@oxygen-agent/cli 1.1014.1696 → 1.1014.1763

package/node_modules/@oxygen/shared/dist/email-brand-kit.js

@@ -0,0 +1,214 @@
+/**
+ * The workspace's newsletter brand kit (tenant table ox_sequencer.email_brand_kit,
+ * migration 0559): the logo, colours, width and font newsletters are designed
+ * with, the company name and postal address every bulk email carries in its
+ * footer, social links and the preference page's title.
+ *
+ * One parser serves the `/api/cli/sequencer/brand-kit` route (web, CLI, MCP):
+ * a patch names only the fields it changes, `null` clears one (a colour, width
+ * or font falls back to its default). Pure and browser-safe.
+ */
+export const EMAIL_BRAND_FONT_FAMILIES = ["system", "georgia", "arial", "helvetica", "verdana"];
+export const EMAIL_BRAND_FONT_LABELS = {
+    system: "System sans",
+    georgia: "Georgia",
+    arial: "Arial",
+    helvetica: "Helvetica",
+    verdana: "Verdana",
+};
+/** The CSS font stack each allowlisted family renders with in an email. */
+export const EMAIL_BRAND_FONT_STACKS = {
+    system: "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif",
+    georgia: "Georgia, 'Times New Roman', Times, serif",
+    arial: "Arial, Helvetica, sans-serif",
+    helvetica: "Helvetica, Arial, sans-serif",
+    verdana: "Verdana, Geneva, sans-serif",
+};
+export const EMAIL_BRAND_SOCIAL_NETWORKS = [
+    "website", "linkedin", "x", "facebook", "instagram", "youtube", "tiktok", "github",
+];
+export const EMAIL_BRAND_COLOR_FIELDS = [
+    "background_color", "content_background_color", "text_color", "link_color", "button_color", "button_text_color",
+];
+export const EMAIL_BRAND_LIMITS = {
+    containerWidthMin: 480,
+    containerWidthMax: 800,
+    logoWidthMin: 40,
+    logoWidthMax: 600,
+    urlMax: 2048,
+    companyNameMax: 120,
+    postalAddressMax: 500,
+    socialLinksMax: 10,
+    preferencePageTitleMax: 120,
+    preferencePageDescriptionMax: 500,
+};
+export const DEFAULT_EMAIL_BRAND_COLORS = {
+    background_color: "#f4f4f5",
+    content_background_color: "#ffffff",
+    text_color: "#18181b",
+    link_color: "#2563eb",
+    button_color: "#18181b",
+    button_text_color: "#ffffff",
+};
+export const DEFAULT_EMAIL_BRAND_KIT = {
+    logo_url: null,
+    logo_width: null,
+    ...DEFAULT_EMAIL_BRAND_COLORS,
+    container_width: 600,
+    font_family: "system",
+    company_name: null,
+    postal_address: null,
+    social_links: [],
+    preference_page_title: null,
+    preference_page_description: null,
+    updated_by: null,
+    updated_at: null,
+};
+/** Every editable field; a patch names a subset. */
+export const EMAIL_BRAND_KIT_FIELDS = [
+    "logo_url", "logo_width", ...EMAIL_BRAND_COLOR_FIELDS, "container_width", "font_family", "company_name",
+    "postal_address", "social_links", "preference_page_title", "preference_page_description",
+];
+export class EmailBrandKitInputError extends Error {
+    field;
+    code = "invalid_brand_kit";
+    constructor(field, message) {
+        super(message);
+        this.field = field;
+        this.name = "EmailBrandKitInputError";
+    }
+}
+const HEX_RE = /^#?([0-9a-f]{6}|[0-9a-f]{3})$/i;
+/** `#rrggbb` lowercase from `#rrggbb`, `rrggbb` or `#rgb`; throws on anything else. */
+export function normalizeBrandColor(value, field) {
+    const raw = typeof value === "string" ? value.trim() : "";
+    const match = HEX_RE.exec(raw);
+    if (!match)
+        throw new EmailBrandKitInputError(field, `${field} must be a hex colour such as #1a2b3c.`);
+    const hex = match[1].toLowerCase();
+    return `#${hex.length === 3 ? hex.split("").map((char) => char + char).join("") : hex}`;
+}
+/** An absolute https URL; email clients block or warn on plain http images and links. */
+export function normalizeBrandUrl(value, field) {
+    const raw = typeof value === "string" ? value.trim() : "";
+    let parsed = null;
+    try {
+        parsed = raw ? new URL(raw) : null;
+    }
+    catch {
+        parsed = null;
+    }
+    if (!parsed || parsed.protocol !== "https:" || !parsed.hostname || raw.length > EMAIL_BRAND_LIMITS.urlMax) {
+        throw new EmailBrandKitInputError(field, `${field} must be an https:// URL.`);
+    }
+    return parsed.toString();
+}
+function boundedInteger(value, field, min, max) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+        throw new EmailBrandKitInputError(field, `${field} must be a whole number from ${min} to ${max}.`);
+    }
+    return value;
+}
+function boundedText(value, field, max, options = {}) {
+    if (typeof value !== "string")
+        throw new EmailBrandKitInputError(field, `${field} must be text.`);
+    const lines = value.replace(/\r\n?/g, "\n").split("\n").map((line) => line.replace(/\s+/g, " ").trim());
+    const text = options.multiline ? lines.filter(Boolean).join("\n") : lines.filter(Boolean).join(" ");
+    if (!text)
+        return null;
+    if (text.length > max)
+        throw new EmailBrandKitInputError(field, `${field} must be at most ${max} characters.`);
+    return text;
+}
+export function isEmailBrandFontFamily(value) {
+    return typeof value === "string" && EMAIL_BRAND_FONT_FAMILIES.includes(value);
+}
+function parseSocialLinks(value) {
+    if (!Array.isArray(value))
+        throw new EmailBrandKitInputError("social_links", "social_links must be a list of { network, url }.");
+    if (value.length > EMAIL_BRAND_LIMITS.socialLinksMax) {
+        throw new EmailBrandKitInputError("social_links", `At most ${EMAIL_BRAND_LIMITS.socialLinksMax} social links.`);
+    }
+    return value.map((entry, index) => {
+        const record = entry && typeof entry === "object" && !Array.isArray(entry) ? entry : {};
+        const network = typeof record.network === "string" ? record.network.trim().toLowerCase() : "";
+        if (!EMAIL_BRAND_SOCIAL_NETWORKS.includes(network)) {
+            throw new EmailBrandKitInputError(`social_links[${index}].network`, `network must be one of ${EMAIL_BRAND_SOCIAL_NETWORKS.join(", ")}.`);
+        }
+        return { network: network, url: normalizeBrandUrl(record.url, `social_links[${index}].url`) };
+    });
+}
+/**
+ * Validate a brand kit change. Only the named fields are returned; `null` (or
+ * an empty string for text) clears one. Throws `EmailBrandKitInputError` naming
+ * the field, and refuses a body that names no field.
+ */
+export function parseEmailBrandKitPatch(body) {
+    const patch = {};
+    const has = (field) => Object.hasOwn(body, field) && body[field] !== undefined;
+    const cleared = (field) => body[field] === null || body[field] === "";
+    if (has("logo_url"))
+        patch.logo_url = cleared("logo_url") ? null : normalizeBrandUrl(body.logo_url, "logo_url");
+    if (has("logo_width")) {
+        patch.logo_width = cleared("logo_width") ? null
+            : boundedInteger(body.logo_width, "logo_width", EMAIL_BRAND_LIMITS.logoWidthMin, EMAIL_BRAND_LIMITS.logoWidthMax);
+    }
+    for (const field of EMAIL_BRAND_COLOR_FIELDS) {
+        if (has(field))
+            patch[field] = cleared(field) ? null : normalizeBrandColor(body[field], field);
+    }
+    if (has("container_width")) {
+        patch.container_width = cleared("container_width") ? null
+            : boundedInteger(body.container_width, "container_width", EMAIL_BRAND_LIMITS.containerWidthMin, EMAIL_BRAND_LIMITS.containerWidthMax);
+    }
+    if (has("font_family")) {
+        const font = typeof body.font_family === "string" ? body.font_family.trim().toLowerCase() : body.font_family;
+        if (cleared("font_family"))
+            patch.font_family = null;
+        else if (isEmailBrandFontFamily(font))
+            patch.font_family = font;
+        else
+            throw new EmailBrandKitInputError("font_family", `font_family must be one of ${EMAIL_BRAND_FONT_FAMILIES.join(", ")}.`);
+    }
+    if (has("company_name")) {
+        patch.company_name = body.company_name === null ? null : boundedText(body.company_name, "company_name", EMAIL_BRAND_LIMITS.companyNameMax);
+    }
+    if (has("postal_address")) {
+        patch.postal_address = body.postal_address === null ? null
+            : boundedText(body.postal_address, "postal_address", EMAIL_BRAND_LIMITS.postalAddressMax, { multiline: true });
+    }
+    if (has("social_links"))
+        patch.social_links = body.social_links === null ? null : parseSocialLinks(body.social_links);
+    if (has("preference_page_title")) {
+        patch.preference_page_title = body.preference_page_title === null ? null
+            : boundedText(body.preference_page_title, "preference_page_title", EMAIL_BRAND_LIMITS.preferencePageTitleMax);
+    }
+    if (has("preference_page_description")) {
+        patch.preference_page_description = body.preference_page_description === null ? null
+            : boundedText(body.preference_page_description, "preference_page_description", EMAIL_BRAND_LIMITS.preferencePageDescriptionMax, { multiline: true });
+    }
+    if (Object.keys(patch).length === 0) {
+        throw new EmailBrandKitInputError("brand_kit", `Pass at least one of ${EMAIL_BRAND_KIT_FIELDS.join(", ")}.`);
+    }
+    return patch;
+}
+/** A newsletter may go live only once the kit carries a postal address. */
+export function brandKitHasPostalAddress(kit) {
+    return typeof kit?.postal_address === "string" && kit.postal_address.trim().length > 0;
+}
+export function brandKitGlobalStyles(kit) {
+    const merged = { ...DEFAULT_EMAIL_BRAND_KIT, ...stripNullish(kit ?? {}) };
+    return {
+        background: merged.background_color,
+        contentBackground: merged.content_background_color,
+        text: merged.text_color,
+        link: merged.link_color,
+        button: merged.button_color,
+        buttonText: merged.button_text_color,
+        containerWidth: merged.container_width,
+        fontFamily: EMAIL_BRAND_FONT_STACKS[merged.font_family] ?? EMAIL_BRAND_FONT_STACKS.system,
+    };
+}
+function stripNullish(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== null && entry !== undefined));
+}

package/node_modules/@oxygen/shared/dist/email-delivery.d.ts

@@ -25,6 +25,14 @@ export type SendingDomainEmailDelivery = {
 export type SequenceEmailDelivery = {
     mode: "inboxes";
 } | SendingDomainEmailDelivery;
+/**
+ * The opt-out line of a cold email sent as plain text, when its Sequence turned the
+ * visible unsubscribe on without writing its own `reply_to_stop_text`. Plain text
+ * shows a line, never the signed URL (Plain T-317). Any reply stops the lead's
+ * enrollment in that Sequence, and opt-out wording ("not interested") puts the
+ * address on do-not-contact unless the workspace lowered `email_optout_phrase`.
+ */
+export declare const DEFAULT_PLAIN_TEXT_OPT_OUT = "Not interested? Just reply and I won't follow up.";
 export declare class EmailDeliverySettingError extends Error {
     readonly field: string;
     constructor(field: string, message: string);
@@ -120,6 +128,8 @@ export declare function sendingDomainRemainingCapacity(input: {
 export declare function bulkSendIntervalMs(maxSendRate: number): number;
 /** Estimated AWS cost of a send count, USD rounded up to the cent. */
 export declare function estimateSesCostUsd(sends: number): number;
+/** Credits for newsletter emails sent through a sending domain (`send.bulk_email`, 5x AWS). */
+export declare function bulkEmailCredits(emails: number): number;
 export declare const RELEASE_SLICE_FRACTION = 0.05;
 export declare const RELEASE_SLICE_MINIMUM = 50;
 export declare const RELEASE_SLICE_HOLD_MS: number;

package/node_modules/@oxygen/shared/dist/email-delivery.js

@@ -12,7 +12,16 @@
  * Pure and browser-safe: the web Delivery control, the CLI/MCP contracts, the
  * tenant settings validator and the dispatcher all read the same parser.
  */
+import { BULK_EMAIL_CREDITS_PER_EMAIL } from "./pricing-snapshot.generated.js";
 export const SEQUENCE_EMAIL_DELIVERY_MODES = ["inboxes", "sending_domain"];
+/**
+ * The opt-out line of a cold email sent as plain text, when its Sequence turned the
+ * visible unsubscribe on without writing its own `reply_to_stop_text`. Plain text
+ * shows a line, never the signed URL (Plain T-317). Any reply stops the lead's
+ * enrollment in that Sequence, and opt-out wording ("not interested") puts the
+ * address on do-not-contact unless the workspace lowered `email_optout_phrase`.
+ */
+export const DEFAULT_PLAIN_TEXT_OPT_OUT = "Not interested? Just reply and I won't follow up.";
 export class EmailDeliverySettingError extends Error {
     field;
     constructor(field, message) {
@@ -205,6 +214,11 @@ export function estimateSesCostUsd(sends) {
     const count = Math.max(0, Math.floor(sends));
     return Math.ceil(count * SES_USD_PER_THOUSAND * 100 / 1000) / 100;
 }
+/** Credits for newsletter emails sent through a sending domain (`send.bulk_email`, 5x AWS). */
+export function bulkEmailCredits(emails) {
+    const count = Number.isFinite(emails) ? Math.max(0, Math.floor(emails)) : 0;
+    return Math.round(count * BULK_EMAIL_CREDITS_PER_EMAIL * 1000) / 1000;
+}
 // ---------------------------------------------------------------------------
 // Release slice (clean-room). The first live start of a sending-domain Sequence
 // sends a small slice, holds, and releases the rest only when the slice's hard

package/node_modules/@oxygen/shared/dist/email-documents.d.ts

@@ -0,0 +1,61 @@
+/** Gmail clips a message above ~102 KB; the server refuses a revision above this. */
+export declare const EMAIL_DOCUMENT_MAX_HTML_BYTES = 102400;
+/** The editor's size meter warns from here. */
+export declare const EMAIL_DOCUMENT_WARN_HTML_BYTES = 81920;
+export declare const EMAIL_DOCUMENT_MAX_TEXT_CHARS = 102400;
+export declare const EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS = 500;
+export declare const EMAIL_DOCUMENT_MAX_NAME_CHARS = 200;
+/** The editor's JSON tree; generous, but bounded so a revision row stays small. */
+export declare const EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES = 512000;
+export declare const EMAIL_DOCUMENT_ROLES: readonly ["step", "template"];
+export type EmailDocumentRole = typeof EMAIL_DOCUMENT_ROLES[number];
+export declare const EMAIL_DOCUMENT_KINDS: readonly ["visual", "html"];
+export type EmailDocumentKind = typeof EMAIL_DOCUMENT_KINDS[number];
+/** A step's reference to its body. Without `revision` it follows the current one until the Sequence goes live. */
+export type EmailDocumentRef = {
+    id: string;
+    revision?: number;
+};
+export declare function isEmailDocumentId(value: unknown): value is string;
+/** UTF-8 byte length, the unit Gmail clips on. */
+export declare function emailHtmlByteLength(html: string): number;
+/** A refused document input: a fixed sentence naming the field (ADR 0023 validation copy). */
+export declare class EmailDocumentInputError extends Error {
+    readonly code: string;
+    readonly field: string;
+    readonly details: Record<string, unknown>;
+    constructor(code: string, field: string, message: string, details?: Record<string, unknown>);
+}
+export type EmailDocumentContentInput = {
+    html: string;
+    text: string;
+    previewText: string | null;
+    editorJson: unknown | null;
+    htmlBytes: number;
+    /** True when the save removed scripts, handlers or unsafe links from raw HTML. */
+    sanitized: boolean;
+    removed: {
+        elements: number;
+        handlers: number;
+        urls: number;
+    };
+};
+/**
+ * A readable plain-text part from email HTML, for a revision saved without one.
+ * Links keep their target (`label (https://...)`); merge tags pass through.
+ */
+export declare function emailHtmlToPlainText(html: string): string;
+/**
+ * Validate one revision's content: raw HTML is cleaned of active content,
+ * text is derived when absent, and the 100 KB HTML ceiling is enforced on the
+ * cleaned bytes. Throws EmailDocumentInputError; never truncates.
+ */
+export declare function normalizeEmailDocumentContent(input: {
+    html: unknown;
+    text?: unknown;
+    previewText?: unknown;
+    editorJson?: unknown;
+}): EmailDocumentContentInput;
+export declare function normalizeEmailDocumentName(value: unknown, fallback: string): string;
+export declare function isEmailDocumentRole(value: unknown): value is EmailDocumentRole;
+export declare function isEmailDocumentKind(value: unknown): value is EmailDocumentKind;

package/node_modules/@oxygen/shared/dist/email-documents.js

@@ -0,0 +1,143 @@
+/**
+ * Email documents: the designed body of a newsletter step (or a reusable
+ * template), stored once with append-only revisions (tenant migration 0555)
+ * and referenced by a step as `body_document {id, revision}`. This leaf holds
+ * the shared vocabulary every surface validates against; storage lives in
+ * `@oxygen/tenant-db/email-documents`. Browser-safe: no Node imports.
+ */
+import { sanitizeEmailHtml } from "./email-html-sanitize.js";
+/** Gmail clips a message above ~102 KB; the server refuses a revision above this. */
+export const EMAIL_DOCUMENT_MAX_HTML_BYTES = 102_400;
+/** The editor's size meter warns from here. */
+export const EMAIL_DOCUMENT_WARN_HTML_BYTES = 81_920;
+export const EMAIL_DOCUMENT_MAX_TEXT_CHARS = 102_400;
+export const EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS = 500;
+export const EMAIL_DOCUMENT_MAX_NAME_CHARS = 200;
+/** The editor's JSON tree; generous, but bounded so a revision row stays small. */
+export const EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES = 512_000;
+export const EMAIL_DOCUMENT_ROLES = ["step", "template"];
+export const EMAIL_DOCUMENT_KINDS = ["visual", "html"];
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isEmailDocumentId(value) {
+    return typeof value === "string" && UUID_RE.test(value);
+}
+/** UTF-8 byte length, the unit Gmail clips on. */
+export function emailHtmlByteLength(html) {
+    return new TextEncoder().encode(html).length;
+}
+/** A refused document input: a fixed sentence naming the field (ADR 0023 validation copy). */
+export class EmailDocumentInputError extends Error {
+    code;
+    field;
+    details;
+    constructor(code, field, message, details = {}) {
+        super(message);
+        this.name = "EmailDocumentInputError";
+        this.code = code;
+        this.field = field;
+        this.details = details;
+    }
+}
+const ENTITIES = { amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'", nbsp: " ", "#39": "'" };
+/**
+ * A readable plain-text part from email HTML, for a revision saved without one.
+ * Links keep their target (`label (https://...)`); merge tags pass through.
+ */
+export function emailHtmlToPlainText(html) {
+    const withoutHidden = html
+        .replace(/<(head|style|script|title)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, "")
+        .replace(/<!--[\s\S]*?-->/g, "");
+    const withLinks = withoutHidden.replace(/<a\b[^>]*?\shref\s*=\s*("([^"]*)"|'([^']*)')[^>]*>([\s\S]*?)<\/a\s*>/gi, (_whole, _raw, dq, sq, label) => {
+        const href = (dq ?? sq ?? "").trim();
+        const text = label.replace(/<[^>]+>/g, "").trim();
+        if (!href || href === "#" || href.startsWith("mailto:") && text.includes(href.slice(7)))
+            return text;
+        return text && text !== href ? `${text} (${href})` : href;
+    });
+    const text = withLinks
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<\/(p|div|h[1-6]|li|tr|table|blockquote|section|article|header|footer)\s*>/gi, "\n\n")
+        .replace(/<li\b[^>]*>/gi, "- ")
+        .replace(/<[^>]+>/g, "")
+        .replace(/&(#\d+|#x[0-9a-f]+|[a-z]+);/gi, (entity, name) => {
+        const lower = name.toLowerCase();
+        if (lower.startsWith("#x"))
+            return String.fromCharCode(Number.parseInt(lower.slice(2), 16));
+        if (lower.startsWith("#") && lower !== "#39")
+            return String.fromCharCode(Number.parseInt(lower.slice(1), 10));
+        return ENTITIES[lower] ?? entity;
+    });
+    return text
+        .split("\n")
+        .map((line) => line.replace(/[ \t ]+/g, " ").trim())
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+/**
+ * Validate one revision's content: raw HTML is cleaned of active content,
+ * text is derived when absent, and the 100 KB HTML ceiling is enforced on the
+ * cleaned bytes. Throws EmailDocumentInputError; never truncates.
+ */
+export function normalizeEmailDocumentContent(input) {
+    if (typeof input.html !== "string" || !input.html.trim()) {
+        throw new EmailDocumentInputError("invalid_email_document", "html", "html is required and must be a non-empty string.");
+    }
+    const cleaned = sanitizeEmailHtml(input.html);
+    const htmlBytes = emailHtmlByteLength(cleaned.html);
+    if (htmlBytes > EMAIL_DOCUMENT_MAX_HTML_BYTES) {
+        throw new EmailDocumentInputError("email_document_too_large", "html", `The email's HTML is ${htmlBytes} bytes; the limit is ${EMAIL_DOCUMENT_MAX_HTML_BYTES} bytes (Gmail clips larger emails). Remove content or images embedded as data.`, { html_bytes: htmlBytes, max_html_bytes: EMAIL_DOCUMENT_MAX_HTML_BYTES });
+    }
+    let text;
+    if (input.text === undefined || input.text === null || (typeof input.text === "string" && !input.text.trim())) {
+        text = emailHtmlToPlainText(cleaned.html);
+    }
+    else if (typeof input.text !== "string") {
+        throw new EmailDocumentInputError("invalid_email_document", "text", "text must be a string.");
+    }
+    else {
+        text = input.text;
+    }
+    if (text.length > EMAIL_DOCUMENT_MAX_TEXT_CHARS) {
+        throw new EmailDocumentInputError("email_document_too_large", "text", `The plain-text part is longer than ${EMAIL_DOCUMENT_MAX_TEXT_CHARS} characters.`, { max_text_chars: EMAIL_DOCUMENT_MAX_TEXT_CHARS });
+    }
+    let previewText = null;
+    if (input.previewText !== undefined && input.previewText !== null) {
+        if (typeof input.previewText !== "string") {
+            throw new EmailDocumentInputError("invalid_email_document", "preview_text", "preview_text must be a string.");
+        }
+        if (input.previewText.length > EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS) {
+            throw new EmailDocumentInputError("invalid_email_document", "preview_text", `preview_text must be at most ${EMAIL_DOCUMENT_MAX_PREVIEW_TEXT_CHARS} characters.`);
+        }
+        previewText = input.previewText.trim() ? input.previewText : null;
+    }
+    let editorJson = null;
+    if (input.editorJson !== undefined && input.editorJson !== null) {
+        if (typeof input.editorJson !== "object") {
+            throw new EmailDocumentInputError("invalid_email_document", "editor_json", "editor_json must be a JSON object.");
+        }
+        if (emailHtmlByteLength(JSON.stringify(input.editorJson)) > EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES) {
+            throw new EmailDocumentInputError("email_document_too_large", "editor_json", `editor_json is larger than ${EMAIL_DOCUMENT_MAX_EDITOR_JSON_BYTES} bytes.`);
+        }
+        editorJson = input.editorJson;
+    }
+    return { html: cleaned.html, text, previewText, editorJson, htmlBytes, sanitized: cleaned.sanitized, removed: cleaned.removed };
+}
+export function normalizeEmailDocumentName(value, fallback) {
+    if (value === undefined || value === null)
+        return fallback;
+    if (typeof value !== "string" || !value.trim()) {
+        throw new EmailDocumentInputError("invalid_email_document", "name", "name must be a non-empty string.");
+    }
+    const name = value.trim();
+    if (name.length > EMAIL_DOCUMENT_MAX_NAME_CHARS) {
+        throw new EmailDocumentInputError("invalid_email_document", "name", `name must be at most ${EMAIL_DOCUMENT_MAX_NAME_CHARS} characters.`);
+    }
+    return name;
+}
+export function isEmailDocumentRole(value) {
+    return typeof value === "string" && EMAIL_DOCUMENT_ROLES.includes(value);
+}
+export function isEmailDocumentKind(value) {
+    return typeof value === "string" && EMAIL_DOCUMENT_KINDS.includes(value);
+}

package/node_modules/@oxygen/shared/dist/email-dsn.js

@@ -145,9 +145,21 @@ const REPUTATION_BLOCK = /\b5\.7\.\d{1,3}\b/;
 const MAILBOX_FULL_CODE = /\b[45]\.2\.2\b/;
 // 5.1.0 is a generic address-status failure, not proof the recipient is invalid.
 const NO_SUCH_USER_CODE = /\b5\.1\.(?:[123]|10)\b/;
+// Exchange Online: "550 5.4.310 DNS domain <d> does not exist [Message=InfoDomainNonexistent]".
+const NO_SUCH_DOMAIN_CODE = /^5\.4\.310$/;
+// Generic or routing statuses whose own prose may still prove an invalid destination.
+const GENERIC_ADDRESS_CODE = /^5\.(?:0\.\d{1,3}|1\.0)$/;
+const ROUTING_CODE = /^5\.4\.\d{1,3}$/;
 const TRANSIENT_CODE = /(\b4\.\d{1,3}\.\d{1,3}\b|\b4\d{2}\b)/;
-const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|over quota|quota exceeded|insufficient storage)/i;
-const NO_SUCH_USER_TEXT = /((?:address|account|recipient|user|mailbox|domain)[^\n.]{0,100}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|nosuchuser|no such (?:user|recipient|mailbox)|(?:user|recipient) unknown|unknown (?:user|recipient)|(?:recipient |email )?address not found|recipient (?:address )?not found|invalid (?:recipient|email address)|no (?:valid )?MX(?: (?:record|records))?\b|\bNXDOMAIN\b)/i;
+const MAILBOX_FULL_TEXT = /(mailbox (?:is )?full|mailbox for user is full|over quota|quota exceeded|insufficient storage)/i;
+// A domain contains dots, so the gap may cross "." but not a sentence end.
+const NAMED_GAP = String.raw `(?:[^\n.]|\.(?=\S)){0,100}`;
+const INVALID_RECIPIENT_TEXT = new RegExp(String.raw `((?:address|account|recipient|user|mailbox)${NAMED_GAP}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|nosuchuser|no such (?:user|recipient|mailbox)|(?:user|recipient) unknown|unknown (?:user|recipient)|(?:recipient |email )?address not found|recipient (?:address )?not found|RecipientNotFound|RecipNotFound|mailbox not found|no mailbox (?:here )?by that name|invalid (?:recipient|mailbox|email address)|unrouteable address)`, "i");
+const INVALID_DOMAIN_TEXT = new RegExp(String.raw `(domain${NAMED_GAP}(?:does ?n[o']?t exist|could(?: not|n['’]t) be found)|domain name not found|host or domain name not found|InfoDomainNonexistent|no (?:valid )?MX(?: (?:record|records))?\b|\bNXDOMAIN\b)`, "i");
+const NO_SUCH_USER_TEXT = new RegExp(`${INVALID_RECIPIENT_TEXT.source}|${INVALID_DOMAIN_TEXT.source}`, "i");
+// Exchange/Outlook headline: "<local> wasn't found at <domain>." It is the
+// receiving directory's verdict only when it names the report's own recipient.
+const EXCHANGE_RECIPIENT_NOT_FOUND = /(?:^|[\s>])([^\s@<>"'()]+)\s+wasn['’]t found at\s+([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
 const PROVIDER_REJECTED_TEXT = /(message rejected|has been blocked|\bblocked\b|\bbanned\b|\bspam\b|local policy violation|unsolicited|reputation)/i;
 const TRANSIENT_TEXT = /(temporar|will retry|try again later|rate ?limit|throttl)/i;
 // Greedy address capture: the character class already stops at whitespace and
@@ -178,24 +190,53 @@ function readProvider(from, haystack) {
         return "microsoft";
     return "unknown";
 }
-function readKind(subject, haystack, hasBody, enhancedCode) {
+function namesExchangeRecipientNotFound(haystack, recipient) {
+    if (!recipient)
+        return false;
+    for (const match of haystack.matchAll(EXCHANGE_RECIPIENT_NOT_FOUND)) {
+        if (`${match[1]}@${match[2]}`.toLowerCase() === recipient)
+            return true;
+    }
+    return false;
+}
+function readKind(subject, haystack, hasBody, enhancedCode, recipient) {
     // Order is load-bearing. A Google "(Delay)" report can quote block-sounding
     // prose while the message is still queued, so the transient marker wins first;
     // an explicit enhanced code then beats keyword matching, because "blocked" and
     // "spam" appear in boilerplate that a 5.1.1 no-such-user report also carries.
     if (/\(delay\)/i.test(subject))
         return "delayed";
+    const exchangeNotFound = namesExchangeRecipientNotFound(haystack, recipient);
     if (enhancedCode) {
+        // Spam, policy and quota statuses stay stop-only whatever the prose says.
         if (REPUTATION_BLOCK.test(enhancedCode))
             return "provider_rejected";
         if (MAILBOX_FULL_CODE.test(enhancedCode))
             return "mailbox_full";
-        if (NO_SUCH_USER_CODE.test(enhancedCode))
-            return "no_such_user";
+        if (NO_SUCH_USER_CODE.test(enhancedCode)) {
+            // Postfix address verification wraps a full mailbox as "550 5.1.1
+            // undeliverable address: ... said: 552 5.2.2 Quota exceeded".
+            return MAILBOX_FULL_CODE.test(haystack) || MAILBOX_FULL_TEXT.test(haystack) ? "mailbox_full" : "no_such_user";
+        }
         if (enhancedCode.startsWith("4."))
             return "delayed";
-        // An explicit generic/routing failure is not address-nonexistence evidence,
-        // even when the surrounding help text suggests checking the address.
+        if (NO_SUCH_DOMAIN_CODE.test(enhancedCode))
+            return "no_such_user";
+        // SignalFisher, 2026-10-22: Exchange's "554 5.4.14 Hop count exceeded" for
+        // malpertuis@intracen.org carried "malpertuis wasn't found at intracen.org";
+        // the receiving directory does not know the address. A routing status needs
+        // that recipient-bound headline or nonexistent-domain prose, never help text.
+        if (ROUTING_CODE.test(enhancedCode) && (exchangeNotFound || INVALID_DOMAIN_TEXT.test(haystack)))
+            return "no_such_user";
+        if (GENERIC_ADDRESS_CODE.test(enhancedCode)) {
+            // Only the diagnostic line itself counts ("550 5.0.0 <x>: User unknown");
+            // Outlook's "Recipient Unknown" heading is a template, not a verdict.
+            const diagnostic = haystack.split("\n").filter(line => line.includes(enhancedCode)).join("\n");
+            if (!PROVIDER_REJECTED_TEXT.test(diagnostic) && (exchangeNotFound || NO_SUCH_USER_TEXT.test(diagnostic)))
+                return "no_such_user";
+        }
+        // Any other explicit failure is not address-nonexistence evidence, even
+        // when the surrounding help text suggests checking the address.
         return "other";
     }
     if (MAILBOX_FULL_TEXT.test(haystack))
@@ -204,7 +245,7 @@ function readKind(subject, haystack, hasBody, enhancedCode) {
         return "provider_rejected";
     if (ENHANCED_CODE.test(haystack))
         return "other";
-    if (NO_SUCH_USER_TEXT.test(haystack))
+    if (exchangeNotFound || NO_SUCH_USER_TEXT.test(haystack))
         return "no_such_user";
     if (TRANSIENT_CODE.test(haystack) || TRANSIENT_TEXT.test(haystack))
         return "delayed";
@@ -228,10 +269,11 @@ export function classifyDeliveryStatusNotification(input) {
     const haystack = `${subject}\n${body}`;
     const enhancedCode = readEnhancedStatusCode(haystack);
     const smtpCode = enhancedCode ?? (ENHANCED_CODE.test(haystack) ? null : SMTP_REPLY_CODE.exec(haystack)?.[1] ?? null);
+    const recipient = readRecipient(haystack);
     return {
-        kind: readKind(subject, haystack, body.trim().length > 0, enhancedCode),
+        kind: readKind(subject, haystack, body.trim().length > 0, enhancedCode, recipient),
         provider: readProvider(from, haystack),
-        recipient: readRecipient(haystack),
+        recipient,
         smtpCode,
     };
 }

package/node_modules/@oxygen/shared/dist/email-html-sanitize.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Clean raw HTML a customer saves as an email document. Email clients never run
+ * scripts, but the same HTML is previewed in the web app and forwarded by
+ * recipients, so active content is removed on save rather than trusted to every
+ * reader: `<script>` (and other embedding elements), inline `on*` event
+ * handlers, and `javascript:` / `vbscript:` / `data:text/html` URLs in link and
+ * source attributes. Styles, tables, images and merge tags are kept as written.
+ *
+ * Browser-safe and dependency-free. This is a save-time cleanup, not the
+ * preview boundary: the web preview still renders inside a sandboxed iframe.
+ */
+export type EmailHtmlSanitizeResult = {
+    html: string;
+    /** What was removed, for the save response (`sanitized` is true when anything was). */
+    removed: {
+        elements: number;
+        handlers: number;
+        urls: number;
+    };
+    sanitized: boolean;
+};
+export declare function isUnsafeEmailUrl(value: string): boolean;
+export declare function sanitizeEmailHtml(input: string): EmailHtmlSanitizeResult;