@oxygen-agent/cli 1.50.37 → 1.98.7

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // skipcq: JS-0271 — bin entry source; build chmod+x on dist/index.js
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, extname, resolve } from "node:path";
@@ -14,13 +14,16 @@ import { inferRowsFileFormat, normalizeRowsForNewTable, normalizeRowsFormat, par
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { createBrowserLoginSession, openBrowser } from "./browser-login.js";
-import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, saveCredentials, switchCredentialProfile, } from "./credentials.js";
+import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { requestOxygen } from "./http-client.js";
 import { runLocalCustomHttpColumn } from "./local-custom-http-column.js";
 import { addSessionOutput, addSessionStatus, getSessionUsage, startSession, updateSessionStep, } from "./session.js";
+import { doctorAgentSkills, installAgentSkills, listAgentSkills, runAutomaticSkillsInstall, } from "./skills.js";
 import { updateCli } from "./update.js";
 const BROWSER_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 const OXYGEN_SPINNER_INTERVAL_MS = 90;
+const INITIAL_OXYGEN_PROFILE_ENV = process.env.OXYGEN_PROFILE?.trim() || null;
+let globalProfileFlag = null;
 const OXYGEN_SPINNER_FRAMES = [
     "[Oxygen  ]",
     "[ Oxygen ]",
@@ -109,6 +112,21 @@ function parseJsonArray(value) {
     }
     return parsed;
 }
+function readCustomIntegrationManifest(options) {
+    const manifestPath = readOption(options.manifest);
+    const manifestJson = readOption(options.manifestJson);
+    if (manifestPath && manifestJson) {
+        throw new OxygenError("invalid_request", "Pass either --manifest or --manifest-json, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (!manifestPath && !manifestJson) {
+        throw new OxygenError("invalid_request", "Pass --manifest or --manifest-json.", {
+            exitCode: 1,
+        });
+    }
+    return parseJsonObject(manifestJson ?? readFileSync(resolve(manifestPath ?? ""), "utf8"));
+}
 function readFileIfPresent(value) {
     const candidate = resolve(value);
     try {
@@ -158,11 +176,17 @@ export function createProgram() {
         .name("oxygen")
         .description("CLI/API-first GTM platform for GTM tool and workflow primitives.")
         .version(OXYGEN_VERSION)
-        .option("--profile <name>", "Use a stored CLI profile for this command.");
+        .option("--profile <name>", "Use a stored CLI profile for this command.")
+        .option("--org <organization>", "Use an organization id, Clerk org id, or slug for this command.");
     program.hook("preAction", () => {
         const options = program.opts();
-        if (options.profile)
+        if (options.profile) {
+            globalProfileFlag = options.profile;
             process.env.OXYGEN_PROFILE = options.profile;
+        }
+        if (options.org) {
+            process.env.OXYGEN_ORG = options.org;
+        }
     });
     program
         .command("login")
@@ -209,6 +233,20 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (profile, options) => {
         await handleLogoutAction({ ...options, profile });
+    }))
+        .addCommand(new Command("env")
+        .description("Print shell `export` lines that pin this terminal to a stored CLI profile.")
+        .argument("<profile>", "Stored profile name.")
+        .option("--unset", "Print `unset` lines instead of `export` lines.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (profile, options) => {
+        await handleProfilesEnvAction(profile, options);
+    }))
+        .addCommand(new Command("current")
+        .description("Show the profile the next command will use, and where it came from.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleProfilesCurrentAction(options);
     }));
     program
         .command("logout")
@@ -263,8 +301,24 @@ export function createProgram() {
         .description("Show the current Oxygen CLI identity.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("whoami", options, async () => requestOxygen("/api/cli/whoami"));
+        await handleWhoamiAction(options);
     });
+    program
+        .command("onboarding")
+        .description("Onboarding helpers.")
+        .addCommand(new Command("start")
+        .description("Start onboarding and get the skill to load.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleOnboardingStartAction(options);
+    }))
+        .addCommand(new Command("reset")
+        .description("Clear the onboarding_started_at marker so onboarding re-runs from scratch. Company context data is preserved.")
+        .option("--confirm", "Required: confirm the reset. Without this flag the command refuses to run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleOnboardingResetAction(options);
+    }));
     program
         .command("status")
         .description("Compare the local Oxygen CLI version against what's deployed in prod.")
@@ -289,16 +343,20 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("orgs list", options, async () => requestOxygen("/api/cli/orgs"));
+    }))
+        .addCommand(new Command("use")
+        .description("Select the active organization for this CLI profile.")
+        .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (organization, options) => {
+        await handleOrgUseAction(organization, options, "orgs use");
     }))
         .addCommand(new Command("select")
-        .description("Select the active organization for an OAuth-backed CLI session.")
+        .description("Alias for orgs use.")
         .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
         .option("--json", "Print a JSON envelope.")
         .action(async (organization, options) => {
-        await handleAsyncAction("orgs select", options, async () => requestOxygen("/api/cli/orgs/select", {
-            method: "POST",
-            body: { organization },
-        }));
+        await handleOrgUseAction(organization, options, "orgs select");
     }));
     program
         .command("db")
@@ -527,6 +585,27 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
         await handleAsyncAction("tables export", options, async () => exportRows(table, options));
+    }))
+        .addCommand(new Command("export-bundle")
+        .description("Export a workspace table as a portable bundle (schema + every row) for cross-environment / cross-org copies.")
+        .argument("<table>", "Table id or slug to export.")
+        .option("--output <path>", "Write the bundle JSON to a file. Defaults to stdout.")
+        .option("--page-size <n>", "Rows per cursor-paginated request. Defaults to 500; hard cap is 1000.")
+        .option("--json", "Print a JSON envelope (omit row payload — use --output to keep the rows).")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables export-bundle", options, async () => exportTableBundle(table, options));
+    }))
+        .addCommand(new Command("import-bundle")
+        .description("Recreate a workspace table from an export-bundle file in this org. Restores columns (incl. enrichment/tool definitions) and inserts every row. Pass --key to make the import idempotent (re-runnable), and --into to resume a failed import into the table it already created.")
+        .requiredOption("--file <path>", "Bundle JSON file produced by `tables export-bundle`.")
+        .option("--name <name>", "Override the table display name. Defaults to the bundle's table name. Ignored with --into.")
+        .option("--project <project>", "Project id or slug for the new table. Defaults to General. Ignored with --into.")
+        .option("--into <table>", "Resume into an existing table (id or slug) instead of creating a new one. Requires --key. Use the table id printed by the failed run.")
+        .option("--key <column>", "Upsert key column. When set, rows are matched by this key instead of blindly inserted, so re-running the import is idempotent (no duplicates). Required with --into.")
+        .option("--batch-size <n>", "Rows per write request. Defaults to 500; paid orgs may use up to 5000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tables import-bundle", options, async () => importTableBundle(options));
     }))
         .addCommand(new Command("list")
         .description("List workspace tables in the current tenant database.")
@@ -629,6 +708,23 @@ export function createProgram() {
             method: "POST",
             body: { table, project: options.project },
         }));
+    }))
+        .addCommand(new Command("recover-pending")
+        .description("Re-poll BetterContact async enrichments that timed out mid-poll and write any newly-found phones back to the table.")
+        .argument("<table>", "Table id or slug.")
+        .option("--max-items <n>", "Max pending cache rows to poll in this run. Defaults to 1000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, options) => {
+        await handleAsyncAction("tables recover-pending", options, async () => {
+            const maxItems = options.maxItems ? Number.parseInt(options.maxItems, 10) : undefined;
+            return requestOxygen("/api/cli/tables/recover-pending", {
+                method: "POST",
+                body: {
+                    table,
+                    ...(Number.isFinite(maxItems) ? { max_items: maxItems } : {}),
+                },
+            });
+        });
     }));
     tablesCommand.addCommand(new Command("webhook")
         .description("Create and manage direct table webhooks.")
@@ -661,6 +757,22 @@ export function createProgram() {
     program
         .command("context")
         .description("Workspace-level GTM context commands.")
+        .addCommand(new Command("resolve")
+        .description("Resolve task-scoped workspace GTM context with readiness and revision provenance.")
+        .option("--purpose <purpose>", "general, lead_sourcing, qualification, outbound_copy, or workflow_design.")
+        .option("--asset-type <csv>", "Comma-separated context asset types to include.")
+        .option("--asset-status <status>", "draft, active, archived, or all. Defaults to active.")
+        .option("--tags <csv>", "Comma-separated asset tags that must be present.")
+        .option("--include-archived", "Include archived assets when no asset status is set.")
+        .option("--max-assets <n>", "Maximum assets to include. Defaults to 10, max 50.")
+        .option("--require-ready", "Exit with a conflict error when required context sections are missing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("context resolve", options, async () => requestOxygen("/api/cli/context/resolve", {
+            method: "POST",
+            body: buildContextResolveBody(options),
+        }));
+    }))
         .addCommand(new Command("profile")
         .description("Company profile and ICP memory.")
         .addCommand(new Command("get")
@@ -734,7 +846,238 @@ export function createProgram() {
         }));
     })));
     program
-        .command("templates")
+        .command("blueprints")
+        .description("Portable Oxygen blueprints: bundle a workflow + tables + columns + prompts as shareable JSON.")
+        .addCommand(new Command("list")
+        .description("List Oxygen blueprints visible in this workspace (seeds + saved).")
+        .argument("[query]", "Search text.")
+        .option("--tag <tag>", "Filter by tag.")
+        .option("--include-seeds", "Include the shipped seed blueprints (default true).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("blueprints list", options, () => {
+            const params = new URLSearchParams();
+            if (query)
+                params.set("query", query);
+            const tag = readOption(options.tag);
+            if (tag)
+                params.set("tag", tag);
+            if (options.includeSeeds === false)
+                params.set("include_seeds", "false");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/blueprints${qs}`);
+        });
+    }))
+        .addCommand(new Command("describe")
+        .description("Describe one blueprint (seed or saved) by slug.")
+        .argument("<slug>", "Blueprint slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints describe", options, () => requestOxygen("/api/cli/blueprints/get", {
+            method: "POST",
+            body: { slug },
+        }));
+    }))
+        .addCommand(new Command("export")
+        .description("Build a portable blueprint JSON from an existing workflow.")
+        .requiredOption("--workflow <id>", "Workflow id or slug to export.")
+        .option("--tables <ids>", "Comma-separated list of table ids/slugs to bundle.")
+        .option("--prompts <slugs>", "Comma-separated list of prompt template slugs to bundle.")
+        .option("--blueprint-id <slug>", "Override the output blueprint slug.")
+        .option("--blueprint-name <name>", "Override the output blueprint name.")
+        .option("--blueprint-summary <text>", "Override the output blueprint summary.")
+        .option("--blueprint-tags <tags>", "Comma-separated tags for the exported blueprint.")
+        .option("--out <path>", "Write the exported envelope to this file path.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints export", options, async () => {
+            const body = { workflow_id: options.workflow };
+            const tables = readOption(options.tables);
+            if (tables)
+                body.table_ids = splitCsv(tables);
+            const prompts = readOption(options.prompts);
+            if (prompts)
+                body.prompt_slugs = splitCsv(prompts);
+            const blueprintId = readOption(options.blueprintId);
+            if (blueprintId)
+                body.blueprint_id = blueprintId;
+            const blueprintName = readOption(options.blueprintName);
+            if (blueprintName)
+                body.blueprint_name = blueprintName;
+            const blueprintSummary = readOption(options.blueprintSummary);
+            if (blueprintSummary)
+                body.blueprint_summary = blueprintSummary;
+            const blueprintTags = readOption(options.blueprintTags);
+            if (blueprintTags)
+                body.blueprint_tags = splitCsv(blueprintTags);
+            const result = await requestOxygen("/api/cli/blueprints/export", {
+                method: "POST",
+                body,
+            });
+            const outPath = readOption(options.out);
+            if (outPath) {
+                const fs = await import("node:fs/promises");
+                const blueprint = result.blueprint;
+                await fs.writeFile(outPath, JSON.stringify(blueprint, null, 2), "utf8");
+            }
+            return result;
+        });
+    }))
+        .addCommand(new Command("preflight")
+        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace.")
+        .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
+        .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
+        .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints preflight", options, async () => {
+            const body = await buildBlueprintRequestBody(slug, options);
+            return requestOxygen("/api/cli/blueprints/preflight", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("apply")
+        .description("Apply a blueprint to this workspace. Creates tables, columns, prompts, and a disabled workflow.")
+        .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
+        .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
+        .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
+        .option("--workflow-id <id>", "Override the resulting workflow id.")
+        .option("--workflow-name <name>", "Override the resulting workflow name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints apply", options, async () => {
+            const body = await buildBlueprintRequestBody(slug, options);
+            const workflowId = readOption(options.workflowId);
+            if (workflowId)
+                body.workflow_id = workflowId;
+            const workflowName = readOption(options.workflowName);
+            if (workflowName)
+                body.workflow_name = workflowName;
+            return requestOxygen("/api/cli/blueprints/apply", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("save")
+        .description("Persist a blueprint envelope into this workspace's gallery.")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--slug <slug>", "Override the stored blueprint slug.")
+        .option("--name <name>", "Override the stored blueprint name.")
+        .option("--summary <text>", "Override the stored blueprint summary.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints save", options, async () => {
+            const filePath = readOption(options.file);
+            if (!filePath)
+                throw new Error("--file is required for blueprints save");
+            const fs = await import("node:fs/promises");
+            const raw = await fs.readFile(filePath, "utf8");
+            const envelope = JSON.parse(raw);
+            const body = { envelope };
+            const slug = readOption(options.slug);
+            if (slug)
+                body.slug = slug;
+            const name = readOption(options.name);
+            if (name)
+                body.name = name;
+            const summary = readOption(options.summary);
+            if (summary)
+                body.summary = summary;
+            return requestOxygen("/api/cli/blueprints/save", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a saved blueprint (seed blueprints cannot be archived).")
+        .argument("<slug>", "Blueprint slug or id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints archive", options, () => requestOxygen("/api/cli/blueprints/archive", { method: "POST", body: { slug } }));
+    }))
+        .addCommand(new Command("share")
+        .description("Create a public share URL for a saved blueprint (oxygen-agent.com/b/<code>).")
+        .argument("<slug>", "Blueprint slug or id to share.")
+        .option("--expires-in-days <days>", "Optional expiry (default: no expiry).")
+        .option("--disabled", "Create the share in disabled state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints share", options, () => {
+            const body = { slug };
+            const expiresInDays = readOption(options.expiresInDays);
+            if (expiresInDays)
+                body.expires_in_days = Number(expiresInDays);
+            if (options.disabled)
+                body.enabled = false;
+            return requestOxygen("/api/cli/blueprints/share", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("shares")
+        .description("List existing share URLs for this workspace.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints shares", options, () => requestOxygen("/api/cli/blueprints/share"));
+    }))
+        .addCommand(new Command("unshare")
+        .description("Revoke a public share URL by short code.")
+        .argument("<code>", "Share short code (the slug after /b/ in the URL).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (code, options) => {
+        await handleAsyncAction("blueprints unshare", options, () => requestOxygen("/api/cli/blueprints/share/revoke", {
+            method: "POST",
+            body: { short_code: code },
+        }));
+    }))
+        .addCommand(new Command("publish")
+        .description("List a blueprint on the public Oxygen marketplace. Auto-creates a share URL if none exists.")
+        .argument("<slug>", "Blueprint slug to publish.")
+        .option("--category <name>", "Optional free-text category (e.g. outbound, enrichment).")
+        .option("--kind <kind>", "Listing kind: community (default) or official (Oxygen-curated; gated).")
+        .option("--approved", "Acknowledge the publish-safety warnings (required if the preview is not clean).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints publish", options, () => {
+            const body = { slug };
+            const category = readOption(options.category);
+            if (category)
+                body.category = category;
+            const kind = readOption(options.kind);
+            if (kind)
+                body.kind = kind;
+            if (options.approved)
+                body.approved = true;
+            return requestOxygen("/api/cli/blueprints/publish", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("unpublish")
+        .description("Remove a blueprint from the public marketplace. The share URL stays valid for direct visitors.")
+        .argument("<slug>", "Blueprint slug to unlist.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints unpublish", options, () => requestOxygen("/api/cli/blueprints/unpublish", {
+            method: "POST",
+            body: { slug },
+        }));
+    }))
+        .addCommand(new Command("marketplace")
+        .description("Browse the public Oxygen blueprint marketplace.")
+        .option("--category <name>", "Filter by listing category.")
+        .option("--kind <kind>", "Filter by listing kind: community or official.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints marketplace", options, () => {
+            const params = new URLSearchParams();
+            const category = readOption(options.category);
+            if (category)
+                params.set("category", category);
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/blueprints/marketplace${qs}`, { requireAuth: false });
+        });
+    }));
+    program
+        .command("prompts")
         .description("Reusable prompt templates layered into AI columns at run time.")
         .addCommand(new Command("list")
         .description("List prompt templates in the workspace.")
@@ -742,10 +1085,85 @@ export function createProgram() {
         .option("--include-archived", "Include archived templates.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("templates list", options, async () => {
+        await handleAsyncAction("prompts list", options, () => {
             const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            if (options.includeArchived)
+                params.set("include_archived", "true");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/templates${qs}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Read one prompt template by id or slug.")
+        .argument("<id_or_slug>", "Template UUID or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (idOrSlug, options) => {
+        await handleAsyncAction("prompts get", options, () => requestOxygen("/api/cli/templates/get", {
+            method: "POST",
+            body: idOrSlug.includes("-") && idOrSlug.length >= 32
+                ? { id: idOrSlug }
+                : { slug: idOrSlug },
+        }));
+    }))
+        .addCommand(new Command("upsert")
+        .description("Create or update a prompt template.")
+        .option("--id <id>", "Existing template UUID to update. Omit to create.")
+        .option("--slug <slug>", "Stable slug (kebab-case).")
+        .option("--name <name>", "Human-readable name.")
+        .option("--description <text>", "Short description.")
+        .option("--kind <kind>", "Template kind: ai_column_system, scoring_rubric, or other.")
+        .option("--body <text>", "Prompt body.")
+        .option("--body-file <path>", "Path to a file containing the prompt body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("prompts upsert", options, async () => {
+            const body = {};
+            if (readOption(options.id))
+                body.id = readOption(options.id);
+            if (readOption(options.slug))
+                body.slug = readOption(options.slug);
+            if (readOption(options.name))
+                body.name = readOption(options.name);
+            if (readOption(options.description) !== undefined)
+                body.description = readOption(options.description);
             if (readOption(options.kind))
-                params.set("kind", readOption(options.kind));
+                body.kind = readOption(options.kind);
+            if (readOption(options.body))
+                body.body = readOption(options.body);
+            else {
+                const path = readOption(options.bodyFile);
+                if (path) {
+                    const fs = await import("node:fs/promises");
+                    body.body = await fs.readFile(path, "utf8");
+                }
+            }
+            return requestOxygen("/api/cli/templates/upsert", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a prompt template. Seeded templates cannot be archived.")
+        .argument("<id>", "Template UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("prompts archive", options, () => requestOxygen("/api/cli/templates/archive", { method: "POST", body: { id } }));
+    }));
+    program
+        .command("templates")
+        .description("Deprecated alias for 'oxygen prompts'. Will be removed in a future release.")
+        .addCommand(new Command("list")
+        .description("List prompt templates in the workspace.")
+        .option("--kind <kind>", "Filter by ai_column_system, scoring_rubric, or other.")
+        .option("--include-archived", "Include archived templates.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("templates list", options, () => {
+            const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
             if (options.includeArchived)
                 params.set("include_archived", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
@@ -789,10 +1207,12 @@ export function createProgram() {
                 body.kind = readOption(options.kind);
             if (readOption(options.body))
                 body.body = readOption(options.body);
-            else if (readOption(options.bodyFile)) {
+            else {
                 const path = readOption(options.bodyFile);
-                const fs = await import("node:fs/promises");
-                body.body = await fs.readFile(path, "utf8");
+                if (path) {
+                    const fs = await import("node:fs/promises");
+                    body.body = await fs.readFile(path, "utf8");
+                }
             }
             return requestOxygen("/api/cli/templates/upsert", { method: "POST", body });
         });
@@ -814,14 +1234,17 @@ export function createProgram() {
         .option("--limit <n>", "Max rows to return (default 50, max 200).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("reviews list", options, async () => {
+        await handleAsyncAction("reviews list", options, () => {
             const params = new URLSearchParams();
-            if (readOption(options.status))
-                params.set("status", readOption(options.status));
-            if (readOption(options.table))
-                params.set("table_id", readOption(options.table));
-            if (readOption(options.limit))
-                params.set("limit", readOption(options.limit));
+            const status = readOption(options.status);
+            const table = readOption(options.table);
+            const limit = readOption(options.limit);
+            if (status)
+                params.set("status", status);
+            if (table)
+                params.set("table_id", table);
+            if (limit)
+                params.set("limit", limit);
             const qs = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/message-reviews${qs}`);
         });
@@ -831,10 +1254,11 @@ export function createProgram() {
         .option("--table <table_id>", "Filter by table id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("reviews next", options, async () => {
+        await handleAsyncAction("reviews next", options, () => {
             const params = new URLSearchParams();
-            if (readOption(options.table))
-                params.set("table_id", readOption(options.table));
+            const table = readOption(options.table);
+            if (table)
+                params.set("table_id", table);
             const qs = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/message-reviews/next${qs}`);
         });
@@ -856,10 +1280,11 @@ export function createProgram() {
         .option("--auto-rerun", "Trigger a single-row rerun of the column after rejecting.")
         .option("--json", "Print a JSON envelope.")
         .action(async (reviewId, options) => {
-        await handleAsyncAction("reviews reject", options, async () => {
+        await handleAsyncAction("reviews reject", options, () => {
             const body = { id: reviewId, decision: "reject" };
-            if (readOption(options.highlightsJson)) {
-                body.highlights = JSON.parse(readOption(options.highlightsJson));
+            const highlightsJson = readOption(options.highlightsJson);
+            if (highlightsJson) {
+                body.highlights = JSON.parse(highlightsJson);
             }
             if (options.autoRerun)
                 body.auto_rerun = true;
@@ -872,15 +1297,25 @@ export function createProgram() {
         .addCommand(new Command("add")
         .description("Add a nullable column to a workspace table.")
         .argument("<table>", "Table id or slug.")
-        .requiredOption("--label <label>", "Display label for the new column.")
+        .option("--label <label>", "Display label for the new column. Required unless --prompt-key supplies a default title.")
         .option("--key <key>", "Optional stable column key. Defaults to a normalized label.")
         .option("--data-type <type>", "Column data type: text, numeric, boolean, jsonb, or timestamptz.")
         .option("--kind <kind>", "Column kind. Defaults to manual.")
         .option("--semantic-type <type>", "Optional semantic type such as company_domain.")
         .option("--definition-json <json>", "Optional JSON object with column definition metadata.")
+        .option("--prompt-key <key>", "OXYGEN prompt-library key (e.g. email_draft_v1). Materializes prompt + output_schema and forces kind=ai.")
+        .option("--input-mapping <json>", "Required with --prompt-key. JSON object mapping prompt input names to column or literal refs.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
-        const column = { label: options.label };
+        if (!options.promptKey && !options.label) {
+            throw new OxygenError("invalid_request", "--label is required.", { exitCode: 1 });
+        }
+        if (options.promptKey && !options.inputMapping) {
+            throw new OxygenError("missing_input_mapping", "--input-mapping is required when --prompt-key is provided.", { exitCode: 1 });
+        }
+        const column = {};
+        if (options.label)
+            column.label = options.label;
         if (options.key)
             column.key = options.key;
         if (options.dataType)
@@ -891,12 +1326,14 @@ export function createProgram() {
             column.semantic_type = options.semanticType;
         if (options.definitionJson)
             column.definition = parseJsonObject(options.definitionJson);
+        const body = { table, column };
+        if (options.promptKey)
+            body.prompt_key = options.promptKey;
+        if (options.inputMapping)
+            body.input_mapping = parseJsonObject(options.inputMapping);
         await handleAsyncAction("columns add", options, async () => requestOxygen("/api/cli/tables/columns", {
             method: "POST",
-            body: {
-                table,
-                column,
-            },
+            body,
         }));
     }))
         .addCommand(new Command("run")
@@ -911,6 +1348,7 @@ export function createProgram() {
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--background", "Create a durable background table action run instead of executing synchronously.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for a background run.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for a background run. Defaults to 50.")
         .option("--local", "Run a custom HTTP column in this CLI process so env-var secrets stay local.")
         .option("--local-concurrency <n>", "Maximum concurrent custom HTTP requests for --local. Defaults to 3.")
         .option("--json", "Print a JSON envelope.")
@@ -918,6 +1356,7 @@ export function createProgram() {
         const limit = readPositiveInt(options.limit);
         const localConcurrency = readPositiveInt(options.localConcurrency);
         const maxCredits = readPositiveNumber(options.maxCredits);
+        const maxConcurrency = readPositiveInt(options.maxConcurrency);
         const filterSelection = readFilterSelectionOption(options.filterJson);
         const selectedModes = [
             Boolean(options.all),
@@ -954,20 +1393,21 @@ export function createProgram() {
                     ...(localConcurrency ? { concurrency: localConcurrency } : {}),
                 });
             }
-            return requestOxygen("/api/cli/tables/columns/run", {
-                method: "POST",
-                body: {
-                    table,
-                    column,
-                    ...(options.all ? { selection: { mode: "all" } } : {}),
-                    ...(filterSelection ? { selection: filterSelection } : {}),
-                    ...(!options.all && readOption(options.rowId) ? { row_id: readOption(options.rowId) } : {}),
-                    ...(!options.all && !filterSelection && limit ? { limit } : {}),
-                    ...(options.force ? { force: true } : {}),
-                    ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
-                    ...(options.background ? { background: true } : {}),
-                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
-                },
+            const body = {
+                table,
+                column,
+                ...(options.all ? { selection: { mode: "all" } } : {}),
+                ...(filterSelection ? { selection: filterSelection } : {}),
+                ...(!options.all && readOption(options.rowId) ? { row_id: readOption(options.rowId) } : {}),
+                ...(!options.all && !filterSelection && limit ? { limit } : {}),
+                ...(options.force ? { force: true } : {}),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(options.background ? { background: true } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+            };
+            return requestColumnsRun(body, table, {
+                background: Boolean(options.background),
             });
         });
     }))
@@ -1035,10 +1475,11 @@ export function createProgram() {
         .argument("<column>", "Column id or key.")
         .option("--label <label>", "New display label.")
         .option("--semantic-type <type>", "New semantic type.")
-        .option("--definition-json <json>", "Definition metadata to merge into the column.")
+        .option("--definition-json <json>", "Definition metadata to shallow-merge into the column; arrays are replaced wholesale and missing keys leave existing fields unchanged.")
+        .option("--dry-run", "Return the would-be merged definition without writing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, column, options) => {
-        await handleAsyncAction("columns update", options, async () => requestOxygen("/api/cli/tables/columns/update", {
+        await handleAsyncAction("columns update", options, () => requestOxygen("/api/cli/tables/columns/update", {
             method: "POST",
             body: {
                 table,
@@ -1046,6 +1487,7 @@ export function createProgram() {
                 ...(readOption(options.label) ? { label: readOption(options.label) } : {}),
                 ...(readOption(options.semanticType) ? { semantic_type: readOption(options.semanticType) } : {}),
                 ...(options.definitionJson ? { definition: parseJsonObject(options.definitionJson) } : {}),
+                ...(options.dryRun ? { dry_run: true } : {}),
             },
         }));
     }))
@@ -1129,10 +1571,12 @@ export function createProgram() {
         .option("--force", "Run even when the target cell already has a value.")
         .option("--connection-id <connection_id>", "Optional provider integration connection id.")
         .option("--max-credits <n>", "Maximum managed/provider credits to reserve for this run.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for this run.")
         .option("--metadata-json <json>", "Optional metadata object to attach to the run.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
         const maxCredits = readPositiveNumber(options.maxCredits);
+        const maxConcurrency = readPositiveInt(options.maxConcurrency);
         await handleAsyncAction("table-runs create", options, async () => requestOxygen("/api/cli/table-action-runs", {
             method: "POST",
             body: {
@@ -1142,13 +1586,23 @@ export function createProgram() {
                 ...(options.force ? { force: true } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
                 ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.metadataJson ? { metadata: parseJsonObject(options.metadataJson) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("list")
+        .description("List durable table action runs for one table.")
+        .requiredOption("--table <table>", "Table id or slug.")
+        .option("--status <status>", "Filter by active, queued, running, paused, completed, completed_with_errors, failed, canceling, or canceled. Defaults to active.")
+        .option("--limit <n>", "Maximum runs to return. Defaults to 20.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("table-runs list", options, () => requestOxygen(tableRunsListPath(options)));
     }))
         .addCommand(new Command("get")
         .description("Get one durable table action run.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (runId, options) => {
         await handleAsyncAction("table-runs get", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}`));
@@ -1173,7 +1627,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("wait")
         .description("Poll a durable table action run until it finishes.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
         .option("--interval-seconds <n>", "Polling interval. Defaults to 5.")
         .option("--json", "Print a JSON envelope.")
@@ -1189,7 +1643,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("cancel")
         .description("Request cancellation for a durable table action run.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (runId, options) => {
         await handleAsyncAction("table-runs cancel", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/cancel`, {
@@ -1427,7 +1881,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("failures")
         .description("List failed background action and ingestion items.")
-        .option("--queue <queue>", "all, actions, or ingestions. Defaults to all.")
+        .option("--queue <queue>", "all, actions, ingestions, or bullmq. Defaults to all.")
         .option("--limit <n>", "Maximum failed items per queue. Defaults to 25; server cap is 100.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -1443,7 +1897,7 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("repair")
-        .description("Repair stale background action and ingestion queue state.")
+        .description("Repair stale background action, ingestion, and workflow queue state.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("worker repair", options, async () => requestOxygen("/api/cli/worker/repair", {
@@ -1533,6 +1987,7 @@ export function createProgram() {
         .addCommand(new Command("costs")
         .description("Show provider costs (COGS) per workspace. Staff only.")
         .option("--top <n>", "Limit number of workspace columns. Defaults to all.")
+        .option("--credential-mode <mode>", "managed (default; real COGS), byok (customer-supplied credentials), or all.", "managed")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("admin costs", options, async () => {
@@ -1540,6 +1995,10 @@ export function createProgram() {
             const top = readPositiveInt(options.top);
             if (top)
                 params.set("top", String(top));
+            const credentialMode = readOption(options.credentialMode);
+            if (credentialMode && credentialMode !== "managed") {
+                params.set("credential_mode", credentialMode);
+            }
             const suffix = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/admin/costs${suffix}`);
         });
@@ -1621,6 +2080,27 @@ export function createProgram() {
     program
         .command("cells")
         .description("Workspace cell provenance commands.")
+        .addCommand(new Command("inspect")
+        .description("Inspect one cell's value, row context, and recent history.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<row_id>", "Workspace row UUID.")
+        .argument("<column>", "Column id or key.")
+        .option("--history-limit <n>", "Maximum recent cell changes to include. Defaults to 10; cap 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, rowId, column, options) => {
+        await handleAsyncAction("cells inspect", options, async () => {
+            const historyLimit = readPositiveInt(options.historyLimit);
+            return requestOxygen("/api/cli/tables/cells/inspect", {
+                method: "POST",
+                body: {
+                    table,
+                    row_id: rowId,
+                    column,
+                    ...(historyLimit ? { history_limit: historyLimit } : {}),
+                },
+            });
+        });
+    }))
         .addCommand(new Command("history")
         .description("Show cell change history.")
         .argument("<table>", "Table id or slug.")
@@ -1713,13 +2193,43 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("session usage", options, async () => getSessionUsage({ sessionId: readOption(options.sessionId) }));
     }));
+    program
+        .command("custom-integrations")
+        .description("Custom HTTP integration commands.")
+        .addCommand(new Command("apply")
+        .description("Create or update a custom HTTP integration manifest. Store credentials from the web Connections page.")
+        .option("--manifest <path>", "Path to a custom HTTP manifest JSON file.")
+        .option("--manifest-json <json>", "Custom HTTP manifest as a JSON object.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("custom-integrations apply", options, () => {
+            const manifest = readCustomIntegrationManifest(options);
+            return requestOxygen("/api/cli/custom-integrations", {
+                method: "POST",
+                body: { manifest },
+            });
+        });
+    }))
+        .addCommand(new Command("list")
+        .description("List custom HTTP integrations for the active organization.")
+        .option("--slug <slug>", "Filter to one custom integration slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("custom-integrations list", options, () => {
+            const params = new URLSearchParams();
+            if (readOption(options.slug))
+                params.set("slug", readOption(options.slug) ?? "");
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/custom-integrations${suffix ? `?${suffix}` : ""}`);
+        });
+    }));
     program
         .command("tools")
         .description("Tool catalog commands.")
         .addCommand(new Command("search")
         .description("Search the tool catalog.")
         .argument("[query]", "Search text.")
-        .option("--verbosity <verbosity>", "summary or full. Defaults to summary.")
+        .option("--verbosity <verbosity>", "minimal, summary, or full. Defaults to summary. Use minimal for high-fanout discovery sweeps that need to stay under the MCP token budget.")
         .option("--only-runnable", "Only return tools runnable by the active organization.")
         .option("--capability <tag>", "Filter by capability tag, such as mobile_phone.")
         .option("--json", "Print a JSON envelope.")
@@ -1743,11 +2253,48 @@ export function createProgram() {
         .action(async (toolId, options) => {
         await handleAsyncAction("tools get", options, async () => requestOxygen(`/api/cli/tools/${encodeURIComponent(toolId)}`));
     }))
+        .addCommand(new Command("enums")
+        .description("Provider enum catalogs for fields that accept normalized values.")
+        .addCommand(new Command("list")
+        .description("List enum catalogs for a provider (or all providers).")
+        .option("--provider <provider>", "Filter to a single provider, e.g. blitzapi.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tools enums list", options, () => {
+            const params = new URLSearchParams();
+            const provider = readOption(options.provider);
+            if (provider)
+                params.set("provider", provider);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/tools/enums${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Fetch the accepted values for one provider enum catalog. Use this before drafting payloads with enumRef fields.")
+        .argument("<provider>", "Provider name, e.g. blitzapi.")
+        .argument("<enum_ref>", "Enum reference id, e.g. industry, employee_range, country_code.")
+        .option("-q, --query <query>", "Case-insensitive substring or token search across the catalog values.")
+        .option("--limit <limit>", "Maximum number of values to return. Defaults to 100. Maximum 1000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (provider, enumRef, options) => {
+        await handleAsyncAction("tools enums get", options, () => {
+            const params = new URLSearchParams();
+            const query = readOption(options.query);
+            const limit = readOption(options.limit);
+            if (query)
+                params.set("q", query);
+            if (limit)
+                params.set("limit", limit);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/tools/enums/${encodeURIComponent(provider)}/${encodeURIComponent(enumRef)}${suffix ? `?${suffix}` : ""}`);
+        });
+    })))
         .addCommand(new Command("run")
         .description("Run an executable Oxygen tool through the HTTPS API.")
         .argument("<tool_id>", "Tool id.")
         .requiredOption("--input-json <json>", "Tool input as a JSON object.")
         .option("--mode <mode>", "Execution mode: live, dry-run, or dry_run. Mutating tools default to dry-run.")
+        .option("--credential-mode <mode>", "Credential mode: managed, user_api_key, or user_oauth.")
         .option("--org <organization_id>", "Optional organization id. Must match the stored CLI token.")
         .option("--org-id <organization_id>", "Optional organization id. Must match the stored CLI token.")
         .option("--connection-id <connection_id>", "Specific integration connection id. Defaults to the org's active default connection.")
@@ -1757,12 +2304,13 @@ export function createProgram() {
         .option("--oxygen-cursor <cursor>", "Short Oxygen cursor returned as oxygen_next_cursor by a previous tool run.")
         .option("--json", "Print a JSON envelope.")
         .action(async (toolId, options) => {
-        await handleAsyncAction("tools run", options, async () => requestOxygen("/api/cli/tools/run", {
+        await handleAsyncAction("tools run", options, () => requestOxygen("/api/cli/tools/run", {
             method: "POST",
             body: {
                 tool_id: toolId,
                 input: parseJsonObject(options.inputJson),
                 ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                ...(readOption(options.credentialMode) ? { credential_mode: readOption(options.credentialMode) } : {}),
                 ...(readOption(options.org) ? { org_id: readOption(options.org) } : {}),
                 ...(readOption(options.orgId) ? { org_id: readOption(options.orgId) } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
@@ -1791,7 +2339,7 @@ export function createProgram() {
         .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
         .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
         .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
-        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact,ai_ark; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact,ai_ark.")
         .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
         .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
         .option("--limit <n>", "Rows to estimate. Defaults to 10.")
@@ -1822,7 +2370,7 @@ export function createProgram() {
         .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
         .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
         .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
-        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact,ai_ark; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact,ai_ark.")
         .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
         .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
         .option("--limit <n>", "Rows to queue.")
@@ -1831,27 +2379,49 @@ export function createProgram() {
         .option("--selection-json <json>", "Full row selection object for server-side row selection.")
         .option("--only-missing", "Queue rows missing the capability's normalized output when no explicit selection is passed.")
         .option("--force", "Re-run rows with an existing target enrichment value.")
+        .option("--max-concurrency <n>", "Maximum concurrent row items for this enrichment run. Defaults to 20.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, options) => {
+        const maxConcurrency = readPositiveInt(options.maxConcurrency);
         await handleAsyncAction("enrich-column run", options, async () => requestOxygen("/api/cli/enrich-column/run", {
             method: "POST",
             body: {
                 ...buildEnrichColumnBody(table, options),
                 max_credits: readPositiveNumber(options.maxCredits),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
                 ...(options.force ? { force: true } : {}),
             },
         }));
     }));
     program
-        .command("integrations")
-        .description("Integration connection and event trigger commands.")
-        .addCommand(new Command("events")
-        .description("Configure provider events that can trigger workflows.")
-        .addCommand(new Command("list")
-        .description("List supported provider events and this org's enabled subscriptions.")
-        .option("--source <source>", "Filter by event source, such as hubspot or composio.gmail.")
-        .option("--event <event>", "Filter by event type, such as contact.created.")
-        .option("--toolkit <id>", "Filter by toolkit / integration id, such as gmail.")
+        .command("enrichment")
+        .description("High-level enrichment column definition helpers.")
+        .addCommand(new Command("apply-default-cascade")
+        .description("Patch an existing enrichment column to the server-side default provider cascade for its intent.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Enrichment column id or key.")
+        .option("--dry-run", "Return the would-be merged definition without writing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("enrichment apply-default-cascade", options, () => requestOxygen("/api/cli/enrichment/apply-default-cascade", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                ...(options.dryRun ? { dry_run: true } : {}),
+            },
+        }));
+    }));
+    program
+        .command("integrations")
+        .description("Integration connection and event trigger commands.")
+        .addCommand(new Command("events")
+        .description("Configure provider events that can trigger workflows.")
+        .addCommand(new Command("list")
+        .description("List supported provider events and this org's enabled subscriptions.")
+        .option("--source <source>", "Filter by event source, such as hubspot or composio.gmail.")
+        .option("--event <event>", "Filter by event type, such as contact.created.")
+        .option("--toolkit <id>", "Filter by toolkit / integration id, such as gmail.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("integrations events list", options, async () => {
@@ -1917,6 +2487,33 @@ export function createProgram() {
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("deliveries")
+        .description("List recent provider webhook deliveries (Composio triggers, HubSpot webhooks, etc.) and the workflow runs they kicked off.")
+        .option("--source <source>", "Filter by event source, such as hubspot or composio.gmail.")
+        .option("--event <event>", "Filter by event type, such as contact.created or GMAIL_NEW_GMAIL_MESSAGE.")
+        .option("--toolkit <id>", "Filter by integration/toolkit id, such as gmail or hubspot.")
+        .option("--connection-id <connection_id>", "Filter by a specific integration connection id.")
+        .option("--result <result>", "Filter by delivery result: success or error.")
+        .option("--limit <n>", "Maximum deliveries to return (1-200). Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations events deliveries", options, () => {
+            const query = new URLSearchParams();
+            const set = (key, value) => {
+                const trimmed = readOption(value);
+                if (trimmed)
+                    query.set(key, trimmed);
+            };
+            set("source", options.source);
+            set("event", options.event);
+            set("toolkit", options.toolkit);
+            set("connection_id", options.connectionId);
+            set("result", options.result);
+            set("limit", options.limit);
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/integrations/events/deliveries${suffix}`);
+        });
     })))
         .addCommand(new Command("list")
         .description("List supported Composio integrations and this org's connections.")
@@ -1944,11 +2541,16 @@ export function createProgram() {
         .addCommand(new Command("disconnect")
         .description("Disconnect a Composio integration.")
         .argument("<integration_id>", "Integration id, such as 'slack'.")
+        .option("--connection-id <id>", "Disconnect a specific connected account when multiple exist.")
         .option("--json", "Print a JSON envelope.")
         .action(async (integrationId, options) => {
-        await handleAsyncAction("integrations disconnect", options, async () => requestOxygen("/api/cli/integrations/composio/disconnect", {
+        const connectionId = readOption(options.connectionId)?.trim();
+        await handleAsyncAction("integrations disconnect", options, () => requestOxygen("/api/cli/integrations/composio/disconnect", {
             method: "POST",
-            body: { integration_id: integrationId },
+            body: {
+                integration_id: integrationId,
+                ...(connectionId ? { connection_id: connectionId } : {}),
+            },
         }));
     }))
         .addCommand(new Command("actions")
@@ -2217,6 +2819,7 @@ export function createProgram() {
         .addCommand(new Command("failures")
         .description("List failed workflow runs and trigger scheduler failures.")
         .option("--limit <n>", "Maximum failures per group. Defaults to 25; server cap is 100.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows failures", options, async () => {
@@ -2224,8 +2827,10 @@ export function createProgram() {
             const limit = readPositiveInt(options.limit);
             if (limit)
                 query.set("limit", String(limit));
+            if (options.includeBundle)
+                query.set("include_bundle", "true");
             const suffix = query.toString() ? `?${query.toString()}` : "";
-            return requestOxygen(`/api/cli/workflows/failures${suffix}`);
+            return prepareWorkflowCliOutput(await requestOxygen(`/api/cli/workflows/failures${suffix}`), options);
         });
     }))
         .addCommand(new Command("run")
@@ -2281,14 +2886,28 @@ export function createProgram() {
     }));
     program
         .command("skills")
-        .description("Agent skill installation commands.")
+        .description("Agent skill discovery and installation commands.")
+        .addCommand(new Command("list")
+        .description("List Oxygen agent skills available from the public skill index.")
+        .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("skills list", options, async () => listAgentSkills(options));
+    }))
+        .addCommand(new Command("doctor")
+        .description("Check Oxygen skill index reachability and local installer prerequisites.")
+        .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("skills doctor", options, async () => doctorAgentSkills(options));
+    }))
         .addCommand(new Command("install")
         .description("Install Oxygen agent skills into local agent skill directories.")
         .option("--api-url <url>", "Oxygen app URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
-        .option("--agents <agents>", "Space or comma separated agents. Defaults to codex, claude-code, and cursor.")
+        .option("--agents <agents...>", "Space or comma separated agents. Defaults to codex, claude-code, and cursor.")
         .option("--skill <skill>", "Skill name or '*'. Defaults to '*'.")
         .option("--project", "Install into the current project instead of global agent scope.")
-        .option("--copy", "Copy skill files instead of symlinking when supported by npx skills.")
+        .option("--copy", "Copy skill files instead of symlinking when supported by npx skills. Default on Windows, where symlinks need Developer Mode or admin.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("skills install", options, async () => installAgentSkills(options));
@@ -2466,11 +3085,11 @@ async function importTranspiledWorkflowModule(absolutePath, source) {
             esModuleInterop: true,
         },
     }).outputText;
-    const workflowsUrl = await import.meta.resolve("@oxygen/workflows");
+    const dir = mkdtempSync(`${tmpdir()}/oxygen-workflow-`);
+    const workflowsUrl = await resolveWorkflowRuntimeModuleUrl(dir);
     const rewritten = transpiled
         .replaceAll("from \"@oxygen/workflows\"", `from "${workflowsUrl}"`)
         .replaceAll("from '@oxygen/workflows'", `from "${workflowsUrl}"`);
-    const dir = mkdtempSync(`${tmpdir()}/oxygen-workflow-`);
     const compiledPath = `${dir}/workflow.mjs`;
     writeFileSync(compiledPath, rewritten, "utf8");
     try {
@@ -2480,6 +3099,84 @@ async function importTranspiledWorkflowModule(absolutePath, source) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+async function resolveWorkflowRuntimeModuleUrl(tempDir) {
+    try {
+        return await import.meta.resolve("@oxygen/workflows");
+    }
+    catch {
+        const shimPath = `${tempDir}/oxygen-workflows-shim.mjs`;
+        writeFileSync(shimPath, workflowRuntimeShimSource(), "utf8");
+        return pathToFileURL(shimPath).href;
+    }
+}
+function workflowRuntimeShimSource() {
+    return `
+export function defineWorkflow(input) {
+  return {
+    __oxygen_workflow_definition: true,
+    id: input.id,
+    name: input.name,
+    ...(input.status ? { status: input.status } : {}),
+    ...(input.specification ? { specification: input.specification } : {}),
+    ...(input.trigger ? { trigger: input.trigger } : {}),
+    ...(input.inputSchema ? { inputSchema: input.inputSchema } : {}),
+    steps: input.steps,
+  };
+}
+export function apiTrigger(input = {}) {
+  return { type: "api", ...(input.status ? { status: input.status } : {}) };
+}
+export function webhookTrigger(input) {
+  return {
+    type: "webhook",
+    trigger_id: input.id,
+    ...(input.name !== undefined ? { trigger_name: input.name } : {}),
+    secret_required: input.secret ?? true,
+    ...(input.idempotencyKeyPath !== undefined ? { idempotency_key_path: input.idempotencyKeyPath } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function cronTrigger(input) {
+  return {
+    type: "cron",
+    cron: input.cron,
+    ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function eventTrigger(input) {
+  return {
+    type: "event",
+    source: input.source,
+    event: input.event,
+    ...(input.filters ? { filters: input.filters } : {}),
+    ...(input.idempotencyKeyPath !== undefined ? { idempotency_key_path: input.idempotencyKeyPath } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function transformStep(input) {
+  return {
+    __oxygen_workflow_step: true,
+    kind: "transform",
+    id: input.id,
+    ...(input.description ? { description: input.description } : {}),
+    run: input.run,
+  };
+}
+export function toolStep(input) {
+  return {
+    __oxygen_workflow_step: true,
+    kind: "tool",
+    id: input.id,
+    ...(input.description ? { description: input.description } : {}),
+    tool: input.tool,
+    ...(input.effect ? { effect: input.effect } : {}),
+    ...(input.mode ? { mode: input.mode } : {}),
+    payload: input.payload,
+  };
+}
+`;
+}
 async function tailWorkflowRun(runId, options) {
     const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
         ?? WORKFLOW_TAIL_DEFAULT_TIMEOUT_SECONDS;
@@ -2508,12 +3205,23 @@ async function tailWorkflowRun(runId, options) {
         }
         const remainingMs = deadline - Date.now();
         if (remainingMs <= 0) {
+            const worker = isRecord(run.worker) ? run.worker : null;
+            const queuedWithoutWorker = status === "queued"
+                && worker !== null
+                && worker.active === null
+                && worker.lastClaim === null;
             throw new OxygenError("workflow_tail_timeout", "Timed out waiting for workflow run to finish.", {
                 details: {
                     workflow_run_id: runId,
                     status: status ?? null,
                     timeout_seconds: timeoutSeconds,
                     polls,
+                    ...(queuedWithoutWorker
+                        ? {
+                            worker_status: "queued_no_worker",
+                            guidance: "No worker has claimed this workflow run. Check `oxygen worker queue-stats --json` for BullMQ and workflow queue health.",
+                        }
+                        : {}),
                 },
                 exitCode: 1,
             });
@@ -2613,6 +3321,72 @@ function readTableRunSelection(options) {
         exitCode: 1,
     });
 }
+function tableRunsListPath(options) {
+    const table = readOption(options.table);
+    if (!table) {
+        throw new OxygenError("invalid_table_run", "Pass --table <table>.", {
+            exitCode: 1,
+        });
+    }
+    const query = new URLSearchParams({ table });
+    const status = readOption(options.status);
+    const limit = readPositiveInt(options.limit);
+    if (status)
+        query.set("status", status);
+    if (limit)
+        query.set("limit", String(limit));
+    if (options.traceId)
+        query.set("trace_id", options.traceId);
+    return `/api/cli/table-action-runs?${query.toString()}`;
+}
+async function requestColumnsRun(body, table, options) {
+    const traceId = randomUUID();
+    try {
+        return await requestOxygen("/api/cli/tables/columns/run", {
+            method: "POST",
+            body,
+            traceId,
+        });
+    }
+    catch (error) {
+        if (!options.background || !isNetworkTimeoutError(error))
+            throw error;
+        const recovered = await recoverBackgroundColumnRun(table, traceId);
+        if (!recovered)
+            throw error;
+        return recovered;
+    }
+}
+async function recoverBackgroundColumnRun(table, traceId) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const listed = await requestOxygen(tableRunsListPath({ table, status: "active", limit: "5", traceId }), { timeoutMs: 30_000 });
+        const runs = Array.isArray(listed.runs)
+            ? listed.runs.filter(isRecord)
+            : [];
+        const run = runs[0];
+        if (run) {
+            const actionRunId = readRecordString(run, "action_run_id") ?? readRecordString(run, "id");
+            const workspaceRunId = readRecordString(run, "workspace_run_id") ?? readRecordString(run, "runId");
+            return {
+                ...run,
+                ...(actionRunId ? { action_run_id: actionRunId } : {}),
+                ...(workspaceRunId ? { workspace_run_id: workspaceRunId } : {}),
+                timeout_recovered: true,
+                recovery: {
+                    reason: "columns_run_background_timeout",
+                    trace_id: traceId,
+                    lookup_command: `oxygen table-runs list --table ${table} --status active --json`,
+                },
+            };
+        }
+        if (attempt < 2)
+            await sleep(750);
+    }
+    return null;
+}
+function isNetworkTimeoutError(error) {
+    return error instanceof OxygenError && error.code === "network_timeout";
+}
 function readCompaniesEnrichBody(table, options) {
     const body = { table };
     const fields = readCsvOption(options.missingFields);
@@ -2721,58 +3495,6 @@ function normalizeSessionStepStatus(value) {
         exitCode: 1,
     });
 }
-function installAgentSkills(options) {
-    const apiUrl = normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl());
-    const indexUrl = `${apiUrl}/.well-known/skills/index.json`;
-    const agents = readWords(options.agents ?? "codex claude-code cursor");
-    const skill = readOption(options.skill) ?? "*";
-    const args = [
-        "skills",
-        "add",
-        indexUrl,
-        "--agents",
-        ...agents,
-        "--yes",
-        "--skill",
-        skill,
-        "--full-depth",
-    ];
-    if (!options.project)
-        args.push("--global");
-    if (options.copy)
-        args.push("--copy");
-    let output = "";
-    try {
-        output = execFileSync("npx", args, {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-    }
-    catch (error) {
-        const failure = error;
-        throw new OxygenError("skills_install_failed", "Unable to install Oxygen agent skills.", {
-            details: {
-                index_url: indexUrl,
-                stdout: failure.stdout?.slice(0, 2000) ?? "",
-                stderr: failure.stderr?.slice(0, 2000) ?? failure.message ?? "unknown",
-            },
-            exitCode: 1,
-        });
-    }
-    return {
-        indexUrl,
-        agents,
-        skill,
-        scope: options.project ? "project" : "global",
-        output,
-    };
-}
-function readWords(value) {
-    return value
-        .split(/[,\s]+/)
-        .map((entry) => entry.trim())
-        .filter(Boolean);
-}
 async function importRows(table, options) {
     const format = normalizeRowsFormat(options.format, inferRowsFileFormat(options.file));
     const parsedRows = await readRowsFile(options.file, format, options.sheet);
@@ -2781,19 +3503,26 @@ async function importRows(table, options) {
             exitCode: 1,
         });
     }
-    const target = await prepareImportTarget(table, options, parsedRows);
     const batchSize = normalizeImportBatchSize(options.batchSize);
     const sourceHash = hashImportFile(options.file);
     const shouldUseBackground = options.background
-        || (!options.sync && target.rows.length > LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD);
+        || (!options.sync && parsedRows.length > LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD);
     if (shouldUseBackground) {
-        return enqueueImportRows(target.tableRef, options, target.rows, format, batchSize, {
+        // Prefer the object-storage fast path: upload the raw file once via a
+        // presigned URL (no request-body limit) so the worker COPY-loads it.
+        // Falls back to the inline multipart import when storage is unconfigured.
+        const staged = await tryEnqueueStagedFileImport(table, options, format, parsedRows, {
+            autoBackground: !options.background,
+            sourceHash,
+        });
+        if (staged)
+            return staged;
+        return enqueueImportFile(table, options, format, batchSize, {
             autoBackground: !options.background,
             sourceHash,
-            createdTable: target.createdTable,
-            ...(target.upsertKey ? { upsertKey: target.upsertKey } : {}),
         });
     }
+    const target = await prepareImportTarget(table, options, parsedRows);
     let rowCount = 0;
     let insertedCount = 0;
     let updatedCount = 0;
@@ -2859,6 +3588,7 @@ async function prepareImportTarget(table, options, parsedRows) {
             createdTable: null,
             tableWebUrl: null,
             upsertKey: options.upsertKey,
+            sourceKeyMap: null,
         };
     }
     const normalized = normalizeRowsForNewTable(parsedRows);
@@ -2885,101 +3615,147 @@ async function prepareImportTarget(table, options, parsedRows) {
         createdTable: created,
         tableWebUrl: createdWebUrl ?? tableWebUrl(createdSlug),
         upsertKey: normalizeCreatedTableUpsertKey(options.upsertKey, normalized.keyBySource),
+        sourceKeyMap: normalized.keyBySource,
     };
 }
-async function enqueueImportRows(table, options, rows, format, batchSize, context) {
-    const batches = chunk(rows, batchSize);
-    const maxConcurrency = readPositiveInt(options.maxConcurrency);
-    const upsertKey = context.upsertKey ?? options.upsertKey;
-    const idempotencyKey = buildImportIdempotencyKey({
-        table,
-        sourceHash: context.sourceHash,
-        format,
-        mode: upsertKey ? "upsert" : "insert",
-        upsertKey: upsertKey ?? null,
-        batchSize,
-    });
-    const created = await requestOxygen("/api/cli/table-ingestion-runs", {
+async function tryEnqueueStagedFileImport(// skipcq: JS-R1005
+table, options, format, parsedRows, context) {
+    if (options.create && table) {
+        throw new OxygenError("invalid_import_target", "Pass either a table argument or --create, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (!options.create && !table) {
+        throw new OxygenError("invalid_import_target", "Pass a table argument or --create <name>.", {
+            exitCode: 1,
+        });
+    }
+    const fileBuffer = readFileSync(options.file);
+    const filename = basename(options.file);
+    // Probe for a presigned upload URL. If object storage isn't configured the
+    // server returns object_storage_not_configured; signal the caller to fall
+    // back to the inline multipart import by returning null.
+    let presigned;
+    try {
+        presigned = await requestOxygen("/api/cli/tables/import-url", {
+            method: "POST",
+            body: { file_name: filename, byte_length: fileBuffer.byteLength },
+        });
+    }
+    catch (error) {
+        if (error instanceof OxygenError && error.code === "object_storage_not_configured") {
+            return null;
+        }
+        throw error;
+    }
+    const uploadUrl = readRecordString(presigned, "upload_url");
+    const storageKey = readRecordString(presigned, "storage_key");
+    const storageBucket = readRecordString(presigned, "storage_bucket");
+    const storageProvider = readRecordString(presigned, "storage_provider") ?? "s3";
+    if (!uploadUrl || !storageKey)
+        return null;
+    // Create the table for --create (or resolve the existing ref) before the
+    // upload so a presign success always pairs with a real target.
+    const target = await prepareImportTarget(table, options, parsedRows);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 300_000);
+    let putResponse;
+    try {
+        putResponse = await fetch(uploadUrl, {
+            method: "PUT",
+            body: new Uint8Array(fileBuffer),
+            signal: controller.signal,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!putResponse.ok) {
+        throw new OxygenError("import_upload_failed", `Uploading the import file to object storage failed (HTTP ${putResponse.status}).`, { details: { status: putResponse.status }, exitCode: 1 });
+    }
+    const result = await requestOxygen("/api/cli/tables/import-staged", {
         method: "POST",
+        timeoutMs: 120_000,
         body: {
-            table,
-            source_type: `file.${format}`,
-            mode: upsertKey ? "upsert" : "insert",
-            ...(upsertKey ? { upsert_key: upsertKey } : {}),
-            expected_item_count: batches.length,
-            ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
-            metadata: {
-                command: "tables import",
-                file_name: basename(options.file),
-                format,
-                ...(options.sheet ? { sheet: options.sheet } : {}),
-                requested_row_count: rows.length,
-                batch_size: batchSize,
-                auto_background: context.autoBackground,
-                source_hash: context.sourceHash,
-                idempotency_key: idempotencyKey,
-            },
+            table: target.tableRef,
+            storage_provider: storageProvider,
+            storage_bucket: storageBucket,
+            storage_key: storageKey,
+            format,
+            file_name: filename,
+            byte_length: fileBuffer.byteLength,
+            sha256: context.sourceHash,
+            row_count: parsedRows.length,
+            ...(target.upsertKey ? { upsert_key: target.upsertKey } : {}),
+            ...(target.sourceKeyMap ? { source_key_map: target.sourceKeyMap } : {}),
         },
     });
-    const ingestionRunId = readRequiredResponseString(created, "id");
-    if (isTerminalTableIngestionStatus(readRecordString(created, "status"))) {
-        return {
-            ingestionRun: created,
-            ingestionRunId,
-            ...(context.createdTable ? { createdTable: context.createdTable } : {}),
-            ...(readRecordString(created, "web_url") ? { web_url: readRecordString(created, "web_url") } : {}),
-            table_web_url: tableWebUrl(table),
-            background: true,
-            autoBackground: context.autoBackground,
-            sourceType: `file.${format}`,
-            rowCount: rows.length,
-            enqueuedItems: 0,
-            duplicatePositions: 0,
-            batchCount: batches.length,
-            batchSize,
-            mode: upsertKey ? "upsert" : "insert",
-            upsertKey: upsertKey ?? null,
-            idempotencyKey,
-        };
+    emitQueueWaitStderrNote(readRecord(result, "queue_wait"));
+    return {
+        ...result,
+        ...(target.createdTable ? { createdTable: target.createdTable } : {}),
+        ...(target.tableWebUrl ? { table_web_url: target.tableWebUrl } : {}),
+        background: true,
+        autoBackground: context.autoBackground,
+        import_engine: "bulk_file_v1",
+        storage_provider: storageProvider,
+    };
+}
+async function enqueueImportFile(table, options, format, batchSize, context) {
+    if (options.create && table) {
+        throw new OxygenError("invalid_import_target", "Pass either a table argument or --create, not both.", {
+            exitCode: 1,
+        });
     }
-    let insertedItems = 0;
-    let duplicatePositions = 0;
-    let latestRun = created;
-    for (const [index, batch] of batches.entries()) {
-        const appended = await requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(ingestionRunId)}/items`, {
-            method: "POST",
-            body: {
-                items: [
-                    {
-                        position: index,
-                        payload: { rows: batch },
-                    },
-                ],
-            },
+    if (!options.create && !table) {
+        throw new OxygenError("invalid_import_target", "Pass a table argument or --create <name>.", {
+            exitCode: 1,
         });
-        insertedItems += readCount(appended.inserted);
-        duplicatePositions += readCount(appended.duplicatePositions);
-        latestRun = appended.run ?? latestRun;
     }
+    const fileBuffer = readFileSync(options.file);
+    const filename = basename(options.file);
+    const form = new FormData();
+    const file = new File([fileBuffer], filename);
+    form.append("file", file, filename);
+    form.append("filename", filename);
+    form.append("format", format);
+    form.append("batch_size", String(batchSize));
+    form.append("auto_background", String(context.autoBackground));
+    form.append("source_hash", context.sourceHash);
+    if (table)
+        form.append("table", table);
+    if (options.create)
+        form.append("table_name", options.create);
+    const project = readOption(options.project);
+    if (project)
+        form.append("project", project);
+    const upsertKey = readOption(options.upsertKey);
+    if (upsertKey)
+        form.append("upsert_key", upsertKey);
+    if (options.sheet)
+        form.append("sheet", options.sheet);
+    const maxConcurrency = readPositiveInt(options.maxConcurrency);
+    if (maxConcurrency)
+        form.append("max_concurrency", String(maxConcurrency));
+    const result = await requestOxygen("/api/cli/tables/import-file", {
+        method: "POST",
+        timeoutMs: 300_000,
+        formData: form,
+    });
+    emitQueueWaitStderrNote(readRecord(result, "queue_wait"));
     return {
-        ingestionRun: latestRun,
-        ingestionRunId,
-        ...(context.createdTable ? { createdTable: context.createdTable } : {}),
-        ...(readRecordString(latestRun, "web_url") ? { web_url: readRecordString(latestRun, "web_url") } : {}),
-        table_web_url: tableWebUrl(table),
+        ...result,
         background: true,
         autoBackground: context.autoBackground,
-        sourceType: `file.${format}`,
-        rowCount: rows.length,
-        enqueuedItems: insertedItems,
-        duplicatePositions,
-        batchCount: batches.length,
-        batchSize,
-        mode: upsertKey ? "upsert" : "insert",
-        upsertKey: upsertKey ?? null,
-        idempotencyKey,
     };
 }
+function emitQueueWaitStderrNote(queueWait) {
+    if (!queueWait)
+        return;
+    const note = readRecordString(queueWait, "note");
+    if (note)
+        process.stderr.write(`note: ${note}\n`);
+}
 async function waitForTableIngestionRun(runId, options) {
     const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
         ?? TABLE_INGESTION_WAIT_DEFAULT_TIMEOUT_SECONDS;
@@ -3079,94 +3855,462 @@ async function exportRows(table, options) {
         ...(formatted.rescuedCount > 0 ? { rescuedNumericCells: formatted.rescuedCount } : {}),
     };
 }
-async function readRowsFile(path, format, sheet) {
-    return await parseRowsFileBuffer(readFileSync(path), format, sheet ? { sheet } : {});
-}
-function normalizeCreatedTableUpsertKey(value, keyBySource) {
-    if (!value)
-        return undefined;
-    return keyBySource[value] ?? value;
-}
-function normalizeExportRowsFormat(value) {
-    const normalized = value?.trim().toLowerCase() || "json";
-    if (normalized === "json"
-        || normalized === "jsonl"
-        || normalized === "csv"
-        || normalized === "table")
-        return normalized;
-    throw new OxygenError("invalid_format", "Export format must be json, jsonl, csv, or table.", {
-        details: { format: value },
-        exitCode: 1,
-    });
+const TABLE_BUNDLE_SCHEMA_VERSION = 1;
+const TABLE_BUNDLE_MAX_PAGE_SIZE = 1000;
+const TABLE_BUNDLE_DEFAULT_PAGE_SIZE = 500;
+async function exportTableBundle(table, options) {
+    const pageSize = Math.min(readPositiveInt(options.pageSize) ?? TABLE_BUNDLE_DEFAULT_PAGE_SIZE, TABLE_BUNDLE_MAX_PAGE_SIZE);
+    // Pull the canonical schema (incl. enrichment/tool definitions and
+    // semantic types) from `describe`; the paginated query response only
+    // surfaces the user-visible projection.
+    const describe = await requestOxygen("/api/cli/tables/describe", { method: "POST", body: { table } });
+    const tableMeta = describe.table ?? null;
+    const columns = (describe.columns ?? []).map(toBundleColumn);
+    const rows = [];
+    let cursor = null;
+    let expectedTotal = null;
+    let pageCount = 0;
+    let hasMoreFlag = false;
+    do {
+        const requestBody = { table, limit: pageSize };
+        if (cursor)
+            requestBody.cursor = cursor;
+        const page = await requestOxygen("/api/cli/tables/query", { method: "POST", body: requestBody });
+        pageCount += 1;
+        if (expectedTotal === null) {
+            expectedTotal = readBundleNumber(page.totalCount) ?? readBundleNumber(page.total_count) ?? null;
+        }
+        for (const row of page.rows ?? [])
+            rows.push(row);
+        cursor = typeof page.nextCursor === "string" && page.nextCursor.length > 0 ? page.nextCursor : null;
+        hasMoreFlag = Boolean(page.hasMore);
+        // Defensive: hasMore=false should always mean cursor=null. If a future
+        // server change ever sets one without the other, stop iterating on
+        // hasMore=false so we don't loop forever.
+        if (!hasMoreFlag)
+            cursor = null;
+    } while (cursor);
+    if (expectedTotal !== null && rows.length !== expectedTotal) {
+        throw new OxygenError("bundle_export_incomplete", "Cursor pagination ended before every row was written. The bundle would be a silent under-export.", {
+            details: {
+                table,
+                totalCount: expectedTotal,
+                exportedCount: rows.length,
+                missing: expectedTotal - rows.length,
+                pages: pageCount,
+            },
+            exitCode: 1,
+        });
+    }
+    const tableId = readRecordString(tableMeta, "id");
+    const tableSlug = readRecordString(tableMeta, "slug");
+    const projectSlug = readRecordString(tableMeta, "projectSlug");
+    const bundle = {
+        schemaVersion: TABLE_BUNDLE_SCHEMA_VERSION,
+        exportedAt: new Date().toISOString(),
+        table: {
+            id: tableId ?? null,
+            slug: tableSlug ?? null,
+            name: readRecordString(tableMeta, "displayName") ?? readRecordString(tableMeta, "name") ?? null,
+            projectSlug: projectSlug ?? null,
+        },
+        columns,
+        rows,
+        totals: {
+            rowCount: rows.length,
+            ...(expectedTotal !== null ? { sourceTotalCount: expectedTotal } : {}),
+            pages: pageCount,
+            pageSize,
+        },
+    };
+    if (options.output) {
+        writeFileSync(options.output, `${JSON.stringify(bundle, null, 2)}\n`);
+    }
+    const summary = {
+        table_id: tableId ?? null,
+        table_slug: tableSlug ?? null,
+        schema_version: TABLE_BUNDLE_SCHEMA_VERSION,
+        column_count: columns.length,
+        row_count: rows.length,
+        pages: pageCount,
+        page_size: pageSize,
+        output: options.output ?? null,
+        ...(tableId ? { web_url: tableWebUrl(tableId) } : tableSlug ? { web_url: tableWebUrl(tableSlug) } : {}),
+    };
+    // When piping to stdout, also emit the full bundle so it can be redirected
+    // into a file. With --output, the file is the source of truth; keep the
+    // stdout response a small summary so it's readable.
+    return options.output ? summary : { ...summary, bundle };
 }
-function formatRows(rows, format, columns) {
-    if (format === "json") {
-        return { content: `${JSON.stringify(rows, null, 2)}\n`, rescuedCount: 0 };
+async function importTableBundle(// skipcq: JS-R1005
+options) {
+    const path = options.file;
+    if (!path || !path.trim()) {
+        throw new OxygenError("invalid_input", "--file is required.", { exitCode: 1 });
     }
-    if (format === "jsonl") {
-        return {
-            content: `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`,
-            rescuedCount: 0,
-        };
-    } // skipcq: JS-0246
-    const keys = [
-        "_row_id",
-        "_created_at",
-        "_updated_at",
-        ...(columns?.map((column) => column.key) ?? []),
-        ...rows.flatMap((row) => Object.keys(row)),
-    ].filter((key, index, all) => all.indexOf(key) === index && rows.some((row) => key in row));
-    if (format === "csv") {
-        return {
-            content: [
-                keys.map(escapeCsvField).join(","),
-                ...rows.map((row) => keys.map((key) => escapeCsvField(row[key])).join(",")),
-            ].join("\n") + "\n",
-            rescuedCount: 0,
-        };
+    const batchSize = normalizeImportBatchSize(options.batchSize);
+    const raw = readFileSync(resolve(path), "utf8");
+    const bundle = parseBundleFile(raw);
+    const columns = bundle.columns.map(bundleColumnToCreateInput);
+    if (columns.length === 0) {
+        throw new OxygenError("invalid_bundle", "Bundle has no columns; nothing to import.", { exitCode: 1 });
     }
-    // "table": render with type-aware formatting and a Markdown-style frame.
-    const columnByKey = new Map(columns?.map((c) => [c.key, c]) ?? []);
-    let rescuedCount = 0;
-    const headers = keys.map((key) => columnByKey.get(key)?.label ?? key);
-    const formattedRows = rows.map((row) => keys.map((key) => {
-        const column = columnByKey.get(key) ?? null;
-        const formatted = formatCellForDisplay(row[key], column, {
-            surface: "cli",
-            onRescued: () => {
-                rescuedCount += 1;
+    const validColumnKeys = new Set(columns.map((column) => column.key).filter((key) => Boolean(key)));
+    const into = readOption(options.into);
+    const upsertKey = readOption(options.key);
+    // Resuming/appending into an existing table without an upsert key would
+    // duplicate every already-imported row. Require --key so the resume matches
+    // rows instead of re-inserting them.
+    if (into && !upsertKey) {
+        throw new OxygenError("invalid_input", "--into requires --key so rows already imported are matched instead of duplicated. Pass --key <uniqueColumn>.", { details: { into }, exitCode: 1 });
+    }
+    if (upsertKey) {
+        if (upsertKey.startsWith("_")) {
+            throw new OxygenError("invalid_input", "--key must be a workspace column key, not an internal field.", { details: { key: upsertKey }, exitCode: 1 });
+        }
+        if (validColumnKeys.size > 0 && !validColumnKeys.has(upsertKey)) {
+            throw new OxygenError("invalid_input", `--key ${upsertKey} is not a column in this bundle.`, { details: { key: upsertKey, available_keys: [...validColumnKeys] }, exitCode: 1 });
+        }
+    }
+    // Resolve the target table: resume into an existing one (--into), or create a
+    // fresh one from the bundle schema.
+    let newTableId;
+    let newTableSlug;
+    let createdTable;
+    if (into) {
+        const describe = await requestOxygen("/api/cli/tables/describe", { method: "POST", body: { table: into } });
+        const tableMeta = describe.table ?? null;
+        const resolvedId = tableMeta ? readRecordString(tableMeta, "id") : null;
+        if (!resolvedId) {
+            throw new OxygenError("table_not_found", `--into table ${into} was not found in this org.`, { details: { into }, exitCode: 1 });
+        }
+        newTableId = resolvedId;
+        newTableSlug = tableMeta ? readRecordString(tableMeta, "slug") ?? null : null;
+        createdTable = false;
+    }
+    else {
+        const tableName = readOption(options.name) ?? bundle.tableName;
+        if (!tableName) {
+            throw new OxygenError("invalid_bundle", "Bundle has no table.name and no --name override was provided.", { exitCode: 1 });
+        }
+        const createResponse = await requestOxygen("/api/cli/tables", {
+            method: "POST",
+            body: {
+                name: tableName,
+                columns,
+                ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
             },
         });
-        // Pipe and any line-break char are the row/cell delimiters of the
-        // Markdown frame — raw values containing them would corrupt the layout.
-        // Match on the line-break class (not just `\r?\n`) so a standalone `\r`
-        // doesn't slip through and split the row visually.
-        return formatted.replace(/[\r\n]+/g, " ↵ ").replace(/\|/g, "\\|");
-    }));
-    const widths = headers.map((header, columnIndex) => {
-        let max = header.length;
-        for (const row of formattedRows) {
-            const cell = row[columnIndex] ?? "";
-            if (cell.length > max)
-                max = cell.length;
+        const created = readRecord(createResponse, "table");
+        const createdId = readRecordString(createResponse, "table_id")
+            ?? (created ? readRecordString(created, "id") : null);
+        if (!createdId) {
+            throw new OxygenError("invalid_response", "Table create response did not include an id; bundle import cannot proceed.", { exitCode: 1 });
         }
-        return Math.min(max, 60);
-    });
-    const renderRow = (cells) => "| " + cells.map((cell, i) => clipCell(cell, widths[i]).padEnd(widths[i])).join(" | ") + " |";
-    const separator = "|" + widths.map((w) => "-".repeat(w + 2)).join("|") + "|";
-    const lines = [renderRow(headers), separator, ...formattedRows.map(renderRow)];
-    if (rescuedCount > 0) {
+        newTableId = createdId;
+        newTableSlug = readRecordString(createResponse, "table_slug")
+            ?? (created ? readRecordString(created, "slug") : null);
+        createdTable = true;
+    }
+    const stagedRows = bundle.rows.map((row) => stripRowForImport(row, validColumnKeys));
+    // In upsert mode every row must carry the key value; otherwise the upsert
+    // route rejects the whole batch midway. Fail fast with a clear message before
+    // writing anything so we never leave a half-imported table behind for a
+    // predictable data problem.
+    if (upsertKey) {
+        const missingIndex = stagedRows.findIndex((row) => row[upsertKey] === undefined || row[upsertKey] === null);
+        if (missingIndex >= 0) {
+            throw new OxygenError("invalid_bundle", `Row ${missingIndex + 1} is missing a value for the upsert key "${upsertKey}".`, { details: { key: upsertKey, row_number: missingIndex + 1 }, exitCode: 1 });
+        }
+    }
+    const resumeCommand = buildBundleResumeCommand({
+        file: path,
+        tableId: newTableId,
+        key: upsertKey ?? null,
+        batchSize,
+    });
+    let processed = 0;
+    let insertedCount = 0;
+    let updatedCount = 0;
+    for (let offset = 0; offset < stagedRows.length; offset += batchSize) {
+        const batch = stagedRows.slice(offset, offset + batchSize);
+        if (batch.length === 0)
+            continue;
+        try {
+            if (upsertKey) {
+                const response = await requestOxygen("/api/cli/tables/rows/upsert", {
+                    method: "POST",
+                    body: { table: newTableId, key: upsertKey, rows: batch, return: "summary" },
+                });
+                insertedCount += readCount(response.insertedCount);
+                updatedCount += readCount(response.updatedCount);
+            }
+            else {
+                await requestOxygen("/api/cli/tables/rows", {
+                    method: "POST",
+                    body: { table: newTableId, rows: batch },
+                });
+                insertedCount += batch.length;
+            }
+            processed += batch.length;
+        }
+        catch (error) {
+            // A mid-loop failure used to leave a partial table with no way forward.
+            // Surface exactly where it stopped and how to resume so the import is
+            // recoverable instead of a silent half-write.
+            const cause = error instanceof OxygenError
+                ? error.code
+                : error instanceof Error
+                    ? error.message
+                    : "unknown";
+            const recovery = upsertKey
+                ? `Re-run with --into ${newTableId} --key ${upsertKey} to resume — already-imported rows are matched by "${upsertKey}", not duplicated.`
+                : `Resume with: ${resumeCommand}`;
+            throw new OxygenError("bundle_import_incomplete", `Bundle import stopped after ${processed}/${stagedRows.length} rows. ${recovery}`, {
+                details: {
+                    table_id: newTableId,
+                    table_slug: newTableSlug,
+                    rows_total: stagedRows.length,
+                    rows_processed: processed,
+                    failed_batch_offset: offset,
+                    failed_batch_size: batch.length,
+                    mode: upsertKey ? "upsert" : "insert",
+                    ...(upsertKey ? { key: upsertKey } : {}),
+                    resume_command: resumeCommand,
+                    web_url: tableWebUrl(newTableSlug ?? newTableId),
+                    cause,
+                },
+                exitCode: 1,
+            });
+        }
+    }
+    return {
+        table_id: newTableId,
+        table_slug: newTableSlug ?? null,
+        created_table: createdTable,
+        column_count: columns.length,
+        row_count: processed,
+        mode: upsertKey ? "upsert" : "insert",
+        ...(upsertKey
+            ? { upsert_key: upsertKey, inserted_count: insertedCount, updated_count: updatedCount }
+            : {}),
+        source_table: bundle.tableSummary,
+        schema_version: bundle.schemaVersion,
+        web_url: tableWebUrl(newTableSlug ?? newTableId),
+    };
+}
+// Builds the exact CLI command that resumes a failed `import-bundle` into the
+// table it already created. Always targets that table with --into + --key so the
+// resume is idempotent; falls back to a <uniqueColumn> placeholder when the
+// original run had no key (insert mode can't be safely auto-resumed).
+function buildBundleResumeCommand(input) {
+    const fileArg = /\s/.test(input.file) ? `"${input.file}"` : input.file;
+    const parts = [
+        "oxygen tables import-bundle",
+        `--file ${fileArg}`,
+        `--into ${input.tableId}`,
+        `--key ${input.key ?? "<uniqueColumn>"}`,
+    ];
+    // 500 is the default in normalizeImportBatchSize; only echo --batch-size when
+    // the user picked something else, to keep the resume command minimal.
+    if (input.batchSize !== 500) {
+        parts.push(`--batch-size ${input.batchSize}`);
+    }
+    return parts.join(" ");
+}
+function toBundleColumn(column) {
+    // Persist only the fields `tables create` knows how to ingest. Drop ids,
+    // physical column names, archivedAt — those are tenant-local and would
+    // collide on import.
+    return {
+        key: column.key,
+        ...(column.label !== undefined ? { label: column.label } : {}),
+        ...(column.dataType !== undefined ? { dataType: column.dataType } : {}),
+        ...(column.kind !== undefined ? { kind: column.kind } : {}),
+        ...(column.semanticType !== undefined ? { semanticType: column.semanticType } : {}),
+        ...(column.definition !== undefined ? { definition: column.definition } : {}),
+        ...(column.position !== undefined ? { position: column.position } : {}),
+    };
+}
+function bundleColumnToCreateInput(column) {
+    const label = typeof column.label === "string" && column.label.trim()
+        ? column.label.trim()
+        : typeof column.key === "string"
+            ? column.key
+            : null;
+    if (!label) {
+        throw new OxygenError("invalid_bundle", "Bundle column is missing label/key.", {
+            details: { column },
+            exitCode: 1,
+        });
+    }
+    return {
+        label,
+        ...(typeof column.key === "string" ? { key: column.key } : {}),
+        ...(typeof column.dataType === "string" ? { dataType: column.dataType } : {}),
+        ...(typeof column.kind === "string" ? { kind: column.kind } : {}),
+        ...(typeof column.semanticType === "string" ? { semanticType: column.semanticType } : {}),
+        ...(column.definition && typeof column.definition === "object" && !Array.isArray(column.definition)
+            ? { definition: column.definition }
+            : {}),
+    };
+}
+function parseBundleFile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new OxygenError("invalid_bundle", "Bundle file is not valid JSON.", {
+            details: { reason: error instanceof Error ? error.message : "unknown" },
+            exitCode: 1,
+        });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new OxygenError("invalid_bundle", "Bundle file must be a JSON object.", { exitCode: 1 });
+    }
+    const record = parsed;
+    const schemaVersion = typeof record.schemaVersion === "number" ? record.schemaVersion : 1;
+    if (schemaVersion !== TABLE_BUNDLE_SCHEMA_VERSION) {
+        throw new OxygenError("unsupported_bundle_version", `Bundle schema version ${schemaVersion} is not supported by this CLI.`, {
+            details: { supported: TABLE_BUNDLE_SCHEMA_VERSION, got: schemaVersion },
+            exitCode: 1,
+        });
+    }
+    const rawColumns = record.columns;
+    if (!Array.isArray(rawColumns)) {
+        throw new OxygenError("invalid_bundle", "Bundle is missing a columns array.", { exitCode: 1 });
+    }
+    const rawRows = record.rows;
+    if (!Array.isArray(rawRows)) {
+        throw new OxygenError("invalid_bundle", "Bundle is missing a rows array.", { exitCode: 1 });
+    }
+    const tableSummary = record.table && typeof record.table === "object" && !Array.isArray(record.table)
+        ? record.table
+        : null;
+    return {
+        schemaVersion,
+        tableName: tableSummary
+            ? (readRecordString(tableSummary, "name") ?? readRecordString(tableSummary, "displayName"))
+            : null,
+        tableSummary,
+        columns: rawColumns.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)),
+        rows: rawRows.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)),
+    };
+}
+function stripRowForImport(row, validColumnKeys) {
+    const out = {};
+    for (const [key, value] of Object.entries(row)) {
+        if (key === "_row_id" || key === "_created_at" || key === "_updated_at")
+            continue;
+        if (validColumnKeys.size > 0 && !validColumnKeys.has(key))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+function readBundleNumber(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value === "string" && value.trim() && Number.isFinite(Number(value)))
+        return Number(value);
+    return null;
+}
+async function readRowsFile(path, format, sheet) {
+    return await parseRowsFileBuffer(readFileSync(path), format, sheet ? { sheet } : {});
+}
+function normalizeCreatedTableUpsertKey(value, keyBySource) {
+    if (!value)
+        return undefined;
+    return keyBySource[value] ?? value;
+}
+function normalizeExportRowsFormat(value) {
+    const normalized = value?.trim().toLowerCase() || "json";
+    if (normalized === "json"
+        || normalized === "jsonl"
+        || normalized === "csv"
+        || normalized === "table")
+        return normalized;
+    throw new OxygenError("invalid_format", "Export format must be json, jsonl, csv, or table.", {
+        details: { format: value },
+        exitCode: 1,
+    });
+}
+function formatRows(rows, format, columns) {
+    if (format === "json") {
+        return { content: `${JSON.stringify(rows, null, 2)}\n`, rescuedCount: 0 };
+    }
+    if (format === "jsonl") {
+        return {
+            content: `${rows.map((row) => JSON.stringify(row)).join("\n")}\n`,
+            rescuedCount: 0,
+        };
+    } // skipcq: JS-0246
+    const keys = [
+        "_row_id",
+        "_created_at",
+        "_updated_at",
+        ...(columns?.map((column) => column.key) ?? []),
+        ...rows.flatMap((row) => Object.keys(row)),
+    ].filter((key, index, all) => all.indexOf(key) === index && rows.some((row) => key in row));
+    if (format === "csv") {
+        const csvBody = [
+            keys.map(escapeCsvField).join(","),
+            ...rows.map((row) => keys.map((key) => escapeCsvField(row[key])).join(",")),
+        ].join("\n");
+        return {
+            content: `${csvBody}\n`,
+            rescuedCount: 0,
+        };
+    }
+    // "table": render with type-aware formatting and a Markdown-style frame.
+    const columnByKey = new Map(columns?.map((column) => [column.key, column]) ?? []);
+    let rescuedCount = 0;
+    const headers = keys.map((key) => columnByKey.get(key)?.label ?? key);
+    const formattedRows = rows.map((row) => keys.map((key) => {
+        const column = columnByKey.get(key) ?? null;
+        const formatted = formatCellForDisplay(row[key], column, {
+            surface: "cli",
+            onRescued: () => {
+                rescuedCount += 1;
+            },
+        });
+        // Pipe and any line-break char are the row/cell delimiters of the
+        // Markdown frame — raw values containing them would corrupt the layout.
+        // Match on the line-break class (not just `\r?\n`) so a standalone `\r`
+        // doesn't slip through and split the row visually.
+        return formatted.replace(/[\r\n]+/g, " ↵ ").replace(/\|/g, "\\|");
+    }));
+    const widths = headers.map((header, columnIndex) => {
+        let max = header.length;
+        for (const row of formattedRows) {
+            const cell = row[columnIndex] ?? "";
+            if (cell.length > max)
+                max = cell.length;
+        }
+        return Math.min(max, 60);
+    });
+    const renderRow = (cells) => {
+        const padded = cells.map((cell, i) => {
+            const width = widths[i] ?? 0;
+            return clipCell(cell, width).padEnd(width);
+        });
+        return `| ${padded.join(" | ")} |`;
+    };
+    const separator = `|${widths.map((width) => "-".repeat(width + 2)).join("|")}|`;
+    const lines = [renderRow(headers), separator, ...formattedRows.map(renderRow)];
+    if (rescuedCount > 0) {
         lines.push("");
         lines.push(`# Note: reformatted ${rescuedCount} cell${rescuedCount === 1 ? "" : "s"} that look numeric in text columns. Run \`oxygen columns retype --to numeric\` to make this permanent.`);
     }
-    return { content: lines.join("\n") + "\n", rescuedCount };
+    return { content: `${lines.join("\n")}\n`, rescuedCount };
 }
 function clipCell(value, width) {
     if (value.length <= width)
         return value;
     if (width <= 1)
         return value.slice(0, width);
-    return value.slice(0, width - 1) + "…";
+    return `${value.slice(0, width - 1)}…`;
 }
 function escapeCsvField(value) {
     const text = value === null || value === undefined
@@ -3204,15 +4348,6 @@ function isRecord(value) {
 function tableWebUrl(tableIdOrSlug) {
     return `https://oxygen-agent.com/tables/${encodeURIComponent(tableIdOrSlug)}`;
 }
-function readRequiredResponseString(value, key) {
-    const entry = value[key];
-    if (typeof entry === "string" && entry.trim())
-        return entry.trim();
-    throw new OxygenError("invalid_response", `Oxygen API response is missing ${key}.`, {
-        details: { key },
-        exitCode: 1,
-    });
-}
 function normalizeImportBatchSize(value) {
     const batchSize = readPositiveInt(value) ?? 500;
     if (batchSize > 5000) {
@@ -3226,17 +4361,6 @@ function normalizeImportBatchSize(value) {
 function hashImportFile(path) {
     return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
-function buildImportIdempotencyKey(input) {
-    return [
-        "tables-import",
-        input.table,
-        input.format,
-        input.mode,
-        input.upsertKey ?? "none",
-        String(input.batchSize),
-        input.sourceHash,
-    ].join(":");
-}
 function isTerminalTableIngestionStatus(status) {
     return status === "completed"
         || status === "completed_with_errors"
@@ -3252,6 +4376,143 @@ function isTerminalTableActionRunStatus(status) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function resolveActiveProfileWithSource() {
+    const resolution = await resolveActiveProfile();
+    let source;
+    if (globalProfileFlag)
+        source = "flag";
+    else if (INITIAL_OXYGEN_PROFILE_ENV)
+        source = "env";
+    else
+        source = resolution.source === "env" ? "env" : resolution.source;
+    return { resolution, source };
+}
+async function handleWhoamiAction(options) {
+    try {
+        const identity = await requestOxygen("/api/cli/whoami");
+        const context = await resolveActiveProfileWithSource();
+        if (context.resolution.exists) {
+            const existingCredentials = context.resolution.credentials;
+            const cached = existingCredentials?.identity;
+            const cachedOrg = existingCredentials?.activeOrganization ?? cached?.organization ?? null;
+            const orgChanged = !cachedOrg || cachedOrg.id !== identity.organization.id;
+            const userChanged = !cached || cached.user.id !== identity.user.id;
+            if (existingCredentials && (orgChanged || userChanged)) {
+                const refreshed = {
+                    token: existingCredentials.token,
+                    apiUrl: existingCredentials.apiUrl,
+                    activeOrganization: storedOrganizationFromOption(identity.organization),
+                    identity: identityFromWhoami(identity),
+                };
+                if (existingCredentials.authKind)
+                    refreshed.authKind = existingCredentials.authKind;
+                await saveCredentials(refreshed, process.env, {
+                    profile: context.resolution.name,
+                    activate: false,
+                }).catch(() => undefined);
+            }
+        }
+        const data = {
+            ...identity,
+            profile: context.resolution.exists ? context.resolution.name : null,
+            profile_source: context.source,
+        };
+        if (options.json) {
+            writeJson(success("whoami", data));
+            return;
+        }
+        process.stdout.write(formatWhoami(identity, context));
+    }
+    catch (error) {
+        const failure = toFailure("whoami", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleOnboardingStartAction(options) {
+    try {
+        const data = await requestOxygen("/api/cli/onboarding/start", { method: "POST" });
+        if (options.json) {
+            writeJson(success("onboarding start", data));
+            return;
+        }
+        process.stdout.write(formatOnboardingStart(data));
+    }
+    catch (error) {
+        const failure = toFailure("onboarding start", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleOnboardingResetAction(options) {
+    if (!options.confirm) {
+        const failure = toFailure("onboarding reset", new OxygenError("confirmation_required", "Refusing to reset onboarding without --confirm. Re-run with `oxygen onboarding reset --confirm`.", { exitCode: 1 }));
+        writeJson(failure);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const data = await requestOxygen("/api/cli/onboarding/reset", {
+            method: "POST",
+            body: { confirm: true },
+        });
+        if (options.json) {
+            writeJson(success("onboarding reset", data));
+            return;
+        }
+        process.stdout.write(formatOnboardingReset(data));
+    }
+    catch (error) {
+        const failure = toFailure("onboarding reset", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function formatOnboardingReset(data) {
+    const lines = [];
+    lines.push(data.message);
+    if (data.cleared && data.cleared_keys.length > 0) {
+        lines.push(`Cleared keys: ${data.cleared_keys.join(", ")}`);
+    }
+    if (data.next_steps.length > 0) {
+        lines.push("");
+        lines.push("Next:");
+        for (const step of data.next_steps)
+            lines.push(`  - ${step}`);
+    }
+    if (data.web_url) {
+        lines.push("");
+        lines.push(`Continue in the web app: ${data.web_url}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatOnboardingStart(data) {
+    const lines = [];
+    lines.push(`Onboarding ${data.context.already_started ? "already started" : "started"} for ${data.organization.name} (${data.organization.slug ?? data.organization.id}).`);
+    if (data.user.domain) {
+        lines.push(`Inferred work domain: ${data.user.domain}`);
+    }
+    else if (data.user.email) {
+        lines.push(`No work domain inferred from ${data.user.email}; the skill will ask you for one.`);
+    }
+    lines.push("");
+    lines.push(`Filled context sections: ${data.context.filled_sections.length > 0 ? data.context.filled_sections.join(", ") : "(none)"}`);
+    lines.push(`Empty context sections:  ${data.context.empty_sections.length > 0 ? data.context.empty_sections.join(", ") : "(none)"}`);
+    lines.push("");
+    lines.push(`Next: load and follow the \`${data.skill_to_load}\` skill.`);
+    lines.push(`  Skill URL: ${data.skill_url}`);
+    if (data.next_steps.length > 0) {
+        lines.push("");
+        lines.push("Steps:");
+        for (const step of data.next_steps)
+            lines.push(`  - ${step}`);
+    }
+    if (data.web_url) {
+        lines.push("");
+        lines.push(`View context in the web app: ${data.web_url}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
 async function handleLoginAction(options) {
     try {
         const data = await login(options);
@@ -3267,18 +4528,24 @@ async function handleLoginAction(options) {
 }
 async function handleAuthUseTokenAction(options) {
     try {
-        const data = await useAuthToken(options);
+        const data = await applyAuthToken(options);
         if (options.json) {
             writeJson(success("auth use-token", {
                 logged_in: true,
                 profile: data.profile,
                 api_url: data.credentials.apiUrl,
-                user: data.identity.user,
-                organization: data.identity.organization,
+                user: data.loginIdentity.user,
+                organization: data.loginIdentity.activeOrganization,
+                organizations: data.loginIdentity.organizations,
+                selection_required: data.loginIdentity.selectionRequired,
+                renamed: data.renamed,
             }));
             return;
         }
-        process.stdout.write(formatLoginSuccess(data.identity, data.credentials, data.profile));
+        process.stdout.write(formatLoginSuccessForResolved(data.loginIdentity, data.profile, { renamed: data.renamed }));
+        const hint = await buildPostLoginHint(data.profile);
+        if (hint)
+            process.stdout.write(hint);
     }
     catch (error) {
         const failure = toFailure("auth use-token", error);
@@ -3289,6 +4556,38 @@ async function handleAuthUseTokenAction(options) {
         process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
     }
 }
+async function handleOrgUseAction(organization, options, command) {
+    try {
+        const data = await requestOxygen("/api/cli/orgs/select", {
+            method: "POST",
+            body: { organization },
+        });
+        const context = await resolveActiveProfileWithSource();
+        const credentials = context.resolution.credentials;
+        const canPersistSelection = Boolean(context.resolution.exists &&
+            credentials &&
+            (credentials.authKind === "user_session" || credentials.token.startsWith("oxy_user_")) &&
+            data.currentOrganization);
+        if (canPersistSelection && data.currentOrganization) {
+            await updateActiveOrganizationForProfile(context.resolution.name, storedOrganizationFromOption(data.currentOrganization));
+        }
+        const result = {
+            ...data,
+            profile: context.resolution.exists ? context.resolution.name : null,
+            selection_persisted: canPersistSelection,
+        };
+        if (options.json) {
+            writeJson(success(command, result));
+            return;
+        }
+        writeJson(result);
+    }
+    catch (error) {
+        const failure = toFailure(command, error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
 async function handleProfilesListAction(options) {
     try {
         const state = await listCredentialProfiles();
@@ -3311,6 +4610,8 @@ async function handleProfilesListAction(options) {
 async function handleProfilesUseAction(profile, options) {
     try {
         const activeProfile = await switchCredentialProfile(profile);
+        const state = await listCredentialProfiles().catch(() => null);
+        const totalProfiles = state?.profiles.length ?? 1;
         const data = {
             active_profile: activeProfile.name,
             profile: summarizeCredentialProfile(activeProfile, true),
@@ -3319,7 +4620,7 @@ async function handleProfilesUseAction(profile, options) {
             writeJson(success("profiles use", data));
             return;
         }
-        process.stdout.write(formatProfileUseSuccess(data.profile));
+        process.stdout.write(formatProfileUseSuccess(data.profile, { totalProfiles }));
     }
     catch (error) {
         const failure = toFailure("profiles use", error);
@@ -3327,6 +4628,74 @@ async function handleProfilesUseAction(profile, options) {
         process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
     }
 }
+async function handleProfilesEnvAction(profile, options) {
+    try {
+        if (options.unset) {
+            const data = {
+                profile,
+                unset: ["OXYGEN_PROFILE", "OXYGEN_API_URL"],
+            };
+            if (options.json) {
+                writeJson(success("profiles env", data));
+                return;
+            }
+            process.stdout.write("unset OXYGEN_PROFILE OXYGEN_API_URL\n");
+            return;
+        }
+        const state = await listCredentialProfiles();
+        const match = state.profiles.find((entry) => entry.name === profile);
+        if (!match) {
+            throw new OxygenError("profile_not_found", `Oxygen CLI profile "${profile}" is not stored.`, {
+                details: { profile },
+                exitCode: 1,
+            });
+        }
+        const env = {
+            OXYGEN_PROFILE: match.name,
+            OXYGEN_API_URL: match.apiUrl,
+        };
+        if (options.json) {
+            writeJson(success("profiles env", { profile: match.name, env }));
+            return;
+        }
+        process.stdout.write(`export OXYGEN_PROFILE=${shellQuote(match.name)}\n`);
+        process.stdout.write(`export OXYGEN_API_URL=${shellQuote(match.apiUrl)}\n`);
+    }
+    catch (error) {
+        const failure = toFailure("profiles env", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleProfilesCurrentAction(options) {
+    try {
+        const context = await resolveActiveProfileWithSource();
+        const credentials = context.resolution.credentials;
+        const data = {
+            profile: context.resolution.exists ? context.resolution.name : null,
+            profile_source: context.source,
+            api_url: credentials?.apiUrl ?? null,
+            organization: credentials?.identity?.organization ?? null,
+            user: credentials?.identity?.user ?? null,
+            stored: context.resolution.exists,
+        };
+        if (options.json) {
+            writeJson(success("profiles current", data));
+            return;
+        }
+        process.stdout.write(formatProfilesCurrent(context));
+    }
+    catch (error) {
+        const failure = toFailure("profiles current", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function shellQuote(value) {
+    if (/^[A-Za-z0-9_.\-:\/@%+=]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 async function handleLogoutAction(options) {
     try {
         const clearOptions = {};
@@ -3413,27 +4782,39 @@ async function login(options) {
         browser: options.browser !== false,
         json: Boolean(options.json),
     });
-    const credentials = {
-        token,
-        apiUrl,
-    };
-    const identity = await requestOxygen("/api/cli/whoami", { credentials });
-    const saveOptions = {};
-    if (options.profile !== undefined)
-        saveOptions.profile = options.profile;
-    const profile = await saveCredentials(credentials, process.env, saveOptions);
+    const loginIdentity = await resolveLoginIdentity(token, apiUrl);
+    const credentials = loginIdentity.credentials;
+    const explicitProfile = readOption(options.profile) ?? readEnvProfileName();
+    let chosenProfile;
+    let renamed = false;
+    if (explicitProfile) {
+        chosenProfile = explicitProfile;
+    }
+    else {
+        const picked = await pickProfileForLogin(loginIdentity);
+        chosenProfile = picked.name;
+        renamed = picked.renamed;
+    }
+    const profile = await saveCredentials(credentials, process.env, { profile: chosenProfile });
+    const skillsInstall = runAutomaticSkillsInstall({ apiUrl: credentials.apiUrl });
     if (!options.json) {
-        process.stdout.write(formatLoginSuccess(identity, credentials, profile));
+        process.stdout.write(formatLoginSuccessForResolved(loginIdentity, profile, { renamed, skillsInstall }));
+        const hint = await buildPostLoginHint(profile);
+        if (hint)
+            process.stdout.write(hint);
     }
     return {
         logged_in: true,
         profile,
         api_url: credentials.apiUrl,
-        user: identity.user,
-        organization: identity.organization,
+        user: loginIdentity.user,
+        organization: loginIdentity.activeOrganization,
+        organizations: loginIdentity.organizations,
+        selection_required: loginIdentity.selectionRequired,
+        skills_install: skillsInstall,
     };
 }
-async function useAuthToken(options) {
+async function applyAuthToken(options) {
     const token = readOption(options.token);
     if (!token) {
         throw new OxygenError("missing_token", "Pass a CLI API token with --token.", {
@@ -3444,18 +4825,131 @@ async function useAuthToken(options) {
         token,
         apiUrl: normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl()),
     };
+    const loginIdentity = await resolveLoginIdentity(token, credentials.apiUrl);
+    const explicitProfile = readOption(options.profile) ?? readEnvProfileName();
+    let chosenProfile;
+    let renamed = false;
+    if (explicitProfile) {
+        chosenProfile = explicitProfile;
+    }
+    else {
+        const picked = await pickProfileForLogin(loginIdentity);
+        chosenProfile = picked.name;
+        renamed = picked.renamed;
+    }
+    const profile = await saveCredentials(loginIdentity.credentials, process.env, { profile: chosenProfile });
+    return {
+        identity: loginIdentity.whoami,
+        loginIdentity,
+        credentials: loginIdentity.credentials,
+        api_url: loginIdentity.credentials.apiUrl,
+        profile,
+        renamed,
+    };
+}
+async function resolveLoginIdentity(token, apiUrl) {
+    if (isUserSessionToken(token)) {
+        const credentials = {
+            token,
+            apiUrl,
+            authKind: "user_session",
+        };
+        const orgs = await requestOxygen("/api/cli/orgs", { credentials });
+        const activeOrganization = orgs.currentOrganization
+            ? storedOrganizationFromOption(orgs.currentOrganization)
+            : null;
+        credentials.activeOrganization = activeOrganization;
+        credentials.identity = identityFromUserAndOrganization(orgs.user, activeOrganization);
+        return {
+            credentials,
+            whoami: null,
+            user: orgs.user,
+            activeOrganization,
+            organizations: orgs.organizations,
+            selectionRequired: Boolean(orgs.selectionRequired),
+        };
+    }
+    const credentials = {
+        token,
+        apiUrl,
+    };
+    if (token.startsWith("oxy_live_"))
+        credentials.authKind = "org_api_key";
     const identity = await requestOxygen("/api/cli/whoami", { credentials });
-    const saveOptions = {};
-    if (options.profile !== undefined)
-        saveOptions.profile = options.profile;
-    const profile = await saveCredentials(credentials, process.env, saveOptions);
+    const activeOrganization = storedOrganizationFromOption(identity.organization);
+    credentials.authKind = identity.authType === "user_session" ? "user_session" : "org_api_key";
+    credentials.activeOrganization = activeOrganization;
+    credentials.identity = identityFromWhoami(identity);
     return {
-        identity,
         credentials,
-        api_url: credentials.apiUrl,
-        profile,
+        whoami: identity,
+        user: identity.user,
+        activeOrganization,
+        organizations: [{ ...identity.organization, selected: true }],
+        selectionRequired: false,
+    };
+}
+function pickProfileForLogin(loginIdentity) {
+    if (loginIdentity.credentials.authKind === "user_session") {
+        const seed = loginIdentity.activeOrganization?.slug
+            ?? loginIdentity.user.email
+            ?? loginIdentity.user.id;
+        return pickProfileNameForUserSession(loginIdentity.user.id, seed);
+    }
+    const organization = loginIdentity.activeOrganization;
+    if (!organization) {
+        return pickProfileNameForUserSession(loginIdentity.user.id, loginIdentity.user.email ?? loginIdentity.user.id);
+    }
+    const seed = organization.slug?.trim() || organization.id;
+    return pickProfileNameForIdentity(organization.id, seed);
+}
+function readEnvProfileName() {
+    const value = process.env.OXYGEN_PROFILE?.trim();
+    return value ? value : null;
+}
+function identityFromWhoami(response) {
+    return {
+        organization: storedOrganizationFromOption(response.organization),
+        user: {
+            id: response.user.id,
+            email: response.user.email ?? null,
+        },
+        capturedAt: new Date().toISOString(),
+    };
+}
+function identityFromUserAndOrganization(user, organization) {
+    return {
+        organization,
+        user: {
+            id: user.id,
+            email: user.email ?? null,
+        },
+        capturedAt: new Date().toISOString(),
+    };
+}
+function storedOrganizationFromOption(organization) {
+    return {
+        id: organization.id,
+        name: organization.name,
+        slug: organization.slug ?? null,
     };
 }
+function isUserSessionToken(token) {
+    return token.startsWith("oxy_user_");
+}
+async function buildPostLoginHint(activeProfile) {
+    if (output.isTTY !== true || process.env.NO_COLOR) {
+        const state = await listCredentialProfiles().catch(() => null);
+        if (!state || state.profiles.length < 2)
+            return "";
+        return `\n  Pin this terminal:  eval "$(oxygen profiles env ${activeProfile})"\n\n`;
+    }
+    const state = await listCredentialProfiles().catch(() => null);
+    if (!state || state.profiles.length < 2)
+        return "";
+    const styles = ansi(true);
+    return `\n  ${styles.dim("Pin this terminal:")}  ${styles.bold(`eval "$(oxygen profiles env ${activeProfile})"`)}\n\n`;
+}
 async function promptForToken(options) {
     const fallbackLoginUrl = createCliLoginUrl(options.apiUrl);
     if (options.json) {
@@ -3541,7 +5035,7 @@ async function waitForBrowserToken(session) {
 }
 function createCliLoginUrl(apiUrl) {
     const url = new URL("/auth/sign-in", apiUrl);
-    url.searchParams.set("redirect_url", "/settings/api-keys");
+    url.searchParams.set("redirect_url", "/settings/cli");
     url.searchParams.set("source", "oxygen_cli");
     return url.toString();
 }
@@ -3593,21 +5087,87 @@ function startOxygenSpinner(message) {
         },
     };
 }
-function formatLoginSuccess(identity, credentials, profile) {
+function formatLoginSuccessForResolved(loginIdentity, profile, options = {}) {
+    if (loginIdentity.whoami) {
+        return formatLoginSuccess(loginIdentity.whoami, loginIdentity.credentials, profile, options);
+    }
+    if (loginIdentity.activeOrganization) {
+        return formatLoginSuccess({
+            user: loginIdentity.user,
+            organization: loginIdentity.activeOrganization,
+            apiKey: {
+                id: "user_session",
+                name: "CLI user session",
+                tokenPrefix: loginIdentity.credentials.token.slice(0, 17),
+                tokenSuffix: loginIdentity.credentials.token.slice(-4),
+                kind: "user_session",
+            },
+            authType: "user_session",
+        }, loginIdentity.credentials, profile, options);
+    }
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const email = loginIdentity.user.email ?? loginIdentity.user.id;
+    const fingerprint = createHash("sha256")
+        .update(`oxygen-cli:${loginIdentity.credentials.token}`)
+        .digest("hex");
+    const profileLabel = options.renamed
+        ? `${profile} ${styles.dim("(auto-renamed to avoid collision)")}`
+        : profile;
+    const rows = [
+        ["Account", email],
+        ["Organization", "not selected"],
+        ["Profile", profileLabel],
+        ["API", loginIdentity.credentials.apiUrl],
+        ["Token", `${loginIdentity.credentials.token.slice(0, 17)}...${loginIdentity.credentials.token.slice(-4)}`],
+        ["Fingerprint", formatFingerprint(fingerprint)],
+    ];
+    const labelWidth = Math.max(...rows.map(([label]) => label.length));
+    const wordmark = renderBox([
+        "",
+        ...OXYGEN_WORDMARK.split("\n").map(line => styles.green(line)),
+        "",
+    ]);
+    const orgLines = loginIdentity.organizations.length > 0
+        ? [
+            "",
+            "Available organizations:",
+            ...loginIdentity.organizations.map((organization) => `  - ${organization.name}${organization.slug ? ` (${organization.slug})` : ""}`),
+            "",
+            `Select one: ${styles.bold("oxygen orgs use <organization>")}`,
+        ]
+        : [];
+    return [
+        "",
+        wordmark,
+        "",
+        `${styles.green("[OK]")} ${styles.bold("CLI connected")}`,
+        "",
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
+        ...orgLines,
+        "",
+        ...formatAutomaticSkillsInstallStatusLines(options.skillsInstall),
+    ].join("\n");
+}
+function formatLoginSuccess(identity, credentials, profile, options = {}) {
     const email = identity.user.email ?? identity.user.id;
-    const org = identity.organization.name || identity.organization.slug || identity.organization.id;
+    const orgName = identity.organization.name || identity.organization.slug || identity.organization.id;
+    const orgSlug = identity.organization.slug ?? null;
+    const org = orgSlug && orgSlug !== orgName ? `${orgName} (${orgSlug})` : orgName;
     const key = identity.apiKey
         ? `${identity.apiKey.tokenPrefix}...${identity.apiKey.tokenSuffix}`
         : "stored";
     const fingerprint = createHash("sha256")
         .update(`oxygen-cli:${credentials.token}`)
         .digest("hex");
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const profileLabel = options.renamed
+        ? `${profile} ${styles.dim("(auto-renamed to avoid collision)")}`
+        : profile;
     // skipcq: JS-0820 — not a React component; rule misfire on array of tuples
     const rows = [
         ["Account", email],
         ["Organization", org],
-        ["Profile", profile],
+        ["Profile", profileLabel],
         ["API", credentials.apiUrl],
         ["Token", key],
         ["Fingerprint", formatFingerprint(fingerprint)],
@@ -3615,17 +5175,18 @@ function formatLoginSuccess(identity, credentials, profile) {
     const labelWidth = Math.max(...rows.map(([label]) => label.length));
     const wordmark = renderBox([
         "",
-        ...OXYGEN_WORDMARK.split("\n").map(line => c.green(line)),
+        ...OXYGEN_WORDMARK.split("\n").map(line => styles.green(line)),
         "",
     ]);
     return [
         "",
         wordmark,
         "",
-        `${c.green("[OK]")} ${c.bold("CLI connected")}`,
+        `${styles.green("[OK]")} ${styles.bold("CLI connected")}`,
         "",
-        ...rows.map(([label, value]) => `  ${c.dim(label.padEnd(labelWidth))}   ${value}`),
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
         "",
+        ...formatAutomaticSkillsInstallStatusLines(options.skillsInstall),
     ].join("\n");
 }
 function formatFingerprint(hex) {
@@ -3637,6 +5198,9 @@ function summarizeCredentialProfile(profile, active) {
         active,
         api_url: profile.apiUrl,
         token_fingerprint: formatFingerprint(createCredentialFingerprint(profile.token)),
+        organization: profile.activeOrganization ?? profile.identity?.organization ?? null,
+        user: profile.identity?.user ?? null,
+        identity_captured_at: profile.identity?.capturedAt ?? null,
     };
 }
 function createCredentialFingerprint(token) {
@@ -3645,68 +5209,190 @@ function createCredentialFingerprint(token) {
         .digest("hex");
 }
 function formatProfilesList(data) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     if (data.profiles.length === 0) {
         return [
             "",
-            `${c.dim("No stored Oxygen CLI profiles.")}`,
+            `${styles.dim("No stored Oxygen CLI profiles.")}`,
             "",
         ].join("\n");
     }
-    const labelWidth = Math.max(...data.profiles.map((profile) => profile.name.length));
-    return [
+    const nameWidth = Math.max(...data.profiles.map((profile) => profile.name.length));
+    const orgWidth = Math.max(...data.profiles.map((profile) => formatProfileOrgCell(profile).length));
+    const lines = [
         "",
-        `${c.bold("Oxygen CLI Profiles")}`,
+        `${styles.bold("Oxygen CLI Profiles")}`,
         "",
         ...data.profiles.map((profile) => {
             const marker = profile.active ? "*" : " ";
+            const orgCell = formatProfileOrgCell(profile);
             return [
-                `${marker} ${profile.name.padEnd(labelWidth)}`,
-                c.dim(profile.api_url),
-                c.dim(profile.token_fingerprint),
+                `${marker} ${profile.name.padEnd(nameWidth)}`,
+                orgCell.padEnd(orgWidth),
+                styles.dim(profile.api_url),
+                styles.dim(profile.token_fingerprint),
             ].join("  ");
         }),
         "",
-    ].join("\n");
+    ];
+    if (data.profiles.length >= 2) {
+        lines.push(`  ${styles.dim("Pin a terminal:")}  ${styles.bold('eval "$(oxygen profiles env <profile>)"')}`);
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+function formatProfileOrgCell(profile) {
+    if (!profile.organization)
+        return "(unknown org — run `oxygen whoami` to refresh)";
+    const { slug, name } = profile.organization;
+    if (slug && slug !== name)
+        return `${name} (${slug})`;
+    return name || slug || profile.organization.id;
+}
+function formatProfileUseSuccess(profile, options) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const lines = [
+        "",
+        `${styles.green("[OK]")} ${styles.bold("CLI profile selected")}`,
+        "",
+        `  ${styles.dim("Profile")}        ${profile.name}`,
+        `  ${styles.dim("Organization")}   ${formatProfileOrgCell(profile)}`,
+        `  ${styles.dim("API")}            ${profile.api_url}`,
+        `  ${styles.dim("Fingerprint")}    ${profile.token_fingerprint}`,
+        "",
+    ];
+    if (options.totalProfiles >= 2) {
+        lines.push(`  ${styles.dim("Note: this changes the active profile for every shell.")}`);
+        lines.push(`  ${styles.dim("To pin this terminal only, run:")} ${styles.bold(`eval "$(oxygen profiles env ${profile.name})"`)}`);
+        lines.push("");
+    }
+    return lines.join("\n");
 }
-function formatProfileUseSuccess(profile) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+function formatWhoami(identity, context) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const email = identity.user.email ?? identity.user.id;
+    const orgName = identity.organization.name || identity.organization.slug || identity.organization.id;
+    const orgSlug = identity.organization.slug ?? null;
+    const org = orgSlug && orgSlug !== orgName ? `${orgName} (${orgSlug})` : orgName;
+    const sourceLabel = describeProfileSource(context.source);
+    const profileName = context.resolution.exists ? context.resolution.name : "(no stored profile)";
+    const apiUrl = context.resolution.credentials?.apiUrl ?? defaultApiUrl();
+    const rows = [
+        ["Account", email],
+        ["Organization", org],
+        ["Profile", `${profileName} ${styles.dim(`(${sourceLabel})`)}`],
+        ["API", apiUrl],
+    ];
+    const labelWidth = Math.max(...rows.map(([label]) => label.length));
+    const lines = [
+        "",
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
+        "",
+    ];
+    if (identity.onboarding && identity.onboarding.complete === false) {
+        const missing = identity.onboarding.missing_sections.join(", ");
+        lines.push(`  ${styles.dim("Onboarding")}     ${styles.bold("workspace context not loaded")} ${styles.dim(`(missing: ${missing})`)}`, `  ${styles.dim("→ Run")} ${styles.bold("oxygen onboarding start")} ${styles.dim("(or oxygen_onboarding_start in MCP)")}`, "");
+    }
+    return lines.join("\n");
+} // skipcq: JS-C1002
+function formatProfilesCurrent(context) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const sourceLabel = describeProfileSource(context.source);
+    if (!context.resolution.exists) {
+        return [
+            "",
+            `${styles.dim("No stored profile resolves for this shell.")}`,
+            `  ${styles.dim("Source:")}  ${sourceLabel}`,
+            `  ${styles.dim("Run")} ${styles.bold("oxygen login")} ${styles.dim("to create one.")}`,
+            "",
+        ].join("\n");
+    }
+    const credentials = context.resolution.credentials;
+    if (!credentials) {
+        return [
+            "",
+            `${styles.dim("No stored profile resolves for this shell.")}`,
+            `  ${styles.dim("Source:")}  ${sourceLabel}`,
+            "",
+        ].join("\n");
+    }
+    const organization = credentials.activeOrganization ?? credentials.identity?.organization ?? null;
+    const orgCell = organization
+        ? (organization.slug && organization.slug !== organization.name
+            ? `${organization.name} (${organization.slug})`
+            : organization.name)
+        : "(unknown — run `oxygen whoami` to refresh)";
     return [
         "",
-        `${c.green("[OK]")} ${c.bold("CLI profile selected")}`,
+        `${styles.bold("Active Oxygen CLI Profile")}`,
         "",
-        `  ${c.dim("Profile")}       ${profile.name}`,
-        `  ${c.dim("API")}           ${profile.api_url}`,
-        `  ${c.dim("Fingerprint")}   ${profile.token_fingerprint}`,
+        `  ${styles.dim("Profile")}        ${context.resolution.name}`,
+        `  ${styles.dim("Source")}         ${sourceLabel}`,
+        `  ${styles.dim("Organization")}   ${orgCell}`,
+        `  ${styles.dim("API")}            ${credentials.apiUrl}`,
         "",
     ].join("\n");
-} // skipcq: JS-C1002
+}
+function describeProfileSource(source) {
+    switch (source) {
+        case "flag": return "from --profile flag";
+        case "env": return "from OXYGEN_PROFILE";
+        case "file": return "from stored active profile";
+        case "default": return "default fallback";
+    }
+}
 function formatLogoutSuccess(result) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const removed = result.removedProfile
         ? `profile "${result.removedProfile}" removed`
         : "removed";
     return [
         "",
-        `${c.green("[OK]")} ${c.bold("CLI logged out")}`,
+        `${styles.green("[OK]")} ${styles.bold("CLI logged out")}`,
         "",
-        `  ${c.dim("Credentials")}   ${removed}`,
-        `  ${c.dim("Profiles left")}  ${String(result.remainingProfiles)}`, // skipcq: JS-C1002
+        `  ${styles.dim("Credentials")}   ${removed}`,
+        `  ${styles.dim("Profiles left")}  ${String(result.remainingProfiles)}`, // skipcq: JS-C1002
         "",
     ].join("\n");
 }
 function formatUpdateSuccess(result) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     return [
         "",
-        `${c.green("[OK]")} ${c.bold(result.dry_run ? "CLI update command ready" : "CLI update completed")}`,
+        `${styles.green("[OK]")} ${styles.bold(result.dry_run ? "CLI update command ready" : "CLI update completed")}`,
         "",
-        `  ${c.dim("Current")}     ${result.current_version}`,
-        `  ${c.dim("Package")}     ${result.package}`,
-        `  ${c.dim("Command")}     ${result.command}`,
+        `  ${styles.dim("Current")}     ${result.current_version}`,
+        `  ${styles.dim("Package")}     ${result.package}`,
+        `  ${styles.dim("Command")}     ${result.command}`,
         "",
+        ...formatAutomaticSkillsInstallStatusLines(result.skills_install),
     ].join("\n");
 } // skipcq: JS-C1002
+function formatAutomaticSkillsInstallStatusLines(result) {
+    if (!result)
+        return [];
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    if (!result.attempted) {
+        if (result.reason === "dry_run")
+            return [];
+        return [
+            `${styles.dim("Skills")}      skipped (${result.reason ?? "not attempted"})`,
+            "",
+        ];
+    }
+    if (result.ok) {
+        return [
+            `${styles.green("[OK]")} ${styles.bold("Oxygen skills installed")}`,
+            "",
+        ];
+    }
+    return [
+        `${styles.yellow("[WARN]")} Oxygen skills could not be installed; the CLI command still completed.`,
+        `  ${styles.dim("Check")} ${"oxygen skills doctor --json"}`,
+        `  ${styles.dim("Retry")} ${result.command}`,
+        "",
+    ];
+}
 function renderBox(lines) {
     const width = Math.max(...lines.map(visibleLength), 0);
     const border = `+${"-".repeat(width + 2)}+`;
@@ -3725,6 +5411,7 @@ function ansi(enabled) {
         bold: wrap(1, 22), // skipcq: JS-0117  // skipcq: JS-W1035
         dim: wrap(2, 22),
         green: wrap(32, 39),
+        yellow: wrap(33, 39),
     };
 }
 function readOption(value) {
@@ -3739,6 +5426,62 @@ function readCsvOption(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+function splitCsv(value) {
+    return value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+function collectMultiple(value, previous) {
+    return [...previous, value];
+}
+async function buildBlueprintRequestBody(// skipcq: JS-R1005
+slug, options) {
+    const body = {};
+    if (slug?.trim())
+        body.slug = slug.trim();
+    const filePath = readOption(options.file);
+    if (filePath) {
+        const fs = await import("node:fs/promises");
+        const raw = await fs.readFile(filePath, "utf8");
+        body.envelope = JSON.parse(raw);
+    }
+    const fromUrl = readOption(options.fromUrl);
+    if (fromUrl) {
+        const response = await fetch(fromUrl, { headers: { Accept: "application/json" } });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch blueprint from URL (${response.status} ${response.statusText}).`);
+        }
+        const payload = await response.json();
+        body.envelope = payload.blueprint
+            ?? payload.envelope
+            ?? payload;
+    }
+    const inputJson = readOption(options.inputJson);
+    if (inputJson) {
+        try {
+            body.inputs = JSON.parse(inputJson);
+        }
+        catch {
+            throw new Error("--input-json must be valid JSON.");
+        }
+    }
+    const tableRefEntries = Array.isArray(options.tableRef) ? options.tableRef : [];
+    if (tableRefEntries.length > 0) {
+        const refs = {};
+        for (const entry of tableRefEntries) {
+            const [key, value] = entry.split("=");
+            if (key && value)
+                refs[key.trim()] = value.trim();
+        }
+        if (Object.keys(refs).length > 0)
+            body.table_refs = refs;
+    }
+    if (!body.slug && !body.envelope) {
+        throw new Error("Pass a blueprint slug, --file, or --from-url.");
+    }
+    return body;
+}
 function contextAssetsQuery(options) {
     const query = new URLSearchParams();
     if (readOption(options.type))
@@ -3752,6 +5495,20 @@ function contextAssetsQuery(options) {
     const value = query.toString();
     return value ? `?${value}` : "";
 }
+function buildContextResolveBody(options) {
+    const assetTypes = readCsvOption(options.assetType);
+    const tags = readCsvOption(options.tags);
+    const maxAssets = readNonNegativeInt(options.maxAssets);
+    return {
+        ...(readOption(options.purpose) ? { purpose: readOption(options.purpose) } : {}),
+        ...(assetTypes.length > 0 ? { asset_types: assetTypes } : {}),
+        ...(readOption(options.assetStatus) ? { asset_status: readOption(options.assetStatus) } : {}),
+        ...(tags.length > 0 ? { tags } : {}),
+        ...(options.includeArchived ? { include_archived: true } : {}),
+        ...(maxAssets !== undefined ? { max_assets: maxAssets } : {}),
+        ...(options.requireReady ? { require_ready: true } : {}),
+    };
+}
 function buildContextAssetUpsertBody(options) {
     const asset = options.assetJson ? parseJsonObject(options.assetJson) : {};
     const tags = readCsvOption(options.tags);