@oxygen-agent/cli 1.1011.855 → 1.1011.1091

package/node_modules/@oxygen/shared/dist/contracts/workspace-utilities.js

@@ -0,0 +1,46 @@
+import { arr, bool, enumOf, int, nullable, obj, str } from "./schema.js";
+export const betaFeaturesUpdateContract = obj({
+    enabled: bool({ description: "Show beta features in this workspace's navigation. Admin or owner required." }),
+}, { required: ["enabled"] });
+export const providerLimitSelectorContract = obj({
+    provider: str({ minLength: 1, description: "Provider ID, e.g. hubspot or leadmagic." }),
+    operation: str({ description: "Exact operation; omit to target the provider-wide policy, not every operation policy." }),
+}, { required: ["provider"] });
+export const providerLimitUpdateContract = obj({
+    provider: providerLimitSelectorContract.properties.provider,
+    operation: nullable(providerLimitSelectorContract.properties.operation),
+    limit: int({ minimum: 1, description: "Enforced calls allowed per window." }),
+    window_seconds: int({ minimum: 1, description: "Window in seconds; 86400 sets an explicit daily policy." }),
+}, { required: ["provider", "limit", "window_seconds"] });
+export const SUPPRESSION_BULK_MAX_KEYS = 500;
+export const utilityListWindowProperties = {
+    view: enumOf(["full", "summary"], { description: "Full keeps native fields; summary names omitted evidence fields in projection. HTTP/CLI default full." }),
+    max_chars: int({ minimum: 2_000, maximum: 40_000, description: "Native context window; MCP caps it at 10000 (external) or 4000 (built-in). Paging.next_offset follows the last exposed row." }),
+};
+export const utilityListWindowContract = obj(utilityListWindowProperties);
+export const providerLimitListContract = obj({
+    provider: providerLimitSelectorContract.properties.provider,
+    limit: int({ minimum: 1, maximum: 500, description: "Saved policies per page; omit for the legacy full list." }),
+    offset: int({ minimum: 0, description: "Current-policy offset; repeat the same provider filter. Concurrent edits may shift rows." }),
+    ...utilityListWindowProperties,
+});
+export const emailSuppressionListContract = obj({
+    reason: enumOf(["hard_bounce", "complaint", "unsubscribe", "manual"]),
+    search: str({ description: "Case-insensitive address substring." }),
+    limit: int({ minimum: 1, maximum: 500, clamp: true, description: "Page size, 1-500; API default 100." }),
+    offset: int({ minimum: 0, description: "Current-ledger offset; repeat the same filters. Concurrent changes may shift rows." }),
+    ...utilityListWindowProperties,
+});
+export const emailDomainSuppressionListContract = obj({
+    ...emailSuppressionListContract.properties,
+    reason: enumOf(["manual", "complaint", "policy"]),
+    search: str({ description: "Case-insensitive bare-domain substring." }),
+});
+export const emailSuppressionRemoveContract = obj({
+    email: str({ minLength: 1, description: "One full email address. Supply email or emails, never both." }),
+    emails: arr(str(), { minItems: 1, maxItems: SUPPRESSION_BULK_MAX_KEYS, description: "Addresses to unblock. Supply emails or email, never both." }),
+});
+export const emailDomainSuppressionRemoveContract = obj({
+    domain: str({ minLength: 1, description: "One bare domain, e.g. acme.com. Supply domain or domains, never both." }),
+    domains: arr(str(), { minItems: 1, maxItems: SUPPRESSION_BULK_MAX_KEYS, description: "Bare domains to unblock. Supply domains or domain, never both." }),
+});

package/node_modules/@oxygen/shared/dist/credit-topup-review.d.ts

@@ -0,0 +1,11 @@
+/** Fixed customer outcome for a verified paid top-up awaiting manual review. */
+export declare const CREDIT_TOPUP_REVIEW_CODE = "credit_topup_review_required";
+export declare const CREDIT_TOPUP_REVIEW_MESSAGE = "Payment received. Credits need review. Check billing or contact support before buying again.";
+export type CreditTopupReviewReason = "organization_missing" | "credits_invalid" | "quoted_amount_invalid" | "payment_intent_missing";
+/** Contains no Stripe identifiers, invalid metadata or staff diagnostics. */
+export type CreditTopupReviewNotice = {
+    code: typeof CREDIT_TOPUP_REVIEW_CODE;
+    message: typeof CREDIT_TOPUP_REVIEW_MESSAGE;
+    count: number;
+    web_url: string;
+};

package/node_modules/@oxygen/shared/dist/credit-topup-review.js

@@ -0,0 +1,3 @@
+/** Fixed customer outcome for a verified paid top-up awaiting manual review. */
+export const CREDIT_TOPUP_REVIEW_CODE = "credit_topup_review_required";
+export const CREDIT_TOPUP_REVIEW_MESSAGE = "Payment received. Credits need review. Check billing or contact support before buying again.";

package/node_modules/@oxygen/shared/dist/emailguard-placement-probe.d.ts

@@ -0,0 +1,70 @@
+type MailboxTransport = "zapbox" | "native_oauth" | "delegation" | "provisioning" | "ineligible";
+export type EmailGuardSeedSendPlan = {
+    placement_test_id: string;
+    from: string;
+    transport: MailboxTransport;
+    recipients: string[];
+    to: string;
+    bcc: string[];
+    subject: string;
+    body: string;
+    test_phrase: string;
+    allow_paused_probe?: true;
+    plan_hash: string;
+};
+/**
+ * Build the exact external-write plan shown in preview and bound by plan_hash.
+ * EmailGuard requires one new message to its whole seed set containing the
+ * unique filter phrase. Oxygen uses one primary To recipient plus Bcc for the
+ * remaining seeds so every inbox receives the same MIME message without
+ * exposing EmailGuard's full seed set to each recipient.
+ */
+export declare function buildEmailGuardSeedSendPlan(input: {
+    placementTestId: string;
+    from: string;
+    transport: MailboxTransport;
+    seedAddresses: unknown;
+    testPhrase: string | null;
+    subject: string | null;
+    bodyText: string | null;
+    allowPausedProbe?: boolean;
+}): EmailGuardSeedSendPlan;
+/** One permanent delivery identity for the lifetime of this provider-created test. */
+export declare function emailGuardProbeDeliveryKey(testId: string): string;
+export declare function emailGuardSeedSendPayload(plan: EmailGuardSeedSendPlan): {
+    kind: "email_send";
+    to: string;
+    subject: string;
+    body: string;
+    bcc?: string[];
+    apply_mailbox_signature: boolean;
+};
+export declare function placementTestAllowsPausedProbe(results: unknown): boolean;
+/** Untrusted job labels never supply pause authority: prove the durable exact approval. */
+export declare function approvedPausedEmailGuardProbeMatches(input: {
+    organizationId: string;
+    mailboxId: string;
+    from: string;
+    transport: MailboxTransport;
+    job: {
+        id: string;
+        source: string;
+        idempotencyKey: string | null;
+        payload: Record<string, unknown>;
+    };
+    test: {
+        id: string;
+        provider: string;
+        status: string;
+        externalId: string | null;
+        mailboxIds: string[];
+        seedAddresses: unknown;
+        testPhrase: string | null;
+        subject: string | null;
+        bodyText: string | null;
+        results: unknown;
+    };
+}): boolean;
+/** Compare every externally meaningful queued field, permitting only private correlation beside it. */
+export declare function emailGuardProbePayloadMatches(plan: EmailGuardSeedSendPlan, payload: Record<string, unknown>): boolean;
+export {};

package/node_modules/@oxygen/shared/dist/emailguard-placement-probe.js

@@ -0,0 +1,161 @@
+import { createHash } from "node:crypto";
+import { CliHttpError } from "./cli-http-error.js";
+const MAX_SEED_RECIPIENTS = 50;
+const DEFAULT_SUBJECT = "Oxygen inbox-placement test";
+const DEFAULT_BODY = "This message is an inbox-placement test sent from Oxygen.";
+function singleEmail(value) {
+    if (typeof value !== "string")
+        return null;
+    const address = value.trim().toLowerCase();
+    if (!address || !address.includes("@") || /[\s\r\n,;]/.test(address)) {
+        return null;
+    }
+    return address;
+}
+function seedAddresses(value) {
+    if (!Array.isArray(value)) {
+        throw new CliHttpError(409, "emailguard_seed_set_missing", "EmailGuard did not return a usable seed-recipient list for this placement test.", { exitCode: 1 });
+    }
+    const recipients = [];
+    for (const raw of value) {
+        const address = singleEmail(raw);
+        if (!address) {
+            throw new CliHttpError(409, "emailguard_seed_set_invalid", "EmailGuard returned an invalid seed recipient; no email was sent.", {
+                details: { recipient: typeof raw === "string" ? raw : null },
+                exitCode: 1,
+            });
+        }
+        if (!recipients.includes(address))
+            recipients.push(address);
+    }
+    if (recipients.length === 0 || recipients.length > MAX_SEED_RECIPIENTS) {
+        throw new CliHttpError(409, "emailguard_seed_set_invalid", `EmailGuard must return between 1 and ${MAX_SEED_RECIPIENTS} unique seed recipients; no email was sent.`, { details: { recipient_count: recipients.length }, exitCode: 1 });
+    }
+    return recipients;
+}
+function headerLine(value, fallback) {
+    const line = value?.trim() || fallback;
+    if (/[\r\n]/.test(line) || line.length > 998) {
+        throw new CliHttpError(400, "invalid_request", "The placement-test subject must be a single line no longer than 998 characters.", { exitCode: 1 });
+    }
+    return line;
+}
+function messageBody(value, phrase) {
+    const base = value?.trim() || DEFAULT_BODY;
+    if (base.includes(phrase))
+        return base;
+    return `${base}\n\nEmailGuard test phrase: ${phrase}`;
+}
+/**
+ * Build the exact external-write plan shown in preview and bound by plan_hash.
+ * EmailGuard requires one new message to its whole seed set containing the
+ * unique filter phrase. Oxygen uses one primary To recipient plus Bcc for the
+ * remaining seeds so every inbox receives the same MIME message without
+ * exposing EmailGuard's full seed set to each recipient.
+ */
+export function buildEmailGuardSeedSendPlan(input) {
+    const from = singleEmail(input.from);
+    if (!from) {
+        throw new CliHttpError(409, "mailbox_not_sendable", "The placement-test sender address is invalid.", {
+            exitCode: 1,
+        });
+    }
+    if (input.transport === "ineligible") {
+        throw new CliHttpError(409, "mailbox_not_sendable", `Mailbox ${from} has no usable send transport. Connect Zapbox, mailbox OAuth, or deployment delegation before sending the deliverability-test probe.`, { details: { mailbox: from }, exitCode: 1 });
+    }
+    const phrase = input.testPhrase?.trim();
+    if (!phrase) {
+        throw new CliHttpError(409, "emailguard_test_phrase_missing", "EmailGuard did not return the mandatory filter phrase; no email was sent.", { exitCode: 1 });
+    }
+    const recipients = seedAddresses(input.seedAddresses);
+    const subject = headerLine(input.subject, DEFAULT_SUBJECT);
+    const body = messageBody(input.bodyText, phrase);
+    const planWithoutHash = {
+        placement_test_id: input.placementTestId,
+        from,
+        transport: input.transport,
+        recipients,
+        to: recipients[0],
+        bcc: recipients.slice(1),
+        subject,
+        body,
+        test_phrase: phrase,
+        ...(input.allowPausedProbe ? { allow_paused_probe: true } : {}),
+    };
+    const planHash = createHash("sha256")
+        .update(JSON.stringify({ version: 1, ...planWithoutHash }))
+        .digest("hex");
+    return { ...planWithoutHash, plan_hash: planHash };
+}
+/** One permanent delivery identity for the lifetime of this provider-created test. */
+export function emailGuardProbeDeliveryKey(testId) {
+    return `placement_test:${createHash("sha256").update(testId).digest("hex")}`;
+}
+export function emailGuardSeedSendPayload(plan) {
+    return {
+        kind: "email_send", to: plan.to, subject: plan.subject, body: plan.body,
+        ...(plan.bcc.length ? { bcc: plan.bcc } : {}), apply_mailbox_signature: false,
+    };
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value : {};
+}
+function equalJson(left, right) {
+    if (left === right)
+        return true;
+    if (Array.isArray(left) || Array.isArray(right)) {
+        return Array.isArray(left) && Array.isArray(right) && left.length === right.length
+            && left.every((value, index) => equalJson(value, right[index]));
+    }
+    if (!left || !right || typeof left !== "object" || typeof right !== "object")
+        return false;
+    const a = record(left);
+    const b = record(right);
+    const keys = Object.keys(a);
+    return keys.length === Object.keys(b).length && keys.every(key => Object.hasOwn(b, key) && equalJson(a[key], b[key]));
+}
+export function placementTestAllowsPausedProbe(results) {
+    const ledger = record(results);
+    const create = record(ledger.create_operation);
+    return ledger.paused_probe_opt_in === true
+        && ["succeeded", "recovered"].includes(String(create.phase))
+        && typeof create.plan_hash === "string" && /^[a-f0-9]{64}$/.test(create.plan_hash);
+}
+/** Untrusted job labels never supply pause authority: prove the durable exact approval. */
+export function approvedPausedEmailGuardProbeMatches(input) {
+    const { test, job } = input;
+    if (test.provider !== "emailguard" || test.status !== "sending" || !test.externalId
+        || test.mailboxIds.length !== 1 || test.mailboxIds[0] !== input.mailboxId
+        || job.source !== "placement_test" || !placementTestAllowsPausedProbe(test.results))
+        return false;
+    const receipt = record(record(test.results).seed_delivery);
+    const authorization = record(receipt.authorization);
+    const create = record(record(test.results).create_operation);
+    const correlation = record(job.payload.correlation);
+    if (!["claimed", "queued"].includes(String(receipt.status)) || authorization.version !== 1
+        || authorization.organization_id !== input.organizationId || authorization.mailbox_id !== input.mailboxId
+        || authorization.create_plan_hash !== create.plan_hash || authorization.allow_paused_probe !== true
+        || authorization.idempotency_key !== emailGuardProbeDeliveryKey(test.id)
+        || job.idempotencyKey !== authorization.idempotency_key
+        || (receipt.job_id != null && receipt.job_id !== job.id)
+        || correlation.source !== "placement_test" || correlation.placement_test_id !== test.id
+        || correlation.organization_id !== input.organizationId
+        || record(correlation.daily_slot).mailbox_id !== input.mailboxId)
+        return false;
+    try {
+        const plan = buildEmailGuardSeedSendPlan({ placementTestId: test.id, from: input.from, transport: input.transport,
+            seedAddresses: test.seedAddresses, testPhrase: test.testPhrase, subject: test.subject, bodyText: test.bodyText, allowPausedProbe: true });
+        const { correlation: _correlation, ...message } = job.payload;
+        return authorization.plan_hash === plan.plan_hash && equalJson(receipt.plan, plan)
+            && equalJson(message, emailGuardSeedSendPayload(plan));
+    }
+    catch {
+        return false;
+    }
+}
+/** Compare every externally meaningful queued field, permitting only private correlation beside it. */
+export function emailGuardProbePayloadMatches(plan, payload) {
+    const { correlation: _correlation, ...message } = payload;
+    return equalJson(message, emailGuardSeedSendPayload(plan));
+}

package/node_modules/@oxygen/shared/dist/future-signup-events.d.ts

@@ -11,7 +11,7 @@ export declare const FUTURE_SIGNUP_LIFECYCLE_PROJECTION_CONTRACT_VERSION_V1: "fu
 export declare const FUTURE_SIGNUP_LIFECYCLE_PROJECTION_CONTRACT_VERSION_V2: "future_signup_lifecycle_projection.v2";
 export declare const FUTURE_SIGNUP_LIFECYCLE_PROJECTION_CONTRACT_VERSION: "future_signup_lifecycle_projection.v1";
 export declare const FUTURE_SIGNUP_CRM_DESTINATION = "oxygen_company_crm";
-export declare const FUTURE_SIGNUP_ACTIVATION_COMMANDS: readonly ["agent create", "crm activity log", "crm assert", "crm object add-attr", "crm object create", "crm relationships define", "crm relationships upsert", "knowledge page upsert", "publishing posts create", "sequences create", "tables create", "tables duplicate", "tables import-csv", "tables import-file", "tables import-staged", "tables import-url", "tables insert", "tables relate", "tables update", "tables upsert", "workflows apply"];
+export declare const FUTURE_SIGNUP_ACTIVATION_COMMANDS: readonly ["agent create", "crm activity log", "crm assert", "crm object add-attr", "crm object create", "crm objects add-attr", "crm objects create", "crm relationships define", "crm relationships upsert", "knowledge page upsert", "publishing posts create", "sequences create", "tables create", "tables duplicate", "tables import-csv", "tables import-file", "tables import-staged", "tables import-url", "tables insert", "tables relate", "tables update", "tables upsert", "workflows apply"];
 export declare function isFutureSignupActivationCommand(command: string): boolean;
 export declare function futureSignupJourneyId(clerkUserId: string): string;
 export declare function futureSignupFactId(clerkUserId: string): string;

package/node_modules/@oxygen/shared/dist/future-signup-events.js

@@ -15,8 +15,12 @@ export const FUTURE_SIGNUP_ACTIVATION_COMMANDS = [
     "agent create",
     "crm activity log",
     "crm assert",
+    // Operations recorded before the label matched the real `crm objects`
+    // command keep the singular form; both name the same command.
     "crm object add-attr",
     "crm object create",
+    "crm objects add-attr",
+    "crm objects create",
     "crm relationships define",
     "crm relationships upsert",
     "knowledge page upsert",

package/node_modules/@oxygen/shared/dist/knowledge-seed-content.js

@@ -137,7 +137,7 @@ const ICP_BODY = `# ICP — ideal customer profile
 `;
 const POSITIONING_BODY = `# Positioning
 
-> **Stub — fill me.** Non-canonical draft. Fill it, then a human pins the canonical version (\`oxygen knowledge page pin positioning --approved\`) — pinning is gated because canonical positioning grounds live copy. See [[conventions]].
+> **Stub — fill me.** Non-canonical draft. Fill it, then pin it (\`oxygen knowledge page pin positioning\`): the pin files a proposal a human approves, because canonical positioning grounds live copy. See [[conventions]].
 
 ## For whom
 - Our [[icp]], and the moment they buy.
@@ -251,7 +251,7 @@ Banned hedges: just, hope this finds you well, wanted to reach out, circling bac
 - **We would not send:** the same idea, wrong — and why it fails
 
 ## Canonical
-Not pinned. Pinning it (\`oxygen knowledge page pin voice --approved\`) is a human-approved act — canonical voice grounds live copy. Claims are [[brand]]; what we do is [[positioning]].
+Not pinned. Pinning it (\`oxygen knowledge page pin voice\`) files a proposal a human approves — canonical voice grounds live copy. Claims are [[brand]]; what we do is [[positioning]].
 `;
 const BRAND_BODY = `# Brand
 

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.d.ts

@@ -31,3 +31,51 @@ export declare function linkedInQuotaBackoffUntil(error: unknown, now: Date): Da
  * `sender_accounts.metadata` jsonb — expires; 0 when it is not parked.
  */
 export declare function linkedInQuotaParkedUntil(metadata: unknown, key: string): number;
+/**
+ * Where a sender's inbox sync is parked until, quota or failure backoff alike,
+ * in the freeform `sender_accounts.metadata` jsonb.
+ */
+export declare const INBOX_SYNC_BACKOFF_KEY = "inbox_sync_backoff_until";
+/** The sender metadata key holding the latest non-quota inbox sync failure. */
+export declare const INBOX_SYNC_FAILURE_KEY = "inbox_sync_failure";
+export type InboxSyncFailureClass = "quota" | "authentication" | "transient" | "other";
+export type InboxSyncFailureRecord = {
+    class: Exclude<InboxSyncFailureClass, "quota">;
+    code: string | null;
+    status: number | null;
+    /** Consecutive failed syncs, reset by a successful one. */
+    consecutive: number;
+    first_at: string;
+    last_at: string;
+    retry_at: string;
+};
+/** First park after a non-quota failure; it doubles per consecutive failure. */
+export declare const INBOX_SYNC_FAILURE_BASE_BACKOFF_MS: number;
+/** No non-quota failure parks a sender longer than this. */
+export declare const INBOX_SYNC_FAILURE_MAX_BACKOFF_MS: number;
+/** Quota, authentication (401/403), transient (capacity, 429, 5xx, retryable), else other. */
+export declare function classifyInboxSyncFailure(error: unknown): InboxSyncFailureClass;
+/** The latest non-quota inbox sync failure recorded on a sender, or null. */
+export declare function readInboxSyncFailure(metadata: unknown): InboxSyncFailureRecord | null;
+/**
+ * The park and record for a whole-sender inbox sync failure that is not a quota
+ * denial: 5 min, doubling per consecutive failure, capped at 2 h. Null for a
+ * quota denial, which keeps its own park (linkedInQuotaBackoffUntil).
+ */
+export declare function inboxSyncFailureBackoff(error: unknown, metadata: unknown, now: Date): {
+    until: Date;
+    record: InboxSyncFailureRecord;
+} | null;
+/**
+ * A sender's whole-inbox sync state for health reads: the last successful sync,
+ * the latest failure that was not a quota denial (cleared by the next success),
+ * and until when the background sync leaves the sender alone.
+ */
+export declare function inboxSyncHealth(sender: {
+    lastInboxSyncAt: Date | null;
+    metadata: unknown;
+}, now?: Date): {
+    last_synced_at: string | null;
+    background_sync_paused_until: string | null;
+    last_failure: InboxSyncFailureRecord | null;
+};

package/node_modules/@oxygen/shared/dist/linkedin-quota-denial.js

@@ -70,3 +70,97 @@ export function linkedInQuotaParkedUntil(metadata, key) {
     const ms = Date.parse(raw);
     return Number.isNaN(ms) ? 0 : ms;
 }
+// ===== Inbox sync failures that are not quota denials (OXP-1.11.72) =====
+//
+// A quota denial parks the sender until its budget resets (above). Every other
+// whole-sender inbox sync failure used to leave the sender eligible on the next
+// backstop pass: in the week to 2026-10-07 production retried one sender 45
+// times through "Managed provider capacity is busy." and 24 senders every few
+// minutes through a 27-minute LinkedIn 5xx incident, and nothing on the sender
+// said so. These failures now park on a bounded, doubling backoff and leave an
+// inspectable record that the next successful sync clears.
+/**
+ * Where a sender's inbox sync is parked until, quota or failure backoff alike,
+ * in the freeform `sender_accounts.metadata` jsonb.
+ */
+export const INBOX_SYNC_BACKOFF_KEY = "inbox_sync_backoff_until";
+/** The sender metadata key holding the latest non-quota inbox sync failure. */
+export const INBOX_SYNC_FAILURE_KEY = "inbox_sync_failure";
+// Refusals raised before the read leaves the process that clear on their own:
+// the managed-provider limiter after waiting out its window, a runtime with no
+// quota enforcer registered, and an unsizable worker fleet. The same set the
+// LinkedIn ingestion drip defers on.
+const TRANSIENT_CODES = new Set([
+    "rate_limit_exceeded",
+    "linkedin_quota_enforcement_unavailable",
+    "worker_fleet_discovery_unavailable",
+]);
+/** First park after a non-quota failure; it doubles per consecutive failure. */
+export const INBOX_SYNC_FAILURE_BASE_BACKOFF_MS = 5 * 60 * 1000;
+/** No non-quota failure parks a sender longer than this. */
+export const INBOX_SYNC_FAILURE_MAX_BACKOFF_MS = 2 * 60 * 60 * 1000;
+function errorStatus(error) {
+    const status = isRecord(error) ? error.status : undefined;
+    return typeof status === "number" && Number.isFinite(status) ? status : null;
+}
+/** Quota, authentication (401/403), transient (capacity, 429, 5xx, retryable), else other. */
+export function classifyInboxSyncFailure(error) {
+    if (isLinkedInQuotaDenial(error))
+        return "quota";
+    const status = errorStatus(error);
+    if (status === 401 || status === 403)
+        return "authentication";
+    if (error instanceof OxygenError && TRANSIENT_CODES.has(error.code))
+        return "transient";
+    if (status === 429 || (status !== null && status >= 500))
+        return "transient";
+    if (isRecord(error) && error.retryable === true)
+        return "transient";
+    return "other";
+}
+/** The latest non-quota inbox sync failure recorded on a sender, or null. */
+export function readInboxSyncFailure(metadata) {
+    const raw = isRecord(metadata) ? metadata[INBOX_SYNC_FAILURE_KEY] : undefined;
+    if (!isRecord(raw) || typeof raw.consecutive !== "number" || raw.consecutive < 1 || typeof raw.first_at !== "string")
+        return null;
+    return raw;
+}
+/**
+ * The park and record for a whole-sender inbox sync failure that is not a quota
+ * denial: 5 min, doubling per consecutive failure, capped at 2 h. Null for a
+ * quota denial, which keeps its own park (linkedInQuotaBackoffUntil).
+ */
+export function inboxSyncFailureBackoff(error, metadata, now) {
+    const failureClass = classifyInboxSyncFailure(error);
+    if (failureClass === "quota")
+        return null;
+    const previous = readInboxSyncFailure(metadata);
+    const consecutive = (previous?.consecutive ?? 0) + 1;
+    const delay = Math.min(INBOX_SYNC_FAILURE_BASE_BACKOFF_MS * 2 ** Math.min(consecutive - 1, 16), INBOX_SYNC_FAILURE_MAX_BACKOFF_MS);
+    const until = new Date(now.getTime() + delay);
+    return {
+        until,
+        record: {
+            class: failureClass,
+            code: error instanceof OxygenError ? error.code : null,
+            status: errorStatus(error),
+            consecutive,
+            first_at: previous?.first_at ?? now.toISOString(),
+            last_at: now.toISOString(),
+            retry_at: until.toISOString(),
+        },
+    };
+}
+/**
+ * A sender's whole-inbox sync state for health reads: the last successful sync,
+ * the latest failure that was not a quota denial (cleared by the next success),
+ * and until when the background sync leaves the sender alone.
+ */
+export function inboxSyncHealth(sender, now = new Date()) {
+    const parkedUntil = linkedInQuotaParkedUntil(sender.metadata, INBOX_SYNC_BACKOFF_KEY);
+    return {
+        last_synced_at: sender.lastInboxSyncAt ? sender.lastInboxSyncAt.toISOString() : null,
+        background_sync_paused_until: parkedUntil > now.getTime() ? new Date(parkedUntil).toISOString() : null,
+        last_failure: readInboxSyncFailure(sender.metadata),
+    };
+}

package/node_modules/@oxygen/shared/dist/partner-coupon-bonus.d.ts

@@ -0,0 +1,45 @@
+import { type RepricingSwitchState } from "./repricing.js";
+/** September 30 P3 ratification; both existing PARTNERS2026 coupon cohorts. */
+export declare const PARTNER_COUPON_IDS: readonly ["jcQhT5r5", "0wTy2bAv"];
+export declare const PARTNER_COUPON_BONUS_EXCLUSION_EFFECTIVE_AT_ENV = "OXYGEN_PARTNER_COUPON_BONUS_EXCLUSION_EFFECTIVE_AT";
+export declare function readPartnerCouponBonusExclusion(options?: {
+    now?: Date;
+    env?: Record<string, string | undefined>;
+}): RepricingSwitchState;
+export type PartnerCouponBinding = {
+    organizationId: string;
+    subscriptionId: string;
+    customerId: string;
+    priceId: string;
+    planKey: string;
+    periodStart: string;
+    periodEnd: string;
+};
+export type PartnerCouponApplication = {
+    id: string;
+    layer: "subscription" | "plan_item" | "customer";
+    couponId: string | null;
+    start: number | null;
+    end: number | null;
+    deleted: boolean;
+};
+/** Trusted server capture, separate from externally supplied Stripe metadata. */
+export type PartnerCouponAuthority = {
+    version: 1;
+    capturedAt: string;
+    binding: PartnerCouponBinding;
+    planItemId: string | null;
+    status: "complete" | "unknown";
+    reason: string | null;
+    applications: PartnerCouponApplication[];
+};
+export type PartnerCouponAuthorityStatus = {
+    state: "active_partner_coupon" | "no_active_partner_coupon" | "unknown";
+    capturedAt: string | null;
+    basis: "captured_stripe_discount_applications" | "unavailable";
+    reason: string | null;
+};
+/** Evaluate only the captured instant; a stored absence is never a live check. */
+export declare function readCapturedPartnerCouponAuthority(authority: PartnerCouponAuthority | null | undefined, binding: PartnerCouponBinding | null): PartnerCouponAuthorityStatus;
+/** Live issuance evaluates known application bounds at its clock, retaining capture provenance. */
+export declare function readPartnerCouponAuthorityAt(authority: PartnerCouponAuthority | null | undefined, binding: PartnerCouponBinding | null, applicationInstant?: Date): PartnerCouponAuthorityStatus;

package/node_modules/@oxygen/shared/dist/partner-coupon-bonus.js

@@ -0,0 +1,57 @@
+import { parseRepricingEffectiveAt } from "./repricing.js";
+/** September 30 P3 ratification; both existing PARTNERS2026 coupon cohorts. */
+export const PARTNER_COUPON_IDS = ["jcQhT5r5", "0wTy2bAv"];
+export const PARTNER_COUPON_BONUS_EXCLUSION_EFFECTIVE_AT_ENV = "OXYGEN_PARTNER_COUPON_BONUS_EXCLUSION_EFFECTIVE_AT";
+export function readPartnerCouponBonusExclusion(options = {}) {
+    const raw = (options.env ?? process.env)[PARTNER_COUPON_BONUS_EXCLUSION_EFFECTIVE_AT_ENV];
+    const effectiveAt = parseRepricingEffectiveAt(raw);
+    if (effectiveAt === null)
+        return { status: "unset", effectiveAt: null };
+    if (effectiveAt === undefined)
+        return { status: "invalid", effectiveAt: null, raw: raw?.trim() ?? "" };
+    return (options.now ?? new Date()).getTime() >= effectiveAt.getTime()
+        ? { status: "in_force", effectiveAt }
+        : { status: "scheduled", effectiveAt };
+}
+/** Evaluate only the captured instant; a stored absence is never a live check. */
+export function readCapturedPartnerCouponAuthority(authority, binding) {
+    return readPartnerCouponAuthorityAt(authority, binding);
+}
+/** Live issuance evaluates known application bounds at its clock, retaining capture provenance. */
+export function readPartnerCouponAuthorityAt(authority, binding, applicationInstant) {
+    const unknown = (reason) => ({
+        state: "unknown", capturedAt: authority?.capturedAt ?? null, basis: "unavailable", reason,
+    });
+    if (!authority || authority.version !== 1 || !binding)
+        return unknown("authority_missing");
+    const capturedAt = parseRepricingEffectiveAt(authority.capturedAt);
+    if (!capturedAt || !Number.isFinite(capturedAt.getTime()))
+        return unknown("capture_time_invalid");
+    if (!authority.binding || Object.keys(binding).some(key => authority.binding[key] !== binding[key])) {
+        return unknown("authority_binding_changed");
+    }
+    if (authority.status !== "complete" || !authority.planItemId || !Array.isArray(authority.applications)) {
+        return unknown(authority.reason ?? "authority_incomplete");
+    }
+    const instant = (applicationInstant ?? capturedAt).getTime() / 1000;
+    if (!Number.isFinite(instant))
+        return unknown("application_time_invalid");
+    for (const application of authority.applications) {
+        if (!application || !application.id || !["subscription", "plan_item", "customer"].includes(application.layer)
+            || typeof application.deleted !== "boolean")
+            return unknown("application_invalid");
+        if (application.deleted)
+            continue;
+        if (!application.couponId || !Number.isSafeInteger(application.start) || application.start < 0
+            || (application.end !== null && (!Number.isSafeInteger(application.end) || application.end < application.start))) {
+            return unknown("application_invalid");
+        }
+        if (PARTNER_COUPON_IDS.includes(application.couponId)
+            && application.start <= instant && (application.end === null || instant < application.end)) {
+            return { state: "active_partner_coupon", capturedAt: authority.capturedAt,
+                basis: "captured_stripe_discount_applications", reason: null };
+        }
+    }
+    return { state: "no_active_partner_coupon", capturedAt: authority.capturedAt,
+        basis: "captured_stripe_discount_applications", reason: null };
+}

package/node_modules/@oxygen/shared/dist/provider-balance-signal.js

@@ -101,8 +101,9 @@ export const MANAGED_BALANCE_FLOORS = {
     // to us, which sits at 0.00 in the normal case (it did on 2026-09-07) and goes
     // negative after a refund. A floor here would page daily about nothing.
     stripe: null,
-    // Reachability probes with no balance concept at all: both fetchers return
-    // `balanceRemaining: null` by construction.
+    // No balance concept at all. Neither is probed any more (Vercel left the stack
+    // on 2026-10-06); null keeps a historical row from ever reading as a low wallet
+    // under the generic default floor.
     vercel: null,
     neon: null,
 };

package/node_modules/@oxygen/shared/dist/table-filter-operators.d.ts

@@ -0,0 +1,6 @@
+export declare const FILTER_TREE_OPERATORS: readonly ["is", "is_not", "contains", "not_contains", "starts_with", "ends_with", "eq", "neq", "gt", "gte", "lt", "lte", "before", "after", "on_or_before", "on_or_after", "is_true", "is_false", "is_any_of", "is_none_of", "is_empty", "is_not_empty"];
+export type FilterTreeOperator = (typeof FILTER_TREE_OPERATORS)[number];
+/** The filter-tree operators a column whose SQL value has `dataType` accepts. */
+export declare function filterTreeOperatorsFor(dataType: string): FilterTreeOperator[];
+/** The filter-tree operator a rejected operator name most likely meant, if any. */
+export declare function filterTreeOperatorSuggestion(operator: string): FilterTreeOperator | null;