables", {
+            method: "POST",
+            body: {
+                name,
+                columns: parseJsonArray(options.columnsJson),
+                ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("duplicate")
+        .description("Duplicate a workspace table. Copies row values unless --schema-only is set.")
+        .argument("<table>", "Source table id or slug.")
+        .option("--name <name>", "Display name for the duplicated table. Defaults to '<source> Copy'.")
+        .option("--schema-only", "Duplicate columns and definitions without copying row values.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables duplicate", options, async () => requestOxygen("/api/cli/tables/duplicate", {
+            method: "POST",
+            body: {
+                table,
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(options.schemaOnly ? { include_rows: false } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("insert")
+        .description("Insert rows into a workspace table.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--rows-json <json>", "JSON array of row objects keyed by column key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables insert", options, async () => requestOxygen("/api/cli/tables/rows", {
+            method: "POST",
+            body: {
+                table,
+                rows: parseJsonArray(options.rowsJson),
+            },
+        }));
+    }))
+        .addCommand(new Command("update")
+        .description("Update one workspace table row.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .requiredOption("--values-json <json>", "JSON object of values keyed by column key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, options) => {
+        await handleAsyncAction("tables update", options, async () => requestOxygen("/api/cli/tables/rows/update", {
+            method: "POST",
+            body: {
+                table,
+                row_id: rowId,
+                values: parseJsonObject(options.valuesJson),
+            },
+        }));
+    }))
+        .addCommand(new Command("delete-row")
+        .description("Delete one workspace table row.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, options) => {
+        await handleAsyncAction("tables delete-row", options, async () => requestOxygen("/api/cli/tables/rows/delete", {
+            method: "POST",
+            body: {
+                table,
+                row_id: rowId,
+            },
+        }));
+    }))
+        .addCommand(new Command("upsert")
+        .description("Insert or update rows in a workspace table by a column key.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--key <key>", "Column key used to match existing rows.")
+        .requiredOption("--rows-json <json>", "JSON array of row objects keyed by column key.")
+        .option("--return <mode>", "Response shape: summary, ids, or rows. Defaults to summary.")
+        .option("--dry-run", "Preview inserts, updates, duplicate keys, and field conflicts without writing rows.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables upsert", options, async () => requestOxygen("/api/cli/tables/rows/upsert", {
+            method: "POST",
+            body: {
+                table,
+                key: options.key,
+                rows: parseJsonArray(options.rowsJson),
+                ...(readOption(options["return"]) ? { return: readOption(options["return"]) } : {}),
+                ...(options.dryRun ? { dry_run: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("import")
+        .description("Import JSON, JSONL, CSV, or XLSX rows into a workspace table.")
+        .argument("[table]", "Table id or slug. Omit when using --create.")
+        .requiredOption("--file <path>", "Input file path.")
+        .option("--format <format>", "json, jsonl, csv, or xlsx. Defaults from file extension.")
+        .option("--sheet <name>", "Worksheet name for XLSX imports. Defaults to the first sheet.")
+        .option("--create <name>", "Create a new table with columns inferred from the file before importing.")
+        .option("--project <project>", "Project id or slug for --create. Defaults to General.")
+        .option("--upsert-key <key>", "Column key used to upsert instead of inserting.")
+        .option("--batch-size <n>", "Rows per API request. Defaults to 500; paid orgs may use up to 5000.")
+        .option("--background", "Enqueue durable import chunks for the background worker.")
+        .option("--sync", `Force foreground import even for files above ${LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD} rows.`)
+        .option("--max-concurrency <n>", "Maximum concurrent import chunks for background mode. Defaults to 5.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables import", options, async () => importRows(table, options));
+    }))
+        .addCommand(new Command("export")
+        .description("Export workspace table rows as JSON, JSONL, or CSV.")
+        .argument("<table>", "Table id or slug.")
+        .option("--format <format>", "json, jsonl, or csv. Defaults to json.")
+        .option("--output <path>", "Write export content to a file.")
+        .option("--limit <n>", "Maximum rows to export. Defaults to 100; hard cap is 1000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables export", options, async () => exportRows(table, options));
+    }))
+        .addCommand(new Command("list")
+        .description("List workspace tables in the current tenant database.")
+        .option("--project <project>", "Project id or slug to filter by.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tables list", options, async () => requestOxygen(readOption(options.project)
+            ? `/api/cli/tables?project=${encodeURIComponent(readOption(options.project))}`
+            : "/api/cli/tables"));
+    }))
+        .addCommand(new Command("query")
+        .description("Query a workspace table by id or slug.")
+        .argument("<table>", "Table id or slug.")
+        .option("--limit <n>", "Maximum rows to return. Defaults to 100; hard cap is 1000.")
+        .option("--cursor <cursor>", "Pagination cursor returned by a previous query.")
+        .option("--fields <columns>", "Comma-separated column keys or ids to include.")
+        .option("--filter-json <json>", "Filter object or array, e.g. '{\"column\":\"mobile_phone_e164\",\"op\":\"is_null\"}'.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables query", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            const filters = readFilterJsonOption(options.filterJson);
+            return requestOxygen("/api/cli/tables/query", {
+                method: "POST",
+                body: {
+                    table,
+                    ...(limit ? { limit } : {}),
+                    ...(readOption(options.cursor) ? { cursor: readOption(options.cursor) } : {}),
+                    ...(readOption(options.fields) ? { fields: readCsvOption(options.fields) } : {}),
+                    ...(filters ? { filters } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("preview")
+        .description("Preview a workspace table with projected rows and summary stats.")
+        .argument("<table>", "Table id or slug.")
+        .option("--limit <n>", "Maximum preview rows to return. Defaults to 25; hard cap is 1000.")
+        .option("--fields <columns>", "Comma-separated column keys or ids to include.")
+        .option("--include-cell-states", "Include per-cell run state in the preview response.")
+        .option("--summary-only", "Return table metadata and stats without row JSON.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables preview", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen("/api/cli/tables/preview", {
+                method: "POST",
+                body: {
+                    table,
+                    ...(limit ? { limit } : {}),
+                    ...(readOption(options.fields) ? { fields: readCsvOption(options.fields) } : {}),
+                    ...(options.includeCellStates ? { include_cell_states: true } : {}),
+                    ...(options.summaryOnly ? { summary_only: true } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("describe")
+        .description("Describe a workspace table and its columns.")
+        .argument("<table>", "Table id or slug.")
+        .option("--include-archived", "Include archived columns.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables describe", options, async () => requestOxygen("/api/cli/tables/describe", {
+            method: "POST",
+            body: {
+                table,
+                ...(options.includeArchived ? { include_archived: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("rename")
+        .description("Rename a workspace table display name and slug.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--name <name>", "New table display name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables rename", options, async () => requestOxygen("/api/cli/tables/rename", {
+            method: "POST",
+            body: { table, name: options.name },
+        }));
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a workspace table without dropping physical data.")
+        .argument("<table>", "Table id or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables archive", options, async () => requestOxygen("/api/cli/tables/archive", {
+            method: "POST",
+            body: { table },
+        }));
+    }));
+    tablesCommand.addCommand(new Command("webhook")
+        .description("Create and manage direct table webhooks.")
+        .addCommand(new Command("create")
+        .description("Create a direct webhook endpoint that writes inbound JSON into a table.")
+        .argument("<table>", "Table id or slug.")
+        .option("--name <name>", "Display name for the webhook.")
+        .option("--mode <mode>", "insert or upsert. Defaults to upsert when --upsert-key is set, otherwise insert.")
+        .option("--upsert-key <key>", "Column key used to upsert rows. Required for upsert mode.")
+        .option("--items-path <path>", "Dot path to an array of row objects in the webhook payload.")
+        .option("--event-id-path <path>", "Dot path to the event id. Defaults to event_id, eventId, id, or payload hash.")
+        .option("--event-type-path <path>", "Dot path to the event type. Defaults to type or event.")
+        .option("--occurred-at-path <path>", "Dot path to the event timestamp.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables webhook create", options, async () => requestOxygen("/api/cli/tables/webhooks", {
+            method: "POST",
+            body: {
+                table,
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                ...(readOption(options.upsertKey) ? { upsert_key: readOption(options.upsertKey) } : {}),
+                ...(readOption(options.itemsPath) ? { items_path: readOption(options.itemsPath) } : {}),
+                ...(readOption(options.eventIdPath) ? { event_id_path: readOption(options.eventIdPath) } : {}),
+                ...(readOption(options.eventTypePath) ? { event_type_path: readOption(options.eventTypePath) } : {}),
+                ...(readOption(options.occurredAtPath) ? { occurred_at_path: readOption(options.occurredAtPath) } : {}),
+            },
+        }));
+    })));
+    program
+        .command("context")
+        .description("Workspace-level GTM context commands.")
+        .addCommand(new Command("profile")
+        .description("Company profile and ICP memory.")
+        .addCommand(new Command("get")
+        .description("Read the current workspace company profile.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("context profile get", options, async () => requestOxygen("/api/cli/context/profile"));
+    }))
+        .addCommand(new Command("update")
+        .description("Merge one or more profile sections into workspace GTM memory.")
+        .requiredOption("--data-json <json>", "JSON object with company, offering, icp, market, gtm_stack, or custom sections.")
+        .option("--summary <text>", "Optional concise summary for the profile.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("context profile update", options, async () => requestOxygen("/api/cli/context/profile/update", {
+            method: "POST",
+            body: {
+                data: parseJsonObject(options.dataJson ?? "{}"),
+                ...(readOption(options.summary) ? { summary: readOption(options.summary) } : {}),
+            },
+        }));
+    })))
+        .addCommand(new Command("assets")
+        .description("Playbooks, strategies, campaigns, personas, and research notes.")
+        .addCommand(new Command("list")
+        .description("List workspace context assets.")
+        .option("--type <type>", "Filter by playbook, strategy, campaign, positioning, persona, competitor, research_note, or other.")
+        .option("--status <status>", "Filter by draft, active, or archived.")
+        .option("--tags <csv>", "Comma-separated tags that must be present.")
+        .option("--include-archived", "Include archived assets when no status filter is set.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("context assets list", options, async () => requestOxygen(`/api/cli/context/assets${contextAssetsQuery(options)}`));
+    }))
+        .addCommand(new Command("get")
+        .description("Read one context asset.")
+        .argument("<asset_id>", "Context asset UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (assetId, options) => {
+        await handleAsyncAction("context asset get", options, async () => requestOxygen("/api/cli/context/assets/get", {
+            method: "POST",
+            body: { id: assetId },
+        }));
+    }))
+        .addCommand(new Command("upsert")
+        .description("Create or update a context asset.")
+        .option("--id <asset_id>", "Existing asset UUID to update. Omit to create.")
+        .option("--type <type>", "Asset type. Defaults to other on create.")
+        .option("--title <title>", "Asset title. Required on create.")
+        .option("--status <status>", "draft, active, or archived.")
+        .option("--tags <csv>", "Comma-separated asset tags.")
+        .option("--summary <text>", "Short asset summary.")
+        .option("--body <text>", "Asset body text.")
+        .option("--data-json <json>", "Flexible JSON object for structured asset data.")
+        .option("--asset-json <json>", "Full asset JSON object. CLI flags override matching fields.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("context asset upsert", options, async () => requestOxygen("/api/cli/context/assets/upsert", {
+            method: "POST",
+            body: buildContextAssetUpsertBody(options),
+        }));
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a context asset.")
+        .argument("<asset_id>", "Context asset UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (assetId, options) => {
+        await handleAsyncAction("context asset archive", options, async () => requestOxygen("/api/cli/context/assets/archive", {
+            method: "POST",
+            body: { id: assetId },
+        }));
+    })));
+    program
+        .command("columns")
+        .description("Workspace table column commands.")
+        .addCommand(new Command("add")
+        .description("Add a nullable column to a workspace table.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--label <label>", "Display label for the new column.")
+        .option("--key <key>", "Optional stable column key. Defaults to a normalized label.")
+        .option("--data-type <type>", "Column data type: text, numeric, boolean, jsonb, or timestamptz.")
+        .option("--kind <kind>", "Column kind. Defaults to manual.")
+        .option("--semantic-type <type>", "Optional semantic type such as company_domain.")
+        .option("--definition-json <json>", "Optional JSON object with column definition metadata.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        const column = { label: options.label };
+        if (options.key)
+            column.key = options.key;
+        if (options.dataType)
+            column.data_type = options.dataType;
+        if (options.kind)
+            column.kind = options.kind;
+        if (options.semanticType)
+            column.semantic_type = options.semanticType;
+        if (options.definitionJson)
+            column.definition = parseJsonObject(options.definitionJson);
+        await handleAsyncAction("columns add", options, async () => requestOxygen("/api/cli/tables/columns", {
+            method: "POST",
+            body: {
+                table,
+                column,
+            },
+        }));
+    }))
+        .addCommand(new Command("run")
+        .description("Run an executable AI, tool, formula, or local custom HTTP column for one row or a bounded batch.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column id or key.")
+        .option("--row-id <row_id>", "Workspace row id to run.")
+        .option("--limit <n>", "Maximum rows to inspect when row-id is omitted. Defaults to 10; sync hard cap is 25.")
+        .option("--all", "Run all rows. Requires --background.")
+        .option("--filter-json <json>", "Row selector filter object or array for background runs. Do not combine with --all, --limit, or --row-id.")
+        .option("--force", "Run even when the target cell already has a value.")
+        .option("--connection-id <connection_id>", "Optional provider integration connection id.")
+        .option("--background", "Create a durable background table action run instead of executing synchronously.")
+        .option("--max-credits <n>", "Maximum managed/provider credits to reserve for a background run.")
+        .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
+        .option("--local-concurrency <n>", "Maximum concurrent custom HTTP requests for --local. Defaults to 3.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        const limit = readPositiveInt(options.limit);
+        const localConcurrency = readPositiveInt(options.localConcurrency);
+        const maxCredits = readPositiveNumber(options.maxCredits);
+        const filterSelection = readFilterSelectionOption(options.filterJson);
+        const selectedModes = [
+            Boolean(options.all),
+            limit !== undefined,
+            Boolean(readOption(options.rowId)),
+            Boolean(filterSelection),
+        ].filter(Boolean).length;
+        if (selectedModes > 1) {
+            throw new OxygenError("invalid_selection", "Pass only one of --all, --limit, --row-id, or --filter-json.", {
+                exitCode: 1,
+            });
+        }
+        if (options.all && !options.background) {
+            throw new OxygenError("invalid_column_run", "--all requires --background.", {
+                exitCode: 1,
+            });
+        }
+        await handleAsyncAction("columns run", options, async () => {
+            if (options.local) {
+                if (options.background) {
+                    throw new OxygenError("invalid_column_run", "Pass either --local or --background, not both.", {
+                        exitCode: 1,
+                    });
+                }
+                if (filterSelection) {
+                    throw new OxygenError("invalid_column_run", "--filter-json requires --background for columns run.", {
+                        exitCode: 1,
+                    });
+                }
+                return runLocalCustomHttpColumn(table, column, {
+                    rowId: readOption(options.rowId),
+                    force: Boolean(options.force),
+                    ...(limit ? { limit } : {}),
+                    ...(localConcurrency ? { concurrency: localConcurrency } : {}),
+                });
+            }
+            return requestOxygen("/api/cli/tables/columns/run", {
+                method: "POST",
+                body: {
+                    table,
+                    column,
+                    ...(options.all ? { selection: { mode: "all" } } : {}),
+                    ...(filterSelection ? { selection: filterSelection } : {}),
+                    ...(!options.all && readOption(options.rowId) ? { row_id: readOption(options.rowId) } : {}),
+                    ...(!options.all && !filterSelection && limit ? { limit } : {}),
+                    ...(options.force ? { force: true } : {}),
+                    ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                    ...(options.background ? { background: true } : {}),
+                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("materialize")
+        .description("Materialize useful fields from a JSONB result column into target columns.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<source_column>", "JSONB source column id or key.")
+        .option("--preset <preset>", "Materialization preset. Currently supports work_email.")
+        .option("--mappings-json <json>", "JSON array of {source_path,target_column,label?,data_type?,semantic_type?} mappings.")
+        .option("--no-create-if-missing", "Require target companion columns to already exist.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, sourceColumn, options) => {
+        const mappings = options.mappingsJson ? parseJsonArray(options.mappingsJson) : undefined;
+        const preset = readOption(options.preset);
+        await handleAsyncAction("columns materialize", options, async () => requestOxygen("/api/cli/tables/columns/materialize", {
+            method: "POST",
+            body: {
+                table,
+                source_column: sourceColumn,
+                ...(mappings ? { mappings } : {}),
+                ...(!mappings ? { preset: preset ?? "work_email" } : preset ? { preset } : {}),
+                create_if_missing: options.createIfMissing !== false,
+            },
+        }));
+    }))
+        .addCommand(new Command("rename")
+        .description("Rename a workspace column key and optionally label.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column id or key.")
+        .requiredOption("--key <key>", "New stable column key.")
+        .option("--label <label>", "Optional new display label.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("columns rename", options, async () => requestOxygen("/api/cli/tables/columns/rename", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                key: options.key,
+                ...(readOption(options.label) ? { label: readOption(options.label) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("update")
+        .description("Update workspace column display metadata.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column id or key.")
+        .option("--label <label>", "New display label.")
+        .option("--semantic-type <type>", "New semantic type.")
+        .option("--definition-json <json>", "Definition metadata to merge into the column.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("columns update", options, async () => requestOxygen("/api/cli/tables/columns/update", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                ...(readOption(options.label) ? { label: readOption(options.label) } : {}),
+                ...(readOption(options.semanticType) ? { semantic_type: readOption(options.semanticType) } : {}),
+                ...(options.definitionJson ? { definition: parseJsonObject(options.definitionJson) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("retype")
+        .description("Convert a manual text column to a stronger data type, migrating stored values.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column id or key.")
+        .requiredOption("--data-type <type>", "Target data type: text, numeric, boolean, or timestamptz.")
+        .option("--dry-run", "Preview the conversion (row counts and samples) without writing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("columns retype", options, async () => requestOxygen("/api/cli/tables/columns/retype", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                data_type: options.dataType,
+                ...(options.dryRun ? { dry_run: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a workspace column without dropping physical data.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Column id or key.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("columns archive", options, async () => requestOxygen("/api/cli/tables/columns/archive", {
+            method: "POST",
+            body: { table, column },
+        }));
+    }));
+    program
+        .command("action-column")
+        .description("Workspace table action-column setup commands.")
+        .addCommand(new Command("add-provider")
+        .description("Add a catalog-backed provider action picker column to a workspace table.")
+        .argument("[table]", "Table id or slug.")
+        .requiredOption("--provider <provider>", "Provider id, such as attio.")
+        .option("--table <table>", "Table id or slug.")
+        .option("--label <label>", "Display label for the new column.")
+        .option("--key <key>", "Optional stable column key. Defaults to <provider>_actions.")
+        .option("--operation-filter <csv>", "Optional comma-separated operation, tool id, category, or tag filter.")
+        .option("--dry-run", "Preview the provider action column without creating it.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("action-column add-provider", options, async () => {
+            const tableId = readOption(table) ?? readOption(options.table);
+            if (!tableId) {
+                throw new OxygenError("invalid_request", "Pass a table argument or --table <table>.", {
+                    exitCode: 1,
+                });
+            }
+            return requestOxygen("/api/cli/action-columns/provider", {
+                method: "POST",
+                body: {
+                    table: tableId,
+                    provider: options.provider,
+                    ...(readOption(options.label) ? { label: readOption(options.label) } : {}),
+                    ...(readOption(options.key) ? { key: readOption(options.key) } : {}),
+                    ...(readOption(options.operationFilter)
+                        ? { operation_filter: readCsvOption(options.operationFilter) }
+                        : {}),
+                    ...(options.dryRun ? { dry_run: true } : {}),
+                },
+            });
+        });
+    }));
+    program
+        .command("table-runs")
+        .description("Durable background table action run commands.")
+        .addCommand(new Command("create")
+        .description("Create a durable background run for table tool-column actions.")
+        .argument("<table>", "Table id or slug.")
+        .option("--column <column>", "Column id or key for a single tool-column action.")
+        .option("--actions-json <json>", "JSON array of actions, each with type tool_column and column.")
+        .option("--limit <n>", "Run against the newest n rows.")
+        .option("--all", "Run against all rows, up to the server cap.")
+        .option("--row-ids <csv>", "Comma-separated row UUIDs to run.")
+        .option("--filter-json <json>", "Filter object or array for server-side row selection.")
+        .option("--force", "Run even when the target cell already has a value.")
+        .option("--connection-id <connection_id>", "Optional provider integration connection id.")
+        .option("--max-credits <n>", "Maximum managed/provider credits to reserve for this run.")
+        .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        const maxCredits = readPositiveNumber(options.maxCredits);
+        await handleAsyncAction("table-runs create", options, async () => requestOxygen("/api/cli/table-action-runs", {
+            method: "POST",
+            body: {
+                table,
+                actions: readTableRunActions(options),
+                selection: readTableRunSelection(options),
+                ...(options.force ? { force: true } : {}),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(options.metadataJson ? { metadata: parseJsonObject(options.metadataJson) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("get")
+        .description("Get one durable table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs get", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}`));
+    }))
+        .addCommand(new Command("items")
+        .description("List row items for a durable table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--status <status>", "Filter by pending, leased, completed, failed, skipped, or canceled.")
+        .option("--limit <n>", "Maximum items to return. Defaults to 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs items", options, async () => {
+            const query = new URLSearchParams();
+            if (readOption(options.status))
+                query.set("status", readOption(options.status) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/items${suffix}`);
+        });
+    }))
+        .addCommand(new Command("wait")
+        .description("Poll a durable table action run until it finishes.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
+        .option("--interval-seconds <n>", "Polling interval. Defaults to 5.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs wait", options, async () => waitForTableActionRun(runId, options));
+    }))
+        .addCommand(new Command("provider-summary")
+        .description("Summarize provider attempts, upstream request events, and credit capture/release for a table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs provider-summary", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/provider-summary`));
+    }))
+        .addCommand(new Command("cancel")
+        .description("Request cancellation for a durable table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs cancel", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/cancel`, {
+            method: "POST",
+            body: {},
+        }));
+    }))
+        .addCommand(new Command("pause")
+        .description("Pause a durable table action run before it starts more row jobs.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs pause", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/pause`, {
+            method: "POST",
+            body: {},
+        }));
+    }))
+        .addCommand(new Command("resume")
+        .description("Resume a paused durable table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs resume", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/resume`, {
+            method: "POST",
+            body: {},
+        }));
+    }))
+        .addCommand(new Command("retry-failed")
+        .description("Requeue failed items for a durable table action run.")
+        .argument("<run_id>", "Table action run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-runs retry-failed", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/retry-failed`, {
+            method: "POST",
+            body: {},
+        }));
+    }));
+    program
+        .command("table-ingestions")
+        .description("Durable background table ingestion commands.")
+        .addCommand(new Command("create-tool-page")
+        .description("Create a paged tool-source ingestion run for a workspace table.")
+        .argument("<table>", "Table id or slug.")
+        .option("--tool <tool_id>", "Tool id such as blitzapi.people_search or hubspot.contacts_list.")
+        .option("--tool-id <tool_id>", "Alias for --tool.")
+        .requiredOption("--request-json <json>", "Tool request JSON object for the first page.")
+        .option("--rows-path <path>", "Dotted path to result rows. Defaults to response.results.")
+        .option("--row-mapping-json <json>", "Object mapping target column keys to dotted source-row paths.")
+        .option("--cursor-path <path>", "Dotted path to the next cursor in the tool result.")
+        .option("--cursor-request-key <path>", "Dotted request key to receive the next cursor.")
+        .option("--max-pages <n>", "Maximum pages to fetch. Defaults to 1.")
+        .option("--upsert-key <key>", "Column key used to upsert instead of inserting.")
+        .option("--connection-id <connection_id>", "Optional provider integration connection id.")
+        .option("--max-concurrency <n>", "Maximum concurrent ingestion items for this run. Defaults to 5.")
+        .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("table-ingestions create-tool-page", options, async () => {
+            const toolId = readOption(options.tool) ?? readOption(options.toolId);
+            if (!toolId) {
+                throw new OxygenError("invalid_table_ingestion", "Pass --tool or --tool-id.", {
+                    exitCode: 1,
+                });
+            }
+            const maxPages = readPositiveInt(options.maxPages);
+            const maxConcurrency = readPositiveInt(options.maxConcurrency);
+            const rowMappingJson = readOption(options.rowMappingJson);
+            const payload = {
+                tool_id: toolId,
+                request: parseJsonObject(options.requestJson),
+                ...(readOption(options.rowsPath) ? { rows_path: readOption(options.rowsPath) } : {}),
+                ...(rowMappingJson ? { row_mapping: parseJsonObject(rowMappingJson) } : {}),
+                ...(readOption(options.cursorPath) ? { cursor_path: readOption(options.cursorPath) } : {}),
+                ...(readOption(options.cursorRequestKey) ? { cursor_request_key: readOption(options.cursorRequestKey) } : {}),
+                ...(maxPages ? { max_pages: maxPages } : {}),
+            };
+            return requestOxygen("/api/cli/table-ingestion-runs", {
+                method: "POST",
+                body: {
+                    table,
+                    source_type: "tool_page",
+                    mode: options.upsertKey ? "upsert" : "insert",
+                    ...(readOption(options.upsertKey) ? { upsert_key: readOption(options.upsertKey) } : {}),
+                    ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                    ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+                    metadata: {
+                        command: "table-ingestions create-tool-page",
+                        ...(options.metadataJson ? parseJsonObject(options.metadataJson) : {}),
+                    },
+                    items: [
+                        {
+                            position: 0,
+                            payload,
+                        },
+                    ],
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Get one durable table ingestion run.")
+        .argument("<run_id>", "Table ingestion run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-ingestions get", options, async () => requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(runId)}`));
+    }))
+        .addCommand(new Command("items")
+        .description("List items for a durable table ingestion run.")
+        .argument("<run_id>", "Table ingestion run UUID.")
+        .option("--status <status>", "Filter by pending, leased, completed, failed, skipped, or canceled.")
+        .option("--limit <n>", "Maximum items to return. Defaults to 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-ingestions items", options, async () => {
+            const query = new URLSearchParams();
+            if (readOption(options.status))
+                query.set("status", readOption(options.status) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(runId)}/items${suffix}`);
+        });
+    }))
+        .addCommand(new Command("wait")
+        .description("Poll a durable table ingestion run until it finishes.")
+        .argument("<run_id>", "Table ingestion run UUID.")
+        .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
+        .option("--interval-seconds <n>", "Polling interval. Defaults to 5.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-ingestions wait", options, async () => waitForTableIngestionRun(runId, options));
+    }))
+        .addCommand(new Command("cancel")
+        .description("Request cancellation for a durable table ingestion run.")
+        .argument("<run_id>", "Table ingestion run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-ingestions cancel", options, async () => requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(runId)}/cancel`, {
+            method: "POST",
+            body: {},
+        }));
+    }))
+        .addCommand(new Command("retry-failed")
+        .description("Requeue failed items for a durable table ingestion run.")
+        .argument("<run_id>", "Table ingestion run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("table-ingestions retry-failed", options, async () => requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(runId)}/retry-failed`, {
+            method: "POST",
+            body: {},
+        }));
+    }));
+    program
+        .command("lead-sourcing")
+        .description("ICP-gated lead sourcing planning and audit commands.")
+        .addCommand(new Command("plan")
+        .description("Compile a natural-language ICP into an account-first lead sourcing plan.")
+        .requiredOption("--prompt <file|text>", "ICP prompt text, or a local file path containing the prompt.")
+        .option("--materialize-preview", "Create a preview table for the plan. Defaults to no table side effect.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("lead-sourcing plan", options, async () => requestOxygen("/api/cli/lead-sourcing/plan", {
+            method: "POST",
+            body: {
+                prompt: readFileIfPresent(options.prompt),
+                ...(options.materializePreview ? { materialize_preview: true } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("audit")
+        .description("Audit a sourced lead table against a lead-sourcing spec.")
+        .argument("<table>", "Table id or slug.")
+        .requiredOption("--spec <file>", "JSON LeadSourcingSpec file, or a text prompt file to compile into a spec.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("lead-sourcing audit", options, async () => requestOxygen("/api/cli/lead-sourcing/audit", {
+            method: "POST",
+            body: {
+                table,
+                ...readSpecFileBody(options.spec),
+            },
+        }));
+    }));
+    program
+        .command("worker")
+        .description("Background worker commands.")
+        .addCommand(new Command("queue-stats")
+        .description("Show background action and ingestion queue health.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("worker queue-stats", options, async () => requestOxygen("/api/cli/worker/queue-stats"));
+    }))
+        .addCommand(new Command("failures")
+        .description("List failed background action and ingestion items.")
+        .option("--queue <queue>", "all, actions, or ingestions. Defaults to all.")
+        .option("--limit <n>", "Maximum failed items per queue. Defaults to 25; server cap is 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("worker failures", options, async () => {
+            const query = new URLSearchParams();
+            if (readOption(options.queue))
+                query.set("queue", readOption(options.queue) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/worker/failures${suffix}`);
+        });
+    }))
+        .addCommand(new Command("repair")
+        .description("Repair stale background action and ingestion queue state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("worker repair", options, async () => requestOxygen("/api/cli/worker/repair", {
+            method: "POST",
+            body: {},
+        }));
+    }))
+        .addCommand(new Command("run-once")
+        .description("Compatibility alias for worker repair; enqueues BullMQ repair work for the current organization.")
+        .option("--claim-limit <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--concurrency <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--enrichment-concurrency <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--lease-seconds <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--provider-timeout-ms <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--recipe-timeout-ms <n>", "Compatibility option; ignored by the BullMQ worker.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        const claimLimit = readPositiveInt(options.claimLimit);
+        const concurrency = readPositiveInt(options.concurrency);
+        const enrichmentConcurrency = readPositiveInt(options.enrichmentConcurrency);
+        const leaseSeconds = readPositiveInt(options.leaseSeconds);
+        const providerTimeoutMs = readPositiveInt(options.providerTimeoutMs);
+        const recipeTimeoutMs = readPositiveInt(options.recipeTimeoutMs);
+        await handleAsyncAction("worker run-once", options, async () => requestOxygen("/api/cli/worker/run-once", {
+            method: "POST",
+            body: {
+                ...(claimLimit ? { claim_limit: claimLimit } : {}),
+                ...(concurrency ? { concurrency } : {}),
+                ...(enrichmentConcurrency ? { enrichment_concurrency: enrichmentConcurrency } : {}),
+                ...(leaseSeconds ? { lease_seconds: leaseSeconds } : {}),
+                ...(providerTimeoutMs ? { provider_timeout_ms: providerTimeoutMs } : {}),
+                ...(recipeTimeoutMs ? { recipe_timeout_ms: recipeTimeoutMs } : {}),
+            },
+        }));
+    }));
+    program
+        .command("billing")
+        .description("Plan and managed credit commands.")
+        .addCommand(new Command("balance")
+        .description("Show the current plan and managed credit balance.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("billing balance", options, async () => requestOxygen("/api/cli/billing/balance"));
+    }))
+        .addCommand(new Command("usage")
+        .description("Show recent credit ledger events.")
+        .option("--days <n>", "Lookback window in days. Defaults to 30.")
+        .option("--limit <n>", "Maximum events to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("billing usage", options, async () => {
+            const params = new URLSearchParams();
+            const days = readPositiveInt(options.days);
+            const limit = readPositiveInt(options.limit);
+            if (days)
+                params.set("days", String(days));
+            if (limit)
+                params.set("limit", String(limit));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/billing/usage${suffix}`);
+        });
+    }))
+        .addCommand(new Command("grant")
+        .description("Grant managed credits to the current organization (staff only).")
+        .requiredOption("--credits <credits>", "Managed credits to grant.")
+        .requiredOption("--idempotency-key <key>", "Stable key that makes retries safe.")
+        .option("--organization-id <id>", "Organization id to credit. Defaults to the current organization.")
+        .option("--org-id <id>", "Alias for --organization-id.")
+        .option("--description <text>", "Ledger description for the admin grant.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("billing grant", options, async () => requestOxygen("/api/cli/billing/grant", {
+            method: "POST",
+            body: {
+                credits: readPositiveNumber(options.credits),
+                idempotency_key: readOption(options.idempotencyKey),
+                ...(readOption(options.organizationId) || readOption(options.orgId)
+                    ? { organization_id: readOption(options.organizationId) ?? readOption(options.orgId) }
+                    : {}),
+                ...(readOption(options.description) ? { description: readOption(options.description) } : {}),
+            },
+        }));
+    }));
+    program
+        .command("admin")
+        .description("Staff-only commands.")
+        .addCommand(new Command("costs")
+        .description("Show provider costs (COGS) per workspace. Staff only.")
+        .option("--top <n>", "Limit number of workspace columns. Defaults to all.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("admin costs", options, async () => {
+            const params = new URLSearchParams();
+            const top = readPositiveInt(options.top);
+            if (top)
+                params.set("top", String(top));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/admin/costs${suffix}`);
+        });
+    }));
+    program
+        .command("observability")
+        .description("Redacted operation event commands for the current organization.")
+        .addCommand(new Command("events")
+        .description("List recent redacted operation events and failures.")
+        .option("--status <status>", "Filter by completed, queued, completed_with_errors, or failed.")
+        .option("--trace-id <trace_id>", "Filter by trace id.")
+        .option("--run-id <run_id>", "Filter by workspace run id.")
+        .option("--limit <n>", "Maximum events to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("observability events", options, async () => {
+            const params = new URLSearchParams();
+            const status = readOption(options.status);
+            const traceId = readOption(options.traceId);
+            const runId = readOption(options.runId);
+            const limit = readPositiveInt(options.limit);
+            if (status)
+                params.set("status", status);
+            if (traceId)
+                params.set("trace_id", traceId);
+            if (runId)
+                params.set("run_id", runId);
+            if (limit)
+                params.set("limit", String(limit));
+            const suffix = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/observability/events${suffix}`);
+        });
+    }));
+    program
+        .command("runs")
+        .description("Tenant run provenance commands.")
+        .addCommand(new Command("list")
+        .description("List recent tenant runs.")
+        .option("--limit <n>", "Maximum runs to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("runs list", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen(`/api/cli/runs${limit ? `?limit=${limit}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Get one run with events.")
+        .argument("<run_id>", "Run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("runs get", options, async () => requestOxygen("/api/cli/runs/get", {
+            method: "POST",
+            body: { run_id: runId },
+        }));
+    }));
+    program
+        .command("rows")
+        .description("Workspace row provenance commands.")
+        .addCommand(new Command("history")
+        .description("Show row change history.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .option("--limit <n>", "Maximum changes to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, options) => {
+        await handleAsyncAction("rows history", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen("/api/cli/tables/rows/history", {
+                method: "POST",
+                body: {
+                    table,
+                    row_id: rowId,
+                    ...(limit ? { limit } : {}),
+                },
+            });
+        });
+    }));
+    program
+        .command("cells")
+        .description("Workspace cell provenance commands.")
+        .addCommand(new Command("history")
+        .description("Show cell change history.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .argument("<column>", "Column id or key.")
+        .option("--limit <n>", "Maximum changes to return. Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, column, options) => {
+        await handleAsyncAction("cells history", options, async () => {
+            const limit = readPositiveInt(options.limit);
+            return requestOxygen("/api/cli/tables/cells/history", {
+                method: "POST",
+                body: {
+                    table,
+                    row_id: rowId,
+                    column,
+                    ...(limit ? { limit } : {}),
+                },
+            });
+        });
+    }));
+    program
+        .command("session")
+        .description("Local agent session plan and output commands.")
+        .addCommand(new Command("start")
+        .description("Start a local Oxygen agent session or update a step.")
+        .option("--steps <json>", "JSON array of step labels.")
+        .option("--user-prompt <text>", "Original user request for local session context.")
+        .option("--update <index>", "Update a step index instead of replacing the plan.")
+        .option("--status <status>", "Step status: pending, running, completed, error, or skipped.")
+        .option("--session-id <id>", "Session id to update. Defaults to the current session.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("session start", options, async () => {
+            const updateIndex = readNonNegativeInt(options.update);
+            if (updateIndex !== undefined) {
+                return updateSessionStep({
+                    sessionId: readOption(options.sessionId),
+                    index: updateIndex,
+                    status: normalizeSessionStepStatus(options.status),
+                });
+            }
+            if (!options.steps) {
+                throw new OxygenError("invalid_session", "Pass --steps as a JSON array of labels.", {
+                    exitCode: 1,
+                });
+            }
+            return startSession({
+                steps: parseStringArray(options.steps),
+                userPrompt: readOption(options.userPrompt),
+            });
+        });
+    }))
+        .addCommand(new Command("status")
+        .description("Attach a live status message to the current local session.")
+        .requiredOption("--message <message>", "Status message.")
+        .option("--step-index <index>", "Optional step index. Defaults to the running step.")
+        .option("--session-id <id>", "Session id. Defaults to the current session.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("session status", options, async () => addSessionStatus({
+            sessionId: readOption(options.sessionId),
+            message: options.message,
+            stepIndex: readNonNegativeInt(options.stepIndex) ?? null,
+        }));
+    }))
+        .addCommand(new Command("output")
+        .description("Register a local session output file or table.")
+        .option("--csv <path>", "CSV output path.")
+        .option("--file <path>", "Generic output file path.")
+        .option("--table <table>", "Workspace table id or slug.")
+        .option("--label <label>", "Human-readable output label.")
+        .option("--meta-json <json>", "Optional JSON metadata object.")
+        .option("--session-id <id>", "Session id. Defaults to the current session.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("session output", options, async () => addSessionOutput({
+            sessionId: readOption(options.sessionId),
+            csv: readOption(options.csv),
+            file: readOption(options.file),
+            table: readOption(options.table),
+            label: readOption(options.label),
+            meta: options.metaJson ? parseJsonObject(options.metaJson) : null,
+        }));
+    }))
+        .addCommand(new Command("usage")
+        .description("Summarize the current local session. Org credit usage is available through billing usage.")
+        .option("--session-id <id>", "Session id. Defaults to the current session.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("session usage", options, async () => getSessionUsage({ sessionId: readOption(options.sessionId) }));
+    }));
+    program
+        .command("tools")
+        .description("Tool catalog commands.")
+        .addCommand(new Command("search")
+        .description("Search the tool catalog.")
+        .argument("[query]", "Search text.")
+        .option("--verbosity <verbosity>", "summary or full. Defaults to summary.")
+        .option("--only-runnable", "Only return tools runnable by the active organization.")
+        .option("--capability <tag>", "Filter by capability tag, such as mobile_phone.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("tools search", options, async () => {
+            const params = new URLSearchParams();
+            params.set("query", query ?? "");
+            if (readOption(options.verbosity))
+                params.set("verbosity", readOption(options.verbosity) ?? "");
+            if (options.onlyRunnable)
+                params.set("only_runnable", "true");
+            if (readOption(options.capability))
+                params.set("capability", readOption(options.capability) ?? "");
+            return requestOxygen(`/api/cli/tools/search?${params.toString()}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Get a tool descriptor.")
+        .argument("<tool_id>", "Tool id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (toolId, options) => {
+        await handleAsyncAction("tools get", options, async () => requestOxygen(`/api/cli/tools/${encodeURIComponent(toolId)}`));
+    }))
+        .addCommand(new Command("run")
+        .description("Run an executable Oxygen tool through the HTTPS API.")
+        .argument("<tool_id>", "Tool id.")
+        .requiredOption("--input-json <json>", "Tool input as a JSON object.")
+        .option("--mode <mode>", "Execution mode: live, dry-run, or dry_run. Mutating tools default to dry-run.")
+        .option("--org <organization_id>", "Optional organization id. Must match the stored CLI token.")
+        .option("--org-id <organization_id>", "Optional organization id. Must match the stored CLI token.")
+        .option("--connection-id <connection_id>", "Specific integration connection id. Defaults to the org's active default connection.")
+        .option("--fields <paths>", "Comma-separated response projection paths for large tool outputs.")
+        .option("--return <mode>", "Legacy response shape: raw, compact, or summary. Defaults to raw.")
+        .option("--return-mode <mode>", "Response shape: raw, compact, or summary. Prefer summary for large search responses.")
+        .option("--oxygen-cursor <cursor>", "Short Oxygen cursor returned as oxygen_next_cursor by a previous tool run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (toolId, options) => {
+        await handleAsyncAction("tools run", options, async () => requestOxygen("/api/cli/tools/run", {
+            method: "POST",
+            body: {
+                tool_id: toolId,
+                input: parseJsonObject(options.inputJson),
+                ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                ...(readOption(options.org) ? { org_id: readOption(options.org) } : {}),
+                ...(readOption(options.orgId) ? { org_id: readOption(options.orgId) } : {}),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(readOption(options.fields) ? { fields: readCsvOption(options.fields) } : {}),
+                ...(readOption(options["return"]) ? { return: readOption(options["return"]) } : {}),
+                ...(readOption(options.returnMode) ? { return_mode: readOption(options.returnMode) } : {}),
+                ...(readOption(options.oxygenCursor) ? { oxygen_cursor: readOption(options.oxygenCursor) } : {}),
+            },
+        }));
+    }));
+    program
+        .command("enrich-column")
+        .description("High-level table enrichment helpers.")
+        .addCommand(new Command("preview")
+        .description("Preflight an enrichment column without provider calls or credit usage.")
+        .argument("<table>", "Table id or slug.")
+        .option("--source-column <column>", "Source column key or id. For mobile_phone this is the LinkedIn URL column.")
+        .option("--full-name-column <column>", "Column key or id containing the person's full name for work_email. Pair with company-domain/name for Prospeo, LeadMagic, Hunter, ContactOut, or BetterContact.")
+        .option("--first-name-column <column>", "Column key or id containing the person's first name for work_email.")
+        .option("--last-name-column <column>", "Column key or id containing the person's last name for work_email.")
+        .option("--linkedin-url-column <column>", "Column key or id containing the person's LinkedIn URL. Required by Blitz API and enough for Prospeo, Hunter, ContactOut, or BetterContact.")
+        .option("--email-column <column>", "Column key or id containing a known work email for providers that accept email as an identity fallback.")
+        .option("--company-domain-column <column>", "Column key or id containing the company domain for work_email. Pair with full-name/first+last for name+company providers.")
+        .option("--company-name-column <column>", "Column key or id containing the company name for work_email when no domain is available.")
+        .option("--company-linkedin-url-column <column>", "Column key or id containing the company's LinkedIn URL for company identity fallback.")
+        .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
+        .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
+        .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
+        .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
+        .option("--limit <n>", "Rows to estimate. Defaults to 10.")
+        .option("--all", "Estimate all rows.")
+        .option("--filter-json <json>", "Filter object or array, e.g. '{\"column\":\"mobile_phone_e164\",\"op\":\"is_null\"}'.")
+        .option("--selection-json <json>", "Full row selection object, e.g. '{\"mode\":\"filter\",\"filters\":[{\"column\":\"mobile_phone_e164\",\"op\":\"is_null\"}],\"limit\":100}'.")
+        .option("--only-missing", "Estimate rows missing the capability's normalized output when no explicit selection is passed.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("enrich-column preview", options, async () => requestOxygen("/api/cli/enrich-column/preview", {
+            method: "POST",
+            body: buildEnrichColumnBody(table, options),
+        }));
+    }))
+        .addCommand(new Command("run")
+        .description("Create or reuse an enrichment column and queue a background run.")
+        .argument("<table>", "Table id or slug.")
+        .option("--source-column <column>", "Source column key or id. For mobile_phone this is the LinkedIn URL column.")
+        .option("--full-name-column <column>", "Column key or id containing the person's full name for work_email. Pair with company-domain/name for Prospeo, LeadMagic, Hunter, ContactOut, or BetterContact.")
+        .option("--first-name-column <column>", "Column key or id containing the person's first name for work_email.")
+        .option("--last-name-column <column>", "Column key or id containing the person's last name for work_email.")
+        .option("--linkedin-url-column <column>", "Column key or id containing the person's LinkedIn URL. Required by Blitz API and enough for Prospeo, Hunter, ContactOut, or BetterContact.")
+        .option("--email-column <column>", "Column key or id containing a known work email for providers that accept email as an identity fallback.")
+        .option("--company-domain-column <column>", "Column key or id containing the company domain for work_email. Pair with full-name/first+last for name+company providers.")
+        .option("--company-name-column <column>", "Column key or id containing the company name for work_email when no domain is available.")
+        .option("--company-linkedin-url-column <column>", "Column key or id containing the company's LinkedIn URL for company identity fallback.")
+        .requiredOption("--max-credits <credits>", "Required credit ceiling for the queued run.")
+        .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
+        .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
+        .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
+        .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
+        .option("--limit <n>", "Rows to queue.")
+        .option("--all", "Queue all rows.")
+        .option("--filter-json <json>", "Filter object or array for server-side row selection.")
+        .option("--selection-json <json>", "Full row selection object for server-side row selection.")
+        .option("--only-missing", "Queue rows missing the capability's normalized output when no explicit selection is passed.")
+        .option("--force", "Re-run rows with an existing target enrichment value.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("enrich-column run", options, async () => requestOxygen("/api/cli/enrich-column/run", {
+            method: "POST",
+            body: {
+                ...buildEnrichColumnBody(table, options),
+                max_credits: readPositiveNumber(options.maxCredits),
+                ...(options.force ? { force: true } : {}),
+            },
+        }));
+    }));
+    program
+        .command("integrations")
+        .description("Integration connection and event trigger commands.")
+        .addCommand(new Command("events")
+        .description("Configure provider events that can trigger workflows.")
+        .addCommand(new Command("list")
+        .description("List supported provider events and this org's enabled subscriptions.")
+        .option("--source <source>", "Filter by event source, such as hubspot.")
+        .option("--event <event>", "Filter by event type, such as contact.created.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations events list", options, async () => {
+            const query = new URLSearchParams();
+            if (readOption(options.source))
+                query.set("source", readOption(options.source) ?? "");
+            if (readOption(options.event))
+                query.set("event", readOption(options.event) ?? "");
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/integrations/events${suffix}`);
+        });
+    }))
+        .addCommand(new Command("enable")
+        .description("Enable a provider event for a connected integration account.")
+        .requiredOption("--source <source>", "Event source, such as hubspot.")
+        .requiredOption("--event <event>", "Event type, such as contact.created.")
+        .option("--connection-id <connection_id>", "Specific integration connection id. Defaults to the active default connection.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations events enable", options, async () => requestOxygen("/api/cli/integrations/events/enable", {
+            method: "POST",
+            body: {
+                source: readOption(options.source),
+                event: readOption(options.event),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+            },
+        }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disable a provider event for a connected integration account.")
+        .requiredOption("--source <source>", "Event source, such as hubspot.")
+        .requiredOption("--event <event>", "Event type, such as contact.created.")
+        .option("--connection-id <connection_id>", "Specific integration connection id. Defaults to the active default connection.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations events disable", options, async () => requestOxygen("/api/cli/integrations/events/disable", {
+            method: "POST",
+            body: {
+                source: readOption(options.source),
+                event: readOption(options.event),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+            },
+        }));
+    })))
+        .addCommand(new Command("list")
+        .description("List supported Composio integrations and this org's connections.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations list", options, async () => requestOxygen("/api/cli/integrations/composio/list"));
+    }))
+        .addCommand(new Command("connect")
+        .description("Connect a Composio integration. OAuth toolkits return a redirect URL; API-key toolkits accept --api-key.")
+        .argument("<integration_id>", "Integration id, such as 'slack' or 'exa'.")
+        .option("--api-key <value>", "API key for Composio API-key toolkits (e.g. Exa, SerpAPI, Resend).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, options) => {
+        await handleAsyncAction("integrations connect", options, async () => {
+            const apiKey = readOption(options.apiKey)?.trim();
+            return requestOxygen("/api/cli/integrations/composio/start", {
+                method: "POST",
+                body: {
+                    integration_id: integrationId,
+                    ...(apiKey ? { api_key: apiKey } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("disconnect")
+        .description("Disconnect a Composio integration.")
+        .argument("<integration_id>", "Integration id, such as 'slack'.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, options) => {
+        await handleAsyncAction("integrations disconnect", options, async () => requestOxygen("/api/cli/integrations/composio/disconnect", {
+            method: "POST",
+            body: { integration_id: integrationId },
+        }));
+    }))
+        .addCommand(new Command("actions")
+        .description("List Composio actions available for a connected integration.")
+        .argument("<integration_id>", "Integration id, such as 'slack'.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, options) => {
+        await handleAsyncAction("integrations actions", options, async () => {
+            const params = new URLSearchParams({ integration_id: integrationId });
+            return requestOxygen(`/api/cli/integrations/composio/actions?${params.toString()}`);
+        });
+    }))
+        .addCommand(new Command("run")
+        .description("Run a Composio action for a connected integration.")
+        .argument("<integration_id>", "Integration id, such as 'slack'.")
+        .argument("<action_slug>", "Composio action slug, such as 'SLACK_SEND_MESSAGE'.")
+        .option("--input <json>", "Arguments as JSON object. Default: empty object.")
+        .option("--live", "Execute the action live. Default is dry-run.")
+        .option("--dry-run", "Force dry-run (no provider call).")
+        .option("--mode <mode>", "'live' or 'dry_run'. Overridden by --live/--dry-run if provided.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (integrationId, actionSlug, options) => {
+        await handleAsyncAction("integrations run", options, async () => {
+            const args = readOption(options.input)
+                ? parseJsonObject(readOption(options.input))
+                : {};
+            const mode = resolveComposioRunMode(options);
+            return requestOxygen("/api/cli/integrations/composio/run", {
+                method: "POST",
+                body: {
+                    integration_id: integrationId,
+                    action_slug: actionSlug,
+                    arguments: args,
+                    mode,
+                },
+            });
+        });
+    }));
+    program
+        .command("workflows")
+        .description("Durable workflow automation commands.")
+        .addCommand(new Command("templates")
+        .description("Discover and run reusable Oxygen workflow templates.")
+        .addCommand(new Command("search")
+        .description("Search reusable workflow templates.")
+        .argument("[query]", "Search text.")
+        .option("--tag <tag>", "Filter by template tag.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("workflows templates search", options, async () => {
+            const params = new URLSearchParams();
+            params.set("query", query ?? "");
+            if (readOption(options.tag))
+                params.set("tag", readOption(options.tag) ?? "");
+            return requestOxygen(`/api/cli/workflows/templates?${params.toString()}`);
+        });
+    }))
+        .addCommand(new Command("describe")
+        .description("Describe one workflow template.")
+        .argument("<template_id>", "Workflow template id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("workflows templates describe", options, async () => requestOxygen("/api/cli/workflows/templates/describe", {
+            method: "POST",
+            body: { template_id: templateId },
+        }));
+    }))
+        .addCommand(new Command("preflight")
+        .description("Validate workflow template inputs and preview effects without running it.")
+        .argument("<template_id>", "Workflow template id.")
+        .requiredOption("--input-json <json>", "Template input as a JSON object.")
+        .option("--mode <mode>", "Execution mode: smoke_test, dry_run, or live.")
+        .option("--max-credits <credits>", "Credit ceiling for paid live work.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("workflows templates preflight", options, async () => requestOxygen("/api/cli/workflows/templates/preflight", {
+            method: "POST",
+            body: workflowTemplateActionBody(templateId, options),
+        }));
+    }))
+        .addCommand(new Command("apply")
+        .description("Create or update a disabled workflow from a template.")
+        .argument("<template_id>", "Workflow template id.")
+        .requiredOption("--input-json <json>", "Template input as a JSON object.")
+        .option("--workflow-id <workflow_id>", "Workflow id to create or update.")
+        .option("--workflow-name <workflow_name>", "Workflow display name.")
+        .option("--mode <mode>", "Mode used for preflight validation.")
+        .option("--max-credits <credits>", "Credit ceiling to store in template defaults.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("workflows templates apply", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/templates/apply", {
+            method: "POST",
+            body: workflowTemplateActionBody(templateId, options),
+        }), options));
+    }))
+        .addCommand(new Command("run")
+        .description("Apply a template as an active workflow and enqueue one run.")
+        .argument("<template_id>", "Workflow template id.")
+        .requiredOption("--input-json <json>", "Template input as a JSON object.")
+        .requiredOption("--mode <mode>", "Execution mode: smoke_test, dry_run, or live.")
+        .option("--workflow-id <workflow_id>", "Workflow id to create or update.")
+        .option("--workflow-name <workflow_name>", "Workflow display name.")
+        .option("--max-credits <credits>", "Required credit ceiling for paid live work.")
+        .option("--approved", "Required for live template runs with side effects.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (templateId, options) => {
+        await handleAsyncAction("workflows templates run", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/templates/run", {
+            method: "POST",
+            body: workflowTemplateActionBody(templateId, options),
+        }), options));
+    })))
+        .addCommand(new Command("schema")
+        .description("Print workflow JSON schemas.")
+        .option("--subject <subject>", "Schema subject: all, apply, call, event, trigger, or manifest.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows schema", options, async () => requestOxygen(`/api/cli/workflows/schema?subject=${encodeURIComponent(options.subject ?? "all")}`));
+    }))
+        .addCommand(new Command("lint")
+        .description("Compile and lint a workflow file without saving it.")
+        .requiredOption("--file <path>", "Workflow module or manifest JSON file.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows lint", options, async () => {
+            const manifest = await compileWorkflowFile(options.file);
+            return requestOxygen("/api/cli/workflows/lint", {
+                method: "POST",
+                body: { manifest },
+            });
+        });
+    }))
+        .addCommand(new Command("apply")
+        .description("Compile and publish a workflow automation.")
+        .requiredOption("--file <path>", "Workflow module or manifest JSON file.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows apply", options, async () => {
+            const manifest = await compileWorkflowFile(options.file);
+            return prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/apply", {
+                method: "POST",
+                body: { manifest },
+            }), options);
+        });
+    }))
+        .addCommand(new Command("list")
+        .description("List workflow automations.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows list", options, async () => requestOxygen("/api/cli/workflows"));
+    }))
+        .addCommand(new Command("get")
+        .description("Get one workflow automation.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows get", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/get", {
+            method: "POST",
+            body: { workflow },
+        }), options));
+    }))
+        .addCommand(new Command("duplicate")
+        .description("Duplicate a workflow automation as a disabled copy by default.")
+        .argument("<workflow>", "Source workflow id, slug, or name.")
+        .option("--name <name>", "Display name for the duplicated workflow. Defaults to '<source> Copy'.")
+        .option("--workflow-id <workflow_id>", "Workflow id for the duplicated workflow. Defaults to a unique '<source>-copy' id.")
+        .option("--trigger-id <trigger_id>", "Webhook trigger id for duplicated webhook workflows.")
+        .option("--status <status>", "active or disabled. Defaults to disabled.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows duplicate", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/duplicate", {
+            method: "POST",
+            body: {
+                workflow,
+                ...(readOption(options.name) ? { name: readOption(options.name) } : {}),
+                ...(readOption(options.workflowId) ? { new_workflow_id: readOption(options.workflowId) } : {}),
+                ...(readOption(options.triggerId) ? { trigger_id: readOption(options.triggerId) } : {}),
+                ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
+            },
+        }), options));
+    }))
+        .addCommand(new Command("call")
+        .description("Enqueue a workflow run through its API trigger.")
+        .argument("[workflow]", "Workflow id, slug, or name.")
+        .option("--workflow <workflow>", "Workflow id, slug, or name.")
+        .option("--workflow-id <workflow_id>", "Workflow id or slug.")
+        .option("--workflow-name <workflow_name>", "Workflow name.")
+        .option("--input-json <json>", "Workflow input object. Defaults to {}.")
+        .option("--mode <mode>", "Execution mode: live, dry-run, or smoke-test.")
+        .option("--idempotency-key <key>", "Optional idempotency key.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflowArg, options) => {
+        await handleAsyncAction("workflows call", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/call", {
+            method: "POST",
+            body: {
+                workflow: readOption(workflowArg) ?? readOption(options.workflow),
+                ...(readOption(options.workflowId) ? { workflow_id: readOption(options.workflowId) } : {}),
+                ...(readOption(options.workflowName) ? { workflow_name: readOption(options.workflowName) } : {}),
+                input: options.inputJson ? parseJsonObject(options.inputJson) : {},
+                ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+            },
+        }), options));
+    }))
+        .addCommand(new Command("events")
+        .description("Workflow event trigger utilities.")
+        .addCommand(new Command("emit")
+        .description("Emit a normalized workflow event and enqueue matching event-triggered workflows.")
+        .requiredOption("--source <source>", "Event source, such as instantly, calendar, or hubspot.")
+        .requiredOption("--event <event>", "Event type, such as email.reply_received.")
+        .requiredOption("--payload-json <json>", "Normalized event payload object.")
+        .option("--raw-payload-json <json>", "Optional raw provider payload object.")
+        .option("--headers-json <json>", "Optional delivery headers object.")
+        .option("--external-event-id <id>", "Provider event id for idempotency and inspection.")
+        .option("--idempotency-key <key>", "Optional explicit event idempotency key.")
+        .option("--mode <mode>", "Execution mode: live, dry-run, or smoke-test.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows events emit", options, async () => {
+            const rawPayloadJson = readOption(options.rawPayloadJson);
+            const headersJson = readOption(options.headersJson);
+            return prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/events/emit", {
+                method: "POST",
+                body: {
+                    source: readOption(options.source),
+                    event: readOption(options.event),
+                    payload: parseJsonObject(options.payloadJson),
+                    ...(rawPayloadJson ? { raw_payload: parseJsonObject(rawPayloadJson) } : {}),
+                    ...(headersJson ? { headers: parseJsonObject(headersJson) } : {}),
+                    ...(readOption(options.externalEventId) ? { external_event_id: readOption(options.externalEventId) } : {}),
+                    ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+                    ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                },
+            }), options);
+        });
+    })))
+        .addCommand(new Command("runs")
+        .description("List workflow runs.")
+        .option("--workflow <workflow>", "Workflow id, slug, or name.")
+        .option("--workflow-id <workflow_id>", "Workflow id or slug.")
+        .option("--status <status>", "Filter by queued, running, completed, failed, canceling, or canceled.")
+        .option("--limit <n>", "Maximum runs to return. Defaults to 50.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows runs", options, async () => {
+            const query = new URLSearchParams();
+            const workflow = readOption(options.workflow) ?? readOption(options.workflowId);
+            if (workflow)
+                query.set("workflow", workflow);
+            if (readOption(options.status))
+                query.set("status", readOption(options.status) ?? "");
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return prepareWorkflowCliOutput(await requestOxygen(`/api/cli/workflows/runs${suffix}`), options);
+        });
+    }))
+        .addCommand(new Command("failures")
+        .description("List failed workflow runs and trigger scheduler failures.")
+        .option("--limit <n>", "Maximum failures per group. Defaults to 25; server cap is 100.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("workflows failures", options, async () => {
+            const query = new URLSearchParams();
+            const limit = readPositiveInt(options.limit);
+            if (limit)
+                query.set("limit", String(limit));
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/workflows/failures${suffix}`);
+        });
+    }))
+        .addCommand(new Command("run")
+        .description("Get one workflow run.")
+        .argument("<run_id>", "Workflow run UUID.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("workflows run", options, async () => prepareWorkflowCliOutput(await requestOxygen("/api/cli/workflows/run", {
+            method: "POST",
+            body: { run_id: runId },
+        }), options));
+    }))
+        .addCommand(new Command("tail")
+        .description("Poll a workflow run until it finishes.")
+        .argument("<run_id>", "Workflow run UUID.")
+        .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
+        .option("--interval-seconds <n>", "Polling interval. Defaults to 2.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("workflows tail", options, async () => prepareWorkflowCliOutput(await tailWorkflowRun(runId, options), options));
+    }))
+        .addCommand(new Command("cancel")
+        .description("Cancel a queued or running workflow run.")
+        .argument("<run_id>", "Workflow run UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (runId, options) => {
+        await handleAsyncAction("workflows cancel", options, async () => requestOxygen("/api/cli/workflows/cancel", {
+            method: "POST",
+            body: { run_id: runId },
+        }));
+    }))
+        .addCommand(new Command("enable")
+        .description("Enable a workflow automation and its current trigger.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows enable", options, async () => requestOxygen("/api/cli/workflows/enable", {
+            method: "POST",
+            body: { workflow },
+        }));
+    }))
+        .addCommand(new Command("disable")
+        .description("Disable a workflow automation and its current trigger.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows disable", options, async () => requestOxygen("/api/cli/workflows/disable", {
+            method: "POST",
+            body: { workflow },
+        }));
+    }));
+    program
+        .command("skills")
+        .description("Agent skill installation commands.")
+        .addCommand(new Command("install")
+        .description("Install Oxygen agent skills into local agent skill directories.")
+        .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--agents <agents>", "Space or comma separated agents. Defaults to codex, claude-code, and cursor.")
+        .option("--skill <skill>", "Skill name or '*'. Defaults to '*'.")
+        .option("--project", "Install into the current project instead of global agent scope.")
+        .option("--copy", "Copy skill files instead of symlinking when supported by npx skills.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("skills install", options, async () => installAgentSkills(options));
+    }));
+    return program;
+}
+async function compileWorkflowFile(filePath) {
+    const absolutePath = resolve(filePath);
+    const source = readFileSync(absolutePath, "utf8");
+    const extension = extname(absolutePath).toLowerCase();
+    if (extension === ".json") {
+        const parsed = parseJsonObject(source);
+        const manifest = isAnyWorkflowManifest(parsed)
+            ? parsed
+            : isAnyWorkflowManifest(parsed.manifest)
+                ? parsed.manifest
+                : null;
+        if (!manifest) {
+            throw new OxygenError("invalid_workflow_manifest", "Workflow JSON must be a manifest or { manifest } object.", {
+                details: { file: filePath },
+                exitCode: 1,
+            });
+        }
+        if (isRecipeManifest(manifest))
+            return manifest;
+        assertWorkflowManifest(manifest);
+        return manifest;
+    }
+    if (extension !== ".js" && extension !== ".mjs" && extension !== ".ts") {
+        throw new OxygenError("invalid_workflow_file", "Workflow file must be .js, .mjs, .ts, or .json.", {
+            details: { file: filePath },
+            exitCode: 1,
+        });
+    }
+    const recipeManifest = await tryCompileRecipeFile(absolutePath, source);
+    if (recipeManifest)
+        return recipeManifest;
+    const mod = extension === ".ts"
+        ? await importTranspiledWorkflowModule(absolutePath, source)
+        : await importJavaScriptWorkflowModule(absolutePath, source);
+    const exported = mod.default ?? mod.workflow ?? mod.manifest;
+    if (isWorkflowDefinition(exported)) {
+        return compileWorkflowDefinition(exported, {
+            source,
+            sourceHash: createHash("sha256").update(source).digest("hex"),
+        });
+    }
+    if (isWorkflowManifest(exported)) {
+        assertWorkflowManifest(exported);
+        return exported;
+    }
+    throw new OxygenError("invalid_workflow_file", "Workflow module must export a workflow definition, recipe, or manifest.", {
+        details: { file: filePath },
+        exitCode: 1,
+    });
+}
+async function tryCompileRecipeFile(absolutePath, source) {
+    if (!referencesRecipeSdk(source))
+        return null;
+    const esbuild = await import("esbuild");
+    const result = await esbuild.build({
+        entryPoints: [absolutePath],
+        bundle: true,
+        write: false,
+        format: "esm",
+        platform: "node",
+        target: "node22",
+        nodePaths: RECIPE_ESBUILD_NODE_PATHS,
+        minify: false,
+        sourcemap: false,
+        legalComments: "none",
+        logLevel: "silent",
+        metafile: true,
+    });
+    const out = result.outputFiles?.[0];
+    if (!out) {
+        throw new OxygenError("invalid_workflow_file", "esbuild produced no output for the recipe.", {
+            details: { file: absolutePath },
+            exitCode: 1,
+        });
+    }
+    const bundle = out.text;
+    try {
+        assertRecipeBundleSafe(bundle);
+    }
+    catch (error) {
+        throw new OxygenError("unsafe_recipe_bundle", error instanceof Error ? error.message : "Durable recipe bundle is unsafe.", {
+            details: { file: absolutePath },
+            exitCode: 1,
+        });
+    }
+    let recipe;
+    try {
+        recipe = await loadRecipeFromBundle(bundle, absolutePath);
+    }
+    catch (error) {
+        if (error instanceof OxygenError)
+            throw error;
+        throw new OxygenError("invalid_recipe_definition", error instanceof Error ? error.message : "Recipe definition is invalid.", {
+            details: { file: absolutePath },
+            exitCode: 1,
+        });
+    }
+    const sourceHash = createHash("sha256").update(bundle).digest("hex");
+    const manifest = buildRecipeManifest({
+        workflowId: recipe.id,
+        workflowName: recipe.name,
+        ...(recipe.status ? { status: recipe.status } : {}),
+        ...(recipe.trigger ? { trigger: recipe.trigger } : {}),
+        ...(recipe.inputSchema ? { inputSchema: recipe.inputSchema } : {}),
+        bundle,
+        toolsUsed: recipe.tools,
+        sourceHash,
+    });
+    return manifest;
+}
+function referencesRecipeSdk(source) {
+    return /["']@oxygen\/recipe-sdk["']/.test(source);
+}
+// Escape Next static analysis (the CLI is bundled by tsc, but mirror the
+// worker's escape so both load identically).
+const dynamicRecipeImport = new Function("specifier", "return import(specifier);");
+async function importRecipeModule(specifier) {
+    try {
+        return await dynamicRecipeImport(specifier);
+    }
+    catch (error) {
+        if (error instanceof TypeError && error.message.includes("dynamic import callback")) {
+            return await import(specifier);
+        }
+        throw error;
+    }
+}
+async function loadRecipeFromBundle(bundle, filePath) {
+    const dir = mkdtempSync(`${tmpdir()}/oxygen-recipe-`);
+    const compiledPath = `${dir}/recipe.mjs`;
+    writeFileSync(compiledPath, bundle, "utf8");
+    try {
+        const url = pathToFileURL(compiledPath);
+        url.searchParams.set("v", createHash("sha256").update(bundle).digest("hex").slice(0, 16));
+        const mod = await importRecipeModule(url.href);
+        const candidate = mod.default ?? mod.recipe ?? mod.workflow;
+        if (!isRecipeDefinition(candidate)) {
+            throw new OxygenError("invalid_workflow_file", "Recipe module must export a defineRecipe() result as default.", {
+                details: { file: filePath },
+                exitCode: 1,
+            });
+        }
+        return candidate;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+async function importJavaScriptWorkflowModule(absolutePath, source) {
+    const url = pathToFileURL(absolutePath);
+    url.searchParams.set("v", createHash("sha256").update(source).digest("hex").slice(0, 16));
+    return await import(url.href);
+}
+async function importTranspiledWorkflowModule(absolutePath, source) {
+    if (/\bfrom\s+["']\.\.?\//.test(source) || /\bimport\s*\(\s*["']\.\.?\//.test(source)) {
+        throw new OxygenError("unsupported_workflow_file", "TypeScript workflow files cannot use relative imports in workflow modules.", {
+            details: { file: absolutePath },
+            exitCode: 1,
+        });
+    }
+    const ts = await import("typescript");
+    const transpiled = ts.transpileModule(source, {
+        fileName: absolutePath,
+        compilerOptions: {
+            module: ts.ModuleKind.ESNext,
+            target: ts.ScriptTarget.ES2022,
+            moduleResolution: ts.ModuleResolutionKind.NodeNext,
+            esModuleInterop: true,
+        },
+    }).outputText;
+    const workflowsUrl = await import.meta.resolve("@oxygen/workflows");
+    const rewritten = transpiled
+        .replaceAll("from \"@oxygen/workflows\"", `from "${workflowsUrl}"`)
+        .replaceAll("from '@oxygen/workflows'", `from "${workflowsUrl}"`);
+    const dir = mkdtempSync(`${tmpdir()}/oxygen-workflow-`);
+    const compiledPath = `${dir}/workflow.mjs`;
+    writeFileSync(compiledPath, rewritten, "utf8");
+    try {
+        return await importJavaScriptWorkflowModule(compiledPath, rewritten);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+async function tailWorkflowRun(runId, options) {
+    const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
+        ?? WORKFLOW_TAIL_DEFAULT_TIMEOUT_SECONDS;
+    const intervalSeconds = readPositiveInt(options.intervalSeconds)
+        ?? WORKFLOW_TAIL_DEFAULT_INTERVAL_SECONDS;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutSeconds * 1000;
+    let polls = 0;
+    while (true) {
+        polls += 1;
+        const latest = await requestOxygen("/api/cli/workflows/run", {
+            method: "POST",
+            body: { run_id: runId },
+        });
+        const run = latest.run ?? latest;
+        const status = readRecordString(run, "status");
+        if (isTerminalWorkflowRunStatus(status)) {
+            return {
+                run,
+                workflowRunId: readRecordString(run, "id") ?? runId,
+                status,
+                terminal: true,
+                polls,
+                elapsedMs: Date.now() - startedAt,
+            };
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new OxygenError("workflow_tail_timeout", "Timed out waiting for workflow run to finish.", {
+                details: {
+                    workflow_run_id: runId,
+                    status: status ?? null,
+                    timeout_seconds: timeoutSeconds,
+                    polls,
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+    }
+}
+function workflowTemplateActionBody(templateId, options) {
+    const inputJson = readOption(options.inputJson);
+    const maxCredits = readPositiveNumber(options.maxCredits);
+    return {
+        template_id: templateId,
+        input: inputJson ? parseJsonObject(inputJson) : {},
+        ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+        ...(readOption(options.workflowId) ? { workflow_id: readOption(options.workflowId) } : {}),
+        ...(readOption(options.workflowName) ? { workflow_name: readOption(options.workflowName) } : {}),
+        ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+        ...(options.approved ? { approved: true } : {}),
+    };
+}
+function prepareWorkflowCliOutput(value, options) {
+    const normalized = normalizeWorkflowRunErrors(value);
+    return (options.includeBundle ? normalized : stripWorkflowBundles(normalized));
+}
+function stripWorkflowBundles(value) {
+    if (Array.isArray(value))
+        return value.map((entry) => stripWorkflowBundles(entry));
+    if (!isRecord(value))
+        return value;
+    const shouldStripBundle = typeof value.bundle === "string"
+        && (value.runtime === "durable"
+            || value.bundle_format === "esm"
+            || (typeof value.compiler_version === "string" && value.compiler_version.startsWith("oxygen-recipes-")));
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (shouldStripBundle && key === "bundle")
+            continue;
+        output[key] = stripWorkflowBundles(entry);
+    }
+    return output;
+}
+function normalizeWorkflowRunErrors(value) {
+    if (Array.isArray(value))
+        return value.map((entry) => normalizeWorkflowRunErrors(entry));
+    if (!isRecord(value))
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = normalizeWorkflowRunErrors(entry);
+    }
+    if (output.status === "failed" && (output.error === null || output.error === undefined) && output.lastError !== null && output.lastError !== undefined) {
+        output.error = output.lastError;
+    }
+    if ((output.error === null || output.error === undefined) && isRecord(output.run) && output.run.error !== undefined) {
+        output.error = output.run.error;
+    }
+    return output;
+}
+function isTerminalWorkflowRunStatus(status) {
+    return status === "completed" || status === "failed" || status === "canceled";
+}
+function readTableRunActions(options) {
+    if (options.actionsJson && readOption(options.column)) {
+        throw new OxygenError("invalid_table_run", "Pass either --actions-json or --column, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (options.actionsJson)
+        return parseJsonArray(options.actionsJson);
+    const column = readOption(options.column);
+    if (column)
+        return [{ type: "tool_column", column }];
+    throw new OxygenError("invalid_table_run", "Pass --column or --actions-json.", {
+        exitCode: 1,
+    });
+}
+function readTableRunSelection(options) {
+    const hasAll = Boolean(options.all);
+    const limit = readPositiveInt(options.limit);
+    const rowIds = readCsvOption(options.rowIds);
+    const filterSelection = readFilterSelectionOption(options.filterJson);
+    const selectedModes = [hasAll, Boolean(limit), rowIds.length > 0, Boolean(filterSelection)].filter(Boolean).length;
+    if (selectedModes > 1) {
+        throw new OxygenError("invalid_table_run", "Pass only one of --all, --limit, --row-ids, or --filter-json.", {
+            exitCode: 1,
+        });
+    }
+    if (hasAll)
+        return { mode: "all" };
+    if (limit)
+        return { mode: "limit", limit };
+    if (rowIds.length > 0)
+        return { mode: "row_ids", row_ids: rowIds };
+    if (filterSelection)
+        return filterSelection;
+    throw new OxygenError("invalid_table_run", "Pass --all, --limit, --row-ids, or --filter-json.", {
+        exitCode: 1,
+    });
+}
+function readFilterSelectionOption(value) {
+    const filters = readFilterJsonOption(value);
+    return filters ? { mode: "filter", filters } : undefined;
+}
+function readSelectionJsonOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return undefined;
+    return parseJsonObject(raw);
+}
+function readFilterJsonOption(value) {
+    const raw = readOption(value);
+    if (!raw)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new OxygenError("invalid_filter", "--filter-json must be valid JSON.", {
+            details: { reason: error instanceof Error ? error.message : String(error) },
+            exitCode: 1,
+        });
+    }
+    const filters = Array.isArray(parsed) ? parsed : [parsed];
+    if (filters.length === 0
+        || filters.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry))) {
+        throw new OxygenError("invalid_filter", "--filter-json must be a filter object or non-empty array of filter objects.", {
+            exitCode: 1,
+        });
+    }
+    return filters;
+}
+function parseStringArray(value) {
+    const parsed = parseJsonArray(value);
+    const labels = parsed
+        .map((entry) => typeof entry === "string" ? entry.trim() : "")
+        .filter(Boolean);
+    if (labels.length !== parsed.length || labels.length === 0) {
+        throw new OxygenError("invalid_session", "Session steps must be a non-empty JSON array of strings.", {
+            exitCode: 1,
+        });
+    }
+    return labels;
+}
+function normalizeSessionStepStatus(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "pending"
+        || normalized === "running"
+        || normalized === "completed"
+        || normalized === "error"
+        || normalized === "skipped") {
+        return normalized;
+    }
+    throw new OxygenError("invalid_session_status", "Session status must be pending, running, completed, error, or skipped.", {
+        details: { status: value },
+        exitCode: 1,
+    });
+}
+function installAgentSkills(options) {
+    const apiUrl = normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl());
+    const indexUrl = `${apiUrl}/.well-known/skills/index.json`;
+    const agents = readWords(options.agents ?? "codex claude-code cursor");
+    const skill = readOption(options.skill) ?? "*";
+    const args = [
+        "skills",
+        "add",
+        indexUrl,
+        "--agents",
+        ...agents,
+        "--yes",
+        "--skill",
+        skill,
+        "--full-depth",
+    ];
+    if (!options.project)
+        args.push("--global");
+    if (options.copy)
+        args.push("--copy");
+    let output = "";
+    try {
+        output = execFileSync("npx", args, {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        const failure = error;
+        throw new OxygenError("skills_install_failed", "Unable to install Oxygen agent skills.", {
+            details: {
+                index_url: indexUrl,
+                stdout: failure.stdout?.slice(0, 2000) ?? "",
+                stderr: failure.stderr?.slice(0, 2000) ?? failure.message ?? "unknown",
+            },
+            exitCode: 1,
+        });
+    }
+    return {
+        indexUrl,
+        agents,
+        skill,
+        scope: options.project ? "project" : "global",
+        output,
+    };
+}
+function readWords(value) {
+    return value
+        .split(/[,\s]+/)
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+async function importRows(table, options) {
+    const format = normalizeRowsFormat(options.format, inferRowsFileFormat(options.file));
+    const parsedRows = await readRowsFile(options.file, format, options.sheet);
+    if (parsedRows.length === 0) {
+        throw new OxygenError("invalid_rows", "Import file did not contain any rows.", {
+            exitCode: 1,
+        });
+    }
+    const target = await prepareImportTarget(table, options, parsedRows);
+    const batchSize = normalizeImportBatchSize(options.batchSize);
+    const sourceHash = hashImportFile(options.file);
+    const shouldUseBackground = options.background
+        || (!options.sync && target.rows.length > LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD);
+    if (shouldUseBackground) {
+        return enqueueImportRows(target.tableRef, options, target.rows, format, batchSize, {
+            autoBackground: !options.background,
+            sourceHash,
+            createdTable: target.createdTable,
+            ...(target.upsertKey ? { upsertKey: target.upsertKey } : {}),
+        });
+    }
+    let rowCount = 0;
+    let insertedCount = 0;
+    let updatedCount = 0;
+    let warningCount = 0;
+    const warnings = [];
+    let warningsTruncated = false;
+    let lastResult = null;
+    for (const batch of chunk(target.rows, batchSize)) {
+        const result = await requestOxygen(target.upsertKey ? "/api/cli/tables/rows/upsert" : "/api/cli/tables/rows", {
+            method: "POST",
+            timeoutMs: 300_000,
+            body: {
+                table: target.tableRef,
+                rows: batch,
+                ...(target.upsertKey ? { key: target.upsertKey } : {}),
+            },
+        });
+        rowCount += readCount(result.rowCount);
+        insertedCount += readCount(result.insertedCount);
+        updatedCount += readCount(result.updatedCount);
+        const batchWarningCount = readCount(result.warningCount);
+        warningCount += batchWarningCount;
+        const batchWarnings = Array.isArray(result.warnings) ? result.warnings : [];
+        for (const warning of batchWarnings) {
+            if (warnings.length < 20)
+                warnings.push(warning);
+        }
+        warningsTruncated = warningsTruncated || result.warningsTruncated === true || warningCount > warnings.length;
+        lastResult = result;
+    }
+    return {
+        table: lastResult?.table ?? null,
+        ...(target.createdTable ? { createdTable: target.createdTable } : {}),
+        rowCount,
+        insertedCount,
+        updatedCount,
+        ...(warningCount > 0 ? {
+            warnings,
+            warningCount,
+            ...(warningsTruncated ? { warningsTruncated: true } : {}),
+        } : {}),
+        batchCount: Math.ceil(target.rows.length / batchSize),
+        batchSize,
+        ...(target.tableWebUrl ? { table_web_url: target.tableWebUrl } : {}),
+        ...(readRecordString(lastResult, "web_url") ? { web_url: readRecordString(lastResult, "web_url") } : {}),
+    };
+}
+async function prepareImportTarget(table, options, parsedRows) {
+    if (options.create && table) {
+        throw new OxygenError("invalid_import_target", "Pass either a table argument or --create, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (!options.create && !table) {
+        throw new OxygenError("invalid_import_target", "Pass a table argument or --create <name>.", {
+            exitCode: 1,
+        });
+    }
+    if (!options.create) {
+        return {
+            tableRef: table,
+            rows: parsedRows,
+            createdTable: null,
+            tableWebUrl: null,
+            upsertKey: options.upsertKey,
+        };
+    }
+    const normalized = normalizeRowsForNewTable(parsedRows);
+    const created = await requestOxygen("/api/cli/tables", {
+        method: "POST",
+        body: {
+            name: options.create,
+            columns: normalized.columns,
+            ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+        },
+    });
+    const tableRecord = readRecord(created, "table");
+    const createdSlug = readRecordString(tableRecord, "slug") ?? readRecordString(tableRecord, "id");
+    if (!createdSlug) {
+        throw new OxygenError("invalid_response", "Oxygen API response is missing the created table slug.", {
+            exitCode: 1,
+        });
+    }
+    return {
+        tableRef: createdSlug,
+        rows: normalized.rows,
+        createdTable: created,
+        tableWebUrl: tableWebUrl(createdSlug),
+        upsertKey: normalizeCreatedTableUpsertKey(options.upsertKey, normalized.keyBySource),
+    };
+}
+async function enqueueImportRows(table, options, rows, format, batchSize, context) {
+    const batches = chunk(rows, batchSize);
+    const maxConcurrency = readPositiveInt(options.maxConcurrency);
+    const upsertKey = context.upsertKey ?? options.upsertKey;
+    const idempotencyKey = buildImportIdempotencyKey({
+        table,
+        sourceHash: context.sourceHash,
+        format,
+        mode: upsertKey ? "upsert" : "insert",
+        upsertKey: upsertKey ?? null,
+        batchSize,
+    });
+    const created = await requestOxygen("/api/cli/table-ingestion-runs", {
+        method: "POST",
+        body: {
+            table,
+            source_type: `file.${format}`,
+            mode: upsertKey ? "upsert" : "insert",
+            ...(upsertKey ? { upsert_key: upsertKey } : {}),
+            expected_item_count: batches.length,
+            ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+            metadata: {
+                command: "tables import",
+                file_name: basename(options.file),
+                format,
+                ...(options.sheet ? { sheet: options.sheet } : {}),
+                requested_row_count: rows.length,
+                batch_size: batchSize,
+                auto_background: context.autoBackground,
+                source_hash: context.sourceHash,
+                idempotency_key: idempotencyKey,
+            },
+        },
+    });
+    const ingestionRunId = readRequiredResponseString(created, "id");
+    if (isTerminalTableIngestionStatus(readRecordString(created, "status"))) {
+        return {
+            ingestionRun: created,
+            ingestionRunId,
+            ...(context.createdTable ? { createdTable: context.createdTable } : {}),
+            ...(readRecordString(created, "web_url") ? { web_url: readRecordString(created, "web_url") } : {}),
+            table_web_url: tableWebUrl(table),
+            background: true,
+            autoBackground: context.autoBackground,
+            sourceType: `file.${format}`,
+            rowCount: rows.length,
+            enqueuedItems: 0,
+            duplicatePositions: 0,
+            batchCount: batches.length,
+            batchSize,
+            mode: upsertKey ? "upsert" : "insert",
+            upsertKey: upsertKey ?? null,
+            idempotencyKey,
+        };
+    }
+    let insertedItems = 0;
+    let duplicatePositions = 0;
+    let latestRun = created;
+    for (const [index, batch] of batches.entries()) {
+        const appended = await requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(ingestionRunId)}/items`, {
+            method: "POST",
+            body: {
+                items: [
+                    {
+                        position: index,
+                        payload: { rows: batch },
+                    },
+                ],
+            },
+        });
+        insertedItems += readCount(appended.inserted);
+        duplicatePositions += readCount(appended.duplicatePositions);
+        latestRun = appended.run ?? latestRun;
+    }
+    return {
+        ingestionRun: latestRun,
+        ingestionRunId,
+        ...(context.createdTable ? { createdTable: context.createdTable } : {}),
+        ...(readRecordString(latestRun, "web_url") ? { web_url: readRecordString(latestRun, "web_url") } : {}),
+        table_web_url: tableWebUrl(table),
+        background: true,
+        autoBackground: context.autoBackground,
+        sourceType: `file.${format}`,
+        rowCount: rows.length,
+        enqueuedItems: insertedItems,
+        duplicatePositions,
+        batchCount: batches.length,
+        batchSize,
+        mode: upsertKey ? "upsert" : "insert",
+        upsertKey: upsertKey ?? null,
+        idempotencyKey,
+    };
+}
+async function waitForTableIngestionRun(runId, options) {
+    const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
+        ?? TABLE_INGESTION_WAIT_DEFAULT_TIMEOUT_SECONDS;
+    const intervalSeconds = readPositiveInt(options.intervalSeconds)
+        ?? TABLE_INGESTION_WAIT_DEFAULT_INTERVAL_SECONDS;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutSeconds * 1000;
+    let polls = 0;
+    while (true) {
+        polls += 1;
+        const latestRun = await requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(runId)}`);
+        const status = readRecordString(latestRun, "status");
+        if (isTerminalTableIngestionStatus(status)) {
+            return {
+                ingestionRun: latestRun,
+                ingestionRunId: readRecordString(latestRun, "id") ?? runId,
+                status,
+                terminal: true,
+                polls,
+                elapsedMs: Date.now() - startedAt,
+                ...(readRecordString(latestRun, "web_url") ? { web_url: readRecordString(latestRun, "web_url") } : {}),
+            };
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new OxygenError("table_ingestion_wait_timeout", "Timed out waiting for table ingestion run to finish.", {
+                details: {
+                    ingestion_run_id: runId,
+                    status: status ?? null,
+                    timeout_seconds: timeoutSeconds,
+                    polls,
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+    }
+}
+async function waitForTableActionRun(runId, options) {
+    const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
+        ?? TABLE_ACTION_RUN_WAIT_DEFAULT_TIMEOUT_SECONDS;
+    const intervalSeconds = readPositiveInt(options.intervalSeconds)
+        ?? TABLE_ACTION_RUN_WAIT_DEFAULT_INTERVAL_SECONDS;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutSeconds * 1000;
+    let polls = 0;
+    while (true) {
+        polls += 1;
+        const latestRun = await requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}`);
+        const status = readRecordString(latestRun, "status");
+        if (isTerminalTableActionRunStatus(status)) {
+            return {
+                actionRun: latestRun,
+                actionRunId: readRecordString(latestRun, "id") ?? runId,
+                status,
+                terminal: true,
+                polls,
+                elapsedMs: Date.now() - startedAt,
+                ...(readRecordString(latestRun, "web_url") ? { web_url: readRecordString(latestRun, "web_url") } : {}),
+            };
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new OxygenError("table_action_run_wait_timeout", "Timed out waiting for table action run to finish.", {
+                details: {
+                    action_run_id: runId,
+                    status: status ?? null,
+                    timeout_seconds: timeoutSeconds,
+                    polls,
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+    }
+}
+async function exportRows(table, options) {
+    const format = normalizeExportRowsFormat(options.format);
+    const limit = readPositiveInt(options.limit);
+    const result = await requestOxygen("/api/cli/tables/query", {
+        method: "POST",
+        body: {
+            table,
+            ...(limit ? { limit } : {}),
+        },
+    });
+    const content = formatRows(result.rows, format, result.columns);
+    if (options.output) {
+        writeFileSync(options.output, content);
+    }
+    return {
+        table: result.table ?? null,
+        format,
+        rowCount: result.rows.length,
+        output: options.output ?? null,
+        ...(options.output ? {} : { content }),
+    };
+}
+async function readRowsFile(path, format, sheet) {
+    return await parseRowsFileBuffer(readFileSync(path), format, sheet ? { sheet } : {});
+}
+function normalizeCreatedTableUpsertKey(value, keyBySource) {
+    if (!value)
+        return undefined;
+    return keyBySource[value] ?? value;
+}
+function normalizeExportRowsFormat(value) {
+    const normalized = value?.trim().toLowerCase() || "json";
+    if (normalized === "json" || normalized === "jsonl" || normalized === "csv")
+        return normalized;
+    throw new OxygenError("invalid_format", "Export format must be json, jsonl, or csv.", {
+        details: { format: value },
+        exitCode: 1,
+    });
+}
+function formatRows(rows, format, columns) {
+    if (format === "json")
+        return `${JSON.stringify(rows, null, 2)}\n`;
+    if (format === "jsonl")
+        return `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`;
+    const keys = [
+        "_row_id",
+        "_created_at",
+        "_updated_at",
+        ...(columns?.map((column) => column.key) ?? []),
+        ...rows.flatMap((row) => Object.keys(row)),
+    ].filter((key, index, all) => all.indexOf(key) === index && rows.some((row) => key in row));
+    return [
+        keys.map(escapeCsvField).join(","),
+        ...rows.map((row) => keys.map((key) => escapeCsvField(row[key])).join(",")),
+    ].join("\n") + "\n";
+}
+function escapeCsvField(value) {
+    const text = value === null || value === undefined
+        ? ""
+        : typeof value === "object"
+            ? JSON.stringify(value)
+            : String(value);
+    return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, "\"\"")}"` : text;
+}
+function chunk(values, size) {
+    const chunks = [];
+    for (let index = 0; index < values.length; index += size) {
+        chunks.push(values.slice(index, index + size));
+    }
+    return chunks;
+}
+function readCount(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function readRecordString(value, key) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const entry = value[key];
+    return typeof entry === "string" ? entry : null;
+}
+function readRecord(value, key) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const entry = value[key];
+    return isRecord(entry) ? entry : null;
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function tableWebUrl(tableIdOrSlug) {
+    return `https://oxygen-agent.com/tables/${encodeURIComponent(tableIdOrSlug)}`;
+}
+function readRequiredResponseString(value, key) {
+    const entry = value[key];
+    if (typeof entry === "string" && entry.trim())
+        return entry.trim();
+    throw new OxygenError("invalid_response", `Oxygen API response is missing ${key}.`, {
+        details: { key },
+        exitCode: 1,
+    });
+}
+function normalizeImportBatchSize(value) {
+    const batchSize = readPositiveInt(value) ?? 500;
+    if (batchSize > 5000) {
+        throw new OxygenError("invalid_number", "Import batch size cannot exceed 5000.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return batchSize;
+}
+function hashImportFile(path) {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+function buildImportIdempotencyKey(input) {
+    return [
+        "tables-import",
+        input.table,
+        input.format,
+        input.mode,
+        input.upsertKey ?? "none",
+        String(input.batchSize),
+        input.sourceHash,
+    ].join(":");
+}
+function isTerminalTableIngestionStatus(status) {
+    return status === "completed"
+        || status === "completed_with_errors"
+        || status === "failed"
+        || status === "canceled";
+}
+function isTerminalTableActionRunStatus(status) {
+    return status === "completed"
+        || status === "completed_with_errors"
+        || status === "failed"
+        || status === "canceled";
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function handleLoginAction(options) {
+    try {
+        const data = await login(options);
+        if (options.json) {
+            writeJson(success("login", data));
+        }
+    }
+    catch (error) {
+        const failure = toFailure("login", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleAuthUseTokenAction(options) {
+    try {
+        const data = await useAuthToken(options);
+        if (options.json) {
+            writeJson(success("auth use-token", {
+                logged_in: true,
+                profile: data.profile,
+                api_url: data.credentials.apiUrl,
+                user: data.identity.user,
+                organization: data.identity.organization,
+            }));
+            return;
+        }
+        process.stdout.write(formatLoginSuccess(data.identity, data.credentials, data.profile));
+    }
+    catch (error) {
+        const failure = toFailure("auth use-token", error);
+        if (options.json)
+            writeJson(failure);
+        else
+            process.stderr.write(`${failure.error.message}\n`);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleProfilesListAction(options) {
+    try {
+        const state = await listCredentialProfiles();
+        const data = {
+            active_profile: state.activeProfile,
+            profiles: state.profiles.map((profile) => summarizeCredentialProfile(profile, profile.name === state.activeProfile)),
+        };
+        if (options.json) {
+            writeJson(success("profiles list", data));
+            return;
+        }
+        process.stdout.write(formatProfilesList(data));
+    }
+    catch (error) {
+        const failure = toFailure("profiles list", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleProfilesUseAction(profile, options) {
+    try {
+        const activeProfile = await switchCredentialProfile(profile);
+        const data = {
+            active_profile: activeProfile.name,
+            profile: summarizeCredentialProfile(activeProfile, true),
+        };
+        if (options.json) {
+            writeJson(success("profiles use", data));
+            return;
+        }
+        process.stdout.write(formatProfileUseSuccess(data.profile));
+    }
+    catch (error) {
+        const failure = toFailure("profiles use", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleLogoutAction(options) {
+    try {
+        const clearOptions = {};
+        if (options.profile !== undefined)
+            clearOptions.profile = options.profile;
+        if (options.all !== undefined)
+            clearOptions.all = options.all;
+        const result = await clearCredentials(process.env, clearOptions);
+        if (options.json) {
+            writeJson(success("logout", {
+                logged_out: true,
+                removed_profile: result.removedProfile,
+                remaining_profiles: result.remainingProfiles,
+            }));
+            return;
+        }
+        process.stdout.write(formatLogoutSuccess(result));
+    }
+    catch (error) {
+        const failure = toFailure("logout", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleUpdateAction(options) {
+    try {
+        const result = updateCli(options);
+        if (options.json) {
+            writeJson(success("update", result));
+            return;
+        }
+        process.stdout.write(formatUpdateSuccess(result));
+    }
+    catch (error) {
+        const failure = toFailure("update", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function detectCliInstallPrefix() {
+    try {
+        const path = fileURLToPath(import.meta.url);
+        const suffixes = [
+            "/lib/node_modules/@oxygen-agent/cli/dist/index.js",
+            "/lib/node_modules/@oxygen/cli/dist/index.js",
+        ];
+        for (const suffix of suffixes) {
+            if (path.endsWith(suffix)) {
+                return path.slice(0, -suffix.length);
+            }
+        }
+    }
+    catch {
+        // Non-file URL (e.g. running from a bundler) — fall through.
+    }
+    return null;
+}
+function updateCli(options) {
+    const packageSpec = readOption(options.package) ?? DEFAULT_CLI_PACKAGE_SPEC;
+    const prefix = detectCliInstallPrefix();
+    const args = prefix
+        ? ["install", "-g", "--prefix", prefix, packageSpec]
+        : ["install", "-g", packageSpec];
+    const command = ["npm", ...args].join(" ");
+    if (options.dryRun) {
+        return {
+            current_version: OXYGEN_VERSION,
+            package: packageSpec,
+            command,
+            dry_run: true,
+            updated: false,
+        };
+    }
+    const result = spawnSync("npm", args, {
+        encoding: "utf8",
+        stdio: options.json ? ["ignore", "pipe", "pipe"] : "inherit",
+    });
+    if (result.error || result.status !== 0) {
+        throw new OxygenError("cli_update_failed", "Unable to update the Oxygen CLI.", {
+            details: {
+                command,
+                package: packageSpec,
+                exit_code: result.status,
+                reason: result.error instanceof Error ? result.error.message : null,
+                stderr: typeof result.stderr === "string" && result.stderr.trim() ? result.stderr.trim().slice(0, 4000) : null,
+            },
+            exitCode: 1,
+        });
+    }
+    return {
+        current_version: OXYGEN_VERSION,
+        package: packageSpec,
+        command,
+        dry_run: false,
+        updated: true,
+    };
+}
+async function login(options) {
+    const apiUrl = normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl());
+    const token = readOption(options.token) ?? await promptForToken({
+        apiUrl,
+        browser: options.browser !== false,
+        json: Boolean(options.json),
+    });
+    const credentials = {
+        token,
+        apiUrl,
+    };
+    const identity = await requestOxygen("/api/cli/whoami", { credentials });
+    const saveOptions = {};
+    if (options.profile !== undefined)
+        saveOptions.profile = options.profile;
+    const profile = await saveCredentials(credentials, process.env, saveOptions);
+    if (!options.json) {
+        process.stdout.write(formatLoginSuccess(identity, credentials, profile));
+    }
+    return {
+        logged_in: true,
+        profile,
+        api_url: credentials.apiUrl,
+        user: identity.user,
+        organization: identity.organization,
+    };
+}
+async function useAuthToken(options) {
+    const token = readOption(options.token);
+    if (!token) {
+        throw new OxygenError("missing_token", "Pass a CLI API token with --token.", {
+            exitCode: 1,
+        });
+    }
+    const credentials = {
+        token,
+        apiUrl: normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl()),
+    };
+    const identity = await requestOxygen("/api/cli/whoami", { credentials });
+    const saveOptions = {};
+    if (options.profile !== undefined)
+        saveOptions.profile = options.profile;
+    const profile = await saveCredentials(credentials, process.env, saveOptions);
+    return {
+        identity,
+        credentials,
+        api_url: credentials.apiUrl,
+        profile,
+    };
+}
+async function promptForToken(options) {
+    const fallbackLoginUrl = createCliLoginUrl(options.apiUrl);
+    if (options.json) {
+        throw new OxygenError("missing_token", "Pass a CLI API token with --token when using --json.", {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
+    if (!process.stdin.isTTY) {
+        throw new OxygenError("missing_token", "Pass a CLI API token with --token, or run `oxygen login` in an interactive terminal.", {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
+    const browserSession = options.browser
+        ? await createBrowserLoginSession(options.apiUrl).catch((error) => {
+            output.write(`Browser login unavailable: ${readErrorMessage(error)}\n`);
+            return null;
+        })
+        : null;
+    if (browserSession) {
+        const opened = openBrowser(browserSession.verificationUrl);
+        if (opened) {
+            output.write("Opened Oxygen in your browser.\n");
+        }
+        else {
+            output.write("Open this URL in your browser:\n");
+            output.write(`${browserSession.verificationUrl}\n`);
+        }
+        const spinner = startOxygenSpinner("Waiting for browser authorization");
+        try {
+            const token = (await waitForBrowserToken(browserSession)).trim();
+            if (token) {
+                spinner.succeed("Browser authorization received");
+                return token;
+            }
+        }
+        catch (error) {
+            spinner.fail(`Browser login unavailable: ${readErrorMessage(error)}`);
+            output.write("Paste a CLI API token instead.\n");
+        }
+        finally {
+            spinner.stop();
+            await browserSession.close();
+        }
+    }
+    return promptForManualToken();
+}
+async function promptForManualToken() {
+    const restoreEcho = muteTokenEcho();
+    const rl = createInterface({ input, output });
+    try {
+        const token = (await rl.question("Oxygen API token: ")).trim();
+        output.write("\n");
+        if (!token) {
+            throw new OxygenError("missing_token", "A CLI API token is required.", {
+                exitCode: 1,
+            });
+        }
+        return token;
+    }
+    finally {
+        rl.close();
+        restoreEcho();
+    }
+}
+async function waitForBrowserToken(session) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            reject(new OxygenError("browser_login_timeout", "Browser authorization timed out.", {
+                exitCode: 1,
+            }));
+        }, BROWSER_LOGIN_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([session.waitForToken(), timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function createCliLoginUrl(apiUrl) {
+    const url = new URL("/auth/sign-in", apiUrl);
+    url.searchParams.set("redirect_url", "/settings/api-keys");
+    url.searchParams.set("source", "oxygen_cli");
+    return url.toString();
+}
+function readErrorMessage(error) {
+    return error instanceof Error ? error.message : "unknown error";
+}
+function startOxygenSpinner(message) {
+    if (!output.isTTY) {
+        output.write(`${message}...\n`);
+        return {
+            succeed: (successMessage) => output.write(`${successMessage}.\n`),
+            fail: (failureMessage) => output.write(`${failureMessage}.\n`),
+            stop: () => undefined,
+        };
+    }
+    let frameIndex = 0;
+    let active = true;
+    let lastLineLength = 0;
+    const clearLine = () => {
+        output.write(`\r${" ".repeat(lastLineLength)}\r`);
+        lastLineLength = 0;
+    };
+    const render = () => {
+        const frame = OXYGEN_SPINNER_FRAMES[frameIndex % OXYGEN_SPINNER_FRAMES.length];
+        frameIndex += 1;
+        const line = `${frame} ${message}...`;
+        lastLineLength = Math.max(lastLineLength, line.length);
+        output.write(`\r${line}${" ".repeat(Math.max(0, lastLineLength - line.length))}`);
+    };
+    render();
+    const interval = setInterval(render, OXYGEN_SPINNER_INTERVAL_MS);
+    const finish = (status, finalMessage) => {
+        if (!active)
+            return;
+        active = false;
+        clearInterval(interval);
+        clearLine();
+        output.write(`[OXYGEN ${status}] ${finalMessage}.\n`);
+    };
+    return {
+        succeed: (successMessage) => finish("OK", successMessage),
+        fail: (failureMessage) => finish("!!", failureMessage),
+        stop: () => {
+            if (!active)
+                return;
+            active = false;
+            clearInterval(interval);
+            clearLine();
+        },
+    };
+}
+function formatLoginSuccess(identity, credentials, profile) {
+    const email = identity.user.email ?? identity.user.id;
+    const org = identity.organization.name || identity.organization.slug || identity.organization.id;
+    const key = identity.apiKey
+        ? `${identity.apiKey.tokenPrefix}...${identity.apiKey.tokenSuffix}`
+        : "stored";
+    const fingerprint = createHash("sha256")
+        .update(`oxygen-cli:${credentials.token}`)
+        .digest("hex");
+    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const rows = [
+        ["Account", email],
+        ["Organization", org],
+        ["Profile", profile],
+        ["API", credentials.apiUrl],
+        ["Token", key],
+        ["Fingerprint", formatFingerprint(fingerprint)],
+    ];
+    const labelWidth = Math.max(...rows.map(([label]) => label.length));
+    const wordmark = renderBox([
+        "",
+        ...OXYGEN_WORDMARK.split("\n").map(line => c.green(line)),
+        "",
+    ]);
+    return [
+        "",
+        wordmark,
+        "",
+        `${c.green("[OK]")} ${c.bold("CLI connected")}`,
+        "",
+        ...rows.map(([label, value]) => `  ${c.dim(label.padEnd(labelWidth))}   ${value}`),
+        "",
+    ].join("\n");
+}
+function formatFingerprint(hex) {
+    return hex.slice(0, 20).match(/.{1,4}/g)?.join(":") ?? hex.slice(0, 20);
+}
+function summarizeCredentialProfile(profile, active) {
+    return {
+        name: profile.name,
+        active,
+        api_url: profile.apiUrl,
+        token_fingerprint: formatFingerprint(createCredentialFingerprint(profile.token)),
+    };
+}
+function createCredentialFingerprint(token) {
+    return createHash("sha256")
+        .update(`oxygen-cli:${token}`)
+        .digest("hex");
+}
+function formatProfilesList(data) {
+    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    if (data.profiles.length === 0) {
+        return [
+            "",
+            `${c.dim("No stored Oxygen CLI profiles.")}`,
+            "",
+        ].join("\n");
+    }
+    const labelWidth = Math.max(...data.profiles.map((profile) => profile.name.length));
+    return [
+        "",
+        `${c.bold("Oxygen CLI Profiles")}`,
+        "",
+        ...data.profiles.map((profile) => {
+            const marker = profile.active ? "*" : " ";
+            return [
+                `${marker} ${profile.name.padEnd(labelWidth)}`,
+                c.dim(profile.api_url),
+                c.dim(profile.token_fingerprint),
+            ].join("  ");
+        }),
+        "",
+    ].join("\n");
+}
+function formatProfileUseSuccess(profile) {
+    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    return [
+        "",
+        `${c.green("[OK]")} ${c.bold("CLI profile selected")}`,
+        "",
+        `  ${c.dim("Profile")}       ${profile.name}`,
+        `  ${c.dim("API")}           ${profile.api_url}`,
+        `  ${c.dim("Fingerprint")}   ${profile.token_fingerprint}`,
+        "",
+    ].join("\n");
+}
+function formatLogoutSuccess(result) {
+    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const removed = result.removedProfile
+        ? `profile "${result.removedProfile}" removed`
+        : "removed";
+    return [
+        "",
+        `${c.green("[OK]")} ${c.bold("CLI logged out")}`,
+        "",
+        `  ${c.dim("Credentials")}   ${removed}`,
+        `  ${c.dim("Profiles left")}  ${String(result.remainingProfiles)}`,
+        "",
+    ].join("\n");
+}
+function formatUpdateSuccess(result) {
+    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    return [
+        "",
+        `${c.green("[OK]")} ${c.bold(result.dry_run ? "CLI update command ready" : "CLI update completed")}`,
+        "",
+        `  ${c.dim("Current")}     ${result.current_version}`,
+        `  ${c.dim("Package")}     ${result.package}`,
+        `  ${c.dim("Command")}     ${result.command}`,
+        "",
+    ].join("\n");
+}
+function renderBox(lines) {
+    const width = Math.max(...lines.map(visibleLength), 0);
+    const border = `+${"-".repeat(width + 2)}+`;
+    const body = lines.map((line) => `| ${line}${" ".repeat(width - visibleLength(line))} |`);
+    return [border, ...body, border].join("\n");
+}
+function visibleLength(value) {
+    return value.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+function ansi(enabled) {
+    const wrap = (open, close) => enabled
+        ? (text) => `\x1b[${open}m${text}\x1b[${close}m`
+        : (text) => text;
+    return {
+        bold: wrap(1, 22),
+        dim: wrap(2, 22),
+        green: wrap(32, 39),
+    };
+}
+function readOption(value) {
+    return value?.trim() ? value.trim() : null;
+}
+function readCsvOption(value) {
+    const option = readOption(value);
+    if (!option)
+        return [];
+    return option
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+function contextAssetsQuery(options) {
+    const query = new URLSearchParams();
+    if (readOption(options.type))
+        query.set("type", readOption(options.type) ?? "");
+    if (readOption(options.status))
+        query.set("status", readOption(options.status) ?? "");
+    for (const tag of readCsvOption(options.tags))
+        query.append("tag", tag);
+    if (options.includeArchived)
+        query.set("include_archived", "true");
+    const value = query.toString();
+    return value ? `?${value}` : "";
+}
+function buildContextAssetUpsertBody(options) {
+    const asset = options.assetJson ? parseJsonObject(options.assetJson) : {};
+    const tags = readCsvOption(options.tags);
+    return {
+        ...asset,
+        ...(readOption(options.id) ? { id: readOption(options.id) } : {}),
+        ...(readOption(options.type) ? { type: readOption(options.type) } : {}),
+        ...(readOption(options.title) ? { title: readOption(options.title) } : {}),
+        ...(readOption(options.status) ? { status: readOption(options.status) } : {}),
+        ...(tags.length > 0 ? { tags } : {}),
+        ...(readOption(options.summary) ? { summary: readOption(options.summary) } : {}),
+        ...(readOption(options.body) ? { body: readOption(options.body) } : {}),
+        ...(options.dataJson ? { data: parseJsonObject(options.dataJson) } : {}),
+    };
+}
+function buildEnrichColumnBody(table, options) {
+    const limit = readPositiveInt(options.limit);
+    const filterSelection = readFilterSelectionOption(options.filterJson);
+    const explicitSelection = readSelectionJsonOption(options.selectionJson);
+    const selectedModes = [
+        Boolean(options.all),
+        limit !== undefined,
+        Boolean(filterSelection),
+        Boolean(explicitSelection),
+    ].filter(Boolean).length;
+    if (selectedModes > 1) {
+        throw new OxygenError("invalid_selection", "Pass only one of --all, --limit, --filter-json, or --selection-json.", {
+            exitCode: 1,
+        });
+    }
+    return {
+        table,
+        ...(readOption(options.sourceColumn) ? { source_column: readOption(options.sourceColumn) } : {}),
+        ...(readOption(options.fullNameColumn) ? { full_name_column: readOption(options.fullNameColumn) } : {}),
+        ...(readOption(options.firstNameColumn) ? { first_name_column: readOption(options.firstNameColumn) } : {}),
+        ...(readOption(options.lastNameColumn) ? { last_name_column: readOption(options.lastNameColumn) } : {}),
+        ...(readOption(options.linkedinUrlColumn) ? { linkedin_url_column: readOption(options.linkedinUrlColumn) } : {}),
+        ...(readOption(options.emailColumn) ? { email_column: readOption(options.emailColumn) } : {}),
+        ...(readOption(options.companyDomainColumn) ? { company_domain_column: readOption(options.companyDomainColumn) } : {}),
+        ...(readOption(options.companyNameColumn) ? { company_name_column: readOption(options.companyNameColumn) } : {}),
+        ...(readOption(options.companyLinkedinUrlColumn)
+            ? { company_linkedin_url_column: readOption(options.companyLinkedinUrlColumn) }
+            : {}),
+        ...(readOption(options.capability) ? { capability: readOption(options.capability) } : {}),
+        ...(readOption(options.targetColumn) ? { target_column: readOption(options.targetColumn) } : {}),
+        ...(readOption(options.onExistingManualColumn)
+            ? { on_existing_manual_column: readOption(options.onExistingManualColumn) }
+            : {}),
+        ...(readOption(options.providerOrder) ? { provider_order: readCsvOption(options.providerOrder) } : {}),
+        ...(options.verifyPhone ? { verify_phone: true } : {}),
+        ...(readOption(options.phoneVerificationCredentialMode)
+            ? { phone_verification_credential_mode: readOption(options.phoneVerificationCredentialMode) }
+            : {}),
+        ...(options.all ? { selection: { mode: "all" } } : {}),
+        ...(filterSelection ? { selection: filterSelection } : {}),
+        ...(explicitSelection ? { selection: explicitSelection } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+        ...(options.onlyMissing ? { only_missing: true } : {}),
+    };
+}
+function readPositiveInt(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new OxygenError("invalid_number", "Expected a positive integer.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function readPositiveNumber(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new OxygenError("invalid_number", "Expected a positive number.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function readNonNegativeInt(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new OxygenError("invalid_number", "Expected a non-negative integer.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function muteTokenEcho() {
+    if (!input.isTTY || process.platform === "win32")
+        return () => undefined;
+    try {
+        execFileSync("stty", ["-echo"], { stdio: ["inherit", "ignore", "ignore"] });
+        return () => {
+            try {
+                execFileSync("stty", ["echo"], { stdio: ["inherit", "ignore", "ignore"] });
+            }
+            catch {
+                // Ignore restore failures; the shell normally restores echo on process exit.
+            }
+        };
+    }
+    catch {
+        return () => undefined;
+    }
+}
+await createProgram().parseAsync(process.argv);
+//# sourceMappingURL=index.js.map