@oxygen-agent/cli 1.1014.1464 → 1.1014.1597

package/node_modules/@oxygen/shared/dist/contracts/sequence-list.d.ts

@@ -1,3 +1,8 @@
 export declare const SEQUENCE_LIST_PROJECTION_CONTRACT: import("./schema.js").ContractObject<{
+    readonly view: {
+        type: "string";
+        enum: readonly ("full" | "summary")[];
+        description?: string;
+    };
     readonly omit: import("./schema.js").StringProperty;
 }, never>;

package/node_modules/@oxygen/shared/dist/contracts/sequence-list.js

@@ -2,7 +2,8 @@
  * Other list filters retain their existing contracts. Unknown CSV values are
  * ignored by the API; absence retains the normal warning reads and results.
  */
-import { obj, str } from "./schema.js";
+import { obj, str, enumOf } from "./schema.js";
 export const SEQUENCE_LIST_PROJECTION_CONTRACT = obj({
+    view: enumOf(["summary", "full"], { description: "CLI/MCP default summary; full details." }),
     omit: str({ description: "warnings: skip warnings and their extra reads." }),
 });

package/node_modules/@oxygen/shared/dist/contracts/signal-search-compatibility.d.ts

@@ -0,0 +1,78 @@
+/** Fresh nested objects keep separately published tool schemas independent. */
+export declare function signalSearchCompatibilityProperties(): {
+    geo: import("./schema.js").ContractObject<{
+        readonly countries: {
+            oneOf: (import("./schema.js").ArrayProperty<import("./schema.js").StringProperty> | import("./schema.js").StringProperty | {
+                type: "null";
+            })[];
+        };
+    }, never>;
+    job: import("./schema.js").ContractObject<{
+        readonly title: import("./schema.js").ContractObject<{
+            readonly include: {
+                oneOf: (import("./schema.js").ArrayProperty<import("./schema.js").StringProperty> | import("./schema.js").StringProperty | {
+                    type: "null";
+                })[];
+            };
+        }, "include">;
+        readonly location: import("./schema.js").ContractObject<{
+            readonly country_code: import("./schema.js").ContractObject<{
+                readonly include: {
+                    oneOf: (import("./schema.js").ArrayProperty<import("./schema.js").StringProperty> | import("./schema.js").StringProperty | {
+                        type: "null";
+                    })[];
+                };
+            }, "include">;
+        }, "country_code">;
+        readonly date_posted: import("./schema.js").ContractObject<{
+            readonly last_days: {
+                readonly oneOf: [{
+                    type: "integer";
+                    description?: string;
+                    minimum?: number;
+                    maximum?: number;
+                    "x-clamp"?: true;
+                }, import("./schema.js").StringProperty, {
+                    readonly type: "null";
+                }];
+            };
+        }, "last_days">;
+    }, never>;
+    company: import("./schema.js").ContractObject<{
+        readonly is_agency: {
+            readonly oneOf: [{
+                readonly type: "boolean";
+                readonly description?: string;
+                readonly enum: readonly [false];
+            }, {
+                type: "string";
+                enum: readonly ("" | "false")[];
+                description?: string;
+            }, {
+                readonly type: "null";
+            }];
+        };
+    }, never>;
+};
+/** Native JSON Schema constraints supplement the shared property's type dialect.
+ * The serving reader independently enforces these same existing restrictions. */
+export declare function signalSearchCompatibilityRules(): {
+    if: {
+        required: string[];
+        properties: {
+            filters: {
+                anyOf: {
+                    required: string[];
+                }[];
+            };
+        };
+    };
+    then: {
+        required: string[];
+        properties: {
+            family: {
+                const: string;
+            };
+        };
+    };
+};

package/node_modules/@oxygen/shared/dist/contracts/signal-search-compatibility.js

@@ -0,0 +1,32 @@
+/** Existing native Signal search compatibility inputs; normalization remains in
+ * the serving reader. No provider, approval or family authority is granted here. */
+import { arr, bool, enumOf, int, obj, str } from "./schema.js";
+/** Fresh nested objects keep separately published tool schemas independent. */
+export function signalSearchCompatibilityProperties() {
+    const list = () => ({ oneOf: [arr(str()), str(), { type: "null" }] });
+    return {
+        geo: obj({ countries: list() }, { description: "Countries alias if countries is absent/null; unioned with job country includes." }),
+        job: obj({
+            title: obj({ include: list() }),
+            location: obj({ country_code: obj({ include: list() }) }),
+            date_posted: obj({ last_days: { oneOf: [int({ minimum: 1, maximum: 3650 }), str(), { type: "null" }] } }),
+        }, { description: "Hiring only. Lists accept arrays or comma strings; values are trimmed. Titles merge with keywords; country includes merge with geo/countries, uppercase and deduplicate. last_days accepts numeric strings for integers 1–3650; differing nonblank top-level last_days is refused." }),
+        company: obj({
+            is_agency: { oneOf: [{ ...bool(), enum: [false] }, enumOf(["false", ""]), { type: "null" }] },
+        }, { description: "Hiring only. Agencies are always excluded: is_agency accepts false, \"false\" or blank." }),
+    };
+}
+/** Native JSON Schema constraints supplement the shared property's type dialect.
+ * The serving reader independently enforces these same existing restrictions. */
+export function signalSearchCompatibilityRules() {
+    // Keep the cross-field condition at the object root without a root-level
+    // combinator: marketplace clients require tools to expose an object schema.
+    // The agency restriction belongs to the company property above.
+    return {
+        if: {
+            required: ["filters"],
+            properties: { filters: { anyOf: [{ required: ["job"] }, { required: ["company"] }] } },
+        },
+        then: { required: ["family"], properties: { family: { const: "hiring" } } },
+    };
+}

package/node_modules/@oxygen/shared/dist/dnc-rules.js

@@ -92,6 +92,20 @@ export const DNC_BUILTIN_RULES = [
         compliance: true,
         group: "automatic",
     },
+    {
+        // Added with sending-domain bulk mail (2026-10-20): the mailbox provider's
+        // feedback loop reports a spam complaint. A new rule that defaults to
+        // `suppress` on purpose: a complaint is the strongest opt-out signal there is.
+        key: "email_complaint",
+        label: "Spam complaint",
+        description: "The recipient marked one of your emails as spam.",
+        ledger: "email",
+        defaultEffect: "suppress",
+        defaultReason: "complaint",
+        allowedEffects: ALL_EFFECTS,
+        compliance: true,
+        group: "automatic",
+    },
     {
         key: "email_optout_phrase",
         label: "Opt-out wording in an email reply",

package/node_modules/@oxygen/shared/dist/email-delivery.d.ts

@@ -0,0 +1,150 @@
+/**
+ * How a Sequence's email steps leave OXYGEN (`settings.email_delivery`).
+ *
+ * `inboxes` is the cold-email model every Sequence had before 2026-10-20: each
+ * lead is assigned a person's warmed mailbox, capped and spaced per inbox.
+ * `sending_domain` is bulk mail to people who subscribed (newsletters, the
+ * onboarding drip): one brand From address on a verified sending domain, sent
+ * through Amazon SES, with a Reply-To mailbox for answers. A sending domain is
+ * an account in Sequencer → Accounts, not a third mailbox provider, so nothing
+ * here touches mailbox rotation; the dispatcher routes this mode to its own lane.
+ *
+ * Pure and browser-safe: the web Delivery control, the CLI/MCP contracts, the
+ * tenant settings validator and the dispatcher all read the same parser.
+ */
+export declare const SEQUENCE_EMAIL_DELIVERY_MODES: readonly ["inboxes", "sending_domain"];
+export type SequenceEmailDeliveryMode = typeof SEQUENCE_EMAIL_DELIVERY_MODES[number];
+export type SendingDomainEmailDelivery = {
+    mode: "sending_domain";
+    sending_domain_id: string;
+    from_address: string;
+    from_name: string | null;
+    reply_to_mailbox_id: string | null;
+    subscription_list_id: string;
+};
+export type SequenceEmailDelivery = {
+    mode: "inboxes";
+} | SendingDomainEmailDelivery;
+export declare class EmailDeliverySettingError extends Error {
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+/**
+ * Parse a stored or submitted `email_delivery` value. Absent/null means
+ * `inboxes` (every existing Sequence). Throws EmailDeliverySettingError naming
+ * the bad field; callers map it to their own validation error.
+ */
+export declare function parseSequenceEmailDelivery(value: unknown): SequenceEmailDelivery;
+/** The delivery a stored settings object resolves to; an unreadable value fails closed to inboxes' validator. */
+export declare function readSequenceEmailDelivery(settings: unknown): SequenceEmailDelivery;
+/** True when the settings route email steps through a sending domain. Never throws. */
+export declare function sendingDomainDeliveryOf(settings: unknown): SendingDomainEmailDelivery | null;
+/** The domain part of an address, lowercased. */
+export declare function emailAddressDomain(address: string): string;
+/** A From address is allowed on a sending domain when it is on the identity (or a subdomain) and listed, if a list exists. */
+export declare function fromAddressAllowedOnSendingDomain(input: {
+    fromAddress: string;
+    identity: string;
+    allowedFromAddresses: readonly string[];
+}): boolean;
+/** Step kinds a sending-domain Sequence may hold: email, and control steps that send nothing. */
+export declare const SENDING_DOMAIN_STEP_KINDS: readonly ["email_send", "wait", "wait_for_signal", "branch", "stop"];
+export type SendingDomainSequenceIssue = {
+    code: "sending_domain_step_kind" | "sending_domain_subject_required" | "sending_domain_unsubscribe_required";
+    message: string;
+    step_index?: number;
+};
+/**
+ * The launch rules of a sending-domain Sequence. Bulk mail to subscribers is a
+ * different product from a cold thread: every email carries its own subject (no
+ * threaded follow-ups), and every email carries the visible unsubscribe footer
+ * and the RFC 8058 one-click headers. Returns every problem, empty when valid.
+ */
+export declare function sendingDomainSequenceIssues(input: {
+    steps: readonly unknown[];
+    settings: Record<string, unknown>;
+}): SendingDomainSequenceIssue[];
+/**
+ * Sending-domain settings are always saved with the unsubscribe link and headers
+ * on and with table auto-enrollment off: a newsletter's audience is its
+ * subscription list, never every new row of a table.
+ */
+export declare function withSendingDomainSettingDefaults(settings: Record<string, unknown>): Record<string, unknown>;
+/** One DNS record a sending domain needs: Easy DKIM CNAMEs and the custom MAIL FROM MX + SPF. */
+export type SendingDomainDnsRecord = {
+    purpose: "dkim" | "mail_from_mx" | "mail_from_spf";
+    type: "CNAME" | "MX" | "TXT";
+    name: string;
+    content: string;
+    priority?: number;
+};
+export declare const DEFAULT_SES_REGION = "eu-central-1";
+/**
+ * The records Amazon SES needs for a sending domain: three Easy DKIM CNAMEs
+ * (`<token>._domainkey.<identity>` → `<token>.dkim.amazonses.com`) and, for the
+ * custom MAIL FROM subdomain, an MX to the regional feedback endpoint plus an
+ * SPF TXT. DMARC stays the zone owner's record and is never planned here.
+ */
+export declare function sendingDomainDnsRecords(input: {
+    identity: string;
+    dkimTokens: readonly string[];
+    mailFromDomain: string | null;
+    region?: string | null;
+}): SendingDomainDnsRecord[];
+export declare const SES_TRANSACTIONAL_RESERVE_FRACTION = 0.2;
+export declare const SES_BULK_RATE_FRACTION = 0.8;
+/** AWS list price for SES outbound email, USD per 1,000 messages (à la carte). */
+export declare const SES_USD_PER_THOUSAND = 0.1;
+/** The account facts capacity needs; shape-compatible with the SES transport's account snapshot. */
+export type SendingAccountQuota = {
+    enforcementStatus: string;
+    sendingEnabled: boolean;
+    productionAccessEnabled: boolean;
+    max24HourSend: number;
+    maxSendRate: number;
+    sentLast24Hours: number;
+};
+/** True when the SES account may send bulk mail at all. */
+export declare function sendingAccountHealthy(account: SendingAccountQuota | null): boolean;
+/**
+ * Sends one sending domain may still reserve today: the smaller of its own daily
+ * ceiling and the account's remaining 24-hour quota after the transactional
+ * reserve. No account snapshot, or an account that is not healthy, is zero.
+ */
+export declare function sendingDomainRemainingCapacity(input: {
+    dailyCeiling: number;
+    sentTodayOnDomain: number;
+    account: SendingAccountQuota | null;
+}): number;
+/** Milliseconds between bulk sends so one consumer stays at or under 80% of MaxSendRate. */
+export declare function bulkSendIntervalMs(maxSendRate: number): number;
+/** Estimated AWS cost of a send count, USD rounded up to the cent. */
+export declare function estimateSesCostUsd(sends: number): number;
+export declare const RELEASE_SLICE_FRACTION = 0.05;
+export declare const RELEASE_SLICE_MINIMUM = 50;
+export declare const RELEASE_SLICE_HOLD_MS: number;
+export declare const RELEASE_MAX_HARD_BOUNCE_RATE = 0.02;
+export declare const RELEASE_MAX_COMPLAINT_RATE = 0.0008;
+export declare const RELEASE_BLOCK_HARD_BOUNCE_RATE = 0.05;
+export declare const RELEASE_BLOCK_COMPLAINT_RATE = 0.003;
+/** Recipients the first slice sends to: 5% of the audience, at least 50, never more than the audience. */
+export declare function releaseSliceSize(audience: number): number;
+export type ReleaseSliceDecision = "hold" | "release" | "review" | "block";
+/**
+ * Decide what happens after the slice. `hold` until the slice has sent and the
+ * hold time passed; then `release` when both rates are within the release
+ * thresholds, `block` when either crosses a block threshold (checked at any
+ * time, including during the hold), else `review`: the rest waits for a person.
+ */
+export declare function evaluateReleaseSlice(input: {
+    sliceSent: number;
+    sliceSize: number;
+    hardBounces: number;
+    complaints: number;
+    holdUntil: Date | null;
+    now: Date;
+}): {
+    decision: ReleaseSliceDecision;
+    hardBounceRate: number;
+    complaintRate: number;
+};

package/node_modules/@oxygen/shared/dist/email-delivery.js

@@ -0,0 +1,246 @@
+/**
+ * How a Sequence's email steps leave OXYGEN (`settings.email_delivery`).
+ *
+ * `inboxes` is the cold-email model every Sequence had before 2026-10-20: each
+ * lead is assigned a person's warmed mailbox, capped and spaced per inbox.
+ * `sending_domain` is bulk mail to people who subscribed (newsletters, the
+ * onboarding drip): one brand From address on a verified sending domain, sent
+ * through Amazon SES, with a Reply-To mailbox for answers. A sending domain is
+ * an account in Sequencer → Accounts, not a third mailbox provider, so nothing
+ * here touches mailbox rotation; the dispatcher routes this mode to its own lane.
+ *
+ * Pure and browser-safe: the web Delivery control, the CLI/MCP contracts, the
+ * tenant settings validator and the dispatcher all read the same parser.
+ */
+export const SEQUENCE_EMAIL_DELIVERY_MODES = ["inboxes", "sending_domain"];
+export class EmailDeliverySettingError extends Error {
+    field;
+    constructor(field, message) {
+        super(message);
+        this.field = field;
+        this.name = "EmailDeliverySettingError";
+    }
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const EMAIL_RE = /^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/;
+function requiredUuid(record, key) {
+    const value = typeof record[key] === "string" ? record[key].trim() : "";
+    if (!UUID_RE.test(value))
+        throw new EmailDeliverySettingError(`email_delivery.${key}`, `email_delivery.${key} must be an id.`);
+    return value.toLowerCase();
+}
+function optionalUuid(record, key) {
+    const value = record[key];
+    if (value === undefined || value === null || value === "")
+        return null;
+    return requiredUuid(record, key);
+}
+/**
+ * Parse a stored or submitted `email_delivery` value. Absent/null means
+ * `inboxes` (every existing Sequence). Throws EmailDeliverySettingError naming
+ * the bad field; callers map it to their own validation error.
+ */
+export function parseSequenceEmailDelivery(value) {
+    if (value === undefined || value === null)
+        return { mode: "inboxes" };
+    if (typeof value !== "object" || Array.isArray(value)) {
+        throw new EmailDeliverySettingError("email_delivery", "email_delivery must be an object.");
+    }
+    const record = value;
+    const mode = record.mode ?? "inboxes";
+    if (mode === "inboxes")
+        return { mode: "inboxes" };
+    if (mode !== "sending_domain") {
+        throw new EmailDeliverySettingError("email_delivery.mode", "email_delivery.mode must be inboxes or sending_domain.");
+    }
+    const fromAddress = typeof record.from_address === "string" ? record.from_address.trim().toLowerCase() : "";
+    if (!EMAIL_RE.test(fromAddress) || /[\r\n]/.test(fromAddress)) {
+        throw new EmailDeliverySettingError("email_delivery.from_address", "email_delivery.from_address must be an email address.");
+    }
+    const rawName = typeof record.from_name === "string" ? record.from_name.trim() : "";
+    if (rawName.length > 120 || /[\r\n]/.test(rawName)) {
+        throw new EmailDeliverySettingError("email_delivery.from_name", "email_delivery.from_name must be one line of at most 120 characters.");
+    }
+    return {
+        mode: "sending_domain",
+        sending_domain_id: requiredUuid(record, "sending_domain_id"),
+        from_address: fromAddress,
+        from_name: rawName || null,
+        reply_to_mailbox_id: optionalUuid(record, "reply_to_mailbox_id"),
+        subscription_list_id: requiredUuid(record, "subscription_list_id"),
+    };
+}
+/** The delivery a stored settings object resolves to; an unreadable value fails closed to inboxes' validator. */
+export function readSequenceEmailDelivery(settings) {
+    const record = settings && typeof settings === "object" && !Array.isArray(settings)
+        ? settings : {};
+    return parseSequenceEmailDelivery(record.email_delivery);
+}
+/** True when the settings route email steps through a sending domain. Never throws. */
+export function sendingDomainDeliveryOf(settings) {
+    try {
+        const delivery = readSequenceEmailDelivery(settings);
+        return delivery.mode === "sending_domain" ? delivery : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The domain part of an address, lowercased. */
+export function emailAddressDomain(address) {
+    const at = address.lastIndexOf("@");
+    return at >= 0 ? address.slice(at + 1).trim().toLowerCase() : "";
+}
+/** A From address is allowed on a sending domain when it is on the identity (or a subdomain) and listed, if a list exists. */
+export function fromAddressAllowedOnSendingDomain(input) {
+    const from = input.fromAddress.trim().toLowerCase();
+    const domain = emailAddressDomain(from);
+    const identity = input.identity.trim().toLowerCase();
+    if (!domain || !(domain === identity || domain.endsWith(`.${identity}`)))
+        return false;
+    return input.allowedFromAddresses.length === 0
+        || input.allowedFromAddresses.some((allowed) => allowed.trim().toLowerCase() === from);
+}
+/** Step kinds a sending-domain Sequence may hold: email, and control steps that send nothing. */
+export const SENDING_DOMAIN_STEP_KINDS = ["email_send", "wait", "wait_for_signal", "branch", "stop"];
+function subjectOf(step) {
+    return typeof step.subject_template === "string" ? step.subject_template.trim() : "";
+}
+/**
+ * The launch rules of a sending-domain Sequence. Bulk mail to subscribers is a
+ * different product from a cold thread: every email carries its own subject (no
+ * threaded follow-ups), and every email carries the visible unsubscribe footer
+ * and the RFC 8058 one-click headers. Returns every problem, empty when valid.
+ */
+export function sendingDomainSequenceIssues(input) {
+    const issues = [];
+    input.steps.forEach((raw, index) => {
+        const step = (raw && typeof raw === "object" ? raw : {});
+        const kind = typeof step.kind === "string" ? step.kind : "";
+        if (!SENDING_DOMAIN_STEP_KINDS.includes(kind)) {
+            issues.push({ code: "sending_domain_step_kind", step_index: index,
+                message: `Step ${index + 1} (${kind || "unknown"}) cannot send through a sending domain. Use email, wait or branch steps.` });
+            return;
+        }
+        if (kind !== "email_send")
+            return;
+        const variants = Array.isArray(step.variants) ? step.variants : [];
+        const variantMissing = variants.some((variant) => variant && typeof variant === "object"
+            && "subject_template" in variant && !subjectOf(variant));
+        if (!subjectOf(step) || variantMissing) {
+            issues.push({ code: "sending_domain_subject_required", step_index: index,
+                message: `Email step ${index + 1} needs a subject. Sending-domain emails never continue a thread.` });
+        }
+    });
+    if (input.settings.include_unsubscribe_link !== true || input.settings.include_unsubscribe_headers !== true) {
+        issues.push({ code: "sending_domain_unsubscribe_required",
+            message: "Sending-domain email must carry the unsubscribe link and one-click headers." });
+    }
+    return issues;
+}
+/**
+ * Sending-domain settings are always saved with the unsubscribe link and headers
+ * on and with table auto-enrollment off: a newsletter's audience is its
+ * subscription list, never every new row of a table.
+ */
+export function withSendingDomainSettingDefaults(settings) {
+    if (!sendingDomainDeliveryOf(settings))
+        return settings;
+    return { ...settings, include_unsubscribe_link: true, include_unsubscribe_headers: true, auto_enroll_table_rows: false };
+}
+export const DEFAULT_SES_REGION = "eu-central-1";
+/**
+ * The records Amazon SES needs for a sending domain: three Easy DKIM CNAMEs
+ * (`<token>._domainkey.<identity>` → `<token>.dkim.amazonses.com`) and, for the
+ * custom MAIL FROM subdomain, an MX to the regional feedback endpoint plus an
+ * SPF TXT. DMARC stays the zone owner's record and is never planned here.
+ */
+export function sendingDomainDnsRecords(input) {
+    const identity = input.identity.trim().toLowerCase();
+    const region = input.region?.trim() || DEFAULT_SES_REGION;
+    const records = input.dkimTokens
+        .map((token) => token.trim())
+        .filter((token) => /^[A-Za-z0-9_-]{1,128}$/.test(token))
+        .map((token) => ({ purpose: "dkim", type: "CNAME", name: `${token}._domainkey.${identity}`, content: `${token}.dkim.amazonses.com` }));
+    if (input.mailFromDomain) {
+        const mailFrom = input.mailFromDomain.trim().toLowerCase();
+        records.push({ purpose: "mail_from_mx", type: "MX", name: mailFrom, content: `feedback-smtp.${region}.amazonses.com`, priority: 10 }, { purpose: "mail_from_spf", type: "TXT", name: mailFrom, content: "v=spf1 include:amazonses.com ~all" });
+    }
+    return records;
+}
+// ---------------------------------------------------------------------------
+// Capacity and pacing. The SES account quota is shared with transactional mail,
+// so bulk mail never plans past 80% of it: 20% stays for receipts and notices.
+// ---------------------------------------------------------------------------
+export const SES_TRANSACTIONAL_RESERVE_FRACTION = 0.2;
+export const SES_BULK_RATE_FRACTION = 0.8;
+/** AWS list price for SES outbound email, USD per 1,000 messages (à la carte). */
+export const SES_USD_PER_THOUSAND = 0.1;
+/** True when the SES account may send bulk mail at all. */
+export function sendingAccountHealthy(account) {
+    return Boolean(account && account.sendingEnabled && account.enforcementStatus.toUpperCase() === "HEALTHY");
+}
+/**
+ * Sends one sending domain may still reserve today: the smaller of its own daily
+ * ceiling and the account's remaining 24-hour quota after the transactional
+ * reserve. No account snapshot, or an account that is not healthy, is zero.
+ */
+export function sendingDomainRemainingCapacity(input) {
+    if (!sendingAccountHealthy(input.account))
+        return 0;
+    const account = input.account;
+    const bulkQuota = Math.floor(Math.max(0, account.max24HourSend) * (1 - SES_TRANSACTIONAL_RESERVE_FRACTION));
+    const accountRemaining = bulkQuota - Math.max(0, account.sentLast24Hours);
+    const domainRemaining = Math.max(0, Math.floor(input.dailyCeiling)) - Math.max(0, input.sentTodayOnDomain);
+    return Math.max(0, Math.min(accountRemaining, domainRemaining));
+}
+/** Milliseconds between bulk sends so one consumer stays at or under 80% of MaxSendRate. */
+export function bulkSendIntervalMs(maxSendRate) {
+    if (!Number.isFinite(maxSendRate) || maxSendRate <= 0)
+        return 60_000;
+    return Math.ceil(1000 / (maxSendRate * SES_BULK_RATE_FRACTION));
+}
+/** Estimated AWS cost of a send count, USD rounded up to the cent. */
+export function estimateSesCostUsd(sends) {
+    const count = Math.max(0, Math.floor(sends));
+    return Math.ceil(count * SES_USD_PER_THOUSAND * 100 / 1000) / 100;
+}
+// ---------------------------------------------------------------------------
+// Release slice (clean-room). The first live start of a sending-domain Sequence
+// sends a small slice, holds, and releases the rest only when the slice's hard
+// bounces and complaints stay low. Thresholds are ours; see OXYGEN_PRODUCT.md.
+// ---------------------------------------------------------------------------
+export const RELEASE_SLICE_FRACTION = 0.05;
+export const RELEASE_SLICE_MINIMUM = 50;
+export const RELEASE_SLICE_HOLD_MS = 3 * 60 * 60 * 1000;
+export const RELEASE_MAX_HARD_BOUNCE_RATE = 0.02;
+export const RELEASE_MAX_COMPLAINT_RATE = 0.0008;
+export const RELEASE_BLOCK_HARD_BOUNCE_RATE = 0.05;
+export const RELEASE_BLOCK_COMPLAINT_RATE = 0.003;
+/** Recipients the first slice sends to: 5% of the audience, at least 50, never more than the audience. */
+export function releaseSliceSize(audience) {
+    const total = Math.max(0, Math.floor(audience));
+    return Math.min(total, Math.max(RELEASE_SLICE_MINIMUM, Math.ceil(total * RELEASE_SLICE_FRACTION)));
+}
+/**
+ * Decide what happens after the slice. `hold` until the slice has sent and the
+ * hold time passed; then `release` when both rates are within the release
+ * thresholds, `block` when either crosses a block threshold (checked at any
+ * time, including during the hold), else `review`: the rest waits for a person.
+ */
+export function evaluateReleaseSlice(input) {
+    const sent = Math.max(0, input.sliceSent);
+    const hardBounceRate = sent > 0 ? Math.max(0, input.hardBounces) / sent : 0;
+    const complaintRate = sent > 0 ? Math.max(0, input.complaints) / sent : 0;
+    const rates = { hardBounceRate, complaintRate };
+    if (sent > 0 && (hardBounceRate > RELEASE_BLOCK_HARD_BOUNCE_RATE || complaintRate > RELEASE_BLOCK_COMPLAINT_RATE)) {
+        return { decision: "block", ...rates };
+    }
+    if (sent < input.sliceSize || !input.holdUntil || input.now.getTime() < input.holdUntil.getTime()) {
+        return { decision: "hold", ...rates };
+    }
+    if (hardBounceRate <= RELEASE_MAX_HARD_BOUNCE_RATE && complaintRate <= RELEASE_MAX_COMPLAINT_RATE) {
+        return { decision: "release", ...rates };
+    }
+    return { decision: "review", ...rates };
+}

package/node_modules/@oxygen/shared/dist/email-dsn.d.ts

@@ -54,6 +54,7 @@ type DsnInput = {
     bodyText?: string | null;
     bodyHtml?: string | null;
 };
+export declare function readDeliveryStatusNotificationBody(input: Pick<DsnInput, "bodyText" | "bodyHtml">): string;
 /**
  * Classify one stored inbound message as a delivery-status notification.
  *

package/node_modules/@oxygen/shared/dist/email-dsn.js

@@ -80,7 +80,7 @@ function dsnHtmlText(html) {
     }
     return parts.join("");
 }
-function readDsnBody(input) {
+export function readDeliveryStatusNotificationBody(input) {
     if (typeof input.bodyText === "string" && input.bodyText.trim())
         return input.bodyText;
     if (typeof input.bodyHtml !== "string")
@@ -121,10 +121,11 @@ const ENHANCED_CODE = /\b([2-5]\.\d{1,3}\.\d{1,3})\b/;
 const SMTP_REPLY_CODE = /\b([2-5]\d{2})\b/;
 const REPUTATION_BLOCK = /\b5\.7\.\d{1,3}\b/;
 const MAILBOX_FULL_CODE = /\b[45]\.2\.2\b/;
-const NO_SUCH_USER_CODE = /\b5\.1\.\d{1,3}\b/;
+// 5.1.0 is a generic address-status failure, not proof the recipient is invalid.
+const NO_SUCH_USER_CODE = /\b5\.1\.(?:[123]|10)\b/;
 const TRANSIENT_CODE = /(\b4\.\d{1,3}\.\d{1,3}\b|\b4\d{2}\b)/;
 const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|over quota|quota exceeded|insufficient storage)/i;
-const NO_SUCH_USER_TEXT = /(does ?n[o']?t exist|nosuchuser|no such user|user unknown|unknown user|address not found|recipient (?:address )?(?:not found|rejected)|invalid recipient)/i;
+const NO_SUCH_USER_TEXT = /((?:address|account|recipient|user|mailbox|domain)[^\n.]{0,100}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|nosuchuser|no such (?:user|recipient|mailbox)|(?:user|recipient) unknown|unknown (?:user|recipient)|(?:recipient |email )?address not found|recipient (?:address )?not found|invalid (?:recipient|email address)|no (?:valid )?MX(?: (?:record|records))?\b|\bNXDOMAIN\b)/i;
 const PROVIDER_REJECTED_TEXT = /(message rejected|has been blocked|\bblocked\b|\bbanned\b|\bspam\b|local policy violation|unsolicited|reputation)/i;
 const TRANSIENT_TEXT = /(temporar|will retry|try again later|rate ?limit|throttl)/i;
 // Greedy address capture: the character class already stops at whitespace and
@@ -166,10 +167,12 @@ function readKind(subject, haystack, hasBody) {
         return "provider_rejected";
     if (MAILBOX_FULL_CODE.test(haystack) || MAILBOX_FULL_TEXT.test(haystack))
         return "mailbox_full";
-    if (NO_SUCH_USER_CODE.test(haystack) || NO_SUCH_USER_TEXT.test(haystack))
+    if (NO_SUCH_USER_CODE.test(haystack))
         return "no_such_user";
     if (PROVIDER_REJECTED_TEXT.test(haystack))
         return "provider_rejected";
+    if (NO_SUCH_USER_TEXT.test(haystack))
+        return "no_such_user";
     if (TRANSIENT_CODE.test(haystack) || TRANSIENT_TEXT.test(haystack))
         return "delayed";
     // Nothing matched AND there was no body to match against: the sync stored the
@@ -186,7 +189,7 @@ function readKind(subject, haystack, hasBody) {
 export function classifyDeliveryStatusNotification(input) {
     const from = typeof input.fromAddress === "string" ? input.fromAddress : "";
     const subject = typeof input.subject === "string" ? input.subject : "";
-    const body = readDsnBody(input);
+    const body = readDeliveryStatusNotificationBody(input);
     if (!DSN_FROM_PATTERN.test(from) && !DSN_SUBJECT_PATTERN.test(subject))
         return null;
     const haystack = `${subject}\n${body}`;
@@ -206,7 +209,7 @@ export function classifyDeliveryStatusNotification(input) {
 export function isGoogleDeliveryStatusRejection(input) {
     if (classifyDeliveryStatusNotification(input)?.kind !== "provider_rejected")
         return false;
-    const body = readDsnBody(input);
+    const body = readDeliveryStatusNotificationBody(input);
     const remote = /^Remote-MTA:\s*(?:dns|rfc822);\s*([a-z0-9.-]+)/im.exec(body)?.[1];
     if (remote) {
         return /(?:^|\.)(?:google|googlemail)\.com$/i.test(remote.replace(/\.$/, ""));

package/node_modules/@oxygen/shared/dist/email-health-summary.d.ts

@@ -0,0 +1,29 @@
+/** Last-known mailbox scores are advisory; coverage and evidence age qualify the fleet. */
+export type EmailHealthState = "unknown" | "healthy" | "degraded" | "critical";
+export declare const HEALTHY_SCORE_MIN = 80;
+export declare const DEGRADED_SCORE_MIN = 50;
+export declare function deriveEmailHealthState(score: number | null | undefined): EmailHealthState;
+type HealthReading = {
+    healthScore: number | null;
+    healthState: EmailHealthState;
+    healthFreshness?: "current" | "stale" | "unmeasured";
+};
+export type FleetHealthSummary = {
+    /** Equal weight for each mailbox with a finite last-known score. Unknowns never become zeros. */
+    score: number | null;
+    scoreState: EmailHealthState;
+    fleetState: EmailHealthState;
+    worstMailboxState: EmailHealthState;
+    total: number;
+    scored: number;
+    current: number;
+    stale: number;
+    unverified: number;
+    unscored: number;
+    degraded: number;
+    critical: number;
+    coverage: "none" | "partial" | "complete";
+    freshness: "unmeasured" | "current" | "stale" | "mixed";
+};
+export declare function summarizeFleetHealth(readings: readonly HealthReading[]): FleetHealthSummary;
+export {};