@oxygen-agent/cli 1.1014.777 → 1.1014.913

package/node_modules/@oxygen/shared/dist/guided-activation.d.ts

@@ -0,0 +1,155 @@
+export declare const GUIDED_ACTIVATION_PURPOSES: readonly ["lead_scan", "morning_briefing"];
+export type GuidedActivationPurpose = typeof GUIDED_ACTIVATION_PURPOSES[number];
+export type GuidedActivationRoutine = {
+    activation_id: string;
+    purpose: GuidedActivationPurpose;
+    scan_policy?: GuidedActivationScanPolicy;
+};
+export declare const GUIDED_ACTIVATION_POINTERS: readonly ["knowledge", "first_leads_table", "sequence", "sender", "oxygent", "direct_chat", "scan_routine", "briefing_routine"];
+export type GuidedActivationPointer = typeof GUIDED_ACTIVATION_POINTERS[number];
+export type GuidedActivationResources = Partial<Record<GuidedActivationPointer, string>>;
+export declare const GUIDED_ACTIVATION_REVISIONS: readonly ["configuration", "sequence", "audience", "recipients", "sender", "copy", "knowledge", "schedule", "authority"];
+export type GuidedActivationRevisions = Record<typeof GUIDED_ACTIVATION_REVISIONS[number], string>;
+export type GuidedActivationBounds = {
+    recipients: number;
+    actions: number;
+    inference_credits: number;
+    provider_credits: number;
+};
+export type GuidedActivationReview = {
+    id: string;
+    purpose: "launch" | GuidedActivationPurpose;
+    activation_revision: number;
+    revisions: GuidedActivationRevisions;
+    bounds: GuidedActivationBounds;
+    input_digest: string;
+    expires_at: string;
+    actor_id: string;
+    authority: {
+        kind: "explicit" | "auto_approve";
+        revision: string;
+    };
+};
+export type GuidedActivation = {
+    id: string;
+    organization_id: string;
+    creator_id: string;
+    revision: number;
+    operating_path: "own_agent" | "oxygent";
+    resources: GuidedActivationResources;
+    outcomes: Partial<Record<"first_leads" | "sequence" | "launch" | GuidedActivationPurpose, "proposed" | "armed" | "launched" | "confirmed_sent" | "paused">>;
+    reviews: Partial<Record<GuidedActivationReview["purpose"], GuidedActivationReview>>;
+    onboarding_start: {
+        state: "claimed" | "posted";
+        chat_id: string;
+        turn_id?: string;
+        event_seq?: number;
+    } | null;
+    last_fault: {
+        code: string;
+        at: string;
+    } | null;
+};
+/** Unknown tiers and production-shaped data are always denied, independent of NODE_ENV. */
+export declare function guidedActivationEnabled(env?: Record<string, string | undefined>): boolean;
+export declare function guidedActivationWorkspaceAllowed(organizationId: string, env?: Record<string, string | undefined>): boolean;
+export declare function guidedActivationAvailableTo(env: Record<string, string | undefined>, viewer: {
+    organizationId: string;
+    email: string | null | undefined;
+    member: boolean;
+    oxygenRole?: string | null;
+}): boolean;
+export declare function assertGuidedActivationBounds(bounds: GuidedActivationBounds, purpose: GuidedActivationReview["purpose"]): void;
+/** Identity survives replacement sessions/config edits and the DST repeated hour. */
+export declare function guidedActivationOccurrenceKey(input: {
+    activationId: string;
+    creatorId: string;
+    purpose: GuidedActivationPurpose;
+    localDate: string;
+}): string;
+/** Narrow reviewed source policy. Provider adapters must refuse unsupported incremental modes. */
+export type GuidedActivationScanPolicy = {
+    version: 1;
+    table_id: string;
+    chat_id: string;
+    policy_digest: string;
+    revisions: GuidedActivationRevisions;
+    sources: Array<{
+        source_id: string;
+        config_digest: string;
+        incremental_mode: "cursor" | "watermark";
+        person_key_field: string;
+    }>;
+    exclude_dnc: true;
+    exclude_contacted: true;
+    review_only: true;
+    max_examined: number;
+    max_new_leads: number;
+    max_provider_pages: number;
+    max_provider_credits: number;
+    max_inference_credits: number;
+};
+export type GuidedActivationScanSnapshot = {
+    version: 1;
+    activation_id: string;
+    creator_id: string;
+    occurrence_id: string;
+    run_id: string;
+    routine_id: string;
+    period: {
+        local_date: string;
+        timezone: string;
+        started_at: string;
+        settled_at: string | null;
+    };
+    policy_digest: string;
+    table_id: string;
+    status: "running" | "completed" | "partial" | "failed" | "effect_unknown" | "budget_exhausted";
+    reason: string | null;
+    counts: {
+        examined: number;
+        new: number;
+        deduped: number;
+        qualified: number;
+        excluded: number;
+    };
+    candidate_ids: string[];
+    sources: Array<{
+        source_id: string;
+        config_digest: string;
+        ingestion_run_ids: string[];
+        cursor_before: string | null;
+        cursor_after: string | null;
+        status: string;
+    }>;
+    credits: {
+        captured: number;
+        held: number;
+    };
+};
+/** C's existing native launch_review is the only launch producer. Its digest binds all material inputs server-side. */
+export type GuidedActivationLaunchReview = {
+    digest: string;
+    expires_at: string;
+    max_live_sends: number;
+    max_credits: number;
+};
+export type GuidedActivationSequenceMarker = {
+    activation_id: string;
+    creator_id: string;
+};
+export type GuidedActivationManualRunPreview = {
+    id: string;
+    kind: "run_now";
+    activation_id: string;
+    purpose: GuidedActivationPurpose;
+    actor_id: string;
+    session_id: string;
+    session_revision: number;
+    config_digest: string;
+    per_run_credits: number;
+    expires_at: string;
+    preview_token: string;
+    approved_at?: string;
+    applied_run_id?: string;
+};

package/node_modules/@oxygen/shared/dist/guided-activation.fixture.d.ts

@@ -0,0 +1,15 @@
+import type { GuidedActivationRevisions, GuidedActivationScanSnapshot } from "./guided-activation.js";
+/** Deterministic non-provider fixtures for A–G; no connection/outreach authority. */
+export declare const GUIDED_ACTIVATION_FIXTURE: {
+    readonly organizationId: "10000000-0000-4000-8000-000000000001";
+    readonly actorId: "10000000-0000-4000-8000-000000000002";
+    readonly activationId: "10000000-0000-4000-8000-000000000003";
+    readonly tableId: "10000000-0000-4000-8000-000000000004";
+    readonly chatId: "10000000-0000-4000-8000-000000000005";
+    readonly routineId: "10000000-0000-4000-8000-000000000006";
+    readonly runId: "10000000-0000-4000-8000-000000000007";
+    readonly now: "2026-10-25T00:30:00.000Z";
+    readonly timezone: "Europe/Berlin";
+};
+export declare const GUIDED_ACTIVATION_REVISION_FIXTURE: GuidedActivationRevisions;
+export declare const GUIDED_ACTIVATION_SCAN_FIXTURE: GuidedActivationScanSnapshot;

package/node_modules/@oxygen/shared/dist/guided-activation.fixture.js

@@ -0,0 +1,21 @@
+/** Deterministic non-provider fixtures for A–G; no connection/outreach authority. */
+export const GUIDED_ACTIVATION_FIXTURE = {
+    organizationId: "10000000-0000-4000-8000-000000000001", actorId: "10000000-0000-4000-8000-000000000002",
+    activationId: "10000000-0000-4000-8000-000000000003", tableId: "10000000-0000-4000-8000-000000000004",
+    chatId: "10000000-0000-4000-8000-000000000005", routineId: "10000000-0000-4000-8000-000000000006",
+    runId: "10000000-0000-4000-8000-000000000007", now: "2026-10-25T00:30:00.000Z", timezone: "Europe/Berlin",
+};
+export const GUIDED_ACTIVATION_REVISION_FIXTURE = {
+    configuration: "config-1", sequence: "sequence-1", audience: "audience-1", recipients: "recipients-1", sender: "sender-1",
+    copy: "copy-1", knowledge: "knowledge-1", schedule: "schedule-1", authority: "authority-1",
+};
+export const GUIDED_ACTIVATION_SCAN_FIXTURE = {
+    version: 1, activation_id: GUIDED_ACTIVATION_FIXTURE.activationId, creator_id: GUIDED_ACTIVATION_FIXTURE.actorId,
+    occurrence_id: JSON.stringify([GUIDED_ACTIVATION_FIXTURE.activationId, GUIDED_ACTIVATION_FIXTURE.actorId, "lead_scan", "2026-10-25"]),
+    run_id: GUIDED_ACTIVATION_FIXTURE.runId, routine_id: GUIDED_ACTIVATION_FIXTURE.routineId,
+    period: { local_date: "2026-10-25", timezone: "Europe/Berlin", started_at: "2026-10-25T00:00:00.000Z", settled_at: "2026-10-25T00:05:00.000Z" },
+    policy_digest: "fixture-policy-1", table_id: GUIDED_ACTIVATION_FIXTURE.tableId, status: "completed", reason: null,
+    counts: { examined: 10, new: 3, deduped: 2, qualified: 3, excluded: 5 }, candidate_ids: ["lead-1", "lead-2", "lead-3"],
+    sources: [{ source_id: "fixture-incremental-source", config_digest: "fixture-source-1", ingestion_run_ids: [], cursor_before: "page-1", cursor_after: "page-2", status: "completed" }],
+    credits: { captured: 0, held: 0 },
+};

package/node_modules/@oxygen/shared/dist/guided-activation.js

@@ -0,0 +1,38 @@
+import { OxygenError } from "./cli-result.js";
+import { isProductionData } from "./deploy-env.js";
+export const GUIDED_ACTIVATION_PURPOSES = ["lead_scan", "morning_briefing"];
+export const GUIDED_ACTIVATION_POINTERS = ["knowledge", "first_leads_table", "sequence", "sender", "oxygent", "direct_chat", "scan_routine", "briefing_routine"];
+export const GUIDED_ACTIVATION_REVISIONS = ["configuration", "sequence", "audience", "recipients", "sender", "copy", "knowledge", "schedule", "authority"];
+/** Unknown tiers and production-shaped data are always denied, independent of NODE_ENV. */
+export function guidedActivationEnabled(env = process.env) {
+    return env.OXYGEN_DEPLOY_ENV === "selfhost-dev" && !isProductionData(env)
+        && env.OXYGEN_GUIDED_ACTIVATION_ENABLED === "staff";
+}
+export function guidedActivationWorkspaceAllowed(organizationId, env = process.env) {
+    // Philipp, 2026-10-15: every genuine DEV workspace, including future IDs.
+    // The old WORKSPACE_IDS inventory no longer grants or restricts admission.
+    return guidedActivationEnabled(env) && organizationId.trim().length > 0;
+}
+export function guidedActivationAvailableTo(env, viewer) {
+    return guidedActivationWorkspaceAllowed(viewer.organizationId, env) && viewer.member
+        && viewer.oxygenRole !== "client";
+}
+export function assertGuidedActivationBounds(bounds, purpose) {
+    if (!bounds || Object.values(bounds).length !== 4 || ![bounds.recipients, bounds.actions].every(value => Number.isSafeInteger(value) && value >= 0)
+        || ![bounds.inference_credits, bounds.provider_credits].every(value => Number.isFinite(value) && value >= 0)
+        || (purpose === "launch" && (bounds.actions <= 0 || bounds.recipients <= 0))
+        || (purpose === "lead_scan" && (bounds.recipients <= 0 || bounds.actions !== 0))
+        || (purpose === "morning_briefing" && (bounds.recipients !== 0 || bounds.actions !== 0 || bounds.provider_credits !== 0))) {
+        throw new OxygenError("activation_invalid_bounds", "Set exact action, recipient and credit ceilings for this operation.", { exitCode: 2 });
+    }
+}
+/** Identity survives replacement sessions/config edits and the DST repeated hour. */
+export function guidedActivationOccurrenceKey(input) {
+    const { activationId, creatorId, purpose, localDate } = input;
+    const date = new Date(`${localDate}T00:00:00Z`);
+    if (!activationId || !creatorId || !GUIDED_ACTIVATION_PURPOSES.includes(purpose)
+        || !/^\d{4}-\d{2}-\d{2}$/.test(localDate) || !Number.isFinite(date.getTime()) || date.toISOString().slice(0, 10) !== localDate) {
+        throw new OxygenError("invalid_request", "A routine occurrence needs its activation, creator, purpose and local date.");
+    }
+    return JSON.stringify([activationId, creatorId, purpose, localDate]);
+}

package/node_modules/@oxygen/shared/dist/linkedin-connection-identity.d.ts

@@ -0,0 +1,9 @@
+/** Aliases must come from the same provider person; never translate ACw to ACo. */
+export type LinkedInConnectionIdentity = {
+    providerId: string;
+    profileUrl?: string | null | undefined;
+    publicIdentifier?: string | null | undefined;
+};
+export declare function linkedinConnectionKeys(identity: LinkedInConnectionIdentity): string[];
+/** Return the original waiting IDs so frozen enrollment identity guards remain authoritative. */
+export declare function connectedLinkedInLeadIds(targets: LinkedInConnectionIdentity[], connections: LinkedInConnectionIdentity[]): string[];

package/node_modules/@oxygen/shared/dist/linkedin-connection-identity.js

@@ -0,0 +1,41 @@
+import { normalizeLinkedinProfileUrl, isLinkedinMemberIdHandle } from "./linkedin-url.js";
+export function linkedinConnectionKeys(identity) {
+    const id = identity.providerId.trim();
+    const keys = id ? [`id:${id.replace(/^urn:li:(?:fs_miniProfile|fsd_profile|member):/, "")}`] : [];
+    const publicIdentifier = identity.publicIdentifier?.trim();
+    const publicUrl = publicIdentifier && !/[\s/?#]/.test(publicIdentifier)
+        ? `https://www.linkedin.com/in/${publicIdentifier}` : null;
+    for (const value of [identity.profileUrl, publicUrl, identity.providerId]) {
+        if (!value)
+            continue;
+        let path;
+        try {
+            path = new URL(value.startsWith("http") ? value : `https://${value}`).pathname;
+        }
+        catch {
+            continue;
+        }
+        if (!/^\/(?:in|pub)\/[^/]+\/*$/i.test(path))
+            continue;
+        const profile = normalizeLinkedinProfileUrl(value);
+        if (profile && !/[\s/?#]/.test(profile.dispatchHandle) && !isLinkedinMemberIdHandle(profile.dispatchHandle))
+            keys.push(`profile:${profile.handle}`);
+    }
+    return [...new Set(keys)];
+}
+/** Return the original waiting IDs so frozen enrollment identity guards remain authoritative. */
+export function connectedLinkedInLeadIds(targets, connections) {
+    const owners = new Map();
+    for (const connection of connections) {
+        for (const key of linkedinConnectionKeys(connection)) {
+            const ids = owners.get(key) ?? new Set();
+            ids.add(connection.providerId.trim().replace(/^urn:li:(?:fs_miniProfile|fsd_profile|member):/, ""));
+            owners.set(key, ids);
+        }
+    }
+    return targets.filter(target => linkedinConnectionKeys(target).some(key => {
+        const ids = owners.get(key);
+        // Conflicting aliases are not proof of one member. Exact IDs remain usable.
+        return ids?.size === 1;
+    })).map(target => target.providerId);
+}

package/node_modules/@oxygen/shared/dist/managed-email-branding.js

@@ -1,6 +1,8 @@
 export const OXYGEN_WARMUP_PROVIDER = "oxygen_warmup";
 export const OXYGEN_PLACEMENT_PROVIDER = "oxygen_placement";
 export function managedEmailProviderInput(value, product) {
+    if (product === "placement" && typeof value === "string" && value.trim().toLowerCase() === "oxygen_deliverability")
+        return "emailguard";
     const publicId = product === "warmup" ? OXYGEN_WARMUP_PROVIDER : OXYGEN_PLACEMENT_PROVIDER;
     return typeof value === "string" && value.trim().toLowerCase() === publicId ? "sendkit" : value;
 }
@@ -12,7 +14,7 @@ export function isManagedPlacementProvider(value) {
 }
 // These are service-owned fields, never arbitrary customer content or opaque receipts.
 const IDENTIFIER_FIELDS = new Set([
-    "provider", "active_provider", "warmup_provider", "warmupProvider", "warmupRail",
+    "provider", "health_provider", "healthProvider", "active_provider", "warmup_provider", "warmupProvider", "warmupRail",
     "action", "code", "failure_code", "error_code", "credential_source", "credentialSource",
     "method", "handoff", "reason_code", "kind", "type", "source",
 ]);
@@ -20,14 +22,14 @@ const COPY_FIELDS = new Set([
     "message", "note", "reason", "description", "hint", "transport_hint", "next_step",
     "next_action", "nextAction", "label", "title", "instruction", "instructions", "warnings",
     "recommendation", "recommendations", "limitations", "next_external_write", "price_note",
-    "error", "errors", "summary", "blocker", "blockers", "detail", "details_text", "provider_label",
+    "pricing_basis", "billing", "capability", "error", "errors", "summary", "blocker", "blockers", "detail", "details_text", "provider_label", "command", "next_command", "next_commands", "needs",
 ]);
 export function managedEmailMessage(value, product = "warmup") {
     const label = product === "warmup" ? "OXYGEN Warm-up" : "OXYGEN placement evaluation";
     if (product === "placement") {
         value = value.replace(/(?:SendKit|OXYGEN placement evaluation) does not document whether inbox, spam, and missing summary values are counts or percentages; Oxygen preserves the values without conversion\./gi, "Summary units are unverified (counts or percentages); values are shown as recorded, without conversion.");
     }
-    return value.replace(/SendKit(?:'s)?\s+warm-?up/gi, label).replace(/SendKit/gi, label);
+    return value.replace(/\bEMAILGUARD_[A-Z0-9_]+\b/g, "managed deliverability configuration").replace(/EmailGuard/gi, "OXYGEN deliverability").replace(/SendKit(?:'s)?\s+warm-?up/gi, label).replace(/SendKit/gi, label);
 }
 /**
  * Project only service identifiers and copy. Preserve URLs, ids, hashes, dates,
@@ -45,9 +47,11 @@ export function publicManagedEmail(value, product = "warmup") {
                 return entry.replace(/^warmup:sendkit:/, "warmup:oxygen_warmup:");
             }
             if (IDENTIFIER_FIELDS.has(field)) {
+                if (entry.toLowerCase() === "emailguard")
+                    return "oxygen_deliverability";
                 if (entry.toLowerCase() === "sendkit")
                     return publicId;
-                return entry.replace(/sendkit_/gi, `${publicId}_`).replace(/_sendkit/gi, `_${publicId}`);
+                return entry.replace(/emailguard/gi, "deliverability").replace(/sendkit_/gi, `${publicId}_`).replace(/_sendkit/gi, `_${publicId}`);
             }
             return COPY_FIELDS.has(field) ? managedEmailMessage(entry, context) : entry;
         }
@@ -62,7 +66,7 @@ export function publicManagedEmail(value, product = "warmup") {
         const privateUsage = (record.provider === "sendkit" || groupKey?.provider === "sendkit") &&
             (record.type === "byok_usage" || (typeof record.byok_usage_events === "number" && record.byok_usage_events > 0));
         return Object.fromEntries(Object.entries(record).map(([key, item]) => [
-            { sendkit_google: "oxygen_warmup_google", sendkit_microsoft: "oxygen_warmup_microsoft", sendkit_binding: "oxygen_placement_binding", sendkitBinding: "oxygen_placement_binding" }[key] ?? key,
+            { sendkit_google: "oxygen_warmup_google", sendkit_microsoft: "oxygen_warmup_microsoft", sendkit_binding: "oxygen_placement_binding", sendkitBinding: "oxygen_placement_binding" }[key] ?? key.replace(/emailguard/gi, "deliverability"),
             privateUsage && key === "provider" ? "private_integration"
                 : privateUsage && key === "key" ? project({ ...groupKey, provider: "private_integration" }, key, context)
                     : privateUsage && key === "tool_id" ? null

package/node_modules/@oxygen/shared/dist/otlp-log-sink.d.ts

@@ -39,6 +39,7 @@ export type OtlpLogSinkOptions = {
     serviceName: string;
     /** Resource attributes merged after the defaults, so a caller can override them. */
     resource?: Record<string, string | null | undefined> | undefined;
+    /** Positive safe integer; invalid values use the default batch size. */
     batchSize?: number | undefined;
     /** `0` disables the interval timer, for runtimes that flush off a request lifecycle. */
     flushIntervalMs?: number | undefined;

package/node_modules/@oxygen/shared/dist/otlp-log-sink.js

@@ -210,7 +210,9 @@ function toLogRecord(record) {
     };
 }
 export function createOtlpLogSink(options) {
-    const batchSize = options.batchSize && options.batchSize > 0 ? options.batchSize : DEFAULT_BATCH_SIZE;
+    const requestedBatchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+    const batchSize = Number.isSafeInteger(requestedBatchSize) && requestedBatchSize > 0
+        ? requestedBatchSize : DEFAULT_BATCH_SIZE;
     const maxQueue = options.maxQueue && options.maxQueue > 0 ? options.maxQueue : DEFAULT_MAX_QUEUE;
     const flushIntervalMs = options.flushIntervalMs === undefined
         ? DEFAULT_FLUSH_INTERVAL_MS
@@ -332,64 +334,66 @@ export function createOtlpLogSink(options) {
                 : {}),
         })));
     };
-    const flush = async () => {
-        if (inFlight)
-            return inFlight;
-        if (queue.length === 0)
-            return undefined;
-        const batch = queue.splice(0, batchSize);
+    const postBatch = async (batch) => {
         const payload = JSON.stringify({
-            resourceLogs: [
-                {
+            resourceLogs: [{
                     resource: { attributes: resourceAttributes },
-                    scopeLogs: [
-                        {
-                            scope: { name: "oxygen" },
-                            logRecords: batch.map(toLogRecord),
-                        },
-                    ],
-                },
-            ],
+                    scopeLogs: [{ scope: { name: "oxygen" }, logRecords: batch.map(toLogRecord) }],
+                }],
         });
-        const run = (async () => {
-            try {
-                const response = await doFetch(options.endpoint, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json", ...options.headers },
-                    body: payload,
-                    signal: AbortSignal.timeout(EXPORT_TIMEOUT_MS),
-                });
-                if (response.ok) {
-                    try {
-                        const rejected = await rejectedRecords(response, batch.length);
-                        if (rejected)
-                            report(rejected, { status: response.status, error_code: "partial_rejection" });
-                    }
-                    catch {
-                        report(batch.length, { status: response.status, error_code: "invalid_response" });
+        try {
+            const response = await doFetch(options.endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", ...options.headers },
+                body: payload,
+                signal: AbortSignal.timeout(EXPORT_TIMEOUT_MS),
+            });
+            if (response.ok) {
+                try {
+                    const rejected = await rejectedRecords(response, batch.length);
+                    if (rejected) {
+                        report(rejected, { status: response.status, error_code: "partial_rejection" });
+                        return false;
                     }
-                    return;
+                    return true;
+                }
+                catch {
+                    report(batch.length, { status: response.status, error_code: "invalid_response" });
+                    return false;
                 }
-                // Receivers/proxies can echo rejected payloads or credentials. Never
-                // read arbitrary response text into operational diagnostics.
-                await response.body?.cancel().catch(() => undefined);
-                // The batch is gone deliberately: retrying into an unhealthy collector
-                // is how a telemetry path turns an ingest blip into memory pressure.
-                report(batch.length, { status: response.status, error_code: "receiver_rejected" });
-            }
-            catch (error) {
-                report(batch.length, {
-                    error_code: "transport_failed",
-                    error_cause: sanitizedErrorCause(error),
-                });
-            }
-            finally {
-                reportOverflow();
             }
-        })();
-        inFlight = run.finally(() => {
-            inFlight = null;
-        });
+            // Receivers/proxies can echo payloads or credentials. Keep diagnostics fixed.
+            await response.body?.cancel().catch(() => undefined);
+            report(batch.length, { status: response.status, error_code: "receiver_rejected" });
+            return false;
+        }
+        catch (error) {
+            report(batch.length, {
+                error_code: "transport_failed",
+                error_cause: sanitizedErrorCause(error),
+            });
+            return false;
+        }
+        finally {
+            reportOverflow();
+        }
+    };
+    const flush = async () => {
+        if (inFlight)
+            return inFlight;
+        if (queue.length === 0)
+            return undefined;
+        // Keep one POST in flight. Healthy full batches continue immediately so the
+        // timer does not cap production at 500/2s. Failure keeps the existing loss
+        // accounting/backoff; neither a rejected batch nor a partial reply is retried.
+        const drain = async () => {
+            do {
+                const accepted = await postBatch(queue.splice(0, batchSize));
+                if (!accepted || queue.length < batchSize)
+                    return;
+            } while (queue.length > 0);
+        };
+        inFlight = Promise.resolve().then(drain).finally(() => { inFlight = null; });
         return inFlight;
     };
     const timer = flushIntervalMs > 0
@@ -404,7 +408,7 @@ export function createOtlpLogSink(options) {
         if (timer)
             clearInterval(timer);
         // Drain rather than flush once: a shutdown's final lines are usually the
-        // interesting ones, and one flush ships only the oldest `batchSize`.
+        // interesting ones. Flush the final partial batch as well as healthy full batches.
         while (queue.length > 0) {
             await flush();
         }

package/node_modules/@oxygen/shared/dist/placement-history.d.ts

@@ -0,0 +1,3 @@
+/** Bind a continuation to its filter. Tenant/RLS still authorizes the anchor. */
+export declare function placementHistoryCursor(id: string, status?: string | null): string;
+export declare function placementHistoryCursorAnchor(cursor: string, status?: string | null): string | null;

package/node_modules/@oxygen/shared/dist/placement-history.js

@@ -0,0 +1,12 @@
+const PLACEMENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Bind a continuation to its filter. Tenant/RLS still authorizes the anchor. */
+export function placementHistoryCursor(id, status) {
+    if (!PLACEMENT_ID.test(id))
+        throw new Error("Invalid placement-test cursor anchor.");
+    return `placement:v1:${status ?? "all"}:${id}`;
+}
+export function placementHistoryCursorAnchor(cursor, status) {
+    const [kind, version, filter, id, extra] = cursor.split(":");
+    return kind === "placement" && version === "v1" && filter === (status ?? "all")
+        && id !== undefined && PLACEMENT_ID.test(id) && extra === undefined ? id : null;
+}

package/node_modules/@oxygen/shared/dist/placement-report.d.ts

@@ -0,0 +1,7 @@
+/** Shared placement-report policy. No provider calls, sends or billing effects. */
+export declare const PLACEMENT_REPORT_WAIT_MS: number;
+export declare const INCOMPLETE_PLACEMENT_MESSAGE = "This test is incomplete. Available seed results are shown.";
+export declare function placementReportDeadline(provider: string, results: unknown): string | null;
+export declare function placementReportExpired(provider: string, results: unknown, now?: number): boolean;
+/** Customer copy follows the persisted settlement receipt, never an inferred balance. */
+export declare function placementRefundMessage(value: unknown): string;

package/node_modules/@oxygen/shared/dist/placement-report.js

@@ -0,0 +1,34 @@
+/** Shared placement-report policy. No provider calls, sends or billing effects. */
+export const PLACEMENT_REPORT_WAIT_MS = 2 * 60 * 60 * 1000;
+export const INCOMPLETE_PLACEMENT_MESSAGE = "This test is incomplete. Available seed results are shown.";
+export function placementReportDeadline(provider, results) {
+    if (provider !== "emailguard" || !results || typeof results !== "object")
+        return null;
+    const receipt = results.seed_delivery;
+    if (!receipt || typeof receipt !== "object")
+        return null;
+    const send = receipt;
+    if (send.status !== "sent" || typeof send.sent_at !== "string")
+        return null;
+    const sent = Date.parse(send.sent_at);
+    return Number.isFinite(sent) ? new Date(sent + PLACEMENT_REPORT_WAIT_MS).toISOString() : null;
+}
+export function placementReportExpired(provider, results, now = Date.now()) {
+    const deadline = placementReportDeadline(provider, results);
+    return deadline !== null && now >= Date.parse(deadline);
+}
+/** Customer copy follows the persisted settlement receipt, never an inferred balance. */
+export function placementRefundMessage(value) {
+    if (!value || typeof value !== "object")
+        return "";
+    const receipt = value;
+    if (receipt.status === "pending")
+        return "Your test-credit refund is pending.";
+    if (receipt.status === "refunded")
+        return "The test charge was refunded.";
+    if (receipt.status === "allowance_restored")
+        return "The included test allowance has been restored.";
+    if (receipt.status === "not_applicable")
+        return "Own-key tests do not receive an OXYGEN test-credit refund.";
+    return "";
+}

package/node_modules/@oxygen/shared/dist/plan-limits-view.d.ts

@@ -109,6 +109,7 @@ type ChannelLimit = {
 };
 export type PlanLimitsSendingLimits = {
     email_per_mailbox?: ChannelLimit;
+    entra_per_mailbox?: ChannelLimit;
     whatsapp_per_number?: ChannelLimit;
     voice_per_number?: ChannelLimit;
     linkedin_per_account?: {

package/node_modules/@oxygen/shared/dist/plan-limits-view.js

@@ -239,6 +239,7 @@ export function planLimitsSendingRows(sending) {
         return [];
     const maximum = (limit) => limit?.max_per_day === null ? "no maximum" : formatLimitCount(limit?.max_per_day);
     return [
+        ...(sending.entra_per_mailbox ? [{ label: "Entra per mailbox", defaultPerDay: formatLimitCount(sending.entra_per_mailbox.default_per_day), maximumPerDay: maximum(sending.entra_per_mailbox) }] : []),
         { label: "Email per mailbox", defaultPerDay: formatLimitCount(sending.email_per_mailbox?.default_per_day), maximumPerDay: maximum(sending.email_per_mailbox) },
         { label: "WhatsApp per number", defaultPerDay: formatLimitCount(sending.whatsapp_per_number?.default_per_day), maximumPerDay: maximum(sending.whatsapp_per_number) },
         {

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.d.ts

@@ -19,6 +19,7 @@ export declare const WHATSAPP_ACCOUNT_CREDITS_PER_MONTH = 3400;
 export declare const X_ACCOUNT_CREDITS_PER_MONTH = 1000;
 export declare const EGRESS_IP_CREDITS_PER_MONTH = 2500;
 export declare const SENDING_MAILBOX_CREDITS_PER_MONTH = 100;
+export declare const SENDING_ENTRA_MAILBOX_CREDITS_PER_MONTH = 25;
 export declare const MANAGED_INBOX_CREDITS_PER_MONTH = 300;
 export declare const MAILBOX_WARMUP_CREDITS_PER_MONTH = 0;
 export declare const DELIVERABILITY_SEAT_CREDITS_PER_MONTH = 100;

package/node_modules/@oxygen/shared/dist/pricing-snapshot.generated.js

@@ -41,6 +41,7 @@ export const WHATSAPP_ACCOUNT_CREDITS_PER_MONTH = 3_400;
 export const X_ACCOUNT_CREDITS_PER_MONTH = 1_000;
 export const EGRESS_IP_CREDITS_PER_MONTH = 2_500;
 export const SENDING_MAILBOX_CREDITS_PER_MONTH = 100;
+export const SENDING_ENTRA_MAILBOX_CREDITS_PER_MONTH = 25;
 export const MANAGED_INBOX_CREDITS_PER_MONTH = 300;
 export const MAILBOX_WARMUP_CREDITS_PER_MONTH = 0;
 export const DELIVERABILITY_SEAT_CREDITS_PER_MONTH = 100;

package/node_modules/@oxygen/shared/dist/sending-limits.d.ts

@@ -23,6 +23,7 @@ export declare function emailMailboxDailyCapMaximum(_options?: RepricingOptions)
 export declare function emailMailboxDailyCapInForce(input: {
     storedCap: number;
     source: EmailMailboxDailyCapSource | null;
+    metadata?: unknown;
 }, options?: RepricingOptions): number;
 /** A new voice number may dial this many times a day once it has warmed up. */
 export declare const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;

package/node_modules/@oxygen/shared/dist/sending-limits.js

@@ -1,12 +1,4 @@
-// Per-channel sending limits that are the same on every plan (2026-09 repricing,
-// decision L3; specification slice S52). Limits guard, credits meter: none of
-// these is sold, and none charges for sending.
-//
-// Email campaign ramp: 5 / 10 / 20 based on accepted-send days, then the
-// configured cap (25 by default, maximum 50), independent of billing activation.
-// The versioned migration changes old defaults once; later choices are retained.
-//
-// Voice per number: 100 dials a day by default, adjustable up to 300.
+import { mailboxInfrastructureDailyCap } from "./email-infrastructure-policy.js";
 import { EMAIL_DELIVERABILITY_DEFAULTS } from "./email-deliverability-policy.js";
 /**
  * The daily cap a new mailbox gets when nobody names one. New mailboxes were
@@ -35,7 +27,7 @@ export function emailMailboxDailyCapMaximum(_options = {}) {
 export function emailMailboxDailyCapInForce(input, options = {}) {
     const stored = Number.isFinite(input.storedCap) ? Math.max(0, Math.floor(input.storedCap)) : 0;
     const maximum = emailMailboxDailyCapMaximum(options);
-    return maximum === null ? stored : Math.min(stored, maximum);
+    return Math.min(stored, maximum ?? Infinity, mailboxInfrastructureDailyCap(input.metadata) ?? Infinity);
 }
 /** A new voice number may dial this many times a day once it has warmed up. */
 export const VOICE_NUMBER_DEFAULT_DAILY_CAP = 100;

package/node_modules/@oxygen/shared/dist/teammates.js

@@ -1,3 +1,4 @@
+import { guidedActivationEnabled } from "./guided-activation.js";
 import { isStaffEmail } from "./staff.js";
 /**
  * AI teammates (ADR 0032): Agents people talk to, each person in one ongoing
@@ -20,7 +21,7 @@ export function teammatesEnabled(env = process.env) {
     return env.OXYGEN_AGENT_SESSIONS_ENABLED === "staff";
 }
 export function teammatesAvailableTo(env, viewer) {
-    return teammatesEnabled(env) && viewer.member && viewer.oxygenRole !== "client" && isStaffEmail(viewer.email, env);
+    return teammatesEnabled(env) && viewer.member && viewer.oxygenRole !== "client" && (guidedActivationEnabled(env) || isStaffEmail(viewer.email, env));
 }
 /**
  * The Workspace Agent's slug. Every workspace's first Oxygent is that Agent: an