@oxygen-agent/cli 1.64.5 → 1.99.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // skipcq: JS-0271 — bin entry source; build chmod+x on dist/index.js
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, extname, resolve } from "node:path";
@@ -14,7 +14,7 @@ import { inferRowsFileFormat, normalizeRowsForNewTable, normalizeRowsFormat, par
 import { assertRecipeBundleSafe, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowManifest, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { createBrowserLoginSession, openBrowser } from "./browser-login.js";
-import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, pickProfileNameForIdentity, resolveActiveProfile, saveCredentials, switchCredentialProfile, } from "./credentials.js";
+import { clearCredentials, defaultApiUrl, listCredentialProfiles, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
 import { requestOxygen } from "./http-client.js";
 import { runLocalCustomHttpColumn } from "./local-custom-http-column.js";
 import { addSessionOutput, addSessionStatus, getSessionUsage, startSession, updateSessionStep, } from "./session.js";
@@ -112,6 +112,21 @@ function parseJsonArray(value) {
     }
     return parsed;
 }
+function readCustomIntegrationManifest(options) {
+    const manifestPath = readOption(options.manifest);
+    const manifestJson = readOption(options.manifestJson);
+    if (manifestPath && manifestJson) {
+        throw new OxygenError("invalid_request", "Pass either --manifest or --manifest-json, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (!manifestPath && !manifestJson) {
+        throw new OxygenError("invalid_request", "Pass --manifest or --manifest-json.", {
+            exitCode: 1,
+        });
+    }
+    return parseJsonObject(manifestJson ?? readFileSync(resolve(manifestPath ?? ""), "utf8"));
+}
 function readFileIfPresent(value) {
     const candidate = resolve(value);
     try {
@@ -161,13 +176,17 @@ export function createProgram() {
         .name("oxygen")
         .description("CLI/API-first GTM platform for GTM tool and workflow primitives.")
         .version(OXYGEN_VERSION)
-        .option("--profile <name>", "Use a stored CLI profile for this command.");
+        .option("--profile <name>", "Use a stored CLI profile for this command.")
+        .option("--org <organization>", "Use an organization id, Clerk org id, or slug for this command.");
     program.hook("preAction", () => {
         const options = program.opts();
         if (options.profile) {
             globalProfileFlag = options.profile;
             process.env.OXYGEN_PROFILE = options.profile;
         }
+        if (options.org) {
+            process.env.OXYGEN_ORG = options.org;
+        }
     });
     program
         .command("login")
@@ -284,6 +303,22 @@ export function createProgram() {
         .action(async (options) => {
         await handleWhoamiAction(options);
     });
+    program
+        .command("onboarding")
+        .description("Onboarding helpers.")
+        .addCommand(new Command("start")
+        .description("Start onboarding and get the skill to load.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleOnboardingStartAction(options);
+    }))
+        .addCommand(new Command("reset")
+        .description("Clear the onboarding_started_at marker so onboarding re-runs from scratch. Company context data is preserved.")
+        .option("--confirm", "Required: confirm the reset. Without this flag the command refuses to run.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleOnboardingResetAction(options);
+    }));
     program
         .command("status")
         .description("Compare the local Oxygen CLI version against what's deployed in prod.")
@@ -308,16 +343,20 @@ export function createProgram() {
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("orgs list", options, async () => requestOxygen("/api/cli/orgs"));
+    }))
+        .addCommand(new Command("use")
+        .description("Select the active organization for this CLI profile.")
+        .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (organization, options) => {
+        await handleOrgUseAction(organization, options, "orgs use");
     }))
         .addCommand(new Command("select")
-        .description("Select the active organization for an OAuth-backed CLI session.")
+        .description("Alias for orgs use.")
         .argument("<organization>", "Organization id, Clerk org id, or slug returned by orgs list.")
         .option("--json", "Print a JSON envelope.")
         .action(async (organization, options) => {
-        await handleAsyncAction("orgs select", options, async () => requestOxygen("/api/cli/orgs/select", {
-            method: "POST",
-            body: { organization },
-        }));
+        await handleOrgUseAction(organization, options, "orgs select");
     }));
     program
         .command("db")
@@ -557,11 +596,13 @@ export function createProgram() {
         await handleAsyncAction("tables export-bundle", options, async () => exportTableBundle(table, options));
     }))
         .addCommand(new Command("import-bundle")
-        .description("Recreate a workspace table from an export-bundle file in this org. Restores columns (incl. enrichment/tool definitions) and inserts every row.")
+        .description("Recreate a workspace table from an export-bundle file in this org. Restores columns (incl. enrichment/tool definitions) and inserts every row. Pass --key to make the import idempotent (re-runnable), and --into to resume a failed import into the table it already created.")
         .requiredOption("--file <path>", "Bundle JSON file produced by `tables export-bundle`.")
-        .option("--name <name>", "Override the table display name. Defaults to the bundle's table name.")
-        .option("--project <project>", "Project id or slug for the new table. Defaults to General.")
-        .option("--batch-size <n>", "Rows per insert request. Defaults to 500; paid orgs may use up to 5000.")
+        .option("--name <name>", "Override the table display name. Defaults to the bundle's table name. Ignored with --into.")
+        .option("--project <project>", "Project id or slug for the new table. Defaults to General. Ignored with --into.")
+        .option("--into <table>", "Resume into an existing table (id or slug) instead of creating a new one. Requires --key. Use the table id printed by the failed run.")
+        .option("--key <column>", "Upsert key column. When set, rows are matched by this key instead of blindly inserted, so re-running the import is idempotent (no duplicates). Required with --into.")
+        .option("--batch-size <n>", "Rows per write request. Defaults to 500; paid orgs may use up to 5000.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("tables import-bundle", options, async () => importTableBundle(options));
@@ -805,7 +846,238 @@ export function createProgram() {
         }));
     })));
     program
-        .command("templates")
+        .command("blueprints")
+        .description("Portable Oxygen blueprints: bundle a workflow + tables + columns + prompts as shareable JSON.")
+        .addCommand(new Command("list")
+        .description("List Oxygen blueprints visible in this workspace (seeds + saved).")
+        .argument("[query]", "Search text.")
+        .option("--tag <tag>", "Filter by tag.")
+        .option("--include-seeds", "Include the shipped seed blueprints (default true).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (query, options) => {
+        await handleAsyncAction("blueprints list", options, () => {
+            const params = new URLSearchParams();
+            if (query)
+                params.set("query", query);
+            const tag = readOption(options.tag);
+            if (tag)
+                params.set("tag", tag);
+            if (options.includeSeeds === false)
+                params.set("include_seeds", "false");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/blueprints${qs}`);
+        });
+    }))
+        .addCommand(new Command("describe")
+        .description("Describe one blueprint (seed or saved) by slug.")
+        .argument("<slug>", "Blueprint slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints describe", options, () => requestOxygen("/api/cli/blueprints/get", {
+            method: "POST",
+            body: { slug },
+        }));
+    }))
+        .addCommand(new Command("export")
+        .description("Build a portable blueprint JSON from an existing workflow.")
+        .requiredOption("--workflow <id>", "Workflow id or slug to export.")
+        .option("--tables <ids>", "Comma-separated list of table ids/slugs to bundle.")
+        .option("--prompts <slugs>", "Comma-separated list of prompt template slugs to bundle.")
+        .option("--blueprint-id <slug>", "Override the output blueprint slug.")
+        .option("--blueprint-name <name>", "Override the output blueprint name.")
+        .option("--blueprint-summary <text>", "Override the output blueprint summary.")
+        .option("--blueprint-tags <tags>", "Comma-separated tags for the exported blueprint.")
+        .option("--out <path>", "Write the exported envelope to this file path.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints export", options, async () => {
+            const body = { workflow_id: options.workflow };
+            const tables = readOption(options.tables);
+            if (tables)
+                body.table_ids = splitCsv(tables);
+            const prompts = readOption(options.prompts);
+            if (prompts)
+                body.prompt_slugs = splitCsv(prompts);
+            const blueprintId = readOption(options.blueprintId);
+            if (blueprintId)
+                body.blueprint_id = blueprintId;
+            const blueprintName = readOption(options.blueprintName);
+            if (blueprintName)
+                body.blueprint_name = blueprintName;
+            const blueprintSummary = readOption(options.blueprintSummary);
+            if (blueprintSummary)
+                body.blueprint_summary = blueprintSummary;
+            const blueprintTags = readOption(options.blueprintTags);
+            if (blueprintTags)
+                body.blueprint_tags = splitCsv(blueprintTags);
+            const result = await requestOxygen("/api/cli/blueprints/export", {
+                method: "POST",
+                body,
+            });
+            const outPath = readOption(options.out);
+            if (outPath) {
+                const fs = await import("node:fs/promises");
+                const blueprint = result.blueprint;
+                await fs.writeFile(outPath, JSON.stringify(blueprint, null, 2), "utf8");
+            }
+            return result;
+        });
+    }))
+        .addCommand(new Command("preflight")
+        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace.")
+        .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
+        .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
+        .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints preflight", options, async () => {
+            const body = await buildBlueprintRequestBody(slug, options);
+            return requestOxygen("/api/cli/blueprints/preflight", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("apply")
+        .description("Apply a blueprint to this workspace. Creates tables, columns, prompts, and a disabled workflow.")
+        .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
+        .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
+        .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
+        .option("--workflow-id <id>", "Override the resulting workflow id.")
+        .option("--workflow-name <name>", "Override the resulting workflow name.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints apply", options, async () => {
+            const body = await buildBlueprintRequestBody(slug, options);
+            const workflowId = readOption(options.workflowId);
+            if (workflowId)
+                body.workflow_id = workflowId;
+            const workflowName = readOption(options.workflowName);
+            if (workflowName)
+                body.workflow_name = workflowName;
+            return requestOxygen("/api/cli/blueprints/apply", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("save")
+        .description("Persist a blueprint envelope into this workspace's gallery.")
+        .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
+        .option("--slug <slug>", "Override the stored blueprint slug.")
+        .option("--name <name>", "Override the stored blueprint name.")
+        .option("--summary <text>", "Override the stored blueprint summary.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints save", options, async () => {
+            const filePath = readOption(options.file);
+            if (!filePath)
+                throw new Error("--file is required for blueprints save");
+            const fs = await import("node:fs/promises");
+            const raw = await fs.readFile(filePath, "utf8");
+            const envelope = JSON.parse(raw);
+            const body = { envelope };
+            const slug = readOption(options.slug);
+            if (slug)
+                body.slug = slug;
+            const name = readOption(options.name);
+            if (name)
+                body.name = name;
+            const summary = readOption(options.summary);
+            if (summary)
+                body.summary = summary;
+            return requestOxygen("/api/cli/blueprints/save", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a saved blueprint (seed blueprints cannot be archived).")
+        .argument("<slug>", "Blueprint slug or id.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints archive", options, () => requestOxygen("/api/cli/blueprints/archive", { method: "POST", body: { slug } }));
+    }))
+        .addCommand(new Command("share")
+        .description("Create a public share URL for a saved blueprint (oxygen-agent.com/b/<code>).")
+        .argument("<slug>", "Blueprint slug or id to share.")
+        .option("--expires-in-days <days>", "Optional expiry (default: no expiry).")
+        .option("--disabled", "Create the share in disabled state.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints share", options, () => {
+            const body = { slug };
+            const expiresInDays = readOption(options.expiresInDays);
+            if (expiresInDays)
+                body.expires_in_days = Number(expiresInDays);
+            if (options.disabled)
+                body.enabled = false;
+            return requestOxygen("/api/cli/blueprints/share", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("shares")
+        .description("List existing share URLs for this workspace.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints shares", options, () => requestOxygen("/api/cli/blueprints/share"));
+    }))
+        .addCommand(new Command("unshare")
+        .description("Revoke a public share URL by short code.")
+        .argument("<code>", "Share short code (the slug after /b/ in the URL).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (code, options) => {
+        await handleAsyncAction("blueprints unshare", options, () => requestOxygen("/api/cli/blueprints/share/revoke", {
+            method: "POST",
+            body: { short_code: code },
+        }));
+    }))
+        .addCommand(new Command("publish")
+        .description("List a blueprint on the public Oxygen marketplace. Auto-creates a share URL if none exists.")
+        .argument("<slug>", "Blueprint slug to publish.")
+        .option("--category <name>", "Optional free-text category (e.g. outbound, enrichment).")
+        .option("--kind <kind>", "Listing kind: community (default) or official (Oxygen-curated; gated).")
+        .option("--approved", "Acknowledge the publish-safety warnings (required if the preview is not clean).")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints publish", options, () => {
+            const body = { slug };
+            const category = readOption(options.category);
+            if (category)
+                body.category = category;
+            const kind = readOption(options.kind);
+            if (kind)
+                body.kind = kind;
+            if (options.approved)
+                body.approved = true;
+            return requestOxygen("/api/cli/blueprints/publish", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("unpublish")
+        .description("Remove a blueprint from the public marketplace. The share URL stays valid for direct visitors.")
+        .argument("<slug>", "Blueprint slug to unlist.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (slug, options) => {
+        await handleAsyncAction("blueprints unpublish", options, () => requestOxygen("/api/cli/blueprints/unpublish", {
+            method: "POST",
+            body: { slug },
+        }));
+    }))
+        .addCommand(new Command("marketplace")
+        .description("Browse the public Oxygen blueprint marketplace.")
+        .option("--category <name>", "Filter by listing category.")
+        .option("--kind <kind>", "Filter by listing kind: community or official.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("blueprints marketplace", options, () => {
+            const params = new URLSearchParams();
+            const category = readOption(options.category);
+            if (category)
+                params.set("category", category);
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/blueprints/marketplace${qs}`, { requireAuth: false });
+        });
+    }));
+    program
+        .command("prompts")
         .description("Reusable prompt templates layered into AI columns at run time.")
         .addCommand(new Command("list")
         .description("List prompt templates in the workspace.")
@@ -813,10 +1085,85 @@ export function createProgram() {
         .option("--include-archived", "Include archived templates.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("templates list", options, async () => {
+        await handleAsyncAction("prompts list", options, () => {
             const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            if (options.includeArchived)
+                params.set("include_archived", "true");
+            const qs = params.toString() ? `?${params.toString()}` : "";
+            return requestOxygen(`/api/cli/templates${qs}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Read one prompt template by id or slug.")
+        .argument("<id_or_slug>", "Template UUID or slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (idOrSlug, options) => {
+        await handleAsyncAction("prompts get", options, () => requestOxygen("/api/cli/templates/get", {
+            method: "POST",
+            body: idOrSlug.includes("-") && idOrSlug.length >= 32
+                ? { id: idOrSlug }
+                : { slug: idOrSlug },
+        }));
+    }))
+        .addCommand(new Command("upsert")
+        .description("Create or update a prompt template.")
+        .option("--id <id>", "Existing template UUID to update. Omit to create.")
+        .option("--slug <slug>", "Stable slug (kebab-case).")
+        .option("--name <name>", "Human-readable name.")
+        .option("--description <text>", "Short description.")
+        .option("--kind <kind>", "Template kind: ai_column_system, scoring_rubric, or other.")
+        .option("--body <text>", "Prompt body.")
+        .option("--body-file <path>", "Path to a file containing the prompt body.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("prompts upsert", options, async () => {
+            const body = {};
+            if (readOption(options.id))
+                body.id = readOption(options.id);
+            if (readOption(options.slug))
+                body.slug = readOption(options.slug);
+            if (readOption(options.name))
+                body.name = readOption(options.name);
+            if (readOption(options.description) !== undefined)
+                body.description = readOption(options.description);
             if (readOption(options.kind))
-                params.set("kind", readOption(options.kind));
+                body.kind = readOption(options.kind);
+            if (readOption(options.body))
+                body.body = readOption(options.body);
+            else {
+                const path = readOption(options.bodyFile);
+                if (path) {
+                    const fs = await import("node:fs/promises");
+                    body.body = await fs.readFile(path, "utf8");
+                }
+            }
+            return requestOxygen("/api/cli/templates/upsert", { method: "POST", body });
+        });
+    }))
+        .addCommand(new Command("archive")
+        .description("Archive a prompt template. Seeded templates cannot be archived.")
+        .argument("<id>", "Template UUID.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (id, options) => {
+        await handleAsyncAction("prompts archive", options, () => requestOxygen("/api/cli/templates/archive", { method: "POST", body: { id } }));
+    }));
+    program
+        .command("templates")
+        .description("Deprecated alias for 'oxygen prompts'. Will be removed in a future release.")
+        .addCommand(new Command("list")
+        .description("List prompt templates in the workspace.")
+        .option("--kind <kind>", "Filter by ai_column_system, scoring_rubric, or other.")
+        .option("--include-archived", "Include archived templates.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("templates list", options, () => {
+            const params = new URLSearchParams();
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
             if (options.includeArchived)
                 params.set("include_archived", "true");
             const qs = params.toString() ? `?${params.toString()}` : "";
@@ -860,10 +1207,12 @@ export function createProgram() {
                 body.kind = readOption(options.kind);
             if (readOption(options.body))
                 body.body = readOption(options.body);
-            else if (readOption(options.bodyFile)) {
+            else {
                 const path = readOption(options.bodyFile);
-                const fs = await import("node:fs/promises");
-                body.body = await fs.readFile(path, "utf8");
+                if (path) {
+                    const fs = await import("node:fs/promises");
+                    body.body = await fs.readFile(path, "utf8");
+                }
             }
             return requestOxygen("/api/cli/templates/upsert", { method: "POST", body });
         });
@@ -885,14 +1234,17 @@ export function createProgram() {
         .option("--limit <n>", "Max rows to return (default 50, max 200).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("reviews list", options, async () => {
+        await handleAsyncAction("reviews list", options, () => {
             const params = new URLSearchParams();
-            if (readOption(options.status))
-                params.set("status", readOption(options.status));
-            if (readOption(options.table))
-                params.set("table_id", readOption(options.table));
-            if (readOption(options.limit))
-                params.set("limit", readOption(options.limit));
+            const status = readOption(options.status);
+            const table = readOption(options.table);
+            const limit = readOption(options.limit);
+            if (status)
+                params.set("status", status);
+            if (table)
+                params.set("table_id", table);
+            if (limit)
+                params.set("limit", limit);
             const qs = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/message-reviews${qs}`);
         });
@@ -902,10 +1254,11 @@ export function createProgram() {
         .option("--table <table_id>", "Filter by table id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("reviews next", options, async () => {
+        await handleAsyncAction("reviews next", options, () => {
             const params = new URLSearchParams();
-            if (readOption(options.table))
-                params.set("table_id", readOption(options.table));
+            const table = readOption(options.table);
+            if (table)
+                params.set("table_id", table);
             const qs = params.toString() ? `?${params.toString()}` : "";
             return requestOxygen(`/api/cli/message-reviews/next${qs}`);
         });
@@ -927,10 +1280,11 @@ export function createProgram() {
         .option("--auto-rerun", "Trigger a single-row rerun of the column after rejecting.")
         .option("--json", "Print a JSON envelope.")
         .action(async (reviewId, options) => {
-        await handleAsyncAction("reviews reject", options, async () => {
+        await handleAsyncAction("reviews reject", options, () => {
             const body = { id: reviewId, decision: "reject" };
-            if (readOption(options.highlightsJson)) {
-                body.highlights = JSON.parse(readOption(options.highlightsJson));
+            const highlightsJson = readOption(options.highlightsJson);
+            if (highlightsJson) {
+                body.highlights = JSON.parse(highlightsJson);
             }
             if (options.autoRerun)
                 body.auto_rerun = true;
@@ -1039,21 +1393,21 @@ export function createProgram() {
                     ...(localConcurrency ? { concurrency: localConcurrency } : {}),
                 });
             }
-            return requestOxygen("/api/cli/tables/columns/run", {
-                method: "POST",
-                body: {
-                    table,
-                    column,
-                    ...(options.all ? { selection: { mode: "all" } } : {}),
-                    ...(filterSelection ? { selection: filterSelection } : {}),
-                    ...(!options.all && readOption(options.rowId) ? { row_id: readOption(options.rowId) } : {}),
-                    ...(!options.all && !filterSelection && limit ? { limit } : {}),
-                    ...(options.force ? { force: true } : {}),
-                    ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
-                    ...(options.background ? { background: true } : {}),
-                    ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
-                    ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
-                },
+            const body = {
+                table,
+                column,
+                ...(options.all ? { selection: { mode: "all" } } : {}),
+                ...(filterSelection ? { selection: filterSelection } : {}),
+                ...(!options.all && readOption(options.rowId) ? { row_id: readOption(options.rowId) } : {}),
+                ...(!options.all && !filterSelection && limit ? { limit } : {}),
+                ...(options.force ? { force: true } : {}),
+                ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
+                ...(options.background ? { background: true } : {}),
+                ...(maxCredits !== undefined ? { max_credits: maxCredits } : {}),
+                ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
+            };
+            return requestColumnsRun(body, table, {
+                background: Boolean(options.background),
             });
         });
     }))
@@ -1121,10 +1475,11 @@ export function createProgram() {
         .argument("<column>", "Column id or key.")
         .option("--label <label>", "New display label.")
         .option("--semantic-type <type>", "New semantic type.")
-        .option("--definition-json <json>", "Definition metadata to merge into the column.")
+        .option("--definition-json <json>", "Definition metadata to shallow-merge into the column; arrays are replaced wholesale and missing keys leave existing fields unchanged.")
+        .option("--dry-run", "Return the would-be merged definition without writing.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, column, options) => {
-        await handleAsyncAction("columns update", options, async () => requestOxygen("/api/cli/tables/columns/update", {
+        await handleAsyncAction("columns update", options, () => requestOxygen("/api/cli/tables/columns/update", {
             method: "POST",
             body: {
                 table,
@@ -1132,6 +1487,7 @@ export function createProgram() {
                 ...(readOption(options.label) ? { label: readOption(options.label) } : {}),
                 ...(readOption(options.semanticType) ? { semantic_type: readOption(options.semanticType) } : {}),
                 ...(options.definitionJson ? { definition: parseJsonObject(options.definitionJson) } : {}),
+                ...(options.dryRun ? { dry_run: true } : {}),
             },
         }));
     }))
@@ -1234,10 +1590,19 @@ export function createProgram() {
                 ...(options.metadataJson ? { metadata: parseJsonObject(options.metadataJson) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("list")
+        .description("List durable table action runs for one table.")
+        .requiredOption("--table <table>", "Table id or slug.")
+        .option("--status <status>", "Filter by active, queued, running, paused, completed, completed_with_errors, failed, canceling, or canceled. Defaults to active.")
+        .option("--limit <n>", "Maximum runs to return. Defaults to 20.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("table-runs list", options, () => requestOxygen(tableRunsListPath(options)));
     }))
         .addCommand(new Command("get")
         .description("Get one durable table action run.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (runId, options) => {
         await handleAsyncAction("table-runs get", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}`));
@@ -1262,7 +1627,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("wait")
         .description("Poll a durable table action run until it finishes.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--timeout-seconds <n>", "Maximum time to wait. Defaults to 600.")
         .option("--interval-seconds <n>", "Polling interval. Defaults to 5.")
         .option("--json", "Print a JSON envelope.")
@@ -1278,7 +1643,7 @@ export function createProgram() {
     }))
         .addCommand(new Command("cancel")
         .description("Request cancellation for a durable table action run.")
-        .argument("<run_id>", "Table action run UUID.")
+        .argument("<run_id>", "Table action run UUID or parent workspace run UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (runId, options) => {
         await handleAsyncAction("table-runs cancel", options, async () => requestOxygen(`/api/cli/table-action-runs/${encodeURIComponent(runId)}/cancel`, {
@@ -1532,7 +1897,7 @@ export function createProgram() {
         });
     }))
         .addCommand(new Command("repair")
-        .description("Repair stale background action and ingestion queue state.")
+        .description("Repair stale background action, ingestion, and workflow queue state.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("worker repair", options, async () => requestOxygen("/api/cli/worker/repair", {
@@ -1828,6 +2193,36 @@ export function createProgram() {
         .action(async (options) => {
         await handleAsyncAction("session usage", options, async () => getSessionUsage({ sessionId: readOption(options.sessionId) }));
     }));
+    program
+        .command("custom-integrations")
+        .description("Custom HTTP integration commands.")
+        .addCommand(new Command("apply")
+        .description("Create or update a custom HTTP integration manifest. Store credentials from the web Connections page.")
+        .option("--manifest <path>", "Path to a custom HTTP manifest JSON file.")
+        .option("--manifest-json <json>", "Custom HTTP manifest as a JSON object.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("custom-integrations apply", options, () => {
+            const manifest = readCustomIntegrationManifest(options);
+            return requestOxygen("/api/cli/custom-integrations", {
+                method: "POST",
+                body: { manifest },
+            });
+        });
+    }))
+        .addCommand(new Command("list")
+        .description("List custom HTTP integrations for the active organization.")
+        .option("--slug <slug>", "Filter to one custom integration slug.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("custom-integrations list", options, () => {
+            const params = new URLSearchParams();
+            if (readOption(options.slug))
+                params.set("slug", readOption(options.slug) ?? "");
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/custom-integrations${suffix ? `?${suffix}` : ""}`);
+        });
+    }));
     program
         .command("tools")
         .description("Tool catalog commands.")
@@ -1858,11 +2253,48 @@ export function createProgram() {
         .action(async (toolId, options) => {
         await handleAsyncAction("tools get", options, async () => requestOxygen(`/api/cli/tools/${encodeURIComponent(toolId)}`));
     }))
+        .addCommand(new Command("enums")
+        .description("Provider enum catalogs for fields that accept normalized values.")
+        .addCommand(new Command("list")
+        .description("List enum catalogs for a provider (or all providers).")
+        .option("--provider <provider>", "Filter to a single provider, e.g. blitzapi.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("tools enums list", options, () => {
+            const params = new URLSearchParams();
+            const provider = readOption(options.provider);
+            if (provider)
+                params.set("provider", provider);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/tools/enums${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("get")
+        .description("Fetch the accepted values for one provider enum catalog. Use this before drafting payloads with enumRef fields.")
+        .argument("<provider>", "Provider name, e.g. blitzapi.")
+        .argument("<enum_ref>", "Enum reference id, e.g. industry, employee_range, country_code.")
+        .option("-q, --query <query>", "Case-insensitive substring or token search across the catalog values.")
+        .option("--limit <limit>", "Maximum number of values to return. Defaults to 100. Maximum 1000.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (provider, enumRef, options) => {
+        await handleAsyncAction("tools enums get", options, () => {
+            const params = new URLSearchParams();
+            const query = readOption(options.query);
+            const limit = readOption(options.limit);
+            if (query)
+                params.set("q", query);
+            if (limit)
+                params.set("limit", limit);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/tools/enums/${encodeURIComponent(provider)}/${encodeURIComponent(enumRef)}${suffix ? `?${suffix}` : ""}`);
+        });
+    })))
         .addCommand(new Command("run")
         .description("Run an executable Oxygen tool through the HTTPS API.")
         .argument("<tool_id>", "Tool id.")
         .requiredOption("--input-json <json>", "Tool input as a JSON object.")
         .option("--mode <mode>", "Execution mode: live, dry-run, or dry_run. Mutating tools default to dry-run.")
+        .option("--credential-mode <mode>", "Credential mode: managed, user_api_key, or user_oauth.")
         .option("--org <organization_id>", "Optional organization id. Must match the stored CLI token.")
         .option("--org-id <organization_id>", "Optional organization id. Must match the stored CLI token.")
         .option("--connection-id <connection_id>", "Specific integration connection id. Defaults to the org's active default connection.")
@@ -1872,12 +2304,13 @@ export function createProgram() {
         .option("--oxygen-cursor <cursor>", "Short Oxygen cursor returned as oxygen_next_cursor by a previous tool run.")
         .option("--json", "Print a JSON envelope.")
         .action(async (toolId, options) => {
-        await handleAsyncAction("tools run", options, async () => requestOxygen("/api/cli/tools/run", {
+        await handleAsyncAction("tools run", options, () => requestOxygen("/api/cli/tools/run", {
             method: "POST",
             body: {
                 tool_id: toolId,
                 input: parseJsonObject(options.inputJson),
                 ...(readOption(options.mode) ? { mode: readOption(options.mode) } : {}),
+                ...(readOption(options.credentialMode) ? { credential_mode: readOption(options.credentialMode) } : {}),
                 ...(readOption(options.org) ? { org_id: readOption(options.org) } : {}),
                 ...(readOption(options.orgId) ? { org_id: readOption(options.orgId) } : {}),
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
@@ -1906,7 +2339,7 @@ export function createProgram() {
         .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
         .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
         .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
-        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact,ai_ark; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact,ai_ark.")
         .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
         .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
         .option("--limit <n>", "Rows to estimate. Defaults to 10.")
@@ -1937,7 +2370,7 @@ export function createProgram() {
         .option("--capability <capability>", "Capability to enrich: mobile_phone or work_email. Defaults to mobile_phone.")
         .option("--target-column <column>", "Target enrichment column key. Defaults to the capability payload column.")
         .option("--on-existing-manual-column <mode>", "How to handle an existing manual target: error, write_if_empty, or create_enrichment_column.")
-        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact.")
+        .option("--provider-order <providers>", "Comma-separated provider order. Work email defaults to blitzapi,prospeo,leadmagic,hunter,contactout,bettercontact,ai_ark; phone defaults to blitzapi,prospeo,leadmagic,contactout,bettercontact,ai_ark.")
         .option("--verify-phone", "Validate found phone numbers with ClearoutPhone before returning them.")
         .option("--phone-verification-credential-mode <mode>", "ClearoutPhone credential mode for phone verification: managed or user_api_key.")
         .option("--limit <n>", "Rows to queue.")
@@ -1960,6 +2393,25 @@ export function createProgram() {
             },
         }));
     }));
+    program
+        .command("enrichment")
+        .description("High-level enrichment column definition helpers.")
+        .addCommand(new Command("apply-default-cascade")
+        .description("Patch an existing enrichment column to the server-side default provider cascade for its intent.")
+        .argument("<table>", "Table id or slug.")
+        .argument("<column>", "Enrichment column id or key.")
+        .option("--dry-run", "Return the would-be merged definition without writing.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (table, column, options) => {
+        await handleAsyncAction("enrichment apply-default-cascade", options, () => requestOxygen("/api/cli/enrichment/apply-default-cascade", {
+            method: "POST",
+            body: {
+                table,
+                column,
+                ...(options.dryRun ? { dry_run: true } : {}),
+            },
+        }));
+    }));
     program
         .command("integrations")
         .description("Integration connection and event trigger commands.")
@@ -2035,6 +2487,33 @@ export function createProgram() {
                 ...(readOption(options.connectionId) ? { connection_id: readOption(options.connectionId) } : {}),
             },
         }));
+    }))
+        .addCommand(new Command("deliveries")
+        .description("List recent provider webhook deliveries (Composio triggers, HubSpot webhooks, etc.) and the workflow runs they kicked off.")
+        .option("--source <source>", "Filter by event source, such as hubspot or composio.gmail.")
+        .option("--event <event>", "Filter by event type, such as contact.created or GMAIL_NEW_GMAIL_MESSAGE.")
+        .option("--toolkit <id>", "Filter by integration/toolkit id, such as gmail or hubspot.")
+        .option("--connection-id <connection_id>", "Filter by a specific integration connection id.")
+        .option("--result <result>", "Filter by delivery result: success or error.")
+        .option("--limit <n>", "Maximum deliveries to return (1-200). Defaults to 50.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("integrations events deliveries", options, () => {
+            const query = new URLSearchParams();
+            const set = (key, value) => {
+                const trimmed = readOption(value);
+                if (trimmed)
+                    query.set(key, trimmed);
+            };
+            set("source", options.source);
+            set("event", options.event);
+            set("toolkit", options.toolkit);
+            set("connection_id", options.connectionId);
+            set("result", options.result);
+            set("limit", options.limit);
+            const suffix = query.toString() ? `?${query.toString()}` : "";
+            return requestOxygen(`/api/cli/integrations/events/deliveries${suffix}`);
+        });
     })))
         .addCommand(new Command("list")
         .description("List supported Composio integrations and this org's connections.")
@@ -2062,11 +2541,16 @@ export function createProgram() {
         .addCommand(new Command("disconnect")
         .description("Disconnect a Composio integration.")
         .argument("<integration_id>", "Integration id, such as 'slack'.")
+        .option("--connection-id <id>", "Disconnect a specific connected account when multiple exist.")
         .option("--json", "Print a JSON envelope.")
         .action(async (integrationId, options) => {
-        await handleAsyncAction("integrations disconnect", options, async () => requestOxygen("/api/cli/integrations/composio/disconnect", {
+        const connectionId = readOption(options.connectionId)?.trim();
+        await handleAsyncAction("integrations disconnect", options, () => requestOxygen("/api/cli/integrations/composio/disconnect", {
             method: "POST",
-            body: { integration_id: integrationId },
+            body: {
+                integration_id: integrationId,
+                ...(connectionId ? { connection_id: connectionId } : {}),
+            },
         }));
     }))
         .addCommand(new Command("actions")
@@ -2335,6 +2819,7 @@ export function createProgram() {
         .addCommand(new Command("failures")
         .description("List failed workflow runs and trigger scheduler failures.")
         .option("--limit <n>", "Maximum failures per group. Defaults to 25; server cap is 100.")
+        .option("--include-bundle", "Include durable recipe bundles in JSON output.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows failures", options, async () => {
@@ -2342,8 +2827,10 @@ export function createProgram() {
             const limit = readPositiveInt(options.limit);
             if (limit)
                 query.set("limit", String(limit));
+            if (options.includeBundle)
+                query.set("include_bundle", "true");
             const suffix = query.toString() ? `?${query.toString()}` : "";
-            return requestOxygen(`/api/cli/workflows/failures${suffix}`);
+            return prepareWorkflowCliOutput(await requestOxygen(`/api/cli/workflows/failures${suffix}`), options);
         });
     }))
         .addCommand(new Command("run")
@@ -2420,7 +2907,7 @@ export function createProgram() {
         .option("--agents <agents...>", "Space or comma separated agents. Defaults to codex, claude-code, and cursor.")
         .option("--skill <skill>", "Skill name or '*'. Defaults to '*'.")
         .option("--project", "Install into the current project instead of global agent scope.")
-        .option("--copy", "Copy skill files instead of symlinking when supported by npx skills.")
+        .option("--copy", "Copy skill files instead of symlinking when supported by npx skills. Default on Windows, where symlinks need Developer Mode or admin.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("skills install", options, async () => installAgentSkills(options));
@@ -2598,11 +3085,11 @@ async function importTranspiledWorkflowModule(absolutePath, source) {
             esModuleInterop: true,
         },
     }).outputText;
-    const workflowsUrl = await import.meta.resolve("@oxygen/workflows");
+    const dir = mkdtempSync(`${tmpdir()}/oxygen-workflow-`);
+    const workflowsUrl = await resolveWorkflowRuntimeModuleUrl(dir);
     const rewritten = transpiled
         .replaceAll("from \"@oxygen/workflows\"", `from "${workflowsUrl}"`)
         .replaceAll("from '@oxygen/workflows'", `from "${workflowsUrl}"`);
-    const dir = mkdtempSync(`${tmpdir()}/oxygen-workflow-`);
     const compiledPath = `${dir}/workflow.mjs`;
     writeFileSync(compiledPath, rewritten, "utf8");
     try {
@@ -2612,6 +3099,84 @@ async function importTranspiledWorkflowModule(absolutePath, source) {
         rmSync(dir, { recursive: true, force: true });
     }
 }
+async function resolveWorkflowRuntimeModuleUrl(tempDir) {
+    try {
+        return await import.meta.resolve("@oxygen/workflows");
+    }
+    catch {
+        const shimPath = `${tempDir}/oxygen-workflows-shim.mjs`;
+        writeFileSync(shimPath, workflowRuntimeShimSource(), "utf8");
+        return pathToFileURL(shimPath).href;
+    }
+}
+function workflowRuntimeShimSource() {
+    return `
+export function defineWorkflow(input) {
+  return {
+    __oxygen_workflow_definition: true,
+    id: input.id,
+    name: input.name,
+    ...(input.status ? { status: input.status } : {}),
+    ...(input.specification ? { specification: input.specification } : {}),
+    ...(input.trigger ? { trigger: input.trigger } : {}),
+    ...(input.inputSchema ? { inputSchema: input.inputSchema } : {}),
+    steps: input.steps,
+  };
+}
+export function apiTrigger(input = {}) {
+  return { type: "api", ...(input.status ? { status: input.status } : {}) };
+}
+export function webhookTrigger(input) {
+  return {
+    type: "webhook",
+    trigger_id: input.id,
+    ...(input.name !== undefined ? { trigger_name: input.name } : {}),
+    secret_required: input.secret ?? true,
+    ...(input.idempotencyKeyPath !== undefined ? { idempotency_key_path: input.idempotencyKeyPath } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function cronTrigger(input) {
+  return {
+    type: "cron",
+    cron: input.cron,
+    ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function eventTrigger(input) {
+  return {
+    type: "event",
+    source: input.source,
+    event: input.event,
+    ...(input.filters ? { filters: input.filters } : {}),
+    ...(input.idempotencyKeyPath !== undefined ? { idempotency_key_path: input.idempotencyKeyPath } : {}),
+    ...(input.status ? { status: input.status } : {}),
+  };
+}
+export function transformStep(input) {
+  return {
+    __oxygen_workflow_step: true,
+    kind: "transform",
+    id: input.id,
+    ...(input.description ? { description: input.description } : {}),
+    run: input.run,
+  };
+}
+export function toolStep(input) {
+  return {
+    __oxygen_workflow_step: true,
+    kind: "tool",
+    id: input.id,
+    ...(input.description ? { description: input.description } : {}),
+    tool: input.tool,
+    ...(input.effect ? { effect: input.effect } : {}),
+    ...(input.mode ? { mode: input.mode } : {}),
+    payload: input.payload,
+  };
+}
+`;
+}
 async function tailWorkflowRun(runId, options) {
     const timeoutSeconds = readPositiveInt(options.timeoutSeconds)
         ?? WORKFLOW_TAIL_DEFAULT_TIMEOUT_SECONDS;
@@ -2640,12 +3205,23 @@ async function tailWorkflowRun(runId, options) {
         }
         const remainingMs = deadline - Date.now();
         if (remainingMs <= 0) {
+            const worker = isRecord(run.worker) ? run.worker : null;
+            const queuedWithoutWorker = status === "queued"
+                && worker !== null
+                && worker.active === null
+                && worker.lastClaim === null;
             throw new OxygenError("workflow_tail_timeout", "Timed out waiting for workflow run to finish.", {
                 details: {
                     workflow_run_id: runId,
                     status: status ?? null,
                     timeout_seconds: timeoutSeconds,
                     polls,
+                    ...(queuedWithoutWorker
+                        ? {
+                            worker_status: "queued_no_worker",
+                            guidance: "No worker has claimed this workflow run. Check `oxygen worker queue-stats --json` for BullMQ and workflow queue health.",
+                        }
+                        : {}),
                 },
                 exitCode: 1,
             });
@@ -2745,23 +3321,89 @@ function readTableRunSelection(options) {
         exitCode: 1,
     });
 }
-function readCompaniesEnrichBody(table, options) {
-    const body = { table };
-    const fields = readCsvOption(options.missingFields);
-    const providers = readCsvOption(options.providers);
-    const selection = readCompaniesEnrichSelection(options);
-    const mode = readOption(options.mode);
-    const maxCredits = readPositiveNumber(options.maxCredits);
-    if (fields.length > 0)
-        body.missing_fields = fields;
-    if (providers.length > 0)
-        body.providers = providers;
-    if (selection)
-        body.selection = selection;
-    if (mode)
-        body.mode = mode;
-    if (maxCredits !== undefined)
-        body.max_credits = maxCredits;
+function tableRunsListPath(options) {
+    const table = readOption(options.table);
+    if (!table) {
+        throw new OxygenError("invalid_table_run", "Pass --table <table>.", {
+            exitCode: 1,
+        });
+    }
+    const query = new URLSearchParams({ table });
+    const status = readOption(options.status);
+    const limit = readPositiveInt(options.limit);
+    if (status)
+        query.set("status", status);
+    if (limit)
+        query.set("limit", String(limit));
+    if (options.traceId)
+        query.set("trace_id", options.traceId);
+    return `/api/cli/table-action-runs?${query.toString()}`;
+}
+async function requestColumnsRun(body, table, options) {
+    const traceId = randomUUID();
+    try {
+        return await requestOxygen("/api/cli/tables/columns/run", {
+            method: "POST",
+            body,
+            traceId,
+        });
+    }
+    catch (error) {
+        if (!options.background || !isNetworkTimeoutError(error))
+            throw error;
+        const recovered = await recoverBackgroundColumnRun(table, traceId);
+        if (!recovered)
+            throw error;
+        return recovered;
+    }
+}
+async function recoverBackgroundColumnRun(table, traceId) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        const listed = await requestOxygen(tableRunsListPath({ table, status: "active", limit: "5", traceId }), { timeoutMs: 30_000 });
+        const runs = Array.isArray(listed.runs)
+            ? listed.runs.filter(isRecord)
+            : [];
+        const run = runs[0];
+        if (run) {
+            const actionRunId = readRecordString(run, "action_run_id") ?? readRecordString(run, "id");
+            const workspaceRunId = readRecordString(run, "workspace_run_id") ?? readRecordString(run, "runId");
+            return {
+                ...run,
+                ...(actionRunId ? { action_run_id: actionRunId } : {}),
+                ...(workspaceRunId ? { workspace_run_id: workspaceRunId } : {}),
+                timeout_recovered: true,
+                recovery: {
+                    reason: "columns_run_background_timeout",
+                    trace_id: traceId,
+                    lookup_command: `oxygen table-runs list --table ${table} --status active --json`,
+                },
+            };
+        }
+        if (attempt < 2)
+            await sleep(750);
+    }
+    return null;
+}
+function isNetworkTimeoutError(error) {
+    return error instanceof OxygenError && error.code === "network_timeout";
+}
+function readCompaniesEnrichBody(table, options) {
+    const body = { table };
+    const fields = readCsvOption(options.missingFields);
+    const providers = readCsvOption(options.providers);
+    const selection = readCompaniesEnrichSelection(options);
+    const mode = readOption(options.mode);
+    const maxCredits = readPositiveNumber(options.maxCredits);
+    if (fields.length > 0)
+        body.missing_fields = fields;
+    if (providers.length > 0)
+        body.providers = providers;
+    if (selection)
+        body.selection = selection;
+    if (mode)
+        body.mode = mode;
+    if (maxCredits !== undefined)
+        body.max_credits = maxCredits;
     if (options.force !== undefined)
         body.force = Boolean(options.force);
     return body;
@@ -2861,19 +3503,26 @@ async function importRows(table, options) {
             exitCode: 1,
         });
     }
-    const target = await prepareImportTarget(table, options, parsedRows);
     const batchSize = normalizeImportBatchSize(options.batchSize);
     const sourceHash = hashImportFile(options.file);
     const shouldUseBackground = options.background
-        || (!options.sync && target.rows.length > LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD);
+        || (!options.sync && parsedRows.length > LARGE_IMPORT_BACKGROUND_ROW_THRESHOLD);
     if (shouldUseBackground) {
-        return enqueueImportRows(target.tableRef, options, target.rows, format, batchSize, {
+        // Prefer the object-storage fast path: upload the raw file once via a
+        // presigned URL (no request-body limit) so the worker COPY-loads it.
+        // Falls back to the inline multipart import when storage is unconfigured.
+        const staged = await tryEnqueueStagedFileImport(table, options, format, parsedRows, {
+            autoBackground: !options.background,
+            sourceHash,
+        });
+        if (staged)
+            return staged;
+        return enqueueImportFile(table, options, format, batchSize, {
             autoBackground: !options.background,
             sourceHash,
-            createdTable: target.createdTable,
-            ...(target.upsertKey ? { upsertKey: target.upsertKey } : {}),
         });
     }
+    const target = await prepareImportTarget(table, options, parsedRows);
     let rowCount = 0;
     let insertedCount = 0;
     let updatedCount = 0;
@@ -2939,6 +3588,7 @@ async function prepareImportTarget(table, options, parsedRows) {
             createdTable: null,
             tableWebUrl: null,
             upsertKey: options.upsertKey,
+            sourceKeyMap: null,
         };
     }
     const normalized = normalizeRowsForNewTable(parsedRows);
@@ -2965,103 +3615,138 @@ async function prepareImportTarget(table, options, parsedRows) {
         createdTable: created,
         tableWebUrl: createdWebUrl ?? tableWebUrl(createdSlug),
         upsertKey: normalizeCreatedTableUpsertKey(options.upsertKey, normalized.keyBySource),
+        sourceKeyMap: normalized.keyBySource,
     };
 }
-async function enqueueImportRows(table, options, rows, format, batchSize, context) {
-    const batches = chunk(rows, batchSize);
-    const maxConcurrency = readPositiveInt(options.maxConcurrency);
-    const upsertKey = context.upsertKey ?? options.upsertKey;
-    const idempotencyKey = buildImportIdempotencyKey({
-        table,
-        sourceHash: context.sourceHash,
-        format,
-        mode: upsertKey ? "upsert" : "insert",
-        upsertKey: upsertKey ?? null,
-        batchSize,
-    });
-    const created = await requestOxygen("/api/cli/table-ingestion-runs", {
+async function tryEnqueueStagedFileImport(// skipcq: JS-R1005
+table, options, format, parsedRows, context) {
+    if (options.create && table) {
+        throw new OxygenError("invalid_import_target", "Pass either a table argument or --create, not both.", {
+            exitCode: 1,
+        });
+    }
+    if (!options.create && !table) {
+        throw new OxygenError("invalid_import_target", "Pass a table argument or --create <name>.", {
+            exitCode: 1,
+        });
+    }
+    const fileBuffer = readFileSync(options.file);
+    const filename = basename(options.file);
+    // Probe for a presigned upload URL. If object storage isn't configured the
+    // server returns object_storage_not_configured; signal the caller to fall
+    // back to the inline multipart import by returning null.
+    let presigned;
+    try {
+        presigned = await requestOxygen("/api/cli/tables/import-url", {
+            method: "POST",
+            body: { file_name: filename, byte_length: fileBuffer.byteLength },
+        });
+    }
+    catch (error) {
+        if (error instanceof OxygenError && error.code === "object_storage_not_configured") {
+            return null;
+        }
+        throw error;
+    }
+    const uploadUrl = readRecordString(presigned, "upload_url");
+    const storageKey = readRecordString(presigned, "storage_key");
+    const storageBucket = readRecordString(presigned, "storage_bucket");
+    const storageProvider = readRecordString(presigned, "storage_provider") ?? "s3";
+    if (!uploadUrl || !storageKey)
+        return null;
+    // Create the table for --create (or resolve the existing ref) before the
+    // upload so a presign success always pairs with a real target.
+    const target = await prepareImportTarget(table, options, parsedRows);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 300_000);
+    let putResponse;
+    try {
+        putResponse = await fetch(uploadUrl, {
+            method: "PUT",
+            body: new Uint8Array(fileBuffer),
+            signal: controller.signal,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!putResponse.ok) {
+        throw new OxygenError("import_upload_failed", `Uploading the import file to object storage failed (HTTP ${putResponse.status}).`, { details: { status: putResponse.status }, exitCode: 1 });
+    }
+    const result = await requestOxygen("/api/cli/tables/import-staged", {
         method: "POST",
+        timeoutMs: 120_000,
         body: {
-            table,
-            source_type: `file.${format}`,
-            mode: upsertKey ? "upsert" : "insert",
-            ...(upsertKey ? { upsert_key: upsertKey } : {}),
-            expected_item_count: batches.length,
-            ...(maxConcurrency ? { max_concurrency: maxConcurrency } : {}),
-            metadata: {
-                command: "tables import",
-                file_name: basename(options.file),
-                format,
-                ...(options.sheet ? { sheet: options.sheet } : {}),
-                requested_row_count: rows.length,
-                batch_size: batchSize,
-                auto_background: context.autoBackground,
-                source_hash: context.sourceHash,
-                idempotency_key: idempotencyKey,
-            },
+            table: target.tableRef,
+            storage_provider: storageProvider,
+            storage_bucket: storageBucket,
+            storage_key: storageKey,
+            format,
+            file_name: filename,
+            byte_length: fileBuffer.byteLength,
+            sha256: context.sourceHash,
+            row_count: parsedRows.length,
+            ...(target.upsertKey ? { upsert_key: target.upsertKey } : {}),
+            ...(target.sourceKeyMap ? { source_key_map: target.sourceKeyMap } : {}),
         },
     });
-    const ingestionRunId = readRequiredResponseString(created, "id");
-    const queueWait = readRecord(created, "queue_wait");
-    if (isTerminalTableIngestionStatus(readRecordString(created, "status"))) {
-        return {
-            ingestionRun: created,
-            ingestionRunId,
-            ...(context.createdTable ? { createdTable: context.createdTable } : {}),
-            ...(readRecordString(created, "web_url") ? { web_url: readRecordString(created, "web_url") } : {}),
-            table_web_url: tableWebUrl(table),
-            background: true,
-            autoBackground: context.autoBackground,
-            sourceType: `file.${format}`,
-            rowCount: rows.length,
-            enqueuedItems: 0,
-            duplicatePositions: 0,
-            batchCount: batches.length,
-            batchSize,
-            mode: upsertKey ? "upsert" : "insert",
-            upsertKey: upsertKey ?? null,
-            idempotencyKey,
-            ...(queueWait ? { queue_wait: queueWait } : {}),
-        };
+    emitQueueWaitStderrNote(readRecord(result, "queue_wait"));
+    return {
+        ...result,
+        ...(target.createdTable ? { createdTable: target.createdTable } : {}),
+        ...(target.tableWebUrl ? { table_web_url: target.tableWebUrl } : {}),
+        background: true,
+        autoBackground: context.autoBackground,
+        import_engine: "bulk_file_v1",
+        storage_provider: storageProvider,
+    };
+}
+async function enqueueImportFile(table, options, format, batchSize, context) {
+    if (options.create && table) {
+        throw new OxygenError("invalid_import_target", "Pass either a table argument or --create, not both.", {
+            exitCode: 1,
+        });
     }
-    let insertedItems = 0;
-    let duplicatePositions = 0;
-    let latestRun = created;
-    for (const [index, batch] of batches.entries()) {
-        const appended = await requestOxygen(`/api/cli/table-ingestion-runs/${encodeURIComponent(ingestionRunId)}/items`, {
-            method: "POST",
-            body: {
-                items: [
-                    {
-                        position: index,
-                        payload: { rows: batch },
-                    },
-                ],
-            },
+    if (!options.create && !table) {
+        throw new OxygenError("invalid_import_target", "Pass a table argument or --create <name>.", {
+            exitCode: 1,
         });
-        insertedItems += readCount(appended.inserted);
-        duplicatePositions += readCount(appended.duplicatePositions);
-        latestRun = appended.run ?? latestRun;
     }
-    emitQueueWaitStderrNote(queueWait);
+    const fileBuffer = readFileSync(options.file);
+    const filename = basename(options.file);
+    const form = new FormData();
+    const file = new File([fileBuffer], filename);
+    form.append("file", file, filename);
+    form.append("filename", filename);
+    form.append("format", format);
+    form.append("batch_size", String(batchSize));
+    form.append("auto_background", String(context.autoBackground));
+    form.append("source_hash", context.sourceHash);
+    if (table)
+        form.append("table", table);
+    if (options.create)
+        form.append("table_name", options.create);
+    const project = readOption(options.project);
+    if (project)
+        form.append("project", project);
+    const upsertKey = readOption(options.upsertKey);
+    if (upsertKey)
+        form.append("upsert_key", upsertKey);
+    if (options.sheet)
+        form.append("sheet", options.sheet);
+    const maxConcurrency = readPositiveInt(options.maxConcurrency);
+    if (maxConcurrency)
+        form.append("max_concurrency", String(maxConcurrency));
+    const result = await requestOxygen("/api/cli/tables/import-file", {
+        method: "POST",
+        timeoutMs: 300_000,
+        formData: form,
+    });
+    emitQueueWaitStderrNote(readRecord(result, "queue_wait"));
     return {
-        ingestionRun: latestRun,
-        ingestionRunId,
-        ...(context.createdTable ? { createdTable: context.createdTable } : {}),
-        ...(readRecordString(latestRun, "web_url") ? { web_url: readRecordString(latestRun, "web_url") } : {}),
-        table_web_url: tableWebUrl(table),
+        ...result,
         background: true,
         autoBackground: context.autoBackground,
-        sourceType: `file.${format}`,
-        rowCount: rows.length,
-        enqueuedItems: insertedItems,
-        duplicatePositions,
-        batchCount: batches.length,
-        batchSize,
-        mode: upsertKey ? "upsert" : "insert",
-        upsertKey: upsertKey ?? null,
-        idempotencyKey,
-        ...(queueWait ? { queue_wait: queueWait } : {}),
     };
 }
 function emitQueueWaitStderrNote(queueWait) {
@@ -3257,7 +3942,8 @@ async function exportTableBundle(table, options) {
     // stdout response a small summary so it's readable.
     return options.output ? summary : { ...summary, bundle };
 }
-async function importTableBundle(options) {
+async function importTableBundle(// skipcq: JS-R1005
+options) {
     const path = options.file;
     if (!path || !path.trim()) {
         throw new OxygenError("invalid_input", "--file is required.", { exitCode: 1 });
@@ -3269,49 +3955,169 @@ async function importTableBundle(options) {
     if (columns.length === 0) {
         throw new OxygenError("invalid_bundle", "Bundle has no columns; nothing to import.", { exitCode: 1 });
     }
-    const tableName = readOption(options.name) ?? bundle.tableName;
-    if (!tableName) {
-        throw new OxygenError("invalid_bundle", "Bundle has no table.name and no --name override was provided.", { exitCode: 1 });
+    const validColumnKeys = new Set(columns.map((column) => column.key).filter((key) => Boolean(key)));
+    const into = readOption(options.into);
+    const upsertKey = readOption(options.key);
+    // Resuming/appending into an existing table without an upsert key would
+    // duplicate every already-imported row. Require --key so the resume matches
+    // rows instead of re-inserting them.
+    if (into && !upsertKey) {
+        throw new OxygenError("invalid_input", "--into requires --key so rows already imported are matched instead of duplicated. Pass --key <uniqueColumn>.", { details: { into }, exitCode: 1 });
     }
-    const createResponse = await requestOxygen("/api/cli/tables", {
-        method: "POST",
-        body: {
-            name: tableName,
-            columns,
-            ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
-        },
-    });
-    const createdTable = readRecord(createResponse, "table");
-    const newTableId = readRecordString(createResponse, "table_id")
-        ?? (createdTable ? readRecordString(createdTable, "id") : null);
-    const newTableSlug = readRecordString(createResponse, "table_slug")
-        ?? (createdTable ? readRecordString(createdTable, "slug") : null);
-    if (!newTableId) {
-        throw new OxygenError("invalid_response", "Table create response did not include an id; bundle import cannot proceed.", { exitCode: 1 });
+    if (upsertKey) {
+        if (upsertKey.startsWith("_")) {
+            throw new OxygenError("invalid_input", "--key must be a workspace column key, not an internal field.", { details: { key: upsertKey }, exitCode: 1 });
+        }
+        if (validColumnKeys.size > 0 && !validColumnKeys.has(upsertKey)) {
+            throw new OxygenError("invalid_input", `--key ${upsertKey} is not a column in this bundle.`, { details: { key: upsertKey, available_keys: [...validColumnKeys] }, exitCode: 1 });
+        }
+    }
+    // Resolve the target table: resume into an existing one (--into), or create a
+    // fresh one from the bundle schema.
+    let newTableId;
+    let newTableSlug;
+    let createdTable;
+    if (into) {
+        const describe = await requestOxygen("/api/cli/tables/describe", { method: "POST", body: { table: into } });
+        const tableMeta = describe.table ?? null;
+        const resolvedId = tableMeta ? readRecordString(tableMeta, "id") : null;
+        if (!resolvedId) {
+            throw new OxygenError("table_not_found", `--into table ${into} was not found in this org.`, { details: { into }, exitCode: 1 });
+        }
+        newTableId = resolvedId;
+        newTableSlug = tableMeta ? readRecordString(tableMeta, "slug") ?? null : null;
+        createdTable = false;
+    }
+    else {
+        const tableName = readOption(options.name) ?? bundle.tableName;
+        if (!tableName) {
+            throw new OxygenError("invalid_bundle", "Bundle has no table.name and no --name override was provided.", { exitCode: 1 });
+        }
+        const createResponse = await requestOxygen("/api/cli/tables", {
+            method: "POST",
+            body: {
+                name: tableName,
+                columns,
+                ...(readOption(options.project) ? { project: readOption(options.project) } : {}),
+            },
+        });
+        const created = readRecord(createResponse, "table");
+        const createdId = readRecordString(createResponse, "table_id")
+            ?? (created ? readRecordString(created, "id") : null);
+        if (!createdId) {
+            throw new OxygenError("invalid_response", "Table create response did not include an id; bundle import cannot proceed.", { exitCode: 1 });
+        }
+        newTableId = createdId;
+        newTableSlug = readRecordString(createResponse, "table_slug")
+            ?? (created ? readRecordString(created, "slug") : null);
+        createdTable = true;
     }
-    const validColumnKeys = new Set(columns.map((column) => column.key).filter((key) => Boolean(key)));
     const stagedRows = bundle.rows.map((row) => stripRowForImport(row, validColumnKeys));
-    let inserted = 0;
+    // In upsert mode every row must carry the key value; otherwise the upsert
+    // route rejects the whole batch midway. Fail fast with a clear message before
+    // writing anything so we never leave a half-imported table behind for a
+    // predictable data problem.
+    if (upsertKey) {
+        const missingIndex = stagedRows.findIndex((row) => row[upsertKey] === undefined || row[upsertKey] === null);
+        if (missingIndex >= 0) {
+            throw new OxygenError("invalid_bundle", `Row ${missingIndex + 1} is missing a value for the upsert key "${upsertKey}".`, { details: { key: upsertKey, row_number: missingIndex + 1 }, exitCode: 1 });
+        }
+    }
+    const resumeCommand = buildBundleResumeCommand({
+        file: path,
+        tableId: newTableId,
+        key: upsertKey ?? null,
+        batchSize,
+    });
+    let processed = 0;
+    let insertedCount = 0;
+    let updatedCount = 0;
     for (let offset = 0; offset < stagedRows.length; offset += batchSize) {
         const batch = stagedRows.slice(offset, offset + batchSize);
         if (batch.length === 0)
             continue;
-        await requestOxygen("/api/cli/tables/rows", {
-            method: "POST",
-            body: { table: newTableId, rows: batch },
-        });
-        inserted += batch.length;
+        try {
+            if (upsertKey) {
+                const response = await requestOxygen("/api/cli/tables/rows/upsert", {
+                    method: "POST",
+                    body: { table: newTableId, key: upsertKey, rows: batch, return: "summary" },
+                });
+                insertedCount += readCount(response.insertedCount);
+                updatedCount += readCount(response.updatedCount);
+            }
+            else {
+                await requestOxygen("/api/cli/tables/rows", {
+                    method: "POST",
+                    body: { table: newTableId, rows: batch },
+                });
+                insertedCount += batch.length;
+            }
+            processed += batch.length;
+        }
+        catch (error) {
+            // A mid-loop failure used to leave a partial table with no way forward.
+            // Surface exactly where it stopped and how to resume so the import is
+            // recoverable instead of a silent half-write.
+            const cause = error instanceof OxygenError
+                ? error.code
+                : error instanceof Error
+                    ? error.message
+                    : "unknown";
+            const recovery = upsertKey
+                ? `Re-run with --into ${newTableId} --key ${upsertKey} to resume — already-imported rows are matched by "${upsertKey}", not duplicated.`
+                : `Resume with: ${resumeCommand}`;
+            throw new OxygenError("bundle_import_incomplete", `Bundle import stopped after ${processed}/${stagedRows.length} rows. ${recovery}`, {
+                details: {
+                    table_id: newTableId,
+                    table_slug: newTableSlug,
+                    rows_total: stagedRows.length,
+                    rows_processed: processed,
+                    failed_batch_offset: offset,
+                    failed_batch_size: batch.length,
+                    mode: upsertKey ? "upsert" : "insert",
+                    ...(upsertKey ? { key: upsertKey } : {}),
+                    resume_command: resumeCommand,
+                    web_url: tableWebUrl(newTableSlug ?? newTableId),
+                    cause,
+                },
+                exitCode: 1,
+            });
+        }
     }
     return {
         table_id: newTableId,
         table_slug: newTableSlug ?? null,
+        created_table: createdTable,
         column_count: columns.length,
-        row_count: inserted,
+        row_count: processed,
+        mode: upsertKey ? "upsert" : "insert",
+        ...(upsertKey
+            ? { upsert_key: upsertKey, inserted_count: insertedCount, updated_count: updatedCount }
+            : {}),
         source_table: bundle.tableSummary,
         schema_version: bundle.schemaVersion,
         web_url: tableWebUrl(newTableSlug ?? newTableId),
     };
 }
+// Builds the exact CLI command that resumes a failed `import-bundle` into the
+// table it already created. Always targets that table with --into + --key so the
+// resume is idempotent; falls back to a <uniqueColumn> placeholder when the
+// original run had no key (insert mode can't be safely auto-resumed).
+function buildBundleResumeCommand(input) {
+    const fileArg = /\s/.test(input.file) ? `"${input.file}"` : input.file;
+    const parts = [
+        "oxygen tables import-bundle",
+        `--file ${fileArg}`,
+        `--into ${input.tableId}`,
+        `--key ${input.key ?? "<uniqueColumn>"}`,
+    ];
+    // 500 is the default in normalizeImportBatchSize; only echo --batch-size when
+    // the user picked something else, to keep the resume command minimal.
+    if (input.batchSize !== 500) {
+        parts.push(`--batch-size ${input.batchSize}`);
+    }
+    return parts.join(" ");
+}
 function toBundleColumn(column) {
     // Persist only the fields `tables create` knows how to ingest. Drop ids,
     // physical column names, archivedAt — those are tenant-local and would
@@ -3458,7 +4264,7 @@ function formatRows(rows, format, columns) {
         };
     }
     // "table": render with type-aware formatting and a Markdown-style frame.
-    const columnByKey = new Map(columns?.map((c) => [c.key, c]) ?? []);
+    const columnByKey = new Map(columns?.map((column) => [column.key, column]) ?? []);
     let rescuedCount = 0;
     const headers = keys.map((key) => columnByKey.get(key)?.label ?? key);
     const formattedRows = rows.map((row) => keys.map((key) => {
@@ -3486,12 +4292,12 @@ function formatRows(rows, format, columns) {
     });
     const renderRow = (cells) => {
         const padded = cells.map((cell, i) => {
-            const w = widths[i] ?? 0;
-            return clipCell(cell, w).padEnd(w);
+            const width = widths[i] ?? 0;
+            return clipCell(cell, width).padEnd(width);
         });
         return `| ${padded.join(" | ")} |`;
     };
-    const separator = `|${widths.map((w) => "-".repeat(w + 2)).join("|")}|`;
+    const separator = `|${widths.map((width) => "-".repeat(width + 2)).join("|")}|`;
     const lines = [renderRow(headers), separator, ...formattedRows.map(renderRow)];
     if (rescuedCount > 0) {
         lines.push("");
@@ -3542,15 +4348,6 @@ function isRecord(value) {
 function tableWebUrl(tableIdOrSlug) {
     return `https://oxygen-agent.com/tables/${encodeURIComponent(tableIdOrSlug)}`;
 }
-function readRequiredResponseString(value, key) {
-    const entry = value[key];
-    if (typeof entry === "string" && entry.trim())
-        return entry.trim();
-    throw new OxygenError("invalid_response", `Oxygen API response is missing ${key}.`, {
-        details: { key },
-        exitCode: 1,
-    });
-}
 function normalizeImportBatchSize(value) {
     const batchSize = readPositiveInt(value) ?? 500;
     if (batchSize > 5000) {
@@ -3564,17 +4361,6 @@ function normalizeImportBatchSize(value) {
 function hashImportFile(path) {
     return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
-function buildImportIdempotencyKey(input) {
-    return [
-        "tables-import",
-        input.table,
-        input.format,
-        input.mode,
-        input.upsertKey ?? "none",
-        String(input.batchSize),
-        input.sourceHash,
-    ].join(":");
-}
 function isTerminalTableIngestionStatus(status) {
     return status === "completed"
         || status === "completed_with_errors"
@@ -3606,15 +4392,20 @@ async function handleWhoamiAction(options) {
         const identity = await requestOxygen("/api/cli/whoami");
         const context = await resolveActiveProfileWithSource();
         if (context.resolution.exists) {
-            const cached = context.resolution.credentials?.identity;
-            const orgChanged = !cached || cached.organization.id !== identity.organization.id;
+            const existingCredentials = context.resolution.credentials;
+            const cached = existingCredentials?.identity;
+            const cachedOrg = existingCredentials?.activeOrganization ?? cached?.organization ?? null;
+            const orgChanged = !cachedOrg || cachedOrg.id !== identity.organization.id;
             const userChanged = !cached || cached.user.id !== identity.user.id;
-            if (orgChanged || userChanged) {
+            if (existingCredentials && (orgChanged || userChanged)) {
                 const refreshed = {
-                    token: context.resolution.credentials.token,
-                    apiUrl: context.resolution.credentials.apiUrl,
+                    token: existingCredentials.token,
+                    apiUrl: existingCredentials.apiUrl,
+                    activeOrganization: storedOrganizationFromOption(identity.organization),
                     identity: identityFromWhoami(identity),
                 };
+                if (existingCredentials.authKind)
+                    refreshed.authKind = existingCredentials.authKind;
                 await saveCredentials(refreshed, process.env, {
                     profile: context.resolution.name,
                     activate: false,
@@ -3638,6 +4429,90 @@ async function handleWhoamiAction(options) {
         process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
     }
 }
+async function handleOnboardingStartAction(options) {
+    try {
+        const data = await requestOxygen("/api/cli/onboarding/start", { method: "POST" });
+        if (options.json) {
+            writeJson(success("onboarding start", data));
+            return;
+        }
+        process.stdout.write(formatOnboardingStart(data));
+    }
+    catch (error) {
+        const failure = toFailure("onboarding start", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+async function handleOnboardingResetAction(options) {
+    if (!options.confirm) {
+        const failure = toFailure("onboarding reset", new OxygenError("confirmation_required", "Refusing to reset onboarding without --confirm. Re-run with `oxygen onboarding reset --confirm`.", { exitCode: 1 }));
+        writeJson(failure);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const data = await requestOxygen("/api/cli/onboarding/reset", {
+            method: "POST",
+            body: { confirm: true },
+        });
+        if (options.json) {
+            writeJson(success("onboarding reset", data));
+            return;
+        }
+        process.stdout.write(formatOnboardingReset(data));
+    }
+    catch (error) {
+        const failure = toFailure("onboarding reset", error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
+function formatOnboardingReset(data) {
+    const lines = [];
+    lines.push(data.message);
+    if (data.cleared && data.cleared_keys.length > 0) {
+        lines.push(`Cleared keys: ${data.cleared_keys.join(", ")}`);
+    }
+    if (data.next_steps.length > 0) {
+        lines.push("");
+        lines.push("Next:");
+        for (const step of data.next_steps)
+            lines.push(`  - ${step}`);
+    }
+    if (data.web_url) {
+        lines.push("");
+        lines.push(`Continue in the web app: ${data.web_url}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatOnboardingStart(data) {
+    const lines = [];
+    lines.push(`Onboarding ${data.context.already_started ? "already started" : "started"} for ${data.organization.name} (${data.organization.slug ?? data.organization.id}).`);
+    if (data.user.domain) {
+        lines.push(`Inferred work domain: ${data.user.domain}`);
+    }
+    else if (data.user.email) {
+        lines.push(`No work domain inferred from ${data.user.email}; the skill will ask you for one.`);
+    }
+    lines.push("");
+    lines.push(`Filled context sections: ${data.context.filled_sections.length > 0 ? data.context.filled_sections.join(", ") : "(none)"}`);
+    lines.push(`Empty context sections:  ${data.context.empty_sections.length > 0 ? data.context.empty_sections.join(", ") : "(none)"}`);
+    lines.push("");
+    lines.push(`Next: load and follow the \`${data.skill_to_load}\` skill.`);
+    lines.push(`  Skill URL: ${data.skill_url}`);
+    if (data.next_steps.length > 0) {
+        lines.push("");
+        lines.push("Steps:");
+        for (const step of data.next_steps)
+            lines.push(`  - ${step}`);
+    }
+    if (data.web_url) {
+        lines.push("");
+        lines.push(`View context in the web app: ${data.web_url}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
 async function handleLoginAction(options) {
     try {
         const data = await login(options);
@@ -3653,19 +4528,21 @@ async function handleLoginAction(options) {
 }
 async function handleAuthUseTokenAction(options) {
     try {
-        const data = await useAuthToken(options);
+        const data = await applyAuthToken(options);
         if (options.json) {
             writeJson(success("auth use-token", {
                 logged_in: true,
                 profile: data.profile,
                 api_url: data.credentials.apiUrl,
-                user: data.identity.user,
-                organization: data.identity.organization,
+                user: data.loginIdentity.user,
+                organization: data.loginIdentity.activeOrganization,
+                organizations: data.loginIdentity.organizations,
+                selection_required: data.loginIdentity.selectionRequired,
                 renamed: data.renamed,
             }));
             return;
         }
-        process.stdout.write(formatLoginSuccess(data.identity, data.credentials, data.profile, { renamed: data.renamed }));
+        process.stdout.write(formatLoginSuccessForResolved(data.loginIdentity, data.profile, { renamed: data.renamed }));
         const hint = await buildPostLoginHint(data.profile);
         if (hint)
             process.stdout.write(hint);
@@ -3679,6 +4556,38 @@ async function handleAuthUseTokenAction(options) {
         process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
     }
 }
+async function handleOrgUseAction(organization, options, command) {
+    try {
+        const data = await requestOxygen("/api/cli/orgs/select", {
+            method: "POST",
+            body: { organization },
+        });
+        const context = await resolveActiveProfileWithSource();
+        const credentials = context.resolution.credentials;
+        const canPersistSelection = Boolean(context.resolution.exists &&
+            credentials &&
+            (credentials.authKind === "user_session" || credentials.token.startsWith("oxy_user_")) &&
+            data.currentOrganization);
+        if (canPersistSelection && data.currentOrganization) {
+            await updateActiveOrganizationForProfile(context.resolution.name, storedOrganizationFromOption(data.currentOrganization));
+        }
+        const result = {
+            ...data,
+            profile: context.resolution.exists ? context.resolution.name : null,
+            selection_persisted: canPersistSelection,
+        };
+        if (options.json) {
+            writeJson(success(command, result));
+            return;
+        }
+        writeJson(result);
+    }
+    catch (error) {
+        const failure = toFailure(command, error);
+        writeJson(failure);
+        process.exitCode = error instanceof OxygenError ? error.exitCode : 1;
+    }
+}
 async function handleProfilesListAction(options) {
     try {
         const state = await listCredentialProfiles();
@@ -3873,9 +4782,8 @@ async function login(options) {
         browser: options.browser !== false,
         json: Boolean(options.json),
     });
-    const credentials = { token, apiUrl };
-    const identity = await requestOxygen("/api/cli/whoami", { credentials });
-    credentials.identity = identityFromWhoami(identity);
+    const loginIdentity = await resolveLoginIdentity(token, apiUrl);
+    const credentials = loginIdentity.credentials;
     const explicitProfile = readOption(options.profile) ?? readEnvProfileName();
     let chosenProfile;
     let renamed = false;
@@ -3883,15 +4791,14 @@ async function login(options) {
         chosenProfile = explicitProfile;
     }
     else {
-        const seed = identity.organization.slug?.trim() || identity.organization.id;
-        const picked = await pickProfileNameForIdentity(identity.organization.id, seed);
+        const picked = await pickProfileForLogin(loginIdentity);
         chosenProfile = picked.name;
         renamed = picked.renamed;
     }
     const profile = await saveCredentials(credentials, process.env, { profile: chosenProfile });
     const skillsInstall = runAutomaticSkillsInstall({ apiUrl: credentials.apiUrl });
     if (!options.json) {
-        process.stdout.write(formatLoginSuccess(identity, credentials, profile, { renamed, skillsInstall }));
+        process.stdout.write(formatLoginSuccessForResolved(loginIdentity, profile, { renamed, skillsInstall }));
         const hint = await buildPostLoginHint(profile);
         if (hint)
             process.stdout.write(hint);
@@ -3900,12 +4807,14 @@ async function login(options) {
         logged_in: true,
         profile,
         api_url: credentials.apiUrl,
-        user: identity.user,
-        organization: identity.organization,
+        user: loginIdentity.user,
+        organization: loginIdentity.activeOrganization,
+        organizations: loginIdentity.organizations,
+        selection_required: loginIdentity.selectionRequired,
         skills_install: skillsInstall,
     };
 }
-async function useAuthToken(options) {
+async function applyAuthToken(options) {
     const token = readOption(options.token);
     if (!token) {
         throw new OxygenError("missing_token", "Pass a CLI API token with --token.", {
@@ -3916,8 +4825,7 @@ async function useAuthToken(options) {
         token,
         apiUrl: normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl()),
     };
-    const identity = await requestOxygen("/api/cli/whoami", { credentials });
-    credentials.identity = identityFromWhoami(identity);
+    const loginIdentity = await resolveLoginIdentity(token, credentials.apiUrl);
     const explicitProfile = readOption(options.profile) ?? readEnvProfileName();
     let chosenProfile;
     let renamed = false;
@@ -3925,31 +4833,83 @@ async function useAuthToken(options) {
         chosenProfile = explicitProfile;
     }
     else {
-        const seed = identity.organization.slug?.trim() || identity.organization.id;
-        const picked = await pickProfileNameForIdentity(identity.organization.id, seed);
+        const picked = await pickProfileForLogin(loginIdentity);
         chosenProfile = picked.name;
         renamed = picked.renamed;
     }
-    const profile = await saveCredentials(credentials, process.env, { profile: chosenProfile });
+    const profile = await saveCredentials(loginIdentity.credentials, process.env, { profile: chosenProfile });
     return {
-        identity,
-        credentials,
-        api_url: credentials.apiUrl,
+        identity: loginIdentity.whoami,
+        loginIdentity,
+        credentials: loginIdentity.credentials,
+        api_url: loginIdentity.credentials.apiUrl,
         profile,
         renamed,
     };
 }
+async function resolveLoginIdentity(token, apiUrl) {
+    if (isUserSessionToken(token)) {
+        const credentials = {
+            token,
+            apiUrl,
+            authKind: "user_session",
+        };
+        const orgs = await requestOxygen("/api/cli/orgs", { credentials });
+        const activeOrganization = orgs.currentOrganization
+            ? storedOrganizationFromOption(orgs.currentOrganization)
+            : null;
+        credentials.activeOrganization = activeOrganization;
+        credentials.identity = identityFromUserAndOrganization(orgs.user, activeOrganization);
+        return {
+            credentials,
+            whoami: null,
+            user: orgs.user,
+            activeOrganization,
+            organizations: orgs.organizations,
+            selectionRequired: Boolean(orgs.selectionRequired),
+        };
+    }
+    const credentials = {
+        token,
+        apiUrl,
+    };
+    if (token.startsWith("oxy_live_"))
+        credentials.authKind = "org_api_key";
+    const identity = await requestOxygen("/api/cli/whoami", { credentials });
+    const activeOrganization = storedOrganizationFromOption(identity.organization);
+    credentials.authKind = identity.authType === "user_session" ? "user_session" : "org_api_key";
+    credentials.activeOrganization = activeOrganization;
+    credentials.identity = identityFromWhoami(identity);
+    return {
+        credentials,
+        whoami: identity,
+        user: identity.user,
+        activeOrganization,
+        organizations: [{ ...identity.organization, selected: true }],
+        selectionRequired: false,
+    };
+}
+function pickProfileForLogin(loginIdentity) {
+    if (loginIdentity.credentials.authKind === "user_session") {
+        const seed = loginIdentity.activeOrganization?.slug
+            ?? loginIdentity.user.email
+            ?? loginIdentity.user.id;
+        return pickProfileNameForUserSession(loginIdentity.user.id, seed);
+    }
+    const organization = loginIdentity.activeOrganization;
+    if (!organization) {
+        return pickProfileNameForUserSession(loginIdentity.user.id, loginIdentity.user.email ?? loginIdentity.user.id);
+    }
+    const seed = organization.slug?.trim() || organization.id;
+    return pickProfileNameForIdentity(organization.id, seed);
+}
 function readEnvProfileName() {
     const value = process.env.OXYGEN_PROFILE?.trim();
     return value ? value : null;
 }
 function identityFromWhoami(response) {
     return {
-        organization: {
-            id: response.organization.id,
-            slug: response.organization.slug ?? null,
-            name: response.organization.name,
-        },
+        organization: storedOrganizationFromOption(response.organization),
         user: {
             id: response.user.id,
             email: response.user.email ?? null,
@@ -3957,6 +4917,26 @@ function identityFromWhoami(response) {
         capturedAt: new Date().toISOString(),
     };
 }
+function identityFromUserAndOrganization(user, organization) {
+    return {
+        organization,
+        user: {
+            id: user.id,
+            email: user.email ?? null,
+        },
+        capturedAt: new Date().toISOString(),
+    };
+}
+function storedOrganizationFromOption(organization) {
+    return {
+        id: organization.id,
+        name: organization.name,
+        slug: organization.slug ?? null,
+    };
+}
+function isUserSessionToken(token) {
+    return token.startsWith("oxy_user_");
+}
 async function buildPostLoginHint(activeProfile) {
     if (output.isTTY !== true || process.env.NO_COLOR) {
         const state = await listCredentialProfiles().catch(() => null);
@@ -3967,8 +4947,8 @@ async function buildPostLoginHint(activeProfile) {
     const state = await listCredentialProfiles().catch(() => null);
     if (!state || state.profiles.length < 2)
         return "";
-    const c = ansi(true);
-    return `\n  ${c.dim("Pin this terminal:")}  ${c.bold(`eval "$(oxygen profiles env ${activeProfile})"`)}\n\n`;
+    const styles = ansi(true);
+    return `\n  ${styles.dim("Pin this terminal:")}  ${styles.bold(`eval "$(oxygen profiles env ${activeProfile})"`)}\n\n`;
 }
 async function promptForToken(options) {
     const fallbackLoginUrl = createCliLoginUrl(options.apiUrl);
@@ -4055,7 +5035,7 @@ async function waitForBrowserToken(session) {
 }
 function createCliLoginUrl(apiUrl) {
     const url = new URL("/auth/sign-in", apiUrl);
-    url.searchParams.set("redirect_url", "/settings/api-keys");
+    url.searchParams.set("redirect_url", "/settings/cli");
     url.searchParams.set("source", "oxygen_cli");
     return url.toString();
 }
@@ -4107,6 +5087,67 @@ function startOxygenSpinner(message) {
         },
     };
 }
+function formatLoginSuccessForResolved(loginIdentity, profile, options = {}) {
+    if (loginIdentity.whoami) {
+        return formatLoginSuccess(loginIdentity.whoami, loginIdentity.credentials, profile, options);
+    }
+    if (loginIdentity.activeOrganization) {
+        return formatLoginSuccess({
+            user: loginIdentity.user,
+            organization: loginIdentity.activeOrganization,
+            apiKey: {
+                id: "user_session",
+                name: "CLI user session",
+                tokenPrefix: loginIdentity.credentials.token.slice(0, 17),
+                tokenSuffix: loginIdentity.credentials.token.slice(-4),
+                kind: "user_session",
+            },
+            authType: "user_session",
+        }, loginIdentity.credentials, profile, options);
+    }
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const email = loginIdentity.user.email ?? loginIdentity.user.id;
+    const fingerprint = createHash("sha256")
+        .update(`oxygen-cli:${loginIdentity.credentials.token}`)
+        .digest("hex");
+    const profileLabel = options.renamed
+        ? `${profile} ${styles.dim("(auto-renamed to avoid collision)")}`
+        : profile;
+    const rows = [
+        ["Account", email],
+        ["Organization", "not selected"],
+        ["Profile", profileLabel],
+        ["API", loginIdentity.credentials.apiUrl],
+        ["Token", `${loginIdentity.credentials.token.slice(0, 17)}...${loginIdentity.credentials.token.slice(-4)}`],
+        ["Fingerprint", formatFingerprint(fingerprint)],
+    ];
+    const labelWidth = Math.max(...rows.map(([label]) => label.length));
+    const wordmark = renderBox([
+        "",
+        ...OXYGEN_WORDMARK.split("\n").map(line => styles.green(line)),
+        "",
+    ]);
+    const orgLines = loginIdentity.organizations.length > 0
+        ? [
+            "",
+            "Available organizations:",
+            ...loginIdentity.organizations.map((organization) => `  - ${organization.name}${organization.slug ? ` (${organization.slug})` : ""}`),
+            "",
+            `Select one: ${styles.bold("oxygen orgs use <organization>")}`,
+        ]
+        : [];
+    return [
+        "",
+        wordmark,
+        "",
+        `${styles.green("[OK]")} ${styles.bold("CLI connected")}`,
+        "",
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
+        ...orgLines,
+        "",
+        ...formatAutomaticSkillsInstallStatusLines(options.skillsInstall),
+    ].join("\n");
+}
 function formatLoginSuccess(identity, credentials, profile, options = {}) {
     const email = identity.user.email ?? identity.user.id;
     const orgName = identity.organization.name || identity.organization.slug || identity.organization.id;
@@ -4118,9 +5159,9 @@ function formatLoginSuccess(identity, credentials, profile, options = {}) {
     const fingerprint = createHash("sha256")
         .update(`oxygen-cli:${credentials.token}`)
         .digest("hex");
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const profileLabel = options.renamed
-        ? `${profile} ${c.dim("(auto-renamed to avoid collision)")}`
+        ? `${profile} ${styles.dim("(auto-renamed to avoid collision)")}`
         : profile;
     // skipcq: JS-0820 — not a React component; rule misfire on array of tuples
     const rows = [
@@ -4134,16 +5175,16 @@ function formatLoginSuccess(identity, credentials, profile, options = {}) {
     const labelWidth = Math.max(...rows.map(([label]) => label.length));
     const wordmark = renderBox([
         "",
-        ...OXYGEN_WORDMARK.split("\n").map(line => c.green(line)),
+        ...OXYGEN_WORDMARK.split("\n").map(line => styles.green(line)),
         "",
     ]);
     return [
         "",
         wordmark,
         "",
-        `${c.green("[OK]")} ${c.bold("CLI connected")}`,
+        `${styles.green("[OK]")} ${styles.bold("CLI connected")}`,
         "",
-        ...rows.map(([label, value]) => `  ${c.dim(label.padEnd(labelWidth))}   ${value}`),
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
         "",
         ...formatAutomaticSkillsInstallStatusLines(options.skillsInstall),
     ].join("\n");
@@ -4157,7 +5198,7 @@ function summarizeCredentialProfile(profile, active) {
         active,
         api_url: profile.apiUrl,
         token_fingerprint: formatFingerprint(createCredentialFingerprint(profile.token)),
-        organization: profile.identity?.organization ?? null,
+        organization: profile.activeOrganization ?? profile.identity?.organization ?? null,
         user: profile.identity?.user ?? null,
         identity_captured_at: profile.identity?.capturedAt ?? null,
     };
@@ -4168,11 +5209,11 @@ function createCredentialFingerprint(token) {
         .digest("hex");
 }
 function formatProfilesList(data) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     if (data.profiles.length === 0) {
         return [
             "",
-            `${c.dim("No stored Oxygen CLI profiles.")}`,
+            `${styles.dim("No stored Oxygen CLI profiles.")}`,
             "",
         ].join("\n");
     }
@@ -4180,7 +5221,7 @@ function formatProfilesList(data) {
     const orgWidth = Math.max(...data.profiles.map((profile) => formatProfileOrgCell(profile).length));
     const lines = [
         "",
-        `${c.bold("Oxygen CLI Profiles")}`,
+        `${styles.bold("Oxygen CLI Profiles")}`,
         "",
         ...data.profiles.map((profile) => {
             const marker = profile.active ? "*" : " ";
@@ -4188,14 +5229,14 @@ function formatProfilesList(data) {
             return [
                 `${marker} ${profile.name.padEnd(nameWidth)}`,
                 orgCell.padEnd(orgWidth),
-                c.dim(profile.api_url),
-                c.dim(profile.token_fingerprint),
+                styles.dim(profile.api_url),
+                styles.dim(profile.token_fingerprint),
             ].join("  ");
         }),
         "",
     ];
     if (data.profiles.length >= 2) {
-        lines.push(`  ${c.dim("Pin a terminal:")}  ${c.bold(`eval "$(oxygen profiles env <profile>)"`)}`);
+        lines.push(`  ${styles.dim("Pin a terminal:")}  ${styles.bold('eval "$(oxygen profiles env <profile>)"')}`);
         lines.push("");
     }
     return lines.join("\n");
@@ -4209,26 +5250,26 @@ function formatProfileOrgCell(profile) {
     return name || slug || profile.organization.id;
 }
 function formatProfileUseSuccess(profile, options) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const lines = [
         "",
-        `${c.green("[OK]")} ${c.bold("CLI profile selected")}`,
+        `${styles.green("[OK]")} ${styles.bold("CLI profile selected")}`,
         "",
-        `  ${c.dim("Profile")}        ${profile.name}`,
-        `  ${c.dim("Organization")}   ${formatProfileOrgCell(profile)}`,
-        `  ${c.dim("API")}            ${profile.api_url}`,
-        `  ${c.dim("Fingerprint")}    ${profile.token_fingerprint}`,
+        `  ${styles.dim("Profile")}        ${profile.name}`,
+        `  ${styles.dim("Organization")}   ${formatProfileOrgCell(profile)}`,
+        `  ${styles.dim("API")}            ${profile.api_url}`,
+        `  ${styles.dim("Fingerprint")}    ${profile.token_fingerprint}`,
         "",
     ];
     if (options.totalProfiles >= 2) {
-        lines.push(`  ${c.dim("Note: this changes the active profile for every shell.")}`);
-        lines.push(`  ${c.dim("To pin this terminal only, run:")} ${c.bold(`eval "$(oxygen profiles env ${profile.name})"`)}`);
+        lines.push(`  ${styles.dim("Note: this changes the active profile for every shell.")}`);
+        lines.push(`  ${styles.dim("To pin this terminal only, run:")} ${styles.bold(`eval "$(oxygen profiles env ${profile.name})"`)}`);
         lines.push("");
     }
     return lines.join("\n");
 }
 function formatWhoami(identity, context) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const email = identity.user.email ?? identity.user.id;
     const orgName = identity.organization.name || identity.organization.slug || identity.organization.id;
     const orgSlug = identity.organization.slug ?? null;
@@ -4239,42 +5280,56 @@ function formatWhoami(identity, context) {
     const rows = [
         ["Account", email],
         ["Organization", org],
-        ["Profile", `${profileName} ${c.dim(`(${sourceLabel})`)}`],
+        ["Profile", `${profileName} ${styles.dim(`(${sourceLabel})`)}`],
         ["API", apiUrl],
     ];
     const labelWidth = Math.max(...rows.map(([label]) => label.length));
-    return [
+    const lines = [
         "",
-        ...rows.map(([label, value]) => `  ${c.dim(label.padEnd(labelWidth))}   ${value}`),
+        ...rows.map(([label, value]) => `  ${styles.dim(label.padEnd(labelWidth))}   ${value}`),
         "",
-    ].join("\n");
+    ];
+    if (identity.onboarding && identity.onboarding.complete === false) {
+        const missing = identity.onboarding.missing_sections.join(", ");
+        lines.push(`  ${styles.dim("Onboarding")}     ${styles.bold("workspace context not loaded")} ${styles.dim(`(missing: ${missing})`)}`, `  ${styles.dim("→ Run")} ${styles.bold("oxygen onboarding start")} ${styles.dim("(or oxygen_onboarding_start in MCP)")}`, "");
+    }
+    return lines.join("\n");
 } // skipcq: JS-C1002
 function formatProfilesCurrent(context) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const sourceLabel = describeProfileSource(context.source);
     if (!context.resolution.exists) {
         return [
             "",
-            `${c.dim("No stored profile resolves for this shell.")}`,
-            `  ${c.dim("Source:")}  ${sourceLabel}`,
-            `  ${c.dim("Run")} ${c.bold("oxygen login")} ${c.dim("to create one.")}`,
+            `${styles.dim("No stored profile resolves for this shell.")}`,
+            `  ${styles.dim("Source:")}  ${sourceLabel}`,
+            `  ${styles.dim("Run")} ${styles.bold("oxygen login")} ${styles.dim("to create one.")}`,
             "",
         ].join("\n");
     }
     const credentials = context.resolution.credentials;
-    const orgCell = credentials.identity
-        ? (credentials.identity.organization.slug && credentials.identity.organization.slug !== credentials.identity.organization.name
-            ? `${credentials.identity.organization.name} (${credentials.identity.organization.slug})`
-            : credentials.identity.organization.name)
+    if (!credentials) {
+        return [
+            "",
+            `${styles.dim("No stored profile resolves for this shell.")}`,
+            `  ${styles.dim("Source:")}  ${sourceLabel}`,
+            "",
+        ].join("\n");
+    }
+    const organization = credentials.activeOrganization ?? credentials.identity?.organization ?? null;
+    const orgCell = organization
+        ? (organization.slug && organization.slug !== organization.name
+            ? `${organization.name} (${organization.slug})`
+            : organization.name)
         : "(unknown — run `oxygen whoami` to refresh)";
     return [
         "",
-        `${c.bold("Active Oxygen CLI Profile")}`,
+        `${styles.bold("Active Oxygen CLI Profile")}`,
         "",
-        `  ${c.dim("Profile")}        ${context.resolution.name}`,
-        `  ${c.dim("Source")}         ${sourceLabel}`,
-        `  ${c.dim("Organization")}   ${orgCell}`,
-        `  ${c.dim("API")}            ${credentials.apiUrl}`,
+        `  ${styles.dim("Profile")}        ${context.resolution.name}`,
+        `  ${styles.dim("Source")}         ${sourceLabel}`,
+        `  ${styles.dim("Organization")}   ${orgCell}`,
+        `  ${styles.dim("API")}            ${credentials.apiUrl}`,
         "",
     ].join("\n");
 }
@@ -4287,28 +5342,28 @@ function describeProfileSource(source) {
     }
 }
 function formatLogoutSuccess(result) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     const removed = result.removedProfile
         ? `profile "${result.removedProfile}" removed`
         : "removed";
     return [
         "",
-        `${c.green("[OK]")} ${c.bold("CLI logged out")}`,
+        `${styles.green("[OK]")} ${styles.bold("CLI logged out")}`,
         "",
-        `  ${c.dim("Credentials")}   ${removed}`,
-        `  ${c.dim("Profiles left")}  ${String(result.remainingProfiles)}`, // skipcq: JS-C1002
+        `  ${styles.dim("Credentials")}   ${removed}`,
+        `  ${styles.dim("Profiles left")}  ${String(result.remainingProfiles)}`, // skipcq: JS-C1002
         "",
     ].join("\n");
 }
 function formatUpdateSuccess(result) {
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     return [
         "",
-        `${c.green("[OK]")} ${c.bold(result.dry_run ? "CLI update command ready" : "CLI update completed")}`,
+        `${styles.green("[OK]")} ${styles.bold(result.dry_run ? "CLI update command ready" : "CLI update completed")}`,
         "",
-        `  ${c.dim("Current")}     ${result.current_version}`,
-        `  ${c.dim("Package")}     ${result.package}`,
-        `  ${c.dim("Command")}     ${result.command}`,
+        `  ${styles.dim("Current")}     ${result.current_version}`,
+        `  ${styles.dim("Package")}     ${result.package}`,
+        `  ${styles.dim("Command")}     ${result.command}`,
         "",
         ...formatAutomaticSkillsInstallStatusLines(result.skills_install),
     ].join("\n");
@@ -4316,25 +5371,25 @@ function formatUpdateSuccess(result) {
 function formatAutomaticSkillsInstallStatusLines(result) {
     if (!result)
         return [];
-    const c = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
     if (!result.attempted) {
         if (result.reason === "dry_run")
             return [];
         return [
-            `${c.dim("Skills")}      skipped (${result.reason ?? "not attempted"})`,
+            `${styles.dim("Skills")}      skipped (${result.reason ?? "not attempted"})`,
             "",
         ];
     }
     if (result.ok) {
         return [
-            `${c.green("[OK]")} ${c.bold("Oxygen skills installed")}`,
+            `${styles.green("[OK]")} ${styles.bold("Oxygen skills installed")}`,
             "",
         ];
     }
     return [
-        `${c.yellow("[WARN]")} Oxygen skills could not be installed; the CLI command still completed.`,
-        `  ${c.dim("Check")} ${"oxygen skills doctor --json"}`,
-        `  ${c.dim("Retry")} ${result.command}`,
+        `${styles.yellow("[WARN]")} Oxygen skills could not be installed; the CLI command still completed.`,
+        `  ${styles.dim("Check")} ${"oxygen skills doctor --json"}`,
+        `  ${styles.dim("Retry")} ${result.command}`,
         "",
     ];
 }
@@ -4371,6 +5426,62 @@ function readCsvOption(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+function splitCsv(value) {
+    return value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+function collectMultiple(value, previous) {
+    return [...previous, value];
+}
+async function buildBlueprintRequestBody(// skipcq: JS-R1005
+slug, options) {
+    const body = {};
+    if (slug?.trim())
+        body.slug = slug.trim();
+    const filePath = readOption(options.file);
+    if (filePath) {
+        const fs = await import("node:fs/promises");
+        const raw = await fs.readFile(filePath, "utf8");
+        body.envelope = JSON.parse(raw);
+    }
+    const fromUrl = readOption(options.fromUrl);
+    if (fromUrl) {
+        const response = await fetch(fromUrl, { headers: { Accept: "application/json" } });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch blueprint from URL (${response.status} ${response.statusText}).`);
+        }
+        const payload = await response.json();
+        body.envelope = payload.blueprint
+            ?? payload.envelope
+            ?? payload;
+    }
+    const inputJson = readOption(options.inputJson);
+    if (inputJson) {
+        try {
+            body.inputs = JSON.parse(inputJson);
+        }
+        catch {
+            throw new Error("--input-json must be valid JSON.");
+        }
+    }
+    const tableRefEntries = Array.isArray(options.tableRef) ? options.tableRef : [];
+    if (tableRefEntries.length > 0) {
+        const refs = {};
+        for (const entry of tableRefEntries) {
+            const [key, value] = entry.split("=");
+            if (key && value)
+                refs[key.trim()] = value.trim();
+        }
+        if (Object.keys(refs).length > 0)
+            body.table_refs = refs;
+    }
+    if (!body.slug && !body.envelope) {
+        throw new Error("Pass a blueprint slug, --file, or --from-url.");
+    }
+    return body;
+}
 function contextAssetsQuery(options) {
     const query = new URLSearchParams();
     if (readOption(options.type))