@oxygen-agent/cli 1.681.3 → 1.686.3

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.681.3
+Version: 1.686.3

package/dist/index.js

@@ -891,8 +891,9 @@ function readJsonFileValue(path, inputName) {
 /**
  * Whitelist mailbox import fields before the local file crosses the network.
  * In particular, a credential cannot be silently sent through the ordinary
- * inline path: the caller must choose --from credentials (or the Hypertide
- * shortcut) so the server applies the encrypted transfer-vault contract.
+ * inline path: the caller must choose --from credentials so the server applies
+ * the encrypted transfer-vault contract. Historical aliases remain accepted by
+ * the parser for backward compatibility but are not advertised.
  */
 function normalizeMailboxImportFile(value, mode) {
     try {
@@ -902,7 +903,7 @@ function normalizeMailboxImportFile(value, mode) {
         if (error instanceof OxygenError &&
             error.message ===
                 "This identity-only import contains a password. Choose a secure credential import for a compatible Google app-password export.") {
-            throw new OxygenError("invalid_request", "Mailbox credentials require --from credentials --vendor <source> (or --from hypertide for a Hypertide export); keep --validate-only for a no-network preflight. An identity import never accepts or forwards passwords.", { exitCode: 1 });
+            throw new OxygenError("invalid_request", "Mailbox credentials require --from credentials --vendor <source>; keep --validate-only for a no-network preflight. An identity import never accepts or forwards passwords.", { exitCode: 1 });
         }
         throw error;
     }
@@ -922,7 +923,7 @@ async function readMailboxImportFile(path) {
         buffer = readFileSync(path);
     }
     catch {
-        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials (or --from hypertide). See https://oxygen-agent.com/docs/providers/mailbox-compatibility.`, { exitCode: 1 });
+        throw new OxygenError("mailbox_import_file_unreadable", `Couldn't read --file '${basename(path)}'. Check that the path exists and is readable. CSV/JSON/JSONL/XLSX identity files are accepted; credential exports require --from credentials --vendor <source>. See https://oxygen-agent.com/docs/providers/mailbox-compatibility.`, { exitCode: 1 });
     }
     if (buffer.byteLength > SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES) {
         throw new OxygenError("invalid_request", `Mailbox import files must be ${SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES / 1024 / 1024} MB or smaller.`, { exitCode: 1 });
@@ -1177,6 +1178,7 @@ function buildCrmRollupBody(options) {
         ...(object ? { object } : {}),
         ...(row ? { row } : {}),
         ...(limit ? { limit: Number.parseInt(limit, 10) } : {}),
+        ...(options.includeLifecycle ? { include_lifecycle: true } : {}),
     };
 }
 function readCrmSetupObjects(value) {
@@ -2594,6 +2596,17 @@ export function createProgram() {
                     : {}),
             },
         }));
+    }))
+        .addCommand(new Command("member-role")
+        .description("Move a member between the admin and member workspace roles. ADMIN ONLY. This is the one Clerk membership change Oxygen makes — inviting people is still done in workspace settings. Use it to demote an admin before `approvals client grant`: a workspace admin's role overrides the restricted client role, so the grant is refused until they are a plain member.")
+        .argument("<email>", "Workspace member's email.")
+        .requiredOption("--role <role>", "admin or member.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (email, options) => {
+        await handleCollabAction("orgs member-role", options, () => requestOxygen("/api/cli/collab/members/workspace-role", {
+            method: "POST",
+            body: { email, role: readOption(options.role) },
+        }), formatCollabWriteResult);
     }));
     program
         .command("support")
@@ -3753,6 +3766,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--limit <n>", "Maximum company rows to scan in one sweep. Defaults to 2000.")
         .option("--dry-run", "Report how many companies disagree with their deals, without writing. A deal with no stage set is not an open deal and is excluded from the comparison, so a blank-stage deal is never reported as drift.")
         .option("--live", "Write the recomputed Open Deal cells. Default is dry-run.")
+        .option("--include-lifecycle", "Also recompute Account Stage from each company's people and deals. Account Stage only moves when a person or deal changes, so a workspace whose records were imported before that projection existed reads Prospect for everything. Free, and dry-run previews it like the rest.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("crm rollup", options, () => requestOxygen("/api/cli/crm/rollup", {
@@ -4192,11 +4206,24 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("enrichment")
         .description("Choose which named enrichments run automatically on new CRM records. The saved set is a STANDING PERMISSION: every record written to the object (imports, inserts, upserts, and `crm assert`) enriches without per-record approval, bounded by the per-batch credit ceiling. Same storage as `oxygen tables auto-run`, in founder words.")
         .addCommand(new Command("list")
-        .description("Show the enrichments available per CRM object: which are armed, what each costs per record, the per-record total, the per-batch credit ceiling, and how much of the column allowance is spent. Read-only, free.")
+        .description("Show the enrichments available per CRM object: which are armed, what each costs per record, the per-record total, the per-batch credit ceiling, how much of the column allowance is spent, and how many records already in the object have never been enriched. Read-only, free.")
         .option("--object <object>", "CRM object slug: companies or people. Omit for every object this workspace has.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleCrmEnrichmentAction("crm enrichment list", options, () => requestOxygen(buildCrmEnrichmentListPath(options)));
+    }))
+        .addCommand(new Command("backfill")
+        .description("Enrich the records you ALREADY have. Arming an enrichment only covers records written from that moment on, so the companies and people already in your CRM stay blank until you run this. Previews for free by default: what is still missing, what one batch costs, and what finishing costs. Add --live --approved --max-credits to actually run a batch; repeat it and the next batch picks up where the last one stopped.")
+        .requiredOption("--object <object>", "CRM object slug: companies or people.")
+        .option("--presets <csv>", "Comma-separated enrichment ids to backfill. Defaults to whatever is armed on the object.")
+        .option("--limit <n>", "How many records this batch enriches. Defaults to 50, max 5000.")
+        .option("--all", "Enrich every record still missing these enrichments, up to 5000 in one batch. Costs the whole `to finish` figure the preview quotes.")
+        .option("--live", "Actually run the batch. Without it this is a free preview that spends nothing.")
+        .option("--approved", "Approve THIS batch after reading the preview. A live paid batch fails with approval_required (exit 7) without it.")
+        .option("--max-credits <n>", "Credit ceiling for this batch. Records beyond it are skipped with credit_limit_reached — the preview says how many that would be. Required for a live paid batch; unused credits are not spent.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleCrmEnrichmentBackfill(options);
     }))
         .addCommand(new Command("enable")
         .description("Arm one enrichment on a CRM object and leave every other choice untouched. Takes effect immediately as a standing permission: new records enrich without per-record approval, capped per batch by the object's credit ceiling.")
@@ -6219,8 +6246,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("client")
         .description("The restricted login an agency hands its client: read the work, comment on it, decide the approvals assigned to them, nothing else. ADMIN ONLY. Invite them to the workspace first — this grants the overlay on an existing membership.")
         .addCommand(new Command("grant")
-        .description("Restrict a member to the client role.")
-        .argument("<email>", "Workspace member's email.")
+        .description("Restrict a member to the client role. An address that is INVITED but has not joined works too: the role is recorded against the invitation and applies the moment they accept, so you do not have to watch for the acceptance and come back.")
+        .argument("<email>", "Workspace member's email, or a pending invitation's email.")
         .option("--json", "Print a JSON envelope.")
         .action(async (email, options) => {
         await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
@@ -6229,8 +6256,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }), formatCollabWriteResult);
     }))
         .addCommand(new Command("revoke")
-        .description("Clear the client role and restore full workspace access.")
-        .argument("<email>", "Workspace member's email.")
+        .description("Clear the client role and restore full workspace access. Works on a pending invitation too, clearing what that address would land as.")
+        .argument("<email>", "Workspace member's email, or a pending invitation's email.")
         .option("--json", "Print a JSON envelope.")
         .action(async (email, options) => {
         await handleCollabAction("approvals client", options, () => requestOxygen("/api/cli/collab/members/role", {
@@ -6239,14 +6266,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }), formatCollabWriteResult);
     }))
         .addCommand(new Command("list")
-        .description("Every member of this workspace and what they may do — the workspace role plus the Oxygen client overlay. Run it after a grant to see the change: this is the same read the /collab/members page renders.")
+        .description("Every member of this workspace and what they may do — the workspace role plus the Oxygen client overlay — followed by anyone invited who has not joined yet, and what they will land as. Also names, per member, why a client grant on them would be refused. Same read the /collab/members page renders.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleCollabAction("approvals client list", options, () => requestOxygen("/api/cli/collab/members"), formatCollabMembers);
     })));
     program
         .command("blueprints")
-        .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For guided GTM plays see `oxygen recipes`.")
+        .description("Scaffolding bundles: a workflow + tables + columns + prompts as shareable JSON. For workflow-specific operating steps, start with `oxygen recipes list <goal> --json`.")
         .addCommand(new Command("list")
         .description("List Oxygen blueprints visible in this workspace (seeds + saved).")
         .argument("[query]", "Search text.")
@@ -6334,12 +6361,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("preflight")
-        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace. Price-aware seeds return a current runtime descriptor upper bound, cap adequacy, and an exact zero-credit apply command.")
+        .description("Preflight a blueprint (slug, local file, or shared URL) against this workspace. Price-aware seeds return a current runtime descriptor upper bound, live/scheduled cap scope and remediation, a zero-spend contract, and an exact apply command.")
         .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
         .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
         .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
         .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
         .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
+        .option("--workflow-id <id>", "Reapply to an existing non-default workflow by database UUID or manifest id/slug; preflight.next preserves the exact selector you supplied, including a database UUID. The shipped LinkedIn monitor reuses its active tables and apply publishes a new disabled revision. An unmatched value previews a separate workflow.")
         .option("--json", "Print a JSON envelope.")
         .action(async (slug, options) => {
         await handleAsyncAction("blueprints preflight", options, async () => {
@@ -6348,24 +6376,18 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("apply")
-        .description("Apply a blueprint: 0 credits and no provider calls or external writes, but creates workspace tables, columns, prompts, and a disabled workflow. It does not enable or run the workflow.")
+        .description("Apply a blueprint: 0 credits and no provider calls or external writes, but creates workspace tables, columns, prompts, and a disabled workflow. Reapplying the shipped LinkedIn monitor reuses its active installed tables. It does not enable or run the workflow.")
         .argument("[slug]", "Blueprint slug (for stored or seed blueprints).")
         .option("--file <path>", "Read a blueprint envelope from a local JSON file.")
         .option("--from-url <url>", "Fetch a shared blueprint envelope from a public Oxygen share URL.")
         .option("--input-json <json>", "Seed blueprint input (parameters) as JSON.")
         .option("--table-ref <ref=id...>", "Reuse an existing table for a blueprint ref (repeatable).", collectMultiple, [])
-        .option("--workflow-id <id>", "Set the new workflow's manifest id/slug; this does not update or reuse an existing workflow.")
+        .option("--workflow-id <id>", "Target an existing workflow by database UUID or manifest id/slug. The shipped LinkedIn monitor reuses its active tables and publishes a new disabled revision; an unmatched value creates a separate workflow.")
         .option("--workflow-name <name>", "Override the resulting workflow name.")
         .option("--json", "Print a JSON envelope.")
         .action(async (slug, options) => {
         await handleAsyncAction("blueprints apply", options, async () => {
             const body = await buildBlueprintRequestBody(slug, options);
-            const workflowId = readOption(options.workflowId);
-            if (workflowId)
-                body.workflow_id = workflowId;
-            const workflowName = readOption(options.workflowName);
-            if (workflowName)
-                body.workflow_name = workflowName;
             return requestOxygen("/api/cli/blueprints/apply", { method: "POST", body });
         });
     }))
@@ -8049,7 +8071,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("topup")
         .description("Buy a custom amount of on-demand credits at $1.25 per 1,000. Run without an amount to inspect the allowed range; checkout happens in Stripe and purchased credits never expire.")
         .argument("[pack]", "Legacy pack alias in USD: 10, 25, 100, or 250.")
-        .option("--credits <n>", "Credits to buy (8,000-200,000 in 1,000-credit increments).")
+        .option("--credits <n>", "Credits to buy (8,000-1,000,000 in 1,000-credit increments).")
         .option("--json", "Print a JSON envelope.")
         .action(async (pack, options) => {
         const credits = readOption(options.credits);
@@ -9504,7 +9526,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("integrations")
-        .description("Integration connections and raw provider-webhook subscriptions. Trigger-ready workspace events live under `workflows events list`. Hypertide mailbox exports use `mailboxes import --from hypertide`, not this group.")
+        .description("Integration connections and raw provider-webhook subscriptions. Trigger-ready workspace events live under `workflows events list`. Local mailbox exports use `mailboxes import`, not this group.")
         .addCommand(new Command("events")
         .description("Inspect raw provider event definitions and manage subscriptions that feed workflows; use `workflows events list` for the trigger-ready workspace catalog.")
         .addCommand(new Command("list")
@@ -12436,7 +12458,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Whitelabel sending inboxes bought through OXYGEN: subscribe a domain + N mailboxes (google/microsoft/azure) as a recurring MONTHLY subscription billed in USD to your Oxygen Email Infrastructure subscription, add-inboxes to a domain you already own, list/get your subscriptions, verify that Oxygen/Stripe/the vendor agree, and cancel. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
+        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. Warmup defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates them in SendKit after provisioning without a second warmup approval. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
         .addCommand(new Command("verify")
         .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -12450,7 +12472,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. Fails closed until the vendor key + founder-signed per-platform pricing are configured. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
+        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Warmup defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. InboxKit warmup needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. This order authorizes automatic SendKit activation after provisioning, so no second `mailboxes warmup enable` approval is needed. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
@@ -12460,7 +12482,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--years <n>", "Years to register the domain for (1-10). Defaults to 1.")
         .option("--redirect-url <url>", "Where the domain's web root redirects. Defaults to your workspace's company website; editable later with `oxygen domains forwarding set`.")
         .option("--billing <path>", "Path to a JSON file with the registrant/WHOIS contact (first_name, last_name, phone, country, city, state, address_line_one, postal_code). Required on your FIRST order; later orders reuse the registrant already on file.")
-        .option("--no-warmup", "Order WITHOUT managed email warm-up. Warm-up is included by default — a new domain needs 14-28 days of warm-up before any cold send, so opting out means bringing your own warm-up provider.")
+        .option("--no-warmup", "Order WITHOUT automatic managed SendKit warm-up. Warm-up is included by default and starts after provisioning under this order approval for the exact quoted Google/Microsoft/Azure addresses; opting out means using BYO warm-up or a later standalone warmup approval.")
         .option("--no-placement", "Order WITHOUT inbox placement. Placement is included by default and covers inbox-placement (spam) testing, blacklist/reputation monitoring, and authentication checks on every inbox.")
         .option("--approved", "Place the order (requires --quote). Without it, a priced preview is returned.")
         .option("--quote <id>", "The quote_id from a fresh preview. Required with --approved.")
@@ -12517,7 +12539,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("add-inboxes")
-        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
+        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing warmup add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. InboxKit warmup needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. The quote authorizes automatic SendKit activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
         .argument("[domain]", "A managed domain this workspace already owns (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
         .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\"}]. The vendor stamps the names on each mailbox, so real names belong here.")
@@ -12635,7 +12657,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("mailboxes")
-        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local Hypertide transfer), pause/disable inboxes, connect EmailGuard monitoring, and run managed SendKit warmup with explicit plans and credit caps. Managed InboxKit Google and Microsoft mailboxes use InboxKit's native Sequencer export during the approved warmup action; SendKit warms them but never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control managed SendKit warmup. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact native Sequencer exports automatically after provisioning under their approved default-on add-on. Standalone warmup plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. SendKit warms them but never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source).")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
@@ -12668,9 +12690,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("compatibility")
-        .description("Read-only compatibility report for every selected mailbox: origin vendor, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, SendKit warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the complete current 18-pair product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
+        .description("Read-only compatibility report for every selected mailbox: generic origin class, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, SendKit warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the current public product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
-        .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and 18-pair provider catalogs; do not read or return workspace mailbox rows.")
+        .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and public provider catalogs; do not read or return workspace mailbox rows.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes compatibility", options, () => {
@@ -12690,14 +12712,14 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>; --from hypertide remains a shortcut. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: managed InboxKit Google/Microsoft warmup uses native InboxKit Sequencer export during `warmup enable`; eligible non-InboxKit Microsoft warmup uses the separate Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
+        .description("Register (or refresh) sending mailboxes in bulk. Use --validate-only with a local file for a non-mutating, no-network preflight; without it, import is a 0-credit state mutation whose upsert is idempotent by mailbox address. CSV/JSON/JSONL/XLSX identity files from any vendor use --file plus optional --vendor. Compatible Google app-password exports use --from credentials --vendor <source>. Connected Zapmail inventories use --from zapmail. In credential files, app_password is Google-only; Microsoft password fields are discarded locally. OAuth grants, MFA/TOTP seeds, and delegation keys never transfer: fresh managed InboxKit Google/Microsoft/Azure orders use automatic native InboxKit Sequencer export when their approved order includes warmup; opted-out/separate managed enrollment uses standalone `warmup enable`; eligible non-InboxKit Microsoft warmup uses the Outlook OAuth fallback (`mailboxes warmup microsoft`); EmailGuard remains vendor_blocked for Microsoft. Google app passwords are sent only in the request body, encrypted server-side, and never returned.")
         .addHelpText("after", [
         "",
         "Ordinary identity file contract (CSV / JSON / JSONL / XLSX):",
         "  Canonical fields: email_address, provider, workspace_external_id?, infrastructure_platform?, tenant_id?. Common vendor aliases such as Email, From Email, ESP, Mailbox ID, and Entra Tenant ID are mapped locally. Credentials are rejected.",
         "",
         "All local file imports:",
-        "  Limits: 500 rows / 5 MB for identity, credential, and Hypertide files.",
+        "  Limits: 500 rows / 5 MB for identity and credential files.",
         "",
         "Credential file contract:",
         '  JSON: {"mailboxes":[{"email_address":"ada@send-acme.com","provider":"google","app_password":"<Google mailbox app password>"}]}',
@@ -12708,7 +12730,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         "",
     ].join("\n"))
         .option("--file <path>", "Local CSV/JSON/JSONL/XLSX file. Common mailbox-vendor headers are normalized locally; only canonical allowlisted fields cross the network.")
-        .option("--from <source>", "Import source: 'credentials' for a compatible Google app-password export, 'hypertide' as its provider shortcut, or 'zapmail' to pull a connected workspace.")
+        .option("--from <source>", "Import source: 'credentials' for a compatible Google app-password export, or 'zapmail' to pull a connected workspace.")
         .option("--vendor <slug>", "Non-secret source provenance (for example instantly, mailforge, or smartlead). Required with --from credentials; optional for identity files.")
         .option("--connection <id>", "Zapmail connection id (--from zapmail). Defaults to the org's active Zapmail connection.")
         .option("--provider <provider>", "Zapmail pool to pull (--from zapmail): google or microsoft. Zapmail's mailbox list is provider-scoped, so the Microsoft pool is only reachable with --provider microsoft; Microsoft mailboxes get their Entra tenant id stamped on import.")
@@ -12726,7 +12748,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 from !== "zapmail" &&
                 from !== "hypertide" &&
                 from !== "credentials") {
-                throw new Error("--from must be credentials, hypertide, or zapmail.");
+                throw new Error("--from must be credentials or zapmail.");
             }
             if (from === "zapmail") {
                 if (validateOnly) {
@@ -12754,7 +12776,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             }
             const sourceProvider = normalizeMailboxImportVendor(vendor, from);
             if (!filePath)
-                throw new Error("Provide --file <path>, --from credentials --vendor <source> --file <path>, --from hypertide --file <path>, or --from zapmail.");
+                throw new Error("Provide --file <path>, --from credentials --vendor <source> --file <path>, or --from zapmail.");
             const mailboxes = normalizeMailboxImportFile(await readMailboxImportFile(resolve(filePath)), from === "hypertide" || from === "credentials"
                 ? "credential"
                 : "identity");
@@ -12901,7 +12923,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, Hypertide, external, or manual mailboxes: it requires an exact list (max 10), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider consent/MFA. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, external, or manual mailboxes: it requires an exact address list (max 10 per command; no domain or directory discovery), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider consent/MFA. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
         .option("--mailboxes <list>", "Comma-separated mailbox addresses. Required for vendor=oxygen (max 10); omit for vendor-provisioned whole-pool flows.")
@@ -12960,7 +12982,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
     }))
         .addCommand(new Command("emailguard")
-        .description("Assess every mailbox origin for EmailGuard and connect credential-capable Google Workspace mailboxes from InboxKit, CMR, Hypertide, or Zapmail. Manual/native Google rows report credential_required; Microsoft 365/Azure reports vendor_blocked. Preview never materializes a password; approved execution fetches it just in time and never prints it.")
+        .description("Assess every mailbox origin for EmailGuard and connect credential-capable Google Workspace mailboxes from managed, Zapmail, or compatible encrypted external imports. Manual/native Google rows report credential_required; Microsoft 365/Azure reports vendor_blocked. Preview never materializes a password; approved execution fetches it just in time and never prints it.")
         .addCommand(new Command("connect")
         .description("Preview or connect selected mailboxes to EmailGuard. Managed mode is 1,000 credits/inbox-month ($1); BYOK is 0 Oxygen credits. Google Workspace requires a real app password, fetched only after approval. Microsoft 365/Azure is explicitly vendor-blocked because EmailGuard exposes neither Microsoft OAuth nor tenant consent; Oxygen never downgrades it to password auth. Starts with a 0-credit, no-provider-write preview. Account connection sends no placement probe.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
@@ -13018,7 +13040,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("delegation")
-        .description("Google sending-domain delegation only — not Microsoft OAuth and not a Hypertide handoff to SendKit warmup or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
+        .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to SendKit warmup or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
         .option("--domain <domain>", "Only report this sending domain.")
         .option("--probe", "Verify each delegated domain by minting a real delegated token per mailbox. Makes one Google token call per mailbox; still 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -13035,9 +13057,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("warmup")
-        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Oxygen enrolls the mailbox for you — preview first, then re-run with --approved to execute and bill. Managed InboxKit Google and Microsoft mailboxes are exported through InboxKit's native Sequencer integration inside that approved action; InboxKit auto-export stays off, and any non-cancelled InboxKit warmup blocks the handoff so one mailbox cannot warm twice. SendKit is warmup-only: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
+        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warmup add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warmup blocks the handoff so one mailbox cannot warm twice. SendKit is warmup-only: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
         .addCommand(new Command("enable")
-        .description("Enroll sending mailboxes in Oxygen's managed SendKit warmup and stamp each mailbox's warmup state. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Managed InboxKit Google and Microsoft mailboxes use InboxKit's native Sequencer export here by default; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. SendKit supplies warmup only — OXYGEN Sequences retain campaign enrollment and dispatch. New enrollments only ever land on SendKit; the retired TrulyInbox rail is refused here and only accepts teardown.")
+        .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed InboxKit targets still use InboxKit's native Sequencer export with exact UIDs; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. SendKit supplies warmup only — OXYGEN Sequences retain campaign enrollment and dispatch. New enrollments only ever land on SendKit; the retired TrulyInbox rail is refused here and only accepts teardown.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13081,7 +13103,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("microsoft")
-        .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for SendKit warmup with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: both Google and Microsoft use InboxKit's native Sequencer export during the separately approved `warmup enable`. For the fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until `warmup enable`.")
+        .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for SendKit warmup with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit Sequencer exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
         .option("--mailboxes <list>", "Comma-separated eligible non-InboxKit Microsoft mailbox ids or addresses. Omit to select the pool; the command refuses a scope containing managed InboxKit rows and points to warmup enable.")
         .option("--tenant <id>", "Deprecated and ignored: SendKit consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
         .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
@@ -13764,7 +13786,7 @@ Run completion:
         .description("Deprecated alias for `oxygen blueprints apply`. Creates a disabled workflow (plus its tables, columns, and prompts) from a blueprint.")
         .argument("<template_id>", "Blueprint slug (formerly workflow template id).")
         .requiredOption("--input-json <json>", "Blueprint input as a JSON object.")
-        .option("--workflow-id <workflow_id>", "Set the new workflow's manifest id/slug; this does not update or reuse an existing workflow.")
+        .option("--workflow-id <workflow_id>", "Select an existing workflow by database UUID or manifest id/slug; an unmatched value creates a separate workflow.")
         .option("--workflow-name <workflow_name>", "Override the resulting workflow name.")
         .option("--mode <mode>", "Deprecated and ignored: the workflow is created disabled.")
         .option("--max-credits <credits>", "Credit ceiling; folded into inputs.max_credits.")
@@ -19563,8 +19585,25 @@ function collabWriteHeadline(data) {
     if (isRecord(data.request)) {
         return `Approval request ${collabText(data.request.id)} is ${collabText(data.request.status)}.`;
     }
+    // `orgs member-role` — the Clerk workspace role, not the Oxygen overlay. It
+    // must be checked BEFORE the overlay branch below: both write payloads are
+    // flat and both carry `email`, so falling through would report a promotion as
+    // "back to full workspace access".
+    if (typeof data.email === "string" && typeof data.workspace_role_choice === "string") {
+        return data.workspace_role_choice === "admin"
+            ? `${data.email} is now a workspace admin.`
+            : `${data.email} is now a workspace member.`;
+    }
     // The member-role write returns the membership fields flat, not nested.
     if (typeof data.email === "string") {
+        // Granting on a PENDING INVITATION changes nobody's access yet. Saying "is
+        // now a client-role member" would tell an agency the client is restricted
+        // while that client has not accepted and holds no membership at all.
+        if (data.pending_invitation === true) {
+            return data.granted === true
+                ? `${data.email} has not joined yet — they will land restricted to the client role.`
+                : `${data.email} has not joined yet — they will land with full workspace access.`;
+        }
         return data.granted === true
             ? `${data.email} is now a client-role member of this workspace.`
             : `${data.email} is back to full workspace access.`;
@@ -19732,6 +19771,31 @@ function formatCollabMembers(data) {
             member.oxygen_role === "client" ? "client" : "—",
             collabText(member.access),
         ])));
+        // Why a grant on a given row would be refused. The payload has carried this
+        // since the web page needed it; printing it is what stops the terminal from
+        // being the surface that only finds out by failing — on an all-admin
+        // workspace EVERY grant is refused, and the table alone never says so.
+        const blocked = members.filter((member) => member.can_restrict === false);
+        if (blocked.length > 0) {
+            lines.push("", `  ${styles.dim("Cannot be restricted to the client role:")}`);
+            for (const member of blocked) {
+                lines.push(`    ${styles.yellow("!")} ${collabText(member.restrict_blocked_reason)}`);
+            }
+        }
+    }
+    // Invited but not joined. They hold nothing yet, so they are listed apart from
+    // the members rather than mixed in with a blank role that reads as access.
+    const invitations = Array.isArray(data.pending_invitations)
+        ? data.pending_invitations.filter(isRecord)
+        : [];
+    if (invitations.length > 0) {
+        lines.push("", styles.bold(`Invited, not joined yet (${invitations.length})`));
+        lines.push(...renderTextTable(["EMAIL", "INVITED AS", "ON JOIN", "INVITED"], invitations.map((invitation) => [
+            collabText(invitation.email),
+            collabText(invitation.workspace_role),
+            invitation.oxygen_role_on_join === "client" ? "client" : "full access",
+            formatCollabAge(invitation.invited_at),
+        ])));
     }
     lines.push(...collabTrailer(data));
     lines.push("");
@@ -20031,11 +20095,35 @@ function pushCrmEnrichmentObject(lines, styles, view) {
         const note = view.custom_columns_uncosted ? ` ${styles.yellow("(cost not included above)")}` : "";
         lines.push(`  ${styles.dim("Extra".padEnd(summaryWidth))}   ${view.custom_columns.join(", ")}${note}`);
     }
+    // The half the config alone cannot show: an armed set says nothing about the
+    // records that were already there when it was armed. Without this line a
+    // workspace reads a correct configuration and never learns that 303 of its
+    // 317 companies are still blank.
+    const backfillLine = formatCrmEnrichmentBacklog(view, styles);
+    if (backfillLine) {
+        lines.push(`  ${styles.dim("Not enriched".padEnd(summaryWidth))}   ${backfillLine}`);
+    }
+    if (view.custom_columns.length > 0) {
+        // A hand-tuned config carries columns no preset owns, so the per-record
+        // figure above can be a floor rather than the bill.
+        const note = view.custom_columns_uncosted ? ` ${styles.yellow("(cost not included above)")}` : "";
+        lines.push(`  ${styles.dim("Extra".padEnd(summaryWidth))}   ${view.custom_columns.join(", ")}${note}`);
+    }
     if (view.changed) {
         lines.push("", ...formatCrmEnrichmentChange(view.changed, styles));
     }
     lines.push("", styles.dim(`View: ${view.deepLink}`), styles.dim(`Runs: ${view.runs_web_url}`));
 }
+function formatCrmEnrichmentBacklog(view, styles) {
+    const backfill = view.backfill;
+    if (!backfill)
+        return null;
+    if (backfill.remaining_rows === 0) {
+        return styles.green(`none — all ${backfill.total_rows.toLocaleString("en-US")} records carry these enrichments`);
+    }
+    return `${styles.yellow(`${backfill.remaining_rows.toLocaleString("en-US")} of ${backfill.total_rows.toLocaleString("en-US")} records`)}`
+        + ` ${styles.dim(`— fill them with \`oxygen crm enrichment backfill --object ${view.object}\``)}`;
+}
 function pushCrmEnrichmentPreset(lines, styles, preset, labelWidth, armed) {
     // Pad the raw marker before colouring it: `[off]` is one character wider than
     // `[on]`, and an ANSI-wrapped padEnd would count the escape codes.
@@ -20088,6 +20176,104 @@ function formatCrmEnrichmentSources(sources) {
     const assertCovered = sources.includes("rows_insert") || sources.includes("rows_upsert");
     return `${labels.join(", ")}${assertCovered ? " (includes `crm assert` writes)" : ""}`;
 }
+function buildCrmEnrichmentBackfillBody(options) {
+    const presets = readCsvOption(options.presets);
+    const limit = readPositiveInt(options.limit);
+    return {
+        object: readOption(options.object) ?? "",
+        // An ABSENT --presets means "whatever is armed"; an explicitly empty one is
+        // still a caller-supplied set, so the two must not collapse.
+        ...(options.presets !== undefined ? { presets } : {}),
+        ...(limit !== undefined ? { limit } : {}),
+        ...(options.all === true ? { all: true } : {}),
+        ...(options.live === true ? { live: true } : {}),
+        ...(options.approved === true ? { approved: true } : {}),
+        ...(readPositiveNumber(options.maxCredits) !== undefined
+            ? { max_credits: readPositiveNumber(options.maxCredits) }
+            : {}),
+    };
+}
+// Backfill prints its own rendering rather than reusing the preset editor's:
+// this command's whole job is to say what is missing and what filling it costs,
+// and a JSON dump buries the one number that decides whether to run it.
+async function handleCrmEnrichmentBackfill(options) {
+    const command = "crm enrichment backfill";
+    try {
+        const data = await requestOxygen("/api/cli/crm/enrichment/backfill", { method: "POST", body: buildCrmEnrichmentBackfillBody(options) });
+        if (options.json) {
+            writeJson(success(command, data));
+            return;
+        }
+        process.stdout.write(formatCrmEnrichmentBackfill(data));
+    }
+    catch (error) {
+        emitCliFailure(command, error);
+    }
+}
+function formatCrmEnrichmentBackfill(view) {
+    const styles = ansi(output.isTTY === true && !process.env.NO_COLOR);
+    const lines = [
+        "",
+        `${styles.bold(`Backfill — ${view.object}`)}  ${view.live ? styles.green("queued") : styles.dim("preview")}`,
+        `  ${styles.dim("Arming an enrichment only covers records written from then on. This fills the ones already here.")}`,
+        "",
+        `  ${formatBackfillHeadline(view, styles)}`,
+        "",
+    ];
+    const labelWidth = Math.max(...view.columns.map((column) => column.label.length), 0);
+    for (const column of view.columns) {
+        const rate = column.credits_per_row === null
+            ? styles.yellow("cost unknown")
+            : formatCrmEnrichmentCredits(column.credits_per_row, styles, "credits/record");
+        const pending = column.billable
+            ? `${column.pending_rows.toLocaleString("en-US")} missing`
+            : styles.dim("derived — fills itself, free");
+        lines.push(`  ${column.label.padEnd(labelWidth)}   ${pending.padEnd(18)}   ${rate}`);
+    }
+    const summary = [
+        ["This batch", `${view.batch.rows.toLocaleString("en-US")} records · ${formatBackfillCredits(view.batch.estimated_credits, styles)}`],
+        ["To finish", `${view.to_finish.rows.toLocaleString("en-US")} records · ${formatBackfillCredits(view.to_finish.estimated_credits, styles)} · ${view.to_finish.batches_at_this_size} batch${view.to_finish.batches_at_this_size === 1 ? "" : "es"} this size`],
+        ["Spendable", view.spendable_credits === null
+                ? styles.dim("unknown")
+                : `${view.spendable_credits.toLocaleString("en-US")} credits ${styles.dim("(balance minus fixed monthly commitments)")}`],
+    ];
+    if (view.batch.recommended_max_credits !== null) {
+        summary.push(["Suggested cap", `${view.batch.recommended_max_credits.toLocaleString("en-US")} credits for this batch`]);
+    }
+    if (view.run) {
+        summary.push(["Run", `${view.run.status} · ${view.run.item_count.toLocaleString("en-US")} items · ${view.run.action_run_id}`]);
+    }
+    if (view.remaining_after_batch !== undefined) {
+        summary.push(["Left after this", `${view.remaining_after_batch.toLocaleString("en-US")} records`]);
+    }
+    const summaryWidth = Math.max(...summary.map(([label]) => label.length));
+    lines.push("", ...summary.map(([label, value]) => `  ${styles.dim(label.padEnd(summaryWidth))}   ${value}`));
+    if (view.to_finish.uncosted_columns.length > 0) {
+        lines.push(`  ${styles.yellow(`Cost unknown for: ${view.to_finish.uncosted_columns.join(", ")} — the figures above are a floor.`)}`);
+    }
+    // The silent failure this command exists to make loud: a ceiling that
+    // truncates the run leaves the rest terminally skipped while the run still
+    // reports completed.
+    if (view.skipped_credit_limit.rows > 0) {
+        lines.push("", `  ${styles.yellow(view.skipped_credit_limit.message)}`);
+    }
+    if (view.credit_guidance && view.credit_posture !== "sufficient") {
+        lines.push("", `  ${styles.yellow(view.credit_guidance)}`);
+    }
+    lines.push("", `  ${styles.dim("Next")}   ${view.next_step}`, ...(view.run_all_step === view.next_step ? [] : [`  ${styles.dim("All ")}   ${view.run_all_step}`]), "", styles.dim(`View: ${view.deepLink}`), styles.dim(`Runs: ${view.run?.web_url ?? view.runs_web_url}`), "");
+    return lines.join("\n");
+}
+function formatBackfillHeadline(view, styles) {
+    if (view.remaining_rows === 0) {
+        return styles.green(`All ${view.total_rows.toLocaleString("en-US")} records already carry these enrichments.`);
+    }
+    return `${styles.bold(view.remaining_rows.toLocaleString("en-US"))} of ${view.total_rows.toLocaleString("en-US")} records are still missing at least one of these enrichments.`;
+}
+function formatBackfillCredits(credits, styles) {
+    if (credits === null)
+        return styles.yellow("cost unknown");
+    return credits === 0 ? styles.green("free") : `${credits.toLocaleString("en-US")} credits`;
+}
 function formatCrmEnrichmentChange(changed, styles) {
     if (changed.enabled_added.length === 0 && changed.enabled_removed.length === 0) {
         return [`  ${styles.dim("No change — that set was already armed.")}`];
@@ -20623,6 +20809,12 @@ slug, options) {
         if (Object.keys(refs).length > 0)
             body.table_refs = refs;
     }
+    const workflowId = readOption(options.workflowId);
+    if (workflowId)
+        body.workflow_id = workflowId;
+    const workflowName = readOption(options.workflowName);
+    if (workflowName)
+        body.workflow_name = workflowName;
     if (!body.slug && !body.envelope) {
         throw new Error("Pass a blueprint slug, --file, or --from-url.");
     }

package/node_modules/@oxygen/shared/dist/billing.d.ts

@@ -29,7 +29,7 @@ export declare const CONTACT_SALES_URL = "https://cal.com/tim-scheuer-mxbib9/45"
 export declare const CREDITS_PER_USD = 1000;
 export declare const TOPUP_USD_CENTS_PER_1K_CREDITS = 125;
 export declare const CREDIT_TOPUP_MIN_CREDITS = 8000;
-export declare const CREDIT_TOPUP_MAX_CREDITS = 200000;
+export declare const CREDIT_TOPUP_MAX_CREDITS = 1000000;
 export declare const CREDIT_TOPUP_STEP_CREDITS = 1000;
 export declare const CREDIT_TOPUP_DEFAULT_CREDITS = 20000;
 export declare function isValidCreditTopupCredits(credits: number): boolean;

package/node_modules/@oxygen/shared/dist/billing.js

@@ -9,10 +9,12 @@ export const CONTACT_SALES_URL = "https://cal.com/tim-scheuer-mxbib9/45";
 // credits bought on demand.
 export const CREDITS_PER_USD = 1_000;
 export const TOPUP_USD_CENTS_PER_1K_CREDITS = 125;
-// Keep on-demand purchases inside the same $10-$250 spend envelope as the
-// original fixed packs, but let customers choose any 1,000-credit increment.
+// On-demand purchases start at the original fixed packs' $10 floor and run up
+// to a $1,250 ceiling, in any 1,000-credit increment. The ceiling is a
+// single-checkout guard rail, not a spend cap: a workspace that needs more
+// tops up again (purchased credits never expire).
 export const CREDIT_TOPUP_MIN_CREDITS = 8_000;
-export const CREDIT_TOPUP_MAX_CREDITS = 200_000;
+export const CREDIT_TOPUP_MAX_CREDITS = 1_000_000;
 export const CREDIT_TOPUP_STEP_CREDITS = 1_000;
 export const CREDIT_TOPUP_DEFAULT_CREDITS = 20_000;
 export function isValidCreditTopupCredits(credits) {

package/node_modules/@oxygen/shared/dist/mailbox-import.js

@@ -208,7 +208,7 @@ export function summarizeMailboxImportValidation(mailboxes, input) {
 export function normalizeMailboxImportVendor(raw, from) {
     if (from === "hypertide") {
         if (raw && raw.trim().toLowerCase() !== "hypertide") {
-            throw new OxygenError("invalid_request", "Hypertide import provenance is fixed to hypertide.", { exitCode: 1 });
+            throw new OxygenError("invalid_request", "This legacy credential-file import is fixed to its original provenance.", { exitCode: 1 });
         }
         return null;
     }

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const OXYGEN_VERSION = "1.681.3";
+export declare const OXYGEN_VERSION = "1.686.3";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";
 export declare const MANAGED_INBOX_MINIMUM_CLI_VERSION = "1.326.2";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.681.3";
+export const OXYGEN_VERSION = "1.686.3";
 // The GLOBAL CLI compatibility floor: the oldest CLI allowed to call any
 // operational route. Raising it hard-rejects every older CLI from the entire
 // product, so it obeys one law, enforced by scripts/ci/cli-min-version-gate.mjs:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.681.3",
+  "version": "1.686.3",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",