@oxygen-agent/cli 1.1011.97 → 1.1011.288

package/node_modules/@oxygen/shared/dist/sequence-lifecycle.js

@@ -0,0 +1,20 @@
+/** Every lifecycle a person reads: the stored statuses plus the derived `completed`. */
+export const SEQUENCE_LIFECYCLES = ["draft", "active", "completed", "paused", "archived"];
+/**
+ * The lifecycle word a person reads for a Sequence.
+ *
+ * The stored status records launch intent only (draft, active, paused,
+ * archived), and nothing moves it when the last lead finishes, so a campaign
+ * that contacted everyone kept reading "Active" forever. Whether work remains
+ * is the derived operational state; `drained` means every enrolled lead has
+ * reached an end. An active Sequence in that state reads as completed.
+ *
+ * Derived on read and never stored: operational health is one derived
+ * contract, not another lifecycle (docs/primitives/sequences.md, 2026-08-26).
+ * Enrolling new leads makes the same Sequence read as active again with no
+ * transition to undo. A paused Sequence stays paused, because someone decided
+ * that and the decision still holds.
+ */
+export function sequenceDisplayStatus(status, operationalState) {
+    return status === "active" && operationalState === "drained" ? "completed" : status;
+}

package/node_modules/@oxygen/shared/dist/sequence-sender-variables.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Reserved `{{sender_*}}` template variables. Every Sequence step can use them
+ * without a lead-table column: they resolve per action from whoever actually
+ * sends it, the person behind the sending inbox or LinkedIn/WhatsApp account.
+ * A lead column with the same key still wins, because row values merge last.
+ */
+export declare const SEQUENCE_SENDER_NAME_VARIABLES: readonly ["sender_first_name", "sender_last_name", "sender_full_name", "sender_name"];
+/** Email steps only: the sending inbox's address. */
+export declare const SEQUENCE_SENDER_EMAIL_VARIABLE = "sender_email";
+export declare const SEQUENCE_SENDER_VARIABLES: readonly string[];
+/** Editor labels, in menu order. `sender_name` stays insertable-by-hand only. */
+export declare const SEQUENCE_SENDER_VARIABLE_LABELS: ReadonlyArray<{
+    key: string;
+    label: string;
+    emailOnly?: boolean;
+}>;
+/**
+ * Who sends an action: the sender profile's own first and last name when it has
+ * them, else a display name (a profile's label, an account's or an inbox's).
+ */
+export type SequenceSenderIdentity = {
+    name?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+};
+/**
+ * The reserved variables for one sender. A profile's stored first and last name
+ * win, because its display name may be a label such as "Talia (EU)". Without
+ * them the display name is split at its first space, so "Anna von Berg" gives
+ * "Anna" and "von Berg". A missing name renders every variable empty, never the
+ * literal token. Passing `email` adds `{{sender_email}}`.
+ */
+export declare function sequenceSenderVariables(sender: SequenceSenderIdentity | string | null | undefined, email?: string | null): Record<string, string>;
+/** Whether any of these templates refers to a reserved sender variable. */
+export declare function referencesSequenceSenderVariables(templates: ReadonlyArray<unknown>): boolean;

package/node_modules/@oxygen/shared/dist/sequence-sender-variables.js

@@ -0,0 +1,63 @@
+/**
+ * Reserved `{{sender_*}}` template variables. Every Sequence step can use them
+ * without a lead-table column: they resolve per action from whoever actually
+ * sends it, the person behind the sending inbox or LinkedIn/WhatsApp account.
+ * A lead column with the same key still wins, because row values merge last.
+ */
+export const SEQUENCE_SENDER_NAME_VARIABLES = [
+    "sender_first_name",
+    "sender_last_name",
+    "sender_full_name",
+    "sender_name",
+];
+/** Email steps only: the sending inbox's address. */
+export const SEQUENCE_SENDER_EMAIL_VARIABLE = "sender_email";
+export const SEQUENCE_SENDER_VARIABLES = [
+    ...SEQUENCE_SENDER_NAME_VARIABLES,
+    SEQUENCE_SENDER_EMAIL_VARIABLE,
+];
+/** Editor labels, in menu order. `sender_name` stays insertable-by-hand only. */
+export const SEQUENCE_SENDER_VARIABLE_LABELS = [
+    { key: "sender_first_name", label: "Sender first name" },
+    { key: "sender_last_name", label: "Sender last name" },
+    { key: "sender_full_name", label: "Sender full name" },
+    { key: SEQUENCE_SENDER_EMAIL_VARIABLE, label: "Sender email", emailOnly: true },
+];
+/**
+ * The reserved variables for one sender. A profile's stored first and last name
+ * win, because its display name may be a label such as "Talia (EU)". Without
+ * them the display name is split at its first space, so "Anna von Berg" gives
+ * "Anna" and "von Berg". A missing name renders every variable empty, never the
+ * literal token. Passing `email` adds `{{sender_email}}`.
+ */
+export function sequenceSenderVariables(sender, email) {
+    const identity = typeof sender === "string" ? { name: sender } : (sender ?? {});
+    const clean = (value) => (value ?? "").trim().replace(/\s+/g, " ");
+    const firstName = clean(identity.firstName);
+    const lastName = clean(identity.lastName);
+    let first;
+    let last;
+    let full;
+    if (firstName || lastName) {
+        first = firstName;
+        last = lastName;
+        full = [firstName, lastName].filter(Boolean).join(" ");
+    }
+    else {
+        full = clean(identity.name);
+        const [head = "", ...rest] = full ? full.split(" ") : [];
+        first = head;
+        last = rest.join(" ");
+    }
+    return {
+        sender_first_name: first,
+        sender_last_name: last,
+        sender_full_name: full,
+        sender_name: full,
+        ...(email !== undefined ? { sender_email: email ?? "" } : {}),
+    };
+}
+/** Whether any of these templates refers to a reserved sender variable. */
+export function referencesSequenceSenderVariables(templates) {
+    return templates.some((text) => typeof text === "string" && /\{\{\s*sender_/.test(text));
+}

package/node_modules/@oxygen/shared/dist/sequences.d.ts

@@ -933,16 +933,22 @@ export type SequenceLintIssue = {
     message: string;
 };
 /**
- * A non-blocking fact about how a definition was normalized that its author must
- * be told, as opposed to an issue that rejects it. Today exactly one:
- * `email_reply_rewritten`. The retired kind is accepted and rewritten into a
- * subject-less `email_send`, and a caller that only reads the stored definition
- * back sees a different `kind` than it wrote with nothing in the response to
- * explain it — reported as a silent coercion by a customer (Plain T-163).
+ * A non-blocking fact about a saved definition that its author must be told, as
+ * opposed to an issue that rejects it:
+ *  - `email_reply_rewritten`: the retired kind is accepted and rewritten into a
+ *    subject-less `email_send`, and a caller that only reads the stored
+ *    definition back sees a different `kind` than it wrote with nothing in the
+ *    response to explain it — reported as a silent coercion by a customer
+ *    (Plain T-163).
+ *  - `sequence_linkedin_owner_conflict`: a draft saves LinkedIn relationship
+ *    steps that name different people, which only the launch refuses (same
+ *    code as its launch blocker and the preview's `blocked` marker). A blind MCP run
+ *    pinned the founder on the connection request alone and learned why the
+ *    draft could not launch only from the start preview (2026-09-29).
  */
 export type SequenceDefinitionNotice = {
     path: string;
-    code: "email_reply_rewritten";
+    code: "email_reply_rewritten" | "sequence_linkedin_owner_conflict";
     message: string;
 };
 export type ValidateSequenceOptions = {

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -1110,6 +1110,25 @@ export function sequenceLinkedInOwnerConflicts(steps) {
         message: `step '${step.id}': every LinkedIn connection, message and InMail step must come from the same person (or all from the lead's own). LinkedIn lets one of your accounts hold a conversation with a lead.`,
     }));
 }
+/**
+ * The draft-save counterpart of the launch's `sequence_linkedin_owner_conflict`:
+ * one notice naming what each relationship step sends from, and both ways out.
+ */
+function sequenceLinkedInOwnerNotice(steps) {
+    const conflicts = sequenceLinkedInOwnerConflicts(steps);
+    const first = conflicts[0];
+    if (!first)
+        return null;
+    const named = conflicts.map(({ index, stepId }) => {
+        const person = steps[index] ? stepSenderProfileId(steps[index]) : undefined;
+        return person ? `'${stepId}' names ${person}` : `'${stepId}' names no one`;
+    });
+    return {
+        path: `steps[${first.index}].sender_profile_id`,
+        code: "sequence_linkedin_owner_conflict",
+        message: `Saved as a draft, but it cannot launch yet: LinkedIn connection, message, InMail and withdraw steps must all name the same sender_profile_id, or none (${named.join(", ")}). LinkedIn lets one of your accounts hold a conversation with a lead. To have one person send all of them, name that person on each; to keep every lead's own person, remove it from all.`,
+    };
+}
 export function sequenceStepsMissingCopy(steps) {
     const missing = [];
     const check = (step, field, value) => {
@@ -1259,6 +1278,13 @@ export function validateSequenceDefinition(input, options = {}) {
             issues.push({ path: `steps[${conflict.index}].sender_profile_id`, message: conflict.message });
         }
     }
+    else {
+        // A draft may be half-built, so a split LinkedIn owner still saves; tell the
+        // author now instead of leaving it for the launch preview to reveal.
+        const ownerNotice = sequenceLinkedInOwnerNotice(normalized);
+        if (ownerNotice)
+            options.notices?.push(ownerNotice);
+    }
     if (issues.length > 0) {
         throw new OxygenError("invalid_sequence", `Sequence definition is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, { details: { issues }, exitCode: 1 });
     }

package/node_modules/@oxygen/shared/dist/signup-lead-payload.d.ts

@@ -16,6 +16,8 @@ export type SignupLeadWebhookInput = {
         firstName?: string | null;
         lastName?: string | null;
         phone?: string | null;
+        /** Whether the provider verified `phone`; sign-up collects numbers without verifying them. */
+        phoneVerified?: boolean | null;
         createdAt?: Date | string | number | null | undefined;
         /** A profile URL the provider already knows for this person; the consent-recorded creator URL still wins at enqueue. */
         linkedinUrl?: string | null;

package/node_modules/@oxygen/shared/dist/signup-lead-payload.js

@@ -34,6 +34,9 @@ export function buildSignupLeadWebhookPayload(input) {
     const firstName = normalizeString(input.user?.firstName);
     const lastName = normalizeString(input.user?.lastName);
     const phone = normalizeString(input.user?.phone);
+    const phoneVerified = phone && typeof input.user?.phoneVerified === "boolean"
+        ? input.user.phoneVerified
+        : null;
     const fullName = normalizeString([firstName, lastName].filter(Boolean).join(" "));
     const clerkOrgId = normalizeString(input.organization?.clerkOrgId);
     const companyName = normalizeString(input.organization?.name);
@@ -53,6 +56,7 @@ export function buildSignupLeadWebhookPayload(input) {
         first_name: firstName,
         last_name: lastName,
         phone,
+        phone_verified: phoneVerified,
         full_name: fullName,
         created_at: normalizeDate(input.user?.createdAt),
         linkedin_url: normalizeString(input.user?.linkedinUrl) ?? undefined,
@@ -121,6 +125,7 @@ export function buildSignupLeadWebhookPayload(input) {
         first_name: firstName,
         last_name: lastName,
         phone,
+        phone_verified: phoneVerified,
         full_name: fullName,
         company_name: companyName,
         company_domain: companyDomain,

package/node_modules/@oxygen/shared/dist/social-post-metrics-series.js

@@ -1,3 +1,4 @@
+import { zoneOffsetMs } from "./zoned-time.js";
 export const EARNED_SERIES_MAX_PRORATE_MS = 3 * 24 * 60 * 60 * 1000;
 function pointsFor(timeline, metric) {
     const points = [];
@@ -179,21 +180,6 @@ export function zonedDayStarts(fromDate, toDate, timeZone) {
     }
     return { days, end: startOfZonedDay(cursor.toISOString().slice(0, 10), timeZone) };
 }
-function zoneOffsetMs(instant, timeZone) {
-    const parts = new Intl.DateTimeFormat("en-US", {
-        timeZone,
-        hourCycle: "h23",
-        year: "numeric",
-        month: "2-digit",
-        day: "2-digit",
-        hour: "2-digit",
-        minute: "2-digit",
-        second: "2-digit",
-    }).formatToParts(instant);
-    const read = (type) => Number(parts.find((part) => part.type === type)?.value ?? 0);
-    const asUtc = Date.UTC(read("year"), read("month") - 1, read("day"), read("hour"), read("minute"), read("second"));
-    return asUtc - Math.floor(instant.getTime() / 1000) * 1000;
-}
 function startOfZonedDay(date, timeZone) {
     const utcMidnight = new Date(`${date}T00:00:00.000Z`).getTime();
     const firstGuess = utcMidnight - zoneOffsetMs(new Date(utcMidnight), timeZone);

package/node_modules/@oxygen/shared/dist/standard-webhooks.d.ts

@@ -0,0 +1,51 @@
+export declare const STANDARD_WEBHOOK_SECRET_PREFIX = "whsec_";
+/** MCP Events accepts only `whsec_` secrets whose base64 value decodes to 24–64 bytes. */
+export declare const STANDARD_WEBHOOK_SECRET_MIN_BYTES = 24;
+export declare const STANDARD_WEBHOOK_SECRET_MAX_BYTES = 64;
+/** Default `webhook-timestamp` window, in either direction, as in the reference libraries. */
+export declare const STANDARD_WEBHOOK_TOLERANCE_SECONDS: number;
+export type StandardWebhookErrorReason = "secret_missing" | "secret_prefix" | "secret_encoding" | "secret_length" | "invalid_id" | "invalid_timestamp";
+/** A secret or signing input that cannot produce a valid signature. Never carries the secret. */
+export declare class StandardWebhookError extends Error {
+    readonly reason: StandardWebhookErrorReason;
+    constructor(reason: StandardWebhookErrorReason, message: string);
+}
+/** One `whsec_` secret, or several during a rotation window (every key signs). */
+export type StandardWebhookSecrets = string | readonly string[];
+/** A `Date`, or whole Unix seconds. */
+export type StandardWebhookTime = Date | number;
+export type StandardWebhookSignInput = {
+    secret: StandardWebhookSecrets;
+    id: string;
+    timestamp: StandardWebhookTime;
+    /** The exact request body. Send these same characters; re-serialising breaks the signature. */
+    body: string;
+};
+export type StandardWebhookHeaders = {
+    "webhook-id": string;
+    "webhook-timestamp": string;
+    "webhook-signature": string;
+};
+/** Decode a `whsec_` secret to its HMAC key, enforcing the 24–64 byte range. */
+export declare function parseStandardWebhookSecret(secret: string): Buffer;
+/** The `webhook-signature` value: `v1,<base64>`, space-separated when several secrets sign. */
+export declare function signStandardWebhook(input: StandardWebhookSignInput): string;
+/** The three Standard Webhooks headers for one delivery attempt. */
+export declare function standardWebhookHeaders(input: StandardWebhookSignInput): StandardWebhookHeaders;
+/**
+ * True when any `v1` entry of `signature` matches any of the secrets and the
+ * timestamp is within `toleranceSeconds` of `now`. A malformed id, timestamp or
+ * signature is `false`; an invalid secret, `now` or `toleranceSeconds` throws,
+ * because that is a misconfiguration rather than a bad request.
+ */
+export declare function verifyStandardWebhook(input: {
+    secret: StandardWebhookSecrets;
+    id: string;
+    /** The `webhook-timestamp` header as received, or a parsed time. */
+    timestamp: StandardWebhookTime | string;
+    body: string;
+    /** The `webhook-signature` header as received. */
+    signature: string;
+    toleranceSeconds?: number;
+    now?: StandardWebhookTime;
+}): boolean;

package/node_modules/@oxygen/shared/dist/standard-webhooks.js

@@ -0,0 +1,124 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+// Standard Webhooks symmetric signatures for the webhooks OXYGEN SENDS: MCP
+// Events deliveries and their callback challenges (OXP-11.5.17).
+//
+// The signed content is `${webhook-id}.${webhook-timestamp}.${body}`, and a
+// signature is `v1,<base64 HMAC-SHA256>` keyed by the base64 value after the
+// `whsec_` prefix. `webhook-signature` is a space-delimited list, so a rotation
+// window carries one signature per key and a receiver accepts any of them.
+// Spec: https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md
+//
+// Svix uses the same scheme, so OXYGEN's inbound verifiers (the `svix` library
+// on the Clerk and Recall routes, and
+// `apps/web/src/lib/ingress-capture/replay-verify.ts`) accept these signatures.
+export const STANDARD_WEBHOOK_SECRET_PREFIX = "whsec_";
+/** MCP Events accepts only `whsec_` secrets whose base64 value decodes to 24–64 bytes. */
+export const STANDARD_WEBHOOK_SECRET_MIN_BYTES = 24;
+export const STANDARD_WEBHOOK_SECRET_MAX_BYTES = 64;
+/** Default `webhook-timestamp` window, in either direction, as in the reference libraries. */
+export const STANDARD_WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+/** A secret or signing input that cannot produce a valid signature. Never carries the secret. */
+export class StandardWebhookError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = "StandardWebhookError";
+        this.reason = reason;
+    }
+}
+// Standard alphabet, padding optional. The reference decoders reject the
+// URL-safe alphabet, and Buffer.from(value, "base64") silently skips stray
+// characters, which would sign with a key the receiver never derives.
+const STANDARD_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=?)?$/;
+// Printable ASCII without space or ".": the id is a header value and a
+// "."-delimited part of the signed content, and the spec forbids "." in it.
+const MESSAGE_ID = /^[\x21-\x2d\x2f-\x7e]+$/;
+const UNIX_SECONDS = /^\d{1,15}$/;
+/** Decode a `whsec_` secret to its HMAC key, enforcing the 24–64 byte range. */
+export function parseStandardWebhookSecret(secret) {
+    if (!secret.startsWith(STANDARD_WEBHOOK_SECRET_PREFIX)) {
+        throw new StandardWebhookError("secret_prefix", "A Standard Webhooks secret must start with whsec_.");
+    }
+    const encoded = secret.slice(STANDARD_WEBHOOK_SECRET_PREFIX.length);
+    if (!STANDARD_BASE64.test(encoded)) {
+        throw new StandardWebhookError("secret_encoding", "A Standard Webhooks secret must be standard base64 after whsec_.");
+    }
+    const key = Buffer.from(encoded, "base64");
+    if (key.length < STANDARD_WEBHOOK_SECRET_MIN_BYTES || key.length > STANDARD_WEBHOOK_SECRET_MAX_BYTES) {
+        throw new StandardWebhookError("secret_length", `A Standard Webhooks secret must decode to ${STANDARD_WEBHOOK_SECRET_MIN_BYTES}-${STANDARD_WEBHOOK_SECRET_MAX_BYTES} bytes; this one decodes to ${key.length}.`);
+    }
+    return key;
+}
+/** The `webhook-signature` value: `v1,<base64>`, space-separated when several secrets sign. */
+export function signStandardWebhook(input) {
+    const keys = parseSecrets(input.secret);
+    if (!MESSAGE_ID.test(input.id)) {
+        throw new StandardWebhookError("invalid_id", "A webhook id must be printable ASCII without spaces or full stops.");
+    }
+    const content = signedContent(input.id, requireUnixSeconds(input.timestamp), input.body);
+    return keys.map((key) => `v1,${hmacBase64(key, content)}`).join(" ");
+}
+/** The three Standard Webhooks headers for one delivery attempt. */
+export function standardWebhookHeaders(input) {
+    const seconds = requireUnixSeconds(input.timestamp);
+    return {
+        "webhook-id": input.id,
+        "webhook-timestamp": String(seconds),
+        "webhook-signature": signStandardWebhook({ ...input, timestamp: seconds }),
+    };
+}
+/**
+ * True when any `v1` entry of `signature` matches any of the secrets and the
+ * timestamp is within `toleranceSeconds` of `now`. A malformed id, timestamp or
+ * signature is `false`; an invalid secret, `now` or `toleranceSeconds` throws,
+ * because that is a misconfiguration rather than a bad request.
+ */
+export function verifyStandardWebhook(input) {
+    const keys = parseSecrets(input.secret);
+    const tolerance = input.toleranceSeconds ?? STANDARD_WEBHOOK_TOLERANCE_SECONDS;
+    if (!Number.isFinite(tolerance) || tolerance < 0) {
+        throw new RangeError("toleranceSeconds must be a finite, non-negative number of seconds.");
+    }
+    const now = input.now === undefined ? Math.floor(Date.now() / 1000) : requireUnixSeconds(input.now);
+    const seconds = readUnixSeconds(input.timestamp);
+    if (seconds === null || !MESSAGE_ID.test(input.id) || Math.abs(now - seconds) > tolerance)
+        return false;
+    const content = signedContent(input.id, seconds, input.body);
+    const expected = keys.map((key) => Buffer.from(hmacBase64(key, content)));
+    for (const entry of input.signature.split(" ")) {
+        const comma = entry.indexOf(",");
+        if (comma < 0 || entry.slice(0, comma) !== "v1")
+            continue;
+        const presented = Buffer.from(entry.slice(comma + 1));
+        if (expected.some((candidate) => candidate.length === presented.length && timingSafeEqual(candidate, presented))) {
+            return true;
+        }
+    }
+    return false;
+}
+function parseSecrets(secret) {
+    const secrets = typeof secret === "string" ? [secret] : secret;
+    if (secrets.length === 0) {
+        throw new StandardWebhookError("secret_missing", "At least one Standard Webhooks secret is required.");
+    }
+    return secrets.map(parseStandardWebhookSecret);
+}
+function signedContent(id, seconds, body) {
+    return `${id}.${seconds}.${body}`;
+}
+function hmacBase64(key, content) {
+    return createHmac("sha256", key).update(content, "utf8").digest("base64");
+}
+function requireUnixSeconds(value) {
+    const seconds = readUnixSeconds(value);
+    if (seconds === null) {
+        throw new StandardWebhookError("invalid_timestamp", "A webhook timestamp must be a valid time at or after the Unix epoch.");
+    }
+    return seconds;
+}
+function readUnixSeconds(value) {
+    if (typeof value === "string")
+        return UNIX_SECONDS.test(value) ? Number(value) : null;
+    const seconds = value instanceof Date ? Math.floor(value.getTime() / 1000) : value;
+    return Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : null;
+}

package/node_modules/@oxygen/shared/dist/tags.d.ts

@@ -1,6 +1,6 @@
 import type { TagColor } from "./select-options.js";
 /** Primitive kinds that participate in the workspace tag union today. */
-export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "sender_profile", "voice_number"];
+export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "sender_profile", "voice_number", "signal_type", "dashboard", "agent", "ad_search_collection"];
 export type TagKind = (typeof TAG_KINDS)[number];
 /**
  * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.

package/node_modules/@oxygen/shared/dist/tags.js

@@ -26,6 +26,10 @@ export const TAG_KINDS = [
     "project",
     "sender_profile",
     "voice_number",
+    "signal_type",
+    "dashboard",
+    "agent",
+    "ad_search_collection",
 ];
 /**
  * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.
@@ -39,7 +43,7 @@ export const TAG_KINDS = [
  */
 export const TAG_KINDS_PROSE = "publishing posts, knowledge pages, sequences, tables, workflows, recipes, " +
     "inbox conversations, CRM records, mailboxes, sender accounts, sending domains, " +
-    "projects, sender profiles, and phone numbers";
+    "projects, sender profiles, phone numbers, signal types, dashboards, agents, and saved Ads searches";
 /**
  * The phrase each kind must contribute to {@link TAG_KINDS_PROSE}. Typed as a
  * total map over TagKind, so adding a kind is a compile error until it is named
@@ -60,6 +64,10 @@ export const TAG_KIND_PROSE_MARKERS = {
     project: "project",
     sender_profile: "sender profile",
     voice_number: "phone number",
+    signal_type: "signal type",
+    dashboard: "dashboard",
+    agent: "agent",
+    ad_search_collection: "saved Ads search",
 };
 export function isTagKind(value) {
     return typeof value === "string" && TAG_KINDS.includes(value);
@@ -91,6 +99,10 @@ export const TAG_KIND_LABELS = {
     project: { one: "project", many: "projects" },
     sender_profile: { one: "sender profile", many: "sender profiles" },
     voice_number: { one: "phone number", many: "phone numbers" },
+    signal_type: { one: "signal type", many: "signal types" },
+    dashboard: { one: "dashboard", many: "dashboards" },
+    agent: { one: "agent", many: "agents" },
+    ad_search_collection: { one: "saved Ads search", many: "saved Ads searches" },
 };
 /** Inline label for a count: `tagKindLabel("sequence", 1)` → "sequence". */
 export function tagKindLabel(kind, count) {

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -8,8 +8,12 @@ export type UgcPostingTarget = {
 };
 export declare const UGC_POSTING_TARGET_MAX = 100;
 export declare const UGC_POSTING_TARGET_PERIODS: readonly ["week", "month", "total"];
-/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
-export declare const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/**
+ * The operator-written creator brief: one page, not a document (Philipp, 2026-09-23;
+ * raised from 1,200 on 2026-09-29, when a natural founder brief ran 1,298 and blind
+ * operators either trimmed it or left the program without one).
+ */
+export declare const UGC_PROGRAM_BRIEF_MAX_CHARS = 4000;
 /** The program's target as its API shape, or null when none is set. */
 export declare function ugcPostingTarget(program: {
     postingTargetCount?: number | null | undefined;
@@ -21,7 +25,6 @@ export type UgcProgram = {
     productUrl: string;
     description: string;
     knowledgePageSlugs: string[];
-    brandApprovalRequired: boolean;
     peerEngagementEnabled?: boolean;
     peerEngagementVersion?: number;
     peerEngagementEffectiveAt?: Date | null;
@@ -94,13 +97,11 @@ export type UgcPostLink = {
     participationId: string;
     creatorOrgId: string;
     masterOrgId: string;
-    brandApprovalRequired: boolean;
     sourcePostId: string;
     attribution: Record<string, unknown>;
     projection: UgcPostProjection;
     sourceRevision: string;
     creatorApprovedRevision: string | null;
-    brandApprovedRevision: string | null;
     grantVersion: number;
     removedAt?: Date | null;
     enrollmentVersion?: number;
@@ -154,13 +155,16 @@ export declare const UGC_SPONSORED_LINKEDIN_SEATS = 1;
  * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
  * Creators tab and the MCP widget alike: a card sponsorship waiting on its
  * checkout reads differently from one waiting on the provider, and a stopped
- * renewal says so while its paid period runs.
+ * renewal says so while its paid period runs. `paid_through` tells a stop that
+ * keeps a paid period from one that ended it, and from a sponsorship that was
+ * cancelled before anything was paid.
  */
 export declare function ugcSponsorshipStatusLabel(row: {
     status: string;
     checkout_url?: string | null;
     cancellation_pending?: boolean;
-}): string;
+    paid_through?: string | null;
+}, now?: number): string;
 /** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
 export declare const UGC_SPONSORSHIP_PLAN_LABELS: Readonly<Record<string, string>>;
 /** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -1,7 +1,11 @@
 export const UGC_POSTING_TARGET_MAX = 100;
 export const UGC_POSTING_TARGET_PERIODS = ["week", "month", "total"];
-/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
-export const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/**
+ * The operator-written creator brief: one page, not a document (Philipp, 2026-09-23;
+ * raised from 1,200 on 2026-09-29, when a natural founder brief ran 1,298 and blind
+ * operators either trimmed it or left the program without one).
+ */
+export const UGC_PROGRAM_BRIEF_MAX_CHARS = 4000;
 /** The program's target as its API shape, or null when none is set. */
 export function ugcPostingTarget(program) {
     return program.postingTargetCount && program.postingTargetPeriod
@@ -14,17 +18,21 @@ export const UGC_SPONSORED_LINKEDIN_SEATS = 1;
  * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
  * Creators tab and the MCP widget alike: a card sponsorship waiting on its
  * checkout reads differently from one waiting on the provider, and a stopped
- * renewal says so while its paid period runs.
+ * renewal says so while its paid period runs. `paid_through` tells a stop that
+ * keeps a paid period from one that ended it, and from a sponsorship that was
+ * cancelled before anything was paid.
  */
-export function ugcSponsorshipStatusLabel(row) {
+export function ugcSponsorshipStatusLabel(row, now = Date.now()) {
+    const paidThrough = row.paid_through ? Date.parse(row.paid_through) : Number.NaN;
+    const paid = Number.isFinite(paidThrough);
     if (row.cancellation_pending)
-        return "Renewal stopping";
+        return paid ? "Renewal stopping" : "Cancelling";
     if (row.status === "active")
         return "Sponsored";
     if (row.status === "pending")
         return row.checkout_url ? "Checkout open" : "Pending";
     if (row.status === "cancelled")
-        return "Renewal stopped";
+        return !paid ? "Not sponsored" : paidThrough > now ? "Renewal stopped" : "Ended";
     return "Not sponsored";
 }
 /** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.97";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.288";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.97";
+export const OXYGEN_BUILD_VERSION = "1.1011.288";

package/node_modules/@oxygen/shared/dist/zoned-time.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Wall-clock time in an IANA time zone, converted to instants DST-correctly.
+ *
+ * Publishing's publish-time contract rides on this on every surface: an ISO
+ * date-time with `Z` or an offset is that exact instant, and one without is
+ * wall-clock time in the post's timezone, read with the offset in force at that
+ * local time. 09:00 Europe/Berlin is 07:00Z in October and 08:00Z in December.
+ */
+/**
+ * Is `zone` an IANA time zone this runtime resolves (`Europe/Berlin`, `UTC`)?
+ * A bare offset (`+02:00`) is refused although Intl accepts it: it never moves
+ * for daylight saving, so a schedule kept in it drifts an hour for half the year.
+ */
+export declare function isValidTimeZone(zone: string): boolean;
+/** `timeZone`'s offset from UTC at `instant`, in milliseconds (Berlin in July: 7,200,000). */
+export declare function zoneOffsetMs(instant: Date, timeZone: string): number;
+export type WallClock = {
+    year: number;
+    /** 1-12. */
+    month: number;
+    day: number;
+    hour: number;
+    minute: number;
+    second: number;
+    millisecond: number;
+};
+/**
+ * The instant a wall-clock time in `timeZone` names. A time the zone repeats (the
+ * autumn fall-back hour) resolves to its first occurrence; a time it skips (the
+ * spring-forward gap) resolves past the gap by its length, as a clock would read
+ * it: 02:30 Europe/Berlin on 2026-03-29 is 03:30 CEST.
+ */
+export declare function zonedWallClockToInstant(wall: WallClock, timeZone: string): Date;
+/**
+ * Parse an ISO date-time: with `Z` or an offset it is that instant; without one
+ * it is wall-clock time in `timeZone` (DST-correct). Null when it names no real
+ * date-time. Anything that is not ISO-shaped keeps `Date`'s own parsing.
+ */
+export declare function parseDateTimeInZone(value: string, timeZone: string): Date | null;