@oxygen-agent/cli 1.1014.1600 → 1.1014.1763

package/node_modules/@oxygen/shared/dist/email-delivery.js

@@ -12,7 +12,16 @@
  * Pure and browser-safe: the web Delivery control, the CLI/MCP contracts, the
  * tenant settings validator and the dispatcher all read the same parser.
  */
+import { BULK_EMAIL_CREDITS_PER_EMAIL } from "./pricing-snapshot.generated.js";
 export const SEQUENCE_EMAIL_DELIVERY_MODES = ["inboxes", "sending_domain"];
+/**
+ * The opt-out line of a cold email sent as plain text, when its Sequence turned the
+ * visible unsubscribe on without writing its own `reply_to_stop_text`. Plain text
+ * shows a line, never the signed URL (Plain T-317). Any reply stops the lead's
+ * enrollment in that Sequence, and opt-out wording ("not interested") puts the
+ * address on do-not-contact unless the workspace lowered `email_optout_phrase`.
+ */
+export const DEFAULT_PLAIN_TEXT_OPT_OUT = "Not interested? Just reply and I won't follow up.";
 export class EmailDeliverySettingError extends Error {
     field;
     constructor(field, message) {
@@ -205,6 +214,11 @@ export function estimateSesCostUsd(sends) {
     const count = Math.max(0, Math.floor(sends));
     return Math.ceil(count * SES_USD_PER_THOUSAND * 100 / 1000) / 100;
 }
+/** Credits for newsletter emails sent through a sending domain (`send.bulk_email`, 5x AWS). */
+export function bulkEmailCredits(emails) {
+    const count = Number.isFinite(emails) ? Math.max(0, Math.floor(emails)) : 0;
+    return Math.round(count * BULK_EMAIL_CREDITS_PER_EMAIL * 1000) / 1000;
+}
 // ---------------------------------------------------------------------------
 // Release slice (clean-room). The first live start of a sending-domain Sequence
 // sends a small slice, holds, and releases the rest only when the slice's hard

package/node_modules/@oxygen/shared/dist/email-documents.d.ts

@@ -0,0 +1,61 @@
+/** Gmail clips a message above ~102 KB; the server refuses a revision above this. */
+export declare const EMAIL_DOCUMENT_MAX_HTML_BYTES = 102400;
+/** The editor's size meter warns from here. */
+export declare const EMAIL_DOCUMENT_WARN_HTML_BYTES = 81920;
+export declare const EMAIL_DOCUMENT_MAX_TEXT_CHARS = 102400;
+export declare const EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS = 500;
+export declare const EMAIL_DOCUMENT_MAX_NAME_CHARS = 200;
+/** The editor's JSON tree; generous, but bounded so a revision row stays small. */
+export declare const EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES = 512000;
+export declare const EMAIL_DOCUMENT_ROLES: readonly ["step", "template"];
+export type EmailDocumentRole = typeof EMAIL_DOCUMENT_ROLES[number];
+export declare const EMAIL_DOCUMENT_KINDS: readonly ["visual", "html"];
+export type EmailDocumentKind = typeof EMAIL_DOCUMENT_KINDS[number];
+/** A step's reference to its body. Without `revision` it follows the current one until the Sequence goes live. */
+export type EmailDocumentRef = {
+    id: string;
+    revision?: number;
+};
+export declare function isEmailDocumentId(value: unknown): value is string;
+/** UTF-8 byte length, the unit Gmail clips on. */
+export declare function emailHtmlByteLength(html: string): number;
+/** A refused document input: a fixed sentence naming the field (ADR 0023 validation copy). */
+export declare class EmailDocumentInputError extends Error {
+    readonly code: string;
+    readonly field: string;
+    readonly details: Record<string, unknown>;
+    constructor(code: string, field: string, message: string, details?: Record<string, unknown>);
+}
+export type EmailDocumentContentInput = {
+    html: string;
+    text: string;
+    previewText: string | null;
+    editorJson: unknown | null;
+    htmlBytes: number;
+    /** True when the save removed scripts, handlers or unsafe links from raw HTML. */
+    sanitized: boolean;
+    removed: {
+        elements: number;
+        handlers: number;
+        urls: number;
+    };
+};
+/**
+ * A readable plain-text part from email HTML, for a revision saved without one.
+ * Links keep their target (`label (https://...)`); merge tags pass through.
+ */
+export declare function emailHtmlToPlainText(html: string): string;
+/**
+ * Validate one revision's content: raw HTML is cleaned of active content,
+ * text is derived when absent, and the 100 KB HTML ceiling is enforced on the
+ * cleaned bytes. Throws EmailDocumentInputError; never truncates.
+ */
+export declare function normalizeEmailDocumentContent(input: {
+    html: unknown;
+    text?: unknown;
+    previewText?: unknown;
+    editorJson?: unknown;
+}): EmailDocumentContentInput;
+export declare function normalizeEmailDocumentName(value: unknown, fallback: string): string;
+export declare function isEmailDocumentRole(value: unknown): value is EmailDocumentRole;
+export declare function isEmailDocumentKind(value: unknown): value is EmailDocumentKind;

package/node_modules/@oxygen/shared/dist/email-documents.js

@@ -0,0 +1,143 @@
+/**
+ * Email documents: the designed body of a newsletter step (or a reusable
+ * template), stored once with append-only revisions (tenant migration 0555)
+ * and referenced by a step as `body_document {id, revision}`. This leaf holds
+ * the shared vocabulary every surface validates against; storage lives in
+ * `@oxygen/tenant-db/email-documents`. Browser-safe: no Node imports.
+ */
+import { sanitizeEmailHtml } from "./email-html-sanitize.js";
+/** Gmail clips a message above ~102 KB; the server refuses a revision above this. */
+export const EMAIL_DOCUMENT_MAX_HTML_BYTES = 102_400;
+/** The editor's size meter warns from here. */
+export const EMAIL_DOCUMENT_WARN_HTML_BYTES = 81_920;
+export const EMAIL_DOCUMENT_MAX_TEXT_CHARS = 102_400;
+export const EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS = 500;
+export const EMAIL_DOCUMENT_MAX_NAME_CHARS = 200;
+/** The editor's JSON tree; generous, but bounded so a revision row stays small. */
+export const EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES = 512_000;
+export const EMAIL_DOCUMENT_ROLES = ["step", "template"];
+export const EMAIL_DOCUMENT_KINDS = ["visual", "html"];
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isEmailDocumentId(value) {
+    return typeof value === "string" && UUID_RE.test(value);
+}
+/** UTF-8 byte length, the unit Gmail clips on. */
+export function emailHtmlByteLength(html) {
+    return new TextEncoder().encode(html).length;
+}
+/** A refused document input: a fixed sentence naming the field (ADR 0023 validation copy). */
+export class EmailDocumentInputError extends Error {
+    code;
+    field;
+    details;
+    constructor(code, field, message, details = {}) {
+        super(message);
+        this.name = "EmailDocumentInputError";
+        this.code = code;
+        this.field = field;
+        this.details = details;
+    }
+}
+const ENTITIES = { amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'", nbsp: " ", "#39": "'" };
+/**
+ * A readable plain-text part from email HTML, for a revision saved without one.
+ * Links keep their target (`label (https://...)`); merge tags pass through.
+ */
+export function emailHtmlToPlainText(html) {
+    const withoutHidden = html
+        .replace(/<(head|style|script|title)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, "")
+        .replace(/<!--[\s\S]*?-->/g, "");
+    const withLinks = withoutHidden.replace(/<a\b[^>]*?\shref\s*=\s*("([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a\s*>/gi, (_whole, _raw, dq, sq, label) => {
+        const href = (dq ?? sq ?? "").trim();
+        const text = label.replace(/<[^>]+>/g, "").trim();
+        if (!href || href === "#" || href.startsWith("mailto:") && text.includes(href.slice(7)))
+            return text;
+        return text && text !== href ? `${text} (${href})` : href;
+    });
+    const text = withLinks
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<\/(p|div|h[1-6]|li|tr|table|blockquote|section|article|header|footer)\s*>/gi, "\n\n")
+        .replace(/<li\b[^>]*>/gi, "- ")
+        .replace(/<[^>]+>/g, "")
+        .replace(/&(#\d+|#x[0-9a-f]+|[a-z]+);/gi, (entity, name) => {
+        const lower = name.toLowerCase();
+        if (lower.startsWith("#x"))
+            return String.fromCharCode(Number.parseInt(lower.slice(2), 16));
+        if (lower.startsWith("#") && lower !== "#39")
+            return String.fromCharCode(Number.parseInt(lower.slice(1), 10));
+        return ENTITIES[lower] ?? entity;
+    });
+    return text
+        .split("\n")
+        .map((line) => line.replace(/[ \t ]+/g, " ").trim())
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+/**
+ * Validate one revision's content: raw HTML is cleaned of active content,
+ * text is derived when absent, and the 100 KB HTML ceiling is enforced on the
+ * cleaned bytes. Throws EmailDocumentInputError; never truncates.
+ */
+export function normalizeEmailDocumentContent(input) {
+    if (typeof input.html !== "string" || !input.html.trim()) {
+        throw new EmailDocumentInputError("invalid_email_document", "html", "html is required and must be a non-empty string.");
+    }
+    const cleaned = sanitizeEmailHtml(input.html);
+    const htmlBytes = emailHtmlByteLength(cleaned.html);
+    if (htmlBytes > EMAIL_DOCUMENT_MAX_HTML_BYTES) {
+        throw new EmailDocumentInputError("email_document_too_large", "html", `The email's HTML is ${htmlBytes} bytes; the limit is ${EMAIL_DOCUMENT_MAX_HTML_BYTES} bytes (Gmail clips larger emails). Remove content or images embedded as data.`, { html_bytes: htmlBytes, max_html_bytes: EMAIL_DOCUMENT_MAX_HTML_BYTES });
+    }
+    let text;
+    if (input.text === undefined || input.text === null || (typeof input.text === "string" && !input.text.trim())) {
+        text = emailHtmlToPlainText(cleaned.html);
+    }
+    else if (typeof input.text !== "string") {
+        throw new EmailDocumentInputError("invalid_email_document", "text", "text must be a string.");
+    }
+    else {
+        text = input.text;
+    }
+    if (text.length > EMAIL_DOCUMENT_MAX_TEXT_CHARS) {
+        throw new EmailDocumentInputError("email_document_too_large", "text", `The plain-text part is longer than ${EMAIL_DOCUMENT_MAX_TEXT_CHARS} characters.`, { max_text_chars: EMAIL_DOCUMENT_MAX_TEXT_CHARS });
+    }
+    let previewText = null;
+    if (input.previewText !== undefined && input.previewText !== null) {
+        if (typeof input.previewText !== "string") {
+            throw new EmailDocumentInputError("invalid_email_document", "preview_text", "preview_text must be a string.");
+        }
+        if (input.previewText.length > EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS) {
+            throw new EmailDocumentInputError("invalid_email_document", "preview_text", `preview_text must be at most ${EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS} characters.`);
+        }
+        previewText = input.previewText.trim() ? input.previewText : null;
+    }
+    let editorJson = null;
+    if (input.editorJson !== undefined && input.editorJson !== null) {
+        if (typeof input.editorJson !== "object") {
+            throw new EmailDocumentInputError("invalid_email_document", "editor_json", "editor_json must be a JSON object.");
+        }
+        if (emailHtmlByteLength(JSON.stringify(input.editorJson)) > EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES) {
+            throw new EmailDocumentInputError("email_document_too_large", "editor_json", `editor_json is larger than ${EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES} bytes.`);
+        }
+        editorJson = input.editorJson;
+    }
+    return { html: cleaned.html, text, previewText, editorJson, htmlBytes, sanitized: cleaned.sanitized, removed: cleaned.removed };
+}
+export function normalizeEmailDocumentName(value, fallback) {
+    if (value === undefined || value === null)
+        return fallback;
+    if (typeof value !== "string" || !value.trim()) {
+        throw new EmailDocumentInputError("invalid_email_document", "name", "name must be a non-empty string.");
+    }
+    const name = value.trim();
+    if (name.length > EMAIL_DOCUMENT_MAX_NAME_CHARS) {
+        throw new EmailDocumentInputError("invalid_email_document", "name", `name must be at most ${EMAIL_DOCUMENT_MAX_NAME_CHARS} characters.`);
+    }
+    return name;
+}
+export function isEmailDocumentRole(value) {
+    return typeof value === "string" && EMAIL_DOCUMENT_ROLES.includes(value);
+}
+export function isEmailDocumentKind(value) {
+    return typeof value === "string" && EMAIL_DOCUMENT_KINDS.includes(value);
+}

package/node_modules/@oxygen/shared/dist/email-dsn.js

@@ -145,9 +145,21 @@ const REPUTATION_BLOCK = /\b5\.7\.\d{1,3}\b/;
 const MAILBOX_FULL_CODE = /\b[45]\.2\.2\b/;
 // 5.1.0 is a generic address-status failure, not proof the recipient is invalid.
 const NO_SUCH_USER_CODE = /\b5\.1\.(?:[123]|10)\b/;
+// Exchange Online: "550 5.4.310 DNS domain <d> does not exist [Message=InfoDomainNonexistent]".
+const NO_SUCH_DOMAIN_CODE = /^5\.4\.310$/;
+// Generic or routing statuses whose own prose may still prove an invalid destination.
+const GENERIC_ADDRESS_CODE = /^5\.(?:0\.\d{1,3}|1\.0)$/;
+const ROUTING_CODE = /^5\.4\.\d{1,3}$/;
 const TRANSIENT_CODE = /(\b4\.\d{1,3}\.\d{1,3}\b|\b4\d{2}\b)/;
-const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|over quota|quota exceeded|insufficient storage)/i;
-const NO_SUCH_USER_TEXT = /((?:address|account|recipient|user|mailbox|domain)[^\n.]{0,100}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|nosuchuser|no such (?:user|recipient|mailbox)|(?:user|recipient) unknown|unknown (?:user|recipient)|(?:recipient |email )?address not found|recipient (?:address )?not found|invalid (?:recipient|email address)|no (?:valid )?MX(?: (?:record|records))?\b|\bNXDOMAIN\b)/i;
+const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|mailbox for user is full|over quota|quota exceeded|insufficient storage)/i;
+// A domain contains dots, so the gap may cross "." but not a sentence end.
+const NAMED_GAP = String.raw `(?:[^\n.]|\.(?=\S)){0,100}`;
+const INVALID_RECIPIENT_TEXT = new RegExp(String.raw `((?:address|account|recipient|user|mailbox)${NAMED_GAP}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|nosuchuser|no such (?:user|recipient|mailbox)|(?:user|recipient) unknown|unknown (?:user|recipient)|(?:recipient |email )?address not found|recipient (?:address )?not found|RecipientNotFound|RecipNotFound|mailbox not found|no mailbox (?:here )?by that name|invalid (?:recipient|mailbox|email address)|unrouteable address)`, "i");
+const INVALID_DOMAIN_TEXT = new RegExp(String.raw `(domain${NAMED_GAP}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|domain name not found|host or domain name not found|InfoDomainNonexistent|no (?:valid )?MX(?: (?:record|records))?\b|\bNXDOMAIN\b)`, "i");
+const NO_SUCH_USER_TEXT = new RegExp(`${INVALID_RECIPIENT_TEXT.source}|${INVALID_DOMAIN_TEXT.source}`, "i");
+// Exchange/Outlook headline: "<local> wasn't found at <domain>." It is the
+// receiving directory's verdict only when it names the report's own recipient.
+const EXCHANGE_RECIPIENT_NOT_FOUND = /(?:^|[\s>])([^\s@<>"'()]+)\s+wasn['’]t found at\s+([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
 const PROVIDER_REJECTED_TEXT = /(message rejected|has been blocked|\bblocked\b|\bbanned\b|\bspam\b|local policy violation|unsolicited|reputation)/i;
 const TRANSIENT_TEXT = /(temporar|will retry|try again later|rate ?limit|throttl)/i;
 // Greedy address capture: the character class already stops at whitespace and
@@ -178,24 +190,53 @@ function readProvider(from, haystack) {
         return "microsoft";
     return "unknown";
 }
-function readKind(subject, haystack, hasBody, enhancedCode) {
+function namesExchangeRecipientNotFound(haystack, recipient) {
+    if (!recipient)
+        return false;
+    for (const match of haystack.matchAll(EXCHANGE_RECIPIENT_NOT_FOUND)) {
+        if (`${match[1]}@${match[2]}`.toLowerCase() === recipient)
+            return true;
+    }
+    return false;
+}
+function readKind(subject, haystack, hasBody, enhancedCode, recipient) {
     // Order is load-bearing. A Google "(Delay)" report can quote block-sounding
     // prose while the message is still queued, so the transient marker wins first;
     // an explicit enhanced code then beats keyword matching, because "blocked" and
     // "spam" appear in boilerplate that a 5.1.1 no-such-user report also carries.
     if (/\(delay\)/i.test(subject))
         return "delayed";
+    const exchangeNotFound = namesExchangeRecipientNotFound(haystack, recipient);
     if (enhancedCode) {
+        // Spam, policy and quota statuses stay stop-only whatever the prose says.
         if (REPUTATION_BLOCK.test(enhancedCode))
             return "provider_rejected";
         if (MAILBOX_FULL_CODE.test(enhancedCode))
             return "mailbox_full";
-        if (NO_SUCH_USER_CODE.test(enhancedCode))
-            return "no_such_user";
+        if (NO_SUCH_USER_CODE.test(enhancedCode)) {
+            // Postfix address verification wraps a full mailbox as "550 5.1.1
+            // undeliverable address: ... said: 552 5.2.2 Quota exceeded".
+            return MAILBOX_FULL_CODE.test(haystack) || MAILBOX_FULL_TEXT.test(haystack) ? "mailbox_full" : "no_such_user";
+        }
         if (enhancedCode.startsWith("4."))
             return "delayed";
-        // An explicit generic/routing failure is not address-nonexistence evidence,
-        // even when the surrounding help text suggests checking the address.
+        if (NO_SUCH_DOMAIN_CODE.test(enhancedCode))
+            return "no_such_user";
+        // SignalFisher, 2026-10-22: Exchange's "554 5.4.14 Hop count exceeded" for
+        // malpertuis@intracen.org carried "malpertuis wasn't found at intracen.org";
+        // the receiving directory does not know the address. A routing status needs
+        // that recipient-bound headline or nonexistent-domain prose, never help text.
+        if (ROUTING_CODE.test(enhancedCode) && (exchangeNotFound || INVALID_DOMAIN_TEXT.test(haystack)))
+            return "no_such_user";
+        if (GENERIC_ADDRESS_CODE.test(enhancedCode)) {
+            // Only the diagnostic line itself counts ("550 5.0.0 <x>: User unknown");
+            // Outlook's "Recipient Unknown" heading is a template, not a verdict.
+            const diagnostic = haystack.split("\n").filter(line => line.includes(enhancedCode)).join("\n");
+            if (!PROVIDER_REJECTED_TEXT.test(diagnostic) && (exchangeNotFound || NO_SUCH_USER_TEXT.test(diagnostic)))
+                return "no_such_user";
+        }
+        // Any other explicit failure is not address-nonexistence evidence, even
+        // when the surrounding help text suggests checking the address.
         return "other";
     }
     if (MAILBOX_FULL_TEXT.test(haystack))
@@ -204,7 +245,7 @@ function readKind(subject, haystack, hasBody, enhancedCode) {
         return "provider_rejected";
     if (ENHANCED_CODE.test(haystack))
         return "other";
-    if (NO_SUCH_USER_TEXT.test(haystack))
+    if (exchangeNotFound || NO_SUCH_USER_TEXT.test(haystack))
         return "no_such_user";
     if (TRANSIENT_CODE.test(haystack) || TRANSIENT_TEXT.test(haystack))
         return "delayed";
@@ -228,10 +269,11 @@ export function classifyDeliveryStatusNotification(input) {
     const haystack = `${subject}\n${body}`;
     const enhancedCode = readEnhancedStatusCode(haystack);
     const smtpCode = enhancedCode ?? (ENHANCED_CODE.test(haystack) ? null : SMTP_REPLY_CODE.exec(haystack)?.[1] ?? null);
+    const recipient = readRecipient(haystack);
     return {
-        kind: readKind(subject, haystack, body.trim().length > 0, enhancedCode),
+        kind: readKind(subject, haystack, body.trim().length > 0, enhancedCode, recipient),
         provider: readProvider(from, haystack),
-        recipient: readRecipient(haystack),
+        recipient,
         smtpCode,
     };
 }

package/node_modules/@oxygen/shared/dist/email-html-sanitize.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Clean raw HTML a customer saves as an email document. Email clients never run
+ * scripts, but the same HTML is previewed in the web app and forwarded by
+ * recipients, so active content is removed on save rather than trusted to every
+ * reader: `<script>` (and other embedding elements), inline `on*` event
+ * handlers, and `javascript:` / `vbscript:` / `data:text/html` URLs in link and
+ * source attributes. Styles, tables, images and merge tags are kept as written.
+ *
+ * Browser-safe and dependency-free. This is a save-time cleanup, not the
+ * preview boundary: the web preview still renders inside a sandboxed iframe.
+ */
+export type EmailHtmlSanitizeResult = {
+    html: string;
+    /** What was removed, for the save response (`sanitized` is true when anything was). */
+    removed: {
+        elements: number;
+        handlers: number;
+        urls: number;
+    };
+    sanitized: boolean;
+};
+export declare function isUnsafeEmailUrl(value: string): boolean;
+export declare function sanitizeEmailHtml(input: string): EmailHtmlSanitizeResult;

package/node_modules/@oxygen/shared/dist/email-html-sanitize.js

@@ -0,0 +1,96 @@
+/**
+ * Clean raw HTML a customer saves as an email document. Email clients never run
+ * scripts, but the same HTML is previewed in the web app and forwarded by
+ * recipients, so active content is removed on save rather than trusted to every
+ * reader: `<script>` (and other embedding elements), inline `on*` event
+ * handlers, and `javascript:` / `vbscript:` / `data:text/html` URLs in link and
+ * source attributes. Styles, tables, images and merge tags are kept as written.
+ *
+ * Browser-safe and dependency-free. This is a save-time cleanup, not the
+ * preview boundary: the web preview still renders inside a sandboxed iframe.
+ */
+const ACTIVE_ELEMENTS = ["script", "iframe", "object", "embed", "applet", "frame", "frameset", "base"];
+const URL_ATTRIBUTES = ["href", "src", "action", "formaction", "background", "poster", "xlink:href", "srcset", "lowsrc", "dynsrc"];
+/** Decode the entity tricks used to hide a scheme (`&#106;avascript:`, `java&#x09;script:`). */
+function decodeForSchemeCheck(value) {
+    return value
+        .replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+        .replace(/&#(\d+);?/g, (_, dec) => String.fromCharCode(Number.parseInt(dec, 10)))
+        .replace(/&(tab|newline);/gi, "")
+        .replace(/&colon;/gi, ":")
+        // Browsers ignore control characters and whitespace inside a scheme.
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000- \u007f-\u009f]+/g, "")
+        .toLowerCase();
+}
+export function isUnsafeEmailUrl(value) {
+    const decoded = decodeForSchemeCheck(value);
+    return decoded.startsWith("javascript:") || decoded.startsWith("vbscript:") || decoded.startsWith("data:text/html")
+        || decoded.startsWith("data:application/xhtml") || decoded.startsWith("data:image/svg+xml");
+}
+// One attribute: a name, then an optional value. `/` separates attributes the way
+// browsers read `<img/onerror=...>`.
+const ATTRIBUTE = /([^\s"'>\/=]+)(?:\s*=\s*("[^"]*"|'[^']*'|[^\s"'>]+))?/g;
+function unquote(value) {
+    return (value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")) ? value.slice(1, -1) : value;
+}
+/** The cleaned attribute string, or null when nothing in it needed cleaning. */
+function rewriteAttributes(attrs, removed) {
+    let changed = false;
+    const kept = [];
+    for (const match of attrs.matchAll(ATTRIBUTE)) {
+        const name = match[1] ?? "";
+        const lower = name.toLowerCase();
+        let value = match[2];
+        if (lower.startsWith("on")) {
+            removed.handlers += 1;
+            changed = true;
+            continue;
+        }
+        if (value !== undefined && URL_ATTRIBUTES.includes(lower) && isUnsafeEmailUrl(unquote(value))) {
+            removed.urls += 1;
+            changed = true;
+            value = '"#"';
+        }
+        else if (value !== undefined && lower === "style") {
+            // A style URL can carry the same schemes (`background:url(javascript:...)`).
+            const cleaned = value.replace(/url\(\s*(["']?)([^"')]*)\1\s*\)/gi, (whole, _q, url) => {
+                if (!isUnsafeEmailUrl(url))
+                    return whole;
+                removed.urls += 1;
+                changed = true;
+                return "none";
+            });
+            value = cleaned;
+        }
+        kept.push(value === undefined ? name : `${name}=${value}`);
+    }
+    if (!changed)
+        return null;
+    const selfClosing = /\/\s*$/.test(attrs);
+    return `${kept.length > 0 ? ` ${kept.join(" ")}` : ""}${selfClosing ? " /" : ""}`;
+}
+export function sanitizeEmailHtml(input) {
+    const removed = { elements: 0, handlers: 0, urls: 0 };
+    let html = input;
+    for (const element of ACTIVE_ELEMENTS) {
+        const paired = new RegExp(`<${element}\\b[^>]*>[\\s\\S]*?<\\/${element}\\s*>`, "gi");
+        const single = new RegExp(`<\\/?${element}\\b[^>]*>`, "gi");
+        html = html.replace(paired, () => {
+            removed.elements += 1;
+            return "";
+        });
+        html = html.replace(single, () => {
+            removed.elements += 1;
+            return "";
+        });
+    }
+    // Attributes are rewritten only inside tags (quoted values may hold `>`), so prose
+    // that mentions "onclick=" survives and an untouched tag keeps its exact bytes.
+    html = html.replace(/<([a-z][a-z0-9:-]*)((?:"[^"]*"|'[^']*'|[^'">])*)>/gi, (match, tag, attrs) => {
+        const rewritten = rewriteAttributes(attrs, removed);
+        return rewritten === null ? match : `<${tag}${rewritten}>`;
+    });
+    const sanitized = removed.elements + removed.handlers + removed.urls > 0;
+    return { html, removed, sanitized };
+}

package/node_modules/@oxygen/shared/dist/email-subscriptions.d.ts

@@ -8,8 +8,26 @@
  * Sequences only send to `subscribed` addresses on their own list, on top of
  * do-not-contact. Pure and browser-safe.
  */
-export declare const EMAIL_SUBSCRIPTION_LIST_KINDS: readonly ["marketing", "product_updates", "onboarding"];
+export declare const EMAIL_SUBSCRIPTION_LIST_KINDS: readonly ["marketing", "product_updates", "onboarding", "topic"];
 export type EmailSubscriptionListKind = typeof EMAIL_SUBSCRIPTION_LIST_KINDS[number];
+/**
+ * Topics: a `topic` list is a narrower subject inside an audience list
+ * (`parent_list_id`). A newsletter on a topic mails only the topic's
+ * subscribers. `opt_out` topics are joined together with their audience list
+ * (the same consent evidence, source `topic_default`); `opt_in` topics only by
+ * an explicit choice. Public lists show on the recipient's preference page;
+ * private ones only to someone already subscribed to them.
+ */
+export declare const EMAIL_SUBSCRIPTION_LIST_VISIBILITIES: readonly ["public", "private"];
+export type EmailSubscriptionListVisibility = typeof EMAIL_SUBSCRIPTION_LIST_VISIBILITIES[number];
+export declare const EMAIL_SUBSCRIPTION_DEFAULTS: readonly ["opt_in", "opt_out"];
+export type EmailSubscriptionDefault = typeof EMAIL_SUBSCRIPTION_DEFAULTS[number];
+/** The consent source of a topic subscription made by joining its audience list. */
+export declare const TOPIC_DEFAULT_SOURCE = "topic_default";
+/** The consent source of a change the recipient made on the hosted preference page. */
+export declare const PREFERENCE_CENTER_SOURCE = "preference_center";
+export declare function isEmailSubscriptionListVisibility(value: unknown): value is EmailSubscriptionListVisibility;
+export declare function isEmailSubscriptionDefault(value: unknown): value is EmailSubscriptionDefault;
 export declare const EMAIL_SUBSCRIPTION_STATUSES: readonly ["subscribed", "unsubscribed", "pending", "cleaned"];
 export type EmailSubscriptionStatus = typeof EMAIL_SUBSCRIPTION_STATUSES[number];
 /** Append-only consent event kinds. Status changes plus the provider facts that cause them. */
@@ -48,3 +66,47 @@ export type EmailConsentEvidence = {
 export declare function parseEmailConsentEvidence(value: unknown, options: {
     requireForSubscribe: boolean;
 }): EmailConsentEvidence;
+/**
+ * Contacts of a list: one subscription read together with the Records person it
+ * names (`email_subscriptions.person_id`, a People record). Records owns the
+ * person (name and the workspace's own People fields, the contact
+ * "properties"); the list owns status and consent.
+ */
+export declare const EMAIL_CONTACT_PROPERTY_TYPES: readonly ["string", "number"];
+export type EmailContactPropertyType = typeof EMAIL_CONTACT_PROPERTY_TYPES[number];
+/** Most contacts one list page returns. */
+export declare const EMAIL_CONTACTS_PAGE_LIMIT = 200;
+/**
+ * Most import entries per call that carry a name or properties: each one is a
+ * Records write (create or match the person by email), so these batches are
+ * smaller than an address-only import. The CLI and web split larger files.
+ */
+export declare const EMAIL_CONTACT_IMPORT_WITH_FIELDS_LIMIT = 1000;
+export declare function isEmailContactPropertyType(value: unknown): value is EmailContactPropertyType;
+/** One contact an import sends: the address, and what goes to its People record. */
+export type EmailContactImportRow = {
+    email: string;
+    person_id?: string;
+    first_name?: string;
+    last_name?: string;
+    properties?: Record<string, string>;
+};
+/** Parse CSV text into rows of cells, honouring quoted fields ("" escapes, commas and newlines inside quotes). */
+export declare function parseCsvCells(text: string): string[][];
+/**
+ * Contacts from a CSV with an email column (the shape `subscriptions export`
+ * writes): first_name and last_name go to the person, every other non-reserved
+ * column is a candidate property, named in `propertyColumns` so a caller can
+ * keep only the workspace's real properties.
+ */
+export declare function parseContactsCsv(text: string): {
+    entries: EmailContactImportRow[];
+    propertyColumns: string[];
+};
+/** Keep only properties the workspace has; report the columns dropped. */
+export declare function keepContactProperties(entries: EmailContactImportRow[], known: ReadonlySet<string>): {
+    entries: EmailContactImportRow[];
+    ignored: string[];
+};
+/** Split an import into calls the import route accepts (smaller batches once any entry carries a name or properties). */
+export declare function chunkContactImport<T extends EmailContactImportRow>(entries: T[]): T[][];