@oxygen-agent/cli 1.177.1 → 1.209.6

package/node_modules/@oxygen/shared/dist/sequences.js

@@ -44,7 +44,32 @@ export const SEQUENCE_SIGNALS = [
     "email_clicked",
     "email_replied",
     "email_bounced",
+    // External GTM signals — recorded onto an enrollment by an Oxygen monitor,
+    // enrichment column, or the published `sequences signal` callable (NOT a
+    // provider webhook). branch / wait_for_signal consume these identically to
+    // engagement signals, so a funding/hiring/job-change event can pause,
+    // re-target, or advance a *running* sequence. The lookup that produced the
+    // signal is the metered+approved step; recording the signal is free internal
+    // state and never itself sends.
+    "company_hiring",
+    "company_raised_funds",
+    "job_change",
+    "new_hire",
+    "web_visit",
+    "intent",
 ];
+/** External GTM signals (the non-engagement subset of SEQUENCE_SIGNALS). */
+export const SEQUENCE_EXTERNAL_SIGNALS = [
+    "company_hiring",
+    "company_raised_funds",
+    "job_change",
+    "new_hire",
+    "web_visit",
+    "intent",
+];
+export function isExternalSequenceSignal(value) {
+    return SEQUENCE_EXTERNAL_SIGNALS.includes(value);
+}
 /**
  * row_values keys an enrollment's email may live under, in send-precedence order.
  * The dispatcher picks the FIRST present key as the recipient address; the
@@ -52,6 +77,8 @@ export const SEQUENCE_SIGNALS = [
  * Single source of truth so the send path and the lookup path can't drift.
  */
 export const SEQUENCE_EMAIL_COLUMN_KEYS = ["email", "email_address", "work_email", "primary_email", "Email"];
+/** Base content + up to this many alternates per A/B step (base counts as variant "a"). */
+export const MAX_STEP_VARIANTS = 5;
 export const SEQUENCE_STEP_KINDS = [
     // linkedin channel (native dispatch)
     "visit_profile",
@@ -216,12 +243,20 @@ raw, index, options, issues) {
         }
         case "message": {
             const template = requiredTemplate(raw.template, `${path}.template`, issues);
-            return { id, channel: "linkedin", kind: "message", template: template ?? "" };
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["template"], issues);
+            return {
+                id, channel: "linkedin", kind: "message", template: template ?? "",
+                ...(variants ? { variants: variants } : {}),
+            };
         }
         case "inmail": {
             const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues);
             const template = requiredTemplate(raw.template, `${path}.template`, issues);
-            return { id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "" };
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "template"], issues);
+            return {
+                id, channel: "linkedin", kind: "inmail", subject_template: subject ?? "", template: template ?? "",
+                ...(variants ? { variants: variants } : {}),
+            };
         }
         case "email_enroll": {
             const subsequenceId = optionalString(raw.subsequence_id, `${path}.subsequence_id`, issues);
@@ -239,11 +274,23 @@ raw, index, options, issues) {
         case "email_send": {
             const subject = requiredTemplate(raw.subject_template, `${path}.subject_template`, issues);
             const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
-            return { id, channel: "email", kind: "email_send", subject_template: subject ?? "", body_template: body ?? "" };
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["subject_template", "body_template"], issues);
+            const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
+            return {
+                id, channel: "email", kind: "email_send", subject_template: subject ?? "", body_template: body ?? "",
+                ...(variants ? { variants: variants } : {}),
+                ...(sendWindow ? { send_window: sendWindow } : {}),
+            };
         }
         case "email_reply": {
             const body = requiredTemplate(raw.body_template, `${path}.body_template`, issues);
-            return { id, channel: "email", kind: "email_reply", body_template: body ?? "" };
+            const variants = normalizeVariants(raw.variants, `${path}.variants`, ["body_template"], issues);
+            const sendWindow = normalizeSendWindow(raw.send_window, `${path}.send_window`, issues);
+            return {
+                id, channel: "email", kind: "email_reply", body_template: body ?? "",
+                ...(variants ? { variants: variants } : {}),
+                ...(sendWindow ? { send_window: sendWindow } : {}),
+            };
         }
         case "email_stop":
             return { id, channel: "email", kind: "email_stop" };
@@ -465,18 +512,12 @@ export function sequenceTemplateVariables(definition) {
     for (const step of definition.steps) {
         if (step.kind === "invite")
             scan(step.note_template);
-        if (step.kind === "message")
-            scan(step.template);
-        if (step.kind === "inmail") {
-            scan(step.subject_template);
-            scan(step.template);
+        // Scan base + every A/B variant's copy so a column referenced only in a
+        // variant still surfaces in the start preview's variable-resolution check.
+        for (const content of sequenceStepVariantContents(step)) {
+            for (const value of Object.values(content))
+                scan(value);
         }
-        if (step.kind === "email_send") {
-            scan(step.subject_template);
-            scan(step.body_template);
-        }
-        if (step.kind === "email_reply")
-            scan(step.body_template);
     }
     return [...vars];
 }
@@ -496,6 +537,238 @@ export function evaluateSequenceCondition(condition, firedSignals) {
         return condition.any.some((c) => evaluateSequenceCondition(c, fired));
     return !evaluateSequenceCondition(condition.not, fired);
 }
+// ===== A/B variants =====
+const VARIANT_ALPHABET = "abcdefghijklmnopqrstuvwxyz";
+/** Variant label for an index: 0 → "a" (the base step), 1 → "b", … */
+export function sequenceVariantLabel(index) {
+    return VARIANT_ALPHABET[index % VARIANT_ALPHABET.length] ?? "a";
+}
+/** Deterministic, replayable FNV-1a hash → uint32. Stable across processes. */
+function hashVariantKey(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i += 1) {
+        hash ^= value.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return hash >>> 0;
+}
+function baseVariantContent(step) {
+    switch (step.kind) {
+        case "email_send": return { subject_template: step.subject_template, body_template: step.body_template };
+        case "email_reply": return { body_template: step.body_template };
+        case "message": return { template: step.template };
+        case "inmail": return { subject_template: step.subject_template, template: step.template };
+        default: return null;
+    }
+}
+/**
+ * The ordered list of fully-resolved content variants for a step: index 0 is the
+ * base step ("a"); each declared alternate is merged OVER the base (so a variant
+ * that sets only `subject_template` keeps the base body). Returns [] for steps
+ * with no copy.
+ */
+export function sequenceStepVariantContents(step) {
+    const base = baseVariantContent(step);
+    if (!base)
+        return [];
+    const variants = step.variants;
+    if (!variants || variants.length === 0)
+        return [base];
+    return [base, ...variants.map((variant) => ({ ...base, ...variant }))];
+}
+/** Number of A/B variants a step carries (1 = no test). */
+export function sequenceStepVariantCount(step) {
+    return sequenceStepVariantContents(step).length;
+}
+/**
+ * Deterministically assign one variant to an enrollment for a step. The same
+ * (key, step) always resolves to the same variant — replayable, evenly
+ * distributed, and previewable in a dry run before any send. `key` is the
+ * enrollment id.
+ */
+export function selectStepVariant(step, key) {
+    const contents = sequenceStepVariantContents(step);
+    if (contents.length === 0)
+        return { variantId: "a", index: 0, content: {} };
+    const index = contents.length > 1 ? hashVariantKey(`${key}:${step.id}`) % contents.length : 0;
+    const content = contents[index] ?? contents[0] ?? {};
+    return { variantId: sequenceVariantLabel(index), index, content };
+}
+// ===== Send windows =====
+function hhmmToMinutes(value) {
+    const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+    if (!match)
+        return null;
+    const hours = Number(match[1]);
+    const minutes = Number(match[2]);
+    if (hours < 0 || hours > 23 || minutes < 0 || minutes > 59)
+        return null;
+    return hours * 60 + minutes;
+}
+const ISO_WEEKDAY = { Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6, Sun: 7 };
+/**
+ * Resolve which IANA timezone a send window evaluates in for a given lead row.
+ * "recipient" mode reads the lead's tz from `recipient_timezone_column`, falling
+ * back to the window's fixed `timezone` when the column is absent/blank.
+ */
+export function resolveSendWindowTimezone(window, rowValues) {
+    if (window.timezone_mode === "recipient" && window.recipient_timezone_column) {
+        const raw = rowValues?.[window.recipient_timezone_column];
+        if (typeof raw === "string" && raw.trim())
+            return raw.trim();
+    }
+    return window.timezone;
+}
+/**
+ * Is `now` inside the send window, evaluated in `timezone` (already resolved for
+ * recipient mode via resolveSendWindowTimezone)? Pure; Intl only
+ * (client-bundle-safe). An unresolvable timezone or malformed window fails OPEN
+ * (returns true) so a bad tz never permanently strands an enrollment — the hard
+ * send caps still bound it. A window with no `days` allows every weekday;
+ * start>end wraps past midnight.
+ */
+export function isWithinSendWindow(window, now, timezone) {
+    const tz = timezone?.trim() ? timezone.trim() : window.timezone;
+    const parts = tzParts(now, tz) ?? tzParts(now, window.timezone) ?? tzParts(now, "UTC");
+    if (!parts)
+        return true; // unresolvable tz → fail open (caps still apply)
+    const startM = hhmmToMinutes(window.start);
+    const endM = hhmmToMinutes(window.end);
+    if (startM === null || endM === null)
+        return true; // malformed window → fail open
+    if (window.days && window.days.length > 0 && !window.days.includes(parts.isoWeekday))
+        return false;
+    if (startM === endM)
+        return false; // empty window
+    const minutes = parts.hour * 60 + parts.minute;
+    return startM < endM ? minutes >= startM && minutes < endM : minutes >= startM || minutes < endM;
+}
+function tzParts(now, tz) {
+    try {
+        const formatted = new Intl.DateTimeFormat("en-US", {
+            timeZone: tz, hour12: false, weekday: "short", hour: "2-digit", minute: "2-digit",
+        }).formatToParts(now);
+        let hour = 0;
+        let minute = 0;
+        let weekday = "Mon";
+        for (const part of formatted) {
+            if (part.type === "hour")
+                hour = Number(part.value) % 24;
+            else if (part.type === "minute")
+                minute = Number(part.value);
+            else if (part.type === "weekday")
+                weekday = part.value;
+        }
+        return { hour, minute, isoWeekday: ISO_WEEKDAY[weekday] ?? 1 };
+    }
+    catch {
+        return null;
+    }
+}
+// ===== Validation helpers for variants + send windows =====
+function normalizeVariants(raw, path, fields, issues) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        issues.push({ path, message: "variants must be an array." });
+        return undefined;
+    }
+    if (raw.length === 0)
+        return undefined;
+    if (raw.length > MAX_STEP_VARIANTS - 1) {
+        issues.push({ path, message: `at most ${MAX_STEP_VARIANTS - 1} alternate variants (the base step is variant "a").` });
+    }
+    const out = [];
+    raw.slice(0, MAX_STEP_VARIANTS - 1).forEach((entry, i) => {
+        if (!isRecord(entry)) {
+            issues.push({ path: `${path}[${i}]`, message: "each variant must be an object." });
+            return;
+        }
+        const variant = {};
+        for (const field of fields) {
+            const value = entry[field];
+            if (value === undefined || value === null)
+                continue;
+            const template = requiredTemplate(value, `${path}[${i}].${field}`, issues);
+            if (template !== undefined)
+                variant[field] = template;
+        }
+        if (Object.keys(variant).length === 0) {
+            issues.push({ path: `${path}[${i}]`, message: `a variant must override at least one of: ${fields.join(", ")}.` });
+        }
+        else {
+            out.push(variant);
+        }
+    });
+    return out.length > 0 ? out : undefined;
+}
+function normalizeSendWindow(raw, path, issues) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (!isRecord(raw)) {
+        issues.push({ path, message: "send_window must be an object." });
+        return undefined;
+    }
+    const timezone = typeof raw.timezone === "string" && raw.timezone.trim() ? raw.timezone.trim() : undefined;
+    if (!timezone)
+        issues.push({ path: `${path}.timezone`, message: "timezone (IANA, e.g. America/New_York) is required." });
+    const start = normalizeHhmm(raw.start, `${path}.start`, issues);
+    const end = normalizeHhmm(raw.end, `${path}.end`, issues);
+    // A zero-width window (start === end) is never open — isWithinSendWindow
+    // returns false for every instant — so a step carrying it defers
+    // (outside_send_window) on every dispatch and the enrollment silently stalls
+    // forever (nothing sends, so the send cap never advances it). Reject it at
+    // write time instead of letting the misconfiguration strand the sequence.
+    if (start !== undefined && end !== undefined && hhmmToMinutes(start) === hhmmToMinutes(end)) {
+        issues.push({ path: `${path}.end`, message: "must differ from start — a zero-width send_window never sends." });
+    }
+    const days = normalizeWeekdays(raw.days, `${path}.days`, issues);
+    const mode = raw.timezone_mode === "recipient" ? "recipient" : "fixed";
+    const column = mode === "recipient"
+        ? optionalString(raw.recipient_timezone_column, `${path}.recipient_timezone_column`, issues)
+        : undefined;
+    if (mode === "recipient" && !column) {
+        issues.push({ path: `${path}.recipient_timezone_column`, message: 'recipient_timezone_column is required when timezone_mode is "recipient".' });
+    }
+    return {
+        timezone: timezone ?? "UTC",
+        ...(days ? { days } : {}),
+        start: start ?? "09:00",
+        end: end ?? "17:00",
+        timezone_mode: mode,
+        ...(column ? { recipient_timezone_column: column } : {}),
+    };
+}
+function normalizeHhmm(value, path, issues) {
+    if (value === undefined || value === null) {
+        issues.push({ path, message: 'is required as "HH:MM".' });
+        return undefined;
+    }
+    if (typeof value !== "string" || hhmmToMinutes(value) === null) {
+        issues.push({ path, message: 'must be "HH:MM" (00:00–23:59).' });
+        return undefined;
+    }
+    return value.trim();
+}
+function normalizeWeekdays(value, path, issues) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!Array.isArray(value)) {
+        issues.push({ path, message: "days must be an array of ISO weekdays (1=Mon … 7=Sun)." });
+        return undefined;
+    }
+    const out = [];
+    for (const entry of value) {
+        const num = Number(entry);
+        if (!Number.isInteger(num) || num < 1 || num > 7) {
+            issues.push({ path, message: "each day must be an integer 1–7 (1=Mon … 7=Sun)." });
+            continue;
+        }
+        if (!out.includes(num))
+            out.push(num);
+    }
+    return out.length > 0 ? out.sort((a, b) => a - b) : undefined;
+}
 function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }

package/node_modules/@oxygen/shared/dist/signup-lead-webhook.d.ts

@@ -0,0 +1,39 @@
+/** Request timeout shared by the direct emit and the durable worker retry. */
+export declare const SIGNUP_LEAD_WEBHOOK_TIMEOUT_MS = 10000;
+/**
+ * Classification of a signup-lead webhook target URL. Drives which internal
+ * Oxygen secret header (if any) is attached, and doubles as a log field on the
+ * emit path.
+ */
+export type SignupLeadWebhookTarget = "missing" | "external" | "oxygen_table_webhook" | "oxygen_workflow_webhook" | "oxygen_internal" | "invalid_url";
+/** True for the canonical Oxygen apex domain and its subdomains only. */
+export declare function isOxygenHostname(hostname: string): boolean;
+/**
+ * Classify a webhook target URL so the caller can decide whether to attach the
+ * internal table/workflow secret. Only genuine oxygen-agent.com hosts receive
+ * internal secrets; external hosts with Oxygen-looking paths are "external" and
+ * must never be trusted with the internal webhook secret.
+ */
+export declare function classifySignupLeadWebhookTarget(value?: string | null): SignupLeadWebhookTarget;
+/** HMAC-SHA256 hex digest of the request body keyed by the webhook secret. */
+export declare function signSignupLeadWebhookBody(secret: string, body: string): string;
+export type BuildSignupLeadWebhookHeadersInput = {
+    /** The destination URL — classified to decide the internal secret header. */
+    webhookUrl: string;
+    /** The flattened signup-lead payload (already serialized into `body`). */
+    payload: Record<string, unknown>;
+    /** The exact serialized request body the signature is computed over. */
+    body: string;
+    /** The shared webhook secret, or null/undefined to send the request unsigned. */
+    secret: string | null | undefined;
+    /** Injectable clock for the signature timestamp (defaults to the current time). */
+    now?: Date;
+};
+/**
+ * Build the complete header set for a signup-lead webhook request. Produces
+ * identical output for the request-time emit and the durable worker retry so
+ * the two transports stay in lockstep. Header values fall back to safe defaults
+ * for the worker's untyped (DB-sourced) payload; for the web emitter's typed
+ * payload the fallbacks are no-ops.
+ */
+export declare function buildSignupLeadWebhookHeaders(input: BuildSignupLeadWebhookHeadersInput): Record<string, string>;

package/node_modules/@oxygen/shared/dist/signup-lead-webhook.js

@@ -0,0 +1,78 @@
+import { createHmac } from "node:crypto";
+// Shared transport contract for the signup-lead webhook. Both the request-time
+// direct emitter (apps/web/src/lib/signup-lead-webhook.ts) and the durable
+// worker retry queue (apps/worker/src/signup-lead-delivery-queue.ts) build the
+// same HMAC signature, Oxygen table/workflow secret headers, timeout, and
+// target classification. This module is the single source of truth so the two
+// paths cannot drift when the webhook auth/header contract changes (OXY-679).
+/** Request timeout shared by the direct emit and the durable worker retry. */
+export const SIGNUP_LEAD_WEBHOOK_TIMEOUT_MS = 10_000;
+/** True for the canonical Oxygen apex domain and its subdomains only. */
+export function isOxygenHostname(hostname) {
+    return (hostname === "oxygen-agent.com" || hostname.endsWith(".oxygen-agent.com"));
+}
+/**
+ * Classify a webhook target URL so the caller can decide whether to attach the
+ * internal table/workflow secret. Only genuine oxygen-agent.com hosts receive
+ * internal secrets; external hosts with Oxygen-looking paths are "external" and
+ * must never be trusted with the internal webhook secret.
+ */
+export function classifySignupLeadWebhookTarget(value) {
+    const target = typeof value === "string" ? value.trim() : "";
+    if (!target)
+        return "missing";
+    try {
+        const url = new URL(target);
+        if (!isOxygenHostname(url.hostname))
+            return "external";
+        if (url.pathname.startsWith("/api/webhooks/tables/")) {
+            return "oxygen_table_webhook";
+        }
+        if (url.pathname.startsWith("/api/webhooks/workflows/")) {
+            return "oxygen_workflow_webhook";
+        }
+        return "oxygen_internal";
+    }
+    catch {
+        return "invalid_url";
+    }
+}
+/** HMAC-SHA256 hex digest of the request body keyed by the webhook secret. */
+export function signSignupLeadWebhookBody(secret, body) {
+    return createHmac("sha256", secret).update(body).digest("hex");
+}
+/**
+ * Build the complete header set for a signup-lead webhook request. Produces
+ * identical output for the request-time emit and the durable worker retry so
+ * the two transports stay in lockstep. Header values fall back to safe defaults
+ * for the worker's untyped (DB-sourced) payload; for the web emitter's typed
+ * payload the fallbacks are no-ops.
+ */
+export function buildSignupLeadWebhookHeaders(input) {
+    const { webhookUrl, payload, body, secret } = input;
+    const now = input.now ?? new Date();
+    const headers = {
+        "content-type": "application/json",
+        "x-event-id": headerString(payload.event_id) ?? "",
+        "x-event-type": headerString(payload.type) ?? "signup_lead.event",
+        "x-event-time": headerString(payload.occurred_at) ?? now.toISOString(),
+        "x-oxygen-signup-source": headerString(payload.source) ?? "clerk",
+    };
+    if (secret) {
+        headers["x-oxygen-webhook-signature"] =
+            `sha256=${signSignupLeadWebhookBody(secret, body)}`;
+        headers["x-oxygen-webhook-signature-algorithm"] = "hmac-sha256";
+        headers["x-oxygen-webhook-signature-timestamp"] = String(Math.floor(now.getTime() / 1000));
+        const target = classifySignupLeadWebhookTarget(webhookUrl);
+        if (target === "oxygen_table_webhook") {
+            headers["x-oxygen-table-webhook-secret"] = secret;
+        }
+        else if (target === "oxygen_workflow_webhook") {
+            headers["x-oxygen-workflow-secret"] = secret;
+        }
+    }
+    return headers;
+}
+function headerString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}

package/node_modules/@oxygen/shared/dist/sql-error.d.ts

@@ -33,5 +33,17 @@ export declare function sqlErrorFields(error: unknown): Record<string, unknown>;
  * the generic error serializers would otherwise emit those values verbatim.
  */
 export declare function redactSqlParameters(text: string): string;
+/**
+ * True when the error is a Postgres serialization failure (40001) or deadlock
+ * (40P01) — the two "the transaction was aborted as a concurrency victim, retry
+ * the whole transaction" outcomes. Postgres aborts exactly one transaction in
+ * such a conflict and lets the other commit, so re-running the victim's
+ * transaction almost always succeeds once the winner has committed. Callers use
+ * this both to drive a bounded transaction retry and to surface a typed,
+ * retryable error (instead of an opaque unexpected_error) when retries are
+ * exhausted. Reuses the same SQLSTATE classifier as the telemetry helpers so the
+ * 40001/40P01 knowledge lives in one place. Never throws.
+ */
+export declare function isRetryableConcurrencyError(error?: unknown): boolean;
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export declare function sqlErrorTelemetryAttributes(error: unknown): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -146,6 +146,21 @@ export function redactSqlParameters(text) {
         return text;
     return text.replace(/\n[ \t]*params[ \t]*:[\s\S]*?(?=\n[ \t]*at\s|$)/i, "");
 }
+/**
+ * True when the error is a Postgres serialization failure (40001) or deadlock
+ * (40P01) — the two "the transaction was aborted as a concurrency victim, retry
+ * the whole transaction" outcomes. Postgres aborts exactly one transaction in
+ * such a conflict and lets the other commit, so re-running the victim's
+ * transaction almost always succeeds once the winner has committed. Callers use
+ * this both to drive a bounded transaction retry and to surface a typed,
+ * retryable error (instead of an opaque unexpected_error) when retries are
+ * exhausted. Reuses the same SQLSTATE classifier as the telemetry helpers so the
+ * 40001/40P01 knowledge lives in one place. Never throws.
+ */
+export function isRetryableConcurrencyError(error) {
+    const cause = describeSqlError(error)?.cause;
+    return cause === "serialization" || cause === "deadlock";
+}
 /** Telemetry-attribute shape (dotted keys) for span error attribution. */
 export function sqlErrorTelemetryAttributes(error) {
     const attribution = describeSqlError(error);

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.177.1";
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";
+export declare const OXYGEN_VERSION = "1.209.6";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,6 +1,8 @@
-export const OXYGEN_VERSION = "1.177.1";
+export const OXYGEN_VERSION = "1.209.6";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
+// 1.181.0: paid table action runs and background columns run require
+// approved=true in addition to max_credits; older CLIs cannot send the flag.
 // 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
 // (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
 // removed the old /api/cli/linkedin/* routes — older CLIs would 404.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/workflow-trigger-metadata.js

@@ -5,10 +5,7 @@ export const WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS = [
     "auto_paused_at",
     "auto_pause_reason",
 ];
+const WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEY_SET = new Set(WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS);
 export function clearWorkflowTriggerAutoPauseMetadata(metadata) {
-    const next = { ...metadata };
-    for (const key of WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS) {
-        delete next[key];
-    }
-    return next;
+    return Object.fromEntries(Object.entries(metadata).filter(([key]) => !WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEY_SET.has(key)));
 }

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -67,6 +67,7 @@ export type WorkflowToolStepManifest = {
     effect: WorkflowStepEffect;
     mode?: WorkflowMode;
     payload_source: string;
+    max_credits?: number;
 };
 export type WorkflowBranchStepManifest = {
     kind: "branch";
@@ -121,6 +122,7 @@ export type WorkflowManifest = {
     trigger?: WorkflowTriggerManifest;
     input_schema?: JsonSchema;
     steps: WorkflowStepManifest[];
+    max_credits?: number;
     source_hash: string;
     compiler_version: string;
     created_at: string;
@@ -139,6 +141,7 @@ export type RecipeManifest = {
     bundle_format: "esm";
     tools_used: string[];
     visual_plan?: RecipeVisualPlanManifest;
+    max_credits?: number;
     source_hash: string;
     compiler_version: typeof DURABLE_RECIPE_COMPILER_VERSION;
     created_at: string;
@@ -219,6 +222,7 @@ export type WorkflowDefinition = {
     specification?: string;
     trigger?: WorkflowTriggerDefinition;
     inputSchema?: JsonSchema;
+    maxCredits?: number;
     steps: WorkflowStepDefinition[];
 };
 export type WorkflowTriggerDefinition = WorkflowTriggerManifest;
@@ -237,6 +241,7 @@ export type WorkflowToolStepDefinition = {
     tool: string;
     effect?: WorkflowStepEffect;
     mode?: WorkflowMode;
+    maxCredits?: number;
     payload: WorkflowFunction;
 };
 export type WorkflowBranchStepDefinition = {
@@ -270,6 +275,7 @@ export declare function defineWorkflow(input: {
     specification?: string;
     trigger?: WorkflowTriggerDefinition;
     inputSchema?: JsonSchema;
+    maxCredits?: number;
     steps: WorkflowStepDefinition[];
 }): WorkflowDefinition;
 export declare function apiTrigger(input?: {
@@ -310,8 +316,22 @@ export declare function toolStep(input: {
     tool: string;
     effect?: WorkflowStepEffect;
     mode?: WorkflowMode;
+    maxCredits?: number;
     payload: WorkflowFunction;
 }): WorkflowToolStepDefinition;
+/**
+ * Conditional step. `condition` is evaluated; control then flows by mode:
+ *
+ * - then only (no `else`, no `join`) — GUARD: truthy continues to `then` (steps
+ *   between the branch and `then` are skipped); falsy skips straight to the end
+ *   of the workflow (no step after the branch runs) and the run completes.
+ * - then + else (no `join`) — skip-until-target jump to `then`/`else`; from the
+ *   chosen target, the remaining steps run sequentially through the end.
+ * - then + else + join — real if/else: the non-chosen arm is skipped and `join`
+ *   is the convergence point where shared downstream work resumes.
+ *
+ * All targets must be ids of later steps (branches are forward-only).
+ */
 export declare function branchStep(input: {
     id: string;
     description?: string;
@@ -339,6 +359,7 @@ export declare function buildRecipeManifest(input: {
     bundle: string;
     toolsUsed: string[];
     visualPlan?: RecipeVisualPlanManifest;
+    maxCredits?: number;
     sourceHash?: string;
     createdAt?: Date;
 }): RecipeManifest;
@@ -804,8 +825,10 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         };
     };
 };
+export declare function computeWorkflowPlanHash(input: Record<string, unknown>): string;
 export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
 export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
+export declare function readWorkflowRunPreApprovedLabels(metadata: Record<string, unknown> | null | undefined): string[];
 export declare function readManagedToolRunCredits(output: unknown): number;
 export type WorkflowSpendCapDecision = {
     allowed: boolean;