@oxygen-agent/cli 1.1014.1464 → 1.1014.1597

package/node_modules/@oxygen/shared/dist/email-health-summary.js

@@ -0,0 +1,28 @@
+export const HEALTHY_SCORE_MIN = 80;
+export const DEGRADED_SCORE_MIN = 50;
+export function deriveEmailHealthState(score) {
+    if (score == null || !Number.isFinite(score))
+        return "unknown";
+    const value = Math.max(0, Math.min(100, score));
+    return value >= HEALTHY_SCORE_MIN ? "healthy" : value >= DEGRADED_SCORE_MIN ? "degraded" : "critical";
+}
+export function summarizeFleetHealth(readings) {
+    const scored = readings.filter(row => row.healthState !== "unknown" && row.healthScore !== null && Number.isFinite(row.healthScore));
+    const score = scored.length ? scored.reduce((sum, row) => sum + Math.max(0, Math.min(100, row.healthScore)), 0) / scored.length : null;
+    const current = scored.filter(row => row.healthFreshness === "current").length;
+    const stale = scored.filter(row => row.healthFreshness === "stale").length;
+    const unverified = scored.length - current - stale;
+    const scoreState = deriveEmailHealthState(score);
+    const critical = readings.filter(row => row.healthState === "critical").length;
+    const degraded = readings.filter(row => row.healthState === "degraded").length;
+    const coverage = scored.length === 0 ? "none" : scored.length === readings.length ? "complete" : "partial";
+    const freshness = scored.length === 0 ? "unmeasured" : current === scored.length ? "current" : stale === scored.length ? "stale" : "mixed";
+    // A strong recorded average cannot clear an unmeasured or stale fleet. Individual faults remain independent.
+    const fleetState = scoreState === "healthy" && (coverage !== "complete" || freshness !== "current") ? "unknown" : scoreState;
+    return {
+        score, scoreState, fleetState,
+        worstMailboxState: critical ? "critical" : degraded ? "degraded" : scored.length ? "healthy" : "unknown",
+        total: readings.length, scored: scored.length, current, stale, unverified,
+        unscored: readings.length - scored.length, degraded, critical, coverage, freshness,
+    };
+}

package/node_modules/@oxygen/shared/dist/email-subscriptions.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Subscription lists and consent for bulk email (sending-domain Sequences).
+ *
+ * A list is who agreed to hear from the workspace about one thing (the
+ * newsletter, product updates, onboarding). A subscription is one address on
+ * one list with a status; every change appends a consent event, which is the
+ * evidence a regulator or a mailbox provider can ask for. Sending-domain
+ * Sequences only send to `subscribed` addresses on their own list, on top of
+ * do-not-contact. Pure and browser-safe.
+ */
+export declare const EMAIL_SUBSCRIPTION_LIST_KINDS: readonly ["marketing", "product_updates", "onboarding"];
+export type EmailSubscriptionListKind = typeof EMAIL_SUBSCRIPTION_LIST_KINDS[number];
+export declare const EMAIL_SUBSCRIPTION_STATUSES: readonly ["subscribed", "unsubscribed", "pending", "cleaned"];
+export type EmailSubscriptionStatus = typeof EMAIL_SUBSCRIPTION_STATUSES[number];
+/** Append-only consent event kinds. Status changes plus the provider facts that cause them. */
+export declare const EMAIL_SUBSCRIPTION_EVENT_TYPES: readonly ["subscribed", "unsubscribed", "pending", "cleaned", "complaint", "hard_bounce"];
+export type EmailSubscriptionEventType = typeof EMAIL_SUBSCRIPTION_EVENT_TYPES[number];
+export declare const EMAIL_SUBSCRIPTION_LIST_KEY_RE: RegExp;
+/** Most addresses one import call accepts. */
+export declare const EMAIL_SUBSCRIPTION_IMPORT_LIMIT = 5000;
+export declare class EmailSubscriptionInputError extends Error {
+    readonly code: string;
+    readonly field: string;
+    constructor(code: string, field: string, message: string);
+}
+export declare function isEmailSubscriptionStatus(value: unknown): value is EmailSubscriptionStatus;
+export declare function isEmailSubscriptionListKind(value: unknown): value is EmailSubscriptionListKind;
+/** The stored subscription key: trimmed, lowercased, one plausible address. */
+export declare function normalizeSubscriptionEmail(value: unknown): string;
+/**
+ * Consent evidence recorded with a subscription change. A change to
+ * `subscribed` must say where consent came from: the notice version and a hash
+ * of the exact notice text the person saw, or, for an import, the source and
+ * the person who vouches for it. IP addresses are stored hashed only.
+ */
+export type EmailConsentEvidence = {
+    notice_version?: string | null;
+    /** sha256 hex of the exact consent notice text shown. */
+    notice_text_hash?: string | null;
+    form_url?: string | null;
+    /** sha256 hex of the subscriber's IP address; never the address itself. */
+    ip_hash?: string | null;
+    user_agent?: string | null;
+    /** Free-text provenance for imports, e.g. "Resend segment export 2026-10-20". */
+    basis?: string | null;
+};
+/** Normalize evidence; `requireForSubscribe` refuses a subscribe that names no basis. */
+export declare function parseEmailConsentEvidence(value: unknown, options: {
+    requireForSubscribe: boolean;
+}): EmailConsentEvidence;

package/node_modules/@oxygen/shared/dist/email-subscriptions.js

@@ -0,0 +1,80 @@
+/**
+ * Subscription lists and consent for bulk email (sending-domain Sequences).
+ *
+ * A list is who agreed to hear from the workspace about one thing (the
+ * newsletter, product updates, onboarding). A subscription is one address on
+ * one list with a status; every change appends a consent event, which is the
+ * evidence a regulator or a mailbox provider can ask for. Sending-domain
+ * Sequences only send to `subscribed` addresses on their own list, on top of
+ * do-not-contact. Pure and browser-safe.
+ */
+export const EMAIL_SUBSCRIPTION_LIST_KINDS = ["marketing", "product_updates", "onboarding"];
+export const EMAIL_SUBSCRIPTION_STATUSES = ["subscribed", "unsubscribed", "pending", "cleaned"];
+/** Append-only consent event kinds. Status changes plus the provider facts that cause them. */
+export const EMAIL_SUBSCRIPTION_EVENT_TYPES = [
+    "subscribed", "unsubscribed", "pending", "cleaned", "complaint", "hard_bounce",
+];
+export const EMAIL_SUBSCRIPTION_LIST_KEY_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+/** Most addresses one import call accepts. */
+export const EMAIL_SUBSCRIPTION_IMPORT_LIMIT = 5000;
+export class EmailSubscriptionInputError extends Error {
+    code;
+    field;
+    constructor(code, field, message) {
+        super(message);
+        this.code = code;
+        this.field = field;
+        this.name = "EmailSubscriptionInputError";
+    }
+}
+export function isEmailSubscriptionStatus(value) {
+    return typeof value === "string" && EMAIL_SUBSCRIPTION_STATUSES.includes(value);
+}
+export function isEmailSubscriptionListKind(value) {
+    return typeof value === "string" && EMAIL_SUBSCRIPTION_LIST_KINDS.includes(value);
+}
+/** The stored subscription key: trimmed, lowercased, one plausible address. */
+export function normalizeSubscriptionEmail(value) {
+    const email = typeof value === "string" ? value.trim().toLowerCase() : "";
+    if (!email || email.length > 320 || !/^[^\s@<>"]+@[^\s@<>"]+\.[^\s@<>"]+$/.test(email)) {
+        throw new EmailSubscriptionInputError("invalid_subscription_email", "email", "Each subscription needs one valid email address.");
+    }
+    return email;
+}
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+function optionalText(value, field, max) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    if (typeof value !== "string" || value.length > max) {
+        throw new EmailSubscriptionInputError("invalid_consent_evidence", `evidence.${field}`, `evidence.${field} must be text of at most ${max} characters.`);
+    }
+    return value.trim() || null;
+}
+function optionalHash(value, field) {
+    const text = optionalText(value, field, 64);
+    if (text === null)
+        return null;
+    if (!SHA256_HEX.test(text.toLowerCase())) {
+        throw new EmailSubscriptionInputError("invalid_consent_evidence", `evidence.${field}`, `evidence.${field} must be a sha256 hex digest.`);
+    }
+    return text.toLowerCase();
+}
+/** Normalize evidence; `requireForSubscribe` refuses a subscribe that names no basis. */
+export function parseEmailConsentEvidence(value, options) {
+    const record = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    const evidence = {
+        notice_version: optionalText(record.notice_version, "notice_version", 80),
+        notice_text_hash: optionalHash(record.notice_text_hash, "notice_text_hash"),
+        form_url: optionalText(record.form_url, "form_url", 2048),
+        ip_hash: optionalHash(record.ip_hash, "ip_hash"),
+        user_agent: optionalText(record.user_agent, "user_agent", 512),
+        basis: optionalText(record.basis, "basis", 500),
+    };
+    if (options.requireForSubscribe) {
+        const notice = Boolean(evidence.notice_version && evidence.notice_text_hash);
+        if (!notice && !evidence.basis) {
+            throw new EmailSubscriptionInputError("consent_evidence_required", "evidence", "Subscribing someone needs consent evidence: notice_version with notice_text_hash, or a basis naming where consent came from.");
+        }
+    }
+    return evidence;
+}

package/node_modules/@oxygen/shared/dist/email-unsubscribe-token.d.ts

@@ -43,6 +43,34 @@ export declare function signUnsubscribeToken(payload: UnsubscribeTokenPayload, s
  * secret, tampered body, replayed garbage). Pure: the route maps null -> 401.
  */
 export declare function verifyUnsubscribeToken(token: string, secret: string): UnsubscribeTokenPayload | null;
+/**
+ * v2: a subscription-list unsubscribe for bulk mail sent through a sending
+ * domain. `lst` names the list the recipient leaves; `scope` says whether the
+ * click leaves that one list or every list (and the do-not-contact ledger).
+ * v1 tokens are untouched: `verifyUnsubscribeToken` still accepts only v1.
+ */
+export type UnsubscribeTokenPayloadV2 = {
+    v: 2;
+    org: string;
+    email: string;
+    /** Subscription list id the recipient leaves. */
+    lst: string;
+    /** `list` leaves only `lst`; `all` leaves every list and suppresses the address. */
+    scope: "list" | "all";
+    seq?: string;
+    enr?: string;
+    /** Sending-domain account id, for provenance. */
+    sd?: string;
+    iat: number;
+};
+export type AnyUnsubscribeTokenPayload = UnsubscribeTokenPayload | UnsubscribeTokenPayloadV2;
+/** Sign a v2 (list-scoped) token. Same wire format and secret as v1. */
+export declare function signUnsubscribeTokenV2(payload: UnsubscribeTokenPayloadV2, secret: string): string;
+/**
+ * Verify a v1 OR v2 token. The one-click route uses this and branches on `v`;
+ * v1 callers keep `verifyUnsubscribeToken`, whose contract is unchanged.
+ */
+export declare function verifyAnyUnsubscribeToken(token: string, secret: string): AnyUnsubscribeTokenPayload | null;
 /**
  * The HMAC signing secret for unsubscribe tokens, or null when unset. The send
  * path treats null as "omit the header" (a send with no one-click link still

package/node_modules/@oxygen/shared/dist/email-unsubscribe-token.js

@@ -49,6 +49,53 @@ export function verifyUnsubscribeToken(token, secret) {
         return null;
     return parseTokenPayload(body);
 }
+/** Sign a v2 (list-scoped) token. Same wire format and secret as v1. */
+export function signUnsubscribeTokenV2(payload, secret) {
+    const normalized = { ...payload, email: payload.email.trim().toLowerCase() };
+    return signPayload(normalized, secret);
+}
+function parseTokenPayloadV2(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const candidate = parsed;
+    if (candidate.v !== 2)
+        return null;
+    const org = typeof candidate.org === "string" ? candidate.org.trim() : "";
+    const email = typeof candidate.email === "string" ? candidate.email.trim().toLowerCase() : "";
+    const lst = typeof candidate.lst === "string" ? candidate.lst.trim() : "";
+    if (!org || !email || !email.includes("@") || !lst)
+        return null;
+    if (candidate.scope !== "list" && candidate.scope !== "all")
+        return null;
+    return {
+        v: 2,
+        org,
+        email,
+        lst,
+        scope: candidate.scope,
+        ...(typeof candidate.seq === "string" && candidate.seq ? { seq: candidate.seq } : {}),
+        ...(typeof candidate.enr === "string" && candidate.enr ? { enr: candidate.enr } : {}),
+        ...(typeof candidate.sd === "string" && candidate.sd ? { sd: candidate.sd } : {}),
+        iat: typeof candidate.iat === "number" && Number.isFinite(candidate.iat) ? candidate.iat : 0,
+    };
+}
+/**
+ * Verify a v1 OR v2 token. The one-click route uses this and branches on `v`;
+ * v1 callers keep `verifyUnsubscribeToken`, whose contract is unchanged.
+ */
+export function verifyAnyUnsubscribeToken(token, secret) {
+    const body = splitAndVerifyToken(token, secret);
+    if (body === null)
+        return null;
+    return parseTokenPayload(body) ?? parseTokenPayloadV2(body);
+}
 /**
  * The HMAC signing secret for unsubscribe tokens, or null when unset. The send
  * path treats null as "omit the header" (a send with no one-click link still

package/node_modules/@oxygen/shared/dist/error-redaction.d.ts

@@ -78,22 +78,10 @@ export declare function readWorkflowStepFailure(error: unknown): WorkflowStepFai
  */
 export declare const AUTOMATION_ACTIONS_EXCEEDED_ERROR_CODE = "automation_actions_exceeded";
 export declare function isAutomationUsageQuotaError(error: unknown): boolean;
-/**
- * The credit-era sibling of the code above, and the one most callers actually want.
- *
- * `automation_actions_exceeded` can only be thrown when the plan carries a non-null
- * `monthlyAutomationActions`. Pricing Model 2.0 ([v1.330.0]) set that field to null on
- * every base plan, so on current plans the admission gate in captureAutomationActions()
- * is unreachable and assertAutomationActionsAvailable() refuses with `insufficient_credits`
- * instead — steps bill automationStepCredits() each out of the one credit pool.
- *
- * Both codes mean the same thing to a caller: "this automation work was REFUSED admission,
- * the customer must feel it, and the run must stop cleanly." Anything else is a metering
- * write that failed and must be stepped over. Matching only the quota code is how a
- * credit-exhausted cron ends up rethrowing out of the scheduler's enqueue loop instead of
- * taking the graceful pause path — abandoning the lease and every remaining due trigger
- * for that tenant's sweep.
- */
+/** Stop dispatch on a known cap refusal or unavailable authoritative Workflow
+ * admission. Unavailable accounting can follow a lost commit acknowledgement;
+ * this predicate does not prove that the fee capture was not applied. Other
+ * legacy metering faults retain their best-effort behavior. */
 export declare const AUTOMATION_INSUFFICIENT_CREDITS_ERROR_CODE = "insufficient_credits";
 export declare function isAutomationAdmissionRefusal(error: unknown): boolean;
 /**

package/node_modules/@oxygen/shared/dist/error-redaction.js

@@ -216,29 +216,20 @@ export function isAutomationUsageQuotaError(error) {
         && typeof error === "object"
         && error.code === AUTOMATION_ACTIONS_EXCEEDED_ERROR_CODE;
 }
-/**
- * The credit-era sibling of the code above, and the one most callers actually want.
- *
- * `automation_actions_exceeded` can only be thrown when the plan carries a non-null
- * `monthlyAutomationActions`. Pricing Model 2.0 ([v1.330.0]) set that field to null on
- * every base plan, so on current plans the admission gate in captureAutomationActions()
- * is unreachable and assertAutomationActionsAvailable() refuses with `insufficient_credits`
- * instead — steps bill automationStepCredits() each out of the one credit pool.
- *
- * Both codes mean the same thing to a caller: "this automation work was REFUSED admission,
- * the customer must feel it, and the run must stop cleanly." Anything else is a metering
- * write that failed and must be stepped over. Matching only the quota code is how a
- * credit-exhausted cron ends up rethrowing out of the scheduler's enqueue loop instead of
- * taking the graceful pause path — abandoning the lease and every remaining due trigger
- * for that tenant's sweep.
- */
+/** Stop dispatch on a known cap refusal or unavailable authoritative Workflow
+ * admission. Unavailable accounting can follow a lost commit acknowledgement;
+ * this predicate does not prove that the fee capture was not applied. Other
+ * legacy metering faults retain their best-effort behavior. */
 export const AUTOMATION_INSUFFICIENT_CREDITS_ERROR_CODE = "insufficient_credits";
 export function isAutomationAdmissionRefusal(error) {
     if (!error || typeof error !== "object")
         return false;
     const code = error.code;
     return code === AUTOMATION_ACTIONS_EXCEEDED_ERROR_CODE
-        || code === AUTOMATION_INSUFFICIENT_CREDITS_ERROR_CODE;
+        || code === AUTOMATION_INSUFFICIENT_CREDITS_ERROR_CODE
+        || code === "budget_policy_exceeded"
+        || code === "workspace_credit_cap_exceeded"
+        || code === "automation_admission_unavailable";
 }
 const MAX_CAUSE_DEPTH = 4;
 const MAX_CAUSE_MESSAGE_LENGTH = 200;

package/node_modules/@oxygen/shared/dist/guided-activation.d.ts

@@ -1,4 +1,16 @@
 export declare const GUIDED_ACTIVATION_PURPOSES: readonly ["lead_scan", "morning_briefing"];
+/**
+ * The research that runs beside the onboarding chat: its own session and turn,
+ * so the person can talk to the Oxygent while it works. `results_turn_id` is
+ * the chat turn that reported it; `results_pending` means the chat was busy
+ * when it finished and the report goes out after that turn.
+ */
+export type GuidedOnboardingResearch = {
+    session_id: string;
+    turn_id?: string;
+    results_turn_id?: string;
+    results_pending?: boolean;
+};
 export type GuidedActivationPurpose = typeof GUIDED_ACTIVATION_PURPOSES[number];
 export type GuidedActivationRoutine = {
     activation_id: string;
@@ -54,13 +66,15 @@ export type GuidedActivation = {
         turn_id?: string;
         event_seq?: number;
         finished_at?: string;
+        /** Agent-led onboarding's background research (Philipp, 2026-10-20): its hidden session and turn, then the chat turn that reported it. */
+        research?: GuidedOnboardingResearch;
     } | null;
     last_fault: {
         code: string;
         at: string;
     } | null;
 };
-/** Unknown tiers and production-shaped data are always denied, independent of NODE_ENV. */
+/** Production requires the explicit all-workspace rollout; the DEV pilot keeps its own switch. */
 export declare function guidedActivationEnabled(env?: Record<string, string | undefined>): boolean;
 export declare function guidedActivationWorkspaceAllowed(organizationId: string, env?: Record<string, string | undefined>): boolean;
 export declare function guidedActivationAvailableTo(env: Record<string, string | undefined>, viewer: {

package/node_modules/@oxygen/shared/dist/guided-activation.js

@@ -3,8 +3,10 @@ import { isProductionData } from "./deploy-env.js";
 export const GUIDED_ACTIVATION_PURPOSES = ["lead_scan", "morning_briefing"];
 export const GUIDED_ACTIVATION_POINTERS = ["knowledge", "first_leads_table", "sequence", "sender", "oxygent", "direct_chat", "scan_routine", "briefing_routine"];
 export const GUIDED_ACTIVATION_REVISIONS = ["configuration", "sequence", "audience", "recipients", "sender", "copy", "knowledge", "schedule", "authority"];
-/** Unknown tiers and production-shaped data are always denied, independent of NODE_ENV. */
+/** Production requires the explicit all-workspace rollout; the DEV pilot keeps its own switch. */
 export function guidedActivationEnabled(env = process.env) {
+    if (env.OXYGEN_DEPLOY_ENV === "selfhost-prod")
+        return env.OXYGEN_GUIDED_ACTIVATION_ENABLED === "all";
     return env.OXYGEN_DEPLOY_ENV === "selfhost-dev" && !isProductionData(env)
         && env.OXYGEN_GUIDED_ACTIVATION_ENABLED === "staff";
 }

package/node_modules/@oxygen/shared/dist/linkedin-sequences.d.ts

@@ -46,6 +46,7 @@ export type LinkedInInviteStep = LinkedInStepBase & {
 };
 export type LinkedInWaitForConnectionStep = LinkedInStepBase & {
     kind: "wait_for_connection";
+    withdraw_on_timeout?: boolean;
     /** Days to wait for the invite to be accepted before acting on on_timeout. */
     timeout_days: number;
     /** What to do if the invite is never accepted. Defaults to "stop". */
@@ -53,6 +54,7 @@ export type LinkedInWaitForConnectionStep = LinkedInStepBase & {
 };
 export type LinkedInWaitStep = LinkedInStepBase & {
     kind: "wait";
+    working_days?: boolean;
     /** Fixed delay before the next step. Provide days and/or hours (>= 1 total). */
     days?: number;
     hours?: number;

package/node_modules/@oxygen/shared/dist/mailbox-standby-rollout.d.ts

@@ -0,0 +1,5 @@
+export { mailboxStandbyWritesReady, assertMailboxStandbyWritesReady } from "./write-rollout.js";
+export declare function assertMailboxStandbyMetadataWriteReady(metadata: Record<string, unknown> | null | undefined): void;
+export declare function assertSequenceStandbyWriteReady(settings: {
+    auto_replace_mailboxes?: boolean;
+} | null | undefined): void;

package/node_modules/@oxygen/shared/dist/mailbox-standby-rollout.js

@@ -0,0 +1,9 @@
+import { assertMailboxStandbyMetadataWritesReady, assertMailboxStandbyWritesReady } from "./write-rollout.js";
+export { mailboxStandbyWritesReady, assertMailboxStandbyWritesReady } from "./write-rollout.js";
+export function assertMailboxStandbyMetadataWriteReady(metadata) {
+    assertMailboxStandbyMetadataWritesReady(metadata);
+}
+export function assertSequenceStandbyWriteReady(settings) {
+    if (settings?.auto_replace_mailboxes === true)
+        assertMailboxStandbyWritesReady();
+}

package/node_modules/@oxygen/shared/dist/mailbox-standby.d.ts

@@ -0,0 +1,43 @@
+export type MailboxOutreachRole = "outreach" | "standby";
+export type MailboxStandbyReadinessEvidence = {
+    observed_at: string;
+    confirmed_days: number;
+    warmup_running: boolean;
+    dns_ready: boolean;
+    auth_healthy: boolean;
+    warmup_provider: string;
+    warmup_vendor_ref: string;
+    ready_since?: string;
+};
+export declare const DEFAULT_MAILBOX_STANDBY_MINIMUM_DAYS = 14;
+export declare const MAILBOX_STANDBY_EVIDENCE_MAX_AGE_MS: number;
+export declare function mailboxOutreachRole(metadata: Record<string, unknown> | null | undefined): MailboxOutreachRole;
+/** Campaign membership is authoritative DB evidence, never the promotion marker alone. */
+export declare function isMailboxOutreachAllowed(input: {
+    metadata: Record<string, unknown> | null | undefined;
+    sequenceId?: string;
+    autoReplace?: boolean;
+    replacementSequenceIds?: string[];
+}): boolean;
+export declare function mailboxStandbyReadiness(input: {
+    metadata: Record<string, unknown>;
+    status: string;
+    warmupState: string;
+    warmupProvider: string | null;
+    warmupVendorRef: string | null;
+    senderProfileId: string | null;
+    senderProfileActive: boolean;
+    minimumDays: number;
+    now?: Date;
+}): {
+    ready: boolean;
+    confirmed_days: number;
+    minimum_days: number;
+    blockers: string[];
+};
+/** The latest promoted descendant; waiting records never create a sending identity. */
+export declare function resolveMailboxStandbyReplacement(rows: readonly {
+    oldMailboxId: string;
+    newMailboxId: string | null;
+    status: string;
+}[], original: string): string | null;

package/node_modules/@oxygen/shared/dist/mailbox-standby.js

@@ -0,0 +1,52 @@
+export const DEFAULT_MAILBOX_STANDBY_MINIMUM_DAYS = 14;
+export const MAILBOX_STANDBY_EVIDENCE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+export function mailboxOutreachRole(metadata) {
+    return metadata?.outreach_role === "standby" ? "standby" : "outreach";
+}
+/** Campaign membership is authoritative DB evidence, never the promotion marker alone. */
+export function isMailboxOutreachAllowed(input) {
+    if (mailboxOutreachRole(input.metadata) === "standby")
+        return false;
+    if (!Object.hasOwn(input.metadata ?? {}, "standby_promotion"))
+        return true;
+    return input.autoReplace === true && !!input.sequenceId && input.replacementSequenceIds?.includes(input.sequenceId) === true;
+}
+export function mailboxStandbyReadiness(input) {
+    const raw = input.metadata.standby_readiness;
+    const evidence = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+    const blockers = [];
+    const observed = Date.parse(evidence.observed_at ?? "");
+    const age = (input.now ?? new Date()).getTime() - observed;
+    if (!Number.isFinite(observed) || age > MAILBOX_STANDBY_EVIDENCE_MAX_AGE_MS || age < -300_000)
+        blockers.push("readiness_evidence_stale_or_missing");
+    if (!evidence.warmup_provider || !evidence.warmup_vendor_ref || evidence.warmup_provider !== input.warmupProvider || evidence.warmup_vendor_ref !== input.warmupVendorRef)
+        blockers.push("warmup_seat_unverified");
+    const days = typeof evidence.confirmed_days === "number" && Number.isInteger(evidence.confirmed_days) && evidence.confirmed_days >= 0 ? evidence.confirmed_days : 0;
+    if (days < input.minimumDays)
+        blockers.push("warmup_days_remaining");
+    if (evidence.warmup_running !== true || !["warming", "active"].includes(input.warmupState))
+        blockers.push("warmup_not_running");
+    if (evidence.dns_ready !== true)
+        blockers.push("dns_not_ready");
+    if (evidence.auth_healthy !== true || input.metadata.oauth_grant_failure || input.metadata.mailbox_deleted_at)
+        blockers.push("authorization_unverified");
+    if (input.status !== "active" || input.metadata.auto_pause)
+        blockers.push("mailbox_not_active_or_safety_paused");
+    if (!input.senderProfileId || !input.senderProfileActive)
+        blockers.push("sender_profile_required");
+    return { ready: blockers.length === 0, confirmed_days: days, minimum_days: input.minimumDays, blockers };
+}
+/** The latest promoted descendant; waiting records never create a sending identity. */
+export function resolveMailboxStandbyReplacement(rows, original) {
+    const visited = new Set([original]);
+    let current = original;
+    while (true) {
+        const next = rows.find(row => row.status === "promoted" && row.newMailboxId && row.oldMailboxId === current)?.newMailboxId;
+        if (!next)
+            return current === original ? null : current;
+        if (visited.has(next))
+            return null;
+        visited.add(next);
+        current = next;
+    }
+}

package/node_modules/@oxygen/shared/dist/native-chat-discovery.d.ts

@@ -0,0 +1,5 @@
+import type { CapabilityRouteMatch } from "./capability-discovery.js";
+export declare function nativeChatEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function isNativeChatTool(name: string): boolean;
+/** The compiled support card includes the dev surface; hosted discovery projects it away when closed. */
+export declare function withNativeChatDiscovery<T extends CapabilityRouteMatch>(route: T, enabled: boolean): T;

package/node_modules/@oxygen/shared/dist/native-chat-discovery.js

@@ -0,0 +1,27 @@
+import { resolveDeployEnv } from "./deploy-env.js";
+export function nativeChatEnabled(env = process.env) {
+    if (!/^(1|true|on)$/i.test(env.OXYGEN_NATIVE_CHAT_ENABLED?.trim() ?? ""))
+        return false;
+    const tier = resolveDeployEnv(env).tier;
+    return tier === "dev" || tier === "local";
+}
+export function isNativeChatTool(name) {
+    return name.startsWith("oxygen_chat_");
+}
+/** The compiled support card includes the dev surface; hosted discovery projects it away when closed. */
+export function withNativeChatDiscovery(route, enabled) {
+    if (enabled || route.card.id !== "support-and-feedback")
+        return route;
+    return {
+        ...route,
+        card: {
+            ...route.card,
+            gatewayTools: route.card.gatewayTools.filter(name => !isNativeChatTool(name)),
+            gatewayCommands: route.card.gatewayCommands.filter(name => !name.startsWith("chat ")),
+            endpointSections: route.card.endpointSections.filter(name => name !== "chat"),
+            intentTerms: route.card.intentTerms.filter(name => !["support chat", "support thread", "chat attachment"].includes(name)),
+        },
+        recommendedTools: route.recommendedTools.filter(name => !isNativeChatTool(name)),
+        recommendedCommands: route.recommendedCommands.filter(name => !name.startsWith("chat ")),
+    };
+}

package/node_modules/@oxygen/shared/dist/native-chat.d.ts

@@ -0,0 +1,124 @@
+/** Native support chat projections shared by web, CLI and MCP. */
+export type ChatStatus = "todo" | "snoozed" | "done";
+export type ChatPriority = "urgent" | "high" | "normal" | "low";
+export type ChatAgentStage = "investigating" | "fixing" | "testing" | "awaiting_release" | "needs_human" | "completed";
+export type ChatAttachment = {
+    id: string;
+    name: string;
+    size_bytes: number;
+    content_type: string;
+    download_url: string;
+};
+export type ChatAgent = {
+    id: string;
+    name: string;
+    stage: ChatAgentStage;
+    last_activity_at: string;
+    summary: string | null;
+    session_url: string | null;
+};
+export type ChatRelease = {
+    status: "none" | "dev" | "prod";
+    fix_sha: string | null;
+    pr_url: string | null;
+    required_roles: string[];
+    verified_at: string | null;
+    stale: boolean;
+};
+export type ChatTriage = {
+    source: "review" | "system_one" | "staff";
+    confidence: number | null;
+    reason: string | null;
+    message_id: string | null;
+};
+export type ChatThread = {
+    id: string;
+    channel_id: string;
+    subject: string;
+    status: ChatStatus;
+    waiting_for_customer: boolean;
+    snoozed_until: string | null;
+    assignee_email: string | null;
+    priority: ChatPriority;
+    triage: ChatTriage;
+    agent: ChatAgent | null;
+    release: ChatRelease;
+    context: Record<string, unknown>;
+    created_at: string;
+    updated_at: string;
+    last_customer_at: string | null;
+    unread_count: number;
+};
+export type ChatMessage = {
+    id: string;
+    thread_id: string;
+    body: string;
+    author: {
+        id: string | null;
+        name: string;
+        kind: "customer" | "staff" | "agent" | "system";
+    };
+    visibility: "public" | "internal";
+    source: "web" | "cli" | "mcp";
+    attachments: ChatAttachment[];
+    mentions: string[];
+    created_at: string;
+};
+export type ChatSignificance = {
+    plan: string | null;
+    mrr_cents: number | null;
+    net_30d_cents: number | null;
+    net_lifetime_cents: number | null;
+    currency: string | null;
+    billing_owner_name: string | null;
+    shared_billing: boolean;
+    captured_at: string | null;
+};
+export type ChatChannel = {
+    id: string;
+    organization_id: string;
+    name: string;
+    updated_at: string;
+    unread_count: number;
+    open_count: number;
+    priority: ChatPriority;
+    oldest_unanswered_at: string | null;
+    significance?: ChatSignificance;
+};
+export type ChatMember = {
+    id: string;
+    name: string;
+    email: string | null;
+};
+export type ChatChannelView = {
+    channel: ChatChannel;
+    threads: ChatThread[];
+    members: ChatMember[];
+    cursor: string;
+};
+export type ChatThreadView = {
+    thread: ChatThread;
+    messages: ChatMessage[];
+    members: ChatMember[];
+    cursor: string;
+    has_more: boolean;
+};
+export type ChatThreadPatch = {
+    status?: ChatStatus;
+    waiting_for_customer?: boolean;
+    snoozed_until?: string | null;
+    assignee_email?: string | null;
+    priority?: ChatPriority;
+    agent?: {
+        id: string;
+        name: string;
+        stage: ChatAgentStage;
+        summary?: string | null;
+        session_url?: string | null;
+    } | null;
+    release?: {
+        fix_sha?: string | null;
+        pr_url?: string | null;
+        required_roles?: string[];
+    };
+};