@oxygen-agent/cli 1.1011.98 → 1.1011.322

package/node_modules/@oxygen/shared/dist/standard-webhooks.js

@@ -0,0 +1,124 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+// Standard Webhooks symmetric signatures for the webhooks OXYGEN SENDS: MCP
+// Events deliveries and their callback challenges (OXP-11.5.17).
+//
+// The signed content is `${webhook-id}.${webhook-timestamp}.${body}`, and a
+// signature is `v1,<base64 HMAC-SHA256>` keyed by the base64 value after the
+// `whsec_` prefix. `webhook-signature` is a space-delimited list, so a rotation
+// window carries one signature per key and a receiver accepts any of them.
+// Spec: https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md
+//
+// Svix uses the same scheme, so OXYGEN's inbound verifiers (the `svix` library
+// on the Clerk and Recall routes, and
+// `apps/web/src/lib/ingress-capture/replay-verify.ts`) accept these signatures.
+export const STANDARD_WEBHOOK_SECRET_PREFIX = "whsec_";
+/** MCP Events accepts only `whsec_` secrets whose base64 value decodes to 24–64 bytes. */
+export const STANDARD_WEBHOOK_SECRET_MIN_BYTES = 24;
+export const STANDARD_WEBHOOK_SECRET_MAX_BYTES = 64;
+/** Default `webhook-timestamp` window, in either direction, as in the reference libraries. */
+export const STANDARD_WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+/** A secret or signing input that cannot produce a valid signature. Never carries the secret. */
+export class StandardWebhookError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = "StandardWebhookError";
+        this.reason = reason;
+    }
+}
+// Standard alphabet, padding optional. The reference decoders reject the
+// URL-safe alphabet, and Buffer.from(value, "base64") silently skips stray
+// characters, which would sign with a key the receiver never derives.
+const STANDARD_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=?)?$/;
+// Printable ASCII without space or ".": the id is a header value and a
+// "."-delimited part of the signed content, and the spec forbids "." in it.
+const MESSAGE_ID = /^[\x21-\x2d\x2f-\x7e]+$/;
+const UNIX_SECONDS = /^\d{1,15}$/;
+/** Decode a `whsec_` secret to its HMAC key, enforcing the 24–64 byte range. */
+export function parseStandardWebhookSecret(secret) {
+    if (!secret.startsWith(STANDARD_WEBHOOK_SECRET_PREFIX)) {
+        throw new StandardWebhookError("secret_prefix", "A Standard Webhooks secret must start with whsec_.");
+    }
+    const encoded = secret.slice(STANDARD_WEBHOOK_SECRET_PREFIX.length);
+    if (!STANDARD_BASE64.test(encoded)) {
+        throw new StandardWebhookError("secret_encoding", "A Standard Webhooks secret must be standard base64 after whsec_.");
+    }
+    const key = Buffer.from(encoded, "base64");
+    if (key.length < STANDARD_WEBHOOK_SECRET_MIN_BYTES || key.length > STANDARD_WEBHOOK_SECRET_MAX_BYTES) {
+        throw new StandardWebhookError("secret_length", `A Standard Webhooks secret must decode to ${STANDARD_WEBHOOK_SECRET_MIN_BYTES}-${STANDARD_WEBHOOK_SECRET_MAX_BYTES} bytes; this one decodes to ${key.length}.`);
+    }
+    return key;
+}
+/** The `webhook-signature` value: `v1,<base64>`, space-separated when several secrets sign. */
+export function signStandardWebhook(input) {
+    const keys = parseSecrets(input.secret);
+    if (!MESSAGE_ID.test(input.id)) {
+        throw new StandardWebhookError("invalid_id", "A webhook id must be printable ASCII without spaces or full stops.");
+    }
+    const content = signedContent(input.id, requireUnixSeconds(input.timestamp), input.body);
+    return keys.map((key) => `v1,${hmacBase64(key, content)}`).join(" ");
+}
+/** The three Standard Webhooks headers for one delivery attempt. */
+export function standardWebhookHeaders(input) {
+    const seconds = requireUnixSeconds(input.timestamp);
+    return {
+        "webhook-id": input.id,
+        "webhook-timestamp": String(seconds),
+        "webhook-signature": signStandardWebhook({ ...input, timestamp: seconds }),
+    };
+}
+/**
+ * True when any `v1` entry of `signature` matches any of the secrets and the
+ * timestamp is within `toleranceSeconds` of `now`. A malformed id, timestamp or
+ * signature is `false`; an invalid secret, `now` or `toleranceSeconds` throws,
+ * because that is a misconfiguration rather than a bad request.
+ */
+export function verifyStandardWebhook(input) {
+    const keys = parseSecrets(input.secret);
+    const tolerance = input.toleranceSeconds ?? STANDARD_WEBHOOK_TOLERANCE_SECONDS;
+    if (!Number.isFinite(tolerance) || tolerance < 0) {
+        throw new RangeError("toleranceSeconds must be a finite, non-negative number of seconds.");
+    }
+    const now = input.now === undefined ? Math.floor(Date.now() / 1000) : requireUnixSeconds(input.now);
+    const seconds = readUnixSeconds(input.timestamp);
+    if (seconds === null || !MESSAGE_ID.test(input.id) || Math.abs(now - seconds) > tolerance)
+        return false;
+    const content = signedContent(input.id, seconds, input.body);
+    const expected = keys.map((key) => Buffer.from(hmacBase64(key, content)));
+    for (const entry of input.signature.split(" ")) {
+        const comma = entry.indexOf(",");
+        if (comma < 0 || entry.slice(0, comma) !== "v1")
+            continue;
+        const presented = Buffer.from(entry.slice(comma + 1));
+        if (expected.some((candidate) => candidate.length === presented.length && timingSafeEqual(candidate, presented))) {
+            return true;
+        }
+    }
+    return false;
+}
+function parseSecrets(secret) {
+    const secrets = typeof secret === "string" ? [secret] : secret;
+    if (secrets.length === 0) {
+        throw new StandardWebhookError("secret_missing", "At least one Standard Webhooks secret is required.");
+    }
+    return secrets.map(parseStandardWebhookSecret);
+}
+function signedContent(id, seconds, body) {
+    return `${id}.${seconds}.${body}`;
+}
+function hmacBase64(key, content) {
+    return createHmac("sha256", key).update(content, "utf8").digest("base64");
+}
+function requireUnixSeconds(value) {
+    const seconds = readUnixSeconds(value);
+    if (seconds === null) {
+        throw new StandardWebhookError("invalid_timestamp", "A webhook timestamp must be a valid time at or after the Unix epoch.");
+    }
+    return seconds;
+}
+function readUnixSeconds(value) {
+    if (typeof value === "string")
+        return UNIX_SECONDS.test(value) ? Number(value) : null;
+    const seconds = value instanceof Date ? Math.floor(value.getTime() / 1000) : value;
+    return Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : null;
+}

package/node_modules/@oxygen/shared/dist/tags.d.ts

@@ -1,6 +1,6 @@
 import type { TagColor } from "./select-options.js";
 /** Primitive kinds that participate in the workspace tag union today. */
-export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "sender_profile", "voice_number"];
+export declare const TAG_KINDS: readonly ["knowledge_page", "publishing_post", "sequence", "table", "workflow", "recipe", "conversation", "mailbox", "sender", "record", "domain", "project", "sender_profile", "voice_number", "signal_type", "dashboard", "agent", "ad_search_collection"];
 export type TagKind = (typeof TAG_KINDS)[number];
 /**
  * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.

package/node_modules/@oxygen/shared/dist/tags.js

@@ -26,6 +26,10 @@ export const TAG_KINDS = [
     "project",
     "sender_profile",
     "voice_number",
+    "signal_type",
+    "dashboard",
+    "agent",
+    "ad_search_collection",
 ];
 /**
  * The taggable kinds in prose, for CLI `--help` and MCP tool descriptions.
@@ -39,7 +43,7 @@ export const TAG_KINDS = [
  */
 export const TAG_KINDS_PROSE = "publishing posts, knowledge pages, sequences, tables, workflows, recipes, " +
     "inbox conversations, CRM records, mailboxes, sender accounts, sending domains, " +
-    "projects, sender profiles, and phone numbers";
+    "projects, sender profiles, phone numbers, signal types, dashboards, agents, and saved Ads searches";
 /**
  * The phrase each kind must contribute to {@link TAG_KINDS_PROSE}. Typed as a
  * total map over TagKind, so adding a kind is a compile error until it is named
@@ -60,6 +64,10 @@ export const TAG_KIND_PROSE_MARKERS = {
     project: "project",
     sender_profile: "sender profile",
     voice_number: "phone number",
+    signal_type: "signal type",
+    dashboard: "dashboard",
+    agent: "agent",
+    ad_search_collection: "saved Ads search",
 };
 export function isTagKind(value) {
     return typeof value === "string" && TAG_KINDS.includes(value);
@@ -91,6 +99,10 @@ export const TAG_KIND_LABELS = {
     project: { one: "project", many: "projects" },
     sender_profile: { one: "sender profile", many: "sender profiles" },
     voice_number: { one: "phone number", many: "phone numbers" },
+    signal_type: { one: "signal type", many: "signal types" },
+    dashboard: { one: "dashboard", many: "dashboards" },
+    agent: { one: "agent", many: "agents" },
+    ad_search_collection: { one: "saved Ads search", many: "saved Ads searches" },
 };
 /** Inline label for a count: `tagKindLabel("sequence", 1)` → "sequence". */
 export function tagKindLabel(kind, count) {

package/node_modules/@oxygen/shared/dist/ugc.d.ts

@@ -8,8 +8,12 @@ export type UgcPostingTarget = {
 };
 export declare const UGC_POSTING_TARGET_MAX = 100;
 export declare const UGC_POSTING_TARGET_PERIODS: readonly ["week", "month", "total"];
-/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
-export declare const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/**
+ * The operator-written creator brief: one page, not a document (Philipp, 2026-09-23;
+ * raised from 1,200 on 2026-09-29, when a natural founder brief ran 1,298 and blind
+ * operators either trimmed it or left the program without one).
+ */
+export declare const UGC_PROGRAM_BRIEF_MAX_CHARS = 4000;
 /** The program's target as its API shape, or null when none is set. */
 export declare function ugcPostingTarget(program: {
     postingTargetCount?: number | null | undefined;
@@ -21,7 +25,6 @@ export type UgcProgram = {
     productUrl: string;
     description: string;
     knowledgePageSlugs: string[];
-    brandApprovalRequired: boolean;
     peerEngagementEnabled?: boolean;
     peerEngagementVersion?: number;
     peerEngagementEffectiveAt?: Date | null;
@@ -94,13 +97,11 @@ export type UgcPostLink = {
     participationId: string;
     creatorOrgId: string;
     masterOrgId: string;
-    brandApprovalRequired: boolean;
     sourcePostId: string;
     attribution: Record<string, unknown>;
     projection: UgcPostProjection;
     sourceRevision: string;
     creatorApprovedRevision: string | null;
-    brandApprovedRevision: string | null;
     grantVersion: number;
     removedAt?: Date | null;
     enrollmentVersion?: number;
@@ -154,13 +155,16 @@ export declare const UGC_SPONSORED_LINKEDIN_SEATS = 1;
  * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
  * Creators tab and the MCP widget alike: a card sponsorship waiting on its
  * checkout reads differently from one waiting on the provider, and a stopped
- * renewal says so while its paid period runs.
+ * renewal says so while its paid period runs. `paid_through` tells a stop that
+ * keeps a paid period from one that ended it, and from a sponsorship that was
+ * cancelled before anything was paid.
  */
 export declare function ugcSponsorshipStatusLabel(row: {
     status: string;
     checkout_url?: string | null;
     cancellation_pending?: boolean;
-}): string;
+    paid_through?: string | null;
+}, now?: number): string;
 /** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */
 export declare const UGC_SPONSORSHIP_PLAN_LABELS: Readonly<Record<string, string>>;
 /** When a new credit sponsorship's reservation starts (`participants[].reservation_starts`). */

package/node_modules/@oxygen/shared/dist/ugc.js

@@ -1,7 +1,11 @@
 export const UGC_POSTING_TARGET_MAX = 100;
 export const UGC_POSTING_TARGET_PERIODS = ["week", "month", "total"];
-/** The operator-written creator brief is short by design (Philipp, 2026-09-23). */
-export const UGC_PROGRAM_BRIEF_MAX_CHARS = 1200;
+/**
+ * The operator-written creator brief: one page, not a document (Philipp, 2026-09-23;
+ * raised from 1,200 on 2026-09-29, when a natural founder brief ran 1,298 and blind
+ * operators either trimmed it or left the program without one).
+ */
+export const UGC_PROGRAM_BRIEF_MAX_CHARS = 4000;
 /** The program's target as its API shape, or null when none is set. */
 export function ugcPostingTarget(program) {
     return program.postingTargetCount && program.postingTargetPeriod
@@ -14,17 +18,21 @@ export const UGC_SPONSORED_LINKEDIN_SEATS = 1;
  * One label for a sponsor's row (`view=sponsorship`) on every surface, the web
  * Creators tab and the MCP widget alike: a card sponsorship waiting on its
  * checkout reads differently from one waiting on the provider, and a stopped
- * renewal says so while its paid period runs.
+ * renewal says so while its paid period runs. `paid_through` tells a stop that
+ * keeps a paid period from one that ended it, and from a sponsorship that was
+ * cancelled before anything was paid.
  */
-export function ugcSponsorshipStatusLabel(row) {
+export function ugcSponsorshipStatusLabel(row, now = Date.now()) {
+    const paidThrough = row.paid_through ? Date.parse(row.paid_through) : Number.NaN;
+    const paid = Number.isFinite(paidThrough);
     if (row.cancellation_pending)
-        return "Renewal stopping";
+        return paid ? "Renewal stopping" : "Cancelling";
     if (row.status === "active")
         return "Sponsored";
     if (row.status === "pending")
         return row.checkout_url ? "Checkout open" : "Pending";
     if (row.status === "cancelled")
-        return "Renewal stopped";
+        return !paid ? "Not sponsored" : paidThrough > now ? "Renewal stopped" : "Ended";
     return "Not sponsored";
 }
 /** What confirming a credit-sponsorship quote does for one creator (`participants[].state`). */

package/node_modules/@oxygen/shared/dist/version.generated.d.ts

@@ -1 +1 @@
-export declare const OXYGEN_BUILD_VERSION = "1.1011.98";
+export declare const OXYGEN_BUILD_VERSION = "1.1011.322";

package/node_modules/@oxygen/shared/dist/version.generated.js

@@ -1,2 +1,2 @@
 // GENERATED by scripts/ci/version-stamp.mjs from VERSION + git history. Do not edit; do not commit.
-export const OXYGEN_BUILD_VERSION = "1.1011.98";
+export const OXYGEN_BUILD_VERSION = "1.1011.322";

package/node_modules/@oxygen/shared/dist/zoned-time.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Wall-clock time in an IANA time zone, converted to instants DST-correctly.
+ *
+ * Publishing's publish-time contract rides on this on every surface: an ISO
+ * date-time with `Z` or an offset is that exact instant, and one without is
+ * wall-clock time in the post's timezone, read with the offset in force at that
+ * local time. 09:00 Europe/Berlin is 07:00Z in October and 08:00Z in December.
+ */
+/**
+ * Is `zone` an IANA time zone this runtime resolves (`Europe/Berlin`, `UTC`)?
+ * A bare offset (`+02:00`) is refused although Intl accepts it: it never moves
+ * for daylight saving, so a schedule kept in it drifts an hour for half the year.
+ */
+export declare function isValidTimeZone(zone: string): boolean;
+/** `timeZone`'s offset from UTC at `instant`, in milliseconds (Berlin in July: 7,200,000). */
+export declare function zoneOffsetMs(instant: Date, timeZone: string): number;
+export type WallClock = {
+    year: number;
+    /** 1-12. */
+    month: number;
+    day: number;
+    hour: number;
+    minute: number;
+    second: number;
+    millisecond: number;
+};
+/**
+ * The instant a wall-clock time in `timeZone` names. A time the zone repeats (the
+ * autumn fall-back hour) resolves to its first occurrence; a time it skips (the
+ * spring-forward gap) resolves past the gap by its length, as a clock would read
+ * it: 02:30 Europe/Berlin on 2026-03-29 is 03:30 CEST.
+ */
+export declare function zonedWallClockToInstant(wall: WallClock, timeZone: string): Date;
+/**
+ * Parse an ISO date-time: with `Z` or an offset it is that instant; without one
+ * it is wall-clock time in `timeZone` (DST-correct). Null when it names no real
+ * date-time. Anything that is not ISO-shaped keeps `Date`'s own parsing.
+ */
+export declare function parseDateTimeInZone(value: string, timeZone: string): Date | null;

package/node_modules/@oxygen/shared/dist/zoned-time.js

@@ -0,0 +1,81 @@
+/**
+ * Wall-clock time in an IANA time zone, converted to instants DST-correctly.
+ *
+ * Publishing's publish-time contract rides on this on every surface: an ISO
+ * date-time with `Z` or an offset is that exact instant, and one without is
+ * wall-clock time in the post's timezone, read with the offset in force at that
+ * local time. 09:00 Europe/Berlin is 07:00Z in October and 08:00Z in December.
+ */
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Is `zone` an IANA time zone this runtime resolves (`Europe/Berlin`, `UTC`)?
+ * A bare offset (`+02:00`) is refused although Intl accepts it: it never moves
+ * for daylight saving, so a schedule kept in it drifts an hour for half the year.
+ */
+export function isValidTimeZone(zone) {
+    const value = zone.trim();
+    if (!value || /^[+-]/.test(value))
+        return false;
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: value });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** `timeZone`'s offset from UTC at `instant`, in milliseconds (Berlin in July: 7,200,000). */
+export function zoneOffsetMs(instant, timeZone) {
+    const parts = new Intl.DateTimeFormat("en-US", {
+        timeZone,
+        hourCycle: "h23",
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        second: "2-digit",
+    }).formatToParts(instant);
+    const read = (type) => Number(parts.find((part) => part.type === type)?.value ?? 0);
+    const asUtc = Date.UTC(read("year"), read("month") - 1, read("day"), read("hour"), read("minute"), read("second"));
+    return asUtc - Math.floor(instant.getTime() / 1000) * 1000;
+}
+/**
+ * The instant a wall-clock time in `timeZone` names. A time the zone repeats (the
+ * autumn fall-back hour) resolves to its first occurrence; a time it skips (the
+ * spring-forward gap) resolves past the gap by its length, as a clock would read
+ * it: 02:30 Europe/Berlin on 2026-03-29 is 03:30 CEST.
+ */
+export function zonedWallClockToInstant(wall, timeZone) {
+    const asUtc = Date.UTC(wall.year, wall.month - 1, wall.day, wall.hour, wall.minute, wall.second, wall.millisecond);
+    const before = zoneOffsetMs(new Date(asUtc - DAY_MS), timeZone);
+    const after = zoneOffsetMs(new Date(asUtc + DAY_MS), timeZone);
+    // Each offset in force around that day names one candidate; a candidate is real
+    // when the zone maps it back to this same wall-clock time.
+    const real = [...new Set([before, after])]
+        .map((offset) => asUtc - offset)
+        .filter((instant) => zoneOffsetMs(new Date(instant), timeZone) === asUtc - instant)
+        .sort((left, right) => left - right);
+    return new Date(real[0] ?? asUtc - before);
+}
+// YYYY-MM-DD, optionally THH:MM[:SS[.fff]], and nothing after it: no Z, no offset.
+const LOCAL_ISO_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:[.,](\d{1,9}))?)?)?$/;
+/**
+ * Parse an ISO date-time: with `Z` or an offset it is that instant; without one
+ * it is wall-clock time in `timeZone` (DST-correct). Null when it names no real
+ * date-time. Anything that is not ISO-shaped keeps `Date`'s own parsing.
+ */
+export function parseDateTimeInZone(value, timeZone) {
+    const text = value.trim();
+    const local = LOCAL_ISO_DATE_TIME.exec(text);
+    if (!local) {
+        const instant = new Date(text);
+        return Number.isFinite(instant.getTime()) ? instant : null;
+    }
+    const [year, month, day, hour, minute, second] = local.slice(1, 7).map((part) => Number(part ?? 0));
+    const millisecond = local[7] ? Math.floor(Number(`0.${local[7]}`) * 1000) : 0;
+    const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+    if (month < 1 || month > 12 || day < 1 || day > daysInMonth || hour > 23 || minute > 59 || second > 59)
+        return null;
+    return zonedWallClockToInstant({ year, month, day, hour, minute, second, millisecond }, timeZone);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.1011.98",
+  "version": "1.1011.322",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",