@oxygen-agent/cli 1.700.10 → 1.717.9

package/dist/index.js

@@ -13,7 +13,7 @@ import { AGENCY_DIRECTORY_REGIONS, AGENCY_DIRECTORY_SERVICES, COLLAB_GATE_KINDS,
 import { TAG_COLORS } from "@oxygen/shared/select-options";
 import { inferImportColumnLabels, inferRowsFileFormat, normalizeImportColumnKey, normalizeRowsForNewTable, normalizeRowsFormat, parseRowsFileBuffer, parseXlsxWorkbookBuffer, } from "@oxygen/shared/file-import";
 import { MAILBOX_IMPORT_FILE_MAX_BYTES as SHARED_MAILBOX_IMPORT_FILE_MAX_BYTES, MAILBOX_IMPORT_ROW_LIMIT as SHARED_MAILBOX_IMPORT_ROW_LIMIT, normalizeMailboxImportFile as normalizeSharedMailboxImportFile, normalizeMailboxImportVendor as normalizeSharedMailboxImportVendor, normalizeMailboxWorkbookRows, parseMailboxImportText, summarizeMailboxImportValidation as summarizeSharedMailboxImportValidation, } from "@oxygen/shared/mailbox-import";
-import { assertRecipeBundleSafe, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, } from "@oxygen/workflows";
+import { assertRecipeBundleSafe, assertPortableWorkflowDefinition, assertWorkflowGraphManifest, assertWorkflowManifest, buildRecipeManifest, compileWorkflowDefinition, isAnyWorkflowManifest, isRecipeManifest, isWorkflowDefinition, isWorkflowGraphManifest, isWorkflowManifest, hashPortableWorkflowGraphManifest, WORKFLOW_GRAPH_COMPILER_VERSION, WORKFLOW_GRAPH_MANIFEST_VERSION, } from "@oxygen/workflows";
 import { isRecipeDefinition } from "@oxygen/recipe-sdk";
 import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "./browser-login.js";
 import { clearCredentials, defaultApiUrl, listCredentialProfiles, loadCredentials, normalizeApiUrl, pickProfileNameForIdentity, pickProfileNameForUserSession, resolveActiveProfile, saveCredentials, switchCredentialProfile, updateActiveOrganizationForProfile, } from "./credentials.js";
@@ -204,6 +204,22 @@ function buildFindBody(capability, options) {
         body.verify = true;
     return body;
 }
+function suppressionListParams(options) {
+    const params = new URLSearchParams();
+    const reason = readOption(options.reason);
+    const search = readOption(options.search);
+    const limit = readOption(options.limit);
+    const offset = readOption(options.offset);
+    if (reason)
+        params.set("reason", reason);
+    if (search)
+        params.set("search", search);
+    if (limit)
+        params.set("limit", limit);
+    if (offset)
+        params.set("offset", offset);
+    return params;
+}
 // One cadence vocabulary across every scheduled surface (column refresh, table
 // feed): `translateScheduleEvery` in apps/web resolves all four forms, so this
 // string is the single place the CLI spells them out.
@@ -2619,13 +2635,13 @@ export function createProgram() {
     }));
     program
         .command("support")
-        .description("File and track Oxygen support tickets. Staff event automation: this CLI's `support admin events` command.")
+        .description("Open and track Plain support conversations for the active OXYGEN organization.")
         .addCommand(new Command("file")
-        .description("File a support ticket. Use when you're stuck on an Oxygen operation.")
+        .description("Create a Plain support Thread. Use when you're stuck on an OXYGEN operation.")
         .requiredOption("--subject <subject>", "One-line summary of the problem.")
         .option("--body <body>", "What you were doing, what happened, and what you tried.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
-        .option("--category <category>", "Optional category label.")
+        .option("--category <category>", "Request type: question, bug, feature_request, billing, security_data, configuration, agency_directory, or other.")
         .option("--source <source>", "Where the ticket originated. Only slack is supported today.")
         .option("--operation <operation>", "The operation/tool that failed, e.g. oxygen_columns_run.")
         .option("--error-code <code>", "The error envelope code you received.")
@@ -2643,7 +2659,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("list")
-        .description("List support tickets for the active organization.")
+        .description("List Plain support Threads for the active organization.")
         .option("--status <status>", "Filter by status (open, triaging, waiting_on_user, resolved, closed).")
         .option("--limit <n>", "Max tickets to return.")
         .option("--json", "Print a JSON envelope.")
@@ -2651,15 +2667,15 @@ export function createProgram() {
         await handleAsyncAction("support tickets list", options, () => requestOxygen(withSupportListQuery("/api/cli/support/tickets", options)));
     }))
         .addCommand(new Command("get")
-        .description("Show one support ticket with its message thread.")
-        .argument("<ticketId>", "Ticket UUID.")
+        .description("Show one Plain support Thread and its customer-visible timeline.")
+        .argument("<ticketId>", "Plain Thread ID (th_...) or migrated legacy ticket UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
         await handleAsyncAction("support ticket get", options, () => requestOxygen(`/api/cli/support/tickets/${encodeURIComponent(ticketId)}`));
     }))
         .addCommand(new Command("reply")
-        .description("Add a message to a support ticket. Reopens a resolved ticket.")
-        .argument("<ticketId>", "Ticket UUID.")
+        .description("Reply to a Plain Chat thread; migrated or native-channel history continues in one linked Chat thread.")
+        .argument("<ticketId>", "Plain Thread ID (th_...) or migrated legacy ticket UUID.")
         .requiredOption("--body <body>", "Your reply.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
@@ -2669,7 +2685,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("ack")
-        .description("Mark a resolved ticket as seen so it leaves the unread count.")
+        .description("Legacy command; Plain owns delivery and read state.")
         .argument("<ticketId>", "Ticket UUID.")
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
@@ -2677,11 +2693,11 @@ export function createProgram() {
             method: "POST",
             body: {},
         }));
-    }))
+    }), { hidden: true })
         .addCommand(new Command("admin")
-        .description("Staff-only support triage commands.")
+        .description("Legacy commands; staff triage now uses Plain Inbox or Plain MCP.")
         .addCommand(new Command("file")
-        .description("File a support ticket into a customer's workspace on their behalf (staff only).")
+        .description("Retired legacy write; always returns the Plain-cutover error (staff only).")
         .requiredOption("--organization <organization>", "Target organization id or slug the ticket belongs to.")
         .requiredOption("--subject <subject>", "One-line summary of the customer's request.")
         .option("--body <body>", "The customer's request in their words, plus any staff notes.")
@@ -2707,7 +2723,7 @@ export function createProgram() {
         }));
     }))
         .addCommand(new Command("list")
-        .description("List support tickets across all organizations (staff only).")
+        .description("Read the legacy OXYGEN ticket archive across organizations; Plain is the live queue (staff only).")
         .option("--status <status>", "Filter by status.")
         .option("--limit <n>", "Max tickets to return.")
         .option("--json", "Print a JSON envelope.")
@@ -2715,7 +2731,7 @@ export function createProgram() {
         await handleAsyncAction("support admin list", options, () => requestOxygen(withSupportListQuery("/api/cli/admin/support/tickets", options)));
     }))
         .addCommand(new Command("events")
-        .description("Read-only, zero-credit poll of body-free support event envelopes (staff only). Watermark polls replay 24h; dedupe by (ticket_ref, version).")
+        .description("Read-only poll of legacy OXYGEN archive events for cutover compatibility; never use it as the live queue (staff only).")
         .option("--after <cursor>", "If has_more=true, pass next_cursor to continue that scan. If false, persist the non-null watermark_cursor for later polls. A watermark poll intentionally replays the settled 24h window, not only unseen events; dedupe every page by (ticket_ref, version).")
         .option("--limit <n>", "Events to return (1-100, defaults to 50).")
         .option("--json", "Print a JSON envelope.")
@@ -2738,7 +2754,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("support admin events", options, () => requestOxygen(withSupportEventsQuery("/api/cli/admin/support/events", options)));
     }))
         .addCommand(new Command("get")
-        .description("Show one support ticket with a consistent message-thread snapshot (staff only).")
+        .description("Show one legacy archived ticket snapshot; Plain is authoritative for live cases (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
         .option("--if-version <version>", "Require the exact decimal version returned by support admin events; stale versions return a conflict without exposing the thread.")
         .option("--json", "Print a JSON envelope.")
@@ -2746,7 +2762,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("support admin get", options, () => requestOxygen(withSupportAdminGetQuery(`/api/cli/admin/support/tickets/${encodeURIComponent(ticketId)}`, options)));
     }))
         .addCommand(new Command("reply")
-        .description("Add a staff message to a support ticket without resolving it.")
+        .description("Retired legacy write; always returns the Plain-cutover error.")
         .argument("<ticketId>", "Ticket UUID.")
         .requiredOption("--body <body>", "Reply body.")
         .option("--json", "Print a JSON envelope.")
@@ -2757,7 +2773,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("resolve")
-        .description("Resolve a support ticket and notify the opener (staff only).")
+        .description("Retired legacy write; always returns the Plain-cutover error (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
         .requiredOption("--resolution <text>", "Resolution message sent to the opener.")
         .option("--json", "Print a JSON envelope.")
@@ -2768,7 +2784,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("workflow")
-        .description("Track verify/plan/draft triage progress on a support ticket (staff only).")
+        .description("Retired legacy write; Plain notes and downstream engineering work own triage (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
         .option("--verify-status <status>", "Verify step: pending | in_progress | done | blocked | skipped.")
         .option("--verify-notes <text>", "Verification notes. Pass an empty string to clear.")
@@ -2781,7 +2797,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleSupportAdminWorkflowAction(ticketId, options);
     }))
         .addCommand(new Command("update")
-        .description("Change a support ticket's status or assignee, with an optional staff note (staff only).")
+        .description("Retired legacy write; Plain owns status, assignee, and notes (staff only).")
         .argument("<ticketId>", "Ticket UUID.")
         .option("--status <status>", "open | triaging | waiting_on_user | closed. Use the resolve command to resolve.")
         .option("--assign <email>", "Assign the ticket to a staff email.")
@@ -2790,16 +2806,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--json", "Print a JSON envelope.")
         .action(async (ticketId, options) => {
         await handleSupportAdminUpdateAction(ticketId, options);
-    })));
+    })), { hidden: true });
     program
         .command("feedback")
-        .description("Send feedback or a bug report to the Oxygen team, including your current chat transcript and environment info. Files a tracked ticket; you're notified of the reply by email and on your next session.")
+        .description("Send feedback or a bug report to the OXYGEN team. Creates the canonical Plain support Thread; transcripts are never attached unless explicitly requested.")
         .option("-m, --message <message>", "Your feedback or bug report.")
         .option("--severity <severity>", "low | normal | high. Defaults to normal.")
         .option("--category <category>", "Optional category label. Defaults to 'feedback'.")
-        .option("--session-id <id>", "Attach a specific local session transcript by id. Defaults to the most recently active session.")
-        .option("--file <path>", "Attach a specific transcript file instead of auto-detecting the current session.")
-        .option("--no-transcript", "Send your note only, without attaching any chat transcript.")
+        .option("--session-id <id>", "Explicitly attach a specific local session transcript by id.")
+        .option("--file <path>", "Explicitly attach a specific local transcript file.")
+        .option("--include-transcript", "Explicitly attach the most recently active local session after best-effort secret redaction. Review it for sensitive customer data first.")
+        .option("--no-transcript", "Deprecated safety override: send the note without a transcript.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("feedback send", options, () => requestOxygen("/api/cli/feedback", {
@@ -3146,7 +3163,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--title <title>", "Internal title for the queue.")
         .option("--text <text>", "Post text. For LinkedIn mentions, use @<public-identifier> directly.")
         .option("--text-file <path>", "Read post text from a local file.")
-        .option("--content-json <json>", "Structured content. Attach Oxygen media with media_asset_ids; attachments is for provider-ready objects. Composio accepts provider_arguments or composio.arguments.")
+        .option("--content-json <json>", "Structured content. Use media_asset_ids for Oxygen uploads. LinkedIn attachments require [{content:<base64>,content_type:<MIME>,filename:<name>}]; content.mentions is rejected, so put verified @<public-identifier> values in --text. Composio accepts provider_arguments or composio.arguments.")
         .option("--composio-action <slug>", "Override the Composio action slug for this scheduled post.")
         .option("--timezone <tz>", "Display timezone for the scheduled date. Defaults to UTC.")
         .option("--status <status>", "draft or scheduled. Defaults to scheduled.")
@@ -3176,7 +3193,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--title <title>", "Internal title for the queue.")
         .option("--text <text>", "Post text. For LinkedIn mentions, use @<public-identifier> directly.")
         .option("--text-file <path>", "Read post text from a local file.")
-        .option("--content-json <json>", "Structured content. Attach Oxygen media with media_asset_ids; attachments is for provider-ready objects. This replaces the existing content object.")
+        .option("--content-json <json>", "Structured content. Use media_asset_ids for Oxygen uploads. LinkedIn attachments require [{content:<base64>,content_type:<MIME>,filename:<name>}]; content.mentions is rejected, so put verified @<public-identifier> values in --text. This replaces the existing content object.")
         .option("--composio-action <slug>", "Override the Composio action slug for this scheduled post.")
         .option("--publish-at <iso>", "ISO date-time when the post should publish.")
         .option("--timezone <tz>", "Display timezone for the scheduled date.")
@@ -3189,7 +3206,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("approve")
-        .description("Approve a scheduled post so the worker can publish it when due.")
+        .description("Approve a scheduled post so the worker can publish it when due. LinkedIn approval resolves every inline @<public-identifier> and blocks with inspectable details if any mention cannot be verified.")
         .argument("<post_id>", "Scheduled post id.")
         .option("--json", "Print a JSON envelope.")
         .action(async (postId, options) => {
@@ -6943,12 +6960,13 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         }));
     }))
         .addCommand(new Command("materialize")
-        .description("Materialize useful fields from a JSONB result column into target columns.")
+        .description("Copy JSON paths from a result column into existing or new target columns. Without --mappings-json, the fixed work_email preset creates email, email_provider, email_status, and email_enriched_at; it does not target a column named work_email.")
         .argument("<table>", "Table id or slug.")
         .argument("<source_column>", "JSONB source column id or key.")
-        .option("--preset <preset>", "Materialization preset. Currently supports work_email.")
-        .option("--mappings-json <json>", "JSON array of {source_path,target_column,label?,data_type?,semantic_type?} mappings.")
+        .option("--preset <preset>", "Fixed companion-column bundle. work_email creates email, email_provider, email_status, and email_enriched_at; it never binds to an existing work_email column.")
+        .option("--mappings-json <json>", "JSON array of {source_path,target_column,label?,data_type?,semantic_type?} mappings. Use this form to write into an existing column such as work_email.")
         .option("--no-create-if-missing", "Require target companion columns to already exist.")
+        .option("--overwrite-existing", "Replace target values when the materialized source differs. By default only empty targets are filled.")
         .option("--json", "Print a JSON envelope.")
         .action(async (table, sourceColumn, options) => {
         const mappings = options.mappingsJson ? parseJsonArray(options.mappingsJson) : undefined;
@@ -6961,6 +6979,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 ...(mappings ? { mappings } : {}),
                 ...(!mappings ? { preset: preset ?? "work_email" } : preset ? { preset } : {}),
                 create_if_missing: options.createIfMissing !== false,
+                overwrite_existing: options.overwriteExisting === true,
             },
         }));
     }))
@@ -7543,7 +7562,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("search")
-        .description("Agent-operable people, signal, web, scrape, and local-business search jobs. For company search use 'oxygen companies search'.")
+        .description("Agent-operable people, signal, web, scrape, and local-business search jobs. For company search use 'oxygen companies search'; for hiring-based account discovery use 'oxygen companies search plan --prompt <goal> --source-intent hiring'.")
         .addCommand(new Command("plan")
         .description("Plan an Oxygen search or scrape route before running provider jobs.")
         .requiredOption("--goal <file|text>", "Search/scrape goal text, or a local file path containing the goal.")
@@ -7670,7 +7689,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("plan")
         .description("Compile a company-search prompt into ordered provider routes without provider calls.")
         .requiredOption("--prompt <text-or-file>", "Company-search prompt, or a path to a prompt file.")
-        .option("--target-count <n>", "Desired company count for routing and estimates.")
+        .option("--target-count <n>", "Desired company count. Single-plan ceiling 50,000; larger requests return an explicit clamp warning and segmentation guidance.")
         .option("--source-intent <intent>", "Override detected intent: sizing, structured, lookalike, technology, hiring, local, known_source, concept, web, url, or fallback.")
         .option("--filters-json <json-or-file>", "CompanySearchFilters JSON inline or a @file/path; wins over individual flags per top-level filter path.")
         .option("--industries <csv>", "Comma-separated industries to include.")
@@ -7705,7 +7724,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--mode <mode>", "dry_run or live. Defaults to dry_run.")
         .option("--max-pages <n>", "Maximum provider pages to ingest. Defaults to the route estimate.")
         .option("--max-credits <n>", "Required credit ceiling for live runs.")
-        .option("--target-count <n>", "Desired company count when planning from --prompt.")
+        .option("--target-count <n>", "Desired company count when planning from --prompt. Single-plan ceiling 50,000.")
         .option("--source-intent <intent>", "Override detected intent when planning from --prompt.")
         .option("--filters-json <json-or-file>", "CompanySearchFilters JSON inline or a @file/path when planning from --prompt; wins over individual flags per top-level filter path.")
         .option("--industries <csv>", "Comma-separated industries to include when planning from --prompt.")
@@ -7776,10 +7795,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("plan")
         .description("Compile a people-search prompt and optional typed persona filters into ordered provider routes without provider calls.")
         .requiredOption("--prompt <text-or-file>", "People-search prompt, or a path to a prompt file.")
-        .option("--target-count <n>", "Desired contact count for routing and estimates.")
+        .option("--target-count <n>", "Desired contact count. Single-plan ceiling 50,000; larger requests return an explicit clamp warning and segmentation guidance.")
         .option("--source-intent <intent>", "Override detected intent: persona_search, account_contacts, audience_sizing, profile_lookup, concept_persona, or fallback_broad.")
         .option("--filters-json <json-or-file>", "PeopleSearchFilters JSON inline or a @file/path; wins over individual flags per top-level filter path.")
         .option("--titles <csv>", "Comma-separated job titles to include.")
+        .option("--title-match <mode>", "How to match --titles: keyword (default, full-text/partial, highest recall) or exact (literal title only).")
         .option("--adjacent-titles <csv>", "Comma-separated adjacent/looser titles to accept.")
         .option("--exclude-titles <csv>", "Comma-separated job titles to exclude.")
         .option("--seniorities <csv>", "Comma-separated seniority levels: C-Suite, VP, Director, Manager, Staff.")
@@ -7814,10 +7834,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--mode <mode>", "dry_run or live. Defaults to dry_run.")
         .option("--max-pages <n>", "Maximum provider pages to ingest. Defaults to the route estimate.")
         .option("--max-credits <n>", "Required credit ceiling for live runs.")
-        .option("--target-count <n>", "Desired contact count when planning from --prompt.")
+        .option("--target-count <n>", "Desired contact count when planning from --prompt. Single-plan ceiling 50,000.")
         .option("--source-intent <intent>", "Override detected intent when planning from --prompt.")
         .option("--filters-json <json-or-file>", "PeopleSearchFilters JSON inline or a @file/path when planning from --prompt; wins over individual flags per top-level filter path.")
         .option("--titles <csv>", "Comma-separated job titles to include when planning from --prompt.")
+        .option("--title-match <mode>", "How to match --titles: keyword (default, full-text/partial, highest recall) or exact (literal title only).")
         .option("--adjacent-titles <csv>", "Comma-separated adjacent titles when planning from --prompt.")
         .option("--exclude-titles <csv>", "Comma-separated job titles to exclude when planning from --prompt.")
         .option("--seniorities <csv>", "Comma-separated seniority levels when planning from --prompt.")
@@ -7896,26 +7917,31 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
     }));
     program
         .command("limits")
-        .description("Plan-tier limits and spend-safety defaults.")
+        .description("Plan-tier limits, spend-safety defaults, and storage capacity posture.")
         .addCommand(new Command("show")
-        .description("Show this workspace's effective plan-tier limits and spend-safety defaults.")
+        .description("Show effective plan-tier limits, spend-safety defaults, and uncapped-by-plan storage posture.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("limits show", options, () => requestOxygen("/api/cli/limits"));
     }))
         .addCommand(new Command("provider")
-        .description("Per-provider call-rate overrides (the self-serve override for BYOK daily caps).")
+        .description("Per-provider call-rate overrides and BYOK daily warning thresholds. With no subcommand, lists policies (same as `limits provider list`).")
         .addCommand(new Command("list")
-        .description("List this workspace's provider rate-limit overrides and the plan-tier BYOK daily defaults.")
+        .description("List enforced provider overrides and the plan-tier BYOK daily threshold with its enforcement mode.")
+        .option("--provider <provider>", "Filter saved overrides to one provider id; plan-tier defaults are always returned.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("limits provider list", options, () => requestOxygen("/api/cli/limits/provider"));
-    }))
+        const query = new URLSearchParams();
+        if (readOption(options.provider))
+            query.set("provider", readOption(options.provider) ?? "");
+        const suffix = query.toString();
+        await handleAsyncAction("limits provider list", options, () => requestOxygen(`/api/cli/limits/provider${suffix ? `?${suffix}` : ""}`));
+    }), { isDefault: true })
         .addCommand(new Command("set")
-        .description("Set a per-provider call ceiling. Use --window-seconds 86400 to override the BYOK daily default.")
+        .description("Set an enforced per-provider call ceiling. Use --window-seconds 86400 for an explicit daily policy.")
         .requiredOption("--provider <provider>", "Provider id (e.g. hubspot, leadmagic).")
         .requiredOption("--limit <n>", "Calls allowed per window.")
-        .requiredOption("--window-seconds <n>", "Window size in seconds (86400 = the BYOK daily window).")
+        .requiredOption("--window-seconds <n>", "Window size in seconds (86400 = one day).")
         .option("--operation <operation>", "Scope to one operation; omitted = provider-wide.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -8529,7 +8555,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .command("observability")
         .description("Workspace observability: redacted operation events, plus the cross-primitive runs lens and approvals inbox (list-only — decisions route to the owning primitive).")
         .addCommand(new Command("events")
-        .description("List recent redacted operation events and failures. For staff ticket-change envelopes, use this CLI's `support admin events` command.")
+        .description("List recent redacted OXYGEN operation events and failures. Customer support triage and support-event history live in Plain Inbox.")
         // Keep in sync with OBSERVABILITY_STATUS_FILTERS in
         // apps/web/src/lib/observability.ts and the MCP tool enum in
         // packages/mcp-server/src/tools/observability.ts. The API rejects any
@@ -9254,6 +9280,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .option("--no-access-check", "Skip per-tool availability checks for a fast complete-catalog listing. Tools are returned without availability info; pair with --terse for discovery sweeps.")
         .option("--category <category>", "Filter by Oxygen tool category, such as company_search, people_search, research, or local.")
         .option("--capability <tag>", "Filter by capability tag, such as mobile_phone.")
+        .option("--provider <provider>", "Filter to one exact provider id, such as blitzapi.")
         .option("--limit <n>", "Maximum number of tools to return. Capped at 100.")
         .option("--providers", "Also return a per-vendor summary (provider id, display name, tool count) alongside the tools.")
         .option("--json", "Print a JSON envelope.")
@@ -9276,6 +9303,8 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 params.set("category", readOption(options.category) ?? "");
             if (readOption(options.capability))
                 params.set("capability", readOption(options.capability) ?? "");
+            if (readOption(options.provider))
+                params.set("provider", readOption(options.provider) ?? "");
             if (options.providers)
                 params.set("include_providers", "true");
             const limit = readPositiveInt(options.limit);
@@ -11561,7 +11590,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("hubspot-list-import")
         .description("Discover saved HubSpot contact lists and configure one bounded DNC-first automatic import into an Oxygen Sequence. Draft and paused recipients stay pending until launch or resume.")
         .addCommand(new Command("lists")
-        .description("List saved HubSpot contact segments available for a Sequence import. This is one no-bill provider read and changes no members, DNC entries, rows, workflows, or enrollments.")
+        .description("List saved HubSpot contact/company segments and readable identity fields available for a Sequence import. These no-bill definition reads change no members, DNC entries, rows, workflows, or enrollments.")
         .argument("<sequence>", "Sequence id or slug.")
         .option("--query <text>", "Optional case-insensitive words to match in the HubSpot list name.")
         .option("--json", "Print a JSON envelope.")
@@ -11579,6 +11608,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .argument("<sequence>", "Sequence id or slug.")
         .requiredOption("--lead-list <id>", "Exact HubSpot ILS contact-list id whose current members should be imported.")
         .requiredOption("--dnc-list <id>", "Different exact HubSpot ILS contact-list id synchronized additively into Oxygen DNC first.")
+        .option("--company-dnc-list <id>", "Optional HubSpot company-list id synchronized as all-channel company DNC.")
+        .option("--contact-linkedin-property <name>", "Optional contact LinkedIn profile property internal name.")
+        .option("--contact-company-domain-property <name>", "Optional explicit company-domain property on contacts, copied to lead rows.")
+        .option("--contact-company-linkedin-property <name>", "Optional explicit company LinkedIn URL property on contacts.")
+        .option("--company-domain-property <name>", "Company-list domain property (default domain).", "domain")
+        .option("--company-linkedin-property <name>", "Optional company-list LinkedIn URL property.")
         .option("--cron <expression>", "Standing cron cadence. Defaults to every 15 minutes.")
         .option("--timezone <iana>", "IANA timezone. Defaults to UTC.")
         .option("--max-records-per-list <n>", "Hard complete-snapshot cap per list (1-5000).", "5000")
@@ -11609,6 +11644,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     sequence,
                     lead_list_id: options.leadList,
                     dnc_list_id: options.dncList,
+                    ...(readOption(options.companyDncList) ? { company_dnc_list_id: readOption(options.companyDncList) } : {}),
+                    ...(readOption(options.contactLinkedinProperty) ? { contact_linkedin_property: readOption(options.contactLinkedinProperty) } : {}),
+                    ...(readOption(options.contactCompanyDomainProperty) ? { contact_company_domain_property: readOption(options.contactCompanyDomainProperty) } : {}),
+                    ...(readOption(options.contactCompanyLinkedinProperty) ? { contact_company_linkedin_property: readOption(options.contactCompanyLinkedinProperty) } : {}),
+                    ...(readOption(options.companyDomainProperty) ? { company_domain_property: readOption(options.companyDomainProperty) } : {}),
+                    ...(readOption(options.companyLinkedinProperty) ? { company_linkedin_property: readOption(options.companyLinkedinProperty) } : {}),
                     mode: options.live ? "live" : "dry_run",
                     max_records_per_list: maxRecords,
                     max_credits: maxCredits,
@@ -12316,7 +12357,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))));
     program.addCommand(new Command("suppressions")
-        .description("Do-not-contact + email blocklist. People/multichannel: lead provider ids the sequencer enroller skips at plan time (list | add | remove); list rows carry a resolved identity (name / picture / profile URL) when the workspace knows the person. Email blocklist (Instantly parity): addresses + whole-domain blocks the native email dispatcher skips before sending (addresses | domains | remove-address | remove-domain). `import` bulk-loads a mixed file: emails, bare domains, LinkedIn profile URLs, and LinkedIn member ids. Consumes 0 credits.")
+        .description("Unified do-not-contact controls for LinkedIn people, email addresses/domains, phones, and explicit company domain/LinkedIn identities. `import` preserves the legacy mixed-file contract; `import-identities` is the source-neutral typed endpoint; `hubspot lists|sync` arms additive list synchronization. Company DNC applies across Sequence channels and is never inferred from a person's email. Consumes 0 credits.")
         .addCommand(new Command("list")
         .description("List the org's do-not-contact suppressions, newest first. Filter by --reason or by --search (case-insensitive substring of the lead provider id).")
         .option("--reason <reason>", "Filter by reason: manual, replied, unsubscribed, bounced, do_not_contact, friends.")
@@ -12381,7 +12422,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("import")
-        .description("Bulk-import a do-not-contact blocklist from a file (newline / comma / whitespace separated, max 5000). An entry with '@' goes on the per-address email list; a bare domain (e.g. acme.com) blocks the WHOLE domain; a LinkedIn profile URL or member id (ACo...) lands on the people do-not-contact list; any other URL is rejected. A domain block is a sharp tool, so --reason is REQUIRED when the file contains any domains; otherwise manual is the default. Idempotent. Consumes 0 credits.")
+        .description("Bulk-import a do-not-contact blocklist from a file (newline / comma / whitespace separated, max 5000). An entry with '@' goes on the per-address email list; a bare domain (e.g. acme.com) blocks email to that whole domain; a LinkedIn profile URL or member id (ACo...) lands on the people do-not-contact list; any other URL is rejected. A domain block is a sharp tool, so --reason is REQUIRED when the file contains any domains; otherwise manual is the default. Idempotent. Consumes 0 credits.")
         .requiredOption("--file <path>", "Path to a file of emails, bare domains, LinkedIn profile URLs, and/or LinkedIn member ids, separated by newlines, commas, or whitespace.")
         .option("--reason <reason>", "Suppression reason. Emails: hard_bounce | complaint | unsubscribe | manual. Domains: manual | complaint | policy. LinkedIn contacts: manual | replied | unsubscribed | bounced | do_not_contact | friends. Required when the file contains any domains; must be valid for every entry type present (manual always is).")
         .option("--source <text>", "Optional provenance note stored on every imported row (e.g. instantly_export).")
@@ -12425,6 +12466,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     imported_emails: parsed.imported_emails ?? 0,
                     imported_domains: parsed.imported_domains ?? 0,
                     imported_contacts: parsed.imported_contacts ?? 0,
+                    imported_phones: parsed.imported_phones ?? 0,
+                    imported_company_domains: parsed.imported_company_domains ?? 0,
+                    imported_linkedin_companies: parsed.imported_linkedin_companies ?? 0,
+                    accepted_identities: parsed.accepted_identities ?? 0,
                     rejected_count: rejected.length,
                     rejected: rejected.slice(0, 10),
                     ...(rejected.length > 10
@@ -12439,6 +12484,157 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             emitCliFailure("suppressions import", error);
         }
     }))
+        .addCommand(new Command("import-identities")
+        .description("Import a source-neutral typed JSON array into DNC. Kinds: email, phone, linkedin_person, company_domain, linkedin_company. Preferred for integrations; company identities apply across every Sequence channel and are never inferred from a person's email.")
+        .requiredOption("--file <path>", "JSON file containing [{kind,value,reason?,source?,detail?,metadata?}], max 5000.")
+        .option("--reason <reason>", "Default reason for entries that omit one.")
+        .option("--source <text>", "Default provenance for entries that omit one.")
+        .option("--detail <text>", "Default note for entries that omit one.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions import-identities", options, () => {
+            const file = readOption(options.file);
+            if (!file)
+                throw new Error("--file is required.");
+            const identities = readJsonFileValue(resolve(file), "--file");
+            if (!Array.isArray(identities) || identities.length === 0 || identities.length > 5000) {
+                throw new Error("--file must contain a non-empty JSON array with at most 5000 identities.");
+            }
+            const reason = readOption(options.reason);
+            const source = readOption(options.source);
+            const detail = readOption(options.detail);
+            return requestOxygen("/api/cli/suppressions/import", {
+                method: "POST",
+                body: {
+                    identities,
+                    ...(reason ? { reason } : {}),
+                    ...(source ? { source } : {}),
+                    ...(detail ? { detail } : {}),
+                },
+            });
+        });
+    }))
+        .addCommand(new Command("phones")
+        .description("List phone suppressions (strict E.164) used by call, WhatsApp, and Sequence safety gates.")
+        .option("--reason <reason>", "do_not_call, wrong_number, complaint, or manual.")
+        .option("--search <text>", "Phone substring.")
+        .option("--limit <n>", "Maximum rows (1-500).")
+        .option("--offset <n>", "Pagination offset.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions phones", options, () => {
+            const params = suppressionListParams(options);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/suppressions/phones${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("remove-phone")
+        .description("Deliberately remove one strict E.164 phone suppression.")
+        .argument("<phone>", "Strict E.164 number, e.g. +14155550123.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (phone, options) => {
+        await handleAsyncAction("suppressions remove-phone", options, () => requestOxygen(`/api/cli/suppressions/phones?phone=${encodeURIComponent(phone)}`, { method: "DELETE" }));
+    }))
+        .addCommand(new Command("companies")
+        .description("List explicit company-domain and LinkedIn-company suppressions. These stop every Sequence channel.")
+        .option("--kind <kind>", "domain or linkedin_company.")
+        .option("--reason <reason>", "manual, complaint, policy, or do_not_contact.")
+        .option("--search <text>", "Identity substring.")
+        .option("--limit <n>", "Maximum rows (1-500).")
+        .option("--offset <n>", "Pagination offset.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions companies", options, () => {
+            const params = suppressionListParams(options);
+            const kind = readOption(options.kind);
+            if (kind)
+                params.set("kind", kind);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/suppressions/companies${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("remove-company")
+        .description("Deliberately remove one explicit company suppression.")
+        .requiredOption("--kind <kind>", "domain or linkedin_company.")
+        .requiredOption("--value <identity>", "Domain or canonical LinkedIn company URL.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions remove-company", options, () => {
+            const kind = readOption(options.kind);
+            const value = readOption(options.value);
+            if (!kind || !value)
+                throw new Error("--kind and --value are required.");
+            const params = new URLSearchParams({ kind, value });
+            return requestOxygen(`/api/cli/suppressions/companies?${params.toString()}`, { method: "DELETE" });
+        });
+    }))
+        .addCommand(new Command("hubspot")
+        .description("Discover and synchronize HubSpot contact/company saved lists into the shared Oxygen DNC endpoint.")
+        .addCommand(new Command("lists")
+        .description("List contact/company saved lists and readable identity properties. Reads definitions only; no memberships or writes.")
+        .option("--query <text>", "Optional list-name search.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions hubspot lists", options, () => {
+            const params = new URLSearchParams();
+            const query = readOption(options.query);
+            if (query)
+                params.set("query", query);
+            const suffix = params.toString();
+            return requestOxygen(`/api/cli/suppressions/hubspot-sync${suffix ? `?${suffix}` : ""}`);
+        });
+    }))
+        .addCommand(new Command("sync")
+        .description("Preview or arm additive HubSpot → DNC sync. Requires at least one contact/company list. Live requires the exact dry-run fingerprint and approval; never enrolls or sends.")
+        .option("--contact-list <id>", "Optional HubSpot contact DNC list id.")
+        .option("--company-list <id>", "Optional HubSpot company DNC list id.")
+        .option("--contact-linkedin-property <name>", "Optional contact LinkedIn profile property.")
+        .option("--company-domain-property <name>", "Company domain property (default domain).", "domain")
+        .option("--company-linkedin-property <name>", "Optional company LinkedIn URL property.")
+        .option("--cron <expression>", "Schedule; default every 15 minutes.")
+        .option("--timezone <iana>", "Schedule timezone; default UTC.")
+        .option("--max-records-per-list <n>", "Complete-snapshot cap (1-5000).", "5000")
+        .option("--max-credits <n>", "Hard credits cap per delivery.", "10")
+        .option("--reviewed-fingerprint <hash>", "Exact dry-run fingerprint, required for live.")
+        .option("--idempotency-key <key>", "Optional first-run idempotency key.")
+        .option("--live", "Arm the Workflow and queue the first durable run.")
+        .option("--approved", "Approve the reviewed bounded recurring reads and additive DNC writes.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction("suppressions hubspot sync", options, () => {
+            const contactList = readOption(options.contactList);
+            const companyList = readOption(options.companyList);
+            if (!contactList && !companyList)
+                throw new Error("Pass --contact-list and/or --company-list.");
+            const maxRecords = readPositiveInt(options.maxRecordsPerList);
+            const maxCredits = readPositiveNumber(options.maxCredits);
+            if (maxRecords === undefined || maxRecords > 5000)
+                throw new Error("--max-records-per-list must be between 1 and 5000.");
+            if (maxCredits === undefined)
+                throw new Error("--max-credits must be positive.");
+            const fingerprint = readOption(options.reviewedFingerprint);
+            if (options.live && !fingerprint)
+                throw new Error("Live activation requires --reviewed-fingerprint from the exact dry-run.");
+            return requestOxygen("/api/cli/suppressions/hubspot-sync", {
+                method: "POST",
+                body: {
+                    contact_list_id: contactList ?? null,
+                    company_list_id: companyList ?? null,
+                    mode: options.live ? "live" : "dry_run",
+                    max_records_per_list: maxRecords,
+                    max_credits: maxCredits,
+                    ...(readOption(options.contactLinkedinProperty) ? { contact_linkedin_property: readOption(options.contactLinkedinProperty) } : {}),
+                    ...(readOption(options.companyDomainProperty) ? { company_domain_property: readOption(options.companyDomainProperty) } : {}),
+                    ...(readOption(options.companyLinkedinProperty) ? { company_linkedin_property: readOption(options.companyLinkedinProperty) } : {}),
+                    ...(readOption(options.cron) ? { cron: readOption(options.cron) } : {}),
+                    ...(readOption(options.timezone) ? { timezone: readOption(options.timezone) } : {}),
+                    ...(fingerprint ? { reviewed_fingerprint: fingerprint } : {}),
+                    ...(readOption(options.idempotencyKey) ? { idempotency_key: readOption(options.idempotencyKey) } : {}),
+                    ...(options.approved ? { approved: true } : {}),
+                },
+            });
+        });
+    })))
         .addCommand(new Command("domains")
         .description("List the org's whole-domain email blocks, newest first. Filter by --reason (manual | complaint | policy) or --search (case-insensitive substring of the domain).")
         .option("--reason <reason>", "Filter by reason: manual, complaint, policy.")
@@ -12565,7 +12761,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })));
     program.addCommand(new Command("managed-inboxes")
-        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. Warmup defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates them in SendKit after provisioning without a second warmup approval. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The vendor is chosen for you; --vendor pins one.")
+        .description("Managed sending inboxes bought through OXYGEN: subscribe a domain + N InboxKit mailboxes (google/microsoft/azure) as a recurring monthly Oxygen-credit purchase, add inboxes to a domain you already own, inspect/verify, and cancel. OXYGEN Warm-up defaults on when available: its quoted recurring credits and exact future addresses are part of the order approval, and the worker activates it after provisioning without a second warmup approval. Subscribe/add-inboxes/cancel are approval-gated (preview → re-run with --approved --quote). The inbox vendor is chosen for you; --vendor pins one.")
         .addCommand(new Command("verify")
         .description("Check that OXYGEN, STRIPE, and the VENDOR agree about what this org is buying. The truth about a managed inbox lives in three systems — what the customer asked for, what they are charged, and what is actually running — and a 200 from any one of them proves nothing. Reports every disagreement with WHO IS LOSING MONEY while it stands (customer_overbilled first, then oxygen_pays). Read-only, no writes, 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -12579,17 +12775,17 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("managed-inboxes registrant", options, () => requestOxygen("/api/cli/managed-inboxes/registrant"));
     }))
         .addCommand(new Command("subscribe")
-        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. Warmup defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. InboxKit warmup needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. This order authorizes automatic SendKit activation after provisioning, so no second `mailboxes warmup enable` approval is needed. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
+        .description("Subscribe a NEW domain + mailboxes as a managed monthly inbox subscription. WITHOUT --approved this prints a priced PREVIEW with a quote_id (nothing ordered, nothing charged); re-run with --approved --quote <id> to place the order. OXYGEN Warm-up defaults on for Google, Microsoft, and Azure when available: preview and approved responses carry `warmup_activation` with the exact `mailboxes` and `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. Managed warm-up needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. This order authorizes automatic OXYGEN Warm-up activation after provisioning, so no second `mailboxes warmup enable` approval is needed. Prices come from the vendor's LIVE rate card and LIVE domain price, and are refused if they sit below vendor cost. To add mailboxes to a domain you ALREADY own use `managed-inboxes add-inboxes` — this command always registers a new domain and fails on one you own.")
         .argument("[domain]", "Sending domain to register + host the mailboxes (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "Sending domain (alternative to the positional argument).")
         .requiredOption("--provider <provider>", "Mailbox PLATFORM: google, microsoft, or azure. (google/microsoft cap at 5 mailboxes per domain; azure allows 100.)")
         .option("--vendor <vendor>", "Pin the vendor: inboxkit or cmr. Omit to let OXYGEN choose. A named vendor with no credential FAILS rather than falling back to another.")
-        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\"}].")
+        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}]. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL — the vendor fetches it server-side at provisioning, so an expiring CDN link (e.g. a media.licdn.com URL with e=<epoch>) ships the mailbox faceless. Use `oxygen managed-inboxes upload-avatar <path>` to host one.")
         .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
         .option("--years <n>", "Years to register the domain for (1-10). Defaults to 1.")
         .option("--redirect-url <url>", "Where the domain's web root redirects. Defaults to your workspace's company website; editable later with `oxygen domains forwarding set`.")
         .option("--billing <path>", "Path to a JSON file with the registrant/WHOIS contact (first_name, last_name, phone, country, city, state, address_line_one, postal_code). Required on your FIRST order; later orders reuse the registrant already on file.")
-        .option("--no-warmup", "Order WITHOUT automatic managed SendKit warm-up. Warm-up is included by default and starts after provisioning under this order approval for the exact quoted Google/Microsoft/Azure addresses; opting out means using BYO warm-up or a later standalone warmup approval.")
+        .option("--no-warmup", "Order WITHOUT automatic OXYGEN Warm-up. Warm-up is included by default and starts after provisioning under this order approval for the exact quoted Google/Microsoft/Azure addresses; opting out means using BYO warm-up or a later standalone warmup approval.")
         .option("--no-placement", "Order WITHOUT inbox placement. Placement is included by default and covers inbox-placement (spam) testing, blacklist/reputation monitoring, and authentication checks on every inbox.")
         .option("--approved", "Place the order (requires --quote). Without it, a priced preview is returned.")
         .option("--quote <id>", "The quote_id from a fresh preview. Required with --approved.")
@@ -12646,10 +12842,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("add-inboxes")
-        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing warmup add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. InboxKit warmup needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. The quote authorizes automatic SendKit activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
+        .description("Add mailboxes to a managed domain you ALREADY own — no new domain is registered and there is NO domain registration charge, only the extra inboxes' monthly rate (plus their add-ons). WITHOUT --approved this prints a priced PREVIEW with a quote_id and orders nothing; re-run with --approved --quote <id> to place the order. When the standing OXYGEN Warm-up add-on is enabled and available, preview and approved responses carry `warmup_activation` for only the exact newly added `mailboxes`, with `scope=warmup_only`; it is null when warmup is disabled or unavailable. For InboxKit, that object also carries `transport=inboxkit_sequencer_export`, `mailbox_credentials_required=false`, and `native_send_oauth_separate=true`. Managed warm-up needs no Google/Microsoft OAuth or mailbox password. Native sending authorization is separate and may still be required before OXYGEN can send. The quote authorizes automatic OXYGEN Warm-up activation after provisioning, so do not run a second warmup approval. Capped per domain by the platform the domain was bought on (5 google/microsoft, 100 azure) COUNTING the inboxes already on it. To register a NEW domain use `managed-inboxes subscribe` instead.")
         .argument("[domain]", "A managed domain this workspace already owns (e.g. send.acme.com). May also be passed as --domain.")
         .option("--domain <domain>", "The managed inbox domain (alternative to the positional argument).")
-        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\"}]. The vendor stamps the names on each mailbox, so real names belong here.")
+        .option("--mailboxes <json>", "JSON array of mailboxes: [{\"username\",\"first_name\",\"last_name\",\"profile_picture_url\"}]. The vendor stamps the names on each mailbox, so real names belong here. profile_picture_url is optional and must be a PUBLIC, PERMANENT https URL the vendor can fetch at provisioning; `oxygen managed-inboxes upload-avatar <path>` returns one.")
         .option("--file <path>", "Path to a JSON file { \"mailboxes\": [...] } (alternative to --mailboxes).")
         .option("--count <n>", "Shorthand for --mailboxes: how many inboxes to add. Requires --prefix.")
         .option("--prefix <base>", "Shorthand username base for --count: `--count 3 --prefix ada` adds ada1, ada2, ada3 with placeholder names (Ada 1, Ada 2, Ada 3). Pass --mailboxes/--file instead when the inboxes need real human names.")
@@ -12762,9 +12958,54 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                 },
             });
         });
+    }))
+        .addCommand(new Command("upload-avatar")
+        .description("Host a mailbox profile picture and print the URL to pass as profile_picture_url. The inbox vendor FETCHES that URL from its own servers when it provisions the mailbox — often long after the order — so it must be public and permanent. A LinkedIn photo URL is neither: media.licdn.com links carry an e=<epoch> expiry and the mailbox ends up faceless. Uploads a PNG, JPEG, or WebP (max 8MB); nothing is charged.")
+        .argument("<path>", "Path to a PNG, JPEG, or WebP image.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (path, options) => {
+        await handleAsyncAction("managed-inboxes upload-avatar", options, async () => {
+            const resolved = resolve(path);
+            const bytes = readFileSync(resolved);
+            const contentType = imageContentTypeForPath(resolved);
+            // Same three hops the web wizard uses: presign, PUT the bytes
+            // straight to object storage, then confirm — the confirm step is
+            // where the server sniffs the real bytes.
+            const ticket = await requestOxygen("/api/cli/managed-inboxes/avatars", {
+                method: "POST",
+                body: { content_type: contentType, content_length: bytes.byteLength },
+            });
+            const upload = readRecord(ticket, "upload");
+            const uploadUrl = readRecordString(upload, "url");
+            const storageKey = readRecordString(ticket, "storage_key");
+            if (!uploadUrl || !storageKey) {
+                throw new OxygenError("invalid_response", "Oxygen API response is missing the avatar upload URL.", { exitCode: 1 });
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 120_000);
+            let putResponse;
+            try {
+                putResponse = await fetch(uploadUrl, {
+                    method: "PUT",
+                    body: new Uint8Array(bytes),
+                    headers: { "content-type": contentType },
+                    signal: controller.signal,
+                });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            if (!putResponse.ok) {
+                throw new OxygenError("avatar_upload_failed", `Uploading the photo to object storage failed (HTTP ${putResponse.status}).`, { details: { status: putResponse.status }, exitCode: 1 });
+            }
+            return await requestOxygen("/api/cli/managed-inboxes/avatars", {
+                method: "PATCH",
+                body: { storage_key: storageKey },
+            });
+        });
     })));
     program.addCommand(new Command("mailboxes")
-        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control managed SendKit warmup. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact native Sequencer exports automatically after provisioning under their approved default-on add-on. Standalone warmup plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. SendKit warms them but never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
+        .description("Native email sending pool: register/refresh Google/Microsoft mailboxes (including secure local credential-file transfer), pause/disable inboxes, connect EmailGuard monitoring, and inspect/control OXYGEN Warm-up. Fresh managed InboxKit Google/Microsoft/Azure orders activate exact native warm-up exports automatically after provisioning under their approved default-on add-on. Standalone warm-up plans and credit caps are for BYOK/imported mailboxes, managed opt-outs, or later separate enrollment. OXYGEN Warm-up never owns campaign dispatch. Safe import preflight: run `oxygen mailboxes compatibility --catalog-only --json`, then `oxygen mailboxes import --file <path> --validate-only --json` (add the credential source flags shown by import help when the file contains credentials).")
         .addCommand(new Command("list")
         .description("List the org's sending mailboxes with provider, status, warmup state, source (managed = bought through Oxygen, byok = bring-your-own), and a pool overview (including counts by source). To see only Google/Microsoft mailboxes that still need OAuth connection and the right remedy for each, use `oxygen mailboxes oauth-health --json`.")
         .option("--status <status>", "Filter by status: active, paused, or disabled.")
@@ -12784,7 +13025,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("get")
-        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block SendKit warmup or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
+        .description("Get one sending mailbox's configuration/readiness detail (provider, status, daily cap, warmup state, auth mode, and source — managed vs bring-your-own) plus a one-row pool summary. This is not sent/replied/bounced performance; use `oxygen sequences analytics` for native Sequence attribution by mailbox/domain. An ineligible native-send transport includes transport_reason + transport_hint; it does not by itself block OXYGEN Warm-up or EmailGuard monitoring. <mailbox> accepts a mailbox id or email address.")
         .argument("<mailbox>", "Mailbox id or email address.")
         .option("--json", "Print a JSON envelope.")
         .action(async (mailbox, options) => {
@@ -12826,7 +13067,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         await handleAsyncAction("mailboxes health", options, () => requestOxygen("/api/cli/mailboxes/health"));
     }))
         .addCommand(new Command("compatibility")
-        .description("Read-only compatibility report for every selected mailbox: generic origin class, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, SendKit warmup path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the current public product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
+        .description("Read-only compatibility report for every selected mailbox: generic origin class, real infrastructure tier (including InboxKit Azure), OXYGEN native-send connection quality, OXYGEN Warm-up path, EmailGuard monitoring path, and exact next actions. Native send distinguishes destination-bound OAuth, provider-managed API transport, admin delegation, and authorization_required. Use --catalog-only for the compact workspace-independent import contract. JSON data.compatibility contains checked rows; data.import_methods and data.import_fields describe accepted transfer inputs; data.provider_matrix is the current public product matrix; data.non_transferable_auth names credentials that must be reconnected; data.summary rolls up states; data.web_url opens the pool. Downstream states distinguish credential_required, consent_required, and vendor_blocked. Never decrypts a credential or calls a downstream provider.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--catalog-only", "Return only the bounded import-method, field, auth-boundary, and public provider catalogs; do not read or return workspace mailbox rows.")
         .option("--json", "Print a JSON envelope.")
@@ -13059,10 +13300,12 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("connect-oauth")
-        .description("Connect Google/Microsoft mailboxes to OXYGEN native send with fresh destination-bound OAuth. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen handles imported, external, or manual mailboxes: it requires an exact address list (max 10 per reviewed command; no domain or directory discovery), returns one OXYGEN browser link per candidate, and stores a grant only after that exact mailbox completes provider sign-in/MFA. Microsoft also returns one tenant-admin fallback per resolved Entra tenant: try exact-account links first, and use setup only if Microsoft requests admin approval. Tenant approval covers app permissions but never imports or authorizes the directory. The 10-address boundary limits one human consent run, not the mailbox pool. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. --vendor zapmail (default) hands a provisioned pool to Zapmail Custom OAuth; --vendor inboxkit requests domain-gated consent with one canary on unproven domains and a 10-write live cap. All paths cost 0 Oxygen credits. Poll --status <id>; connected means an encrypted refresh token actually landed, never merely that a request was accepted.")
+        .description("Connect Google/Microsoft mailboxes to OXYGEN native send. Preview by default; pass --approved only after reviewing exact candidates. --vendor oxygen requires an exact address list and never discovers a domain directory. Microsoft supports --authorization-mode tenant (one administrator approval, up to 500 exact selected addresses, recommended for dedicated sending tenants) or individual (one account sign-in per mailbox, max 10 per run, recommended for ordinary company/personal mailboxes). Microsoft's application grant is tenant-wide at the provider; OXYGEN—not Microsoft—enforces the selected-address boundary at verification and send time unless the tenant separately configures Exchange Application RBAC. Connecting authorization does not change whether a mailbox is active or disabled. Google uses individual OAuth. Source tokens, passwords, authenticator seeds, and one-time codes never transfer. Managed authorization paths remain available through their vendor options. All paths cost 0 Oxygen credits.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
         .option("--provider <provider>", "Mailbox provider to provision: google or microsoft.")
         .option("--vendor <vendor>", "Authorization path: oxygen for imported/manual mailboxes, zapmail (default), or inboxkit.")
-        .option("--mailboxes <list>", "Comma-separated mailbox addresses. Required for vendor=oxygen (max 10); omit for vendor-provisioned whole-pool flows.")
+        .option("--mailboxes <list>", "Comma-separated exact mailbox addresses. Required for vendor=oxygen (tenant mode max 500; individual mode max 10).")
+        .option("--authorization-mode <mode>", "vendor=oxygen only: auto, tenant, or individual. Tenant is Microsoft-only and never scans the directory.")
         .option("--domains <list>", "Comma-separated sending domains to limit an inboxkit run to. Omit to cover every domain in the pool.")
         .option("--no-canary", "inboxkit only: fan out to every eligible mailbox on a domain that has never connected one, instead of firing a single canary first.")
         .option("--connection <id>", "Zapmail connection id. Defaults to the org's active Zapmail connection.")
@@ -13093,6 +13336,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
             const mailboxes = readCsvOption(options.mailboxes);
             const domains = readCsvOption(options.domains);
             const connection = readOption(options.connection);
+            const authorizationMode = readOption(options.authorizationMode);
             return requestOxygen("/api/cli/mailboxes/connect-oauth", {
                 method: "POST",
                 body: {
@@ -13101,6 +13345,9 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
                     // without the new flags is the request this command has always
                     // sent — the server reads an absent vendor as zapmail.
                     ...(vendor ? { vendor } : {}),
+                    ...(authorizationMode
+                        ? { authorization_mode: authorizationMode }
+                        : {}),
                     ...(mailboxes.length > 0 ? { mailboxes } : {}),
                     ...(domains.length > 0 ? { domains } : {}),
                     ...(options.canary === false ? { canary: false } : {}),
@@ -13112,7 +13359,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("oauth-health")
-        .description("Show every Google/Microsoft inbox with neither a per-mailbox OAuth token nor covered Google delegation. Remedies are connect_oauth for Zapmail, connect_oauth_inboxkit for InboxKit, and connect_oauth_oxygen for imported/manual mailboxes. Zapmail rows include their 3-per-7-day export budget; OXYGEN direct rows require exact browser authorization and may invoke provider MFA. For Microsoft, the connect-oauth remedy returns a per-tenant admin fallback to use only if exact authorization asks for approval. Read-only — 0 Oxygen credits.")
+        .description("Show every Google/Microsoft inbox with neither a usable per-mailbox OAuth token nor verified delegation/application access. Results name connect_oauth_oxygen for imported/manual mailboxes and connect_oauth_inboxkit for that managed path. Microsoft can use one-admin tenant authorization for exact selected addresses or individual OAuth. Read-only — 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("mailboxes oauth-health", options, () => requestOxygen("/api/cli/mailboxes/oauth-health"));
@@ -13176,7 +13423,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     })))
         .addCommand(new Command("delegation")
-        .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to SendKit warmup or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
+        .description("Google sending-domain delegation only — not Microsoft OAuth and not a credential-file handoff to OXYGEN Warm-up or EmailGuard. Reports covered domains plus the exact client id/scopes; --probe mints a real token per mailbox. Read-only, sends no mail, 0 Oxygen credits.")
         .option("--domain <domain>", "Only report this sending domain.")
         .option("--probe", "Verify each delegated domain by minting a real delegated token per mailbox. Makes one Google token call per mailbox; still 0 Oxygen credits.")
         .option("--json", "Print a JSON envelope.")
@@ -13193,9 +13440,11 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("warmup")
-        .description("Mailbox warmup for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. Oxygen's native warmup runs on ONE rail: SendKit, managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warmup add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warmup blocks the handoff so one mailbox cannot warm twice. SendKit is warmup-only: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down here with `warmup disable`; they are never silently moved onto SendKit.")
+        .description("OXYGEN Warm-up for the sending pool — the weeks of low-volume conversational mail that make a new inbox look trusted before you cold-send from it. It is managed and credit-billed at 3,000 credits per warming inbox per month ($3). Fresh managed InboxKit Google/Microsoft/Azure orders with the default-on warm-up add-on activate automatically after provisioning under the approved order quote; do not run a second `warmup enable`. Standalone preview → approval is for BYOK/imported mailboxes, a managed opt-out, or later separate enrollment. InboxKit auto-export stays off because Oxygen submits only the exact authorized UIDs, and any non-cancelled InboxKit warm-up blocks the handoff so one mailbox cannot warm twice. OXYGEN Warm-up never owns campaign dispatch: native OXYGEN Sequences still own campaigns and sends. Eligible non-InboxKit Microsoft mailboxes use the separate `mailboxes warmup microsoft` OAuth fallback. Inboxes already warming on the retired TrulyInbox rail keep reporting and are wound down there with `warmup disable`; they are never silently moved to the current managed rail.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
         .addCommand(new Command("enable")
-        .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed InboxKit targets still use InboxKit's native Sequencer export with exact UIDs; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. SendKit supplies warmup only — OXYGEN Sequences retain campaign enrollment and dispatch. New enrollments only ever land on SendKit; the retired TrulyInbox rail is refused here and only accepts teardown.")
+        .description("STANDALONE ENROLLMENT: enroll BYOK/imported mailboxes, a managed order that opted out, or mailboxes being added to warmup later. Fresh managed InboxKit Google/Microsoft/Azure orders whose approved quote included warmup activate automatically after provisioning and do not need this command. Targets the whole pool unless --mailboxes is given; one synchronous preview/approval is capped at 220 mailboxes, so split larger pools into explicit batches. Without --approved this is a 0-credit, no-provider-write priced preview: nothing is exported, enrolled, or billed. Preview one inbox with `oxygen mailboxes warmup enable --mailboxes sender@example.com --json`. Execute by echoing its --plan and --max-credits with --approved. Eligible managed InboxKit targets still use InboxKit's native Sequencer export with exact UIDs; auto-export remains off, and any non-cancelled InboxKit warmup must be cancelled before export (pausing is not enough). Only eligible non-InboxKit Microsoft mailboxes need `mailboxes warmup microsoft`. OXYGEN Warm-up retains no campaign authority — OXYGEN Sequences own enrollment and dispatch. New enrollments only ever land on the managed OXYGEN rail; the retired TrulyInbox rail is refused here and only accepts teardown.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to warm. Omit to warm the whole pool.")
         .option("--approved", "Execute the PRICED enrollment. Without it the response is a priced preview and nothing is enrolled or billed.")
         .option("--plan <hash>", "Hash from the fresh preview (required with --approved).")
@@ -13239,9 +13488,10 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("microsoft")
-        .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for SendKit warmup with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit Sequencer exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
+        .description("NON-INBOXKIT FALLBACK ONLY: authorize eligible Microsoft/Outlook mailboxes for OXYGEN Warm-up with ONE browser consent PER MAILBOX, never a password or app password. Do not run this for managed InboxKit mailboxes: fresh Microsoft/Azure orders activate native InboxKit warm-up exports automatically when the approved order includes warmup; opted-out or later separate managed enrollment uses standalone `warmup enable`. For the non-InboxKit fallback there is no tenant-admin shortcut: a 40-inbox Microsoft pool means 40 separate authorizations, each opened by whoever can sign in to that mailbox. The preview names the exact fallback mailboxes and outstanding links at 0 credits. Approve that fresh hash with --max-credits 0, open every returned consent_url, then re-run with --status. Warmup itself stays OFF until standalone `warmup enable`.")
+        .addHelpText("after", "\nDocs: https://oxygen-agent.com/docs/providers/mailbox-compatibility\n")
         .option("--mailboxes <list>", "Comma-separated eligible non-InboxKit Microsoft mailbox ids or addresses. Omit to select the pool; the command refuses a scope containing managed InboxKit rows and points to warmup enable.")
-        .option("--tenant <id>", "Deprecated and ignored: SendKit consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
+        .option("--tenant <id>", "Deprecated and ignored: OXYGEN Warm-up consent is per mailbox, so there is no tenant-wide scope to bind. Still accepted so older scripts keep running.")
         .option("--approved", "Mint the per-mailbox consent links for the exact previewed mailbox scope. Still 0 credits — a human then has to open each link.")
         .option("--plan <hash>", "Fresh setup preview hash (required with --approved).")
         .option("--max-credits <n>", "Hard Oxygen credit cap; this setup requires exactly 0 (required with --approved).")
@@ -13326,7 +13576,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("pause")
-        .description("Pause warmup at the rail that actually enrolled each mailbox — SendKit for current enrollments, TrulyInbox for inboxes still warming there. A mailbox left on a rail Oxygen no longer drives reports unsupported instead of being retargeted, so the reply never claims a pause that did not happen. Targets the whole pool unless --mailboxes is given.")
+        .description("Pause warmup at the rail that actually enrolled each mailbox — OXYGEN Warm-up for current enrollments, TrulyInbox for inboxes still warming there. A mailbox left on a rail Oxygen no longer drives reports unsupported instead of being retargeted, so the reply never claims a pause that did not happen. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13339,7 +13589,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("resume")
-        .description("Resume paused warmup at each mailbox's recorded rail (SendKit, or TrulyInbox for inboxes still warming there). A mailbox on a rail Oxygen no longer drives reports unsupported instead of being retargeted. Targets the whole pool unless --mailboxes is given.")
+        .description("Resume paused warmup at each mailbox's recorded rail (OXYGEN Warm-up, or TrulyInbox for inboxes still warming there). A mailbox on a rail Oxygen no longer drives reports unsupported instead of being retargeted. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13352,7 +13602,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         });
     }))
         .addCommand(new Command("disable")
-        .description("Disable warmup and unenroll each mailbox from the rail that actually enrolled it. On a managed rail — SendKit today, TrulyInbox for older enrollments — this also cancels that mailbox's warmup subscription, so billing stops with the vendor removal. This is how you wind an inbox off the retired TrulyInbox rail. Targets the whole pool unless --mailboxes is given.")
+        .description("Disable warmup and unenroll each mailbox from the rail that actually enrolled it. On a managed rail — OXYGEN Warm-up today, TrulyInbox for older enrollments — this also cancels that mailbox's warmup subscription, so billing stops with the provider removal. This is how you wind an inbox off the retired TrulyInbox rail. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses. Omit for the whole pool.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13367,7 +13617,7 @@ fixed scan; watermark_cursor starts a later bounded replay. Consumers must retai
         .addCommand(new Command("status")
         .description("Read warmup analytics back from the rail each mailbox is enrolled on and update its state in the pool. Read-only at the vendor, 0 Oxygen credits. Targets the whole pool unless --mailboxes is given.")
         .option("--mailboxes <list>", "Comma-separated mailbox ids or addresses to sync. Omit to sync the whole pool.")
-        .option("--provider <name>", "Optional. sendkit is the rail every current enrollment uses; pass trulyinbox only to read inboxes still warming on the retired rail. Omit it to read each mailbox on the rail it is recorded against.")
+        .option("--provider <name>", "Optional machine routing filter. Omit it for OXYGEN Warm-up; pass trulyinbox only to read inboxes still warming on the retired rail.")
         .option("--dry-run", "Skip the provider call (mailboxes marked pending).")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
@@ -13875,6 +14125,17 @@ Authoring guide:
   Install or refresh the focused product skill:
   oxygen skills install --skill oxygen-workflow-authoring
 
+Fastest editable graph:
+  1. oxygen workflows events list --search "<outcome>" --kind builtin --json
+  2. oxygen workflows init --id my-workflow
+  3. oxygen workflows schema --subject graph --json
+  4. oxygen workflows lint --file my-workflow.workflow.json --json
+  5. oxygen workflows apply --file my-workflow.workflow.json --json
+
+Applying saves the definition only: it costs 0 credits, calls no graph nodes,
+and creates no run. A disabled workflow stays disabled. Calling or enabling it
+is the separate execution/authorization step.
+
 Run completion:
   Calls enqueue asynchronously. Follow the returned run_id with:
   oxygen workflows tail <run_id>
@@ -13953,20 +14214,21 @@ Run completion:
     })))
         .addCommand(new Command("schema")
         .description("Print workflow JSON schemas.")
-        .option("--subject <subject>", "Schema subject: all, apply, call, event, trigger, or manifest.")
+        .option("--subject <subject>", "Schema subject: all, apply, call, event, trigger, manifest, graph, or definition.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
         await handleAsyncAction("workflows schema", options, () => requestOxygen(`/api/cli/workflows/schema?subject=${encodeURIComponent(options.subject ?? "all")}`));
     }))
         .addCommand(new Command("init")
-        .description("Scaffold a local durable-recipe project (starter recipe, vendored @oxygen/recipe-sdk types, tsconfig) so your editor resolves the SDK without an npm install.")
+        .description("Create a local editable workflow graph. Use --format recipe only for the legacy durable-recipe authoring path.")
         .option("--dir <path>", "Directory to scaffold into. Defaults to the current directory.")
-        .option("--id <id>", "Recipe id for the starter file. Defaults to 'my-recipe'.")
-        .option("--name <name>", "Recipe display name. Defaults to 'My recipe'.")
+        .option("--id <id>", "Workflow id. Defaults to 'my-workflow' (or 'my-recipe' with --format recipe).")
+        .option("--name <name>", "Workflow display name. Defaults to 'My workflow' (or 'My recipe' with --format recipe).")
+        .addOption(new Option("--format <format>", "Authoring format: graph (default) or legacy recipe.").choices(["graph", "recipe"]).default("graph"))
         .option("--force", "Overwrite existing files instead of skipping them.")
         .option("--json", "Print a JSON envelope.")
         .action(async (options) => {
-        await handleAsyncAction("workflows init", options, async () => scaffoldRecipeProject(options));
+        await handleAsyncAction("workflows init", options, async () => scaffoldWorkflowProject(options));
     }))
         .addCommand(new Command("lint")
         .description("Compile and lint a workflow file without saving it.")
@@ -13982,7 +14244,7 @@ Run completion:
         });
     }))
         .addCommand(new Command("apply")
-        .description("Compile and publish a workflow automation. Applying does not start a run; call it separately, then tail the returned run_id.")
+        .description("Compile and publish a workflow definition. Apply costs 0 credits, calls no graph nodes, creates no run, and preserves disabled status; call or enable separately to execute.")
         .requiredOption("--file <path>", "Workflow module or manifest JSON file.")
         .option("--approved", "Authorize autonomous tool calls for this revision.")
         .option("--max-credits <n>", "Optional explicit positive ceiling for each autonomous delivery; omit to use the plan-tier default.")
@@ -14008,6 +14270,55 @@ Run completion:
             writeScheduleWarnings(data);
             return data;
         });
+    }))
+        .addCommand(new Command("export")
+        .description("Export one graph-native workflow as a portable, editable definition with source account ids and trigger authority removed.")
+        .argument("<workflow>", "Workflow id, slug, or name.")
+        .option("--out <path>", "Write only the portable definition JSON to this path.")
+        .option("--force", "Overwrite --out if it already exists.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (workflow, options) => {
+        await handleAsyncAction("workflows export", options, async () => {
+            const data = await requestOxygen("/api/cli/workflows/export", { method: "POST", body: { workflow } });
+            const outPath = readOption(options.out);
+            if (!outPath)
+                return data;
+            const absolutePath = resolve(outPath);
+            if (existsSync(absolutePath) && !options.force) {
+                throw new OxygenError("workflow_export_file_exists", `Refusing to overwrite '${absolutePath}'. Pass --force to replace it.`, { details: { path: absolutePath }, exitCode: 1 });
+            }
+            writeFileSync(absolutePath, `${JSON.stringify(data.definition, null, 2)}\n`, "utf8");
+            return { ...data, written_to: absolutePath };
+        });
+    }))
+        .addCommand(new Command("import")
+        .description("Preflight or install a portable workflow definition. Imports are create-only and always disabled.")
+        .requiredOption("--file <path>", "Portable .oxygen-workflow.json file from workflows export.")
+        .option("--preflight", "Validate destination accounts and collisions without creating anything.")
+        .option("--workflow-id <id>", "Override the destination workflow id.")
+        .option("--workflow-name <name>", "Override the destination workflow name.")
+        .option("--webhook-trigger-id <id>", "Override the regenerated destination webhook trigger id.")
+        .option("--connection <binding_id=connection_id>", "Bind one exported account requirement to an active destination connection (repeatable).", collectMultiple, [])
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleAsyncAction(options.preflight ? "workflows import preflight" : "workflows import", options, async () => {
+            const definition = readPortableWorkflowDefinitionFile(options.file);
+            const connectionBindings = parseWorkflowConnectionBindings(options.connection ?? []);
+            return requestOxygen(options.preflight
+                ? "/api/cli/workflows/import/preflight"
+                : "/api/cli/workflows/import", {
+                method: "POST",
+                body: {
+                    definition,
+                    connection_bindings: connectionBindings,
+                    ...(readOption(options.workflowId) ? { workflow_id: readOption(options.workflowId) } : {}),
+                    ...(readOption(options.workflowName) ? { workflow_name: readOption(options.workflowName) } : {}),
+                    ...(readOption(options.webhookTriggerId)
+                        ? { webhook_trigger_id: readOption(options.webhookTriggerId) }
+                        : {}),
+                },
+            });
+        });
     }))
         .addCommand(new Command("list")
         .description("List workflow automations.")
@@ -14678,7 +14989,7 @@ function asWorkflowCompileError(error, filePath) {
         exitCode: 1,
     });
 }
-// ---- oxygen workflows init: scaffold a local durable-recipe project ----
+// ---- oxygen workflows init: graph-first authoring, recipe compatibility ----
 //
 // @oxygen/recipe-sdk is never published to npm — it ships bundled inside this CLI
 // (scripts/build-cli-npm-package.mjs → bundledDependencies). `init` vendors the SDK's
@@ -14688,6 +14999,66 @@ function asWorkflowCompileError(error, filePath) {
 // at `apply` time, so the vendored types stay locked to the CLI actually installed.
 const RECIPE_TYPES_VENDOR_DIR = ".oxygen/types";
 const RECIPE_INIT_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/i;
+function renderStarterGraph(id, name, now = new Date()) {
+    const manifest = {
+        manifest_version: WORKFLOW_GRAPH_MANIFEST_VERSION,
+        workflow: { id, name, status: "disabled" },
+        trigger: { type: "api", status: "disabled" },
+        input_schema: { type: "object", properties: {} },
+        nodes: [{
+                id: "trigger",
+                name: "API trigger",
+                description: "Configure this trigger in the workflow editor.",
+                kind: "trigger",
+                ui: { x: 0, y: 0 },
+            }],
+        edges: [],
+        source_hash: "",
+        compiler_version: WORKFLOW_GRAPH_COMPILER_VERSION,
+        created_at: now.toISOString(),
+    };
+    manifest.source_hash = hashPortableWorkflowGraphManifest(manifest);
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+function scaffoldGraphProject(options) {
+    const workflowId = readOption(options.id) ?? "my-workflow";
+    if (!RECIPE_INIT_ID_PATTERN.test(workflowId)) {
+        throw new OxygenError("invalid_workflow_id", "Workflow id must start with a letter or digit and contain only letters, digits, dashes, or underscores.", {
+            details: { id: workflowId },
+            exitCode: 1,
+        });
+    }
+    const workflowName = readOption(options.name) ?? "My workflow";
+    const directory = resolve(readOption(options.dir) ?? ".");
+    const workflowFileName = `${workflowId}.workflow.json`;
+    const workflowFile = join(directory, workflowFileName);
+    const filesWritten = [];
+    const filesSkipped = [];
+    if (existsSync(workflowFile) && options.force !== true)
+        filesSkipped.push(workflowFile);
+    else {
+        mkdirSync(directory, { recursive: true });
+        writeFileSync(workflowFile, renderStarterGraph(workflowId, workflowName), "utf8");
+        filesWritten.push(workflowFile);
+    }
+    return {
+        format: "graph",
+        directory,
+        workflow_file: workflowFile,
+        files_written: filesWritten,
+        files_skipped: filesSkipped,
+        next_steps: [
+            `Edit ${workflowFileName}, then validate it: oxygen workflows lint --file ./${workflowFileName}`,
+            `Install it disabled: oxygen workflows apply --file ./${workflowFileName}`,
+            `Open it: oxygen workflows get ${workflowId} --json`,
+        ],
+    };
+}
+function scaffoldWorkflowProject(options) {
+    return readOption(options.format) === "recipe"
+        ? scaffoldRecipeProject(options)
+        : scaffoldGraphProject(options);
+}
 function readBundledSdkDts(pkg) {
     for (const base of RECIPE_ESBUILD_NODE_PATHS) {
         const candidate = join(base, "@oxygen", pkg, "dist", "index.d.ts");
@@ -14803,6 +15174,34 @@ function scaffoldRecipeProject(options) {
         ],
     };
 }
+function readPortableWorkflowDefinitionFile(filePath) {
+    const absolutePath = resolve(filePath);
+    let parsed;
+    try {
+        parsed = parseJsonValue(readFileSync(absolutePath, "utf8"), "--file");
+        assertPortableWorkflowDefinition(parsed);
+    }
+    catch (error) {
+        throw asWorkflowCompileError(error, filePath);
+    }
+    return parsed;
+}
+function parseWorkflowConnectionBindings(values) {
+    const result = {};
+    for (const value of values) {
+        const separator = value.indexOf("=");
+        const bindingId = separator > 0 ? value.slice(0, separator).trim() : "";
+        const connectionId = separator > 0 ? value.slice(separator + 1).trim() : "";
+        if (!bindingId || !connectionId) {
+            throw new OxygenError("invalid_workflow_connection_binding", `Invalid --connection '${value}'. Use <binding_id>=<connection_id>.`, { details: { value }, exitCode: 1 });
+        }
+        if (result[bindingId]) {
+            throw new OxygenError("duplicate_workflow_connection_binding", `Connection binding '${bindingId}' was provided more than once.`, { details: { binding_id: bindingId }, exitCode: 1 });
+        }
+        result[bindingId] = connectionId;
+    }
+    return result;
+}
 async function compileWorkflowFile(filePath) {
     try {
         return await loadWorkflowManifestFromFile(filePath);
@@ -14835,8 +15234,15 @@ async function loadWorkflowManifestFromFile(filePath) {
         // this the web canvas could author a graph the CLI could not apply, and the
         // CLI is the primary surface.
         if (isWorkflowGraphManifest(manifest)) {
-            assertWorkflowGraphManifest(manifest);
-            return manifest;
+            const compiled = basename(absolutePath).endsWith(".workflow.json")
+                ? {
+                    ...manifest,
+                    created_at: new Date().toISOString(),
+                    source_hash: hashPortableWorkflowGraphManifest(manifest),
+                }
+                : manifest;
+            assertWorkflowGraphManifest(compiled);
+            return compiled;
         }
         assertWorkflowManifest(manifest);
         return manifest;
@@ -16712,6 +17118,16 @@ function readPeopleSearchFilters(options) {
     const titleExclude = readCsvOption(options.excludeTitles);
     if (titleExclude.length > 0)
         titles.exclude = titleExclude;
+    const titleMatch = options.titleMatch?.trim().toLowerCase();
+    if (titleMatch) {
+        if (titleMatch !== "keyword" && titleMatch !== "exact") {
+            throw new OxygenError("invalid_title_match", '--title-match must be "keyword" or "exact".', {
+                details: { flag: "--title-match", value: options.titleMatch },
+                exitCode: 1,
+            });
+        }
+        titles.match_mode = titleMatch;
+    }
     if (Object.keys(titles).length > 0)
         filters.titles = titles;
     const seniorities = readCsvOption(options.seniorities);
@@ -18130,6 +18546,22 @@ function chunk(values, size) {
 function readCount(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
+/**
+ * Content type from the file extension — a hint only. It picks the presigned
+ * URL's type and the stored key's extension; the server sniffs the real bytes
+ * before it will publish a URL, so a wrong guess here fails loudly rather than
+ * hosting something mislabelled.
+ */
+function imageContentTypeForPath(path) {
+    const lower = path.toLowerCase();
+    if (lower.endsWith(".jpg") || lower.endsWith(".jpeg"))
+        return "image/jpeg";
+    if (lower.endsWith(".webp"))
+        return "image/webp";
+    if (lower.endsWith(".png"))
+        return "image/png";
+    throw new OxygenError("unsupported_image", "Profile pictures must be a .png, .jpg, or .webp file.", { details: { path }, exitCode: 2 });
+}
 function readRecord(value, key) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
@@ -20591,10 +21023,12 @@ function buildPostEngagementQuery(options) {
         params.set("account", account);
     return params.toString();
 }
-// Assemble the POST body for `oxygen feedback`. Reads the local chat transcript
-// (unless --no-transcript) and attaches a non-sensitive environment snapshot so
-// the Oxygen team can triage. The transcript read happens here, inside the
-// command action, so any failure surfaces in the JSON envelope.
+// Assemble the POST body for `oxygen feedback`. A transcript leaves the machine
+// only after an explicit --include-transcript, --session-id, or --file choice;
+// --no-transcript remains a backward-compatible veto. The local capture applies
+// bounded, best-effort secret redaction, but the user still owns the decision to
+// share broader session content. The environment snapshot never includes env
+// variables or credential values.
 function buildFeedbackBody(options) {
     const message = readOption(options.message);
     if (!message) {
@@ -20610,11 +21044,15 @@ function buildFeedbackBody(options) {
     };
     if (readOption(options.severity))
         body.severity = readOption(options.severity);
-    if (options.transcript !== false) {
+    const sessionId = readOption(options.sessionId);
+    const file = readOption(options.file);
+    const includeTranscript = options.transcript !== false &&
+        (options.includeTranscript === true || Boolean(sessionId) || Boolean(file));
+    if (includeTranscript) {
         try {
             const captured = captureCurrentTranscript({
-                sessionId: readOption(options.sessionId),
-                file: readOption(options.file),
+                sessionId,
+                file,
             });
             if (captured) {
                 const { path: _path, ...payload } = captured;